# Postfix rate-limits + postscreen tarpit (E2 D3, soft mode, no DNSBL).
# NOTE: smtpd_client_error_rate_limit / smtpd_slow_connection_rate_limit do not
# exist in Postfix; mapped to the real anvil params smtpd_client_recipient_rate_limit
# and smtpd_client_auth_rate_limit (same values).
smtpd_client_connection_rate_limit = 10
smtpd_client_message_rate_limit = 20
smtpd_client_recipient_rate_limit = 10
smtpd_client_auth_rate_limit = 5
smtpd_hard_error_limit = 20
smtpd_soft_error_limit = 10
smtpd_error_sleep_time = 1s
smtpd_junk_command_limit = 2
postscreen_greet_action = enforce
postscreen_bare_newline_enable = yes

# Only $mydomain (produktor.io) is a LOCAL virtual mailbox domain (inbound).
# Historical / incubator addresses (gmail.com, gmx.de, gridfactor.de, rpf.de,
# viscreation.de, wheregroup.com) keep their Dovecot accounts for IMAP +
# doveadm import, but must NOT be local delivery domains: otherwise outbound
# mail to those domains short-circuits into the incubator archive (dovecot
# lmtp "Saved") and never leaves the host — e.g. a campaign test from
# info@produktor.io to eslider@gmail.com. Overridden last (DMS appends
# postfix-main.cf after its own setup). See mailing skill, Gitea #115.
virtual_mailbox_domains = $mydomain