The behavior you are describing is expected. It's the result of two separate systems working independently, which can make the logs easy to misread. Here's a brief explanation of the two:
- Block Authentication by Country is an authentication gate; it does not block any connections. When a login is attempted from a restricted country, SmarterMail refuses the authentication. That will end the current session, but it does not prevent the IP from reconnecting and trying again.
- IDS Rules independently counts failed authentication attempts. When an IP crosses the threshold for an IDS rule, a block is created and future connections from that IP are prevented until the block expires.
Because Block Authentication by Country is configured at the system level, and can be further restricted at the domain level, it isn't enforced until an authentication attempt is made for an account that apparently belongs to a valid domain. Anything up to that point which causes an authentication failure will count as an IDS rule violation.
With all that in mind, an aggressive IP from a restricted country is likely to trip both systems across multiple authentication attempts. Seeing both in the logs on the same day is expected as it's the result of two different types of protection catching the same bad actor.
That is exactly what your log lines show, only about 12 hours apart:
[2026.07.29] 07:56:54.189 [185.229.98.44] SMTP User user@domain.com with IP 185.229.98.44 attempting login from country Spain (ES) not on the allowed country list.
[2026.07.29] 19:54:56.336 [IpBruteForceDetector] Added 185.229.98.44 to IDS block list. Duration: xxx seconds, Description: x incorrect in xx minutes
The first line is the country filter refusing an authentication attempt, apparently using an email that seemed to belong to a domain that exists on your server. However, Block Authentication by Country never blocks connections, which is why the IP was able to keep trying. Over the next 12 hours, that same IP continued connecting and attempting to authenticate, at least occasionally using email addresses that belong to domains your server doesn't recognize. At 19:54, the IP finally triggered an IDS rule and a block was created.
In regards to your question, "Are a few let through on purpose to confuse attackers?" — no, SmarterMail is not intentionally letting anything through. What you're seeing in the IDS Block list isn't the country filter leaking a few IPs, it's authentiation attempts failing before getting to the country check and eventually triggering the IDS system.
You may very well be seeing IPs from restricted countries popping up in your IDS block list more often after upgrading from 9652 to 9693. Build 9673 included upgrades and fixes for the IDS system, including a fix for IDS tracking in SMTP. Prior to 9673, failed SMTP authentication attempts weren't always incrementing the IDS counters, which meant that bad actors could continue trying to authenticate for longer before triggering an IDS block, if they ever happened to trigger one. After 9673, failed SMTP authentication attempts are being counted more accurately, which means this sort of attacker is more likely to trigger an IDS block.