Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My mail.log is overflowing with random spammers attempting to send spam through my server.

Is this typical or have I misconfigured something?

Is there a way to ban an IP after several attempts of relaying or is there a way not to log these attempts? (latter might be a bad idea)

share|improve this question
up vote 2 down vote accepted

Once they find an IP that answers to port 25, they'll try everything they can to relay through it or guess valid email addresses that they can deliver spam to. I don't think you want to quit logging it just in case something does come through that you later need to diagnose.

fail2ban and iptables --recent would cut down on the log entries by firewalling the IPs that are attempting to connect multiple times. Each has a 'window' of opportunity for a spammer to try before getting blocked. fail2ban would be better in this case as it would block based on failure messages. iptables --recent is much less discriminate and might block legitimate connections that passed a threshhold.

You could alter your syslog configuration to log only .info to your maillog, and .warn/.err to a separate file.

share|improve this answer
Thanks, working on setting up fail2ban as you recommended. – styts Jun 30 '10 at 19:45

You can also set these options for postfix to reject connections from rogue clients.

smtpd_error_sleep_time = 10s
smtpd_soft_error_limit = 10
smtpd_hard_error_limit = 20
share|improve this answer
can you please elaborate on how these limits could be used to block "relay access" attacks? – Martin Vegter Jun 26 '14 at 7:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.