Sending limits

Sending limits stop one account — or one hacked website or mailbox — from sending so much email that the whole server ends up on a blocklist. Every message an account sends is counted, from its mailboxes (signed-in SMTP) and from its websites (PHP mail() and sendmail). Over a limit, the mail is deferred: the sending program is told to try again later, so nothing is lost.

Where: Server Admin › Email › Mail health (the Sending limits and Sending limits per account cards), and Server Admin › Accounts › Packages

How the limits are chosen

Each account has a limit per hour (the clock hour) and per day (any 24 hours). For each of the two, the first of these that is set applies:

Limits count recipients: a message to three people counts three.

Set the server defaults

1. Open Mail health.
2. In Sending limits, type Emails per hour (0 = unlimited) and Emails per day (0 = unlimited).
3. Click Save.

The card shows Active when the limit service runs, or Limit service not running in red.

Give one account its own limits

1. In Sending limits per account, type the Account (its username).
2. Type Emails per hour (0 = unlimited) and Emails per day (0 = unlimited). Leave a field empty to use the package's limit.
3. Click Save.

Accounts with their own limits are listed with what they sent this hour and in the last 24 hours. Edit fills the form; Use the package removes the account's own limits.

When an account reaches a limit

• Further mail is deferred (450 4.7.1 for mailboxes; websites' sendmail exits with "try later") and goes out automatically when the limit allows it again.
• The account owner and you (and the account's reseller) are told once per hour or day, through Notifications (event Sending limit reached).
• The customer sees a notice on Deliverability.
• The hook mail.limit_reached is raised (Event hooks).

Limits reached in the last 24 hours on Mail health lists every event. Let it send again clears the account's counts of the last 24 hours, so it can send at once.

Sudden spikes

The spike guard holds an account at once when it sends, in one hour, more than five times its busiest hour of the last seven days — and at least the Pause at number of the Spam guard card (default 300). It is checked for every message, so a burst is stopped within seconds.

• All of the account's sending is put on hold: mailboxes and websites. Receiving keeps working.
• The account owner and you are told (event Sending put on hold), and the hook mail.spike_held is raised.
• The account is listed under the spam guard as paused, and in Limits reached in the last 24 hours.

When you have dealt with the cause (usually a hacked website form or a stolen mailbox password), click Allow sending again or Let it send again.

Top senders

Sending this hour lists the 15 busiest accounts: recipients this hour and in the last 24 hours with their limits, messages held back, and the spike guard's threshold. Let it send again appears for an account that was held back; Pause sending stops an account's sending by hand.

How it works

The counting is done by the mail policy service (hostfog-mailpolicy, the program hf-api mail-policy), which runs on every server with email:

• Postfix asks it at the end of every signed-in message (a Postfix policy service on /var/spool/postfix/private/hf-policy); the account is found from the mailbox's domain.
• Websites send through the panel's sendmail wrapper, which asks it over /run/hostfog-mail.sock; the system tells the service which account is calling, so an account can only use up its own limit. Mailing lists count against the account that owns them.
• The counts are kept in memory and saved to /var/lib/hostfog/mail-policy every 30 seconds and when the service stops, so a restart or an update keeps them.
• The limits are in /etc/hostfog/mail-limits, written by the panel. The panel reads the service's events every five minutes to send the notifications and raise the hooks.

API

Packages take mail_hour and mail_day. See Email API.

Related

• Mail health
• Packages
• Deliverability
• Event hooks