[exim] domain_match, local_domain, sql

Hi
I have strange problem, I wanted to create acl check to defer messages from
local domains but without auth. local_domains are defined as:

domainlist local_domains = ${lookup mysql {SELECT DISTINCT domain FROM user
WHERE domain='${quote_mysql:$domain}' UNION SELECT DISTINCT domain FROM alias
WHERE domain='${quote_mysql:$domain}'}}

and it seems to work well in other places.

in rcpt acl I put following rule (taken from struction.de tutorial)

defer
    message = use SMTP AUTH
    log_message = Forged Sender address (claims to be local user 
[${sender_address}], but isn't authenticated)
    !hosts = +relay_from_hosts
    !authenticated  = *
    condition = ${if match_domain{$sender_address_domain}{+local_domains}}

and it didn't triggered when it should. I changed condition - included mysql
lookup:

    condition = ${lookup mysql {select if(count(*)>0,'yes','no')  as c from 
(SELECT DISTINCT domain FROM user WHERE domain='${quote_mysql:
$sender_address_domain}' UNION SELECT DISTINCT domain FROM
 alias WHERE domain='${quote_mysql:$sender_address_domain}') as domains;}
{$value}}

and now it works - but sitll I'd love to know why it doesn't with first
condition.

looking into mysql logs it looks like fist condition matched against
destination domain, not the sender one (is that possible?)

best regards
--
Marcin Gryszkalis, PGP 0x9F183FA3
jabber jid:mg@???, gg:2532994
http://the.fork.pl