And according to RFC2821, putting an IP as the HELO *IS* valid.
it is supposed to be an FQDN or an IP (in those cases where a machine
has no name [e.g. a dynamic dialup IP]) However, I don't accept
mail from HELO ip.ad.re.ss unless it's a LOCAL IP.
Since RFC2821 explicitly prohibits you from checking the domain
literal claimed in EHLO/HELO and rejecting the message if the reverse
DNS doesn't match that domain, then I submit that your tests are at
least violating the spirit of RFC2821 in a similar manner.