Deny smtp connection from unknown and unverified hosts with hosts.deny

Question

I need to reject all smtp connections whose host name is unknown or does not match its address. Have tried setting in hosts.deny:

smtpd: UNKNOWN
smtpd: PARANOID

but Postfix logs show that they are still getting through to the mail deamon.

postfix/smtpd[3426]: warning: hostname server1.reselect.org does not resolve to address 89.33.194.240
postfix/smtpd[3426]: connect from unknown[89.33.194.240]
postfix/smtpd[3426]: NOQUEUE: reject: CONNECT from unknown[89.33.194.240]: 450 4.7.25 Client host rejected: cannot find your hostname, [89.33.194.240]; proto=SMTP
...
postfix/smtpd[3997]: connect from unknown[193.56.29.102]
postfix/smtpd[3997]: NOQUEUE: reject: CONNECT from unknown[193.56.29.102]: 450 4.7.25 Client host rejected: cannot find your hostname, [193.56.29.102]; proto=SMTP

Why does it not work?

Answer 1

Have found out from this answer that smtp connections are not filterd by hosts.deny becaus Postfix does not refer to the tcp-wrappers library.

Answer 2

hosts.deny does not do the job because it is not its purpose.

You must look into an application called "fail2ban". That is what you need. With fail2ban you can create a policy that when they get rejected for n number of time, they would not be able to connect for m minutes.

For example if your policy defined to block rejected users for the next 24 hours, then the ip 89.33.194.240 which tried to connect and rejected, cannot connect again for the next 24 hours.

Your mail.log reduces size dramatically.