Those type of attacks are usually distributed across hundreds of compromised devices - rarely do they come from one single IP, and additionally, SM's IP detection rule would fire if it was a single.

It is pretty much expected behavior.  Between malicious probes and "research" probes, you will see a lot of traffic which is not legitimate email.  Generally, white-hat services will not try passwords against you, however.  On my main infrastructure (running sendmail,) I collect SMTP AUTH attempts and wind up blocking wide swaths of IPs in my border firewall.  In fact, I block entire countries and tell my customers who might be traveling to use a VPN (I will even provide one for free, if needed.)  Sometimes I have to whitelist, and I prefer whitelisting a couple of IPs in a /16 or /8 versus the exposure of the full IP block.

Some recommendations, if you can implement a second server:

1) Create an inbound gateway.

2) DNS (If the MX is getting its own public IP address):

3) On the main server:

3) On your firewall:

@Douglas Foster, "Note that in SM port setup, "SSL" mode means mandatory encryption, while optional encryption with STARTTLS is "TLS" mode."

Wait, SSL and TLS in SM Port Setup (Bindings) don't line up with SSL and TLS, but simply refer to whether STARTTLS is used? I read the help and a KB article, but it's not clear whether setting a port for SSL when my server has only TLS enabled will work.

You understand my assertion correctly, that it has nothing to do with the ciphersuites configured on  your server.    But you can test to prove me right or wrong.   Set up a temporary listener on a non-standard port such as 588 or 12345, then configure IMAP or POP test connections from Outlook or your favorite email client. Newer versions of Outlook seem to be labelled unamiguously ("SSL/TLS" for mandatrory, and "STARTLS" for optional.")   Once you have test results, you can develop a plan to optimize your client connections using standard ports.

Hi there,

I wanted to let you know that I submitted a feature request to the developers to modify the translations for SSL and TLS to SSL/TLS and StartTLS respectively. This change would make things easier for everyone to understand.

When you select SSL for IMAP, for instance, it's actually using IMAPS which is using TLS. It's common for people to think that the SSL option only uses SSL, which is deprecated. However, that is not true. It uses whatever cipher suites are enabled on the host machine.

I hope this clears things up.

Best regards,

Thanks Zach! After testing as Doug suggested, if it turned out as he said, I was gonna be submitting a ticket for that exact thing.