Anti-abuse checks of SMTP clients, run by Sovite.Core.SMTPHandler before its own checks of each stage. Clients in smtp.trusted_networks skip all of them.

The screen

On listeners with screen (by default those in smtp mode), each client gets a score, as with Postfix's postscreen:

• The client address is looked up in the [[screen.dnsbl]] lists (Sovite.Abuse.DNSBL), in the background. Each list it is on adds its weight; allow lists such as DNSWL have negative weights.
• With screen.greet_delay, the greeting waits that long. A client that talks first adds screen.early_talker_weight.
• At EHLO and MAIL, the [[screen.rhsbl]] lists are checked for the EHLO name and the sender's domain.

A client that reaches screen.threshold is refused: before the greeting with 554 5.7.1, then the connection is closed; at EHLO or MAIL, that command gets 554 5.7.1. A client at or below screen.allow_threshold is allow-listed: the domain lists and greylisting are skipped. A client that passed the greeting, without talking first or a failed lookup, is remembered for screen.cache_time and not delayed or looked up again meanwhile.

Rate limits

The [rate_limit] limits count, per client address (per /64 for IPv6), new connections (421 4.7.0 and closed), messages (MAIL, 450 4.7.1), and recipients (450 4.7.1); and per authenticated user, messages and recipients. Authenticated clients only count against the user limits.

Greylisting

With greylist.enabled, a valid recipient from an unknown client network and sender is deferred with 450 4.7.1 until the client tries again after greylist.delay, see Sovite.Core.Greylist. Authenticated and allow-listed clients, and listeners without screen, skip it.

Outbound

Authenticated users whose mail fails too often are suspended, see Sovite.Core.Outbound; their MAIL gets 550 5.7.1.

Telemetry

• [:sovite, :screen, :rejected] - %{score}, %{session_id, remote_ip, stage, reasons}, when a client reaches the threshold.