Apache SpamAssassin™ reject spam score threshold
[?] Reject mail at SMTP time if the spam score is greater than this number. (positive or negative, single digit after a decimal point allowed)
Dictionary attack protection
[?] Block dictionary attacks by dropping and ratelimiting hosts with more than 4 failed recipients
Reject remote mail sent to the server's hostname
[?] Reject mail at SMTP time if the recipient is an address of the primary hostname of this server. No remote mail should normally be received for the primary hostname, and this has recently become a common spam target.
Enable Apache SpamAssassin™ for secondary MX domains
[?] When enabled, mail that is sent to the primary mail exchanger for domains that are listed in /etc/secondarymx will be scanned with Apache SpamAssassin™
Ratelimit suspicious SMTP servers
[?] Ratelimit incoming SMTP connections that do not send QUIT (violates RFCs), have recently matched an RBL, or have attacked the server.
Apache SpamAssassin™: ratelimit spam score threshold
[?] Ratelimit hosts which transport messages with a spam score above this number. (positive or negative, single digit after a decimal point allowed)
Ratelimit incoming connections with only failed recipients
[?] Ratelimit incoming SMTP connections that have only sent to failed recipients five separate connection times in the last hour.
Require HELO before MAIL
[?] Require incoming SMTP connections to send HELO before MAIL
Introduce a delay into the SMTP transaction for unknown hosts and messages detected as spam.
[?] The SMTP receiver will wait a few additional seconds for a connection when it detects spam messages in order to reduce inbound spam. The system excludes the following remote hosts from the delay: Neighbor IP addresses in the same netblock, Loopback addresses, Trusted Mail Hosts, Relay Hosts, Backup MX Hosts, Skip SMTP Checks Host, Sender Verify Bypass Hosts.
Do not delay the SMTP connections for hosts in the Greylisting “Trusted Hosts” list
Do not delay the SMTP connections for hosts in the Greylisting “Common Mail Providers” list
Require remote (hostname/IP address) HELO
[?] Require incoming SMTP connections to send a HELO that does not match the primary hostname or a local IP address.
Require remote (domain) HELO
[?] Require incoming SMTP connections to send a HELO that does not match this server’s local domains.
Require RFC-compliant HELO
[?] Require incoming SMTP connections to send HELO conforming to internet standards (RFC2821 4.1.1.1)
Allow DKIM verification for incoming messages
[?] By default, Exim verifies syntactically valid signatures in incoming mail, even when Exim is not configured to act on the results of the check. This verification process can degrade your server's performance.
Reject mail at SMTP time if the sender fails DKIM key validation.
Maximum message recipients (soft limit)
(Minimum: 1; Maximum: 100) [?] Reject any recipient addresses after this number have been specified for a single message. NOTE: The RFCs specify that SMTP servers should accept at least 100 RCPT commands for a single message.
Maximum message recipients before disconnect (hard limit)
(Minimum: 1; Maximum: 100) [?] Disconnect and ratelimit any connection that specifies more than this number of recipients for a single message. NOTE: The RFCs specify that SMTP servers should accept at least 100 RCPT commands for a single message.