Design an Email Service (Gmail)

The ask

An email address is a name that identifies one mailbox. A sender writes to one or more addresses.

The service accepts outgoing mail from its own users. The service also accepts incoming mail from other email systems.

Each owner can read, search, organise and delete stored mail. Sending, reading and searching must stay fast at very large scale.

Accepted mail must not be lost. Unwanted mail must be filtered without hiding real mail.

Estimate the scale

300,000,000 emails arrive a day.

300,000,000 / 86,400 = about 3,472 emails per second.

The average email is 75 KB.

300,000,000 x 75 KB = 22.5 TB of new mail a day.

One mailbox holds up to 15 GB. Old mail is kept, so storage grows every day.

API and data

The send operation names the recipient addresses, the subject, the body and any attachments.

Read operations list one folder, fetch one message and search by word, sender or date.

A message record holds the sender, the recipients, the time, the subject and the read state. The record also holds folder labels.

Attachments are stored in blob storage. The message record keeps a reference to each attachment.

High-level design

An incoming gate accepts mail and places it on a queue. Workers then process each message in turn.

A filtering service scores each message for junk and harmful content. The service returns a score and the signals behind it.

A storage service writes clean mail into the owner's mailbox store. Mailboxes are sharded by mailbox identity.

A read service serves folder lists and search results. A send service hands outgoing mail to a delivery queue.

Storage and search

Sharding by mailbox keeps one owner's mail together. Reads for one mailbox touch one shard in the common case.

Each shard is replicated. A copy on another server keeps accepted mail safe when one server fails.

An inverted index maps a word to the messages containing it. The index also maps senders and dates to messages.

Search reads the index first and fetches only matching messages. Long folder lists are returned in pages.

Deep dive: filtering without losing real mail

Junk mail arrives through the same gate as real mail. Filtering must decide quickly and must stay cautious.

The filtering service combines sender reputation, message signals and the owner's own past choices. A high score means likely junk.

Clear junk is refused or filed away from the inbox. Borderline mail goes to a junk folder, never to silent deletion.

An owner can mark a message as not junk. That choice moves the message and adjusts filtering for that mailbox.

Outgoing mail is rate limited per mailbox. A taken-over mailbox cannot flood other systems for long.

Delivery and failure

A delivery worker sends outgoing mail to the receiving system. A failed delivery is retried with growing gaps.

Each message carries one unique identity. A retry checks that identity, so one message is not stored twice.

Mail that still fails lands in a dead-letter queue. The sender then gets a clear failure notice.

Evaluation and trade-offs

An email service is a store that grows every day and a search system over that store. Both halves shape the design.

The search index costs extra storage. Fast search over years of mail is worth that cost.

Stronger filtering catches more junk and risks more real mail. The junk folder balances safety against loss.

Sharding by mailbox makes one mailbox fast. Searches across all mailboxes stay slow, and they stay rare.

Email scale