This will not work if you have an off-site MX or you have an off-site MX
that doesn't have the same packet filtering rules that you do.
It will time out to the first MX, and deliver to the next. If that next MX
is off-site, it will be delivered there and you will just get the spam
via that route.. 
It's best done with sendmail rules, I suppose.