Per mailbox send limit doesn't work for me

WholesaleDialup

WholesaleDialup

Verified User
Joined
Sep 25, 2004
Messages
178
Location
San Antonio, TX
I have always had the per DA user limit turned on and set to 3-500 emails. I have always found this limit only somewhat useful for dealing with authenticated users spamming or through accounts which get compromised (password figured out).

In more recent versions of DA, I noticed the per mailbox limit which I was extremely happy to see. I promptly turned this feature on across three DA servers.

It seems though that I don't have something set right or I missed the point of this feature.

Basically I have a server which I have set the per DA user limit to 500 (only one domain per DA user) and the per mailbox limit for every mailbox under that user/domain to 100.

In my mind this means that no one mailbox can exceed 100 emails sent so, it would take 5 mailboxes reaching the 100 limit to cause the entire user/domain limit of 500 to be exceeded. Correct?

This means that if one mailbox is compromised and a SPAMMER starts sending SPAM as an authenticated mailbox they should only be able to send a max of 100 emails and the rest of the mailboxes under this domain can continue to send mail because there are still 400 emails left within the 500 domain/user wide limit. Correct?

Somehow, I have seen several times where I get the email alert letting me know that a single mailbox just sent 100 emails. THEN, very soon after I get another email telling me the DA User/domain wide account sent 500 emails.

When I check the list of email addresses for that domain, I sort by emails sent and only see the one mailbox that has something like 101/100 meaning that 101 emails were sent (not sure how 101 is = to or less than 100 but OK) and no other mailboxes have much more than a few email sent out for the day.

Who sent the other 400 emails? How? I don't get it..

If each mailbox is limited to 100 and the list of mailboxes only shows 1 user that hit 100, how can the domain wide DA user have sent 500 emails before the spammer got cut-off?

Help, I am confused about this feature or I missed something entirely.

Thanks in advance for any help..
 
I'm not sure and this is only a guess, so hopefully John will reply as well.

But my understanding is that the system checks for daily limit before it sends an email, but if an email is sent to more than one person (multiple Cc, Bcc, or even To), then the next time the mailbox is checked it can be over the limit.

I could be wrong, so I hope John will respond.

Jeff
 
Guess I need to dig into the "recipients per envelope" type setting in Exim, I am sure it exist but I haven't dug into the exim.conf in a while.

So, technically it sounds like a per mailbox or per user (DA user) limit of say 500 could turn into thousands if the SPAMMER puts more than one recipient per email. That's bad.. Hmmm.
 
As I write above, I'm not sure. But if I'm write then it makes sense that recipients per envelope may not help, except to limit legitimate users.

Jeff
 
Before we dig in much further, make sure you've got the most recent version of the exim.pl, version 16:
Code: 
wget -O /etc/exim.pl http://files1.directadmin.com/services/exim.pl
/etc/init.d/exim restart
both version 15 and 16 are far better at blocking the upper limit, in that (as of 15), it will return the sender an "invalid password" error when the limit is reached.

Previously, exim would continue to accept messages with a valid password auth, but if the limit was reached, they'd just all pile up in the spool/queue, causing a far amount of backlog and mess.

Beyond that, check:
Email Accounts -> E-Mail Usage

to see if the auth is set, and if there is a user owned path. (read the bottom of the page for how much weight to put on each variable, as the exim restart path can show as the "path" for smtp deliveries)
The path usually only applies for script based sends, via direct access to the exim binary, rather than port 25.
The script based sends don't have the "bad password" error at the limit (exim.pl 15/16), as no password is used for script sends.. as such, they can still still up the queue (but won't get out)


More things to check, listed here:
http://help.directadmin.com/item.php?id=455

John
 
You must log in or register to reply here.
Back
Top