mail sending rate limit

gosha

Hello
Enhance allows to limit mail sending rate, it is a good peace of security and will help you a little to avoid the blacklists. But rate limiting is possible only by sender's IP, I believe it is not very accurate way, for example, if you have a 2 customers with 2 different IP addresses, one has 5 emails and another 505 email, limiting the sending rate by IP will just not work. Don't you think that the limit should be based on sending account?

Dmitri.

AdamM

gosha
Yes, It's weird for me too. The limit should be set to the client's domain. Example 50 emails for hour for domain.

gosha

AdamM not even domain, because fax@domain.com and noreply@domain.com should really have different limits. For security is enough if there are one default limit per sender and ability to change it.

gosha

Also I see from the Postfix documentation that there is no simple way to make a per domain limit, but per user probably it is possible to use the 'smtpd_client_auth_rate_limit' setting.

ss88us

gosha Rate limiting per user is not possible in Postfix without a policy service like PolicyD.

Using smtpd_client_auth_rate_limit is risky because if you use Roundcube for example, every page load uses AUTH. Probably some email clients use AUTH every time they GET mail too.