Postfix busy, linux idle - what can one do?

Wietse explains:

When all Postfix SMTP server (smtpd) processes are busy, connections from remote SMTP clients will queue in the kernel up to some kernel defined limit.

If this is a persistent condition, remote SMTP clients will give up waiting before a Postfix SMTP server (smtpd) process becomes available, and Postfix SMTP server (smtpd) processes will log "lost connection after CONNECT" errors.

The Postfix cure is:

eliminate useless or redundant RBL lookups (people often use multiple Spamhaus RBLs that include each other):
- zen.spamhaus.org contains:
  - SBL (127.0.0.2)
  - XBL (127.0.0.4-8) which contains:
    - CBL
    - NJABL Open Proxy IPs list
      (dnsbl.njabl.org is itself a composite list and contains more than the open proxy IPs list part now incorporated in XBL!)
  - PBL (127.0.0.10-11)

reject non-existent recipients early:

  
smtpd_recipient_restrictions =
   reject_unlisted_recipient
   permit_mynetworks
   reject_unauth_destination ...

eliminate body_checks patterns, and install a real content filter (contant_filter or smtpd_proxy_filter).
run more SMTP server (smtpd) processes
configure Postfix's stress personality (Postfix 2.6.x an newer), which changes Postfix behavior under stress.
Read the full description here
Last resort: You can specify smtpd_peername_lookup = no under conditions of severe stress with Postfix 2.3 and later.
You get the same effect by setting up an empty in-addr.arpa zone on the DNS server.
Warning: This setting tells postfix to treat all clients as "unknown" and will cause a hard reject for ALL clients if one is using reject_unknown_client, reject_unknown_client_hostname, or reject_unknown_reverse_client_hostname.
This will also disable all hostname-based features, such as a client access blacklist/whitelist, or if one has included a domain name in mynetworks.

When the kernel-defined limit for queued connections is reached, remote SMTP clients will experience "connection timed out" errors.

© by Ralf Hildebrandt
This document contains links to external information sources that I do neither monitor nor control. I explicitly disclaim any liabilities in respect to external references.
You are getting this document without any guarantees. Any methods shown above are meant as demonstration and may be wrong in some place. You may damage your system if you try to follow my hints and instructions. You do this at your own risk!

This file was last modified 08. Jun 2009 by root