D. J. Bernstein
Internet mail
Mail disasters

Mailers that can't handle temporary problems

MUAs that don't check the sendmail exit code

Some MUAs send messages in the background---and never notice if something goes wrong! They lose mail whenever the machine is low on memory or disk space.

BSD Mail: On fork() failures, mail1() calls savedeadletter(), which ignores write errors. On exec() failures, mail1() prints a message but doesn't call savedeadletter(). On sendmail failures, mail1() doesn't even print a message; it throws away the sendmail exit code.

Emacs: sendmail-send-it reportedly ignores errors.

Automated mail generators

cron: cron logs its activities by sending mail messages. If it sees a sendmail error, it puts a notice into syslog but throws away the contents of the message.

MUAs that save mail

On the bright side, some MUAs have sensible error handling.

Mew reportedly checks the sendmail exit code.

mutt reportedly checks the sendmail exit code by default.