I have listed some hosts in tls_try_verify_hosts, but when they connect, no data appears in $tls_peerdn.

This means that the clients have not sent certificates when asked by the server to do so. If the clients are running Exim, check that tls_certificate is correctly set in their smtp transports. Note that this value is not automatically inherited from the global tls_certificate option.

---