Per-Provider Tuning Baselines
Community-maintained per-provider MTA shaping baselines — connection limits, messages per connection, rates, TLS requirements, and automated-throttle rules — from the KumoMTA shaping files, attributed and dated.
Concrete starting values for per-destination shaping, taken from the KumoMTA project's publicly maintained shaping files: the vendor-maintained policy-extras/shaping.toml (defaults and major providers, several sections marked "provided directly by" the provider) and the community-contributed community/shaping.toml (additional providers and bounce-driven automation rules). Fetched 2026-07-20 from the main branch. These values drift as providers change policy — treat them as attributed starting points to validate against your own deferral data, not as facts about current provider limits. See MTA Delivery Tuning for what each parameter means and how the automation model works.
Mechanics to know when reading the tables:
- MX rollup: limits apply per receiving MX infrastructure — all recipient domains resolving to the same MX set share one bucket. Provider blocks match by MX suffix (e.g., anything with MX under
.google.comor.googlemail.comis "google", which covers Gmail and Google Workspace hosted domains — as of the file's 2024-09-03 note their MX hostnames resolve to common IPs, so they are shaped together). provider_connection_limitvsconnection_limit: the provider variant is enforced across the whole provider rollup; the plain variant applies per site. Mimecast deliberately uses per-site limits because each Mimecast site name is a separate regional MTA fleet.- Where a cell is blank, the global default applies.
Global defaults
| Parameter | Default |
|---|---|
| connection_limit | 10 |
| max_connection_rate | 100/min |
| max_deliveries_per_connection | 100 |
| max_message_rate | 100/s |
| idle_timeout | 60 s |
| data_timeout / data_dot_timeout | 30 s / 60 s |
| enable_tls | Opportunistic |
| consecutive_connection_failures_before_delay | 100 |
| remember_broken_tls | 3 days |
A default automation rule (all destinations) matches the cross-provider deferral family — Messages from <IP> temporarily deferred, All messages from <IP> will be permanently deferred, has been temporarily rate limited due to IP reputation, Unfortunately, messages from <IP> weren't sent, Server busy. Please try again later from — and on match sets max_message_rate = 1/minute and connection_limit = 1 for 90 minutes.
Provider baselines
| Provider (MX match) | Conn. limit | Deliveries/conn. | TLS | Other |
|---|---|---|---|---|
Google (.google.com, .googlemail.com) |
5 (provider-wide) | 50 | Required — Google tempfails and rate-limits non-TLS injection | consecutive_connection_failures_before_delay = 5 |
Yahoo (.yahoodns.net) — values "provided by Yahoo directly" |
default (10) | 20 | default | |
Microsoft consumer (.olc.protection.outlook.com) |
5 (provider-wide) | 50 | default | Consumer, O365, and DANE MX sets are separate edge-server groups, shaped separately |
Office 365 (.mail.protection.outlook.com) |
5 (provider-wide) | 50 | default | |
Office 365 DANE (.mx.microsoft) |
5 (provider-wide) | 50 | default | DANE left disabled in the baseline (most sites' DNSSEC not ready) |
Apple iCloud (.icloud.com) |
10 (provider-wide) | 5 | default | Note the very low deliveries/connection |
Comcast (comcast.net) — "provided directly by Comcast" |
25 | 1000 | Required | idle_timeout = 30 s; consecutive_connection_failures_before_delay = 24 |
Mimecast (.mimecast.com, .mimecast.co.za, .mimecast-offshore.com) — "provided directly by Mimecast" |
10 per site | 100 | default | Per-site, not provider-wide (regional fleets) |
| mail.com — "provided directly by mail.com" | default | 100 | default | |
Orange (.orange.fr) |
2 (provider-wide) | 100 | Required | |
GMX / WEB.DE (.web.de, .gmx.net) (community) |
4 | 20 | Required | consecutive_connection_failures_before_delay = 5 |
Yahoo Japan (yahoo.co.jp) (community) |
2 | 20 | default | max_message_rate = 10/s; separate MX fleet from Yahoo proper |
Barracuda (.barracudanetworks.com.) (community, dated 2026-03-27) |
10 (provider-wide) | 15 | Required | |
Netvigator (.netvigator.com.) (community, dated 2026-03-27) |
5 (provider-wide) | 10 | Required | |
KPN (.kpnmail.nl.) (community) |
10 | 10 | Required | |
Tencent QQ (.qq.com) (community) |
4 | 8 | Required | |
NetEase 163.com (.netease.com) (community) |
4 | 7 | RequiredInsecure (TLS forced but certs not validated) | |
Mailgun smarthost (smtp.mailgun.com) — "provided directly by Mailgun" for senders relaying via Mailgun |
7000 | 3 | default | Smarthost, not a mailbox provider |
Automated-throttle rules per provider (community-contributed)
These are the bounce-response-driven adjustments the community file layers on the baselines. Trigger N/hr means the rule fires once the response has matched N times in an hour; every action expires after its duration. (Cross-reference the provider error-code articles for what each response means: Gmail, Yahoo, Microsoft, Apple, Comcast, GMX/WEB.DE.)
| Provider | Response matched (regex, abridged) | Trigger | Action | Duration |
|---|---|---|---|---|
| Gmail | "Our system has detected that this message" | 5/hr | Suspend | 1 h |
| Gmail | "Our system has detected an unusual rate" | 2/hr | max_message_rate = 10/min | 30 m |
| Gmail (example, shipped commented-out — suspends whole tenants) | "This message does not have authentication information" | — | SuspendTenant | 3 h |
| Yahoo | [TS02] (unusual traffic patterns, submit IPs for review) |
3/hr | max_message_rate = 1/min | 30 m |
| Yahoo | [TS03] (unusual traffic patterns) |
3/hr | max_message_rate = 10/min | 30 m |
| Yahoo | 421 4.7.0 [TSS04] (deferred, user complaints) — also in vendor file: any [TS?S04] → Suspend 2 h, no threshold |
2/hr | Suspend | 2 h |
| Yahoo | 421 4.7.0 [TSS05] (deferred, user complaints) |
2/hr | Suspend | 4 h |
| Yahoo | 421 [IPTS04] |
2/hr | Suspend | 2 h |
| Yahoo | 421 [IPTS05] |
2/hr | Suspend | 4 h |
| Yahoo | 553 5.7.1 [BL (Spamhaus-listed IP) |
5/hr | Suspend | 2 h |
| Yahoo | "Max message per connection reached" | 3/hr | max_message_rate = 10/min | 1 h |
| Yahoo Japan | "VS98-IP0 deferred" (553 Mail from <IP> not allowed) |
2/hr | Suspend | 1 h |
| Yahoo Japan | 421 [TSS04] / 421 [IPTS04] (volume or complaints) |
2/hr | Suspend | 1 h |
| Yahoo Japan | "Timeout waiting for command" | 2/hr | Suspend | 30 m |
| GMX / WEB.DE | "Too many connections" | 3/hr | connection_limit = 1 | 30 m |
| GMX / WEB.DE | "Reject due to policy restrictions." | 5/hr | max_message_rate = 1/min | 1 h |
| GMX / WEB.DE | "Reject due to policy violations." | 5/hr | Suspend | 1 h |
| GMX / WEB.DE | 554 … Reject due to policy restrictions. |
5/hr | Suspend | 2 h |
| Outlook | "Unfortunately … part of their network is on our block list" | 5/hr | Suspend | 2 h |
| Outlook | "Access denied, please try again later" | 5/hr | Suspend | 1 h |
| Outlook | "Server busy. Please try again later" | 5/hr | Suspend | 30 m |
| Outlook | same "Server busy" text (second rule) | 3/hr | max_message_rate = 1/min | 15 m |
| Outlook | "has been temporarily rate limited" | 3/hr | Suspend | 30 m |
| Outlook | "exceeded the maximum number of connections" | 2/hr | connection_limit = 1 | 1 h |
| Outlook | "exceeded maximum number of messages per connection" | 2/hr | max_deliveries_per_connection = 2 | 1 h |
| Outlook | "Connection refused … exceed max concurrent connections. IB007" | 2/hr | connection_limit = 1 | 1 h |
| Outlook | "Temporary server error. Please try again later" | 5/hr | Suspend | 1 h |
| Apple | "Service unavailable - try again later" | 5/hr | Suspend | 15 m |
| Apple | [BS02] Temporary server error. |
5/hr | Suspend | 15 m |
| Apple | [HCM1] Your mail from <IP> was deferred |
3/hr | Suspend | 15 m |
| Apple | "rejected due to having a domain present in the Spamhaus DBL" | 3/hr | Suspend | 4 h |
| Comcast (vendor file) | RL0000 (rate limited) |
2/hr | max_connection_rate = 10000/h | 2 h |
| Comcast (vendor file) | RL000010 (domain throttled) |
Immediate | SuspendTenant | 5 m |
| Orange | "Trop de connexions" | 2/hr | connection_limit = 1 | 1 h |
| Orange | "Service refuse" | 2/hr | Suspend | 1 h |
| Orange | "Client host blocked for spamming issues" (Cloudmark reset URL variant) | 5/hr | Suspend | 2 h |
| Orange | "Client host blocked for spamming issues … spamhaus" | 5/hr | Suspend | 2 h |
| Mimecast | "Internal resource temporarily unavailable" | 3/hr | Suspend | 30 m |
| Netvigator | "Too many messages for this session" | 3/hr | Suspend | 30 m |
550 Sender frequency limited / 550 Ip frequency limited / 550 Connection frequency limited / 550 Domain frequency limited / 550 Mail content denied |
5/hr each | Suspend | 1 h | |
| 163.com | 451 DT:SPM (anti-spam deferral) |
5/hr | Suspend | 15 m |
| 163.com | 421 Too many connections |
2/hr | connection_limit = 1 | 1 h |
| 163.com | 554 DT:SPM |
2/hr | connection_limit = 1 | 1 h |
| 163.com | 550 RP:ORQ / 554 HL:ITC (daily limit reached) |
2/hr each | Suspend | 1 h |
Reading the pattern
Across providers the community's throttle logic is consistent with the design principles in MTA Delivery Tuning: mechanical-limit responses (too many connections / messages per session) get a parameter cut for about an hour; capacity blips ("server busy", "service unavailable") get short suspensions of 15–30 minutes; reputation events (user-complaint deferrals, blocklist rejections) get the longest suspensions (2–4 hours) because sending through them makes reputation worse. Note also how low the baselines sit relative to the global default: the biggest providers are shaped to 5 provider-wide connections, and several regional providers (Orange, Yahoo Japan) to just 2.
Caveats
- Values are what worked for KumoMTA operators as of the fetch date; providers change limits without notice, and per-IP reputation modulates what any given sender actually gets. Validate against your own deferral logs.
- Several entries carry in-file dates (Barracuda and Netvigator marked 2026-03-27; the Google/Workspace rollup note dated 2024-09-03) — a reminder that each row has its own freshness.
- The community file explicitly states rules are contributed as-is and must be combined with the vendor defaults file for full coverage.
- These are sender-side self-imposed limits, not published provider guarantees, except where marked "provided directly by" the provider (Yahoo, Comcast, Mimecast, mail.com, Mailgun).