Volume limits documented per ESP and IP
Why it matters
Every ESP plan has hard sending limits — SES sandbox defaults to 1 send per second and 200 per day; SendGrid's free tier caps at 100 sends per second. Exceeding these limits produces 429 errors that fail jobs and degrade IP reputation if retried without backoff. CWE-770 (allocation without limits) applies when queue concurrency is uncapped relative to the ESP tier. The Deliverability Engineering Audit's IP reputation category depends on sends staying within known limits — this check verifies that those limits are actually documented and enforced in code, not just hoped to be safe.
Severity rationale
High because sending above ESP tier limits produces throttling errors that increase bounce rate, consume retry budget, and can trigger account suspension on plans with anti-abuse enforcement.
Remediation
Document ESP limits and wire them to the rate limiter configuration in a dedicated file (e.g., src/config/email-limits.ts):
// src/config/email-limits.ts
export const ESP_LIMITS = {
sendgrid: { perSecond: 100, perDay: 1_000_000 },
ses: { perSecond: 14, perDay: 50_000 } // SES sandbox defaults
} as const
// BullMQ rate limiter:
const limiter = { max: 100, duration: 1000 } // 100/second
Include the source plan tier and date in a comment — limits change when plans change. The queue limiter value must not exceed the documented per-second limit for the configured ESP.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Operational Resilience (Email) Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-770 — Allocation of Resources Without Limits or Throttling — queue fires at full capacity with no documented rate ceiling
- iso-25010:2011 · performance-efficiency.resource-utilization — Performance Efficiency / Resource Utilisation — volume limits must be documented and enforced
Taxons
History
- 2026-04-18·v1.0.0·Initial import from operational-resilience-email·automated