I am watching my email gateway blackhole spam messages using spamassassin - anything over a specific score.
Right now, it is dropping around 3 per second. This is great, but I would prefer the spam wasn't using up so much of the incoming capacity.
I am wondering if I can create a dynamic rule that will track the mount of blackholed emails coming from a specific IP address and throttle them if it exceeds a value, for a period of time.
I could do this with iptables, but would prefer to issue an SMTP 4xx code so they retry later - this is because gmail.com seems to be the source of some of this spam, and I want to accept email from gmail in general.
So before I go scripting something to do all this for me, is there a straightforward way?