Per-client limits

• Back to SMTP main service

Per-client limits cap how much one client address may submit to your SMTP service per time unit: simultaneous sessions, new connections, messages and recipients. 
A client that goes beyond a limit receives a temporary error: its mail waits on its own side and is retried later, instead of flooding your relay and the providers behind it. 
Unlike the Postfix default, the limits also apply to your own networks, which is where most floods come from.

The feature is available from the menu SMTP Router > Inbound flow > Per-client limits.

Functional benefits

• Protects your sending reputation. When an internal job suddenly sends tens of thousands of messages, the large providers (Microsoft 365, Gmail, Yahoo…) start rate-limiting or refusing all mail from your relay, including the legitimate mail of every other user. Capping the runaway source keeps the rest of the company's mail flowing.
• Closes the trusted-network blind spot. By default Postfix never limits a host of its trusted networks. Application servers, schedulers, ETL jobs and monitoring tools all sit there, and they are precisely the population that floods a relay. Here, the limits reach them unless you decide otherwise.
• Loses no mail. The answer to a client over its limit is a temporary error (450 4.7.1 Error: too much mail from …). A well-behaved client keeps the message and retries; the surge is spread over time instead of being refused.
• Never throttles the server itself. Loopback addresses are always exempt: the quarantine re-injection, the webmail and the local content filters keep working at full speed.
• Shows what is really applied. The values in force are read back from Postfix after each save.

Concepts

What is counted

Every counter is kept per client IP address by the Postfix anvil service, over a sliding time unit (60 seconds by default, between 10 seconds and 1 hour):

A value of 0 means no limit. The proposed values stay far above what any single legitimate host sends through a typical gateway, while cutting a runaway job down to a rate your relay and its peers absorb.

Exempt clients

• Always exempt: 127.0.0.0/8 and [::1]/128. This cannot be removed.
• Exempt your networks: off by default. Switching it on restores the Postfix behaviour, where every host of mynetworks escapes the limits.
• Exempt addresses: your own list, one IP address or network per line (up to 500). Host names are refused: the limits match the client address, and a name would make the exemption depend on a DNS answer at every connection. A network written with host bits (10.1.2.77/24) is stored as 10.1.2.0/24, and /0 is refused.

Important: an exempt client escapes every limit of this page, the simultaneous sessions included. This is why the session limit is a field of the page: when your networks are no longer exempt, an internal relay or load balancer that legitimately opens many sessions needs either a higher value or its own exemption.

Use cases

• A runaway application server. A scheduler or an ETL job loops and submits the same report thousands of times. With 300 messages per minute, the excess is deferred at its source; the Volume alerts tell you which address and which sender are responsible.
• A compromised workstation or a stolen account. A machine of your network that starts sending spam is slowed down to the limit instead of saturating your queue and getting your public IP blacklisted.
• Bulk senders you trust. A newsletter platform or a mass-mailing server inside your network: add its address to the exempt addresses rather than raising the limits for everybody.
• Internal relays and load balancers. Hosts that concentrate the traffic of many users behind one address: exempt them, or raise the simultaneous sessions and the message limit to match their real load.
• Together with per-domain rate limiting. Per-client limits control what enters your relay; the per-domain rate limiting of the SMTP Router controls how fast mail leaves towards one provider. The first prevents the surge, the second keeps a provider from rate-limiting you while a backlog drains.

Configure

• Nothing is applied to Postfix until you save the Parameters form once. Before that, the page shows a warning and the values are only a proposal.
• Saving applies the limits and reloads Postfix: they take effect for new sessions immediately.
• Disable the feature (left widget) removes every parameter managed by this page: Postfix returns to its defaults (50 simultaneous sessions, no rate limit, trusted networks exempt).
• With several SMTP instances, each instance has its own limits.

Choosing values. Before tightening the limits, open the Clients this hour tab of the Volume alerts: it lists how many messages each client address submitted over the last 60 minutes. Set the message limit well above the largest legitimate client.

Check that it works

In the lab, with a limit of 3 messages per minute and the trusted networks not exempt, five messages sent in a row from one host gave:

message 1, 2, 3  -> 250 accepted
message 4, 5     -> 450 4.7.1 Error: too much mail from 192.168.1.142

The same five messages submitted from 127.0.0.1 were all accepted: loopback stays exempt.

Related pages

• Volume alerts: be warned when a client submits an unusual volume, or when a provider starts rate-limiting your server.
• SMTP protocol hardening.
• SMTP AutoBlock: block abusive external clients at the firewall.
• Artica SMTP Edition.