SMTP AUTH and rate limiting at the listener

Wire up SASL PLAIN/LOGIN auth:

kumo.on('smtp_server_auth_plain', function(authz, authc, password, conn_meta)
  -- Look up credentials in your DB / file / Vault
  local ok = verify_password(authc, password)
  if ok then
    conn_meta:set_meta('tenant', tenant_for_user(authc))
    return true
  end
  return false
end)

You decide where credentials live — passwd-file, MySQL, Vault, HTTP API. KumoMTA just calls your function.

Per-listener rate limit to slow brute-force:

kumo.start_esmtp_listener {
  listen = '0.0.0.0:587',
  max_messages_per_connection = 1000,
  max_recipients_per_message  = 100,
  data_buffer_size           = '32MB',
  max_message_rate           = '50/s',  -- per source IP
}

Bind tenant metadata at AUTH time. Everything downstream — throttles, IP pool, queue selection — reads conn_meta for tenant. Get this right and the rest of the config writes itself.