[exim] Implementing a secondary MX

I have two machines running exim, both handling totally different
domains. It would be nice if they could be secondaries for eachother.
The ACLs on them aren't identical but both use exiscan and virus/spam
scanning.

To implement a secondary MX of sorts, the following router is used:

mail_route:
driver = manualroute
domains = +local_domains
route_data = ${lookup mysql {MYSQL_RELAY}{$value}}
transport = remote_smtp

The route_data is simply the name of the server to pass the mail onto
for a particular domain and comes from MySQL, e.g. a row would say that
all mail to "example.com" should be passed to "mx.example.com".

This works, the implementation passes on mail correctly for the right
domains. However, there is potential for plenty of collateral bounces.
For example, the primary MX receives a mail from the backup MX and
decides it doesn't like it (spam, stricter ACLs, no-such-mailbox etc.)
so rejects it. The backup is then going to attempt to send out a bounce
to the originating host. The no-such-mailbox problem could be countered
by having a list of valid users on the backup MX, that isn't hard to
solve. However, I see no way to fix the first two.

Is there a better solution for implementing a backup MX?

Thanks,

David