Postfix provides several “checks” that can be evaluated at different “stages” of the incoming SMTP connection. “checks” are something like “is the remote client SASL-Authenticated?”, “is the remote client providing an FQDN HELO Hostname?”, “is the remote client asking for SMTP pipelining?”, as well as “is the remote client blacklisted in some RBL?” or “is the remote client connecting from one of my IP subnet”?
Such checks can be evaluated at different stage of the SMTP transaction:
- as soon as the TCP connection is established (smtpd_client_restrictions)
- when the client issue a “MAIL FROM” command (smtpd_sender_restrictions)
- when the client send an “RCPT TO” command (smtpd_recipient_restrictions)
as well as at other stages.
Restrictions/Directives above, can be combined as in the following example (please note that “...restrictions are applied in the order as specified; the first restriction that matches wins”):
In order to properly LOG useful information that might not be known in the “smtpd_client_restrictions” (or other) context, the parameter “smtpd_delay_reject=yes” might be useful, as it will delay the “rejection time”, so to collect other infos (the recipient, for example, very useful to properly troubleshoot problems with end users complaining for missing received mail).
Postfix is a very complex system and, as such, is extremely flexible and powerful. You can find lots of information in the official web-pages (es.: http://www.postfix.org/postconf.5.html) that, BTW, includes also some useful configs that can be used as a starting point for your own setup (http://www.postfix.org/STANDARD_CONFIGURATION_README.html)
P.S.: please, be “kind” with this answer as... it's my first POST in the ServerFault/StackExchange arena ;-)