KumoMTA uses RocksDB for the queue spool. Survives crashes and reboots, but a dead node's queues are stuck on that node's disk.
Two patterns for resilience:
1. Pair of nodes per shard with shared NVMe / DRBD storage. If node A dies, node B mounts the spool and resumes. Fastest failover but ops-heavy.
2. Active/active with brief duplicate-send tolerance. Spool stays local. If a node dies, route new mail to surviving nodes. Mail already on the dead spool waits for recovery (usually <30 min on modern infra). Tolerate brief delays for resilience simplicity.
Most ESPs choose #2. Plus they maintain hot spares ready to mount a snapshot from object storage.
Backup the spool: RocksDB checkpoints can be copied to S3 hourly. Restore-on-new-node tested quarterly.
Sign in to keep track of what you have read.