[exim] using exim with ironport preprocessor

Using ironport to preprocess spam, to deliver to our server running
exim.

Problem is that even when mail originates on this server (for example
php/webmail or user uses our exim server as an outgoing email
server ...

Even when the email address ends up on this server we still want the
email to go to the ironport box first for spam detection.

Our exim server is doing virtual email hosting; that system comes from
DirectAdmin (a webhosting control panel) and works properly.

I created a list: ironport_domains:

domainlist ironport_domains = lsearch;/etc/virtual/ironport_domains

Then I created a new router which I put immediately under the lookuphost
router.

The lookuphost router looks like this:

<snip>
lookuphost:
driver = dnslookup
domains = ! +local_domains
ignore_target_hosts = 127.0.0.0/8
condition = "${perl{check_limits}}"
transport = remote_smtp
</snip>

Immediately under it I put this new router:

<snip>
send_to_ironport:
driver = manualroute
verify = false
domains = +ironport_domains
condition = "${if eq {$received_protocol}{local} {1}{0}}"
transport = remote_smtp
route_list = * 1.2.3.4
no_more
</snip>

(where 1.2.3.4 is the IP# of the ironport box)

This must be wrong; it's not working, mail originating through webmail
(php) on this server is immediately passed through to the directors and
is delivered locally.

My guess is I've done something wrong with the condition. Though I've
spent a few days looking, I can't figure it out <frown>.

Here are the headers on the email tried, showing the path through the
server:

<snip>
Received: from localhost ([127.0.0.1] helo=67.112.189.217)
    by web01.dacira.nl with esmtpa (Exim 4.69)
    (envelope-from <example@???>)
    id 1L1CMg-0002F2-NM
    for example@???; Sat, 15 Nov 2008 05:02:30 
+0100
Received: from phpmailer ([67.112.189.217])
    by 67.112.189.217 with HTTP (UebiMiau);
    Sat, 15 Nov 2008 05:02:30 +0100
</snip>

(munging with "example and ".example" by me to avoid scraping.)

Can anyone help me figure this out?

Thanks.

Jeff
--
Jeff Lasman, Nobaloney Internet Services
P.O. Box 52200, Riverside, CA 92517
Our blists address used on lists is for list email only
voice: +1 951 643-5345, or see:
"http://www.nobaloney.net/contactus.html"