diff --git a/mail/postfix/Makefile b/mail/postfix/Makefile
index ca8860ddb..a86fe025c 100644
--- a/mail/postfix/Makefile
+++ b/mail/postfix/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		postfix
-PLUGIN_VERSION=		1.13
+PLUGIN_VERSION=		1.14
 PLUGIN_COMMENT=		SMTP mail relay
 PLUGIN_DEPENDS=		postfix-sasl
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
diff --git a/mail/postfix/pkg-descr b/mail/postfix/pkg-descr
index b319d4237..38f254a7d 100644
--- a/mail/postfix/pkg-descr
+++ b/mail/postfix/pkg-descr
@@ -6,6 +6,9 @@ is completely different.
 Plugin Changelog
 ================
 
+1.14
+
+* Add more anti-spam features into postfix itself
 
 1.13
 
diff --git a/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml b/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml
index 2432b7b13..008bd8eab 100644
--- a/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml
+++ b/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml
@@ -150,6 +150,36 @@
         <advanced>true</advanced>
         <help>If you enable this, every entry in Recipients will be checked against. When there is no match mail will be rejected. Be aware that it does not matter if the action is "OK" or "REJECT". This setup allows you to run postfix in front of an internal system and already rejecting unsolicited mail at the border.</help>
     </field>
+    <field>
+        <id>general.extensive_helo_restrictions</id>
+        <label>Advanced HELO Restrictions</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>general.extensive_sender_restrictions</id>
+        <label>Advanced Sender Restrictions</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>general.reject_unknown_client_hostname</id>
+        <label>Reject Unkown Client Hostname</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>general.reject_non_fqdn_helo_hostname</id>
+        <label>Reject Non-FQDN HELO Hostname</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>general.reject_invalid_helo_hostname</id>
+        <label>Reject Invalid HELO Hostname</label>
+        <type>checkbox</type>
+    </field>
+     <field>
+        <id>general.reject_unknown_helo_hostname</id>
+        <label>Reject Unkown HELO Hostname</label>
+        <type>checkbox</type>
+    </field>
     <field>
         <id>general.reject_unauth_pipelining</id>
         <label>Reject Unauthenticated Pipelining</label>
diff --git a/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml b/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml
index e2d2a99e5..4a0bd65e4 100644
--- a/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml
+++ b/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml
@@ -111,6 +111,30 @@
             <default>0</default>
             <Required>Y</Required>
         </enforce_recipient_check>
+        <extensive_helo_restrictions type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </extensive_helo_restrictions>
+        <extensive_sender_restrictions type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </extensive_sender_restrictions>
+        <reject_unknown_client_hostname type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </reject_unknown_client_hostname>
+        <reject_non_fqdn_helo_hostname type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </reject_non_fqdn_helo_hostname>
+        <reject_invalid_helo_hostname type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </reject_invalid_helo_hostname>
+        <reject_unknown_helo_hostname type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </reject_unknown_helo_hostname>
         <reject_unauth_pipelining type="BooleanField">
             <default>1</default>
             <Required>Y</Required>
diff --git a/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf b/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf
index fed2225db..d74434602 100644
--- a/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf
+++ b/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf
@@ -134,6 +134,18 @@ relay_recipient_maps = hash:/usr/local/etc/postfix/recipient_access
 {% if helpers.exists('OPNsense.postfix.recipient.recipients.recipient') %}
 {% do smtpd_recipient_restrictions.append('check_recipient_access hash:/usr/local/etc/postfix/recipient_access') %}
 {% endif %}
+{% if helpers.exists('OPNsense.postfix.general.reject_unknown_client_hostname') and OPNsense.postfix.general.reject_unknown_client_hostname == '1' %}
+{% do smtpd_recipient_restrictions.append('reject_unknown_client_hostname') %}
+{% endif %}
+{% if helpers.exists('OPNsense.postfix.general.reject_non_fqdn_helo_hostname') and OPNsense.postfix.general.reject_non_fqdn_helo_hostname == '1' %}
+{% do smtpd_recipient_restrictions.append('reject_non_fqdn_helo_hostname') %}
+{% endif %}
+{% if helpers.exists('OPNsense.postfix.general.reject_invalid_helo_hostname') and OPNsense.postfix.general.reject_invalid_helo_hostname == '1' %}
+{% do smtpd_recipient_restrictions.append('reject_invalid_helo_hostname') %}
+{% endif %}
+{% if helpers.exists('OPNsense.postfix.general.reject_unknown_helo_hostname') and OPNsense.postfix.general.reject_unknown_helo_hostname == '1' %}
+{% do smtpd_recipient_restrictions.append('reject_unknown_helo_hostname') %}
+{% endif %}
 {% if helpers.exists('OPNsense.postfix.general.reject_unauth_pipelining') and OPNsense.postfix.general.reject_unauth_pipelining == '1' %}
 {% do smtpd_recipient_restrictions.append('reject_unauth_pipelining') %}
 {% endif %}
@@ -168,6 +180,22 @@ smtpd_recipient_restrictions = {{ smtpd_recipient_restrictions | join(', ') }}
 
 smtpd_helo_required = yes
 
+{% if helpers.exists('OPNsense.postfix.general.extensive_helo_restrictions') and OPNsense.postfix.general.extensive_helo_restrictions == '1' %}
+smtpd_helo_restrictions =
+        permit_mynetworks,
+        permit_sasl_authenticated,
+        reject_invalid_helo_hostname,
+        reject_non_fqdn_hostname,
+        reject_unknown_hostname
+{% endif %}
+{% if helpers.exists('OPNsense.postfix.general.extensive_sender_restrictions') and OPNsense.postfix.general.extensive_sender_restrictions == '1' %}
+smtpd_sender_restrictions =
+        permit_mynetworks,
+        permit_sasl_authenticated,
+        reject_unknown_reverse_client_hostname,
+        reject_unknown_sender_domain,
+        reject_non_fqdn_sender
+{% endif %}
 syslog_facility = mail
 syslog_name = postfix