Message Queues and Delivery Guarantees
On this page
Why Delivery Guarantees Matter
- Networks fail and brokers retry. Messages can be duplicated or lost.
- Correctness depends on what the system promises and what consumers assume.
- Production rule: design for duplicates and define acceptable loss explicitly.
At Most Once
- Message is delivered zero or one time.
- Duplicates are avoided, but loss can occur.
- Fits non critical telemetry and best effort notifications.
At Least Once
- Message is delivered one or more times.
- Duplicates are expected, consumers must be idempotent.
- Most common production default for business events.
Exactly Once as a Goal
- True end to end exactly once is extremely hard.
- Systems approximate it with transactions, idempotency, and deduplication.
- Production rule: treat exactly once as an application level property, not a broker slogan.
Acknowledgements and Redelivery
- Consumers ack after processing completes, not before.
- If processing fails or ack is not received, broker redelivers.
- Visibility timeout and lease concepts define how long a message is in flight.
Ordering Reality
- Ordering is usually guaranteed only per partition or per queue.
- Parallelism can break ordering if not keyed carefully.
- Use keys that align with business invariants to preserve required order.
Backpressure and Load Shedding
- Queue depth is a signal of pressure.
- Scale consumers up to a limit, then shed or degrade non critical work.
- Protect downstream dependencies with circuit breakers and rate limits.
Failure Modes
- Duplicate side effects when consumers are not idempotent.
- Hot partition where one key dominates throughput and lags.
- Poison pill message blocks progress without DLQ handling.
- Unbounded retries create storms and amplify outages.
Operational Checklist
- Define retry policy with caps and jitter.
- Dead letter queue with alerting and replay procedure.
- Consumer lag dashboards and autoscaling thresholds.
- Idempotency keys and dedupe strategy for side effects.
- Runbooks for broker outage and backlog drain.