Chapter 08 Mail Transport & Defense Admin: #pOutbound

Outbound Reputation Shield, OutboundGuard, ESMTP Limits & Fail2Ban

Two threats face every internet-facing mail server: external credential-stuffing bots and damaged outbound IP/domain reputation (caused by repeated hard bounces, spam complaints, missing RFC 8058 unsubscribe headers, or compromised accounts). SharpMailserver combines the core deliverability safeguards of leading transactional ESPs - 100% optional and individually toggleable.

Operational Tip & Architecture Note

Under Outbound Reputation & Quotas (#pOutbound), switch with 1 click between Off (default), Recommended, or Strict (Bulk) - or enable individual modules selectively. Using the built-in zero-traffic sandbox domain *.sink.sharpmail.local (ok@, bounce@, defer@, complaint@), you can test bounces, webhooks, and suppressions safely without sending external traffic.

Reputation Shield, Sandbox Sink & IP Allowlist via Cockpit or CLI

Every safeguard can be managed live in the Cockpit (#pOutbound) or declaratively via sharpmail-cli.

Reference / Configuration

# Reputation Shield per CLI abfragen oder gezielt aktivieren (0 ms Hot-Reload):
sharpmail-cli get ReputationShield singleton
sharpmail-cli update ReputationShield singleton --set enableSuppressionPreCheck=true --set autoSuppressHardBounces=true

# Büro-Gateway vor Auto-Ban schützen (#pRules):
sharpmail-cli create IpAccessRule --set cidr=198.51.100.40/32 --set action=Allow --set note="Standort Stuttgart"

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`Suppression List & Auto-Bounce-Sperre (#pOutbound · optional)`	Automatically records 5xx hard bounces, consecutive 4xx soft bounces, and unsubscribes, dropping known dead recipients pre-send before touching remote MX servers.	`Optional (Vorlage: Empfohlen)`	Protects sender score at Gmail, Outlook, and Yahoo by never repeatedly hitting non-existent 550 mailboxes.
`ARF Feedback-Loop & RFC 8058 1-Klick-Unsubscribe (optional)`	Automatically ingests inbound RFC 5965 ARF abuse reports and injects DKIM-oversigned RFC 8058 One-Click List-Unsubscribe headers with scanner-safe GET/POST handling.	`Optional (für Bulk Pflicht ab 5.000/Tag)`	Enable for marketing and notification categories: satisfies Google/Yahoo bulk sender mandates while keeping GET previews immune to enterprise link scanners.
`24h Bounce- & Complaint-Notbremse + 421 ISP-Cooldown (optional)`	Trips an automatic circuit breaker when rolling 24h bounce (>5%) or complaint (>0.2%) rates spike, and applies adaptive per-domain cooldowns on 421/451 rate-limit responses.	`Optional (critical/2FA ausgenommen)`	Keep AllowCriticalWhenTripped enabled so 2FA codes and password resets continue flowing even if a bad marketing batch trips the breaker.
`DNSBL-Selbsttest, HMAC-Webhooks & Sandbox-Sink (optional)`	Checks your outbound IPv4 against 5 major DNSBLs, dispatches HMAC-SHA256 signed bounce/complaint webhooks to your CRM/ERP, and simulates outcomes via *.sink.sharpmail.local.	`sink.sharpmail.local aktiv`	Point staging/CI tests at ok@, bounce@, defer@, and complaint@sink.sharpmail.local for realistic bounce & webhook testing with zero internet traffic.
`Auto-Ban / Fail2Ban & TarpitDelayMs (#pRules)`	Blocks brute-force IPs across SMTP, IMAP, Webmail, ActiveSync, and DAV (8 failures -> 30m ban) while stalling dictionary scanners via SMTP tarpit (1500 ms).	`Aktiv · 1500 ms Tarpit`	Leave active, whitelist static office/VPN egress IPs in #pRules, and keep standard human mailboxes protected by per-account OutboundGuard limits.