Re: [exim] why so many synchronisation failures?

On 30/04/18 12:51, John via Exim-users wrote:
> I am seeing a large number of synchronisation errors in incoming mail
> eg
> rejected connection from H=[198.53.60.171] input="QUIT\r\n"

At a guess you are delaying before sending a banner on connect.
They're giving up, and being kind enough to tell you so.

> The IP address varies but the QUIT\r\n is the commonest version, and
> overwhelmingly from places with no reverse DNS.

So, botnet.

> I am sure this is unwanted stuff, but what are the malefactors trying
> to achieve?

A working SMTP connection, though know knows what this particular one
goes on to do.

If you care you could add +smtp_no_mail +millisec to your log_selector
to see how long they wait before giving up (assuming recent Exim
version).
--
Cheers,
Jeremy