ratelimit ACL condition can be used to measure and control the rate at which clients can send email. This is more powerful than the smtp_ratelimit_* options, because those options control the rate of commands in a single SMTP session only, whereas the ratelimit condition works across all connections (concurrent and sequential) from the same client host. The syntax of the ratelimit condition is:

ratelimit = <m> / <p> / <options> / <key>
If the average client sending rate is less than m messages per time period p then the condition is false; otherwise it is true.

As a side-effect, the ratelimit condition sets the expansion variable $sender_rate to the client’s computed rate, $sender_rate_limit to the configured value of m, and $sender_rate_period to the configured value of p.

If a client’s average rate is greater than the maximum, the rate limiting engine can react in two possible ways, depending on the presence of the strict or leaky options. This is independent of the other counter-measures (such as rejecting the message) that may be specified by the rest of the ACL. The default mode is leaky, which avoids a sender’s over-aggressive retry rate preventing it from getting any email through.

The strict option means that the client’s recorded rate is always updated. The effect of this is that Exim measures the client’s average rate of attempts to send email, which can be much higher than the maximum. If the client is over the limit it will be subjected to counter-measures until it slows down below the maximum rate. The smoothing period determines the time it takes for a high sending rate to decay exponentially to 37% of its peak value, which means that you can work out the time (the number of smoothing periods) that a client is subjected to counter-measures after an over-limit burst with this formula:

ln(peakrate/maxrate)

The leaky option means that the client’s recorded rate is not updated if it is above the limit. The effect of this is that Exim measures the client’s average rate of successfully sent email, which cannot be greater than the maximum. If the client is over the limit it will suffer some counter-measures, but it will still be able to send email at the configured maximum rate, whatever the rate of its attempts. This is generally the better choice if you have clients that retry automatically.

Reference URL: http://www.exim-new-users.co.uk/content/view/65/39/

~Still have some Q on how does the rate limit work?!