Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We need to slow down the rate email spam is sent through the Exchange system from our developers' buggy applications.

How can I throttle email messages in Exchange 2010 by Source IP, or sender, so that the messages in question are not deleted, rather, are delayed, slowed down, or blocked dynamically based on the quantity or spam-ishness of the message.

share|improve this question
5  
Get your developers to fix their buggy apps? –  Ben Pilbrow Oct 18 '11 at 20:11
1  
@Ben You showed the correct way. But I want to know the answer, too. Under normal (phishing) conditions. –  mailq Oct 18 '11 at 20:15
    
I'm with Ben and mailq on this one... Good luck with that though. With regards to delaying, I'd suggest you maybe dedicate a queue specifically to the user and deal with it like that. See priority queuing, see limitations on queues. Yes, dedicating a queue is ridiculous. –  mbrownnyc Oct 18 '11 at 20:23
    
@mbrownnyc Thank you for your constructive answer... Getting people to do things right sometimes takes too long, and so I have to implement protections to the infrastructure now. I welcome any additional constructive ideas focused on this effort. –  makerofthings7 Oct 18 '11 at 20:26

1 Answer 1

up vote 2 down vote accepted

Ultimately, your developers need to fix their apps. Exchange can handle an obscene number of incoming messages concurrently, so if your developers are creating that much email that you're concerned it's having an impact on the day-to-day stuff then you have serious problems. Is this actually causing you a problem, or are you just imagining you have a problem that really doesn't exist? Check out the Exchange performance counters and get some statistics to back up your claim.

If it were my Exchange server they were thrashing, and I'd verified there was a genuine problem, I'd go to their manager with my concerns (backed with statistics) and tell them to sort their apps out or risk being blocked from sending email completely. If the app is still in development then that's sort of a valid excuse for buggy emails, but it really should be using a separate SMTP server and not the production Exchange server.

Exchange 2010 does have throttling policies which I guess you could (ab)use dependant on your setup, but the scenarios they apply to when you want to throttle non-mailbox objects is pretty narrow (IMO). If the emails are coming from a service running on a machine as NETWORK SERVICE (including a web server) then you can apply a throttling policy to a computer object. What's more likely though is this is a client app run as whatever user happens to be logged on, in which scenario I don't believe you'll be able to throttle using Exchange. I don't believe you can throttle by client IP address either, which is a bit annoying I have to admit.

If you do fall into the category of an app running as NETWORK SERVICE, you can create a new throttling policy and apply it to Active Directory computer objects. The value you'll want to throttle on is probably MessageRateLimit, which is messages per minute. If more messages than the throttling policy are submitted, the app will receive a transient error. The documentation is not very specific on whether it will actually accept the message and delay delivery or temporarily reject it, but your apps really should have some mechanism to handle transient errors anyway so that shouldn't be an issue. The commands to set this up would be New-ThrottlingPolicy -Name "Naughty Apps" -MessageRateLimit 50 and then Set-ThrottlingPolicyAssociation -Identity COMPUTERNAME$ -ThrottlingPolicy "Naughty Apps".

If you don't fall into the app running as NETWORK SERVICE category, then I'm not sure there's anything you can do from within Exchange. You may be able to set up something like Postfix and configure your app to send messages to that server instead, which would then relay them onto your Exchange server at a slower rate. I'm really out of my knowledge area to suggest any actual details though.

share|improve this answer
    
What do you think about having all the apps (Unix and whatnot) relay to IIS SMTP and smart host to Exchange. Then smart host with named credentials svc_smtp_applications by clicking on "Delivery" and "Outbound Security". Now rather than set permissions on Network Service perhaps just set the throttling on this account? –  makerofthings7 Oct 19 '11 at 14:30
1  
@makerofthings7 that sounds good in theory. I'm not really familiar with the IIS SMTP server, but if it can send authenticated mail as a specific mailbox then that would be perfect - you can do Set-Mailbox <<Your IIS Service account>> -ThrottlingPolicy "Naughty Apps". To test it, set the MessageRateLimit to something stupid like 1 and send a few messages. You should (hopefully) see them being deferred in the event logs of the IIS server. With a bit of luck, this should hopefully be exactly what you're after. –  Ben Pilbrow Oct 19 '11 at 16:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.