In our collective constant quest to stop the parasites from attacking our email servers, is there a way to do this ? If not, This is then my suggestion.

For account logins and authentication (possibly other things too), It would be nice to have a "primary IP address" where when a client is logging in, it has a higher trust level than any other IP. This could / would work in conjunction with IDS blocking.

NOT mistaking that for a whitelist, this is not a unlimited master key.

Most of our clients have locations with static IP Addresses, and most of them only ever access their email from those static IP's, The rare exception is if they set up email on their cell phones, but then the cell phones store the password - unless they are using webmail on their phone (or tablet.) BUT out of a couple of hundred email accounts on our server, I think only 8 users access their email from their phones.

I would like to plug in the primary IP addresses that our clients access their email from for each domain (Some domains have 3 primary IPs from 3 physical locations), and any login attempt from any other locations is instantly more questionable. 

For Instance : With IDS I could say, 

A) For any (known) primary IP addresses, login fails are allowed more than 20 times in 10 minutes (because there may be 40+ different people trying to log in at one IP Address) 

B) But any login attempts made from an unknown (not primary) IP address, is automatically questioned and is limited to 3 login failures in 3 minutes then it is blocked. Since a cell phone store the password, this would not impact most email clients on cell phones.

C)  AND, if a primary IP address gets blocked, an email alert is sent to me the system admin. This way I can investigate immediately as the client is sure to be calling for support since their primary site is locked out.