Outbound mail control

A website that is broken into is worth something to whoever broke in mainly as a way to send mail, and the first sign is usually a customer saying their mail is bouncing. By then the server's address is on a blocking list, getting off takes days, and until it is done nobody else on that machine can send either.

• Through this server. The default. Mail goes to the server's own mail service, where it can be counted and limited.
• Direct to the internet. For a website that genuinely needs to reach a remote mail server itself. Nothing counts what it sends.
• Nothing at all. No outbound mail, by the direct route or through this server. The switch for a website you already know has been taken over.

Whether a website may go direct is a kernel rule, so it holds whether or not the panel, the agent or anything else is running. Sending through a mail provider on the submission ports is unaffected: a website using a real provider is doing the thing worth encouraging.

• Count it, and tell nobody. The numbers appear and nothing is refused. Where to start on a server whose normal traffic you have not measured.
• Hold the rest of the hour. Further mail is refused until the hour turns, then resumes on its own. A busy website that had one unusual afternoon recovers with nobody doing anything.
• Stop it until released. The website stays stopped until an administrator looks at why. The right answer when passing the limit means something has gone wrong rather than something is busy.

An empty limit on a website follows the server's. Zero means no limit, and everything is still counted: you cannot pick a sensible threshold for traffic nobody has measured.

Dashmox does not read your customers' mail. It counts how many messages a website sends, to how many recipients, and how that compares with what the same website normally does. Recipients are counted separately on purpose: one message to four hundred addresses and four hundred messages are the same spam, and only the second shows up in a count of messages.

Whether a website may go direct is a boundary. A kernel rule, with no way around it from inside a website.

How much it may send is a control. It stands in front of the program websites use to send mail, which catches every piece of ordinary software: a contact form, a mailing list plugin, a script. A website running code that deliberately avoids that program can send uncounted. No hosting panel can prevent that, because the mail system is reachable by any local process by design, and a panel that told you otherwise would be selling you a feeling.

So "nothing at all" is half kernel and half not. The direct route out is closed by the kernel. Handing a message to this server's own mail service is a file written into a directory rather than a connection, so no firewall sees it, and that half is the same program that does the counting. On a server where counting is off, only the direct route is closed. The panel says so on the page rather than leaving you to find out.

Counting puts a small program where the system's sendmail is, using the mechanism package upgrades are told about, so upgrading Postfix does not silently remove it. Turning counting off withdraws it and puts the server back exactly as it was. If counting ever does stop while limits are set, the health page treats it as critical, because that state looks exactly like a quiet server.