[Exim] hosts_override not overriding?

Just something I found while I was trying to do some pre-cutover testing....

Exim 4.12 running on Solaris. It is in a sandwich configuration with a 3rd
party spam / virus scanner in the middle (That isn't rfc compliant, so I have
to sandwich it in between 2 MTA's that are). Yeah I know about the other
scanners, but that's not the issue.

The router in question

dns_to_virus_scanner:
driver = dnslookup
domains = ! +local_domains
transport = dns_filtered_smtp
ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
self = send
no_more

Its corresponding Transport

dns_filtered_smtp:
driver=smtp
port=888
allow_localhost
hosts = ietf-mx.ietf.org
hosts_override

------------------------------------
I set it up this way so that I could still utilize exim's DNS sender
verification, and still do smart hosting (As mentioned in FAQ: Q0313

I have this setup for a domain ietf.org right now, and it works great, but the
MX records are all set properly.

I am trying to also send another domain through the same setup, and am getting
relaying errors, I ran it in debug mode, and here is what I see:

4161 dns_to_virus_scanner router called for bthorson@???
4161 domain = foretec.com
4161 DNS lookup of foretec.com (MX) succeeded
4161 132.151.1.197 in "0.0.0.0 : 127.0.0.0/8"? no (end of list)
4161 fully qualified name = foretec.com
4161 host_find_bydns yield = HOST_FOUND (2); returned hosts:
4161 colossus.foretec.com 132.151.1.197 10
4161 queued for dns_filtered_smtp transport: local_part = bthorson
4161 domain = foretec.com
4161 errors_to=NULL
4161 domain_data=NULL localpart_data=NULL
4161 routed by dns_to_virus_scanner router
4161 envelope to: bthorson@???
4161 transport: dns_filtered_smtp
4161 host colossus.foretec.com [132.151.1.197] MX=10
4161 Attempting full verification using callout
4161 locking /usr/exim-in/spool/db/callout.lockfile
4161 locked /usr/exim-in/spool/db/callout.lockfile
4161 opened hints database /usr/exim-in/spool/db/callout: flags=2
4161 dbfn_read: key=foretec.com
4161 callout cache: no domain record found
4161 dbfn_read: key=bthorson@???
4161 callout cache: no address record found
4161 interface=NULL port=888
4161 Connecting to colossus.foretec.com [132.151.1.197]:888 ... failed

If I am doing a hosts_override, shouldn't it be going out to ietf-mx and not
colossus.foretec.com?

Now I do realize that my MX record for this domain is not set to
ietf-mx.ietf.org I am trying to migrate over and do some pre-cutover
testing. In the process I noticed that hosts_override doesn't seem to be
overriding the callout. (Or maybe it is, and the hosts_override is just a
low level kind of thing that isn't spit out into the debug logs?)

Thanks much!

--Brett