Without judgment intended, as a Linux sysadmin you should absolutely be monitoring mail to root. That is the standard place to deliver error output from unattended processes. You can easily /etc/alias it to something else if that's more convenient.

Sysadmin/Devops here. I send all root mail to Graylog.

That does look nice. Thanks for Graylog reference.

Graylog looks fantastic, thanks for the mention.

You'll love it. I'm pushing tens of thousands of messages per second into a cluster, and it works like a champ.

So the default behavior is to only email root unless crontab is edited, therefore most people would never receive an email (in case of renew failure), if they only followed the instructions given.

Otherwise mail is sent to the owner of the crontab.

If your server isn't set up to forward root's cron E-Mail to you you have bigger problems than your let's encrypt certs not renewing.

A properly administered Linux system would be emailing root mail to a real email address unless monitored by another system. I've never worked in a professional environment where root mail was left unread at any point. Root aliases (excluding environments with other monitoring) are on the checklist for any basic image(server) deployment. It's a standard, well-adopted practice.

cron error reporting via email is an established solution. Why reinvent the wheel?

I'd agree that a hint regarding MAILTO= in the crontab file would be neat.

Getting off-topic here, but whenever I do a new Debian build one of the items on my checklist is to edit /etc/aliases to add either my actual login user or a real email address (depending on the server setup) as an alias for root.

You are doing your Debian installs with debconf set way too high. I always set debconf to "low" but I am 99% positive this is a default question during installation.

Interesting. I'll try that next time. Thanks!