> That seems excessive and abusive Good thing it's my own mail server then, isn't it? The practical reason is that virtually all Whois lookups of offending IP

> That seems excessive and abusive Good thing it's my own mail server then, isn't it? The practical reason is that virtually all Whois lookups of offending IPs return blocks of /24 or larger, so that's a reasonable default. Besides, as I said, this doesn't result in a "ban", just tags emails as spam and passes them through. At my scale an occasional false positive is not a big deal.