Thinking along the lines of "it's not rocket science", I decided to put
together an Exim implementation of sender cookies.
It turned out to be just a few lines of Exim config. You can find it here,
along with some background info:
http://pobox.com/~b.candler/software/authbounce/configure-authbounce.txt
I decided against VERP and included a cookie header instead; I think it
scales better (multiple MTAs can each add their own cookies) and is less
likely to break things (you don't hit the 64-character limit and you don't
break anything which filters on the envelope sender)
I did turn up a bug in exim-4.30 however, which means that the validation of
an incoming bounce does not work if it is the second or later message
delivered within an SMTP conversation. So until that is fixed, please don't
use this in a production environment!
Enjoy,
Brian.