The primary has hosteddomains set accordingly and empty esmtproutes,
while the secondary has hosteddomains empty and esmtproutes set to shunt
all mail to the secondary.
You mean "the secondary has esmtproutes set to the primary" ?
Yes, of course, that's what I meant. :) thanks.
Incidentally, another component of my system which I did not mention
involves very low (2-minute) TTLs set on all my hosted domains, so that
the canonical names for www and pop3 clients point to the currently
active primary machine. It remains to be seen how well this works for
failover in practice.