Topic: postqueue entries at too high a rate
==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.7.0
- Deployed with iRedMail Easy or the downloadable installer? downloadable
- Linux/BSD distribution name and version: Debian bookworm
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MariaDB
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? Yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
How to block users who appear to be trying to DDOS postfix?
For the past couple of weeks, the postqueue command returns 10-20 entries like this every day:
4XvfGM1lGBzHRHk 1940 Thu Nov 21 18:30:35 postmaster@example.org
(host gmail-smtp-in.l.google.com[2607:f8b0:4023:c0d::1b] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, go to 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate d2e1a72fcca58-724ea167815si1872327b3a.311 - gsmtp (in reply to RCPT TO command))
someuser@gmail.com
(In this example I've obfuscated the postmaster and recipient's emails, but otherwise this is straight from the postqueue command.)
The recipient addresses appear to be random; they don't have accounts on my system.
I can delete the postqueue entries with a command like this:
for i in `pq | cut -d " " -f 1 | grep 4X` ; do sudo/sbin/postsuper -d $i ; done
But (a) that might also delete valid postqueue entries and (b) if there's a way of addressing the root problem, I'd prefer to do that instead. Thank you!
----
Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.