I would have opted for "client" rather than "sender" checks, provided a sufficiently stable/comprehensive range of source IP addresses for the forwarding host were available.
OK, took a quick look at the documentation on this but still left with questions. So would "client" be the same as HOST_A? So I would do:
xxx.xxx.xxx.xxx OK # IP of HOST_A forwarding email here And I would use "check_client_access" instead? Is that right?