There are no specific examples, but it works just like similar qmail-based setups. After parsing couriertcpd's options, the remaining arguments form the command courietcpd runs after establishing a connection, specifically: "/usr/bin/couriertls -server -tcpd /usr/sbin/courieresmtpd". When couriertls starts, after parsing its options the remaining argument forms the command couriertls runs, specifically "/usr/sbin/courieresmtpd".

You would want to replace the last argument with your own wrapper: /usr/local/sbin/esmtpdwrapper, an executable shell script, that might do something like this:

#! /bin/sh

if test "$TCPREMOTEHOST" = "" then exit 0 fi

exec /usr/sbin/courieresmtpd

So, connections without a hostname in TCPREMOTEHOST get dropped right away, everyone else runs courieresmtpd, as usual. Read "ENVIRONMENT VARIABLES" in couriertcpd's man page for a list of environment variables you can use. Your wrapper inherits the environment all the way from couriertcpd. You said you don't want to require valid reverse DNS from some IP address ranges, so you'll need to tweak this logic.