Message delivery semantics

Kafka's delivery guarantees break down into the durability of publishing and the guarantees when consuming. The three models are at most once (messages may be lost but are never redelivered), at least once (messages are never lost but may be redelivered), and exactly once (each message is processed once and only once). A published message is considered committed only when all in-sync replicas have applied it to their log, and a committed message is not lost as long as one broker replicating that partition remains alive. A producer hitting a network error cannot tell whether the message was committed before or after the failure; before 0.11.0.0 the only option was to resend, yielding at-least-once semantics. Since 0.11.0.0 the producer supports an idempotent delivery option — the broker assigns each producer an ID and deduplicates using a per-message sequence number — and transactions that write to multiple topic partitions atomically. Producers trading durability for latency can send fully asynchronously or wait only for the leader. On the consumer side, saving the position before processing gives at-most-once, while processing before saving the position gives at-least-once. Scope: Apache Kafka. Reviewed October 4, 2026.