I think it's worth mentioning that Mercury doesn't include the reverse-DNS of the connecting host in the Received: lines it generates, only the client greeting. That's often forged, so depending upon it is inadvisable, although it might work (as might just checking for the presence or absence of DKIM-Signature: lines on mails you know ought to have them).
Cheers,
Sabahattin
--
Sabahattin Gucukoglu <mail<at>sabahattin<dash>gucukoglu<dot>com>
Address harvesters, snag this: feedme@yamta.org
http://sabahattin-gucukoglu.com/