Stephane,

If you whitelist domain name, you do risk spammers faking that domain.
When SpamFilter checks the MX record, it simply checks to ensure the domain has a valid MX record. That's all it can do, as outgoing mail server are often different than the servers accepting incoming emails as listed in the MX records.

The feature that you're talking about, if I understood you correctly, is already available. It's called SPF (Sender Policy Framework). Basically the sender's domain administrators specify via DNS what servers are allowed to send emails on their behalf. If an email is received from an IP that has not been authorized by the SPF policies from the domain administrator, it is rejected. The SPF information is added to the DNS by the companies that decide to employ them. If a company has adopted SPF, SpamFilter will use that information to filter their email.

In your example, DELL.COM did implement SPF. If you enable the SPF filter in SpamFilter (it's on by default), then you should never receive spam emails where the sender is "faked" to appear from dell.com.

For ibm.com.... well, there's a real surprise here. The IBM administrators configured the SPF record for IBM.COM to say basically that *ALL* addresses in the form user@IBM.COM are to be rejected. Now either (1) this is a huge mistake on behalf of IBM's admins, or (2) all of IBM's addresses are in the form user@us.ibm.com or user@something.IBM.COM.