Views:
You can configure Deep Discovery Email Inspector to monitor SMTP traffic and perform the following actions:
  • Block messages from a sender IP address or email address for a specified time when the number of connections or messages reaches the specified threshold
  • Monitor and block senders in an LDAP group from sending email messages when the maximum number of messages is reached for a specified time
Note
Note
  • Disable SMTP traffic throttling when you deploy Deep Discovery Email Inspector as a non-edge MTA in your network.
  • Deep Discovery Email Inspector does not apply SMTP traffic throttling settings to senders in the Approved Senders list.
  • When SMTP traffic volume is extremely high, Deep Discovery Email Inspector might not precisely block email messages based on the configuration due to the time delay between rule trigger and activation.
  • For information on how Deep Discovery Email Inspector blocks messages based on the Approved Senders and Blocked Senders lists, see Sender Filter Order of Evaluation.

Procedure

  1. Go to Administration → Sender Filtering/Authentication → SMTP Traffic Throttling.
  2. To monitor and control SMTP traffic based on sender addresses, do the following.
    1. Select a sender address type.
      • Enable SMTP traffic throttling based on sender IP addresses: Monitors traffic based on sender IP addresses
      • Enable SMTP traffic throttling based on sender email addresses: Monitors traffic based on sender email addresses
    2. Configure the required settings.

      Field
      Description
      Maximum connections
      Type the maximum number of connections allowed for a single IP address.
      Maximum messages
      Type the maximum number of messages allowed from a single IP address or email address.
      Blocking duration
      Select the number of hours to block.
      Note
      Note
      After blocking a sender for the specified time, Deep Discovery Email Inspector removes the sender from the Blocked Senders list.
  3. To monitor and control the number of email messages a sender is allowed to send in an LDAP group, do the following.
    1. Select Enable LDAP-based SMTP traffic throttling.
    2. Select a monitoring method and configure the required settings.
      • Duration-based monitoring: Monitors email messages within the selected time window. If the message threshold is reached for the LDAP group (for example, 100 message limit in 5 minutes), Deep Discovery Email Inspector blocks the sender for the specified time.
      • Daily reset: Monitors email messages transmitted and resets the counter everyday (midnight).
    3. Configure the message threshold for an LDAP group. Click Add+ and specify the group name and maximum messages.
      Note
      Note
      • The asterisk (*) wildcard is supported. Use this wildcard to set a default message threshold for senders not belonging to any LDAP groups in the list.
      • If a sender belongs to more than one LDAP group, Deep Discovery Email Inspector applies the most restrictive setting (lowest message threshold).
      • Settings in the Approved Senders List and Blocks Senders List have priority.
  4. Click Save.
    To use the default settings, click Restore Default to discard your configuration.