Well, SMTPdebug level 3 only gets me this info:

[0C04:0006-0D2C] 04/27/2016 09:02:31.26 AM SMTP CIServ Listen> Connection Accepted on Port 25 for Session 234A2E6D
[0C04:0008-0FF0] 04/27/2016 09:02:31 AM  SMTP Server [0C04:0008-0FF0] State change from Greeting to Greeting
[0C04:0008-0FF0] 04/27/2016 09:02:31 AM  SMTP Server [0C04:0008-0FF0] Processing in Greeting state
[0C04:0008-0FF0] 04/27/2016 09:02:31 AM  SMTP Server [0C04:0008-0FF0] State change from Greeting to Connected
[0C04:0008-0FF0] 04/27/2016 09:02:31 AM  SMTP Server: xxxx.xxxx.ca (127.0.0.1) connected
[0C04:0008-0650] 04/27/2016 09:02:35 AM  SMTP Server: xxxx.xxxx.ca (127.0.0.1) disconnected. 0 message[s] received

It looks like there is a connection being made on port 25, but no data is transmitted?

On a normal inbound SMTP connection, I get this:

[0C04:0006-0D2C] 04/27/2016 09:02:44.40 AM SMTP CIServ Listen> Connection Accepted on Port 25 for Session 234A2E6F
[0C04:0008-0650] 04/27/2016 09:02:44 AM  SMTP Server [0C04:0008-0650] State change from Greeting to Greeting
[0C04:0008-0650] 04/27/2016 09:02:44 AM  SMTP Server [0C04:0008-0650] Processing in Greeting state
[0C04:0008-0650] 04/27/2016 09:02:44 AM  SMTP Server [0C04:0008-0650] State change from Greeting to Connected
[0C04:0008-0650] 04/27/2016 09:02:44 AM  SMTP Server: mail6.bemta8.messagelabs.com (216.82.243.55) connected
[0C04:0008-0FF0] 04/27/2016 09:02:44 AM  SMTP Server [0C04:0008-0FF0] Processing in Connected state
[0C04:0008-0FF0] 04/27/2016 09:02:44 AM  SMTP Server [0C04:0008-0FF0] EHLO command received

Thanks, I didn't restart the SMTP task - I thought that if I used "set config SMTPDebug=3" then I didn't have to?

It did seem to increase the logging level. My point is that there doesn't seem to be an EHLO/HELO exchange from the localhost connection.

Not sure there is any point to opening a PMR - I am just trying to determine what could be making this connection.

The server is working fine and these localhost connections are not completing, I would just like to know what they are!

doing a telnet to 127.0.0.1 and see what happens.  Some shops change the default port for smtp for this exact reason.

Thanks Barry,

Connecting to 127.0.0.1 on port 25 from the server and then dropping the connection gives a similar log entry,

If I telnet from my workstation to the server, it shows my workstation IP

04/27/2016 11:52:26 AM  SMTP Server: PMSLOTUS.xxxxxx.ca (127.0.0.1) connected
04/27/2016 11:52:30 AM  SMTP Server: PMSLOTUS.xxxxxx.ca (127.0.0.1) disconnected. 0 message[s] received
04/27/2016 11:53:19 AM  SMTP Server: al-2014.xxxxxx.ca (192.168.1.51) connected
04/27/2016 11:53:30 AM  SMTP Server: al-2014.xxxxxx.ca (192.168.1.51) disconnected. 0 message[s] received

So that would indicate some service on the service is initiating connections on port 25?

Any idea on how to determine what it might be?

Here is a url http://www.howtogeek.com/howto/28609/how-can-i-tell-what-is-listening-on-a-tcpip-port-in-windows/    

on netstat options

Do you have any add on running like virus scan? 

No virus scan add-ons or anything running.

I took a look at the connections, and there is one connection to port 25 locally shown as unknown process - no process ID

I think it must be the Domino server, as I can't think what else it could be.

 TCP    127.0.0.1:58297        127.0.0.1:25           TIME_WAIT       0

Oh well, thanks for the help! I will keep looking.