Unable to receive/send emails in Plesk with submission port (587) enabled: Connection concurrency limit exceeded

Updated April 05, 2023 04:02

kb: technical ABT: Group B

Applicable to:

IMAP accounts are failing to sync when using the Outlook mail client.
The Postfix service stops sending/receiving emails on port 587.
The following error can be found on /var/log/maillog:

CONFIG_TEXT: postfix/smtpd[12664]: warning: Connection concurrency limit exceeded: 51 from unknown [203.0.113.1] for service smtp

The maximum number of connections that an SMTP client may make simultaneously is exceeded (default is 50).

Either of the following resolutions can be applied:

Increase the number of connections that an SMTP client may make simultaneously:

Connect to the server using SSH
Execute the command below to increase the maximum number of connections that an SMTP client may make simultaneously:

# postconf smtpd_client_connection_count_limit=100

Note: This is a sample value, it needs to be changed according to the server specifics.

Configure Fail2Ban so that it will automatically block IP addresses that exceeded the allowed limit.

Log into Plesk
Go to Plesk > Tools & Settings > IP Address Banning (Fail2Ban) >Jails > Add Jail
Add the following:

Name:

CONFIG_TEXT: postfix-concurrency

Filter:

CONFIG_TEXT: postfix-sasl -Postfix SMTP and SASL authentication failures \

Action:

CONFIG_TEXT: iptables-multiport[name="postfix-concurrency", port="smtp,smtps,submission" protocol="tcp"]

Log Path:

CONFIG_TEXT: /var/log/maillog

Ban Period:

CONFIG_TEXT: 600

The maximum number of failed login attempts:

CONFIG_TEXT: 5
Go to Tools & Settings > IP Address Banning (Fail2Ban) >Jails > Manage Filters > Add Filter
Add the following:

Name:

CONFIG_TEXT: postfix-concurrency

Content:

CONFIG_TEXT: [Definition]
failregex = warning: Connection concurrency limit exceeded: [0-9]+ from \S+\[<HOST>\] for service \S+$
ignoreregex =
Connect to the server using SSH
Verify the filter functionality by running the following command:

# fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/postfix-concurrency.local
If the configuration is correct you will get a result similar to the one below:

CONFIG_TEXT: Running tests
Use failregex filter file : postfix-concurrency, basedir: /etc/fail2ban
Use log file : /var/log/maillog
Use encoding : UTF-8
Results
Failregex: 0 total
Ignoreregex: 0 total