Snowshoe spam

[cliffhiker]

Getting constantly flooded with snowshoe spam. Several hundred identical from same domain in a matter of minutes.
I'm running a fairly plain jane EFA system here with plenty of horsepower.
Bayes set to 100000 tokens about 931000 so far ~155K spam & 219K ham.

I've seen two issues.
First, the blacklist_to entries seem to sometimes fire and sometimes not. Any clue?
Second, is there any way to limit an ip or domain to about 10-20 deliveries then pause in postscript?

[shawniverson]

I would recommend taking care of this using postfix. Don't even let those emails come up your stack.

[cliffhiker]

good idea... I think I asked about that, though with a typo
Links or hints are fine....
Second, is there any way to limit an ip or domain to about 10-20 deliveries then pause in postscript postfix?

Any other ideas would be helpful...

[shawniverson]

Check these out...

http://www.postfix.org/SMTPD_ACCESS_README.html

http://www.postfix.org/TUNING_README.html