What they're testing
Whether you think about backpressure and third-party limits, or only about your own throughput.
The short answer~30 seconds
10 million in 300 seconds is about 33,000 notifications a second. Don't push directly: write a campaign record, have a process expand the recipient list into batches onto a queue, and let a worker pool consume it. What decides success is the OUTBOUND rate limit: APNs, FCM and email providers each have their own quotas, so workers must be partitioned per channel with a separate throttle each — otherwise you get blocked and lose the whole send.
The long answer
Expanding the recipient list is where this usually goes wrong. Loading 10M rows into memory exhausts RAM; paging by OFFSET degrades quadratically. The correct approach is keyset pagination over the primary key, a few thousand ids per batch, recording the cursor so a crashed process resumes rather than restarting — sending duplicates to ten million people is a PR incident, not merely a technical one.
Backpressure is the concept to name. If the producer enqueues faster than workers drain, the queue grows and latency rises without bound — you're still "sending" two hours later. So the producer must watch queue depth and slow itself. It's also why a bounded queue beats an unbounded one: it converts a hidden problem into an explicit signal.
Finally, priority and isolation. Campaign notifications must not crowd out transactional ones — an OTP has to arrive within seconds even during a ten-million send. That means two separate queues with separate worker pools, not one queue with a priority field. Isolation by physical resource is far more reliable than isolation by ordering logic.
What they'll ask next
?How do you guarantee no duplicates?
You can't guarantee it absolutely under at-least-once. The pragmatic form is a sent(campaign_id, user_id) table with a composite primary key, inserted before sending; a conflict means skip. It isn't perfect — you can insert and then die before sending — but it converts "sent twice" into "might miss a few", which is the safer direction to fail.
These lose points
- Ignoring provider quotas. You don't control FCM, and being throttled by them isn't something you can fix yourself.
- One queue for every notification type. A campaign send will bury the OTP of someone trying to log in.