It's actually extremely hard (in the performance sense) to do a reverse lookup of every inbound connection.  Remote DNS servers can have terrible latency problems, and your framework needs to be prepared to have hundreds or thousands (or more, for a big site) of lookups in flight to avoid starving the valid connections.  A netblock lookup is a single firewall rule.