Is this a spammer trying to access or just the system?

I solved this issue by adding this below line:

smtpd_tls_auth_only = yes

in

/etc/postfix/main.cf

file. Then restart postfix:

service postfix restart

Three years later, and I am going to be that guy who revives this thread :-)

I added the following entries to /etc/postfix/main.cf ::

disable_vrfy_command = yes
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,
     reject_non_fqdn_hostname,
     reject_invalid_hostname,
     permit
smtpd_recipient_restrictions =
   permit_sasl_authenticated,
   reject_invalid_hostname,
   reject_non_fqdn_hostname,
   reject_non_fqdn_sender,
   reject_non_fqdn_recipient,
   reject_unknown_sender_domain,
   reject_unknown_recipient_domain,
   permit_mynetworks,
   reject_rbl_client list.dsbl.org,
   reject_rbl_client sbl.spamhaus.org,
   reject_rbl_client cbl.abuseat.org,
   reject_rbl_client dul.dnsbl.sorbs.net,
   permit
smtpd_error_sleep_time = 1s
smtpd_soft_error_limit = 10
smtpd_hard_error_limit = 20

Then restarted Postfix service postfix restart

Yes, that address shows up on several blacklists.

Yes, that address shows up on at least 5 blacklists (Spamhouse ZEN, Protected Sky, Drone BL, CBL, Blocklist.de). Because the provider is lax about the whole thing, I’d recommend just blocking out the whole network range 193.189.116.0/23 from Delorian Internet Services

@musicmouse

Seeing such messages is actually quite common and you should be fine as long as you’re rate-limiting connections to prevent flooding. In your main.cf configuration file, you should see options such as:

smtpd_error_sleep_time
smtpd_soft_error_limit
smtpd_hard_error_limit

If we set the above to something such as:

smtpd_error_sleep_time = 1s
smtpd_soft_error_limit = 10
smtpd_hard_error_limit = 20

This would mean that Postfix will wait 1 second before each error (i.e. lack of HELO, FQDN etc). After 10 errors, that limit will increase and once the limit hits 20, it will disconnect the client.

If you’re seeing a surge of such connection attempts, you can reduce the soft error limit and then reduce the gap between the soft and hard limits. You’ll still see the disconnects though it will ensure that they happen faster so that repeated attempts don’t tie up connections.

If you see the same IP or IP’s often, block them using your firewall (or install a firewall and then block them). That’ll prevent them from connecting in the first place.