[kalkaran]

I have a few mail servers and I have not had your problem but this could be because I use fail2ban, and have it drop requests above a certain threshold in a given time frame.

Depending on how these ddos attacks are getting sent this might help.

[Wronnay]

Thanks - my mailserver uses fail2ban too but i think i should check the configuration out.

Edit: found out that fail2ban blocked a known abuser: https://www.abuseipdb.com/check/212.70.149.67

But my ban time was very low, thanks for the heads up!