Poison Message
A record that a consumer cannot process and cannot skip, which halts its partition entirely until someone intervenes.
In an ordered log, a consumer that fails on a record and retries indefinitely stops making progress. Because ordering is per partition, everything behind that record in the same partition stops too — so one malformed message can stall a material share of a pipeline.
The record is usually not malicious: a schema violation from an unvalidated producer, an unexpected null, a value that overflows a downstream column, or a reference to an entity that no longer exists.
The handling has three parts, and skipping any one of them produces a different failure. Bounded retries, because some failures are transient and some are permanent, and treating them identically means either giving up on recoverable errors or blocking forever on unrecoverable ones. A dead letter destination with the original record and the failure context, so the pipeline advances. An owner and an alert, because the classic outcome is a dead letter queue that accumulates for months while everyone assumes someone is watching it.
The design question that follows is whether skipping is acceptable at all. For analytical aggregation it usually is, provided the count is visible. For a financial ledger it is not, and the correct behaviour is to stop and escalate — which is a legitimate choice as long as it was chosen.