As I indicated in my exchange with James, there's nothing stopping
a spammer from (1) registering a valid name and advertising
it in his HELO (2) simply advertising a totally random name that
doesn't map to his IP in his HELO. Both of these measures will
evade rule (A), and indeed (2) is RFC 2821 compliant. Moreover,
as Danny observes, address literals are also RFC 2821 compliant
and appear to pass the current configuration.
Accordingly, here we have a situation where we have a rule that
is:
(1) easy for any spammer to bypass
(2) can be shown to have blocked legitimate mail in at least two cases
[Note, you say "defer", but since the issue here is hosts without
records, not DNS failures, defer is just a particularly
inconvenient
form of block.]