I repeat myself: It's not about the ideal solution, but about what should be included in the install template. And I think the install template (and therefore the standard config) should contain a good mix of security, spam protection and fault tolerance.

I only complain about the HELO-check, and spam filtered by that will also be filtered one or two steps later in the chain. But the false-positive rate of the HELO check is far to great.

In my config I also change a lot of stuff on postfix and postgrey to suit my needs, but a newbee should be able to get a works-out-of-the-box installation.