Throttling email from a sender

[GRAHAM CAREY]

Hi Guys,

Our Ironport C170 just got hammered by high amount of inbound emails sent with the same subject from one sender to one recipient.

What we want to do is create a rule "if sender sends more than 100 messages in a minute return code 425". We don't want the sender to be static.

Is there any way we can achieve this?

Regards

[martin.eppler]

Hello Graham,

I think the "Rate Limit for Envelope Senders" option in the Mail Flow Policy section "Mail Flow Limits" could help you further here.  

Best regards,

Martin

[GRAHAM CAREY]

Hi Martin,

Thank for you answer but want to make sure if i understand you correctly.

Even though sender sends high amount of emails to one recipient each email is treated as separate recipient for Ironport?

e.g. setting "Max. Recipients Per Time Interval:" to 100 will allow only 100 emails to be sent to example@example.com from sender@example.com ?

Best Regards

[martin.eppler · Accepted solution]

Hello Graham,

the counter is tied to the envelope sender address (mail-from SMTP command) and will count the envelope recipients (rcpt-to SMTP command) in the SMTP sessions. So if sender@example.com sends a one mail to user1@test.com, two mails to user2@test.com and one mail to user3@test-test.com the counter will read 4.

The AsyncOS 9.7 user guide on page 7-17 explains the parameter as follows:

Max. Recipients per Time Interval

The maximum number of recipients during a specified time period that this listener will receive from a unique envelope sender, based on the mail-from address. The number of recipients is tracked globally. Each listener tracks its own rate limiting threshold; however, because all listeners validate against a single counter, it is more likely that the rate limit will be exceeded if messages from the same mail-from address are received by multiple listeners.

Best regards,

Martin

[GRAHAM CAREY]

Hi Martin,

Thank you it did the trick. Is there any way to get notification sent to an email address when sender is blocked? The only way we found is go to Monitor -> Rate limit and add "Top Offenders by Rejected Recipients" to the Dashbord