Detect and classify the failure

Separate authentication/permission errors, quota/rate limits, provider 5xx, timeout, DNS/TLS failure, malformed response, and unsupported request. A credential error requires operator action; a timeout may justify a bounded retry. Never translate either to “not listed,” “valid,” or “pass.”

Track latency, error class, queue age, and success rate by provider/operation without logging submitted addresses or tokens. Compare with the provider’s authenticated status channel when available, but trust your own request evidence too.

Stop amplification

Set connection and total timeouts, limited attempts with exponential backoff and jitter, global/provider/account concurrency and rate limits, and a circuit breaker. When the threshold opens, stop new upstream calls for a cool-down and return a typed unavailable result. Deduplicate identical in-flight work with idempotency keys.

Do not rotate credentials, egress IPs, or public resolvers to evade provider controls. Honor Retry-After when valid and bounded by your job expiry.

Decide what users see

For synchronous pages, state that the capability is temporarily unavailable and avoid collecting data if no work can be performed. For queued work, preserve queued, retrying, partial, failed, and expired distinctly, with a safe next-check time. Do not keep browser polling indefinitely.

A cached result may be shown only if its original observation time, source, and expiry are visible and the product contract allows it. Never relabel stale as current.

Use fallbacks deliberately

Enable a secondary provider only if it has approved licensing, equivalent privacy/authorization controls, mapped semantics, tested limits, and explicit provenance in the result. Different coverage cannot be merged silently. For high-risk network checks, unavailable may be the safest fallback.

Recover gradually

Probe with a bounded health request, half-open the circuit, and release queued work at a controlled rate. Protect against a thundering herd. Confirm response-contract validity before closing the incident.

Run fixture tests for every failure and recovery state. The outage response is successful when it protects the provider and your queues, tells users the truth, and resumes without duplicate paid/network actions.