# background: something like this does not work for packets which
# exim is replying to. I don't know why.
#iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1
+#
+# note: exim will misreport the I= interface for remote hosts that would
+# not use the default route. It still goes through the vpn, you can
+# verify with tcpdump.