# THIS FILE IS FOR COMMUNITY CONTRIBUTED BOUNCE CLASSIFICATION RULES
# THESE ARE PROVIDED AS-IS BY THEIR RESPECTIVE CONTRIBUTERS
# THIS FILE SHOULD BE USED IN COMBINATION WITH shaping.toml TO GET FULL
# COVERAGE INCLUDING STATUS CODE BASED RULES.

# DO NOT EDIT THIS FILE, IT WILL BE OVERWRITTEN WHEN YOU UPDATE YOUR INSTALLATION
# INSTEAD CREATE YOUR OWN FILE AND ADD IT TO THE LIST OF FILES LOADED IN YOUR
# INIT POLICY. IN THIS EXAMPLE YOUR OWN FILE IS AT /opt/kumomta/etc/policy/custom-shaping.toml

# local shaping = require 'policy-extras.shaping'

# local shaper = shaping:setup_with_automation {
#  publish = { 'http://127.0.0.1:8008' },
#  subscribe = { 'http://127.0.0.1:8008' },
#  extra_files = { 
#        '/opt/kumomta/share/policy-extras/shaping.toml',
#        '/opt/kumomta/share/community/shaping.toml', 
#        '/opt/kumomta/etc/policy/shaping_custom.toml',
#        },
# }

# kumo.on('init', function()
#  -- Configure publishing of TSA logs to automation daemon
#  shaper.setup_publish()
# end) -- END OF THE INIT EVENT

# kumo.on('get_egress_path_config', shaper.get_egress_path_config)

#### BEGIN COMMUNITY CONTRIBUTED SHAPING RULES

#===== GMAIL 
# default provider configs in policy-extra/shaping.toml
[[provider."gmail".automation]]
regex = "Our system has detected that this message"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "1 hour"

[[provider."gmail".automation]]
regex = "Our system has detected an unusual rate"
trigger = {Threshold="2/hr"}
action = {SetConfig={name="max_message_rate", value="10/minute"}}
duration = "30m"

#===== YAHOO
# default provider configs in policy-extra/shaping.toml

## 421 4.7.0 [TS01] Messages from x.x.x.x temporarily deferred due to user complaints
# This one is caught in the default.automation in policy-extra/shaping.toml

# We're seeing unusual traffic patterns from your server.
# Submit your sending IPs for review.
[[provider."yahoo".automation]]
regex = "\\[TS02\\]"
trigger = {Threshold="3/hr"}
action = {SetConfig={name="max_message_rate", value="1/minute"}}
duration = "30m"

# We're seeing unusual traffic patterns from your server
[[provider."yahoo".automation]]
regex = "\\[TS03\\]"
trigger = {Threshold="3/hr"}
action = {SetConfig={name="max_message_rate", value="10/minute"}}
duration = "30m"

# 421 4.7.0 [TSS04] Messages from a.b.c.d temporarily deferred due to user complaints
[[provider."yahoo".automation]]
regex = "421 4\\.7\\.0 \\[TSS04\\]"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "2 hours"

# 421 4.7.0 [TSS05] Messages from a.b.c.d temporarily deferred due to user complaints
[[provider."yahoo".automation]]
regex = "421 4\\.7\\.0 \\[TSS05\\]"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "4 hours"

# 421 [IPTS04] Messages from a.b.c.d temporarily deferred due to user complaints
[[provider."yahoo".automation]]
regex = "421 \\[IPTS04\\]"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "2 hours"

# 421 [IPTS05] Messages from a.b.c.d temporarily deferred due to user complaints
[[provider."yahoo".automation]]
regex = "421 \\[IPTS05\\]"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "4 hours"

# The sending IP is listed on a Spamhaus blacklist
[[provider."yahoo".automation]]
regex = "553 5\\.7\\.1 \\[BL"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "2 hours"

# 421 Max message per connection reached, closing transmission channel
[[provider."yahoo".automation]]
regex = "Max message per connection reached, closing transmission channel"
trigger = {Threshold="3/hr"}
action = {SetConfig={name="max_message_rate", value="10/minute"}}
duration = "1 hour"

#====== YAHOO.CO.JP (custom)
# This one uses different MX servers then provider.yahoo
["yahoo.co.jp"]
connection_limit = 2
max_message_rate = "10/s"
max_deliveries_per_connection = 20

# 553 Mail from x.x.x.x not allowed - VS98-IP0 deferred
[["yahoo.co.jp".automation]]
regex = "VS98-IP0 deferred"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "1 hour"

# 421 [TSS04] Messages from 3.70.121.217 temporarily deferred due to unexpected volume or user complaints
[["yahoo.co.jp".automation]]
regex = "421 \\[TSS04\\]"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "1 hours"

# 421 [IPTS04] Messages from 136.144.163.100 temporarily deferred due to unexpected volume or user complaints
[["yahoo.co.jp".automation]]
regex = "421 \\[IPTS04\\]"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "1 hours"

[["yahoo.co.jp".automation]]
regex = "Timeout waiting for command"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "30 minutes"

#===== web.de
[provider."gmx.net_web.de"]
match=[
        {MXSuffix=".web.de"},
        {MXSuffix=".gmx.net"},
]
max_deliveries_per_connection = 20
connection_limit = 4
enable_tls = "Required"
consecutive_connection_failures_before_delay = 5

[[provider."gmx.net_web.de".automation]]
regex = "Too many connections"
trigger = {Threshold="3/hr"}
action = {SetConfig={name="connection_limit", value=1}}
duration = "30 minutes"

[[provider."gmx.net_web.de".automation]]
regex = "Reject due to policy restrictions."
trigger = {Threshold="5/hr"}
action = {SetConfig={name="max_message_rate", value="1/minute"}}
duration = "1 hour"

[[provider."gmx.net_web.de".automation]]
regex = "Reject due to policy violations."
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "1 hour"

[[provider."gmx.net_web.de".automation]]
regex = "554.*Reject due to policy restrictions."
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "2 hours"

#===== outlook
# default provider configs in policy-extra/shaping.toml
[[provider."outlook".automation]]
regex = "Unfortunately.*part of their network is on our block list"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "2 hours"

[[provider."outlook".automation]]
regex = "Access denied, please try again later"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "1 hour"

[[provider."outlook".automation]]
regex = "Server busy. Please try again later"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "30m"

[[provider."outlook".automation]]
regex = "The mail server.*has been temporarily rate limited"
trigger = {Threshold="3/hr"}
action = "Suspend"
duration = "30m"

[[provider."outlook".automation]]
regex = "Server busy. Please try again later"
trigger = {Threshold="3/hr"}
action = {SetConfig={name="max_message_rate", value="1/minute"}}
duration = "15m"

[[provider."outlook".automation]]
regex = "The mail server.*has exceeded the maximum number of connections"
trigger = {Threshold="2/hr"}
action = {SetConfig={name="connection_limit", value=1}}
duration = "1 hour"

[[provider."outlook".automation]]
regex = "The mail server.*has exceeded maximum number of messages per connection"
trigger = {Threshold="2/hr"}
action = {SetConfig={name="max_deliveries_per_connection", value=2}}
duration = "1 hour"

[[provider."outlook".automation]]
regex = "Connection refused from.*due to exceed max concurrent connections. IB007"
trigger = {Threshold="2/hr"}
action = {SetConfig={name="connection_limit", value=1}}
duration = "1 hour"

[[provider."outlook".automation]]
regex = "Temporary server error. Please try again later"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "1 hour"

#===== icloud.com
# default provider configs in policy-extra/shaping.toml
[[provider."apple".automation]]
regex = "Service unavailable - try again later"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "15 minutes"

# 451 [BS02] Temporary server error. Please try again later.
[[provider."apple".automation]]
regex = "\\[BS02\\] Temporary server error."
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "15 minutes"


# 421 [HCM1] Your mail from x.y.z.a was deferred.
[[provider."apple".automation]]
regex = '''\\[HCM1\\] Your mail from \d+\.\d+\.\d+\.\d+ was deferred'''
trigger = {Threshold="3/hr"}
action = "Suspend"
duration = "15 minutes"

[[provider."apple".automation]]
regex = "Your email was rejected due to having a domain present in the Spamhaus DBL"
trigger = {Threshold="3/hr"}
action = "Suspend"
duration = "4 hours"

#===== orange
# default provider configs in policy-extra/shaping.toml
[[provider."orange".automation]]
regex = "Trop de connexions"
trigger = {Threshold="2/hr"}
action = {SetConfig={name="connection_limit", value=1}}
duration = "1 hour"

[[provider."orange".automation]]
regex = "Service refuse"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "1 hour"

[[provider."orange".automation]]
regex = "Client host blocked for spamming issues.*http://csi.cloudmark.com/reset-request/"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "2 hour"

[[provider."orange".automation]]
regex = "Client host blocked for spamming issues.*spamhaus"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "2 hour"

[[provider."mimecast".automation]]
# default provider configs in policy-extra/shaping.toml
regex = "Internal resource temporarily unavailable"
trigger = {Threshold="3/hr"}
action = "Suspend"
duration = "30 minutes"

# 20260327
#==== Barracuda network
[provider."barracuda"]
match=[
        {MXSuffix=".barracudanetworks.com"},
]
enable_tls = 'Required'
max_deliveries_per_connection = 15
provider_connection_limit =10

# 20260327
#==== Netvigator network
[provider."netvigator"]
match=[
        {MXSuffix=".netvigator.com"},
]
enable_tls = 'Required'
max_deliveries_per_connection = 10
provider_connection_limit = 5

# 20260327
[[provider."netvigator".automation]]
regex = "Too many messages for this session"
trigger = {Threshold="3/hr"}
action = "Suspend"
duration = "30 minutes"

#==== KPN provider
[provider."kpn"]
match=[
        {MXSuffix=".kpnmail.nl"},
]
max_deliveries_per_connection = 10
connection_limit = 10
enable_tls = "Required"

#===== qq.com
[provider."qq.com"]
match=[{MXSuffix=".qq.com"}]
max_deliveries_per_connection = 8
connection_limit = 4
enable_tls = "Required"

[[provider."qq.com".automation]]
regex = "550 Sender frequency limited.*"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "1 hour"

[[provider."qq.com".automation]]
regex = "550 Ip frequency limited.*"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "1 hour"

[[provider."qq.com".automation]]
regex = "550 Connection frequency limited.*"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "1 hour"

[[provider."qq.com".automation]]
regex = "550 Domain frequency limited.*"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "1 hour"

[[provider."qq.com".automation]]
regex = "550 Mail content denied.*"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "1 hour"

#===== 163.com
[provider."163.com"]
match=[{MXSuffix=".netease.com"}]
max_deliveries_per_connection = 7
connection_limit = 4
enable_tls = "RequiredInsecure"

[[provider."163.com".automation]]
regex = "451 DT:SPM*"
trigger = {Threshold="5/hr"}
action = "Suspend"
duration = "15m"

[[provider."163.com".automation]]
regex = "421 Too many connections"
trigger = {Threshold="2/hr"}
action = {SetConfig={name="connection_limit", value=1}}
duration = "1 hour"

[[provider."163.com".automation]]
regex = "554 DT:SPM"
trigger = {Threshold="2/hr"}
action = {SetConfig={name="connection_limit", value=1}}
duration = "1 hour"

# At daily limit
[[provider."163.com".automation]]
regex = "550 RP:ORQ"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "1 hour"

# At daily limit
[[provider."163.com".automation]]
regex = "554 HL:ITC"
trigger = {Threshold="2/hr"}
action = "Suspend"
duration = "1 hour"