Thanks for the responses and tip on reject_unknown_reverse_client_hostname I've made the switch to that and it seems to catch many unmapped IPs.
I half suspected there was something less stringent I could go for, and had not noticed that variant. We had only reject_unknown_client from older Postfix config (we're still on 2.4). --Donald
