Is there a way to throttle inbound mail flow from a known good sender? (we just don't want to be blasted by their email bursts)

[Andrey Fyodorov]

Hi everyone.

We need to receive daily email blasts from a known good external sender.  The only thing is that we don't want to get blasted by their entire burst at once because these bursts are overwhelming our downstream connection from SMG to an advanced malware scanning solution.

I was hoping there could be a way to throttle or tarpit that sender and make them try sending some of their emails later.

[PINGMING CHEN]

Hello :

You can enable DHA/virus attack defer & some SMTP advance to reduce mass flow sessions

[alexander smg]

Unclassified | Non classifié

that won’t work. Just reduce your inbound max number of connections and reduce your max number of recipients per message under advanced settings inbound.

[PINGMING CHEN]

Hello

And for good/bad sender, you also can adjust the Connection Classification to limit throttle 

[alexander smg]

Unclassified | Non classifi?

Connection classification yes maybe. But I disabled it years ago. I found it too unpredictable. And the mal logs never really say what they throttle. Too unpredictable.

[Andrey Fyodorov]

Thank you all.

This is a good sender, so directory harvest attack detection of virus attack detection won’t help me.

This good sender simply sends a burst of 4,000+ emails in very a short period of time, one email per recipient, all the recipients are valid.

[alexander smg]

Unclassified | Non classifi?

So do what I suggested and see what happens

[alexander smg]

Unclassified | Non classifi?

If you have a second smg inline after the gateways, the way I do it, you can limit the inbound connections from your gw. Another way, if you have exchange, is to limit connections on the receive connector. I have asked for this feature for years and alas, nothing. [Image.png]