A dead letter queue with nobody reading it is a bin

Moving failed messages out of the main flow keeps the system healthy and does nothing on its own about the messages.

what a dead letter queue needs to be more than a bin:

  an alert when anything lands in it, with the reason
  a retention long enough to investigate — 14 days
  a documented replay path, tested at least once
  an owner, by name
  a count on a dashboard somebody sees daily

without these it is a table with 41,000 rows in it and
an interesting story about last February.

The replay path is the part that is never tested until it is needed, and it is the part most likely to be broken — a message from three weeks ago may not deserialise against today’s code. Alerting on arrival rather than on depth is what catches the first failure instead of the four hundredth. A count that nobody looks at daily is functionally zero.