[Exim] Routing mail to a host that doesn't resolve?

I'm dealing with a setup where some Exim boxen
will sit in front of an Exchange server (to
help filter out viruses and spam and generally
keep it from turning into the molten lump of
slag it so desperately aspires to become).

The Exchange server is, unfortunately, configured
in a somewhat insecure manner - to wit, it is
connected to a network. For shame. Thankfully,
it's not connected to a network that most things
can see, but lives happily off in the magical
world of RFC1918-land.

The Exim servers, of course, need to be visible,
but they also have interfaces in RFC1918 land.
However, being in the DMZ, they do not (and by
the company's security policy, should not)
have access to any nameserver capable of
finding/resolving the Exchange box.

Since virtually every address on the Exim
servers points to someone on the Exchange box
(and we may actually get into using a forward
router as described in Exim FAQ 320) this is...
a bit of a challenge.

Running in debug mode, Exim is perfectly happy
with my HELO and MAIL FROM... and it even finds
someone in its aliases.$domain file. But...
that alias points to someone on the Exchange
box, so it calls the dnslookup router, and *that*
comes back with a big fat HOST_NOT_FOUND,
returning DNS_NOMATCH. No joy.

So... I've looked at the hubbed_hosts thing in
FAQ 301 (and actually, all the FAQs in section
3), and didn't stumble across a way to have
Exim point to a host that doesn't resolve.
The machine Exim's on has no problem reaching
the Exchange server; there's just no DNS for
it at that point.

I'm sure *somebody* out there has encountered
this, and solved it, before. :) Any pointers?

Thanks,

-Dan (asking his question for the year)