Move certificate name checking to mainline, default enabled

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index c831e6cc46322f046fc1382c68a7c2c63b30770b..5bdf5728270c9f1677b8669c347161353251f311 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -13546,8 +13546,9 @@ This option defines the ACL that is run after an SMTP DATA command has been
 processed and the message itself has been received, but before the final
 acknowledgment is sent. See chapter &<<CHAPACL>>& for further details.
 
-.option acl_smtp_data_prdr main string&!! unset
-.cindex "DATA" "ACL for"
+.option acl_smtp_data_prdr main string&!! accept
+.cindex "PRDR" "ACL for"
+.cindex "DATA" "PRDR ACL for"
 .cindex "&ACL;" "PRDR-related"
 .cindex "&ACL;" "per-user data processing"
 This option defines the ACL that,
@@ -23162,11 +23163,12 @@ connects. If authentication fails, Exim will try to transfer the message
 unauthenticated. See also &%hosts_require_auth%&, and chapter
 &<<CHAPSMTPAUTH>>& for details of authentication.
 
-.option hosts_try_prdr smtp "host list&!!" unset
+.option hosts_try_prdr smtp "host list&!!" *
 .cindex "PRDR" "enabling, optional in client"
 This option provides a list of servers to which, provided they announce
 PRDR support, Exim will attempt to negotiate PRDR
 for multi-recipient messages.
+The option can usually be left as default.
 
 .option interface smtp "string list&!!" unset
 .cindex "bind IP address"
@@ -23224,7 +23226,7 @@ so can cause parallel connections to the same host if &%remote_max_parallel%&
 permits this.
 
 
-.option multi_domain smtp boolean true
+.option multi_domain smtp boolean&!! true
 .vindex "&$domain$&"
 When this option is set, the &(smtp)& transport can handle a number of
 addresses containing a mixture of different domains provided they all resolve
@@ -23233,6 +23235,9 @@ handling only one domain at a time. This is useful if you want to use
 &$domain$& in an expansion for the transport, because it is set only when there
 is a single domain involved in a remote delivery.
 
+It is expanded per-address and can depend on any of
+&$address_data$&, &$domain_data$&, &$local_part_data$&,
+&$host$&, &$host_address$& and &$host_port$&.
 
 .option port smtp string&!! "see below"
 .cindex "port" "sending TCP/IP"
@@ -23268,7 +23273,7 @@ connecting, as an outbound SSL-on-connect, instead of using STARTTLS to upgrade.
 The Internet standards bodies strongly discourage use of this mode.
 
 
-.option retry_include_ip_address smtp boolean true
+.option retry_include_ip_address smtp boolean&!! true
 Exim normally includes both the host name and the IP address in the key it
 constructs for indexing retry data after a temporary delivery failure. This
 means that when one of several IP addresses for a host is failing, it gets
@@ -23278,9 +23283,8 @@ addresses is not affected.
 However, in some dialup environments hosts are assigned a different IP address
 each time they connect. In this situation the use of the IP address as part of
 the retry key leads to undesirable behaviour. Setting this option false causes
-Exim to use only the host name. This should normally be done on a separate
-instance of the &(smtp)& transport, set up specially to handle the dialup
-hosts.
+Exim to use only the host name.
+Since it is expanded it can be made to depend on the host or domain.
 
 
 .option serialize_hosts smtp "host list&!!" unset
@@ -23431,6 +23435,19 @@ The &$tls_out_certificate_verified$& variable is set when
 certificate verification succeeds.
 
 
+.option tls_verify_cert_hostnames smtp "host list&!!" *
+.cindex "TLS" "server certificate hostname verification"
+.cindex "certificate" "verification of server"
+This option give a list of hosts for which,
+while verifying the server certificate,
+checks will be included on the host name
+(note that this will generally be the result of a DNS MX lookup)
+versus Subject and Subject-Alternate-Name fields.  Wildcard names are permitted
+limited to being the initial component of a 3-or-more component FQDN.
+
+There is no equivalent checking on client certificates.
+
+
 .option tls_verify_certificates smtp string&!! unset
 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
@@ -26917,6 +26934,7 @@ This ACL is evaluated after &%acl_smtp_dkim%& but before &%acl_smtp_data%&.
 
 
 .section "The SMTP PRDR ACL" "SECTPRDRACL"
+.cindex "PRDR" "ACL for"
 .oindex "&%prdr_enable%&"
 The &%acl_smtp_data_prdr%& ACL is available only when Exim is compiled
 with PRDR support enabled (which is the default).
@@ -26925,8 +26943,9 @@ client and server for a message, and more than one recipient
 has been accepted.
 
 The ACL test specfied by &%acl_smtp_data_prdr%& happens after a message
-has been recieved, and is executed for each recipient of the message.
-The test may accept or deny for inividual recipients.
+has been recieved, and is executed once for each recipient of the message
+with &$local_part$& and &$domain$& valid.
+The test may accept, defer or deny for inividual recipients.
 The &%acl_smtp_data%& will still be called after this ACL and
 can reject the message overall, even if this ACL has accepted it
 for some or all recipients.