1

Topic: postqueue entries at too high a rate

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.7.0
- Deployed with iRedMail Easy or the downloadable installer? downloadable
- Linux/BSD distribution name and version: Debian bookworm
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MariaDB 
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? Yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

How to block users who appear to be trying to DDOS postfix?

For the past couple of weeks, the postqueue command returns 10-20 entries like this every day:

4XvfGM1lGBzHRHk       1940 Thu Nov 21 18:30:35 postmaster@example.org
(host gmail-smtp-in.l.google.com[2607:f8b0:4023:c0d::1b] said: 450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, go to 450 4.2.1  https://support.google.com/mail/?p=ReceivingRate d2e1a72fcca58-724ea167815si1872327b3a.311 - gsmtp (in reply to RCPT TO command))
                                               someuser@gmail.com

(In this example I've obfuscated the postmaster and recipient's emails, but otherwise this is straight from the postqueue command.)

The recipient addresses appear to be random; they don't have accounts on my system.

I can delete the postqueue entries with a command like this:

for i in `pq | cut -d " " -f 1 | grep 4X` ; do sudo/sbin/postsuper -d $i ; done

But (a) that might also delete valid postqueue entries and (b) if there's a way of addressing the root problem, I'd prefer to do that instead. Thank you!

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: postqueue entries at too high a rate

Maybe some account was cracked and used to send spams. Check the Postfix log file to figure it out.