I actually set mine to 1.  It prevents the hammering.  As for legit emails, a legit email will retry again some time after the blacklist clears.

This compliance feature is great, but it works only if failed RCPTs are in one session.

We often get 50+ connections (concurrent or within minutes) from same IP which are all ending with user unknown. But as these are seperate sessions there is no way to automatically blacklist them.

For us it would be a great feature if it would be possible to blacklist these IPs the same way as it is done within one session.

I've never tried this, but if you set the maximum failures to 1 won't that blacklist the IP?  There should not be many legitimate senders affected by this, but it may be necessary to monitor the logs to check.

1 is not a good idea, as any legitimate sender who makes a mistake will get blacklisted. We often get mails addressed to several local users and if one leaves the company some time later we remove his/her mailbox - so a mail to this now unknown user would blacklist the sender.

I agree - I wouldn't be comfortable recommending that anyone use a value lower than 3 for failed RCPTs.

As for the original question...  I know exactly what you're describing (I see the same kind of probing on my production server most days), but I can't offer a solution at this stage, sorry.

Cheers!

-- David --

Hello David,

At first thank you for your great software.

My question was only a suggestion for a future release and it is good to know that you also get these kind of connections.

Regards from Germany
Axel