SES Throttling

[DanielKitchen8001]

Hi

We have a requirement to remove throttling for emails sent by AmazonSES but I’d rather not remove all throttling for the whole of AmazonSES, just the emails from our 3rd party who are using AmazonSES to send from our domain and copying in emails to us (e.g. FROM geoff@example.com  CC tom@example.com

Sender Domain: eu-west-2.amazonses.com

We use Cisco Cloud Gateway C100V.

Is this achievable? 

TIA

[Ken Stieers]

Create a new sender group in the Host Access Table for the inbound listener, add the IPs for AmazonSES.
Create a mail flow policy with the throttling settings you want, set it on the sender group you created.

You'll still be limited by the max set on the listener, and you probably still want to set this low enough so that it can't ddos you.

The hard part is figuring out what all the ips are for AmazonSES. I'd start by digging in the logs for all of the ones that you have gotten mail from so far...

[DanielKitchen8001]

Thanks for your response. On the sender group I can see that hostnames are accepted. Is the below valid? 

In my custom mail flow policy, can I add an exception so that if the mail is From: @example.com, it will bypass the throttling limits? 

[Ken Stieers]

It should be.

You probably want to use a leading dot, I think the mail comes from something like .eu-west-2.amazonses.com, so it won't match.

[DanielKitchen8001]

I've followed your recommendation and can see emails are matching the new sender group... is there anything we can do bypass the throttling based off the From: address? I've tried adding an exception via the address list but not sure if that is referring to the sender domain? 

[Ken Stieers]

You've added an exception where?

[DanielKitchen8001]

I created an entry in the address lists for our domain @example.com under HAT and added this to the exceptions in the mail flow policy:

But I'm guessing in this scenario, the sender is actually the .amazonses domain and not our actual @example.com domain. So I was looking for away to inspect the "From:" address and if that is @example.com, bypass the mail flow rate limits. 

[Ken Stieers]

Yeah.. that will only work for the envelope sender... you may still be able to pin that down, there is a little flexibility in address lists.