# Rate limiting of PLAN.md section 5.2.
#
# This file exists because the module ships enabled but with no rates defined,
# which means it accepts everything: "rspamadm configdump ratelimit" on a
# stock image returns only whitelisted_rcpts. Without explicit buckets there
# is no limit at all, and the defence reads as present while doing nothing.
#
# Each rate is "<burst> / <period>". The bucket leaks over the period, so the
# burst is what a sender may do at once and the period sets the refill rate.

rates {
  # Per connecting IP: generous enough for a busy legitimate MTA relaying a
  # mailing list, tight enough to matter for a spam cannon.
  to_ip = {
    bucket = [
      { burst = 100; rate = "60 / 1min"; }
    ];
  }

  # Per authenticated sender. This is the containment for a compromised
  # account, and it backs up the per-mailbox max_recipients_per_hour enforced
  # in ProcessOutboundEmailUseCase - that one is authoritative, this one
  # catches the same abuse earlier and without a database round trip.
  user = {
    bucket = [
      { burst = 50; rate = "30 / 1min"; }
    ];
  }

  # Per recipient, to blunt a dictionary attack enumerating local parts.
  to = {
    bucket = [
      { burst = 20; rate = "10 / 1min"; }
    ];
  }
}

# Mail we authenticated ourselves is not what this limit is aimed at, but a
# compromised account is - so authenticated users stay limited, and only the
# addresses RFC 2142 requires to always be reachable are exempt.
whitelisted_rcpts = "postmaster,mailer-daemon,abuse";