My ISP's mail server is rejecting bounce messages from Exim, complaining that they have no sender. The SMTP trace does indeed show that the sender address is <>. Why is the Sender on the bounce message empty?

Because the RFCs say it must be. Your ISP is at fault. Send them this extract from RFC 2821 section 6.1 (Reliable Delivery and Replies by Email): If there is a delivery failure after acceptance of a message, the receiver-SMTP MUST formulate and mail a notification message. This notification MUST be sent using a null (<>) reverse path in the envelope. The recipient of this notification MUST be the address from the envelope return path (or the Return-Path: header line). However, if this address is null (<>), the receiver-SMTP MUST NOT send a notification. The reason that bounce messages have no sender is so that they themselves cannot provoke further bounces, as this could lead to a unending exchange of undeliverable messages.

---