Postfix has some nice options to restrict client accesses with respect to DNS/IP address setup and
helo names (documentation). For example one can instruct postfix to reject clients if
heloargument is a malformed domain
heloargument is not a fully qualified domain name
- the IP address has no reverse domain lookup entry
- the domain from the reverse lookup does not point to the client's IP address
- the domain has a MX entry
At least in my observation these measures are quite successful against some amount of spam.
What I am missing is a more strict reject option that works like this:
- reject if the DNS lookup of the
heloargument does not match the client's IP address
AFAICS, there is no explicit option to configure this restriction. But perhaps there are other ways to configure that behavior with postfix?