Have you tried listing an MX that returns a TCP REJECT when queried on port 25? Or one that *always* returns a 451 Temp Error message, but hosted by yourself? That's something I've implemented elsewhere and works well, and you don't have the trust issue with since it's hosted by you.