Dead letter queue for permanently failed sends

When a send job exhausts its retry budget and disappears silently, every permanently failed send becomes invisible. Customer support cannot answer "did we send that?", engineers cannot distinguish a flaky network blip from a systemic ESP misconfiguration, and the business has no path to replay failed communications. CWE-391 covers insufficient logging of error conditions — a missing DLQ is the queue-layer equivalent. ISO-25010:2011 reliability.recoverability requires that a system can recover from faults; a DLQ is the prerequisite for that recovery.

Set removeOnFail: false on the BullMQ queue configuration so failed jobs move to the built-in failed set instead of being deleted:

export const emailQueue = new Queue('email', {
  connection,
  defaultJobOptions: {
    attempts: 5,
    backoff: { type: 'exponential', delay: 2000 },
    removeOnComplete: { age: 86400, count: 1000 },
    removeOnFail: false
  }
})

For SQS, configure a redrive policy pointing to a DLQ with maxReceiveCount: 5. Retain at least 30 days of failed job history to satisfy audit and replay requirements.