[Exim] Malformed SMTP response after RCPT (Exim 3)

Hello!

I have some trouble with my exim (though it's the best mailserver
ever known... :)

Actually I run exim 3.35 and do some lookups via mysql.
The problem I describe should be easy to repeat:

1.) The configure file has a MYSQL lookup for local_domains,
    which looks like this:
---cut---
LOCAL_DOMAINS = localhost
MYSQL_DOMAINS = SELECT DISTINCT D_NAME FROM DOMAINS LEFT JOIN
  DOMAINDATA ON DOMAINS.D_ID=DOMAINDATA.DD_DOMAIN WHERE D_ACTIVE=1 AND
  D_NAME LIKE '$key' AND DD_TYPE=3 AND (DD_DATA1 like
  'mail2.keppler-it.de' OR DD_DATA1 like 'mail.keppler-it.de')
[...]
local_domains = LOCAL_DOMAINS : mysql;MYSQL_DOMAINS
---cut---

and other lines for relay control (pop-before-smtp):

---cut---
MYSQL_RELAY = SELECT ip FROM relay_ip WHERE ip="${sender_host_address}" \
    AND DATE_SUB(NOW(), INTERVAL 10 MINUTE) < ts
host_accept_relay = localhost : mysql;MYSQL_RELAY
---cut---

    This works well in 99,9% of all cases. But watch the following
    dialogue (with debug mode 9) when locally connecting to 127.0.0.2
    (or connecting *from* any other IP which is not resolvable via DNS;
    in this example when I connect *to* 127.0.0.2 I automatically
    connect *from* 127.0.0.2 - loopback...)
---cut---
SMTP<< 220 mail.keppler-it.de ESMTP Exim 3.35 #3 Fri, 22 Mar 2002 19:43:19 +0100

SMTP>> EHLO mail.keppler-it.de^M

read response data: size=127
  SMTP<< 250-mail.keppler-it.de Hello root at mail.keppler-it.de [127.0.0.2]
         250-SIZE
         250-PIPELINING
         250-AUTH PLAIN LOGIN
         250 HELP
host in ? no (option unset)

SMTP>> MAIL FROM:<user@???>^M
SMTP>> RCPT TO:<anotheruser@???>^M
SMTP>> DATA^M
read response data: size=174
SMTP<< 250 <user@???> is syntactically correct
SMTP<< like 'mail2.keppler-it.de' OR DD_DATA1 like 'mail.keppler-it.de')503 Valid RCPT TO <recipient> must precede
DATA
---cut---
(slightly modified to hide real email addresses)

I played around with telnet and found out the following:
- The error occurs immediately after submitting the RCPT command
- In my exim_rejectlog following line comes up:
     refused relay (host) to <anotheruser@???> from <user@???> \
     H=(mail.keppler-it.de) [127.0.0.2] U=root (failed to find host name from IP address)
  This is exactly what I want - but what's this strange SMTP response
  message!?
- When I put the address "127.0.0.2" in the list of host_accept_relay
  this error disappears, everything works well.
- When I use a resolvable IP-Number (e.g. by adding 127.0.0.2 to my
  name server) and remove 127.0.0.2 from the host_accept_relay
  list, I get a normal "relaying prohibited" error.
- Removing the "host_lookup" setting doesn't help anyhow.
- Using a local receiver's address works fine - ok, this is local
  delivery...

So it looks that instead of an error message ("XXX Relaying prohibited" or whatever)
a broken part of an former SQL query appears during the SMTP dialogue.

I don't know if this is a common problem - I searched google and this
list archive for several hours but didn't find more infos.

By the way: I found this "bug"(?) by luck, because some stupid
person has set the MX-IP for a external domain to "127.0.0.2" and
one of my users tried to send mail to this domain... %-\

Thanks in advance for any ideas!

Klaus