Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to implement per-recipient limits for incoming mail to our Postfix MX servers, but I don't know what to use to achieve that. Postfix docs and Google searches will only give me config recipes to set up (global) incoming concurrency or throttle mails coming out of Postfix.

As an example, if a given recipient receives more than 1000 mails in the last 60 seconds, we'll block it with temporary error codes for the next 60 minutes.

So far I hadn't found anything and missing other options I'd probably try to hack together something that scans log files and edits Postfix check_recipient_access access list.

[if someone is going to ask the reason, it is spam mail coming from usually legit servers (those with good IP reputation, good PTR records, not present in any RBL, etc) to a given single recipient address. We got flooded a couple times and our amavis servers took a long time to empty the queue, we'd like to prevent that flooding]

share|improve this question

2 Answers 2

As an alternative to writing your own policy daemon you could use a mail filter like milter-limit . It seems to be doing exactly what you want. I haven't used it myself, but I have used other milters from snertsoft and they did work fine with postfix.

share|improve this answer

First I thought about making use of anvil and some kind of _rate_limits. But it's not what you look for (1000 mails within 60 seconds can come from a variety of sources).

I guess you could set it up with policy delegation and your own specific script, just like with Greylisting, where some specific conditions are counted and enforced. Here is an example of a policy daemon template. This way you are very flexible, e.g. whitelist some IP's, clients or servers and do the computation in realtime without wading through logfiles.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.