A shared sending interface keeps sender configuration and message evidence consistent across application modules.
Recipient-level records
Distinguish one logical send intent from its individual To, CC and BCC recipients. Keep a configurable sender and reply-to identity. Record enough correlation and timing information to reconcile an outcome without copying credentials, message bodies or attachments into ordinary logs.
Statuses and delivery evidence
Acceptance, queueing and confirmed delivery are different facts. Preserve recipient-level outcomes and reliable delivery evidence. An uncertain response must remain uncertain until reconciled.
Failures and duplicate avoidance
Use a stable business idempotency key for retries of the same intent. Reusing that key for different content is a conflict; identical content alone cannot identify independent sends. A storage failure before dispatch should prevent an untracked send. If persistence fails after dispatch, keep the registered intent and recovery reference, and reconcile before attempting another physical message.
Keep provider-specific credentials and transport configuration outside public documentation and ordinary message records. Authorize access to recipient details, including BCC.