It looks like require_rdns works at the check_relay level, which is at connection time, so you are correct. If the connection proceeds to HELO/EHLO, then refusal based on lack of a PTR record is forbidden. I was incorrect. Nate