diff --git a/extras/kolab_policy_ratelimit.py b/extras/kolab_policy_ratelimit.py
deleted file mode 100755
--- a/extras/kolab_policy_ratelimit.py
+++ /dev/null
@@ -1,79 +0,0 @@
-#!/usr/bin/python3
-"""
-This policy applies rate limitations
-"""
-
-import json
-import time
-import sys
-
-import requests
-
-
-def read_request_input():
-    """
-        Read a single policy request from sys.stdin, and return a dictionary
-        containing the request.
-    """
-    start_time = time.time()
-
-    policy_request = {}
-    end_of_request = False
-
-    while not end_of_request:
-        if (time.time() - start_time) >= 10:
-            sys.exit(0)
-
-        request_line = sys.stdin.readline()
-
-        if request_line.strip() == '':
-            if 'request' in policy_request:
-                end_of_request = True
-        else:
-            request_line = request_line.strip()
-            request_key = request_line.split('=')[0]
-            request_value = '='.join(request_line.split('=')[1:])
-
-            policy_request[request_key] = request_value
-
-    return policy_request
-
-
-if __name__ == "__main__":
-    URL = 'https://services.kolabnow.com/api/webhooks/policy/ratelimit'
-
-    # Start the work
-    while True:
-        REQUEST = read_request_input()
-
-        try:
-            RESPONSE = requests.post(
-                URL,
-                data=REQUEST,
-                verify=True
-            )
-        # pylint: disable=broad-except
-        except Exception:
-            print("action=DEFER_IF_PERMIT Temporary error, try again later.")
-            sys.exit(1)
-
-        try:
-            R = json.loads(RESPONSE.text)
-        # pylint: disable=broad-except
-        except Exception:
-            sys.exit(1)
-
-        if 'prepend' in R:
-            for prepend in R['prepend']:
-                print("action=PREPEND {0}".format(prepend))
-
-        if RESPONSE.ok:
-            print("action={0}\n".format(R['response']))
-
-            sys.stdout.flush()
-        else:
-            print("action={0} {1}\n".format(R['response'], R['reason']))
-
-            sys.stdout.flush()
-
-        sys.exit(0)
diff --git a/src/app/Http/Controllers/API/V4/PolicyController.php b/src/app/Http/Controllers/API/V4/PolicyController.php
--- a/src/app/Http/Controllers/API/V4/PolicyController.php
+++ b/src/app/Http/Controllers/API/V4/PolicyController.php
@@ -42,67 +42,6 @@
         return response()->json($result, 200);
     }
 
-    /*
-     * Apply a sensible rate limitation to a request.
-     *
-     * @return \Illuminate\Http\JsonResponse
-     */
-    public function ratelimit()
-    {
-        /*
-        $data = [
-            'instance' => 'test.local.instance',
-            'protocol_state' => 'RCPT',
-            'sender' => 'sender@spf-pass.kolab.org',
-            'client_name' => 'mx.kolabnow.com',
-            'client_address' => '212.103.80.148',
-            'recipient' => $this->domainOwner->email
-        ];
-
-        $response = $this->post('/api/webhooks/spf', $data);
-        */
-
-        $data = \request()->input();
-
-        // TODO: normalize sender address
-        $sender = strtolower($data['sender']);
-
-        $alias = \App\UserAlias::where('alias', $sender)->first();
-
-        if (!$alias) {
-            $user = \App\User::where('email', $sender)->first();
-
-            if (!$user) {
-                // what's the situation here?
-            }
-        } else {
-            $user = $alias->user;
-        }
-
-        // TODO time-limit
-        $userRates = \App\Policy\Ratelimit::where('user_id', $user->id);
-
-        // TODO message vs. recipient limit
-        if ($userRates->count() > 10) {
-            // TODO
-        }
-
-        // this is the wallet to which the account is billed
-        $wallet = $user->wallet;
-
-        // TODO: consider $wallet->payments;
-
-        $owner = $wallet->user;
-
-        // TODO time-limit
-        $ownerRates = \App\Policy\Ratelimit::where('owner_id', $owner->id);
-
-        // TODO message vs. recipient limit (w/ user counts)
-        if ($ownerRates->count() > 10) {
-            // TODO
-        }
-    }
-
     /*
      * Apply the sender policy framework to a request.
      *
diff --git a/src/routes/api.php b/src/routes/api.php
--- a/src/routes/api.php
+++ b/src/routes/api.php
@@ -145,7 +145,6 @@
     ],
     function () {
         Route::post('greylist', 'API\V4\PolicyController@greylist');
-        Route::post('ratelimit', 'API\V4\PolicyController@ratelimit');
         Route::post('spf', 'API\V4\PolicyController@senderPolicyFramework');
     }
 );
diff --git a/src/tests/Feature/Stories/SenderPolicyFrameworkTest.php b/src/tests/Feature/Stories/SenderPolicyFrameworkTest.php
--- a/src/tests/Feature/Stories/SenderPolicyFrameworkTest.php
+++ b/src/tests/Feature/Stories/SenderPolicyFrameworkTest.php
@@ -6,13 +6,13 @@
 
 class SenderPolicyFrameworkTest extends TestCase
 {
-    public function setUp()
+    public function setUp(): void
     {
         parent::setUp();
         $this->useServicesUrl();
     }
 
-    public function tearDown()
+    public function tearDown(): void
     {
         $this->useNormalUrl();
         parent::tearDown();
@@ -146,7 +146,7 @@
 
         $response = $this->post('/api/webhooks/policy/spf', $data);
 
-        $response->assertStatus(200);
+        $response->assertStatus(403);
     }
 
     public function testSenderTemperror()
@@ -162,7 +162,7 @@
 
         $response = $this->post('/api/webhooks/policy/spf', $data);
 
-        $response->assertStatus(403);
+        $response->assertStatus(200);
     }
 
     public function testSenderRelayPolicyHeloExactNegative()
diff --git a/src/tests/TestCase.php b/src/tests/TestCase.php
--- a/src/tests/TestCase.php
+++ b/src/tests/TestCase.php
@@ -24,10 +24,10 @@
     /**
      * Set baseURL to the normal location
      */
-    protected static function useServicesUrl(): void
+    protected static function useNormalUrl(): void
     {
         // This will set base URL for all tests in a file.
-        \config(['app.url' => 'https://' . \config('app.domain'))]);
+        \config(['app.url' => 'https://' . \config('app.domain')]);
         url()->forceRootUrl(config('app.url'));
     }