mail sending rate limit

gosha

Hello
Enhance allows to limit mail sending rate, it is a good peace of security and will help you a little to avoid the blacklists. But rate limiting is possible only by sender's IP, I believe it is not very accurate way, for example, if you have a 2 customers with 2 different IP addresses, one has 5 emails and another 505 email, limiting the sending rate by IP will just not work. Don't you think that the limit should be based on sending account?

Dmitri.

AdamM

gosha
Yes, It's weird for me too. The limit should be set to the client's domain. Example 50 emails for hour for domain.

gosha

AdamM not even domain, because fax@domain.com and noreply@domain.com should really have different limits. For security is enough if there are one default limit per sender and ability to change it.

gosha

Also I see from the Postfix documentation that there is no simple way to make a per domain limit, but per user probably it is possible to use the 'smtpd_client_auth_rate_limit' setting.

ss88us

gosha Rate limiting per user is not possible in Postfix without a policy service like PolicyD.

Using smtpd_client_auth_rate_limit is risky because if you use Roundcube for example, every page load uses AUTH. Probably some email clients use AUTH every time they GET mail too.

KHR

I was just about to make a post about this. It's crucial for my service to restrict the sender—it's of utmost importance. However, limiting based solely on domain and IP isn't a feasible option for us.

Isaia-Arknet_PTY_LTD

When playing with limits you have to be careful as Enhance sending limit pet IP will count Server IP sending from the hosting server.

For example: if you have 100 domains and all send PHP emails, the respective limit set in enhance will count the server IP as a sender, and even if every domain sends 100 emails each, the limit is actually 100 emails x 100 domains from that IP.
This can create issues if you set up a low limit thinking that you limit an external IP (considering it is one user) and put a lower limit, like 200 emails/hour. This is not the case.

There is a lot of work to be done in the email area 🙂 with time we might get the desired functionality.