-- /etc/kumomta/bounce_handler.lua
-- Real-time bounce classification and suppression

local SUPPRESSION_LIST = {}
local BOUNCE_STATS = { hard = 0, soft = 0, processed = 0 }

-- Load suppression list from file/db on startup
local function load_suppression_list()
    local f = io.open("/var/lib/kumomta/suppression.txt", "r")
    if f then
        for line in f:lines() do
            SUPPRESSION_LIST[line] = true
        end
        f:close()
        log_info("Loaded " .. #SUPPRESSION_LIST .. " suppressed addresses")
    end
end

local function add_to_suppression(email)
    SUPPRESSION_LIST[email] = true
    -- Persist to disk
    local f = io.open("/var/lib/kumomta/suppression.txt", "a")
    if f then
        f:write(email .. "\n")
        f:close()
    end
end

local function is_suppressed(email)
    return SUPPRESSION_LIST[email] == true
end

-- Bounce code classification
local function classify_bounce(smtp_response)
    local code = tonumber(smtp_response:match("%d+")) or 0

    -- RFC 3463 bounce classes
    if code >= 500 or (code >= 400 and code < 500 and string.find(smtp_response, "user unknown")) then
        return "hard"
    elseif code >= 400 then
        return "soft"
    else
        return "unknown"
    end
end

-- Main bounce handler
kumo.on("smtp_delivery_result", function(result, meta)
    BOUNCE_STATS.processed = BOUNCE_STATS.processed + 1
    local bounce_type = classify_bounce(result.message)

    if bounce_type == "hard" then
        BOUNCE_STATS.hard = BOUNCE_STATS.hard + 1
        add_to_suppression(meta.rcpt_to)
        log_warn("Hard bounce: " .. meta.rcpt_to .. " - " .. result.message)
    elseif bounce_type == "soft" then
        BOUNCE_STATS.soft = BOUNCE_STATS.soft + 1
        -- Log for escalation tracking
        track_soft_bounce(meta.rcpt_to, result.code)
    end

    -- Report metrics
    if BOUNCE_STATS.processed % 100 == 0 then
        local bounce_rate = (BOUNCE_STATS.hard / BOUNCE_STATS.processed) * 100
        log_info("Bounce stats: " .. BOUNCE_STATS.hard .. " hard, " ..
                 BOUNCE_STATS.soft .. " soft, rate: " ..
                 string.format("%.2f", bounce_rate) .. "%")
    end
end)

-- Pre-send check
kumo.on("smtp_message_received", function(domain, meta)
    local recipient = meta.rcpt_to

    if is_suppressed(recipient) then
        log_warn("Suppressed address rejected: " .. recipient)
        kumo.reject_recipient("550 5.1.1 Address suppressed")
    end
end)

load_suppression_list()

-- Real-time verification before accepting into queue
local function verify_email_address(email)
    local http = require("socket.http")
    local ltn12 = require("ltn12")
    local json = require("cjson")

    local response = {}
    local req = http.request{
        url = "https://api.zerobounce.net/v2/validate?email=" .. email .. "&apikey=YOUR_KEY",
        sink = ltn12.sink.table(response),
    }

    if req then
        local data = json.decode(table.concat(response))
        if data.status == "valid" or data.status == "catch-all" then
            return true
        else
            return false
        end
    end
    return true -- Fail open if API is unreachable
end

# Comment: Suppressed addresses - updated 2026-05-18
bounced-user@example.com
complained-user@spamtrap.net
unsubscribed@legitimate.com
mailbox-full-123@outlook.com

# Webhook receiver for bounce/complaint events
import json

def handle_webhook(event):
    if event['type'] == 'bounce':
        add_to_suppression(event['email'], reason='hard_bounce')
    elif event['type'] == 'complaint':
        add_to_suppression(event['email'], reason='complaint')

    # Propagate to all MTAs
    for mta in all_mtas:
        mta.sync_suppression(event['email'])

# /etc/pmta/config

# Bounce classification
bounce检查-level up to 2
bounce-interval 15m

# Hard bounce rules
add-parts-filter bounce-checker
match-command RCPT TO (.*) (.*)
    body-match "User unknown" do
        bounce [code] [enhanced-code]
        log-bounce
        suppress
    /match

# Soft bounce rules
match-command RCPT TO (.*) (.*)
    body-match "Mailbox full" do
        tempfail
        retry 3 times every 15 minutes
    /match

# Feedback loop processing
feedbackloop <your-company@postmaster.com>
    add-feedback-filter fbl
    class auto
    source postmaster