Comprehensive Guide to iRedAPD in iRedMail

1. What is iRedAPD?

iRedAPD is a Policy Server for Postfix. It:

Does NOT scan email content
Does NOT detect spam
Does NOT inspect attachments

Its only job is to decide whether an SMTP action is allowed or denied.

2. iRedAPD in iRedMail Architecture

Client / Internet
      ↓
    Postfix
      ↓  (policy check)
   iRedAPD  ← decision-making
      ↓
 Amavis / Queue

iRedAPD communicates directly with Postfix.

3. Core Responsibilities of iRedAPD

1️⃣ Rate Limiting

Limits number of emails per hour/day
Prevents outbound spam bursts

2️⃣ Sender Restrictions

Prevents sending from forged addresses
Enforces sender login matching

3️⃣ Recipient Restrictions

Prevents abuse toward a specific recipient

4️⃣ Greylisting (optional)

Reduces automated spam

4. Components of iRedAPD

iredapd (daemon) — main Python service
Backend database — MariaDB/MySQL or PostgreSQL

5. Important iRedAPD Paths

Path	Description
/opt/iredapd/	Main program directory
/opt/iredapd/settings.py	Configuration file
/etc/postfix/main.cf	Postfix policy integration
/var/log/iredapd/	Logs

6. Connecting iRedAPD to Postfix

In main.cf:

smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    check_policy_service inet:127.0.0.1:7777

Default port: 7777

7. Key Settings in settings.py

Path:

/opt/iredapd/settings.py

7.1 Enable/Disable Plugins

plugins = [
    'reject_null_sender',
    'reject_sender_login_mismatch',
    'throttle',
]

7.2 Rate Limiting (critical)

THROTTLE_SENDER = {
  'inbound': (60, 3600),
  'outbound': (200, 3600),
}

This means: 200 outbound emails per hour.

7.3 Prevent Sender Spoofing

REJECT_SENDER_LOGIN_MISMATCH = True

8. Logs & Debugging

View logs:

tail -f /var/log/iredapd/iredapd.log

Example log:

REJECT Throttled sender

9. Security Best Practices

Always configure rate limits
Outbound limits should be stricter than inbound
Enable greylisting only if your SMTP server is strong enough
Ensure iRedAPD is always running

10. Common Issues

Email not sending

Rate limit too low
Incorrect plugin enabled

Server blacklisted

iRedAPD disabled
Outbound unlimited

11. iRedAPD vs Rspamd (Policy Layer)

Feature	iRedAPD	Rspamd
Rate limiting	✅	✅
Greylisting	✅	❌
Simplicity	✅	❌
Modern features	❌	✅

Conclusion

iRedAPD is the first line of defense before emails enter the Postfix queue. If misconfigured, it can cause major delivery issues; if configured correctly, it provides stability, protection, and peace of mind. It prevents spoofing, controls outbound traffic, and ensures your mail server stays healthy and trusted.