Personally, I'd go a step further. Associate an MTA connection with a
domain name. In other words, require rDNS and use the host name returned
to look up a TXT record. Using your above example, you'd have this:
Yes. But that particular step breaks 30% of the email out there (at
least that's the number I've seen for email senders without proper
reverse DNS). It may be high--but certainly no major ISP that has
attempted to block on rDNS has kept the block--and they weren't even
authenticating--just seeing if it was there.