Question
Why do email users get bounces with "421 Too many concurrent SMTP connections; please try again later."?
Answer
This happens on a very busy mail server and requires an adjustment to Exim's configuration.
The setting to change is smtp_accept_max. By default on a cPanel server, the smtp_accept_max setting is set to 100.
You would want to increment in sets of 50 and if you need to set this high use additional commands like netstat to see if there is a large number of connections from a particular IP. In that case, you may need to block IP addresses but if there is an actual distributed DDOS attack a firewall or DDOS service may be needed to mitigate the attack. Exim doesn't have a way to inspect connections to determine if there is an attack.
The change to smtp_accept_max needs to be set in WHM under the Advanced Editor tab using the Exim Configuration Manager section of WHM. This ensures changes remain persistent when other changes are made in the future.
This is an example command to get SMTP connections to the server by the number of connections from the IP:
netstat -plan| grep :25 |awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -n | tail -30