Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In our mail server we are taking lots of hits. In the maillog there are lots of these:

Apr 23 04:35:13 mail1 postfix/smtpd[31700]: NOQUEUE: reject: RCPT from unknown[]: 554 <>: Recipient address rejected: User unknown in local recipient table; from=<> to=<> proto=ESMTP helo=<localhost>

I have a script which searches for the IPs and block those. I'm having a problem when I IP block the RCPT IP's. Instead I want to block the senders domain, like in this example: What should I modify in my script to do this?

cd /admin
# first get one minute of log
grep "`date +"%b %d %H:%M:" --date="1 minutes ago"`" /var/log/maillog > minutelog
# now extract the rejected attempts, sort and count uniq ip
cat minutelog | grep "reject:" | cut -d" " -f10 | cut -d"[" -f2 | cut -d"]" -f 1 | sort | uniq -c | sort -n | sed 's/^[ \t]*//' > tmp1
# for each line in result
while read line
MYCOUNT=`echo $line | cut -d" " -f1`
MYIP=`echo $line | cut -d" " -f2`
if [ $MYCOUNT -lt $LIMIT ] ;
echo $MYIP is ok: $MYCOUNT attempts
echo blocking the spammer at $MYIP with $MYCOUNT attempts
$IPT -I INPUT -i eth0 --proto tcp -s $MYIP --destination-port 25 -j DROP
echo $MYIP >> blocked.smtp
done < tmp1
rm -f minutelog
rm -f tmp1
share|improve this question
Deleted, didn't notice count in script. – AlexD Apr 24 '11 at 4:02
up vote 1 down vote accepted

It is impossible to block by SMTP sender domain using only IP filter because e-mail with given domain could originate from any IP. Moreover it is dangerous to block by sender domain at all because anyone could spoof sender e-mail and send multiple messages with something like and your script will happily block all traffic from gmail.

To solve your problem I recommend checking section "Measures against clients that make too many connections" in

share|improve this answer
Thanks for the advice. – Saif Apr 24 '11 at 6:27

It's better to try Fail2ban:

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.