temporary block IP that will be send a more than 100 mail per day in POSTFIX

Question

I have using the POSTFIX mail server for receiving a mail. Now some spammers send a spam mail continuously. I have some idea to block a IP address who send a mail more than 100 per day. is it possible in POSTFIX or shell script. Let me know?

Answer 1

According to the Postfix documentation, what you are looking for is Postfix SMTP relay and access control, specifically smtpd_client_restrictions

The Postfix documentation can be a little dense and intimidating to a newcomer. There are guides available that can help show how to Blacklist and Whitelist with Postfix (and I've reproduced some of that guide below).

The essential idea is that first, you set up a file of client_checks. Next, make a hash of that file using postmap; this improves performance.
Third, in your /etc/postfix/main.cf add a reference the hash.

The file /etc/postfix/client_checks would contain something like this:

# Restricts which clients this system accepts SMTP connections from.

example.com               REJECT No spammers
.example.com              REJECT No spammers, from your subdomain
123.45.67.89              REJECT Your IP is spammer
123.45.6.0/24             REJECT Your IP range is spammer
32.1.98.76                OK
example1.com              OK

Next, you would run postmap /etc/postfix/client_checks

Edit your main.cf file to add a reference to the client checks:

smtpd_recipient_restrictions = check_client_access hash:/etc/postfix/client_checks

Restart postfix and test for correct operation. You'd want to test from ideally both a whitelisted IP address and a blacklisted IP address. If it were me, I would temporarily add a known IP address to the client check and confirm mail from that host is rejected, then remove it from client_checks once I was confident the check is working.

---