[exim] Debian ACLs: Requiring authentication FROM and TO loc…

Hello,

I have a problem with the ACL configuration of my Mailserver:

Mails to local domains are accepted even if the sender is my own domain,
too, and the not authenticated. Since our spam filter does ignores mails
from our own domain I get swamped with spam of that kind. I am using debian
and the configuration contains a very handy rule to require "verify =
sender". However I don't really wanna do that, if we started rejecting mails
from misconfigured servers/clients we might as well close our business.

So, how can I make sure that a mail coming from a local domain but not from
a relay host must have an authenticated sender or it is rejected? I'd want
to integrate it into the typical debian set of rules... so if any Debian
users are around?

Thank you
Björn