Hacker News Reader

I'm curious but is SMTP DDOS a thing? Are there attacks around this? If so has anyone developed good mitigations at a networking level I mean?

I'd love someone to write about that. Everything is always about HTTP/S

View on HN

Its not terribly common to attack the SMTP service itself, as usually spam can be sent to cause problems outside of the availability of the SMTP service itself. If SMTP traffic is put through HAProxy conn_cur and conn_rate trackers can be used to limit connections per source IP. "inspect delay" can be used to cause SMTP connections to be held in HAProxy for a while, which makes mail flooding substantially more difficult as well (there is an example of that in the docs if you search for inspect-delay).

We have updated the post and added a section to match this use case. You can find it under the subsection "Protecting TCP (non-HTTP) Services"

Reply on news.ycombinator.com