I've come up with this as a slight mod from the current postfix jail:

^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 454 4\.7\.1 :*$

How to include the "Relay access denied" portion in the regex?  Sorry - regex still mystifies me.

On Sat, Jul 5, 2014 at 11:37 AM, billy noah <billynoah@gmail.com> wrote:
Got a ton of these in my mail.log:

Jul  3 20:03:17 example postfix/smtpd[9575]: NOQUEUE: reject: RCPT from netsol.outbound.ed10.com[]: 454 4.7.1 <admin@example.com>: Relay access denied; from=<V6P6-OONY4-99LFU-MBYOCY-90KJ1-M-M2-20140703-841ceff4f3b9eaedbb@netsol.bounce.ed10.net> to=<admin@example.com> proto=ESMTP helo=<netsol.outbound.ed10.com>

Is there a jail setting or custom filter in existence to handle these?  If not, could someone get me started on one?