mail-spam Free

SMTP rejects collected faster than any mistake explains — spam or address guessing; the rejects themselves are the evidence

Category

mail

Threshold

3/1h, 6/24h, 10/7d

Ban policy

attack

Report

mail-spam

Parsers

postfix-reject

Why it is written this way

The rule file View raw

# An address collecting SMTP rejects — recipient guessing, spam runs,
# relay sweeps — six in two minutes. A single reject is written for a
# legitimate correspondent's server typoing an address too, which is
# why there is a threshold at all; six in two minutes is a machine
# working through a list (CrowdSec's postfix-spam: capacity 5,
# leakspeed 10s).
rule: mail-spam
description: "SMTP rejects collected faster than any mistake explains — spam or address guessing; the rejects themselves are the evidence"
about:
  purpose: >-
    Ban an address collecting delivery rejections — a spam run meeting your filters.
  blocks: >-
    Three rejected deliveries in an hour, six in a day, ten in a week.
  applies_to: >-
    Any machine running Postfix.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
  beware:
    - >-
      A legitimate correspondent's server typoing an address is rejected too, which is why there is a threshold at all. Keep this one at its numbers unless you have measured your own.
category: mail
parsers:
  - postfix-reject
# Connections opened and dropped without delivering left on 2026-09-09
# for mail-connect-probe: they are not rejected deliveries and must not
# be reported as any. Of two days' bans under this rule, 90 were a real
# rejected delivery and 1 209 were a connection that never delivered
# anything.
#
# And the patient one: a reject every hour or two, for days — 28 in two
# and a half days from one address (2026-09-07), never six in two
# minutes. Twelve in a day, thirty in a week: a correspondent's server
# retrying one typo does not reach that; a list being worked does.
# Longer windows, lower counts (Robin, 2026-09-08): what knocks and
# hangs up comes back hours later, not seconds later — four connections
# dropped between nine in the morning and eight in the evening were
# nowhere near a two-minute count.
threshold: [3/1h, 6/24h, 10/7d]
ban: attack
report: mail-spam