# Incident — outbound rate limit exceeded, mail permanently lost Date: 2026-08-17 (Monday), window 09:30–09:57 server time. Detected via a deferral notice received by Bastien; analyzed in Track Delivery (data retention: 1 day — this file is the durable record). ## Verdict: legitimate HR bulk send, NOT a compromise - `hr@advmfr.net` sent a bulk mailing (authenticated SMTP, `esmtpa`, from `27.145.49.135` asianet residential, hostname `DESKTOP-1LV4VG7`, body ~73 KB) to ~200+ **personal** Gmail/Hotmail addresses of employees. - Recipient names match existing company mailboxes (sunita, kittisak, waraporn, romtham, parintorn, kannikar…) plus Burmese-name addresses consistent with the workforce. Pattern = payslip/announcement distribution, not spam. ## Impact - o2switch domain-wide limit: **180 emails/hour**. At 100% mail is deferred and retried; the log then shows **225/180 (125%) → "Message discarded"** = permanent loss. - **~185 HR recipients never received the mailing** (list below, to re-send). - **Collateral loss on a shared quota**: at 09:57, business-critical mail from `export@advmfr.net` was **discarded**: - `thicc@fedex.com` - `thclearance3@fedex.com` - `592276@fedex.com` - `export.advmfr@gmail.com` → export must re-send these (FedEx customs clearance traffic). ## Immediate actions 1. Tell HR the mailing mostly did NOT go out; re-send **in batches of max 100/hour** (or wait for the ESP solution below). The quota is per domain and shared: while HR re-sends, other mailboxes' outbound counts too. 2. Tell export to re-send the 4 discarded messages above. 3. Verify this list against Track Delivery before it expires (24 h retention). ## Update, same day: re-send now blocked by MailChannels The HR re-send triggered a second, different rejection: o2switch's shared outbound relay (smtp.mailchannels.net) returns `550 5.7.1 [CS] Message blocked` for `hr@advmfr.net` (bounce example: recipient `suree7445@gmail.com`, MailChannels txid 13407f960baafbc6, auid=o2switch). The relay's content filter now classifies the mailing as spam: identical content, bulk volume, all-freemail recipients, right after yesterday's 225-message burst. That is the standard spammer profile from the relay's point of view. Consequences: - **Stop re-sending the HR mailing through the mailbox immediately.** Each retry worsens the sender's reputation on a relay shared with the whole server. - The o2switch boilerplate advice "change your password if you never sent this" does not apply: we know HR sent it. - False-positive reports go through o2switch (per the MailChannels bounce page), but the correct fix is not to fight the relay; bulk mail does not belong on it. - To check once traffic resumes: whether ordinary 1:1 mail from `hr@` passes (single test message to one known recipient). If even 1:1 mail is blocked, open a ticket with o2switch referencing the MailChannels txid. ## Structural fix (to discuss with Narin) - Bulk mailings (HR, announcements) must not go through the cPanel mailbox: the 180/h cap is fixed, and the MailChannels relay actively blocks bulk patterns anyway. - Brevo rejected by Bastien (cost). **Chosen alternative, zero cost: the client's own Google Workspace on advmfr.com** (MX/SPF already on Google). Two ways: 1. Create a Google Group (e.g. `staff-list@advmfr.com`) containing the ~200 personal addresses; HR sends ONE email to the group. Best deliverability (Google → Gmail), one click for future mailings, membership managed by HR. 2. Or send from `hr@advmfr.com` with the list in BCC (Workspace allows up to 2,000 recipients/day, far above the need). Prerequisite to confirm with Narin: an active Workspace mailbox HR can use on advmfr.com. - "It worked on Bluehost": different host, different outbound policy. Bluehost tolerated the volume; o2switch shared hosting routes all outbound through a 180/h domain cap plus the MailChannels content filter, and that policy is not negotiable on shared plans. Note that "accepted by the relay" never meant "delivered to inbox": 200 identical messages to freemail addresses from shared hosting mostly land in spam folders anyway. The Google route fixes both acceptance and inbox placement. - o2switch mailbox remains for normal 1:1 business mail only. - Add to AKE's guide: "Message discarded" or "exceeded the max emails per hour" in Track Delivery = alert immediately. ## Discarded recipients — hr@advmfr.net mailing (to re-send) Transcribed from Track Delivery 2026-08-17; verify against the live log before EOD. 09:41 piyapornphoolakorn@gmail.com, chombusaywaew@gmail.com, suknoppa19867@gmail.com, mintmew876@gmail.com, krataithong1707@gmail.com 09:40 pariyachatkathong1@gmail.com, kanchanachaipanya07@gmail.com, chochomhwe37@gmail.com, sukonlawatmaseeda@gmail.com, faiik5207@gmail.com, susuh2922@gmail.com, c18090327@gmail.com, ssainuan21@gmail.com, maywin5572@gmail.com, eieisanthai@gmail.com, siriaa895@gmail.com, parintorn.wo@gmail.com, romthamburnrot@gmail.com, phatchani445693@gmail.com, yupa199122@gmail.com, bm3702202@gmail.com 09:39 lope6080@gmail.com, praepayom03@gmail.com, apichada01@gmail.com, nattarikan504@gmail.com, atikarn.ph@gmail.com, patcharapa24052@gmail.com, phanpanat996@gmail.com, nattaganmekmok@gmail.com, gaewarin1233@gmail.com, kyawminthan860@gmail.com, kmn1997210@gmail.com, ksun572@gmail.com, kritsana.anyapho@gmail.com, malangworranut@gmail.com, warilk.2542@gmail.com, kikkii40@hotmail.com, noeychalita28@gmail.com 09:38 sharkmegalo@gmail.com, waraporn.14121987@gmail.com, rungthiphykhakaew4@gmail.com, sanhtooaung9619@gmail.com, suthamatchanthapha@gmail.com, prawa25466@gmail.com, thidamas2003@gmail.com, nuttanicha6995@gmail.com, wanna120843@gmail.com, simmaluangg@gmail.com, mamyma230@gmail.com, sirinporn36120@gmail.com, uliaporns@gmail.com, naphatsaxc@gmail.com, klauysonthaya13@gmail.com, chomphoo212106@gmail.com, chetsadaphong99@gmail.com 09:37 pongsathon291143@gmail.com, janyabonnam@gmail.com, onuma171999@gmail.com, aiaifluke@gmail.com, rattikannontawat@gmail.com, supraneesabsuwan@gmail.com, nattanapat.a@gmail.com, hthaythiphychunceriy@gmail.com, jiranan212549@gmail.com, jane20072540@gmail.com, nampuang984@gmail.com, sunita2759@gmail.com, ausani22865@gmail.com, phatrasaya0292@gmail.com, fahfahhhh545@gmail.com, pijakpimpa.hin@gmail.com, penpayom26081998@gmail.com 09:36 sutarattt201723@gmail.com, s42358640@gmail.com, monthathip.ni21@gmail.com, viyada202524@gmail.com, sirilaksingsuk@gmail.com, duangchai212533@gmail.com, dec2001it@gmail.com, theer201@gmail.com, kittisak.chw41@gmail.com, paveenaruksat18@gmail.com, kanisara0637141911@gmail.com, pitaporn.w@gmail.com, pimlapas.m1998@gmail.com, numfon.0203@gmail.com, s99972166@gmail.com, choc99776@gmail.com 09:35 aungnaingg5799@gmail.com, snithkamutha9@gmail.com (x2), kyawminthan860@gmail.com, "choc 64088"@gmail.com (malformed address, check with HR), manyeinmyein@gmail.com, myintiwin9009@gmail.com, wittayachaisaeng@gmail.com, warapornpromnang@gmail.com, pra.supawit@gmail.com, sarot303@gmail.com, ketcharin8880@gmail.com, pramothysilakhm@gmail.com, chalalai12356@gmail.com, noomza2508@gmail.com, palm13910@gmail.com, noom2088@gmail.com 09:34 wittyawat123@gmail.com, chonnicha254512@gmail.com, thanyarat0948@gmail.com, nattamon0219@gmail.com, jetsadapornp12@gmail.com, nickichom@gmail.com, nan01051983@gmail.com, waraphon222308@gmail.com, sumetprompichai95@gmail.com, fan6113@gmail.com, aun1509af@gmail.com, koy2561998@gmail.com, wa11112538@gmail.com, nattapotn5141@gmail.com, yuy041141@gmail.com, tgxzz23@gmail.com, narinwata21@gmail.com 09:33 w7369923@gmail.com, pitchakron2537@gmail.com, saisamorn.sungseekeaw@gmail.com, 090626ooll@gmail.com, sulisa.nernklang1995@gmail.com, niphada760@gmail.com, s72820657@gmail.com, bathaunh619@gmail.com, oppoais0841@gmail.com, phookatesomboon@gmail.com, chavhewanmoonoi@gmail.com, kewclub1130@gmail.com, hninwaihlaingy200@gmail.com, eiwaiphoo56@gmail.com, mt9659919@gmail.com, sasimapaya1010@gmail.com, matayea7531@gmail.com, vjone0383@gmail.com 09:32 boyb22512237@gmail.com, kunanyakat1997@gmail.com, sitananla2543@gmail.com, wipawan252701@gmail.com, 19yanisa@gmail.com, ananyaporn218@gmail.com, natchasonchai50@gmail.com, doraemon199018@gmail.com, wunwipa060140@gmail.com, orapan1087@gmail.com, myomyoa990@gmail.com, pleasepps85@gmail.com, maungthanhtike32@gmail.com, poo05389@gmail.com, yuyt88642@gmail.com, minchitmin584@gmail.com, nitchananthongtidram@gmail.com 09:31 uyuy59287@gmail.com, win352602@gmail.com, nutawa08@gmail.com, nongtoen.07092557@gmail.com, jiwmaliwan192@gmail.com, phisarinthan3870@gmail.com, thidarat100802@gmail.com, w54249819@gmail.com, naphapornsridi@gmail.com, anocha12340@gmail.com, araya.ngahatthee29448@gmail.com, ooydyy8888@gmail.com, ratsamee191038@gmail.com, aftaban1981@gmail.com, budsaba.jaiboon@gmail.com, ningchorphaka@gmail.com, yuisamila2002@gmail.com 09:30 sirikanda102529@gmail.com, oomzaa7999@gmail.com, teekannikar40@gmail.com ## Discarded — export@advmfr.net (09:57, to re-send) thicc@fedex.com, export.advmfr@gmail.com, thclearance3@fedex.com, 592276@fedex.com