> Consider for a moment how hard it would be for an average spammer to > spoof rDNS
This has nothing to do with DNS. The trusted/internal/msa networks only checks an IP address as it stands in an Received header field, it does not check nor depend on its rDNS or forward DNS. Mark