Fix Auto-ban: IP block expiration ignores per-reason ban durations

CHANGELOG.md

@@ -22,6 +22,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 - Masked emails: Return `UnknownRecipient` only for disabled or expired masked emails.
 - IDN: `sanitize_email` rejects valid Punycode domains.
 - Directory: Removing a user from all groups does not sync the changes correctly.
+- Auto-ban: IP block expiration ignores per-reason ban durations.
 
 ## [0.16.11] - 2026-06-25
 

crates/common/src/network/security.rs

@@ -36,7 +36,10 @@ pub struct Security {
     pub allowed_ip_addresses: AHashSet<IpWithTtl<IpAddr>>,
     pub allowed_ip_networks: Vec<IpWithTtl<IpAddrOrMask>>,
     pub has_allowed_networks: bool,
-    pub blocked_ip_expiration: Option<u64>,
+    pub auth_ban_period: Option<u64>,
+    pub abuse_ban_period: Option<u64>,
+    pub loiter_ban_period: Option<u64>,
+    pub scan_ban_period: Option<u64>,
 
     pub http_banned_paths: Vec<MatchType>,
     pub scanner_fail_rate: Option<Rate>,
@@ -164,7 +167,10 @@ impl Security {
             has_allowed_networks: !allowed_ip_networks.is_empty(),
             allowed_ip_addresses,
             allowed_ip_networks,
-            blocked_ip_expiration: security.auth_ban_period.map(|v| v.as_secs()),
+            auth_ban_period: security.auth_ban_period.map(|v| v.as_secs()),
+            abuse_ban_period: security.abuse_ban_period.map(|v| v.as_secs()),
+            loiter_ban_period: security.loiter_ban_period.map(|v| v.as_secs()),
+            scan_ban_period: security.scan_ban_period.map(|v| v.as_secs()),
             auth_fail_rate: security.auth_ban_rate,
             rcpt_fail_rate: security.abuse_ban_rate,
             loiter_fail_rate: security.loiter_ban_rate,
@@ -191,6 +197,16 @@ impl Security {
             password_default_expiration: auth.password_default_expiry.map(|v| v.as_secs()),
         }
     }
+
+    fn ban_period(&self, reason: BlockReason) -> Option<u64> {
+        match reason {
+            BlockReason::RcptToFailure => self.abuse_ban_period,
+            BlockReason::AuthFailure => self.auth_ban_period,
+            BlockReason::Loitering => self.loiter_ban_period,
+            BlockReason::PortScanning => self.scan_ban_period,
+            BlockReason::Manual | BlockReason::Other => None,
+        }
+    }
 }
 
 impl Server {
@@ -304,7 +320,7 @@ impl Server {
             .core
             .network
             .security
-            .blocked_ip_expiration
+            .ban_period(reason)
             .map(|v| now + v);
         self.inner
             .data