Since writing this Salesforce has released support for DKIM which is much better way of authenticating emails coming out of Salesforce which I would now use if your infrastructure allows it. Check out the release notes for more information. @radnip ...
