unusually high Emails Being sent

Stewart85

I have just started to get emails from my server provider saying that

(Enhance Master server). The level of SMTP traffic on port 25/tcp is unusually high and at this pace you will hit the limit soon and all connections on this port will be blocked until the next day.

I do have an email role set up on that server. I don't see it sending large amounts of email

Is there any way to see what is being sent from the email role in enhance, and also the email role is using smtp port 465 not 25 so if I bl;ock port 25 on that server will the email role still work

Thanks

cPFence

Stewart85

Check the logs to see what’s going on:
/var/log/mail.log
/var/log/postfix.log

Or enable the Rspamd WebUI, it gives you a handy overview of mail activity.

Stewart85

cPFence thanks for the info, I think I have found where it's coming from

Jul 10 00:00:34 ← Timestamp (July 10th at 00:00:34, server’s local time) smtp-1-uk1 ← Hostname of your mail server postfix/cleanup[184528]: ← The Postfix “cleanup” daemon (PID 184528) handling message cleanup AAD47141A46: ← Postfix queue ID for this message milter-reject: ← Indicates a milter (mail filter) has issued a reject END-OF-MESSAGE ← The rejection happened at the end of the DATA phase from unknown[179.220.67.220]: ← The connecting client: reverse‑lookup failed, IP 179.220.67.220 4.7.1 Ratelimit "smtp_auth_limit_hourly" exceeded; ← SMTP response code 4.7.1, with text saying the policy named “smtp_auth_limit_hourly” was hit from=<admin@guardscheduler.com> ← Envelope sender address to=<elainemar2002@yahoo.com.br> ← Envelope recipient address proto=ESMTP ← Protocol used (ESMTP) helo=<b3dc43dc.virtua.com.br> ← The HELO/EHLO string the client presented

In plain terms:
A client at IP 179.220.67.220 tried to send mail as admin@guardscheduler.com to a Yahoo Brazil address, but your Postfix milter policy “smtp_auth_limit_hourly” blocks clients who authenticate (or attempt to send) more than a certain number of messages per hour. Once that threshold was reached, the filter dropped this email with a “4.7.1 Rate limit exceeded” error.