Followup... yes found the exact feature you are looking for:

     g_sent_store "System_Sent"
with
     expire_rule folder="System_Sent" age="30".



Also look at the settings:

g_spam_user_max, g_spam_user_warn, g_breakin_enable, g_country_login

g_hacker_max + g_hacker_days
g_hacker_password / g_hacker_passwords / g_hacker_weak
g_hacker_alert

Let me know how that goes.

Marijn



On Thursday 12/11/2026 at 3:32 pm, SurgeMail Support (Marijn) via list wrote:


Hi

That is the first mailing list post in a while!  Here are my thoughts on the matter :-)

Are those guesses from "safe" countries or "obscure" countries, particularly if obscure I would start with g_country_ip based detection. Typical settings might be:

               g_country_ip "TRUE"
               g_safe_country "US,AU,NZ,FR,GB,CA"
               g_safe_alert "TRUE"
and maybe
               g_safe_warning "TRUE"
is a good combination for early detection of compromised accounts.


I am not aware of any features that match exactly what you are suggesting, but will have a look to see what I can find.

The most relevant existing feature is :
           g_redirect_from_cc from="*@mydomain.com" to="ourtbound@mydomain.com"
would allow you to capture all outbound mail from all or some matching accounts in one place and and setup expire rules to only keep 30 days worth.

I think these could be made to work too:
1) each of the archive features
2) mfilter based solution


Also there already is a sent_store feature that allows mail clients to trigger the store to sent folder on an authenticated SMTP session to do most of what you are describing without having to separately imap upload the messages. That could easily be extended and always trigger.


Hmmm... maybe Chris has already implemented your exact feature, this always used to be his area... I will do some more source code hunting :-)


Marijn








On Thursday 12/11/2026 at 2:56 pm, Lyle Giese via list  wrote:

My personal Surgemail server has been under very heavy password attack  from around the world.  They know valid user ids and pound away to the  tune of thousands per account every day.  It's been going on for about  2 or 3 months now.

Like a blind squirrel looking for nuts, they finally found a valid  password and proceed to abuse it.  However the abuse was a very small  volume of messages to valid email addresses(no NDRs generated).  The  only way I discovered it was that I use a relayhost for relaying email  and monitor all email outbound on it.  So any damage was limited and I  quickly changed the password on the effected email account.

Now my question pertains to outbound email.  If a password is  compromised, how do I easily discover that?  If the abusers are smart  and don't send any email that generates an NDR, the abuse could  continue with little notice esp with low mail volume generated.

My question pertains to sent email.  Right now, it's up the the email  sending agent to archive sent email to the 'Sent' folder.  I don;t see  off hand how I can capture outbound email and review it.  Email  archiving is one way, but how would that give me easy access to volume  of sent mail per account? The rules per account seem to be for inbound  email only.

I am thinking I could use a rule to save a copy of outbound email  server side into a special 'sent' folder for each account(or against  each account).  Then just glance at the number of messages once or  twice a day and see out of normal usage. For this to work, I need this  to be a server side rule and not rely on the email sender.  Archiving  includes all email for the account, incoming and outgoing and doesn't  lend itself to easy viewing.

I don't want this for long term storage and would limit to 30days or  less.

Lyle Giese