Blocking failed smtp relay requests

Question

Every day (around the same time, interestingly) I get a wave of log messages exactly like this:
postfix/smtpd[45049]: warning: 186.60.162.91: hostname 186-60-162-91.speedy.com.ar verification failed: nodename nor servname provided, or not known
It appears to me as if some pinhead is attempting to use my server as a spam relay and all the messages are being rejected. No harm is done, except that I get annoyed about this useless waste of my small and expensive business-class bandwidth (I'm in Australia).
Is there anyway to automatically add a rule to the firewall to reject the the IP address after, say, 3 failed attempts in less than 10 seconds? Or something like that?
I've been manually adding rules, now and then, but I'm sure this is useless as they change IP addresses every day. When the wave of attempts start, I've noticed that they tend to come from the same few IP addresses and it seems senseless of the mail server to have to reject them if I could automatically add those IP addresses to the firewall which would simply drop the request before they even get started.
Any help would be gratefully appreciated.

Answer 1

Good to hear the basics are covered You'd be surprised how often they're overlooked.
Looking up the actual error in your log, it looks to be warning indicating that the PTR doesn't have a corresponding A record. Basically, a fairly minor DNS issue on the sending MTA. So, might not be actual relay attempts. Relays should be dropped or show failed login attempts elsewise. /var/log/mail.log I think is where you'll see any failures.
What I was thinking of is the adaptive firewall. emond is meant to block IPs after 10 failed attempts, for 15 mins. I imagine it can be adapted, so to speak, to block the IPs for longer, or after fewer attempts. You could trawl through your logs to see if that's actually happening.
The command line tool for the adaptive firewall is afctl The rule that does the default blocking after 10 failed attempts is in a plist /etc/emond.d/rules/AdaptiveFirewall.plist
The postfix config can also be managed to block SMTP specific accesses, blacklisting or greylisting IPs. I'm trying to dig up details for how to do this in the way you'd like.