Just replace
smtpd_client_restrictions = reject_unknown_reverse_client_hostname
with
smtpd_client_restrictions = reject_unknown_client_hostname
.
From the Postfix manual:
reject_unknown_client_hostname (with Postfix < 2.3: reject_unknown_client)
Reject the request when
1) the client IP address->name mapping fails, or
2) the name->address mapping fails, or
3) the name->address mapping does not match the client IP address.
This is a stronger restriction than the reject_unknown_reverse_client_hostname
feature, which triggers only under condition 1) above.
The unknown_client_reject_code parameter specifies the response code for
rejected requests (default: 450). The reply is always 450 in case the
address->name or name->address lookup failed due to a temporary problem.
However, this your belief is wrong:
No legit (ham) email has this pattern so I would like to block emails associated with this message.
My customers complaint from time to time, and it happens that sometimes reverse hostname does not comply with the HELO address, or it resolves to other address or doesn't resolve at all, and that's perfectly solicited mail. Basically, current RFCs only mandate the existence of the PTR record of the HELO hostname, while don't say anything about its value or existence of the A record under that name or its value. Technically legitimate server can omit everything else and still comply to RFCs, while you are blocking it with this configuration. To remedy this, I put all those checks into smtpd_recipient_restrictions, and added check_sender_access hash://... immediately before it, so I can selectively exclude some mail from this check by sender domain name or full sender email address:
smtpd_client_restrictions = [default]
smtpd_recipient_restrictions =
...
check_sender_access hash:/etc/postfix/spam_exceptions,
reject_unknown_client_hostname,
...
You can't use check_sender_access in the smtpd_client_restrictions because you only obtain sender envelope address to check against during MAIL From: phase.
This spam_exceptions file has the simple structure:
affected.domain OK
...
I just add domains into this file when I resolve complaints. And I have a quite big collection already!
