Stephane_999,

Using the debug view with *.*.*.* will not provide reliable results, as you will be monitoring *all* traffic to SpamFilter, and the debug data may be overwhelming to SpamFilter. The debug view is intended to be used with a single IP/network to pinpoint problems with that specific network.

In regards to the connections appearing "stuck", are they always from the same IPs? If so, you can use the debug view to just capture data from those IPs, and we can try to see what the problem is. If there is no pattern to them, do the "from" email addresses reported there "appear" to be legitimate addresses, or do they look like spammers? Please note that often spammers will probe mail servers, and it is somewhat normal to see a few pending connections.

This said, SpamFilter will perform many of its tests after receiving the "RCPT TO" command, and prior to outputing a "250" code if the recipient is valid. A delay in this process cold occur if the DNS server(s) used by SpamFilter is slow in responding to DNS lookups (SpamFilter has a 5 second defualt timeout on DNS queries). Could you check to ensure the DNS server(s) is working properly and responding to queries in a timely manner?