To allow clients to connect, they need authorization. This can be done based on hostmask, address mask, and/or with a password. With intelligent use of classes and the maxconnections field in the connection classes, you can let in a specific domain, but get rid of all other domains in the same toplevel, thus setting up some sort of 'reverse K: line'.
Technical description (for examples, see below):
For every connecting client, the IP-number is known. A reverse lookup on this IP-number is done to get the (/all) hostname(s). Each hostname that belongs to this IP-number is matched to hostmask, and the I: line is used when any matches; the client will then show with this particular hostname. If none of the hostnames matches, then the IP-number is matched against the IP mask field, if this matches then the I: line is used nevertheless and the client will show with the first (main) hostname if any; if the IP-number did not resolve then the client will show with the dot notation of the IP-number.
There is a special case for the UNIX domain sockets and localhost connections though; in this case the IP mask field is compared with the name of the server (thus not with any IP-number representation). The name of the server is the one returned in the numeric 002 reply, for example: 002 Your host is 2.undernet.org[jolan.ppro], running version ... Then the "jolan.ppro" is the name used for matching. Therefore, unix domain sockets, and connections to localhost would match this I: line:
IP or crap = jolan.ppro
Hostmask = foobar
Connection Class = 1
Finally, I: lines with empty IP mask or hostmask fields are skipped.
This is the 'fallback' entry. All .uk, .nl, and all unresolved are in these two lines. By using two different lines, multiple connections from a single IP are only allowed from hostnames which have both valid forward and reverse DNS mappings.
IP or crap = *@*
Password = 1
Hostmask = Unresolved
Connection Class = 1
IP or crap = Resolved
Hostmask = *@*
Connection Class = 1
If you don't want unresolved dudes to be able to connect to your server, use just:
IP or crap = NotMatchingCrap
Hostmask = *@*
Connection Class = 1
You can request a more complete listing, including the "list of standard K-lines" from the Routing Committee; it will also be sent to you if you apply for a server and get accepted.
Ourselves - this makes sure that we can get in, no matter how full the server is (hopefully).
IP or crap = *@*
Hostmask = *@*.localdomain
Connection Class = 10
You can put a digit (0..9) in the password field, which will make ircd only accept a client when the total number of connections to the network from the same IP number doesn't exceed this number. The following example would accept at most two connections from dial up accounts that have "dial??.*" as host mask:
IP or crap = Resolved
PASSOWORD = 2
Hostmask = *@dial??.*
Connection Class = 1