Goal: a closed loop from delivery events to suppression state.

Step 1. Enable the Event Webhook in Settings > Mail Settings > Event Notification with a dedicated HTTPS URL. Enable signature verification and store the public key.

Step 2. In the receiver, verify each POST: ECDSA over the timestamp concatenated with the raw body bytes. Reject failures and log them; never re-serialize parsed JSON before verifying.

Step 3. Return 2xx immediately and queue processing. Slow handlers cause retries and duplicate deliveries to your endpoint.

Step 4. Route events: bounce with a 5xx status goes to the do-not-mail store; spamreport goes there permanently; unsubscribe/group_unsubscribe updates the preference store. Deferred events just update the delivery log.

Step 5. Gate every send on the do-not-mail store. Check suppression state before building the recipient list, not after the 202.

Verify: a test hard bounce produces a bounce event that lands the address in the store, and the next campaign excludes it. Pitfall: delayed bounces can arrive without a message ID; match on email address.