okay thanks, i'll have a look into that.

on a related note then, is there any way that the defaults for the throttling tab can be set for all new domains and/or inboxes? so for example... all new domains have the 'Number of max outgoing emails' set to 100 per hour and all new inboxes have their 'Max size of single outgoing email' set to 10mb?

also i think a feature that might be useful to consider for the future would a checkbox which would allow you to auto-suspend inboxes or domains based on certain thresholds being reached. I dont know if this would be helpful to anyone else but we are quite paranoid about sending limits as we use amazon SES as our SMTP relay and we have had a few cases where throttling has failed and we have been suspended.

yes i understand.

i think we're a bit closer to understanding the problem but unfortunately we've had a massive compromise again this morning with 45,000 emails being sent from 1 account. Having spent some time last week writing the throttle database entries manually to only apply to domains, it seems that iredmail has once again added entries for some individual inboxes, thus overriding our per-domain settings.

Here is what we think is happening... It seems that when an email is *received* by the server an entry gets added to the throttle table automatically. I presume this is by design in order to throttle inbound email from specific sources. The problem is that it seems that emails sent locally (between 2 accounts on our mail server) are also causing an entry to be added. Because the priority for individual inboxes is higher, and the default settings for an inbox are really high (see screenshot) they make the per-domain rules useless.

If anyone can offer any suggestions, what i need to do is prevent local addresses from getting their throttle limits set automatically by the system. Currently when i wipe the throttle table so it only contains the @domain.com rules, it starts to get written to again almost instantly as emails start to arrive. (see screenshot 2 for default inbox limits being set by the system)

I know a quick fix would be to change the priority values so that the per domain values were ahead of per inbox, but we want something more long term because in some cases we do set certain inboxes to have higher hourly send limits

in case anyone is interested, the SQL command im using to flush all non-domain rules from the throttle table is;
DELETE FROM `throttle` WHERE _from NOT LIKE '@%'

# postconf smtpd_recipient_restrictions

smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_policy_service inet:127.0.0.1:10031

-------------------------------------------------------

# postconf smtpd_end_of_data_restrictions

smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10032

i know what the source is, thats not a problem. i believe they were sent by a sasl authenticated user (probably our clients machine has malware installed)

are you saying that with my current configuration throttling is essentially disabled for all sasl authenticated users? how do i address this?

my problem is that the throttle table is being populated automatically my iredmail whenever a user sends an email. I dont want to have to set throttle limits for every single inbox but if i dont they automatically receive the throttle settings displayed in my screenshot(s) and automatically take priority over the per-domain settings i have.

currently throttling is useless to me because if i only allow 20 per hour per domain and then ired automatically sets each inbox to 512 per hour, then 512 emails can be sent before we even notice.

Please just use iRedMail default setting:

This is working as expected, Policyd/Cluebringer need to log it to track throttling.

It's ok. But in the latest iRedMail, we set them in 'smtpd_helo_restrictions' instead:

smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_helo_access pcre:/etc/postfix/helo_access.pcre

Note: Not all HELO hostnames are resolvable in DNS, so please be careful with 'reject_unknown_helo_hostname'.

<> is called null sender, it's used by Postfix to send non-delivery notification and other notification emails.
It's hard to say whether this is used by spammer or not, you have to check mail log to figure it out.