Hi, I'm new to this forum, but I have come here as I have a specific problem and after searching the web I found very little about this, and this forum seemed to be the best place to start asking. My production mail server supports about 100 people and about 600/1000 emails a day. But it gets around 20,000 lost connections from UNKNOWN per day, with a typical UNKNOWN IP address creating 300/400 each. Here is a log summary Connections lost: Connection lost while AUTH : 20 Time(s) Connection lost while CONNECT : 1267 Time(s) Connection lost while EHLO : 1 Time(s) Connection lost while END-OF-MESSAGE : 1 Time(s) Connection lost while NOOP : 1 Time(s) Connection lost while RCPT : 49 Time(s) Connection lost while RSET : 1 Time(s) Connection lost while UNKNOWN : 17645 Time(s) On my test / secondary server (which handles about 80 emails a day) I dont get any Connection lost while UNKNOWN What is going on, is the a DOS (it been going on for at least a month) or spambots or brute force attempts, or similar? I have had some complaints about server connections not being made, and I can't see anything specific in the logs apart from all these entries, so will this number of lost connections materially impact the performance? If so should I do something like fail2ban the UNKOWN/unkowns, or could it be something else like a bad config setting? I think my server is more than powerful enough to handle the normal load. Any thoughts or areas to look at, gratefully received.