Fabian,


I looks like your server is to slow to answer this huge amount of
requests. :)

How did you identify that ? Please let me know.
 
Now seriously. I do not know about Dovcot, but on my Cyrus
IMAP/POP server I can configure how many connection it should
accept at most. Google showed me, that Dovecot also could do
this, e.g. client_limit, see [1]. A useful value depends on your
user base.

I will add client_limit, but I think the connections in my dovecot.log are independent connections. They arrive at different time. client_limit is for limiting simultaneous connections. So Will this work for my case ?

( In the meantime, I have created a new jail called "fail2ban-dovecot" , which will find the connections from dovecot.log and ban the IPs. )

thanks.