This is the FAQ for the Exim Mail Transfer Agent. Thanks to the many people who provided the original information. This file would be amazingly cluttered if I tried to list them all. Suggestions for corrections, improvements, and additions are welcome.
This version of the FAQ applies to Exim 3.20 and later releases. The syntax of some of the options was altered and tidied up at release 3.00. Some of the examples quoted here will not work with earlier releases.
References of the form Cnnn and Fnnn are to the sample configuration and filter files that can be found in the separately distributed directory called config.samples. The primary location is
ftp://ftp.csx.cam.ac.uk/pub/software/email/exim/config.samples.tar.gz ftp://ftp.csx.cam.ac.uk/pub/software/email/exim/config.samples.tar.bz2
There are brief descriptions of these files at the end of this document.
The FAQ is divided into the following sections: Debugging, Building exim, Mailbox locking, Routing, Directing, Delivery, UUCP, Performance, Policy controls, Majordomo, Rewriting addresses, Headers, Fetchmail, Perl, Dial-up, Modifying message bodies, Millennium, Miscellaneous, HP-UX, BSDI, IRIX, Linux, Sun systems, Cookbook, and List of sample configurations.
Philip Hazel <ph10@cus.cam.ac.uk>
Last update: 23-April-2001
A0001: Exim should never crash. The author is always keen to know about crashes, so that they can be diagnosed and fixed. However, before you start sending email, please check that you are running the latest release of Exim, in case the problem has already been fixed. The techniques described below can also be useful in trying to pin down exactly which circumstances caused the crash and what Exim was trying to do at the time. If the crash is reproducable (by a particular message, say) keep a copy of that message. If there is a core file (in Exim's spool directory), see if you can get any information from it.
One thing that has caused crashes in the past has been incorrectly installed DB libraries. In particular, if you are running any version of Berkeley db, it is best to set USE_DB=yes in Local/Makefile before building Exim. This then avoids the use of the "ndbm compatibility interface" via the ndbm.h include file, which has been found to be incorrect on some systems. If you have already built Exim, you can just edit Local/Makefile and run make again to rebuild. Before restarting Exim, delete any existing database files in the spool/db directory.
Q0002: Exim is not working. What is wrong? How can I check what it is doing?A0002: Exactly how is it not working? Check the more specific questions in the other sections of this FAQ. Some general techniques for debugging are:
1. Look for information in Exim's log files. These are in the "log" directory in Exim's spool directory, unless you have configured a different path for them. Serious operational problems are reported in paniclog.
2. If the problem involves the delivery of one or more messages, try forcing a delivery with the -d option, to cause Exim to output debugging information. For example:
exim -d -M 0z6CXU-0005RR-00
On its own, -d produces a small amount of information. Following it with a number increases the amount given: -d9 gives the maximum amount of general information; -d10 gives in addition details of the interpretation of filter files, and -d11 or higher also turns on the debugging option for DNS lookups. The output is written to the standard error stream.
3. If the problem involves incoming SMTP mail, try using the -bh option to simulate an incoming connection from a specific host, for example:
exim -bh 10.9.8.7
This goes through the motions of an SMTP session, without actually accepting a message. Information about various policy checks is output. You will need to know how to pretend to be an SMTP client.
4. If the problem involves lack of recognition or incorrect handling of local addresses, try using the -bt option with debugging turned on, to see how Exim is handling the address. For example,
exim -d2 -bt z6abc
will show you how it would handle the local part "z6abc". Increase the debug level to -d9 for more information.
Q0003: What does the error "Child process of address_pipe transport returned 69 from command xxx" mean?A0003: The most common meaning of exit code 69 is "unavailable", and this often means that when Exim tried to exec the command xxx, it failed. One cause of this might be incorrect permissions on the file containing the command. See also Q0033.
Q0004: My virtual domain setup isn't working. How can I debug it?A0004: You can use an exim command with -d (or -d2, -d3 ... -d9) to get it to show you how it is processing addresses. You don't actually need to send a message; use the -bt option like this:
exim -d2 -bt localpart@virtualhost
This will show you which directors it is using. If the problem appears to be with the expansion of an option setting, you can use the debug_print option on a director (or router) to get Exim to output the expanded string values as it goes along.
Q0005: Why is Exim giving "421 Unexpected log failure, please try later" when receiving an SMTP message with a large number of recipients?A0005: You are verifying recipients, and your configuration is one that does a different lookup of some sort for each recipient. Exim keeps lookup files open, in case there are several lookups in the same file. Versions of Exim prior to 2.10 did not limit the number of open files used for this purpose, and your operating system's maximum per process has been reached. Exim is trying to log the failure to open a file, but cannot open the log file, for the same reason. If upgrading Exim is not immediately possible, you might be able to increase your operating system's maximum number of open files per process.
Q0006: Why is Exim not rejecting incoming messages addressed to non-existent users at SMTP time?A0006: Have you remembered to set receiver_verify? It is not the default.
Q0007: I've put an entry for *.my.domain in a DBM lookup file, but it isn't getting recognized.A0007: You need to request "partial matching" by setting the search type to "partial-dbm" in order for this to work.
Q0008: I've put the entry *@domain.com in a lookup database, but it isn't working. The expansion I'm using is:
${lookup{${lc:$sender_address}}dbm{/the/file} ...
A0008: As no sender address will ever be *@domain.com this will indeed have no effect as it stands. You need to tell Exim if you want it to look for defaults after the normal lookup has failed. In this case, change the search type from "dbm" to "dbm*@". See the section on "Default values in single-key lookups" in the chapter entitled "File and database lookups".
Q0009: Is there a way to print recognized local domains?A0009: If you run "exim -bP local_domains" it will output the string that is set, but it won't print the contents of any files that are referenced.
Q0010: If I run "./exim -d9 -bt user@domain" all seems well, but when I send a message from my User Agent, it does not arrive at its destination.A0010: Try sending a message directly to Exim by typing this:
exim -d9 user@domain
<some message, could be empty>
.
If the message gets delivered to a remote host, but never arrives at its final destination, then the problem is at the remote host. If, however, the message gets through correctly, then the problem may be between your User Agent and Exim. Try setting Exim's log_arguments option, to see with which arguments the UA is calling Exim.
Q0011: I am getting this message in mainlog every so often: "no immediate delivery: too many connections (19, max 0)". What am I missing?A0011: A current release of Exim. :-) The message you are getting is the wrong message. What it should be saying is "too many messages received in one SMTP connection" (see next question). This bug was fixed in release 2.051.
Q0012: What does "no immediate delivery: too many messages received in one SMTP connection" mean?A0012: An SMTP client may send any number of messages down a single SMTP connection to a server. Initially, an Exim server starts up a delivery process as soon as a message is received. However, in order not to start up too many processes when lots of messages are arriving (typically after a period of downtime), it stops doing immediate delivery after a certain number of messages have arrived down the same connection. The threshold is set by smtp_accept_queue_per_connection, and the default value is 10. On large systems, the value should be increased. If you are running a dial-in host and expecting to get all your mail down a single SMTP connection, then you can disable the limit altogether by setting the value to zero.
Q0013: Exim puts "for <address>" in the Received: headers of some, but not all, messages. Is this a bug?A0013: No. It is deliberate. Exim inserts a "for" phrase only if the incoming message has precisely one recipient. If there is more than one recipient, nothing is inserted. The reason for this is that not all recipients appear in the To: or Cc: headers, and it is considered a breach of privacy to expose such recipients to the others. A common case is when a message has come from a mailing list.
Q0014: Instead of exim_dbmbuild, I'm using a homegrown program to build DBM (or cdb) files, but Exim doesn't seem to be able to use them.A0014: Exim expects there to be a binary zero value on the end of each key used in a DBM file if you use the "dbm" lookup type, but not for the "dbmnz" lookup type or for the keys of a cdb file. Check that you haven't slipped up in this regard.
Q0015: Exim is unable to route to any remote domains. It doesn't seen to be able to access the DNS.A0015: Try running "exim -d11 -bt <remote address>". The -d11 will make it show the resolver queries it is building and the results of its DNS queries. If it appears unable to contact any nameservers, check the contents and permissions of /etc/resolv.conf.
Q0016: I'm using ETRN to run a script that checks things and doesn't always end up running "exim -R". However, after it has run once, subsequent attempts fail with "458 Already processing".A0016: Set no_smtp_etrn_serialize.
Q0017: What does the error message "transport system_aliases: cannot find transport driver "aliasfile" in line 92" mean?A0017: "aliasfile" is a director, not a transport. You have put a configuration for a director into the transports section of the configuration file.
Q0018: Exim is timing out after receiving and responding to the DATA command from one particular host, and yet the client host also claims to be timing out. This seems to affect only certain messages.A0018: (A) This problem has been seen with a network that was dropping all packets over a certain size, which mean that the first part of the SMTP transaction worked, but when the body of a large message started flowing, the main data bits never got through the network. See also Q0021.
(B) This can also happen if a machine has a broken TCP stack and won't reassemble fragmented datagrams.
(C) A very few ISDN lines have been seen which failed when certain data patterns were sent through them, and replacing the routers at both end of the link did not fix things. One of them was triggered by more than 4 X's in a row in the data.
Q0019: What does the message "Socket bind() to port 25 for address (any) failed: address already in use" mean?A0019: You are trying to run an Exim daemon when there is one already running - or maybe some other MTA is running, or perhaps you have an SMTP line in /etc/inetd.conf which is causing inetd to listen on port 25.
Q0020: I've set headers_check_syntax, but this causes Exim to complain about headers like "To: Work: Jim <jims@email>, Home: Bob <bobs@email>" which look all right to me. Is this a bug?A0020: No. Header lines such as From:, To:, etc., which contain addresses, are structured, and have to be in a specific format which is defined in RFC 822. Unquoted colons are not allowed in the "phrase" part of an email address (they are OK in other headers such as Subject:). The correct form for that header is
To: "Work: Jim" <jims@email>, "Home: Bob" <bobs@email>
You will sometimes see unquoted colons in To: and Cc: headers, but only in connection with name lists (called "groups"), for example:
To: My friends: X <x@y.x>, Y <y@w.z>;,
My enemies: A <a@b.c>, B <b@c.d>;
Each list must be terminated by a semicolon, as shown.
Q0021: Whenever Exim tries to deliver a specific message to a particular server, it fails, giving the error "Remote end closed connection after data" or "Broken pipe" or a timeout. What's going on?A0021: "Broken pipe" is the error you get on some OS when the far end just drops the connection. The alternative is "connection reset by peer".
(A) There are some firewalls that fall over on \0 characters in the mail. Have a look, e.g. with hexdump -c mymail | tail to see if your mail contains any binary zero characters.
(B) There are broken SMTP servers around that just drop the connection after the data has been sent if they don't like the message for some reason (e.g. it is too big) instead of sending a 5xx error code. Have you tried sending a small message to the same address?
It has been reported that some releases of Novell servers running NIMS are unable to handle lines longer than 1024 characters, and just close the connection. This is an example of this behaviour.
(C) If the problem occurs right at the start of the mail, then it could be a network problem with mishandling of large packets. Many emails are small and thus appear to propagate correctly, but big emails will generate big IP datagrams.
There have been problems when something in the middle of the network mishandles large packets due to IP tunnelling. In a tunnelled link, your IP datagrams gets wrapped in a larger datagram and sent over a network. This is how virtual private networks (VPNs), and some ISP transit circuits work. Since the datagrams going over the tunnel require a larger packet size, the tunnel needs a bigger maximum transfer unit (MTU) in the network handling the tunnelled packets. However, MTUs are often fixed, so the tunnel will try to fragment the packets.
If the systems outside the tunnel are using MTU path discovery, (most Sun Sparc Solaris machines do by default), and set the DF (don't fragment) bit because they don't send packets larger than their local MTU, then ICMP control messages will be sent by the routers at the ends of the tunnel to tell them to reduce their MTU, since the tunnel can't fragment the data, and has to throw it away. If this mechanism stops working, e.g. a firewall blocks ICMP, then your host never knows it has hit the maximum path MTU, but it has received no ACK on the packet either, so it continues to resend the same packet and the connection stalls, eventually timing out.
You can test the link using pings of large packets and see what works:
ping -s host 2048
Try reducing the MTU on the sending host:
ifconfig le0 mtu 1300
Alternatively, you can reduce the size of the buffer Exim uses for SMTP output by putting something like
DELIVER_OUT_BUFFER_SIZE=512
in your Local/Makefile and rebuilding Exim (the default is 8192).
Q0022: Why do messages not get delivered down the same connection when I do something like: exim -v -R @aol.com ? For other domains, I do this and I see the appropriate "waiting for passed connections to get used" messages.A0022: Recall that Exim does not keep separate queues for each domain, but operates in a distributed fashion. Messages get into its "waiting for host x" hints database only when a delivery has been tried, and has had a temporary error. Here are some possibilities:
(1) The messages to aol.com got put in your queue, but no previous delivery attempt occured before you did the -R. This might have been because of your settings of queue_only_load, smtp_accept_queue, or any other option that caused no immediate delivery attempt on arrival. If this is the case, you can try using -qqR instead of -R.
(2) You have set batch_max on the smtp transport, and that limit was reached. This would show as a sequence of n messages down one connection, then another n down a new connection, etc.
(3) Exim tried to pass on the SMTP connection to another message, but that message was in the process of being delivered to aol.com by some other process (typically, a normal queue runner). This will break the sequence, though the other delivery should pass its connection on to other messages if there are any.
(4) The folk at aol.com changed the MX records so the host names have changed - or a new host has been added. I don't know how likely this is.
(5) Exim is not performing as it should in this regard, for some reason. Next time you have mail queued up for aol.com, try running
exim_dumpdb /var/spool/exim wait-remote_smtp
to see if those messages are listed among those waiting for the relevant aol.com hosts.
Q0023: What does the error "SEGV while reading ... from dbm file: record assumed not to exist" mean?A0023: A crash is occuring when Exim calls your DBM library in order to read a record from one of its hints files. This kind of problem can be related to incorrectly installed DBM libraries. If you are using Slackware 3.6, the problem is that libgdbm is incorrectly installed on that system, and you will need to re-install it from source.
Q0024: There seems to be a problem in the string expansion code: it doesn't recognize references to headers such as ${h_to}.A0024: The only valid syntax for header references is (for example) $h_to: because header names are permitted by RFC 822 to contain a very wide range of characters. A colon (or white space) is required as the terminator.
Q0025: Exim is timing out after sending the a message's data to one particular host, and yet the remote host also claims to be timing out. This seems to affect only certain messages.A0025: See Q0018.
Q0026: When the Exim daemon forks a copy of itself to handle an incoming SMTP request, the forked copy seems to go around in circles for a significant (up to 5 minutes, so far) amount of time before deciding to accept the message.A0026: These kinds of delay are usually caused by some kind of network problem that affects outgoing calls made by Exim at the start of an incoming message. Configuration options that cause outgoing calls are:
(1) rfc1413_query_hosts and rfc1413_query_timeout (for ident calls); firewalls sometimes block ident calls, which can lead to this problem.
(2) rbl_domains and rbl_hosts.
(3) host_lookup and any other options that require the remote host's name to be looked up from its IP address.
(4) sender_verify_hosts_callback and sender_verify_callback_domains.
You can use the -bh option to get more information about what is happening at the start of a connection.
Q0027: What does "failed to create child process to send failure message" mean? This is a busy mail server with smtp_accept_max set to 500, but this problem started to occur at about 300 incoming connections.A0027: Some message delivery failed, and when Exim wanted to send a bounce message, it was unable to create a process in which to do so. Probably the limit on the maximum number of simultaneously active processes has been reached. Most OS have some means of increasing this limit, and in some operating systems there is also a limit per uid which can be varied.
Q0028: What does "<message filter> transporting defer (-1): No transport set by director" in a log line mean?A0028: Your system filter contains a "save" command, but you have not set message_filter_file_transport.
Q0029: Why is Exim refusing to relay, saying "failed to find host name from IP address" when I have the sender's IP address in host_accept_relay? My configuration contains this:
host_accept_relay = "lsearch;/etc/mail/relaydomains:192.168.96.0/24"
A0029: When checking host_accept_relay, the items are tested in left-to-right order. The first item in your list is a lookup on the incoming host's name, so Exim has to determine the name from the incoming IP address in order to perform the test. If it can't find the host name, it can't do the check, so it gives up. The solution is to put all explicit IP addresses first in the list. You would have discovered what was going on if you had run a test such as
exim -bh 192.168.96.131
Q0030: When I run "exim -bd -q10m" I get "PANIC LOG: exec of exim -q failed".
A0030: This probably means that Exim doesn't know its own path so it can't re-exec itself to do the first queue run. Check the output of
exim -bP exim_path
Q0031: Why do connections to my machine's SMTP port take a long time to respond
with the banner, when connections to other ports respond instantly?
A0031: See Q0026.
Q0032: I can't seem to get a pipe command to run when I include a ${if expansion in it. This fails:
command = "perl -T /usr/local/rt/bin/rtmux.pl \
rt-mailgate helpdesk \
${if eq {$local_part}{rt} {correspond}{action}}"
A0032: You need some internal quoting in there. Exim expands each individual argument separately. Because you have (necessarily) got spaces in your ${if item, you have to quote that argument. Try
command = "perl -T /usr/local/rt/bin/rtmux.pl \
rt-mailgate helpdesk \
\"${if eq {$local_part}{rt} {correspond}{action}}\""
Q0033: I'm trying to get Exim to connect an alias to a pipe, but it always
gives error code 69, with the comment "(could mean service or program
unavailable)".
A0033: If your alias entry looks like this:
alias: |"/some/command some parameters"
change it to look like this:
alias: "|/some/command some parameters"
Q0034: I'm having a problem with an Exim RPM.
A0034: See Q9606.
Q0035: What does the error "Spool file is locked" mean?A0035: This is not an error[*]. All it means is that when an Exim delivery process (probably started by a queue runner process) looked at a message in order to start delivering it, it found that another Exim process was already busy delivering it. On a busy system this is quite a common occurrence. If you set log_level less than 5, these messages are omitted from the log.
[*] The only time when this message might indicate a problem is if it is repeated for the same message for a very long time - say more than a few hours. That would suggest that the process that is delivering the message has somehow got stuck.
Q0036: Exim is reporting IP addresses as 0.0.0.0 or 255.255.255.255 instead of their correct values. What's going on?A0036: You are using a version of Exim built with gcc on an IRIX box. See Q9502.
Q0037: I can't seem to figure out why PAM support doesn't work correctly.A0037: There is a problem using PAM on Linux with shadow passwords when the calling program is not running as root. Exim is normally running as the Exim user when authenticating a remote host. I don't know of an easy resolution to this.
Q0038: I'm trying to use a query-style lookup for hosts that are allowed to relay, but it is giving really weird errors.A0038: Does your query contain a colon character? Remember that host_accept_relay operates on a colon-separated list, so you need to double any colons in the query. This applies even if the query is defined as a macro.
Q0039: Exim is rejecting calls from hosts that have more than one IP address, for no apparent reason.A0039: You are using Solaris 7 or earlier, and have "nis dns files" in /etc/nsswitch.conf. Change this to "dns nis files" to avoid hitting Sun bug 1154236 (a bad interaction between NIS and the DNS).
Q0040: Exim is failing to find the MySQL library, even though is it present within $LD_LIBRARY_PATH. I'm getting this error:
/usr/local/bin/exim: fatal: libmysqlclient.so.6: open failed:
No such file or directory
A0040: Exim is suid, and LD_LIBRARY_PATH is ignored for suid binaries on a Solaris (and other?) systems. What you should be doing is adding -R/local/lib/mysql to the same place in the compilation that you added -L/local/lib/mysql. This lets the binary know where to look without needing a path variable.
Q0041: I have a collection of Exim processes that have been around for days, and are apparently stuck while trying to deliver to remote hosts. This is causing the messages they are handling to get stuck.A0041: There appears to be a problem in the connect() function in some operating systems, such that it does not time out as it should. Setting connect_timeout in the smtp transport causes Exim to apply its own timeout, and this seems to overcome this problem. In Exim 3.15 the default was changed from zero (rely on system's timeout) to 5 minutes, which is the value recommended in the RFCs.
Q0042: I have a message in the spool which couldn't be delivered because of a timeout from the remote smtp server. When I try to deliver this message in eximon, I get "Spool file is locked". How can I deliver the message?A0042: Find the Exim proccess that is stuck, and kill it. You may be able to use exiwhat to do this, but if it is stuck in connect() it may not respond, and you will have to identify it some other way. Now read Q0041 about why this might have happened.
If you have a suitable debugger on your system, you may be able to find out more information before killing the process. For example, if you have gdb you can connect it to the process by running this command as root:
gdb exim <process-id>
At the gdb prompt, give the "bt" (backtrace) command, to display the stack contents. This should tell you the name of the function in which the process is stuck. If this is connect(), then you do have the Q0041 problem.
Q0043: What does the error "lookup of host "xx.xx.xx" failed in yyyy router" mean? Any suggestions to stop this these sort of errors from being frozen would be muchly appreciated.A0043: You configured a domainlist router to send the message to xx.xx.xx. When it tried to look up the IP address for that host, the lookup failed with a permanent error. As this is a manual routing, this is a considered to be a serious error which the postmaster needs to know about (maybe you have a typo in your file), and there is little point in keeping on trying. So it freezes the message.
1. Don't set up routes to non-existent hosts.
2. If you must set up routes to non-existent hosts, and don't want freezing, set the host_find_failed option on the router to do something other than freeze.
Q0044: My filter isn't working. How can I test it?A0044: Use the -bf option (-bF for a system filter) to test the basic operation of your filter. If you also turn on debugging at level 10 (-d10) it will output information as the filter runs.
Q0045: Exim works fine on one host, but when I copied the binary to another identical host, it stopped working (it could not resolve DNS names).A0045: Is the new host running exactly the same operating system? Most importantly, are the versions of the dynamically loaded libraries (files with names like libsocket.so.1) the same on both systems? If not, that is probably the cause of the problem. Either arrange for the libraries to be the same, or rebuild Exim from source on the new host.
Q0046: Once in a while, a user will send a message and immediatly get a response back "No Transport Provider" If they choose "Send Again", sometimes it works, sometimes it doesn't.A0046: This problem has been seen on Debian Linux 2.1 systems. The best advice seems to be to upgrade your server to a later Debian release and a later Exim release, and maybe also upgrade the hardware.
Q0047: I set host_accept_relay to do a lookup in a file of IP addresses, but it doesn't work.A0047: Did you remember to put `net-' at the start of the the search type? If you set something like this:
host_accept_relay = lsearch;/some/file
it searches the file for the host name. You need to set
host_accept_relay = net-lsearch;/some/file
to make it use the IP address as the key to the lookup.
A0101: The problem is that libident assumes "struct timeval" refers to DST_NONE, and so it tries to avoid using this structure when DST_NONE isn't defined. Unfortunately it doesn't make this change everywhere it should, and so it blows up. The problem has been seen on NetBSD and some versions of the Linux C library. An easy, albeit not particularly neat, fix is to add -DDST_NONE to LIBIDENTCFLAGS for systems that are afflicted like this - there's not a lot else you can do without modifying libident. The value of DST_NONE is never used, so defining it to be empty should be harmless.
Q0102: When I ran make I got the error "undefined reference to dbopen".A0102: Either:
(A) This means you (or the default configuration for your operating system) have configured Exim to use Berkeley DB version 1.xx and it has not been given access to the DB library (where dbopen should be found). You may need something like DBMLIB=-ldb in Local/Makefile. Berkeley DB is one of several alternative DBM libraries that Exim can make use of. For a discussion of DBM issues, see the file doc/dbm.discuss.txt in the Exim distribution.
(B) You are running on a version of Linux which has a problem in its libraries. This effect isn't fully understood. It has been seen with the libraries used in Caldera OpenLinux Base 1.1.
Q0103: I can't get Exim to compile with Berkeley DB version 2.x.A0103: Have you set USE_DB=yes in Local/Makefile? This causes Exim to use the native interface to the DBM library instead of the compatibility interface, which needs a header called ndbm.h that may not exist on your system.
Q0104: I'm getting an "undefined symbol" error for hosts_ctl when I try to build Exim. (On some systems this error is "undefined reference to 'hosts_ctl'".)A0104: You should either remove the definition of USE_TCP_WRAPPERS or add -lwrap to your EXTRALIBS setting in Local/Makefile.
Q0105: I'm about to upgrade to a new Exim release. Do I need to ensure the spool is empty, or take any other special action?A0105: If you are changing to release 3.00 or later from a release prior to 3.00, you will probably need to make changes to the runtime configuration file. See README.UPDATING for details. Otherwise, you do not need to take special action. New releases are made backwards compatible with old spool files and "hints" databases so that upgrading can be done on a running system. All that should be necessary is to install a new binary and then HUP the daemon if you are running one.
Q0106: What does the error "install-info: command not found" mean?A0106: You have set INFO_DIRECTORY in your Local/Makefile, and Exim is trying to install the Texinfo documentation, but cannot find the command called install-info. If you have a version of Texinfo prior to 3.9, you should upgrade. Otherwise, check your installation of Texinfo to see why the install-info command is not available.
Q0107: Exim doesn't seem to be recognizing my operating system type correctly, and so is failing to build.A0107: Run the command "scripts/os-type -generic". The output should be one of the known OS types, and should correspond to your operating system. You can see which OS are supported by obeying "ls OS/Makefile-*" and looking at the file name suffixes.
If there is a discrepancy, it means that the script is failing to interpret the output from the "uname" command correctly, or that the output is wrong. Meanwhile, you can build Exim by obeying
EXIM_OSTYPE=xxxx make
instead of just make, provided you are running a Bourne-compatible shell, or otherwise by setting EXIM_OSTYPE correctly in your environment. It is probably best to start again from a clean distribution, to avoid any wreckage left over from the failed attempt.
Q0108: I am getting an error "`exim' undeclared here" when I compile, in the globals.c module.A0108: You have set EXIM_UID = exim in your Local/Makefile. Unfortunately, named uids are not permitted here; you must give a numerical uid. However, in the runtime configure file names are permitted.
Q0109: Exim fails to build, complaining about the absence of the "killpg" function.A0109: This function should be present in all modern flavours of Unix. If you are using an older version, you should be able to get round the problem by inserting
#define killpg(pgid,sig) kill(-(pgid),sig)
into the file called OS/os.h-xxx, where xxx identifies your operating system, and is the output of the command "scripts/os-type -generic".
Q0110: I'm getting an unresolved symbol ldap_is_ldap_url when trying to build Exim.A0110: You must have specified LOOKUP_LDAP=yes in the configuration. Have you remembered to set -lldap somewhere (e.g. in LOOKUP_LIBS)? You need that in order to get the LDAP library scanned when linking.
Q0111: I'm getting an unresolved symbol mysql_close when trying to build Exim.A0111: You must have specified LOOKUP_MYSQL=yes in the configuration. Have you remembered to set -lmysqlclient somewhere (e.g. in LOOKUP_LIBS)? You need that in order to get the MySQL library scanned when linking.
Q0112: I'm trying to build Exim with PAM support. I have included -lpam in EXTRALIBS, but I'm still getting a linking error:
/lib/libpam.so: undefined reference to `dlerror'
/lib/libpam.so: undefined reference to `dlclose'
/lib/libpam.so: undefined reference to `dlopen'
/lib/libpam.so: undefined reference to `dlsym'
A0112: Add -ldl to EXTRALIBS. In some systems these dynamic loading functions are in their own library.
Q0113: I'm getting the error "db.h: No such file or directory" when I try to build Exim.A0113: This problem has been seen with RedHat 7.0, but could also happen in other environments. If your system is using the DB3 DBM library, you need to install the DB3 development package in order to build Exim. The package is called something like db3-devel-3.1.14-16.i386.rpm for Linux systems, but you should check which version of DB3 you have installed.
Q0114: I'm getting the error "/usr/bin/ld: cannot find -ldb1" when I try to build Exim.A0114: This is probably the same problem as Q0113.
A0201: Your configuration specifies that local mailboxes are all held in single directory, via configuration lines like these (taken from the default configuration):
local_delivery:
driver = appendfile
file = /var/mail/$local_part
and the permissions on the directory probably look like this:
drwxrwxr-x 3 root mail 512 Jul 9 13:48 /var/mail/
Using the default configuration, Exim runs as the local user when doing a local delivery, and it uses a lock file to prevent any other process from updating the mailbox while it is writing to it. With those permissions the delivery process, running as the user, is unable to create a lock file in the /var/mail directory. There are two solutions to this problem:
(A) Set the "write" and "sticky bit" permissions on the directory, so that it looks like this:
drwxrwxrwt 3 root mail 512 Jul 9 13:48 /var/mail/
The "w" allows any user to create new files in the directory, but the "t" bit means that only the creator of a file is able to remove it. This is the same setting as is normally used with the /tmp directory.
(B) Arrange to run the local_delivery transport under a specific group by changing the configuration to read
local_delivery:
driver = appendfile
file = /var/mail/${local_part}
group = mail
The delivery process still runs under the user's uid, but with the group set to "mail". The group permission on the directory allows the process to create and remove the lock file.
The choice between (A) and (B) is up to the administrator. If the second solution is used, users can empty their mailboxes by updating them, but cannot delete them.
If your problem involves mail to root, see also Q0507.
Q0202: I am experiencing mailbox locking problems with Sun's mailtool used over a network.A0202: See A9705 in the Sun-specific section below.
A0301: They mean exactly what they say. Exim has tried to route a domain that it thinks is not local, and when it looked it up in the DNS, either the lowest numbered MX record pointed at the local host, or there were no MX records, and the address record for the domain pointed to an IP address that belongs to the local host.
(A) If the domain is meant to be handled as a local domain, then there is a problem with the setting of the local_domains configuration option. If you have not set this, then only the name of the local host is treated as a local domain. If, for example, your host is called myhost.mydomain.com and you want it to handle mail for the domain mydomain.com as well as for its own name, you must set
local_domains = myhost.mydomain.com:mydomain.com
or, if you want to be more general, you could use
local_domains = *.mydomain.com:mydomain.com
If you have a large number of individual local domains, you should investigate storing them in a file and setting local_domains to do a lookup.
All the domains in local_domains are treated as synonymous by default. If you want to specify different handling for different domains, you can either use domains options, to restrict certain directors to certain domains, or use the $domain expansion variable in director options to vary the value according to the domain, for example, setting the name of an alias file to /etc/aliases/$domain.
(B) If the domain is one for which the local host is providing a forwarding service (called "mail hubbing"), possibly as part of a firewall, then you need to set up a router to tell Exim where to send messages addressed to this domain, since the DNS directs them to the local host. The routers section of your configuration file should look something like this:
hubbed_hosts:
driver = domainlist
transport = remote_smtp
route_list = see discussion below
other_hosts:
driver = lookuphost
transport = remote_smtp
Note that the domainlist router must come first so that it can pick off a hubbed host before it gets to the lookuphost router. The contents of the route_list option depend on how many hosts you are hubbing for, and how their names are related to the domain name. Suppose the local host is a firewall, and all the domains in *.foo.bar have MX records pointing to it, and each domain corresponds to a host of the same name. Then the setting could be
route_list = "*.foo.bar $domain byname"
If there isn't a convenient relationship between the domain names and the host names, then you either have to list each domain separately, or use a lookup expansion to look up the host from the domain, or put the routing information in a file and use the route_file option.
(C) If neither (A) nor (B) is the case, then the lowest numbered MX record or the address record for the domain should not be pointing to your host. You should arrange to get the DNS mended.
There has been a rash of instances of domains being deliberately set up with MX records pointing to "localhost", which causes this behaviour. By default, Exim defers delivery and freezes the message. You can change what Exim does by setting the generic "self" option on the router, for example, to make it bounce such domains. If you are running a release later than 3.16, you can use the option called ignore_target_hosts instead, to get it to pretend such hosts do not exist.
Q0302: How do I configure Exim to send all non-local mail to a gateway host?A0302: Replace the lookuphost router in the default configuration with the following:
send_to_gateway:
driver = domainlist
transport = remote_smtp
route_list = * gate.way.host byname
This uses gethostbyname() to find the gateway's IP address. You could alternatively have "bydns" to do a DNS lookup with MX handling, in which case "gate.way.host" is really being treated as a mail domain name rather than a host name. If there are several hosts you can send to, you can specify them as a colon-separated list. See also Q0325 and Q0402.
Q0303: How do I configure Exim to send all non-local mail to a central server if it cannot be immediately delivered by my host? I don't want to have queued mail waiting on my host.A0303: Add to the remote_smtp transport the following:
fallback_hosts = central.server.name(s)
If there are several names, they must be separated by colons.
Q0304: How can I arrange for messages submitted by (for example) Majordomo to be routed specially?A0304: See A0404.
Q0305: How do I arrange for all incoming email for *@some.domain to go into one pop3 mail account? The customer doesn't want to add a list of specific local parts to the system.A0305: Set up a special transport that writes to the mailbox like this:
special_transport:
driver = appendfile
file = /pop/mailbox
envelope_to_add
return_path_add
delivery_date_add
user = exim
The file will be written as the user "exim". Then arrange to route all mail for that domain to that transport, with a router like this:
special_router:
driver = domainlist
transport = special_transport
route_list = some.domain
Alternatively, you could make some.domain a local domain, and use a smartuser director instead.
Q0306: The route_list setting ^foo$:^bar$ $domain byname in a domainlist router does not work.A0306: The first thing in a route_list item is a single pattern, not a list of patterns. You need to write that as ^(foo|bar)$ $domain byname. Alternatively, you could use several items and write
route_list = "foo $domain byname; bar $domain byname"
Note the semicolon separator. This is because the second thing in each item can be a list - of hosts.
Q0307: I'm getting "permission denied" when Exim attempts to check a require_files option.A0307: See A0410 below.
Q0308: I have a domain for which some local parts must be delivered locally, but the remainder are to be treated like any other remote addresses.A0308: The way to do this is not to include the domain in local_domains, so that addresses initially get passed to the routers. The first router should be definied like this:
special_local:
driver = domainlist
local_parts = whatever...
domains = whatever...
route_list = * localhost byname
self = local
That will pick off those addresses with matching local parts and domains, and hand them to the directors, because of the self = local setting. Any other addresses will fall through to the other routers and be handled as normal remote addresses.
Q0309: For certain domains, I don't want Exim to use MX records. Instead, I want it just to look up the hosts' A records. I tried using a negative entry in mx_domains in the smtp router, but it didn't work.A0309: The mx_domains option specifies domains for which there must be an MX record (an A record isn't good enough). Consequently, a negative item in it doesn't do what you want - any domain matching is is not required to have an MX record, but it doesn't stop Exim from using MX records for any that do have them. You can achieve what you want using either a lookuphost or a domainlist router:
(A) Using lookuphost:
special_domains:
driver = lookuphost
transport = remote_smtp
domains = list:of:domains:you:want:to:do:this:for
gethostbyname
(B) Using domainlist:
special_domains:
driver = domainlist
transport = remote_smtp
domains = list:of:domains:you:want:to:do:this:for
route_list = * * byname
If the list of domains is actually a lookup in a file, you can dispense with domains in the domainlist case, and put the lookup into the route_list option.
Q0310: How can I configure Exim on a firewall machine so that if mail arrives addressed to a domain whose MX points to the firewall, it is forwarded to the internal mail server, without having to have a list of all the domains involved?A0310: As your first router, have the standard lookuphost router from the default configuration, with the added options
no_more
self = pass
This will handle all domains whose lowest numbered MX records do not point to your host. Because of the no_more setting, if it encounters an unknown domain, routing will fail. However, if it hits a domain whose lowest numbered MX points to your host, the "self" option comes into play, and overrides no_more. The "pass" setting causes it to pass the address on to the next router. (The default causes it to generate an error.)
As your second (and last) router, set up a domainlist router that sends everything to your internal mail server. That is, use an option of the form
route_list = * internal.server byname
Q0311: How can I arrange that messages larger than some limit are handled by
a special router?
A0311: If you are using Exim 2.10 or greater, you can use a condition option on the router of the form
condition = ${if >{$message_size}{100K}{yes}{no}}
Earlier versions of Exim do not have numerical comparison operators, though you can use tricks like
condition = ${if eq {${substr_5:$message_size}}{}{no}{yes}}
Q0312: If a DNS lookup returns no MX records why doesn't Exim just bin the
message?
A0312: If a DNS lookup returns no MXs, Exim looks for an A record, in accordance with the rules that are defined in the RFCs. If you want to break the rules, you can set mx_domains in the lookuphost router, but you will cut yourself off from those sites (and there still seem to be plenty) who do not set up MX records.
Q0313: When a DNS lookup for MX records fails to complete, why doesn't Exim send the messsage to the host defined by the A record?A0313: The RFCs are quite clear on this. Only if it is known that there are no MX records is an MTA allowed to make use of the A record. When an MX lookup fails to complete, Exim does not know whether there are any MX records or not. There seem to be some nameservers (or some configurations of some nameservers) that give a "server fail" error when asked for a non-existent MX record. Exim uses standard resolver calls, which unfortunately do not distinguish between this case and a timeout, so all Exim can do is try again later.
Q0314: Can you specify a list of domains to explicitly reject?A0314: Use a router like this:
reject_domains:
driver = domainlist
self = fail_hard
domains = list:of:domains:to:reject
route_list = * localhost byname
Q0315: Is it possible to use a conditional expression for the host item in a
route_list for the domainlist router? I tried the following, but it
doesn't work:
route_list = * ${if match{$header_from:}{.*\\.usa\\.net\\$} \
{<smarthost1>}{<smarthost2>} bydns_a
A0315: The problem is that the second item in the route_list contains white space, which means that it gets terminated prematurely. To avoid this, you must put the second item in quotes:
route_list = * "${if match{$header_from:}{.*\\.usa\\.net\\$} \
{<smarthost1>}{<smarthost2>}}" bydns_a
Q0316: I send all external mail to a smart host, but this means that bad
addresses also get passed to the smart host. Can I avoid this?
A0316: If you are receiving the mail via SMTP, then you can use verification to weed out the bad addresses. Set no_verify on the router which sends everything to your smart host, and insert a new router with verify_only that does general routing using DNS lookups (e.g. the default lookuphost router), or any other verification you want. Then set receiver_verify so that addresses are accepted only if they verify successfully.
Q0317: I have a dial-up machine, and I use the queue_smtp option so that remote mail only goes out when I do a queue run. However, any email I send with an address <anything>@aol.com is returned within about 15 mins saying 'retry time exceeded', and all addresses are affected.A0317: See Q1401.
Q0318: How can I route mail for user X@local to a smarthost if X doesn't exist on the local host?A0318: See A0428.
Q0319: How can I arrange to do my own qualification of non-fully-qualified domains, and then pass them on to the next router?A0319: If you have some list of domains that you want to qualify, you can do this using a domainlist router. For example,
qualify:
driver = domainlist
route_list = *.a.b $domain.c.com
adds ".c.com" to any domain that matches "*.a.b". In the absence of any options in the route item, the new domain is passed to the next router.
If you want to do this in conjunction with a lookuphost router, the widen_domains option of that router may be another way of achieving what you want.
Q0320: Every system has a "nobody" account under which httpd etc run. I would like to know how to restrict mail which comes from that account to users on that host only.A0320: Set up a router with senders=nobody@your.domain which routes all mail to a local transport that delivers it to /dev/null (or to a pipe that bounces with an error message, or whatever). That would catch all mail to non-local domains.
Q0321: I have a really annoying intermittent problem where attempts to mail to valid sites are rejected with "unknown mail domain". This only happens a few times a day and there is no particular pattern to the sites it rejects. If I try to lookup the same domain a few minutes later then it is OK.A0321: (A) Have you linked Exim against the newest DNS resolver library that comes with Bind? If you are using SunOS4 that may be your problem, as the resolver that comes with that OS is known to be buggy and to give intermittent false negatives.
(B) Effects like this are sometimes seen if a domain's nameservers get out of step with each other.
Q0322: I'd like route all mail with unresolved addresses to a relay machine.A0322: Set pass_on_timeout on your lookuphost router, and add below it a domainlist router that routes everything to the relay.
Q0323: I would like to forward all incoming email for a particular domain to another machine via SMTP. Whereabouts would I configure that?A0323: First, do not list the domain in local_domains. Instead, list it in relay_domains. Then, if the domain's lowest numbered MX record points to your host, set up a domainlist router before your normal lookuphost router, in order to route the domain to the specific host.
Q0324: Why does Exim say "all relevant MX records point to non-existent hosts" when MX records point to IP addresses?A0324: MX records cannot point to IP addresses. They are defined to point to host names, so Exim always interprets them that way. (An IP address is a syntactically valid host name.) The DNS for the domain you are having problems with is misconfigured.
However, it appears that more and more DNS zones are breaking the rules and putting IP addresses on the RHS of MX records. Exim follows the rules and rejects this, but other MTAs do support it, so allow_mx_to_ip was regretfully added at release 3.14 to permit this heinous activity.
Q0325: How can I arrange for mail on my local network to be delivered directly to the relevant hosts, but all other mail to be sent to my ISP's mail server? The local hosts are all DNS-registered and behave like normal Internet hosts.A0325: Set up a first router to pick off all the domains for your local network. There are several ways you might do this. For example
local:
driver = lookuphost
transport = remote_smtp
domains = lsearch;/etc/local_domains.list
This does a perfectly conventional DNS routing operation, but only for your local domains. Follow this with a "smarthost" router:
internet:
driver = domainlist
transport = remote_smtp
route_list = * mail.isp.net bydns_a
This sends anything else to the smart host.
Q0326: What I'd like to do is have alternative smarthosts, where the one to be used is determined by which ISP I'm connected to.A0326: The simplest way to do this is to use a lookup in a domainlist router. For example:
smarthost:
driver = domainlist
transport = remote_smtp
route_list = * ${lookup{smart}lsearch{/etc/smarthost}{$value}} byname
where you arrange for the name (or IP address) of the relevant smart host to be placed in /etc/smarthost when you connect, in the form
smart: smart.host.name.or.ip
By keeping the data out of the main configuration file, you avoid having to HUP the daemon when it changes.
A0401: Adding an asterisk to a search type causes Exim to look up "*" when the normal lookup fails. So if your director is something like this:
virtual:
driver = aliasfile
domains = virt.dom.ain
file = /usr/lib/aliases.virt
search_type = lsearch
no_more
you should change "lsearch" to "lsearch*", and put this in the alias file:
*: postmaster@virt.dom.ain
This solution has the feature that if there are several unknown addresses in the same message, only one copy gets sent to the postmaster, because of Exim's normal de-duplication rules.
You can get separate deliveries for each unknown address only if you can direct them to a specific transport, by using a smartuser director like this:
virtual:
driver = aliasfile
domains = virt.dom.ain
file = /usr/lib/aliases.virt
search_type = lsearch
default_virtual:
driver = smartuser
domains = virt.dom.ain
transport = special_delivery
new_address = postmaster@virt.dom.ain
no_more
If an address in the virtual domain is not matched by the normal alias lookup, then it gets picked up by the smartuser and passed to the transport with a new address. There is no checking for duplicates, so if there is more than one address that passes through this mechanism, multiple copies get delivered. In order to distinguish them, the envelope_to_add option can be set on the transport, to cause the insertion of an Envelope-To: header containing the original recipient address.
Q0402: How do I configure Exim to send all messages to a central server?A0402: This implies that you are not doing any local deliveries at all. Set
local_domains =
in the configuration file. This specifies that there are no local domains (by default your host name is set up as a local domain). Then all addresses are non-local - A0302 tells you how to deal with them.
Q0403: How do I configure Exim to send messages for unknown local users to a central server?A0403: At the end of the directors section of the configuration, insert the following director:
unknown:
driver = smartuser
transport = unknown_transport
You should add no_verify to this if you are verifying addresses; without it, all local parts will verify as valid in the local domain. Then somewhere in the transports section of the configuration insert
unknown_transport:
driver = smtp
hosts = server.host.name
A colon-separated list of hosts may be given. They are tried in order. By default, the IP address of any host is found by looking in the DNS and doing MX processing (so really it is a domain list rather than a host list). If you don't want MX processing, set the "gethostbyname" option:
unknown_transport:
driver = smtp
hosts = server.host.name
gethostbyname
This calls the gethostbyname() function to find IP addresses. Depending on your operating system and configuration, this usually consults /etc/hosts and possibly other sources of information, as well as, or instead of, the DNS.
If you want to change the recipient address when doing this, you can use the new_address option on the smartuser director. For example, if the address is user@foo.bar.com and the setting is
new_address = $local_part@bar.com
The message is sent to the server with the envelope recipient changed to user@bar.com. However, this does not make any changes to the message's headers.
Q0404: How can I arrange for messages submitted by (for example) Majordomo to be handled specially?A0404: You can use the condition option on a director or router, with a setting such as
condition = ${if and {{eq {$sender_host_address}{}} \
{eq {$sender_ident}{majordom}}} {yes}{no}}
This first tests for a locally-submitted message, by ensuring there is no sending host address, and then it checks the identity of the user that ran the submitting process.
Q0405: On a host that accepts mail for several domains, do I have to use fully qualified names in /etc/aliases or do I have to set up an alias file for each domain?A0405: You can do it either way. If you use a single file, you must set include_domain on the aliasfile director. If you use a separate file for each domain you can use a single director with an option such as
file = /etc/aliases/$domain
(as in C007), or you can have several different directors, each one with
domains = domain1:domain2:...
so that each one processes certain domains only. That way you could have several domains sharing an alias file. All of this assumes that you want have different aliases for each domain. If all the domain names are in effect just synonyms, you don't need to do anything other than ensure they all match something in local_domains.
Q0406: Some of my users are using the .forward to pipe to a shell command which appends to the user's INBOX. How can I forbid this?A0406: If you allow your users to run shells in pipes, you cannot control which commands they run or which files they write to. However, you should point out to them that writing to an INBOX by arbitrary commands is not interlocked with the MTA and MUAs, and is liable to mess up the contents of the file.
If a user simply wants to choose a specific file for the delivery of messages, this can be done by putting a file name in a .forward file rather than using a pipe, or by using the "save" command in an Exim filter file.
You can set forbid_pipe on the forwardfile director, but that will prevent them from running any pipe commands at all. Alternatively, you can restrict which commands they may run in their pipes by setting the allow_commands and/or restrict_to_path options in the address_pipe transport.
Q0407: How can I arrange for a default value when using a query-style lookup such as LDAP or NIS+ to handle aliases?A0407: Using the queries option for the aliasfile driver should do what you want. You can supply a second query which gets obeyed when the first query fails. For example,
queries = "\
ldap:://x.y.z/l=yvr?aliasaddress?sub?(&(mail=$local_part@$domain)):\
ldap:://x.y.z/l=yvr?aliasaddress?sub?(&(mail=default@$domain))"
Q0408: If I don't fully qualify the addresses in a virtual domain's alias file
then mail to aliases which also match the local domain get delivered to
the local domain.
For example, if the alias file for foobar.com is
foo: joe@some.place.com
postmaster: foo
then mail sent to postmaster@foobar.com is not delivered to joe@some.place.com but instead goes to foo@localdomain.com.
A0408: Set the qualify_preserve_domain option on the aliasfile director.
Q0409: We've got users who chmod their home to 750, and home is NFS-mounted without root privilege, so Exim cannot access ~user/.forward.A0409: Set the seteuid option on the forwardfile director so that Exim "becomes" the user before trying to read the file. However, if your operating system does not support the seteuid() function, you cannot do this. In that circumstance, if you cannot persuade your users to make their .forward files world readable, you can set the ignore_eacces option, which causes Exim to ignore unreadable files.
Q0410: I'm getting "permission denied" when Exim tries to check a for the existence of a user's .procmailrc file using require_files.A0410: Exim is running under its own uid (or root if there isn't an Exim uid) when it checks require_files. You can cause it to change to a specific uid by putting an item not containing any / characters at the start of the require_files list. In this case you probably want a director along these lines:
procmail:
driver = localuser
require_files = $local_part:$home/.procmailrc
transport = procmail_pipe
Q0411: How can I deliver mail into different directories for each virtual
domain, doing user lookups not against /etc/passwd but against
/etc/passwd.domain?
A0411: See configuration sample C009.
Q0412: I want mail for any local part at certain virtual domains to go to a single address for each domain.A0412: One way to to this is
virtual:
driver = smartuser
domains = lsearch;/etc/virtual
new_address = ${lookup{$domain}lsearch{/etc/virtual}{$value}fail}
The /etc/virtual file contains a list of domains and the addresses to which their mail should be sent. For example:
domain1: postmaster@some.where.else
domain2: joe@xyz.plc
etc.
If the number of domains is large, using a DBM or cdb file would be more efficient.
Q0413: How can I make Exim look in the alias NIS map instead of /etc/aliases?A0413: The default configuration does not use NIS (many hosts don't run it). You should change the system_aliases director to
system_aliases:
driver = aliasfile
file = mail.aliases
search_type = nis
If you want to use /etc/aliases as well as NIS, put this director (with a different name) before or after the default one, depending on which data source you want to take precedence.
Q0414: What does the error message "error in forward file (filtering not enabled): missing or malformed local part ..." mean?A0414: If you are trying to use an Exim filter, you have forgotten to enable the facility, which is disabled by default. In the forwardfile director (in the Exim configuration file) you need to set
filter = true
to allow a .forward file to be used as an Exim filter. If you are not trying to use an Exim filter, then you have put a malformed address in the .forward file.
Q0415: Exim isn't recognizing certain forms of local address.A0415: (A) Try using the -bt option with debugging turned on, to see how Exim is handling the addresses. For example,
exim -d2 -bt z6abc
will show you how it would handle the local part "z6abc". Increase the debug level to -d9 for more information.
(B) If the local user names contain capital letters, that is probably the cause of your problem. Setting up such user names is a bad idea. By default, everything is lowercased before the final delivery for the sake of alias matching and user name matching, because people who type email addresses often get the case wrong. You can stop this by setting
locally_caseless = false
but then incoming addresses are recognized only in the correct case. See Q0424 for a way round this.
Q0416: I have a domain for which some local parts must be delivered locally, but the remainder are to be treated like any other remote addresses.A0416: See A0308.
Q0417: What I really need is the ability to obtain the result of a pipe command so that I can filter externally and redirect internally. Is this possible?A0417: This is not possible. The result of a pipe command is not available to a filter, because it doesn't run any deliveries while filtering. It just sets up deliveries. They all happen later. If you want to run pipes and examine their results, you need to set up a single delivery to a delivery agent such as procmail which provides this kind of facility.
Q0418: When I set a suffix on one of my directors, it doesn't get stripped when checking the local_parts option. Why is this?A0418: The test on local parts and domains is done early on, and only if they match is supplementary processing such as prefix and suffix recognition done. There is a section of the manual called "Skipping directors" which gives details. If you want to ignore a prefix or suffix in the initial test of the local part, you can do so by replacing local_parts with a setting of the condition option. For example, suppose you wanted to look up the basic local part in a file, and run the director if it is found:
condition = ${if lookup{\
${if match{$local_part}{^(.*)-request}{$1}{$local_part}}\
}lsearch{/some/file}{yes}}
The key that is looked up is the second line, which uses a regular expression to strip "-request" from the local part if it is present.
Q0419: Why will Exim deliver a message locally to any username that is longer than 8 characters as long as the first 8 characters match one of the local usernames?A0419: The problem is in your operating system. Exim just calls the getpwnam() function to test a local part for being a local login name. It does not presume to guess the maximum length of user name for the underlying operating system. Many operating systems correctly reject names that are longer than the maximum length; yours is apparently deficient in this regard. To cope with such systems, Exim has an option called max_user_name_length which you can set to the maximum allowed length.
Q0420: Why am I seeing the error "bad mode (100664) for /home/test/.forward (userforward director)"? I've looked through the documentation but can't see anything to suggest that exim has to do anything other than read the .forward file.A0420: For security, Exim checks for mode bits that shouldn't be set, by default 022. You can change this by setting the "modemask" option of the forwardfile director.
Q0421: How can I arrange that messages larger than some limit are handled by a special director?A0421: See A0311.
Q0422: When a user's .forward file is syntactially invalid, Exim defers delivery of all messages to that user, which sometimes include the user's own test messages. Can it be told to ignore the .forward file and/or inform the user of the error?A0422: Setting skip_syntax_errors on the forwardfile director causes syntax errors to be skipped. When dealing with users' .forward files it is best to combine this with a setting of syntax_errors_to in order to send a message about the error to the user. However, to avoid an infinite cascade of messages, you have to be able to send to an address that bypasses .forward file processing. This can be done by including a director like this one
real_localuser:
driver = localuser
transport = local_delivery
prefix = real-
before the forwardfile director. This will do an ordinary local delivery without .forward processing, if the local part is prefixed by "real-". You can then set something like the following options on the forwardfile director:
skip_syntax_errors
syntax_errors_to = real-$local_part@$domain
syntax_errors_text = "\
This is an automatically generated message. An error has been \
found\nin your .forward file. Details of the error are reported \
below. While\nthis error persists, messages addressed to you will \
get delivered into\nyour normal mailbox and you will receive a \
copy of this message for\neach one."
A final tidying setting to go with this is a rewriting rule that changes "real-username" into just "username" in the headers of the message:
^real-([^@]+)@your\.dom\.ain$ $1@your.dom.ain h
This means that users won't ever see the "real-" prefix, unless they look at the Envelope-To header.
Q0423: I have some users on my system with upper case letters in their login names, but these are not recognized.A0423: See A0424.
Q0424: I have unset locally_caseless because my users have upper case letters in their login names, but incoming mail now has to use the correct case. Can I relax this somehow?A0424: If you really have to live with caseful user names but want incoming local parts to be caseless, then you have to maintain a file, indexed by the lower case forms, that gives the correct case for each login, like this:
admin: Admin
steven: Steven
mcdonald: McDonald
lamanch: LaManche
...
and at the start of your directors, put one like this:
set_case_director:
driver = smartuser
new_address = ${lookup{${lc:$local_part}}lsearch{/the/file}\
{$value@$domain}fail}
For efficiency, you should also set the new_director option to cause processing of the changed address to begin at the next director. If you are otherwise using the default configuration, then the setting would be
new_director = system_aliases
If there are lots of users, then a DBM or cdb file would be more efficient than lsearch. If you are handling several domains, then you will have to extend this configuration to cope appropriately.
Q0425: I want to look up local users in an SQL database instead of looking in the passwd file.A0425: From release 3.03, Exim contains support for calling MySQL, and from release 3.14 there is support for PostgreSQL.
You must consider what will happen if your database is down. All local mail delivery will be delayed until it comes up again. Whether this matters is of course something for you to decide. If the database is down a lot and it does matter, then consider some scheme of extracting a list of users from the database at regular intervals, and getting Exim to work off that. This is also likely to be more efficient.
Q0426: Is it possible for Exim to use a SQL database like MySQL for its lists of virtual domains and explicit aliases?A0426: See A0425.
Q0427: Can I use my existing alias files and forward files as well as procmail and effectively drop in exim in place of Sendmail ?A0427: Yes, as long as your alias/forward files don't assume that pipes are going to run under a shell. If they do, you either have to change them, or configure Exim to use a shell (which it doesn't by default).
Q0428: How can I route mail for user X@local to a smarthost if X doesn't exist on the local host?A0428: This is the same question as Q0402. The duplication is a bug in the FAQ.
Q0429: What is quickest way to set up Exim so any message sent to a non- existing user would bounce back with a different message, based on the name of non-existing user?A0429: See the example in the section of the manual entitled "System-wide automatic processing".
Q0430: I am building some largish mailing lists with Majordomo, and was wondering if it worth leaving the actually list expansion to the aliasfile :include: mechanism or should I consider using the forwardfile transport? Is there any real difference in terms of facilities and/or performance, and are the expansions basically the same code anyway?A0430: The code that pulls out individual addresses from a list is the same in both cases, so it's really just a matter of which is the most convenient for you.
Q0431: What do I need to do to make Exim handle /usr/ucb/vacation processing automatically, so that people could just create a .vacation.msg file in their home directory and not have to edit their .forward file?A0431: Add a new director like this, immediately before the normal localuser director:
vacation:
driver = localuser
require_files = .vacation.msg
transport = vacation_transport
unseen
and a matching new transport like this:
vacation_transport:
driver = pipe
command = "/usr/ucb/vacation \"$local_part\""
However, some versions of /usr/ucb/vacation do not work properly unless the DBM file(s) it uses are created in advance - it won't create them itself. You also need a way of removing them when the vacation is over.
Another possibility is to use a fixed filter file which is run whenever .vacation.msg exists, for example:
vacation:
driver = forwardfile
check_localuser
require_files = $home/.vacation.msg
file = /some/central/filter
filter
The filter file should use the "if personal" check before sending mail, to avoid generating automatic responses to mailing lists. If sending a message is all that it does, this doesn't count as a "significant" delivery, so the message goes on to be delivered as normal.
Yet another possibility is to make use of Exim's autoreply transport. See C033.
Q0432: I want to use a default entry in my alias file, but it picks up the local parts that the aliases generate. For example, if the alias file is
luke.skywalker: luke
ls: luke
*: postmaster
then messages addressed to luke.skywalker end up at postmaster.
A0432: (A) If you know for certain that no alias in your alias file ever generates another alias that is in the same file, then the most efficient solution is to put
new_director = name-of-following-director
in your aliasfile director. This stops Exim from processing the generated names as aliases the second time.
(B) If you can't give that guarantee, then you have to put dummy entries in the alias file for all your local parts, for example:
luke: luke
(C) Another possibility is to put the aliasfile director for these aliases after the localuser director, so that local parts get picked off first. You will need to have two aliasfile directors if there are some local parts (e.g. root) which you do want to handle as aliases rather than local users.
Q0433: I have some obsolete domains which people have been warned not to use any more. How can I arrange to delete any mail that is sent to them?A0433: If you are using release 3.10 or later, you can use a smartuser director like this:
obsolete:
domains = lsearch;/etc/exim/obsolete.domains
new_address = :blackhole:
If you want to make any exceptions, for example, for mail to postmaster at those domains, you can add the line
local_parts = !postmaster
If you are using an earlier release of Exim, you have to set up an alias file in order to use :blackhole:
obsolete:
domains = lsearch;/etc/exim/obsolete.domains
file = /blackhole/all
search_type = lsearch*
with the file containing
*: :blackhole:
and possibly a postmaster alias if you want.
Q0434: How can I arrange that mail addressed to anything@something.mydomain.com gets delivered to something@mydomain.com?A0434: Ensure that all the relevant domains are local, by setting
local_domains = mydomain.com : *.mydomain.com
Then set up a smartuser director like this:
user_from_domain:
driver = smartuser
new_address = ${if match{$domain}{^(.+)\\.mydomain.com\$}\
{$1@mydomain.com}fail}
Q0435: I can't get a regular expression to work in this local_parts option on
one of my directors:
local_parts = ^0740\d{6}
A0435: The local_parts option is expanded before use, so that you can, for example, make it dependent on the domain. Therefore, you need to write
local_parts = ^0740\\d{6}
so as to preserve the backslash.
Q0436: How can I arrange for all addresses in a group of domains *.example.com to share the same alias file? I have a number of such groups.A0436: For a single group you could just hardwire the file name into a director that had
domains = *.example.com
set, to restrict it to the relevant domains. For a number of such groups you can create a file containing the domains, like this:
*.example1.com example1.com
*.example2.com example2.com
...
Arrange that the domains are treated as local by setting
local_domains = partial-lsearch;/that/file
Then create a director like this
domain_aliases:
driver = aliasfile
domains = partial-lsearch;/that/file
file = /etc/aliases.d/$domain_data
search_type = lsearch*
The variable $domain_data contains the data that was looked up when the domains option was matched, i.e. "example1.com", "example2.com", etc. in this case.
Q0437: When Exim tries to read /usr/lib/majordomo/lists/lists.aliases it is giving "Permission denied", but that file is world-readable!A0437: Check the permissions on the superior directories.
Q0438: Some of our users have no home directories; the field in the password file contains /no/home/dir. This causes the error "failed to stat /no/home/dir (No such file or directory)" when Exim tries to look for a .forward file, and the delivery is deferred.A0438: With the default configuration, you are asking Exim to check for a .forward file in the user's home directory. It looks up the home directory and tries to stat() it before looking for .forward. This is so that it can will notice a missing NFS home directory, and not treat it as if the .forward file did not exist. This stat() is failing when the home directory doesn't exist. What you should do is pick off these special cases before looking for .forward files for normal users. Place the following director before the userforward director:
no_home_directory_users:
driver = localuser
transport = local_delivery
match_directory = /no/home/dir
current_directory = /
Q0439: How can I disable Exim's de-duplication features? I want it to do two
deliveries if two different aliases expand to the same address.
A0439: This is not possible. Duplication has other ramifications other than just (in)convenience. Consider:
. Message is addressed to A and to B.
. Both A and B are aliased to C.
. Without de-duplication, two deliveries to C are scheduled.
. One delivery happens, Exim records that it has delivered the message to C.
. The next delivery fails (C's mailbox is over quota, say).
Next time round, Exim wants to know if it has already delivered to C or not, before scheduling a new delivery. Has it? Obviously, if duplicate deliveries are supported, it has to remember not only that it has delivered to C but also the "history" of how that delivery happened - in effect an ancestry list back to the original envelope address. This it does not do, and changing it to work in that way would be a lot of work and a big upheaval.
The best way to get duplicate deliveries if you want them is not to use aliasfile, but to use smartuser with a transport, e.g.
alias_with_duplicates:
driver = smartuser
transport = local_delivery_for_duplicates
new_address = ${lookup {$local_part} lsearch ..... etc
This goes straight to the transport without generating a new address that is considered for de-duplication or re-aliasing. In effect, it is just re-writing the address on the way to the transport. You will need to specify the user under which to run the delivery, either on the transport or on the director.
Q0440: I set up an aliasfile director using MySQL, but it doesn't use the new addresses. This it my director:
mysql_system_aliases:
driver = aliasfile
search_type = mysql
query = "select userid from domain_table where \
aliasid='$local_part' and domain='$domain'"
transport = local_delivery
A0440: The setting of "transport" is your problem. Aliasfile operates entirely differently if you give it a transport. It just verifies the incoming address by doing the query, then sends it to the transport. Take away the transport setting, and it will do normal aliasing, that is, turn one address into another which is independently processed.
Q0441: I received a message with a Subject: line that contained a non-printing character (a carriage return). This messed up my filter file. Is there a way to get round it?A0441: Instead of $h_subject: use ${escape:$h_subject:}
Q0442: My users' mailboxes are distributed between several servers according to the first letter of the user name. All the servers receive incoming mail at random. I would like to have the same configuration file for all the servers, which does local delivery for the mailboxes it holds, and sends other addresses to the correct other server. Is this possible?A0442: It is easiest if you arrange for all the users to have password entries on all the servers. This means that non-existent users can be detected at the first server they reach. Set up a file containing a mapping from the first letter of the user names to the servers where their mailboxes are held. For example:
a: server1
b: server1
c: server2
...
Replace the normal localuser director with these two directors:
localuser:
driver = localuser
transport = local_delivery
condition = ${if eq{$primary_hostname}\
{${lookup {${substr_0_1:$local_part}}\
lsearch{/etc/mapfile} {$value}}}{yes}{no}}
check_remote:
driver = localuser
transport = send_to_correct_host
The first director succeeds only if the local part is a local user whose mailbox is listed as being on the current host. The second server runs for all other local users, directing the addresses to this transport:
send_to_correct_host:
driver = smtp
hosts = ${lookup {${substr_0_1:$local_part}}lsearch{/etc/mapfile}\
{$value}}
Local parts that are not the names of local users are declined by both directors, and so they fail.
Q0443: I want to search for '$' in the subject line, but I can't seem to get the syntax. The obvious choice, '\$' doesn't work. Any help?A0443: Try one of these:
if $h_subject: contains \$ then ...
if $h_subject: contains "\\$" then ...
Q0444: One of the things I want to set up is for anything@onedomain to forward
to anything@anotherdomain. I tried adding $local_part@anotherdomain to
my aliases but it did not expand - it sent it to that literal address.
A0444: If you want to do it that way, you can make it expand by setting the "expand" option on the aliasfile director. Another approach is to use a smartuser director like this:
forwarddomain:
driver = smartuser
domains = onedomain
new_address = $local_part@anotherdomain
new_address can, of course, be more complicated, involving lookups etc. if you have lots of different cases.
Q0445: How can I have an address looked up in two different alias files, and delivered to all the addresses that are found?A0445: It is tempting to use the "unseen" option for this (see Q0504 for an example of the use of "unseen"). You would have two directors, the first of which has "unseen" set, so that the address is always passed on to the next director, even if the first one accepts it.
However, there is a problem with this approach. If an address is found in the first director (with unseen set) but not in the second one, it will get delivered but will also (under most normal setups) generate an "unknown user" bounce as well.
If you want an incoming address to be "properly" delivered to two different "child" addresses (or lists), "unseen" is not really the right way to do it. You don't really need two different directors. You can use a smartuser director with an option something like this:
new_address = ${lookup{$local_part}lsearch{/etc/aliases1}\
{$value${lookup{$local_part}lsearch{/etc/aliases2}{,$value}}}\
{${lookup{$local_part}lsearch{/etc/aliases2}{$value}fail}}}\
If the first lookup succeeds, the result is its data, followed by the data from the second lookup, if any, separated by a comma. If the first lookup fails, the result is the data from the third lookup (which also looks in the second file), but if this also fails, the entire expansion is forced to fail, thereby causing the director to decline.
Q0446: I've converted from Sendmail, and I notice that Exim doesn't make use of the "owner-" entries in my alias file to change the sender address in outgoing messages to a mailing list.A0446: If you have an alias file with entries like this:
somelist: a@b, c@d, ...
owner-somelist: postmaster
Sendmail assumes that the second entry specifies a new sender address for the first. Exim does not make this assumption. However, you can make it take the same action, by adding
errors_to = owner-$local_part@whatever.domain
to the configuration for your aliasfile director. This is fail-safe, because Exim verifies a new sender address before using it. Thus, the change of sender address occurs only when the owner entry exists.
A0501: Whenever Exim does a local delivery, it runs a process under a specific user and group id (uid and gid). For deliveries into mailboxes, and to pipes and files set up by .forwarding, it normally picks up the uid/gid of the receiving user. However, if an address is directed to a pipe or a file by some other means, such an entry in the system alias file of the form
majordomo: |/local/mail/majordomo ...
then Exim has to be told what uid/gid to use for the delivery. This can be done either on the director that handled the address, or on the transport that actually does the delivery. If a pipe is going to run a setuid program, then it doesn't matter what uid Exim starts it out with, and so the most straightforward thing is to put
user = exim
on either the director or the transport. A setting on the transport overrides a setting on the director, so if the same transport is being used with several directors, you should set the user on it only if you want the same uid to be used in all cases.
In the default configuration, the transports used for file and pipe deliveries are the ones called address_file and address_pipe. You can specify different transports by setting, for example,
pipe_transport = special_pipe_transport
on the aliasfile director. Then you can set up special_pipe_transport
special_pipe_transport:
driver = pipe
user = ????
which will be used only for pipe deliveries from that one director. What you put for the ???? is up to you, and depends on the particular circumstances.
Q0502: Exim won't deliver to a host with no MX record.A0502: (A) Are you sure there really is no MX record? Sometimes a typo results in a malformed MX record in the zone file, in which case some nameservers give a SERVFAIL error rather than NXDOMAIN. Exim has to treat this as a temporary error, so it can't go on to look for an A record. You can check for this state using one of the DNS interrogation commands, such as "nslookup", "host", or "dig".
(B) Is there a wildcard MX record for your domain? Is the search_parents option on in your lookuphost router? (Prior to Exim version 1.80 this was the default; it was changed because of this problem.) If the answer to both these questions is "yes", then that is the cause of the problem. When the DNS resolver fails to find the MX record, it tries adding on your domain if search_parents is true, and thereby finds your wildcard MX record. For example:
. There is a wildcard MX record for *.a.b.c.
. There is a host called x.y.z that has an A record and no MX record.
. Somebody on a machine m.a.b.c domain tries to mail to user@x.y.z.
. Exim calls the DNS to look for an MX record for x.y.z.
. The DNS doesn't find any MX record. Because search_parents is true, it then tries searching the current host's parent domain, so it looks for x.y.z.a.b.c and picks up the wildcard MX record.
Setting search_parents false makes this case work while retaining the wildcard MX record. However, anybody on the machine m.a.b.c who mails to user@n.a (expecting it to go to user@n.a.b.c) now has a problem. The widen_domains option of the lookuphost router may be helpful in this circumstance.
Q0503: How should Exim be configured when it is acting as a temporary storage system for a domain on a dial-up host?A0503: See Q1403, Q0521, and Q5014.
Q0504: I would like to deliver mail addressed to a given domain normally, but also to generate a message to the envelope sender.A0504: If the domain is a local one, you can do this with an "unseen" smartuser director and an autoreply transport, along the following lines:
# Transport
warning_t:
driver = autoreply
file = /usr/local/mail/warning.txt
file_expand
from = postmaster@your.domain
to = $sender_address
user = exim
subject = Re: Your mail to $local_part@$domain
# Director
auto_warning_d:
driver = smartuser
domains = <domains you want to do this for>
condition = ${if eq{$sender_address}{}{no}{yes}}
transport = warning_t
no_verify
unseen
Note the use of the condition option to avoid attempting to send a message when there is no sender (that is, when the incoming message is a delivery error report). You can of course extend this to include other conditions. If you want to log the sending of messages, you can add
log = /some/file
to the transport and also make use of the "once" option if you want to send only one message to each sender.
Q0505: Exim keeps crashing with segmentation errors (signal 11 or 139) during delivery. This seems to happen when it is about to contact a remote host or when a delivery is deferred.A0505: This could be a problem with Exim's databases. Check that your DBM library is correctly installed. In particular, if you have installed a second DBM library onto a system that already had one, check that its version of ndbm.h is being seen first. For example, if the new version is in /usr/local/include, check that there isn't another version in /usr/include. If you are using Berkeley db, you can set USE_DB=yes in your Local/Makefile to avoid using ndbm.h altogether. This is particularly relevant for version 2 of Berkeley db, because no ndbm.h file is distributed with it.
Q0506: Whenever Exim tries to do a local delivery, it gives a permission denied error for the .forward file, like this:
1998-08-10 16:55:32 0z5y2W-0000B8-00 == xxxx@yyy.zzz <xxxx@yyy.zz>
D=userforward defer (-1): failed to open /home/xxxx/.forward
(userforward director): Permission denied (euid=1234 egid=101)
A0506: Have you remembered to make Exim setuid root?
Q0507: I have installed Exim, but now I can't mail to root any more. Why is this?A0507: Most people set up root as an alias for the manager of the machine. If you haven't done this, Exim will attempt to deliver to root as if it were a normal user. This isn't really a good idea because the delivery process would run as root. Exim has a trigger guard in the option
never_users = root
in the default configuration file. This prevents it from running as root when doing any local deliveries. If you really want to run local deliveries as root, remove this line, but it would be better to create an alias for root instead.
Q0508: How can I stop undeliverable bounce messages (e.g. to routeable, but undeliverable, spammer senders) from clogging up the queue for days?A0508: Set ignore_errmsg_errors to drop them immediately, or set ignore_errmsg_ errors_after to specify a (short) time to keep them for. I use 12h so that I notice them, but they go away relatively quickly.
Q0509: How can mails that are being routed through directors other than localuser be delivered under the uid of the recipient?A0509: A0501 contains background information on this. If you are using, say, an alias file to direct messages to specific mailboxes, then you can use the "user" option on either the aliasfile director or the appendfile transport to set the uid. What you put in the setting depends on how the required uid is to be found. It could be looked up in a file or computed somehow from the local part, for example.
Q0510: I want to use MMDF-style mailboxes. How can I get Exim to append the ctrl-A characters that separate indvidual emails?A0510: Set the suffix option in the appendfile transport. In fact, for MMDF mailboxes you need a prefix as well as a suffix to get it working right, so your transport should contain these settings:
prefix = "\1\1\1\1\n"
suffix = "\1\1\1\1\n"
Also, you need to change the check_string and escape_string settings so that the escaping happens for lines in the message that happen to begin with the MMDF prefix or suffix string, rather than "From" (the default):
check_string = "\1\1\1\1\n"
escape_string = "\1\1\1\1 \n"
Adding a space to the line is sufficient to prevent it being taken as a separator.
Q0511: I have an ISDN connection and would like a way of running the queue automatically when it is up.A0511: The following shell commands test for the interface being up and then run the queue:
ifconfig ppp0 | fgrep UP >/dev/null
if [ $? -eq 0 ] ; then exim -q ; fi
You could put these commands into a script which runs them at regular intervals. You might want to use -qq instead of -q.
With Linux, the script /etc/ppp/ip-up is run after a ISDN connection or a more general PPP connection has been established. If you are using Linux, you could put the call to exim in that script.
Q0512: If a user's mailbox is over quota, is there a way for me to set it up so that the mail bounces to the sender and is NOT stored in the mail queue?A0512: In the retry section of the configuration, put
*@your.dom.ain quota
That is, provide no retry timings for over quota errors. They will then bounce immediately. Alternatively, you can set up retries for a short time only, or use something like this:
*@your.dom.ain quota_7d
*@your.dom.ain quota F,2h,15m; F,3d,1h
which bounces immediately if the user's mailbox hasn't been read for 7 days, but otherwise tries for up to 3 days after the first quota failure.
Q0513: I'm using tmail to do local deliveries, but when I turned on the use_crlf option on the pipe transport (tmail prefers \r\n terminations) message bodies started to vanish.A0513: You need to unset the prefix option, or change it so that its default \n terminator becomes \r\n. For example, the transport could be:
local_delivery_mbx:
driver = pipe
command = /usr/local/bin/tmail $local_part
user = exim
current_directory = /
use_crlf
prefix =
The reason for this is as follows: tmail uses the line terminator on the first line it sees to determine whether lines are terminated by \r\n or \n. If the latter, it moans to stderr and changes subsequent \n terminators to \r\n. The default setting of the prefix option is "From ...\n", and this is unaffected by the use_crlf option. If you don't change this, tmail sees the first line terminated by \n and prepends \r to the \n terminator on all subsequent lines. However, if use_crlf is set, Exim makes all other lines \r\n terminated leading to doubled \r\r\n lines and corrupt mbx mailboxes.
Q0514: What does the message "Unable to get root to set uid and gid for local delivery to xxx: uid=yyy euid=zzz" mean?A0514: Have you remembered to make Exim setuid root? It needs root privilege if it is to do any local deliveries, because it does them "as the user".
Q0515: I upgraded to 2.04 and now my Envelope-To: header for my virtual domains is gone. Any idea how to get it back?A0515: Read paragraph 1 of the 1.92 information in README.UPDATING. Add envelope_to_add to your transports for your virtual domains. You may also want to set return_path_add and delivery_date_add.
Q0516: The Exim log records the arrival of a message, and then "Completed", without logging any deliveries. What's going on?A0516: This is unlikely in current versions of Exim, because more logging has been added. In versions before 2.053, one scenario is that the message was addressed to some user who has set up an Exim filter containing the command "seen finish", which discards a message without doing any deliveries. (In current versions of Exim this is logged as "discarded".) More information can be obtained by setting
log_received_recipients
so that next time you can see to whom it is addressed. Another possibility, prior to version 2.053, was that the message was injected using the -t option, but all the addresses in the message were also on the command line. See A5020 for more detail. Current versions of Exim generate a bounce message in this case.
Q0517: When I activate "return receipt" for example in Netscape Mailbox sending options, then I get an error message from Exim... something like "not supported". Can I activate delivery confirmations?A0517: Exim does not support any kind of delivery notification.
(A) You can configure it to recognize headers such as "Return-receipt-to:" if you wish.
(B) Some people want MSN (message status notification). Such services are implemented in MUAs, and don't impact on the MTA at all.
(C) I investigated the RFCs which describe the DSN (delivery status notification) system, and there is even a bit of code in there (excluded by #ifdef) for handling some of the data. However, I was unable to specify any sensible way of actually doing anything with the data. There were comments on the mailing list at the time; many people, including me, conclude that DSN is in practice unworkable. The killer problem is with forwarding and aliasing. Do you propagate the DSN data with the generated addresses? Do you send back a "reached end of the DSN world" or "expanded" message? Do you do this differently for different kinds of aliasing/forwarding? For a user who has a .forward file with a single address in, this might seem easy - just propagate the data. But what if there are several forwardings? If you propagate the DSN data, the sender may get back several DSN messages - and should the sender really know about the detail of the receiver's forwarding arrangements? There isn't really any way to distinguish between a .forward file that is forwarding and one that is a mini mailing list. And so on, and so on. There are so many questions that don't have obvious answers.
Q0518: When I dial up to collect mail from my ISP, only the first 10 messages get delivered immediately; the remainder just sit on the queue until a queue runner process finds them.A0518: Your ISP is delivering all the messages in a single SMTP session. Exim limits the number of immediate delivery processes it will create as a result of a single SMTP connection, in order to avoid creating a zillion processes on systems that can have many incoming connections. In your situation, you should probably set smtp_accept_queue_per_connection to some number larger than 10.
Q0519: My ISP's mail server is rejecting bounce messages from Exim, complaining that they have no sender. The SMTP trace does indeed show that the sender address is "<>". Why is the Sender on the bounce message empty?A0519: Because the RFCs say it must be. Your ISP is at fault. Send them this extract from RFC 1123 section 5.3.3 ("Reliable Mail Receipt"):
If there is a delivery failure after acceptance of a message, the receiver-SMTP MUST formulate and mail a notification message. This notification MUST be sent using a null ("<>") reverse path in the envelope; see Section 3.6 of RFC-821. The recipient of this notification SHOULD be the address from the envelope return path (or the Return-Path: line). However, if this address is null ("<>"), the receiver-SMTP MUST NOT send a notification. If the address is an explicit source route, it SHOULD be stripped down to its final hop.
Q0520: What does the message "retry time not reached [for any host]" on the log mean? Why won't Exim try to deliver the message?A0520: That is not an error. It means exactly what it says. A previous attempt to deliver to that address failed with a temporary error, and Exim computed the earliest time at which to try again. This can apply to local as well as to remote deliveries. For remote deliveries, each host (if there are several) has its own retry time.
If you are running on a dial-up host, the rest of this answer probably does not apply to you. Go and read Q1404 instead. If your host is permanently online, read on...
Some MTAs have a retrying schedule for each message. Exim does not work like this. Retry timing is normally host-based for remote domains and address-based for local domains. (There are some exceptions for certain kinds of remote failure - see "Errors in outgoing SMTP" in the manual.)
If a new message arrives for a failing address and the retry time has not yet arrived, Exim will log "retry time not reached" and leave the message on the queue, without attempting delivery. Similarly, if a queue runner notices the message before the time to retry has arrived, it writes the same log entry. When the retry time has past, Exim attempts delivery at the next queue run. If you want to know when that will be, run the exinext utility on the address, for example:
exinext user@some.domain
You can suppress these messages on the log by setting log_level to a value that is less than 5. You can force a delivery attempt on a specific message (overriding the retry time) by means of the -M option:
exim -M 10hCET-0000Bf-00
If you want to do this for the entire queue, use the -qf option. See also Q0533.
Q0521: RFC 1985 specifies that the SMTP command "ETRN host.domain" causes all mail queued for that host, no matter what domain it's for, to be dequeued. Why doesn't Exim support this?A0521: Exim does not keep queues of mail for specific destinations. It just keeps one pool of undelivered messages. What is more, once you start a delivery of a message, it tries to deliver to all the addresses in the message, not just the one you may be interested in. (Of course, this doesn't usually do any harm.)
The only way it could be done within Exim would be, for every message on the queue, to go through the motions of routing each undelivered address and see if that resulted in a delivery to the host of interest. This could be extremely expensive (e.g. 1,000 messages on the queue, only 1 for the given host).
The bottom line is that Exim just wasn't designed for this kind of operation, that is, holding messages for intermittently connected hosts. The queueing arrangements are designed for handling delivery problems that are not expected to be common.
A better way to do this is to implement the required queues separately. After all, keeping such mail on an "active" queue (where Exim will keep trying to deliver) is silly. If there is a lot of mail for these hosts, it also masks genuine delivery problems when you inspect the queue.
Large ISPs who provide this kind of functionality do not usually leave waiting mail on the MTA's queue. Instead, they get it delivered into per-host directories, one message per file, in one of the special formats (BSMTP, maildir, or mailstore) and when an ETRN arrives, it kicks off some completely different program that establishes an SMTP connection to the host and shovels the waiting mail down it. That seems to me to be a much neater way of doing this. It means you can easily add additional functionality such as archiving or throwing away uncollected mail.
One program that has this functionality is "ssmtp", which can be found in ftp://metalab.unc.edu/pub/Linux/system/mail/mta/. Alternatively, sample configuration C037 demonstrates an elegant way of using Exim itself to deliver the saved messages when the client issues an ETRN.
Q0522: If email has been deferred to a member on a local mailing list (implemented through forward files), and one of our ETRN clients is on this mailing list, the -R won't "flush" the mailing list message for that client.A0522: That is because -R matches only original recipient addresses, not those produced as a result of expansion, because these are not (by default) preserved from delivery to delivery. You can get round this by setting one_time on the forwardfile director, but you are not allowed to have expansions to pipes or files on directors that have one_time set. Therefore, you will have to have a separate director for mailing lists (with one_time set) to the one used for normal forward files that might specify pipe or file deliveries. However, the problem will then still be present for any user who sets up a .forward file to redirect to any of the ETRN domains. See the last 3 paragraphs of A0521 for a discussion of an alternative approach.
Q0523: Exim seems to be sending the same message twice, according to the log, although there is a difference in capitalization of the local part of the address.A0523: That is correct. The RFCs are explicit in stating that capitalization matters for local parts. For remote domains, Exim is not entitled to assume case independence of local parts. I know, it is utterly silly, and it causes a lot of grief, but that's what the rules say. Here is a quote from the draft of the forthcoming revision to RFC 821:
... a command verb, an argument value other than a mailbox local-part, and free form text MAY be encoded in upper case, lower case, or any mixture of upper and lower case with no impact on its meaning. This is NOT true of a mailbox local-part. The local-part of a mailbox MUST BE treated as case sensitive. Therefore, SMTP implementations MUST take care to preserve the case of mailbox local-parts. Mailbox domains are not case sensitive. However, exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged.
Q0524: How can I force the next retry time for a host to be now?A0524: (A) You can force a particular message to be delivered with the -M command line option. If it succeeds, the retry data will get cleared. If the host is past the cutoff time, so that messages are bouncing immediately without trying a delivery, you can use -odq to put a message on the queue without a delivery attempt, and then use -M on it.
(B) You can change the retry time with the exim_fixdb utility, but its interface is very clumsy.
Q0525: I set up "|/bin/grep Subject|/usr/bin/smbclient -M <netbiosname>" as an alias but it doesn't work.A0525: That is a shell command line. Exim does not run pipe commands under a shell by default (for added security - and it saves a process). You need something like
"|/bin/sh -c '/bin/grep Subject|/usr/bin/smbclient -M <netbiosname>'"
Q0526: Why does the pipe transport add a line starting with ">From" to
messages?
A0526: Actually, it adds a line starting with "From", because that is the default of the "prefix" option (/usr/ucb/vacation needs it, and that is the most common use of piping). If you don't want it, change the setting of "prefix".
Q0527: I have set fallback_hosts on my smtp transport, but after the error "sem@chat.ru cannot be resolved at this time" Exim isn't using them.A0527: fallback_hosts only works if an attempt at delivery to the original host(s) fails. In this case, Exim couldn't even resolve the domain chat.ru to discover what the original hosts were, so it never got as far as the transport. However, see Q0322 for a possible solution.
Q0528: After the holidays my ISP has always hundreds of e-mails waiting for me. These are forced down Exim's throat in one go. Exim spawns a lot of kids, but is there some limit to the number of processes it creates?A0528: Unless you have changed smtp_accept_queue_per_connection (introduced at release 2.03) it should only spawn that many processes per connection (default 10). Your ISP may be making many connections, of course. That is limited by smtp_accept_max.
Q0529: When a message in the queue got to 12h old, Exim wrote 'retry timeout exceeded' and removed all messages in the queue to this host - even recent messages. How I can avoid this behaviour? I only want to remove messages that have exceeded the maximum retry time.A0529: Exim's retrying is host-based rather than message-based. The philosophy is that if a host has been down for a very long time, there is no point in keeping messages hanging around. However, you might like to check out delay_after_cutoff in the smtp transport. It doesn't do what you want, but it might help.
Q0530: Can Exim add a Content-Length: header to messages it delivers?A0530: You could include something like
headers_remove = "content-length"
headers_add = "Content-Length: $message_body_size"
to the appendfile transport. However, the use of Content-Length: can cause several problems, and is not recommended unless you really know what you are doing. There is a discussion of the problems in
http://home.netscape.com/eng/mozilla/2.0/relnotes/demo/content-length.html
Q0531: Exim seems to be trying to deliver a message every 10 minutes, though the retry rules specify longer times after a while, because it is writing a log entry every time, like this:
1999-08-26 14:51:19 11IVsE-000MuP-00 == example@example.com T=smtp defer
(-34): some host address lookups failed and retry time not reached for
other hosts or connection limit reached
A0531: It is looking at the message every 10 minutes, but it isn't actually trying to deliver. It's looking up example.com in the DNS and finding this information:
example.com. MX 10 example-com.isp.example.com.
example.com. MX 0 mail.example.com.
mail.example.com. A 202.77.183.45
A lookup for example-com.isp.example.com. yielded NXDOMAIN
The last line means that there is no address (A) record in the DNS for example-com.isp.example.com. That accounts for "some host address lookups failed", but the retry time for mail.example.com hasn't been reached, which accounts for "retry time not reached for other hosts".
Q0532: I am trying to set exim up to have a automatic failover if it sees that the system that it is sending all mail to is down.A0532: Add to the remote_smtp transport the following:
fallback_hosts = failover.server.name(s)
If there are several names, they must be separated by colons.
Q0533: I can't get Exim to deliver over NFS. I get the error "fcntl() failed: No locks available", though the lock daemon is running on the NFS server and other hosts are able to access it.A0533: Check that you have lockd running on the NFS client. This is not always running by default on some systems (Red Hat is believed to be one such system).
Q0534: Why does Exim bounce messages without even attempting delivery, giving the error "retry time not reached for any host after a long failure period"?A0534: This message means that all hosts to which the message could be sent have been failing for so long that the end of the retry period (typically 4 or 5 days) has been reached. In this situation, Exim still computes a next time to retry, but any messages that arrive in the meantime are bounced straight away. You can alter this behaviour by unsetting the delay_after_cutoff option on the smtp transport. Then Exim will try most messages for those hosts once before giving up.
Q0535: My .forward file is "|/usr/bin/procmail -f-" and mail gets delivered, but there was a bounce to the sender, sending him the output of procmail. How can I prevent this?A0535: Exim's default configuration is set up like this:
address_pipe:
driver = pipe
return_output
The return_output option requests that any output that the pipe produces be returned to the sender. That is the safest default. If you don't want this, you can either remove the option altogether, or change it to return_fail_output, to return output only if the command fails. Note that this will affect all pipes that users run, not just your procmail one. It might be better to arrange for procmail not to produce any output when it succeeds.
Q0536: Can I write an ordinary file when I running a perl script as a transport filter for remote_smtp and address_pipe transports?A0536: Yes, provided the file is writeable by the Exim user. However, if two messages are being delivered at once, their data will get mixed up in the file unless you implement your own locking scheme. If all you want to do is to take a copy of the message, another approach that avoids the locking problem is to use a system filter to set up an "unseen" delivery to a file. If you only want the message's headers, you can set message_filter_file_transport to point to a special appendfile transport that has headers_only set.
Q0537: I have some mails on my queues that are sticking around longer than the retry time indicates they should. They are all getting frozen because some remote admin has set their MX record to 127.0.0.1.A0537: The admin in question is an idiot. Exim will always freeze such messages because they are apparently routed to the local host. There are two router options that can help you deal with them.
(1) Set
self = fail
on the router which handles the domain - in a simple configuration this will be the lookuphost router. This will cause the relevant addresses to bounce, instead of freezing the message.
(2) If you are running Exim 3.20 or later, you can set
ignore_target_hosts = 127.0.0.1
on the router instead. This causes Exim to completely ignore any hosts with that IP address.
Q0538: My /var/spool/mail has grown drastically. Is there any possibility of using two files in exim.cfg ?A0538: You can use an expansion string to split mailboxes between two directories. For example,
file = /var/spool/mail${nhash_2:$local_part}/$local_part
which does a hash on the local part, producing either 0 or 1, thereby using mail0 or mail1. But remember, the MUAs that read these mailboxes also have to know where they are.
Q0539: Sendmail has a program called smrsh that restricts what binaries can be run from sendmail aliases. Is there someting like this in Exim ?A0539: Check out the allow_commands option in the pipe transport.
Q0540: I wish to have large emails go out one at a time.A0540: One possibility is to set up a router that defers all large messages, except in queue runs. Since queue runners deliver just one message at a time, if you limited the number of simultaneous queue runners to 1, you would get the effect you wanted. A suitable router might be
defer_if_large_unless_queue_run:
driver = domainlist
self = defer
condition = ${if or{{queue_running}{<{$message_size}{200K}}}{no}{yes}}
route_list = * 127.0.0.1 byname
Of course, this would always delay any large message until the next queue runner, but if you run them fairly regularly, this shouldn't be a huge problem. (May even be desirable!)
A0601: There are several possibilities. One straightforward way is to set up a domainlist router which matches the UUCP domains and routes to a suitable transport. Sample configuration C003 is such a configuration, while C004 shows another way to do it, by defining the domains as local and using a smartuser director.
If all the domains whose MX records point to the local host are either local domains or UUCP domains, you can do without the domainlist router altogether, by making use of the "self" option. This means that only the DNS has to be updated when a UUCP domain is added or removed.
For example, this router routes to remote hosts over SMTP using a DNS lookup with default options, and fails for unknown domains (because of the no_more setting), but if the MX for a domain points at the local host, Exim continues on to the next router (self = fail_soft overrides no_more).
lookuphost:
driver = lookuphost
transport = smtp
no_more
self = fail_soft
The next router can just send everything to a suitable UUCP transport:
uucp:
driver = domainlist
transport = uux_transport
route_list = "* $domain"
This assumes that the transport can determine the UUCP host name from the domain name.
Q0602: How can I get Exim to handle "bang path" addresses?A0602: In general, you can't (Exim is an Internet mailer and recognizes only RFC 822 addresses) but some restricted kinds of bang path can be dealt with by appropriate rewriting - but please note the warning below.
Exim treats a bang path address as an unqualified local part, and so will qualify it with your domain. A rule such as
^([^!]+)!(.+)@your\.domain$ $2@$1
turns a!b@your.domain into b@a. You can also use a repeating rule to turn multi-component paths into the "percent hack" notation with a rule such as
^([^!]+)!([^@%]+)(.+)$ $2%$1$3 R
which turns a!b@c into b%a@c and a!b!c@d first into b!c%a@d and then, because of the R flag, into c%b%a@d. The R flag causes repetition up to 10 times.
See also sample configuration C002, which contains some more sophisticated rewriting rules.
WARNING: If you install a general rewriting rule like the above, you are opening yourself up to the possibility of unwanted relaying. A host that is not permitted to relay through your system could send a message with an SMTP command line such as
RCPT TO:<victim-host!victim-user@your.domain>
and this would be accepted because it is addressed to your domain. However, the rewriting then converts the address, and the message does in fact get relayed. One way round this, if all your bang path messages are passed to Exim via SMTP, is to use the "S" rewriting flag. This applies a rewriting rule to incoming SMTP addresses as soon as they are received, before checking for qualification, relaying, etc. So a rule such as
^([^!]+)!(.+)$ $2@$1 S
rewrites simple two-component bang paths before the result is checked for relaying. However, this does not rewrite addresses in the headers of the message.
Q0603: We see something strange on our system in regards to mail comming in via rmail from a UUCP link. The sender is being set to mailmaster instead of the real sender, and a Sender: header is being added to the message.A0603: If mailmaster is the user that is running rmail, you need to include that user in the trusted_users configuration option. Only trusted users are permitted to specify senders when mail is passed to Exim via the command line.
A0701: There doesn't seem to be any significant performance hit using a flat queue on Solaris systems, so there is no need to do this for them. On the other hand, there is a known performance problem on Linux filing systems, where split_spool_directory can make a significant difference. ???? Other operating systems ????
Q0702: How well does Exim scale?A0702: Although the author did not specifically set out to write a high- performance MTA, Exim does seem to be fairly efficient. The biggest server at the University of Cambridge (a large Sun box) goes over 100,000 deliveries per day on busy days (it has over 20,000 users). There was a report of a mailing list exploder that sometimes handles over 100,000 deliveries a day on a big Linux box, the record being 177,000 deliveries (791MB in total). Up to 13,000 deliveries an hour have been reported.
These are quotes from some Exim users:
"... Canada's largest internet provider, uses Exim on all of our mail machines, and we're absolutely delighted with it. It brought life back into one of our machines plagued with backlogs and high load averages. Here's just an example of how much email our largest mail server (quad SS1000) is seeing ... " [230,911 deliveries in a day: 4,475MB]
"... Exim has to ... do gethostbyname()s and RBL lookups on all of the incoming mail servers, and he runs from inetd (TCP Wrappers connected). All the same, it seems to me that he runs as fast as lightning on our SCO 5.0.4 box (1 Pentium 166) - far faster than MMDF which I (and many customers) had before."
"On a PII 400 with 128M of RAM running Linux 2.2.5, I have achieved 36656 messages per hour (outgoing unique messages and recipients). For about a 5 minute period, I was able to achieve an average of 30 messages per second (that would be 108000 m/hour)! We are using: (options that make a difference):
queue_only
split_spool_directory
auto_thaw 60s
max_queue_run 1
remote_max_parallel 1
We have a cron job hat runs every five minutes that spawns 5 exim -q if there are less that 120 exim processes currently running. We found that by "manually" controlling the concurrency of exim -q processes contending for the spool for remote_smtp delivery that we gained considerable performance -- 10000 m/hour."
Q0703: We have a large password file. Can Exim use alternative lookups during delivery to speed things up?A0703: Yes. You don't have to use the password file at all. See sample configuration C009 for some suggestions. (It shows lsearch lookups, but these could equally be DBM or cdb or NIS or LDAP lookups.)
If you are using FreeBSD, this problem should not arise, because it automatically uses an indexed password file. In some other operating systems you can arrange for this to happen too. On Linux, for example, all you need to do is
# cd /var/db
# make
and put "db" before "files" in any /etc/nsswitch.conf lines you want to use db for.
Q0704: I just wondered if it might be helpful to put the hints database on a RAM disk during regular operation. Did anybody try that yet?A0704: A user reported thus: I have found that this works GREAT under Solaris. Make a RAM disk partition and keep everything in the "db" directory on it. However, when I try the same thing on Linux, I don't see the same boost. I think that Linux's file buffer cache works about the same. Plus, this leave more room for processes to run.
A0801: There are several different options that can be used to block incoming SMTP messages according to different criteria. The following are the most commonly used:
(A) Set sender_verify; this causes rejection of any message whose envelope sender cannot be successfully routed. This is mainly a check on the existence of remote domains, though it the domain is a local one, the local part also gets checked. Unfortunately, error mesages do not have envelope sender addresses, so cannot be checked in this way. See the headers_sender_verify options for ways of checking header addresses.
(B) If you want to block all mail from specific hosts or IP networks, set host_reject_recipients. The _recipients form of the option is more likely to prevent the remote hosts from keeping on trying. For example:
host_reject_recipients = 209.12.111.0/24
If you have many such blocks, they can be put in a file which is named in the option. If you have a mixture of IP addresses and names in your list, it is best to put the addresses first, because they can be checked without the need for a DNS lookup.
(C) If you want to block mail from specific envelope sender addresses, one convenient way is to organize a file of local parts indexed by domain names, for example
x.y.z creditrepair:^betterlovelife[0-9]+$:...
p.q.r *
This would block creditrepair@x.y.z, any local part starting with betterlovelife and ending with digits in the x.y.z domain, and all addresses in the p.q.r domain. You refer to the file in the Exim configuration as follows:
sender_reject_recipients = @@lsearch*;/name/of/the/file
If the file is big, you can convert it into a DBM or cdb file and use a faster lookup method. The asterisk on the end of the search type causes a lookup for "*" if the domain is not found; that is, it permits a default list of local parts that are blocked at any domain that is not specifically listed. If you use this, you probably also want to end each local part list with ">*" (except those that consist of "*"). This causes Exim to check the default list of local parts if none of the specific ones for a domain are matched. So, the file above could become
* yourfriend:a.friend:...
x.y.z creditrepair:^betterlovelife[0-9]+$:>*
p.q.r *
If you are using an lsearch file, putting the * entry first saves a bit of processing.
(D) If you want to allow mail to postmaster through the blocks, you can set
recipients_reject_except = postmaster@your.domain
This overrides any of the policy controls that cause rejection by recipient.
Q0802: I don't want to block spam entirely; how can I inspect each message before deciding whether to deliver it or not?A0802: This can be done by using a system filter. See the sample configuration F003.
Q0803: How can I test that my spam blocks are working?A0803: The -bh option allows you to run a testing SMTP session as if from a given IP address. For example,
exim -bh 192.203.178.39
In addition to the normal SMTP replies, it outputs commentary about which tests have succeeded or failed.
Q0804: How can I test that Exim is correctly configured to use the Realtime Blocking List (RBL)?A0804: The -bh option allows you to run a testing SMTP session as if from a given address. You need to know a blocked IP address with which to test. Such a testing address is kindly provided by Russell Nelson:
linux.crynwr.com [192.203.178.39]
You can also send mail to nelson@linux.crynwr.com from the server whose RBL block you are testing. The robot that receives that email will attempt to send a piece of test email in reply. If your RBL block didn't work, you get a message to that effect. Regardless of whether the RBL block succeeds or not it emails you the results of the SMTP conversation from a host that is not on the RBL, so you can see how your server looks from the view of someone on the RBL.
Q0805: How can I use tcpwrappers in conjunction with Exim?A0805: Exim's own control facilities can do all that tcpwrappers can do. However, if you are already using tcpwrappers for other things it might be convenient to include Exim controls in the same place.
First of all, ensure that Exim is built to call the tcpwrappers library, by including USE_TCPWRAPPERS=yes in Local/Makefile. You also need to ensure that the header file tcpd.h is available at compile time, and the libwrap.a library is available at link time, typically by including it in EXTRALIBS. You may need to copy these two files from the tcpwrappers build directory to, for example, /usr/local/include and /usr/local/lib, respectively. Then you could reference them by
CFLAGS=-I/usr/local/include
EXTRALIBS=-L/usr/local/lib -lwrap
in Local/Makefile. There are two ways to make use of the functionality, depending on how you have tcpwrappers set up. If you have it set up to use only one file, you ought to have something like:
/etc/hosts.allow:
exim : <client_list> : <allow_or_deny>
For example:
exim : LOCAL 192.168.0. .friendly.domain special.host : ALLOW
exim : ALL : DENY
This allows connections from local hosts (chiefly `localhost'), from the subnet 192.168.0.0/24, from all hosts in *.friendly.domain, and from a specific host called special.host. All other connections are denied. If you have tcpwrappers set up to use two files, use the following:
/etc/hosts.allow:
exim : <client_list>
/etc/hosts.deny:
exim : <client_list>
Read the hosts_access(5) man page for more ways of specifying clients, including ports, etc., and on logging connections.
Q0806: How can I get POP-auth-before-relay support in Exim?A0806: See http://cc.ysu.edu/~doug/exim-pop.tar.Z which has some scripts for this, courtesy of Doug S <doug@cc.ysu.edu>. See also Q0835.
Q0807: I have one or two cases where my machine correctly rejects messages, but the remote machine is quite persistent, and keeps trying over and over.A0807: It is an unfortunate fact that a number of SMTP clients, in violation of the SMTP RFC, do not treat a permanent error code that is given after the MAIL FROM command or the DATA portion of the transaction as a permanent error. Consequently they keep resending the message. Failing checks on a message's headers (the headers_... options) necessarily result in an error code after the data has been received.
Q0808: I am seeing the error "no valid sender in message headers: return path is <>" in the reject log. Isn't <> a valid return path for error messages?A0808: It is indeed valid. The complaint here is about the contents of the message's headers, not the return path. This message has been reworded in later versions of Exim. You must have set the headers_sender_verify option. Check the From:, Reply-to: and Sender: headers that were logged with the error. You can use Exim's -bv option to find out why verification of those addresses failed.
Q0809: Let's say that we want to run a mail server that does not care if you have proper reverse DNS. If you include host_reject lines in your config file, Exim will always reject connections from such hosts. How can this be avoided?A0809: This is true only if you have wild-carded host names in host_reject. For complete host names, Exim uses a DNS forward lookup to obtain an IP address to compare. If you are using wild cards of any sort, put +allow_unknown as an item in your host list, for example:
host_reject = +allow_unknown : *.def.zz : *.stu.yy
This will allow any host without reverse DNS to bypass the checks. Note that it means that the owner of abc.def.zz (for example) can trivially get round your block simply by deleting the PTR record for abc.def.zz. If you use +warn_unknown instead of +allow_unknown, the action is the same, but every time the exception is invoked, it is logged.
Q0810: Is there a way to prevent lookups in the RBL for local hosts?A0810: Check out the rbl_hosts option.
Q0811: How can I set up the sender_reject option in my config file so I can reject mail by matching regular expressions?A0811: You must either put the regular expressions directly in the option setting, or in a file that is referenced by a plain file name, or use an @@ type of search. If the regular expressions match the domain as well as the local part, then the first two approaches are the only possible ones. For example:
sender_reject_recipients = ^.*\.spam\.com$ : ^.*@[0-9]+\.com$
or
sender_reject_recipients = /some/file
Each line of the file is treated as if it were an entry in the list, and must begin with ^ if it is a regular expression. No keys are involved because this is not a lookup,
If you are using version 2.10 or later, the first of those regular expressions can be rewritten to execute much more efficiently by using lookbehinds and once-only subpatterns:
sender_reject_recipients = ^(?>.*$)(?<=\.spam\.com)
See the manual section entitled "Address lists" for a description of the @@ type of split domain/local part lookup. See also Q0801.
Q0812: Normally sender_reject_recipients works fine, but addresses that have some uppercase letters in them seem to come through.A0812: This should no longer be the case from release 3.00 onwards. Although host and domain names are case-insensitive, the RFCs about mail specify that local parts are case sensitive. When earlier versions of Exim looked up a sender address in sender_reject_recipients, they did so using the caseful form, in order to be compliant with the mail RFCs. (In principle, user@domain and USER@domain might be different people. Silly, I know, but that's the rule. It has caused a lot of grief.) However, RFC 2305 (Anti-Spam Recommendations for SMTP MTAs) recommends that address checking in blocking lists should be done caselessly, so Exim now does this by default.
Q0813: I want to accept some sender addresses, even though they do not verify. There doesn't seem to be an option for verification exceptions, so how can I do this?A0813: Set up a special director or router to ensure that those addresses do verify, using verify_only and verify_sender so that it is not used during delivery or recipient verification. For example, here is a router which verifies the address root@somedomain.com:
verify_exceptions:
driver = domainlist
verify_only
verify_sender
domains = some.domain.com
local_parts = root
route_list = *
Q0814: We are being plagued by forged mail coming from a number of different
hosts and sender addresses. The guy however leaves a fingerprint. The
first received line always contains 'Received: from baby'. What is the
best suggested way for eliminiating him from our systems?
A0814: You cannot, unfortunately, prevent the message from getting into your system, because the message has to be read before you can inspect the Received: header. The best you can do is to install a system filter which junks any message containing such a header. Thus the sender still wastes bandwidth and your resources in transporting the message to you, but you just throw it away. A simple system filter that does this is
# Exim filter
if $h_Received: contains "from baby" then seen finish endif
Q0815: I have set host_accept_relay, but my host still refuses to relay from
matching hosts.
A0815: (A) Did you remember to HUP or restart the Exim daemon after changing the configuration? You can get information as to what options Exim is checking by using the -bh option to test how it would handle mail from a specific host.
(B) Have you used any wild-card host names in host_accept_relay? E.g:
host_accept_relay = *.aaa.bbb
If so, the problem may be that the relevant hosts do not have reverse DNS entries for their IP addresses. In order to match a wild card name, Exim has to look up the calling host's name from its IP address, and if it cannot do so, it takes a hard line by default. Exim processes lists from left to right, and so will attempt a reverse DNS lookup at the first wild-carded entry it reaches. If you have IP addresses in your list, it is best to put them first for this reason. Suppose you had
host_accept_relay = *.x.y : 10.9.8.7
Then when the host 10.9.8.7 connects, a reverse lookup will still be done, because the first check is against *.x.y. If the lookup fails, relaying is rejected. However, if the list were in the opposite order, the IP check would succeed, and no DNS lookup would be done. See also Q0809.
Q0816: How can I run customized verification checks on incoming addresses?A0816: If you can implement your checks in Perl, then you can use Exim's facility for running an embedded Perl interpreter. For example, if you want to run special checks on local addresses, you could install this as your first director:
private_verify:
driver = smartuser
condition = ${perl{verify}{$local_part}{$domain}}
verify_only
If you want this to be the only means of verification, you can set no_verify on all the other directors. Otherwise, if this director fails to verify, the address gets passed on to those that follow.
The verify_sender and verify_recipient options can be used to restrict the director to sender or recipient verification only, and if necessary you could have two different directors, one for senders and one for recipients.
If the result of the expansion of condition is not "no", "false" or "0", then address verification succeeds, because the director itself matches any address. The expansion of condition causes the Perl subroutine called "verify" to be run, with two arguments, the local part and the domain. The subroutine must be provided in Perl code that is referenced by the perl_startup option. See the chapter on embedded Perl for details.
Remote addresses can be handled in a similar way by using a domainlist router that matches all domains. See also Q0813.
Starting up a Perl interpreter is not cheap. On a busy system you should first make sure that there isn't some way of using Exim's own facilities for doing what you want before going down this road.
Q0817: Does Exim apply RBL checks to error messages, those with an envelope sender of "<>" ?A0817: Yes, it does, because the RBL check happens immediately on connection, before any commands are passed, and so therefore before it even knows that the envelope sender is "<>".
Q0818: I want to be able to set up a list, similar to sender_reject_recipients, but with a user-defined message. I believe I have to use a director for this.A0818: You can do this using the prohibition_message mechanism (see the section entitled "Customizing prohibition messages" in the manual). This avoids having to use a director, and therefore doesn't require you to let the message into your host at all. Use something like this:
prohibition_message = "\
${if eq {$prohibition_reason}{sender_reject_recipients}\
{${lookup{$sender_address}lsearch{/some/file}{$value}}}{}}"
This example looks up a message that is specific to the sender, but you can of course tailor the message any way you like. Vertical bar is treated as a line separator in prohibition texts.
Q0819: I want to reject certain sender-recipient combinations, with a specific message for each such combination.A0819: That needs a special director, using the "senders" option to predicate it on the sender, and a file of recipients to fail for each sender. Something like this:
forced_fail:
driver = aliasfile
senders = sender@domain.com : *@otherdomain.com
file = /blocked/${lc:$sender_address}
search_type = lsearch
with the files containing lines like
recipient: :fail: message
If you are handling multiple local domains, you may want to set include_domain so you can specify fully qualified addresses in the files. If the files get big, an indexed search type such as DBM or cdb should be used.
If you want to block an entire domain from a specific sender, you could use this director:
domain_block:
driver = aliasfile
senders = dislikedsender@wherever
file = /fail/all
search_type = lsearch*
with the file containing
*: :fail: message
The message text supplied after :fail: is restricted to a single line. If you want to send several paragraphs of message, instead of using :fail: you could use the aliasfile to pipe the message off so some script which generates a long message and then gives a non-zero return code so that the message gets returned to the sender.
In all of these cases you are in trouble if the sender address is bad, because the bounce message you generate will get stuck.
Q0820: Will Exim allow me to create a file of regexs and match incoming external email to the list - and if a match is found file the offending message into a special location? Also is it possible to make exim only filter parts of an incoming email - e.g. ignore large MIME attachments for example and only process text/plain?A0820: You can do some of this in a system filter. For example:
if $message_body matches <...some complicated regex...> or
$message_body matches <...some other regex...> or
$header_from: matches <...regex...> or
etc.
then
save /some/special/file
endif
or instead of "save" you could have "deliver" (to some address) or "pipe" (to some script).
There isn't any mechanism for ignoring attachments, but $message_body only looks at the first n bytes of the body, where n defaults to 500 but can be changed.
A more expensive alternative would be to run a Perl subroutine using the embedded Perl mechanism. If you passed over the message id, the Perl code could read the message files on the spool and implement any algorithm it liked for deciding what should be done.
Q0821: I've hacked sendmail to make an ioctl call at the time of the SMTP RCPT command, to check if a user has exceeded their email quota. If they have I issue a temporary failure and a message - can I do this with Exim?A0821: This could be done by arranging for a quota check to happen during the verification of the address after RCPT, but without hacking Exim you would have to use the embedded Perl facility to get it to run a Perl script to do the test.
If the reason you want to do this is to avoid having messages for over- quota users sitting on your spool for many days, there is an alternative. In Exim you can set up special retry rules for quota excession (what we use is "if mailbox not read for 7 days, bounce immediately, otherwise try every hour for one day, then bounce").
Q0822: I'm looking for a rule to reject special unknown recipients.A0822: If the messages in question are coming in via SMTP, you can turn on receiver_verify (if you haven't already) and arrange for these addresses not to verify. For example, if they are not in your local domains, you could use a router like this:
verify_check_specials:
driver = domainlist
condition = "\
${if eq {$local_part@$domain}{account@host.domain}{yes}{no}}"
verify_only
fail_verify
route_list = *
where of course you can extend the condition setting to use regular expressions, file lookups, Perl calls, or anything else that is available. The failure of the verification causes an error return to the SMTP RCPT command, so the messages never get into your system. For addresses in your local domains you could use a smartuser director in a similar fashion, but you could also use an alias file with :fail: entries.
If you are receiving such messages from the local host, then they are already in the system, and have to be failed locally as part of the delivery process. The :fail: mechanism is the simplest for local addresses. For remote addresses, one possibility would be to use a router with a condition setting to send such messages to an autoreply transport that sends back an error message to the sender. See also Q0826.
Q0823: I'd like to pass all messages through a virus-scanning system before delivery. Can Exim do this?A0823: One way of achieving this is to deliver all messages via a pipe to a checking program that resubmits them for delivery in some private way that can be checked (e.g. on a specific SMTP port, or IP address). One possibility is to use the "received protocol" field that can be set for locally submitted mail via the -oMr command line option. This director sends all messages that are not from the local host and whose received protocol is not "scanned-ok" to the virus_scan transport:
vircheck:
driver = smartuser
transport = virus_scan
condition = "${if or {{eq {$received_protocol}{scanned-ok}} \
{eq {$sender_host_address}{127.0.0.1}}}\
{0}{1}}"
A similar router could be used if you want to scan messages for remote addresses. One problem is that this approach scans the message for each recipient, not just once per message.
The virus_scan transport should be set up to pipe the message to a suitable checking program or script which runs as a trusted user. This can then re-submit the message to Exim, using -oMr to set the received protocol to "scanned-ok", and the -f option to set the correct envelope sender address. WARNING: If you forget to make the resubmitting process run as a trusted user, the received protocol does not get set, and you are likely to generate a loop.
Q0824: How can I accomplish this: a message sent from any host must either be sending to a domain in a list (a dbm file) or the sender's address domain must be in the list.A0824: First of all, set
relay_domains = dbm;/the/dbm/file
This allows relaying from any host, provided that the recipient address matches one of the domains in the list. Then set
host_accept_relay = *
sender_address_relay = dbm;/the/dbm/file
This allows relaying from any host (because of the *) to any arbitrary domain, provided that the sender's address matches a domain in the list.
WARNING: This setting makes it possible for your host to be used as an open relay by those unscrupulous enough to forge sender addresses. Your host may end up on one of the open relay blocking lists as a result.
Q0825: I've set relay_domains and sender_address_relay, but if user@mydomain tries sending to an arbitrary domain, Exim rejects it.A0825: The safest way to control relaying arbitrary domains is by host, not by sender address. If you are able to specify the hosts which your users use, then set host_accept_relay to match them. You can then remove the setting of sender_address_relay, unless you also want to limit relaying to specific senders.
If you want to permit relaying from specific senders on arbitrary hosts, you can set relay_match_host_or_sender. This requires that only one of the host or sender address be recognized, instead of both of them.
WARNING: This setting makes it possible for your host to be used as an open relay by those unscrupulous enough to forge sender addresses. Your host may end up on one of the open relay blocking lists as a result.
Q0826: I set sender_reject_recipients, but Exim is not rejecting those recipients.A0826: You have misunderstood the option. A setting like that rejects all the recipients of an incoming message with that sender. To reject a specific recipient in your own domain you can set up an alias like this:
reject-me: :fail: mail for reject-me is not acceptable
If you want to reject a recipient that is not in a local domain, one approach is to set up a router to send the address to your directors, and then use an alias file to generate a :fail: message as above. Alternatively, you can use the verification mechanism: see Q0822.
Q0827: I can't find an option to deny "RCPT TO:" addresses.A0827: Denying RCPT TO addresses is the job of verifying. You can set up directors and routers that are run only when verifying and not when delivering. This gives you a great deal of flexibility. See Q0822.
Q0828: My problem is that Exim replaces $local_part with an empty string in the system filtering. What's wrong or what did I miss?A0828: A message may have many recipients. The system filter is run just once at the start of a delivery attempt. Consequently, it does not make sense to set $local_part. Which recipient should it be set to? However, you can access all the recipients from a system filter via the variable called $recipients.
Q0829: Using $recipients in a system filter gives me another problem: how can I do a string lookup if $recipients is a list of addresses?A0829: Check out section 25 of the filter document ("Testing a list of addresses"). If that doesn't help, you may have to resort to calling an embedded Perl interpreter - but that is expensive.
Q0830: Is there a way to configure Exim to reject mail to a certain local host?A0830: No, only to certain domains. Use a configuration like this:
receiver_verify
local_domains = rejected.domain : <other local domains>
with the first director as
reject_domains:
driver = smartuser
domains = rejected.domain
verify_only
fail_verify
Q0831: Exim sometimes rejects messages with bad senders after the DATA and
sometimes after the MAIL command. What is the difference?
A0831: The first time Exim encounters a particular bad sender, it rejects the message after the data has been received, so that it can log the headers. If the same sender re-appears within 24 hours, Exim assumes that the remote host has (in violation of RFC 821) not interpreted the previous 550 error code correctly, so this time it rejects the MAIL command. Some hosts don't even managed to handle that, so if the same sender turns up for a third time within 24 hours, Exim accepts MAIL, but rejects every RCPT command instead.
Q0832: How can I get Exim to remove attachments from messages?A0832: (A) The cleanest way is to check for the existence of a "Content-type" header line, and route messages containing it down a pipe to some other program that strips the attachments and re-submits the message to Exim. Alternatively, a transport filter can be used to do the job, as described in C028.
(B) A somewhat more hairy way is to use embedded Perl from a system filter to truncate the message's data file directly, and then use the "headers remote" filter command to get rid of the associated headers.
Q0833: I ran a relay test against my host and it failed with an address containing a %, though I don't have percent_hack_domains set. Is Exim broken? This is what the tester said:
Relay test 6
>>> RSET
<<< 250 Reset OK
>>> MAIL FROM:<spamtest@example.com>
<<< 250 <spamtest@example.com> is syntactically correct
>>> RCPT TO:<relaytest%mail-abuse.org@example.com>
<<< 250 <relaytest%mail-abuse.org@example.com> is syntactically correct
Relay test result
Uh oh, host appeared to accept a message for relay.
The host may reject this message internally, however
A0833: This does not prove that your host is open for relaying. Notice the wording of the last two sentences: "appeared to accept" and "may reject internally". Assuming that your Exim configuration is correct, Exim will discover that the local part "relaytest%mail-abuse.org" is not valid on your host, and it will bounce the message.
Why doesn't it reject the RCPT TO command? Answer: because you have not set receiver_verify in your configuration file, or you have excluded these particular sender or recipient domains from receiver verification.
Q0834: How can I arrange for each user to have a file listing the only sender addresses from which she will accept mail? I want to do this so my family members don't get any spam (or other inappropriate mail).A0834: Arrange for each user you want to control to have a file called .acceptlist, ignoring for the moment how this gets maintained. Then, turn on receiver_verify and make the following your first director:
verify_known_sender:
driver = smartuser
require_files = /home/$local_part/.acceptlist
senders = ! /home/$local_part/.acceptlist
new_address = :fail: Sender unknown
That will stop such messages even getting into your host. (Replace /home/$local_part with whatever the correct path to your user's home directories is.) As written above, the accept list is interpolated into the senders list and can contain wild cards. If there are no wild cards and the lists get very long, it would be more efficient to convert them into some indexed format, e.g. cdb and use a cdb lookup.
One problem with this is that it will block bounce messages, which have empty senders. You can get round this, by changing the "senders" line to
senders = ! : ! /home/$local_part/.acceptlist
However, this will, of course, let in spam that has a null sender. Since the "senders" option is expanded, you could perhaps include something that tested a message without a sender for being a plausible bounce message before including the null sender in the list. Another approach would be to use a condition option to do various tests, including looking up $sender_address in /home/$local_part/.acceptlist.
Q0835: I have the POP-auth-before-relay support in, but I see that Exim still does an RBL lookup before checking the POP authorisation file. How can I prevent it doing an RBL check if the caller is authorized by virtue of a recent POP authentication?A0835: If the file containing a list of recent POP-authenticated hosts is /usr/local/etc/exim/popauth, say, set
rbl_hosts = !/usr/local/etc/exim/popauth
so that hosts in the list are exempted from RBL checking.
Q0836: When using Nessus on a system that runs exim, a number of security issues are raised. Nessus complains that exim answers to EXPN and/or VRFY; sometimes it even complains that exim allows relaying.A0836: Exim supports EXPN only if you permit it to do so by setting smtp_expn_hosts. Likewise, it supports to VRFY only if you set smtp_verify. Without these settings, its responses are
550 EXPN not available
252 VRFY not available
Maybe the use of 252 is the "problem". It is recommended that this be done (by those that discuss these things) because there are stupid clients that attempt VRFY before sending a message.
Q0837: Could anyone points me to right rules to prevent sending/receiving messages to/for domains which have one MX to localhost or only have address 127.0.0.1 ?A0837: You need to turn on sender_verify. With the default configuration, this will result in a temporary verification failure for these domains. You can make this into a permanent failure by adding
self = fail
to your lookuphost router. The default action on encountering a routing to the local host is to defer, and freeze the message if it is a delivery address. Making this change applies to any routing to the local host, not just to 127.0.0.1.
If you are running Exim release 3.16 or later, an alternative approach is to set ignore_target_hosts = 127.0.0.1 on the relevant routers.
Q0838: How can I lock out domains that do not have any MX records?A0838: You can do this by means of the mx_domains option, but you should NOT do this for Internet domains in general. There are still a large number of legitimate domains that do not have MX records.
Q0839: I would like to have a per-user limit for the maximum size of messages that can be sent.A0839: The simplest way to do this is to put something in a system filter along these lines:
if $message_size is above
"${lookup{$sender_address}lsearch{/some/file}{$value}{10M}}"
then
fail "Message is larger than $sender_address is allowed to send"
endif
Q0840: I have set up a DBM (or cdb, or lsearch, or MySQL or whatever) file
containing a list of IP addresses for the hosts I want to allow to
relay, but when I set host_accept_relay to do a lookup on that data, it
doesn't work.
A0840: If you include any kind of lookup in a host list, it will by default search on the host name, not on the IP address. What you want is something like
host_accept_relay = net-dbm;/some/file
The prefix net- makes it look up the IP address instead of the name. You can also look up IP networks by using entries like
host_accept_relay = net24-dbm;/some/file
For a host with IP address 192.168.45.23 this would do the lookup using the key "192.168.45.0/24".
A0901: Users have found several ways of setting up Exim for use with Majordomo. There's a web page at
http://www.netmaster.ca/exim/majordomo.html
which shows one way to do it, and discusses some of the issues. The sample configuration C018 is another approach which automates a lot of the functions based on whether the files or directories exist. Only three aliases per list are needed.
Somewhere in the Majordomo docs or FAQ it mentions using batchmail or other additional programs to improve the performance of large lists. They are not needed with Exim, and their use can actually make things worse. However, it's a good idea to set remote_max_parallel to a value greater than 1 in the Exim configuration.
Q0902: I have set $mailer in majordomo.cf, but it still isn't setting the sender correctly in the messages it sends.A0902: Make sure you have got the quoting correct in the $mailer setting. For example,
$mailer = "$sendmail_command -oi -oee -f$sender\@lists.mydomain.de";
is not correct. It needs three backslashes, not one, and the $ at the start of $sender has to be escaped with a backslash.
Q0903: I'm trying to set up majordomo, but I'm getting a "wrong mode" error when I try to send it mail. The panic log entry reads:1999-01-05 11:23:34 0zxZGY-0000vB-00 majordomo_aliases director: /var/lib/majordomo/lists/lists.aliases (lsearch lookup): wrong mode
A0903: Check the mode of /var/lib/majordomo/lists/lists.aliases and compare it with the setting of the modemask option in the majordomo_aliases director. This option specifies bits which must not be set for the alias file, and it defaults to 022.
Q0904: I'm getting return code 9 from /home/majordomo/majordomo-1.94.4/wrapper when it is passed a message from Exim.A0904: A problem like this turned out to be the Perl version that came with RedHat 5.2. Rebuilding Perl 5.005x solved it.
Q0905: Exim is complaining about an invalid command line when Majordomo tries to send it a message for delivery.A0905: Take a look at your majordomo.cf file, It should have something that looks like
$sendmail_command = "/usr/lib/sendmail";
and another line like
$mailer = "$sendmail_command -oi -oee -f\$sender";
If you have modified resend (one of the majordomo programs) to use $sendmail_command instead of $mailer you will be calling Exim with no command line arguments.
A1001: If you set up a rewriting rule in the following form:
*@*.your.domain $1@your.domain
then Exim will rewrite all addresses in the envelope and the headers, removing anything between "@" and "your.domain". This applies to all messages that Exim processes. If you want to rewrite sender addresses only, the the rule should be
*@*.your.domain $1@your.domain Ffrs
This applies the rule only to the envelope "From" address and to the From:, Reply-to:, and Sender: headers.
Q1002: I have Exim configured to remove the hostname portion of the domain on outgoing mail, and yet the hostname is present when the mail gets delivered.A1002: Check the DNS record for your domain. If the MX record points to a CNAME record instead of to an A record, MTAs are liable to rewrite addresses, changing your domain name to its "canonical" form, as obtained from the CNAME record.
Q1003: I want to rewrite local addresses in mail that goes to the outside world, but not for messages that remain within the local intranet.A1003: Exim wasn't really designed to handle this kind of split world, and doing this is not entirely straightforward.
(A) If you are running version 3.20 or later, you can use the headers_rewrite option on a transport. This will apply to just those copies of a message that pass through the transport. The return_path option can similarly be used to rewrite the sender address, but there is no way of rewriting recipient addresses at transport time. However, as these are by definition remote addresses, you probably don't want to rewrite them.
You have to set up the configuration so that it uses different SMTP transports for internal and external mail. Typically this would be done by setting the domains option on a router for handling your internal domains. However, if all domains are routed in the same way (for example, using a DNS lookup), another approach is to use a string expansion for the transport name. For example:
lookuphost:
driver = lookuphost
transport = ${if match{$domain}{\\.my\\.domain\$}{int_smtp}{ext_smtp}}
This example uses the int_smtp transport for domains ending in .my.domain, and ext_smtp for everything else. The ext_smtp transport could be something like this:
ext_smtp:
driver = smtp
headers_rewrite = *@*.my.domain \
${lookup{$1}cdb{/etc/$2/mail.handles.cdb}{$value}fail}
return_path = \
${if match{$return_path}{^([^@]+)@(.*)\\.my\\.domain\$}\
{\
${lookup{$1}cdb{/etc/$2/mail.handles.cdb}{$value}fail}\
}\
fail}
This example uses a separate file of local-to-external address translations for each domain. This is not the only possibility, of course. The headers_rewrite and return_path options apply the same rewriting to the header lines and the envelope sender address, respectively.
(B) If you are running a version of Exim that is earlier than 3.20, doing this kind of rewriting is very much more difficult. Until the headers_rewrite option was added, all header rewriting was done at the time a message was received. A standard configuration cannot handle rewriting that is specific to certain recipients only.
The simplest thing to do is to upgrade to the latest current Exim release. For those that cannot do that, this old information from the pre-3.20 FAQ is retained:
The trick is to split off a copy of the message to be sent to all external recipients, and do the rewriting on that. This can be achieved by running two differently-configured versions of Exim, either on a single host, or on two different hosts. If you have a gateway or firewall machine, that is the natural place to run the rewriting version.
On a single machine, the following is one way of handling this:
(1) Set up the normal configuration (in the configuration file whose name is screwed into the binary) such that it does local deliveries as required, but forwards a copy of the message for non-local recipients to a different incarnation of Exim via a private SMTP port. For example, use this transport and router:
# Transport to send SMTP using port 26
internal_smtp:
driver = smtp
service = 26
# Router to send everything the internal_smtp transport
pass_remotes:
driver = domainlist
transport = internal_smtp
route_list = * localhost byname
self = send
This should be the only router. Because of the self = send setting, Exim will transport the messages, even though it knows it is going to the local host.
(2) Set up a different configuration file for the rewriting version of Exim. This need do no local deliveries, so it needs no local domains or directors, and as it accepts mail only from the local host, there is no need for any spam-blocking or other policy controls. However, it does need to have its own spool area. The main part of the configuration could be like this:
local_domains =
local_interfaces = 127.0.0.1
host_reject = !127.0.0.1
spool_directory = /var/spool/exim-external
end
Note the use of a negated item for host_reject, causing rejection of SMTP calls from all but the local host.
The directors section can be completely empty (apart from the line saying "end"), while the routers section should be as in a normal configuration, as it is going to control external delivery.
The rule(s) for rewriting your internal addresses into external ones should be in this configuration. This is one example of what might be done:
*@*.your.domain "\
${lookup{$1}cdb{/etc/$2/mail.handles.cdb}{$value}fail}"
which looks up each local part in a per-host file to obtain the externally-visible address, including (in this example) the domain.
(3) You have to arrange for a daemon to be listening on port 26, and to be using the alternate configuration file. It is necessary to do this as root so that Exim retains its privilege after reading a non-standard configuration. A command such as
exim -C /etc/exim-configure2 -bd -oX 26
could be used in a suitable system start-up file. Alternatively you could set up inetd to run Exim with the -C option for incoming connections on port 26.
The net result of all of this is that when a message has one or more external recipients, a copy of it is sent via port 26 to the second version of Exim, which rewrites any internal addresses and does the external deliveries. The cost of this is that the message has to be copied and spooled twice, and you have two different Exim queues to manage. Note that if the "external" Exim has to send a delivery failure message, it will use the rewritten sender address.
Q1004: I'm using this rewriting rule to change login names into "friendly" names, but if mail comes in for an upper case login name, it doesn't get rewritten.
*@my.domain ${lookup{$1}dbm{/usr/lib/exim/longforms}\
{$value}fail}@my.domain bcfrtFT
The longforms database has entries of the form:
ano23: A.N.Other
A1004: Replace $1 in your rule by ${lc:$1} to force the local part to lower case before it is used as a lookup key.
Q1005: Is it possible to completely fail a message if the rewrite rules fail?A1005: It depends on what you mean by "fail a message" and what addresses you are rewriting. If you are rewriting recipient addresses for your local domain, you can do:
*@dom.ain ${lookup{$1}dbm{/wher/ever}{$value}{failaddr}} Ehq
and in your alias file put something like
failaddr: :fail: Rewriting failed.
This fails a single recipient - others are processed independently.
Q1006: I'm using $domain as the key for a lookup in a rewriting rule, but its contents are not being lowercased. Aren't domains supposed to be handled caselessly?A1006: The value of $domain is the actual domain that appears in the address. It could of course be lower cased, but I know that would cause some unhappiness, because some people have mixed-case domain names which look silly if the case is changed. Thus, one wants to preserve the case in rewrites such as
*@*.TheRap.com <something>@$domain
(not the best example) because "therap" doesn't look like two words. I know it seems trivial, but it is important to some people - especially if by some unfortunate accident the lowercased word is something indecent.
You can trivally force lower casing by means of the ${lc: operator. Instead of "$domain" write "${lc:$domain}".
Q1007: I want to rewrite local sender addresses depending on the domain of the recipient.A1007: In general, this is not possible, because a message may have more than one recipient and Exim keeps just a single copy of each message. It may also deliver one copy of a message with several recipient addresses. You can do an incomplete job by using a regular expression match in a rewrite rule to test, for example, the contents of the To: header. This would work except in cases of multiple recipients. See also Q1003.
A1101: To the remote_smtp transport, add something like
headers_add = "${if and{\
{eq{$domain}{spec.dom}}\
{matches{$h_subject:}{whatever}}}\
{Content-Type: text/html; charset=\"us-ascii\"} fail }"
This example shows a Content-Type header, but you can have anything you like, and multiple headers can be inserted by using \n to separate them.
Q1102: Is it possible to have Exim add a header to only certain local_parts of outgoing mail?A1102: Only if you arrange for each such local part to receive its own private copy of the mail. See max_rcpt in the SMTP transport. Then you could use conditions in an expansion string to add or not add a header.
Q1103: How can I remove some part of the Received: header?A1103: Set received_header_text.
Q1104: How I can insert the PGP header line using exim filters?A1104: You can't insert headers in a user filter. A system filter can do so, but the inserted lines then are included for all recipients.
Q1105: I know I can use a system filter to replace certain headers in messages, but how can I add text to existing headers? I want to add [SPAM] to the subject line of messages that appear to be spam.A1105: You can only do this in a round about way, using filter commands like this:
headers add "New-Subject: SPAM: $h_subject:"
headers remove subject
neaders add "Subject: $h_new-subject:"
headers remove new-subject
This trick works only in system filters, where the commands are obeyed in order, and affect the master list of headers that apply to the whole message. You cannot do this with the headers_add and headers_remove options on drivers.
A1201: Put "localhost" in a list of local domains, that is, add it to the local_domains option in your Exim configuration file.
Q1202: Fetchmail is passing on bounce messages to Exim with the sender address set to <@some.domain> which causes Exim to complain, because there is no local part.A1202: This was a fetchmail problem which has been fixed. Ideally, you should upgrade to the current fetchmail release. If you cannot do this, there is some Exim magic that might help. The 'S' rewriting flag allows rewriting of envelope addresses to be done as soon as they are received in the SMTP protocol, before any kind of checking or other processing is done. This is specifically provided for installations that have to cope with mangled addresses coming in over SMTP.
Q1203: I'm currently using Exim with fetchmail and I'd like to use the RBL on Exim, but will it work? Do I need to configure fetchmail any particular way? As far as Exim knows, all mail is coming from 127.0.01. Will it check the source address against RBL? Or will it check the From: header?A1203: It will check 127.0.0.1 (not very useful). The point of the RBL is to keep messages from black-listed hosts out of your machine. If you are using fetchmail, you have got the messages into your machine before you approach Exim. That kind of defeats the purpose of the RBL. The right way to do this would be for the host from which you fetchmail to do the RBL checking and insert some kind of warning header for you to test, as Exim does if you run RBL checks in warning mode.
A1301: If you are using BSDI, see Q9401.
Q1302: Exim built with Perl support exits with several error messages of the form "undefined reference to `PL_stack_sp'".A1302: This has been seen on FreeBSD systems that had two different versions of Perl installed, the older with an a.out library and the newer with an ELF library. Ensure that the older package is removed.
A1401: Use the queue_remote_domains option to control which domains are held on the queue for later delivery. For example,
queue_remote_domains = ! *.localnet
allows delivery to domains ending in .localnet, while queueing all the others.
Q1402: I have a dial-up machine, and I use the queue_smtp_domains option so that remote mail only goes out when I do a queue run. However, any email I send with an address <anything>@aol.com is returned within about 15 minutes saying 'retry time exceeded', and all addresses are affected.A1402: (A) You should be using queue_remote_domains rather than queue_smtp_ domains. With the latter, Exim is trying to route the addresses, which involves a DNS lookup. This is presumably timing out, causing a retry time to be set for the domain, and somehow a valid lookup never happened before the maximum retry time (default of 4 days) passed. Hence the bounce. The fact that it is aol.com is not relevant. You should probably also be using -qq to do your queue run rather than -q.
(B) An alternative approach if you are sending all your outgoing mail to the same smart host is to use a single router like this:
route_append: driver = domainlist transport = remote_smtp route_list = "* smarthost.isp.net byname"
and put the address of the smart host in /etc/hosts, so that it can be found without the need of a DNS lookup. Then you can use queue_smtp_ domains so that Exim does the routing for every message, but doesn't try to deliver it. See also Q1403.
Q1403: How should Exim be configured when it is acting as a temporary storage system for a domain on a dial-up host?A1403: Exim isn't really designed for this, but... The lowest-numbered MX record for the domain should be pointing to your host. You should set a large retry time for that domain, so that Exim doesn't keep trying to deliver when the host is offline. When the host comes online, the waiting messages have to be kicked somehow. This can be done by calling Exim with the -R option, or via the SMTP ETRN command. This works provided the number of messages is low. If you are handling lots of mail, keeping messages waiting for their host to connect and those that are having delivery problems to remote hosts all in the same queue doesn't work so well. It is better in this case to get Exim to deliver the mail for the dial-in hosts into some local files which then get transmitted by other software when the host connects. See the manual chapter entitled "Intermittently connected hosts" and also Q5014 and Q0521.
Q1404: I have queue_remote_domains or queue_smtp_domains set, and use -qf to force delivery of waiting mail when I dial in. How can I arrange for any new messages that arrive while I'm connected to be delivered immediately?A1404: (A) Instead of queue_remote_domains or queue_smtp_domains, use the queue_only_file option. This causes messages to be queued only if a particular file exists. The word "remote" or "smtp" before the file name controls which type of queueing is used. For example:
queue_only_file = remote/etc/present/when/not/connected
Then, in the scripts which are run when you connect and disconnect, arrange to remove the file after connection, and create it just before disconnection.
(B) An alternative is to set hold_domains to point to a file lookup and switch that file appropriately.
A1501: There are a number of technical and potential legal problems that arise in connection with message modification. Some of them are listed below. If, despite these considerations, you still want to modify messages, you can do so using Exim, but not directly in Exim itself. It is not the job of an MTA to modify messages, something that requires understanding of their content and format.
Exim provides a hook in the form of a "transport filter" that lets you pass any outgoing message through a program or script of your choice. It is the job of this script to make any changes to the message that you require. By this means, you have full control over what changes are made, and Exim does not need to know anything about message bodies. However, using a transport filter requires additional resources, and may slow down mail delivery.
You can use Exim's directors and routers to arrange for those messages that you want to modify to be delivered via a transport filter. For example, suppose you want to do this for messages from addresses in your domain that are being delivered to a remote host. Place the following router before the standard lookuphost router:
filter_remote:
driver = lookuphost
transport = remote_smtp_filter
condition = ${if eq {$sender_address_domain}{your.domain}{yes}{no}}
This routes the relevant addresses to a transport called remote_smtp_filter. Other addresses fall through to the normal router, and are routed to the standard remote_smtp transport. Another way to do this would be to use a single router, with an expanded string for the transport setting. The new transport is defined thus:
remote_smtp_filter:
driver = smtp
transport_filter = /your/filter/command
The entire message is passed to your filter command on its standard input. It must write the modified version to the standard output, taking care not to break the RFC 822 syntax. The command is run as the Exim user, if one is defined; otherwise it is run as root.
There are a number of potential problems in doing this kind of modification in an MTA. Many people believe that to attempt is it wrong, because:
1. It breaks digital signatures, which are becoming legally binding in some countries (already in the UK, likely to be 1 October 2000 in the USA). It may well also break encryption.
2. It is likely to break MIME encoding, that is, it is likely to wreck attachments, unless great care is taken. And what about the case of a message containing only binary MIME parts?
3. It is illegal under German and Dutch law to change the body of a mail message in transit. It might potentially be illegal in the UK under European law. This consideration applies to ISPs and other "common carriers". It would presumably not apply in a corporate environment where modification was done only to messages originating from the employees, before they left the company's network. It might also not apply if the senders have explicitly given their consent (e.g. agreed to have advertisements added to their incoming mail).
4. Since the delivered message body was produced by the MTA (not the originator, because it was modified), the MTA operator could potentially be sued for any content. This again applies to "common carrier" MTAs. It's interesting that adding a disclaimer of liability could be making you liable for the message, but this case seems more likely to involve adding advertisements than disclaimers. After all, no postal service in the world opens all the mail it carries to add disclaimers.
5. Some mail clients (old versions of MS outlook) crash if the message body of an incoming MIME message has been tampered with.
There are also potential problems that could arise if a scheme to add disclaimers goes wrong for some messages:
1. False negatives: "Ah, this guy usually says he does not represent their views, but in this message he doesn't have the disclaimer".
2. False positives: "This official announcement does not represent our views, oh no".
An alternative approach to the disclaimer problem would be to insist that all relevant messages have the disclaimer appended by the MUA. The MTA should refuse to accept any that do not. Again, however, the MTA must understand the format of messages in order to do this. Simply checking for appropriate wording at the end of the body is not good enough. It would probably be necessary to run a Perl script from within an Exim system filter in order to adopt this approach.
Finally, it's a trivial matter to add customized headers of the sort:
X-Disclaimer: This is a standard disclaimer that says that the views
X-Disclaimer: contained within this message are somebody elses.
which is a much easier alternative to modifying message bodies.
Q1502: How can I remove attachments from messages?A1502: The answer to this is essentially the same as for Q1501.
A2000: The author of Exim believes that it is Y2K-compliant, as long as the underlying operating system and C library are. Exim does not parse dates or times at all. Internally, it makes some use of binary timestamps in Unix format (number of seconds since 1-Jan-1970) and uses C library services to convert these to printing forms (e.g. for logging). The printing forms all use 4-digit years. Some people have tried various tests. No problems have been reported, but details of what tests have been done are not available.
Well, it's now August 2000, and no Y2K problems have been reported, so it looks like I was right.
A5001: This is an error that occurs when Exim is trying to find out the all the IP addresses on all of the local host's interfaces. If you have lots of virtual interfaces, this can occur if there are more than around 250 of them. The solution is to set the option local_interfaces to list just those IP addresses that you want to use for making and receiving SMTP connections.
Q5002: How can I arrange to allow a limited set of users to perform a limited set of Exim administration functions? I don't want to put them all in the exim group.A5002: See http://www.chiark.greenend.org.uk/~ian/userv/. Using userv you can arrange (for example) for certain users to be able to invoke mailq or runq or other preset commands as exim (or any other user, as configured) with only userv configuration. If you want to check the particular Exim options available you can easily do it with shell or Perl scripts and userv configuration, and provided you know how to do argument `unparsing' properly in shell or Perl it will be secure.
Q5003: How can I test for a message's size being greater or less than a given value in an expansion string?A5003: This isn't straightforward in versions of Exim prior to 2.10, because there were no arithmetic operators in expansion strings. In version 2.10 or later you can write, straightforwardly,
${if > {$message_size}{10K} {yes} {no}}
In earlier versions, low cunning can be used to achieve certain kinds of test. For example, to test if the message size is less than or equal to 1000000:
${if eq{${expand:\$\{substr_-1000000_$message_size:x\}}} {} {yes} {no}}
Q5004: I want to "tail" the Exim log, but I have a number of other logs I also
want to "tail", and the number of tailing windows is getting to be a
nuisance.
A5004: Look for a program called 'xtail' (despite its name, it's not an X-windows application). It allows you to do multiple tails, even of entire directories.
Q5005: I would like to have Exim log information written to syslog.A5005: Support for this is available from version 3.10 onwards.
Q5006: What does the error "Failed to create spool file" mean?A5006: Exim has been unable to create a file in its spool area in which to store an incoming message. This is most likely to be either a permissions problem in the file hierarchy, or a problem with the uid under which Exim is running, though it could be something more drastic such as your disc being full. Check that you have defined the spool directory correctly by running
exim -bP spool_directory
and examining the output. Check the mode of this directory. It should look like this, assuming you are running Exim as user `exim':
drwxr-x--- 6 exim exim 512 Jul 16 12:29 /var/spool/exim
If there are any subdirectories already in existence, they should have the same permissions, owner, and group. Check also that you haven't got incorrect permissions on superior directories (for example, /var/spool). Check that you have set up the exim binary to be setuid root. It should look like this:
-rwsr-xr-x 1 root xxx 502780 Jul 16 14:16 exim
Note that it is not just the owner that must be root, but also the third permission must be "s" rather than "x".
Q5007: Exim keeps crashing with segmentation errors (signal 11 or 139).A5007: This might be a problem with the db library. See Q0505.
Q5008: Exim's databases keep getting corrupted.A5008: See Q0505.
Q5009: I've been using an autoreply director to try and mimic a bounce message, but I can't get it to have an envelope from of <>.A5009: You haven't, by any chance, put "exim" in the list of never_users, have you?
Q5010: I see entries in the log that mention two different IP addresses for the same connection. Why is this? For example:
H=tip-mp8-ncs-13.stanford.edu ([36.173.0.189]) [36.173.0.156]
A5010: The actual IP address from which the call came is the final one. Whenever there's something in parentheses in a host name, it is what the host quoted as the domain part of an SMTP HELO or EHLO command. So in this case, the client, despite being 36.173.0.156, issued the command
HELO [36.173.0.189]
when it sent your server the message. This is, of course, very misleading.
Q5011: How can I persuade Exim to accept ETRN commands without the leading # character?A5011: Set the option
smtp_etrn_command = /usr/lib/sendmail -R $domain
This causes Exim to run that command, with $domain replaced by the argument of ETRN. The default action of Exim is to require the # sign in order to be RFC-compliant, and to run the equivalent of
smtp_etrn_command = /usr/lib/sendmail -R ${substr_1:$domain}
which uses the argument without the leading # as the value for the -R option. You aren't restricted to running Exim with the -R option, of course. You can specify any command you like, with any number of arguments. In particular, you can pass over the IP address of the caller via $sender_host_address. However, if you make use of expansion strings in the arguments, each one must be entirely contained in a single argument. For example, if you want to remove the first character of the ETRN argument when it is @ or #, you could use
smtp_etrn_command = "/usr/lib/sendmail -R \
\"${if match {$domain}{^[@#]}{${substr_1:$domain}}{$domain}}\""
The internal quotes are necessary because of the white space inside the expansion string.
If you use smtp_etrn_command to run something other than Exim with the -R option, you must disable smtp_etrn_serialize, because otherwise the serialization lock (which is set by default) never gets removed.
Q5012: I've recently noticed that emails I send with a Bcc: line are being delivered to their final destination with the Bcc: line still present.A5012: Exim removes Bcc lines only if you call it with the -t option (i.e. when it is acting partly as an MUA). It does not remove Bcc lines that are present in incoming SMTP mail or command-line mail that does not use -t. Indeed, it should not remove them. From RFC 822:
5.3. BCC / RESENT-BCC
This field contains the identity of additional recipients of the message. The contents of this field are not included in copies of the message sent to the primary and secondary recipients. Some systems may choose to include the text of the "Bcc" field only in the author(s)'s copy, while others may also include it in the text sent to all those indicated in the "Bcc" list.
Only the initiating software (i.e. the MUA) can tell what to do with Bcc; any MTA software has to leave it alone.
Q5013: I used gv v3.5.8 (ghostview) to try printing spec.ps. After every printed page, the printer ejects a blank sheet. Is this something to do with using "letter" rather than A4 paper?A5013: This seems to be an effect of using ghostview. Although the PostScript is generated for A4 pages, the size of the page images is such that they should fit on a letter page (they are shorter than would normally be used on A4 paper). If the PostScript file is sent directly to a PostScript printer, there is no problem. An alternative is to get hold of the "psutils" toolset, which is available from
ftp://ftp.dcs.ed.ac.uk/pub/psutils/psutils.tar.gz
It contains utilities for extracting pages (which can be useful for double-sided printing) and for resizing pages. If you resize from A4 to letter the text shrinks a bit, but should then be printable via ghostview.
Q5014: I would like to have a separate queue per domain for hosts which dial in to collect their mail.A5014: Exim isn't really designed for this kind of operation. The only way to do this would be to cause it to send those messages to a differently configured version of Exim with its own spool area. This could be done via a pipe or SMTP to a private port. The main Exim, listening on port 25, would then be configured to run an appropriate command to prod one of the others when it received ETRN, by means of the etrn_command option.
You could probably manage this with a single Exim binary and a number of different configuration files, passed to the special versions using the -C option. For this application they could all run as exim, since no root privilege would be needed.
An alternative approach id to get Exim to deliver mail for such hosts in batch SMTP format into some directory, and have the ETRN run something to pass such messages to the dialled-in host. See also Q0503 and Q0521.
Q5015: A short time after I start Exim I see a <defunct> zombie process. What is causing this?A5015: Your system must be lightly loaded as far as mail is concerned. The daemon sets off a queue runner process when it is started, but it only tidies up completed child processes when it wakes up for some other reason. When there's nothing much going on, you occasionally see <defunct> processes like this waiting to be dealt with. This is perfectly normal.
Q5016: On a reboot, or a restart of the mail system, I see the message "Mailer daemons: exim abandoned: unknown, malformed, or incomplete option -bz sendmail". What does this mean?A5016: -bz is a Sendmail option requesting it to create a "configuration freeze file". Exim has no such concept and so does not support the option. You probably have a line like
/usr/lib/sendmail -bz
in some start-up script (e.g. /etc/init.d/mail) immedately before
/usr/lib/sendmail -bd -q15m
The first of these lines should be commented out.
Q5017: I would like to restrict e-mail usage for some users to the local machine, ideally on a group basis.A5017: See A9802
Q5018: Whenever exim restarts it takes up to 3-5 minutes to start responding on the SMTP port. Why is this?A5018: Something else is hanging onto port 25 and not releasing it. One place to look is /etc/inetd.conf in case for any reason an SMTP stream is configured there.
Q5019: Why aren't there any man pages for Exim? I don't always carry my printed documentation.A5019: As well as plain ASCII text, the Exim documentation is provided in two online forms - texinfo and HTML - which have a certain amount of built- in indexing for ease of finding your way around. There are no man pages because the author of Exim hasn't the time (or desire :-) to maintain yet another documentation format. Besides, it is hard to know how to split the Exim manual up.
There is a contributed man page for a previous version of Exim in
ftp://ftp.cus.cam.ac.uk/pub/software/programs/exim/Contrib/doc/exim.8
This was written by a previous maintainer of the Debian GNU/Linux Exim package. You can view a nicely formated version at:
http://dwww.jimpick.com/cgi-bin/dwww?type=man&location=/usr/man/man8/exim.8.gz
This contains some introductory text and the command line options only.
Q5020: When I send a message using the -t command line option, Exim sends only to the addresses within the message, not to those on the command line.A5020: By default Exim operates according to the Sendmail documentation, and interprets addresses on the command line as addresses not to send to. You can set
extract_addresses_remove_arguments = false
to change this behaviour. There is some confusion in the Sendmail community about the interpretation of recipient addresses on the command line if the -t option is used.
Here is an except from one version of the sendmail documentation
-t Read message for recipients. To:, Cc:, and Bcc: lines will be scanned for recipient addresses. The Bcc: line will be deleted before transmission. Any addresses in the argument list will be suppressed, that is, they will not receive copies even if listed in the message header.
Earlier versions of the sendmail documentation are ambiguous (unlike the snippet above). Apparently the code and documentation streams resolved the ambiguity differently.
Q5021: If I set up, for example, local_domains = *customer.com, then it matches "customer.com" and "abc.customer.com" as required, but it also matches "noncustomer.com", which is wrong. How can I get round this?A5021: (A) You have to specify two entries in the list:
local_domains = customer.com : *.customer.com
because * in a domain list matches any characters, including "." and including a null sequence.
(B) Alternatively, you could use a regular expression:
local_domains = ^(.+\.|)customer\.com$
but that probably will not be as efficient.
(C) If you have lots of local domains, you could put them into a file to be searched (using lsearch, dbm, cdb, or whatever) and use a partial search such as
local_domains = partial-dbm;/list/of/domains
If the file contains the key *.customer.com then the desired effect is achieved, because partial lookups do operate on a component basis. See the section entitled "Partial matching in domain lists". It is a bit confusing that "*" is used in this context, because its meaning is not the same as when it appears directly in a domain list.
Q5022: I want to match all local domains of the form *.oyoy.org but want a few exceptions. For instance I don't want foo.oyoy.org or bar.oyoy.org to be treated as local. What is the best way to do this?A5022: (A) From release 3.00 onwards, you can put negative items in the local_domains setting, like this:
local_domains = !foo.oyoy.org : !bar.oyoy.org : *.oyoy.org
If there are many exceptions, you can use a lookup instead of listing them all inline.
(B) Otherwise, you can use a regular expression:
local_domains = ^.*(?<!^foo|^bar)\.oyoy\.org$
An alternative formulation that is more efficient in execution (because it doesn't backtrack for .* in cases that don't match) is
local_domains = ^(?>.*$)(?<=\.oyoy\.org)(?<!^(foo|bar)\.oyoy\.org)
If you are using an earlier version of Exim in which the regular expression library does not have lookbehind support (versions prior to 2.051, but after 1.735):
local_domains = ^(?!(foo|bar)\.oyoy\.org$).+\.oyoy\.org$
If you are using a version of Exim that is earlier than 1.735, consider upgrading!
Q5023: I can't seem to find a pre-built version of Exim anywhere. The machine is a Sparc 5 running Solaris 2.6.A5023: The problem is that there are a number of build-time options, requiring the answer to questions like:
. Which DBM library do you have? (On Solaris probably ndbm, but no easy default on some other systems.)
. Which uid/gid do you want to use for Exim?
. Where do you want the configuration file to be? (Many different answers, even on the same OS, depending on local policy.)
. Ditto for the binaries.
. Which optional bits of Exim do you want to include?
... and so on. One could impose a set of values, but I suspect they would probably please nobody.
Q5024: Is there a Windows NT version of Exim available?A5024: A long time ago somebody took a copy of the Exim source with the aim of trying to port it to NT. However, I never heard anything more.
Q5025: Does Exim support Delivery Status Notificaion (DSN), Message Status Notification (MSN), or any other form of delivery acknowledgement?A5025: See A0517.
Q5026: What does "Exim" stand for?A5026: Originally, it was "EXperimental Internet Mailer", which was the best I could come up with when I was starting out. At that point it was experimental - I wanted to see if the ideas I had for extending Smail's approach actually worked. Then somebody discovered about it and wanted to start using it, and told other people about it...
Q5027: What does the log message "no immediate delivery: more than 10 messages received in one connection" mean?A5027: See A0518.
Q5028: Although I haven't set check_spool_space, Exim is still checking the amount of space on the spool for incoming SMTP messages that use the SIZE option. Can I suppress this?A5028: The RFC for the SIZE option says
If the server currently lacks sufficient resources to accept a message of the indicated size, but may be able to accept the message at a later time, it responds with code "452 insufficient system storage".
and that is what Exim is trying to implement. This is entirely independent from check_spool_space, which says "don't accept any mail if there is less than so much space in the spool partition", though the code is optimised to do both checks at the same time if required. However, you can suppress the SIZE check if you want to, by unsetting smtp_check_spool_space.
Q5029: I just noticed log entries that start off "<= <>". Am I correct in assuming that the "<>" indicates that the envelope did not contain any "From" data?A5029: Yes. This indicates a delivery failure report (aka "bounce message"). Here is what RFC 1123 has to say about this:
"If there is a delivery failure after acceptance of a message, the receiver-SMTP MUST formulate and mail a notification message. This notification MUST be sent using a null ("<>") reverse path in the envelope; see Section 3.6 of RFC-821. The recipient of this notification SHOULD be the address from the envelope return path (or the Return-Path: line). However, if this address is null ("<>"), the receiver-SMTP MUST NOT send a notification. If the address is an explicit source route, it SHOULD be stripped down to its final hop."
The reason for using empty sender addresses is to identify bounce messages so that they themselves do not cause further bounces. However, this has made life harder for those that want to check incoming mail for valid senders. It is a pity that some other mechanism (e.g. a keyword on the MAIL command) was not used instead, but it is far too late to change now.
Empty senders are also used for other kinds of report which should not themselves cause the generation of bounce messages. For example, Exim uses them when sending out warnings about delivery delays.
Q5030: I've received a message which does not have my address in the To: line. It is a spam message with the same address in both the From: and the To: headers. How can this happen, and why doesn't Exim reject it?A5030: There is an important distinction between the "envelope" from and to and the "header" from and to. The former are sometimes called the "sender" and "recipient". An email message needs an "envelope" for the same reason that paper mail does - the envelope tells the delivery mechanism what to do with *this copy* of the message, whereas the To: header lists all the recipients, including those who have been sent different copies of the message because their mailbox is on some other host.
An MTA such as Exim normally works entirely with the "envelope" addresses, not with those in the header lines. However, you can specify that it should do some checking of header addresses by setting a number of options whose names begin with headers_.
Don't try to block mail where envelope from and the header from differ. There are common legitimate cases where this happens, for example, messages forwarded from mailing lists and delivery failure reports.
Q5031: Can (or will) Exim ever handle a message delivery purely in memory, that is, it is handled without it ever hitting the disc?A5031: It doesn't, and never will. Accepting and delivering a message are two entirely separate, independent processes, which communicate only by writing/reading the message on the disc.
Q5032: If I am using dbm files for data that Exim reads, can I rebuild them on the fly, or do I need to restart Exim every time I make a change?A5032: Exim re-reads the file every time it consults it, so if you are using a cdb or a DBM library that uses just a single file (i.e. NOT ndbm) then you can just build the new file with a temporary file name, and use "mv" to rename it into the correct place on the fly. If there are two files to rename, there is a window of time during which the DBM database is inconsistent. On lightly loaded systems this may not matter.
Q5033: What are the main differences between using an Exim filter and using procmail?A5033: Exim filters and procmail provide different facilities. Exim filters run at directing time, before any deliveries are done. A filter is like a ".forward file with conditions". One of the benefits is de-duplication. Another is that if you forward, you are forwarding the original message.
However, this does mean that pipes etc. are not run at filtering time, nor can you change the headers, because the message may have other recipients and Exim keeps only a single set of headers.
Procmail runs at delivery time. This is for one recipient only, and so it can change headers, run pipes and check the results, etc. However, if it wants to forward, it has to create a new message containing a copy of the original message.
It's your choice as to which of these you use. You can of course use both.
Q5034: I need an option that is the opposite of -bpa, that is, a listing of those addresses generated from a top-level address that have not yet been delivered.A5034: Exim does not keep this information. It saves only the top-level addresses and the list of addresses that are finished with. At each delivery attempt, generated addresses are recomputed from scratch. This makes it possible to correct errors in .forward and alias files that are causing delivery delays. However, there is an option you can set on an aliasfile or forwardfile director that changes things. It is called one_time, and if it is set, the list of generated addresses gets added to the top-level list at the first delivery attempt, and is never regenerated. Because top-level address lists must be real email addresses, this option cannot be used if any of the generated addresses are pipes, files, or autoreplies.
Q5035: I am getting complaints from a customer who uses my EXIM server for relaying that they are being blocked with a "Too many connections" error.A5035: See smtp_accept_max and related options such as smtp_accept_reserve.
Q5036: When I try "exim -bf" to test a system filter, I received the following error message: "Filter error: unavailable filtering command "fail" near line 8 of filter file".A5036: Use the -bF option to test system filters. This gives you access to the freeze and fail actions.
Q5037: How can I make Exim receive incoming mail, queue it, but NOT attempt to deliver it? I want to be in this state while moving some mailboxes.A5037: (1) Set queue_only in the Exim configuration. (2) Kill off your daemon, and restart it without the -q option (i.e. with just the -bd option), so that it does not spawn any queue runners. This stops all deliveries, remote as well as local. To stop just local deliveries, assuming that none of your routers are configured to send messages directly to a local transport, make this your first director:
defer_all:
driver = smartuser
new_address = :defer:
When you are ready to go again, remove that director and do a -qf run to override the retry times. This solution works from release 3.10 onwards. In earlier releases an aliasfile director must be used because :defer: was not available for use in smartuser.
Q5038: What does the rejection message "reject all recipients: 3 times bad sender" mean?A5038: See the section of the manual entitled "Sender verification". Exim has failed to verify a sender from the same host 3 times within a period of 24 hours.
Q5039: The menu in Eximon isn't working. It displays, but I can't select anything from it.A5039: On some X implementations, if the numlock key is pressed (so that the numeric keypad is working) then the menu didn't work properly in versions of Eximon before Exim release 3.10. The problem is an infelicity in the particular implementation of X. A workaround was introduced at release 3.10, so this problem should no longer be encountered.
Q5040: What does "ridiculously long message header" in an error report mean?A5040: There has to be some limit to the length of a message's header lines, because otherwise a malefactor could open an SMTP channel to your host, start a message, and then just send characters continuously until your machine ran out of memory. (Exim stores all the header lines in main memory). For this reason a limit is imposed on the total amount of memory that can be used for header lines. The default is 1MB, but this can be changed by setting HEADER_MAXSIZE in Local/Makefile. Exceeding the limit provokes the "ridiculous" error message.
Prior to release 3.022 Exim used two separate limits, one on the length of an individual header line and one on the total number of header lines. A header line longer than 8192 used to provoke the error "Header line is ridiculously overlong". In subsequent releases there is no limit on individual header lines; only the total header size matters.
Q5041: What does Exim use for POP as a default? Do I have to install anything else?A5041: Yes. Exim provides MTA functionality. That is, it delivers mail. POP is one of several ways of reading previously-delivered mail. Exim does not provide that functionality.
Q5042: I see that Exim doesn't support SSL. Can it be made to work with stunnel?A5042: From release 3.20, Exim does support SSL/TLS, by making use of the OpenSSL library.
The problem with using stunnel is that all your SSL connections look like they come from 127.0.0.1 - none of your IP based policies will have any effect. This means that you are basically an open relay, anyone who connects to your server via SSL can relay through you, whether they are local or not (and who knows, spammers may someday evolve brains enough to try using SSL ports).
One solution to this is to force all SSL connections to authenticate before relaying. This is how one user has done this:
First make sure you are set up to do SMTP AUTH properly (see the sample configuration C034). Then add MUSTAUTH to the auth_hosts line in your configure file. If you don't already have a list of IPs there, it will look like this:
auth_hosts = MUSTAUTH
If you have some IPs you want to authenticate, add them like this:
auth_hosts = MUSTAUTH:10.1.1.1:10.1.1.2
Then invoke stunnel like this:
/usr/local/sbin/stunnel -d 465 -l /usr/exim/bin/exim \
-p /usr/local/ssl/certs/exim.pem -- exim -bs -DMUSTAUTH=127.0.0.1
Whenever an SSL connection is established, Exim is invoked with the macro MUSTAUTH defined as 127.0.0.1, which forces that one particular instance to authenticate, without disrupting normal 127.0.0.1 operations via non-SSL sessions.
Q5043: Is there an easy way of removing all queued messages at once in a safe way?A5043: Try this command:
exim -bp | awk '/^ *[0-9]+[mhd]/{print "exim -Mrm " $3}' | sh
Q5044: What is the best way to provide backup MX for clients?
A5044: If the clients are always online, all you need to do is to have MX records for their domains pointing to your host, with suitable preference values, and ensure that their domains are listed in relay_domains. If the clients are not always online, see Q1403.
Q5045: Why does Exim do "ident" callbacks by default? Isn't this just a waste of resources? I've been told this is an ancient way of authentication. Is it obsolete?A5045: This is a common mistake, at least partially resulting from the incorrect naming of the protocol when it was first published. The service on port 113 is an identification service, which allows a target host to record information identifying the user responsible for making a connection to it. The information may not be intelligible to the recording host - it could, for example, be encrypted so that only someone on the calling host can make sense of it. It is useful for providing additional information in an audit trail.
The data should not be used for authentication in any form except on a closed secure network between cooperating hosts (probably not even then). The information from the source host is only as reliable as the host itself - if it's not under your control then you have to treat the information as opaque data that can be used by the sysadmin of the source system to trace back connection data - and some ident implementations send out opaque cookies or DES encrypted information. Ident is hugely useful at times - especially for checking back on connections from multiuser machines (as opposed to one-person desktop boxes).
You can stop Exim making ident calls by adding
rfc1413_query_timeout = 0s
to its configuration, but it is better to leave it active (reducing the timeout if it is causing problems) - it costs very little, and in cases of mail forgery from a multiuser system can track the sinner concerned very quickly.
Q5046: I often have the problem that a message gets stuck in the mailq and I want it to be bounced to a certain address.A5046: You can do this using a combination of four command line options, like this:
exim -Mf 14Fdlq-0003kM-00
exim -Mmad 14Fdlq-0003kM-00
exim -Mar 14Fdlq-0003kM-00 new@ddress
exim -M 14Fdlq-0003kM-00
The first command freezes the message so that a queue runner won't start to deliver it while you are changing things. The second command marks all existing recipients as delivered. The third command adds a new recipient, and the fourth command forces a delivery of the message, which will cause it to be delivered to the new address, and then deleted.
Q5047: What precautions should I take when editing exim.conf?A5047: Edit exim.conf to exim.conf.new. Then run
exim -bV -C exim.conf.new
That will check for syntax errors without disturbing your running configuration. If you are paranoid enough, as root run
exim -C exim.conf.new <some address>
<some message>
.
and see if it delivers it. Carry on testing until happy. When happy,
mv exim.conf.new exim.conf
kill -HUP `cat /var/spool/exim/exim-daemon.pid`
Then check the Exim log to be sure the daemon restarted OK. Watch the log for a bit to see that mail is flowing.
Q5048: Is exim able to use RFC 2645, On-demand Mail Relay (ODMR)?A5048: No.
Q5049: I want to send every bounced mail that is received by my server, as "headers-only" to the sysadmin. How can I do this?A5049: 1. Set up a transport with headers_only to do the delivery.
2. Set up a smartuser director that directs messages to a special local alias (e.g. "sysadmin-header") to that transport.
3. Set up a system filter file, containing something like
if first_delivery and error_message then
unseen deliver sysadmin-header@your.domain
endif
Q5050: What POP3 daemon should I use with Exim? I want something with
configurable authentication mechanisms.
A5050: Qmail-pop has a checkpasswd part that can be hacked to add whatever authentication you want. There is also Solid POP which has a lot of Exim support in it (e.g. nhash). There is also Cyrus, which is self-contained, so you don't have to worry about ownership of mailboxes and also it can be poked into authenticating from just about anything. However, in general, YMMV, and really what suits one user may not suit another. There is a mailing list at pop-imap@exim.org for the discussion of POP/IMAP issues. More information can be found in its archives.
Q5051: Is there any way I can send bounces to the postmaster, and nobody else? Basically, I want to recieve them, and I don't want the reply/from person to get them. If I think they need it I will forward it myself.A5051: Put errors_to=postmaster on every router and director.
(Bundled) cc: "buildconfig.c", line 54: error 1705: Function prototypes
are an ANSI feature.
A9301: The bundled compiler is not an ANSI C compiler. You either have to get a copy of gcc from the HPUX Software Porting Archives or buy the ANSI cc from HP. The advice given by one user of HP systems on the Exim mailing list was as follows:
"Personally, I wouldn't use anything but the ANSI C compiler. gcc works for compilation, but it doesn't know squat about PA-RISC chips past the 1.0 rev. Since then, HP has come out with PA-RISC 1.1, 2.0, and 2.1, each with better features. gcc will compile for them, but it doesn't produce anywhere near the optimization that HP's compiler does.
I took the gcc road when we moved from FreeBSD to HP-UX because I was familiar with it. After 6 months, I had to go and re-port everything over when we realized that gcc wasn't going to do it for us long-term. If I could give advice to any new HP-UX admin: don't use gcc if you can afford the ANSI C compiler. Based on the cost of even the lowest HP workstation, that usually isn't a problem."
./exim: can't load library 'libperl.so'
A9401: You probably compiled perl5 yourself, without looking into
/usr/src/contrib/perl5/perl5.004_02/hints/bsdos.sh
first. The problem is that the command
perl5 -MExtUtils::Embed -e ldopts
doesn't give you sufficient flags to link something with libperl. Since 5.004_02 the hints/bsdos.sh file has changed to adapt to the changes between BSDI 3.1 and 4.0, but it is still not entirely right.
The solution is, when you compile perl, change the "ccdlflags" variable in config.sh to:
-rdynamic -Wl,-rpath,/usr/local/lib/perl5/5.00502/i386-bsdos/CORE
(or something similar). Alternatively, you can run ./Configure and answering the question "Any special flags to pass to cc to use dynamic loading?" with the above line. It is not known what -rdynamic means (it's not apparently documented in any man page), but that's what BSDI guys did to compile perl5 which comes with BSDI 4.0 distribution.
A9501: This problem was fixed in Exim release 2.03. If you are running an earlier version you should use the local_interfaces option to specify all your IP addresses explicitly.
Q9502: The IP addresses for incoming calls are all being given as 255.255.255.255 or 0.0.0.0.A9502: From release 3.21, Exim contains a workaround that should fix this problem. If you are using an earlier release, read on...
If you used the gcc compiler 2.8.x or a version in the 2.95 series, there is a known bug with the "gethost" function under Irix. SGI recommends using either their cc compiler in Irix 6.5, or a lesser version of the gnu compiler. Version 2.7.2.3 is known to work. Alternatively, there is an Inst-able port of Exim for Irix at http://freeware.sgi.com, but it is not likely to be the latest release. There is further information about this problem, which is described as a "classic gcc structure-in-a-register bug" at this URL:
http://www.ccp14.ac.uk/ccp14admin/apache13/apache255error.html
This is a summary that I was sent:
"Gcc does not correctly pass/return structures which are smaller than 16 bytes and which are not 8 bytes. The problem is very involved and difficult to fix. It affects a number of other targets also, but irix6 is affected the most, because it is a 64 bit target, and 4 byte structures are common. The exact problem is that structures are being padded at the wrong end, e.g. a 4 byte structure is loaded into the lower 4 bytes of the register when it should be loaded into the upper 4 bytes of the register."
A9601: This has been seen in cases where Exim has been incorrectly built with a muddled combination of an ndbm.h include file and a non-matching DBM library.
Faults like this have also been seen on systems with faulty motherboards. You could try to compile the Linux kernel 10 times - if the compile process stops with signal 11, your hardware is to blame.
Q9602: Exim has created a directory called build-Linux-libc5-i386 but is trying to reference build-Linux-libc5-i386-linux while building.A9602: You have several shells installed, which are setting conflicting values in the HOSTTYPE environment variable that is used to construct the name of the build directory. One way round this is to run this command:
ln -s build-Linux-libc5-i386-linux build-Linux-libc5-i386
This problem should no longer be encountered in release 3.10 or later. Exim has been changed to get the host type from the "uname" command preferentially.
Q9603: I want to use logrotate which is standard with RH5.2 Linux to rotate my mail logs. Anyone worked out the logrotate config file that will do this?A9603: Here's one suggestion:
/var/log/exim/main.log {
create 644 exim exim
rotate 4
compress
delaycompress
}
The sleep is added to allow things to close the log file prior to compression. You also need similar entries for the panic log and the reject log, of course.
Q9604: I'm seeing the message "inetd[334]: imap/tcp server failing (looping), service terminated" on a RedHat 5.2 system, causing imap connections to be refused. The imapd in use is Washington Uni vers 12.250. Could this be anything to do with Exim?A9604: No, it's nothing to do with Exim, but here's the answer anyway: there is a maximum connection rate for inetd. If connections come in faster than that, it thinks a caller is looping. The default setting on RedHat 5.2 is 40 calls in any one minute before inetd thinks there's a problem and suspends further calls for 10 mins. This default setting is very conservative. You should probably increase it by a factor of 10 or 20. For example:
imap stream tcp nowait.400 root /usr/sbin/tcpd /usr/local/etc/imapd
The rate setting is the number following "nowait". This syntax seems to be specific to the Linux version of inetd. Other operating systems provide similar functionality, but in different ways.
Q9605: I get the "too many open files" error especially when a lot of messages land for majordomo at the same time.A9605: The problem appears to be the number of open files the system can handle. This is changable by using the proc filesystem. To your /etc/rc.d/rc.local file append something like the following:
# Now System is up, Modify kernel parameters for max open etc.
if [ -f /proc/sys/kernel/file-max ]; then
echo 16384 >> /proc/sys/kernel/file-max
fi
if [ -f /proc/sys/kernel/inode-max ]; then
echo 24576 >> /proc/sys/kernel/inode-max
fi
if [ -f /proc/sys/kernel/file-nr ]; then
echo 2160 >> /proc/sys/kernel/file-nr
fi
By echoing the value you want for file-max to the file file-max etc., you actually change the kernel parameters.
Q9606: I'm having a problem with an Exim RPM.A9606: Normally the thing to do if you have a problem with an RPM package is to contact the person who built the package first, not the person who made the software that's in the package. You can usually find out who made a package using the following command:
rpm --query --package --queryformat '%{PACKAGER}\n' <rpm-package-file>
where <rpm-package-file> is the actual file, e.g. `exim-3.03-2.i386.rpm'. Or, if the package is installed on your system:
rpm --query --queryformat '%{PACKAGER}\n' <package-name>
where <package-name> is the name component of the package, e.g. `exim'. If the packager is unable or unwilling to help, only then should you contact the actual author or associated mailing list of the software.
If you discover through the querying process that you can't tell who the person (or company or group) is who built the package, or that they no longer exist at the given address, then you should reconsider whether you want a package from an unknown source on your system.
If you discover through the querying process that you yourself are the person who built the package, then you should either (a) contact the author or associated mailing list, or (b) reconsider whether you ought to be building and distributing RPM packages of software you don't understand.
Similar rules of thumb govern other binary package formats, including debs, tarballs, and POSIX packages.
Q9607: I installed debian 2.2 linux on a small 325mb 486 laptop. When I try to test the Mail program, I get the following error: "Failed to open configuration file /etc/exim.conf".A9607: The Debian installation should have given you /usr/sbin/eximconfig, which asks you some questions and then sets up the configuration file in /etc/exim.conf. Try running that (you'll probably need root) and see how it goes. In any case you get a thoroughly commented conf file at the end, which will give you a sample from which to work if you need further modification.
The exim docs in the Debian package are in /usr/doc/exim and the full reference manual is spec.txt.gz
Q9608: I'm getting the error "db.h: No such file or directory" when I try to build Exim under RedHat 7.0.A9608: See Q0113.
A9701: Make sure you are liking with the GNU ld linker and not the system version of ld.
Q9702: How can I get rid of spurious ^M characters in messages sent from CDE dtmail?A9702: CDE dtmail passes messages to Exim via the command line interface with lines terminated by CRLF, instead of the Unix convention of just LF. As Exim is an 8-bit clean program it treats the CR as just another data character. Exim has a command line option called -dropcr which causes it to ignore all CR characters in an incoming non-SMTP message. You should configure dtmail to add this option to the command it uses to call Exim (using the path /usr/lib/sendmail). However, it has been reported that it isn't possible to change this call from dtmail by any official means. An alternative approach is to replace /usr/lib/sendmail by a filtering script which removes the spurious CRs from the input before passing it to Exim.
Q9703: On SunOS 4 Exim crashes when looking up domains in the DNS that have more than 10 A records.A9703: There are Sun library patches to fix this. It is not Exim's problem. For 4.13_U1 the patch is 101558-xx; for 4.1.3 the patch is 100891-xx. From the README: 1054748 ftp, ping dump core when connecting to a host with multiple DNS A records.
An alternative is to build another resolver library - such as the ones that are part of the bind distribution - and explicitly link against those.
Q9704: The menu in Eximon isn't working on my Sun system.A9704: With OpenWindows, if the numlock key is pressed (so that the numeric pad is working) then some menus don't work. This appears to be true for the console and (some) remote X-window servers. A workaround for this problem was introduced in the 3.10 Exim release, so it should no longer be encountered.
Q9705: I am experiencing mailbox locking problems with Sun's mailtool used over a network.A9705: Under the "Expert" settings of mailtool is a option to turn on "Use network aware mail file locking". By default dtmail has this set, but mailtool doesn't. You should set it. The help info on dtmail has this to say about it:
"Mailer tries to prevent two different instances of itself from opening the same mail file at the same time through a technique that detects this access when both instances of Mailer and the file are all on the same machine. A network-aware mail file locking protocol is available that uses ToolTalk to coordinate instances of Mailer running from more than one machine, or mail files accessed over the network. Mailer can only change this option when first opening a mail file."
If you are using the SunOS4 version of mailtool, this apparently doesn't work. The only thing which does seem to work it getting the user to hit the "done" button to make it release the lock.
Q9706: Exim has been crashing on my Solaris x86 system, apparently while running DBM functions.A9706: The use of ndbm with gcc has caused problems on x86 Solaris systems. Try changing one or the other; using either db 1.85 with gcc, or Sun's WS compiler with ndbm, has fixed this in the past.
Q9707: The exiwhat utility isn't working for me on a Solaris 2 system.A9707: Have you got /usr/ucb on your path? If so, it is probably picking up the wrong version of the ps command. The exiwhat script is built on Solaris to expect the normal Solaris version of ps.
Q9708: How do I stop Sun's dtcm from hanging?A9708: From qmail's FAQ: "There is a novice programming error in dtcm, known as ``failure to close the output side of the pipe in the child.'' Sun has, at the time of this writing, not yet provided a patch."
Q9709: I want Exim to use only the resolver (i.e. ignore /etc/hosts), but don't want to alter the nsswitch.conf file in Solaris 2.A9709: You need to rebuild Exim after fiddling with OS/os.h-SunOS5:
#define gethostbyaddr res_gethostbyaddr
#define gethostbyname res_gethostbyname
#define endhostent res_endhostent
#define endnetent res_endnetent
#define gethostent res_gethostent
#define getnetbyaddr res_getnetbyaddr
#define getnetbyname res_getnetbyname
#define getnetent res_getnetent
#define sethostent res_sethostent
#define setnetent res_setnetent
Exim uses gethostbyname and gethostbyaddr only, but may use others in the future. Note that -lnsl is still needed in the Makefile as it contains code used by the NIS lookup and also the inet_addr function that Exim uses.
A9801: (1) add partial-lsearch;/etc/mail/tpc.domains to local_domains; /etc/mail/tpc.domains is a text file with lines in this format:
9.3.5.1.0.8.1.tpc.int.
This sample line indicates that we accept faxes destined for 1(801)539-*.
(2) Set up the following transport:
tpc:
driver = pipe
command = /usr/local/tpc/tpcmailer.pl ${local_part}@${domain} \
${sender_address}
pipe_as_creator
/usr/local/tpc/tpcmailer.pl is the mail processing script that can be obtained from the TPC distribution.
(3) Set up the following director:
tpc_director:
driver = smartuser
transport = tpc
domains = partial-lsearch;/etc/mail/tpc.domains
Of course, there are other things to do as well before your system is a functioning TPC server.
Q9802: How do I configure Exim so that it sends mail to the outside world only from a restricted list of our local users?A9802: There are several possible ways that this can be done.
(A) You can restrict the senders directly by putting a setting such as this one on all the drivers that route to the outside (usually this is just the final lookuphost router):
senders = :^[^@]+@(?!${rxquote:your.domain}\$):\
lsearch;/permitted/senders
The first item in this list is empty, to match the empty sender. This is necessary because bounce messages have null senders. The second item is a regular expression that matches any address whose domain is not your domain. This caters for cases when mail from an external user has arrived for a local user who has forwarding set up to some outside address.
If the first two items do not match (that is, the address is in your domain) the sender is looked up in a file of permitted senders; each item in the file must be a complete address, including the domain. If the sender is unacceptable, an "unrouteable mail domain" error will occur because the router won't run, and there are no more to try.
(B) If your local users are in many domains, it may be easier to use a condition option to test the domain and local part independently, along these lines:
condition = \
${lookup{${domain:$sender_address}}lsearch{/domain/list}\
{\
${lookup{${local_part:$sender_address}}lsearch\
{/permitted/senders}{yes}{no}}\
}\
{yes}}
Obviously other means of testing the domain and local part could be substituted, for example, by having separate files of valid local parts for each local domain.
(C) If your local users are logged in to your host, you could use a special group for those that are permitted to mail to the world. Assuming your groups are defined in /etc/group you could arrange to look up the group in that file and then check that the sender was in the group,using something along these lines:
condition = \
${lookup{groupname}lsearch{/etc/group}\
{${if match {$value}\
{[:,]${rxquote:${local_part:$sender_address}}(,|\$)}\
{yes}{no}}}{no}}
This is checking the local part of the sender; a alternative might be to check $sender_ident. However, you should really also check that $sender_host_address is either unset or set to 127.0.0.1 or your IP address, so you check only locally-originated mail.
A block like this does not prevent a logged in user from sending mail by telnetting to another host's SMTP port, or indeed from installing a private version of Exim to do the job for her.
(D) On a gateway server that has no local users and so receives all the mail via SMTP from client hosts, you could use a rewriting rule to rewrite sender addresses in your local domain from a table of legal local parts, replacing any illegal addresses with an address such as unknown@your.domain. If this is combined with sender_verify=true it causes messages from users that are not in the table to be refused, assuming that the gateway is capable of verifying the local part of user@your.domain.
Q9803: How do I configure Exim to run with SmartList?A9803: This is what was done for Exim's own mailing list, using SmartList/ procmail 3.11pre7. It runs as its own user - trying to manage mailing lists under your own ID can be hard work. Smartlist is installed into /var/spool/slist, and there is an slist user defined. Each list appears as a directory under /var/spool/slist (as per usual for Smarlist). Exim is configured like this:
# slist added to list of trusted users so it can
# manipulate sender addresses
trusted_users = exim:slist
# in transports, a list transport is defined:
list_transport:
driver = pipe
command = /var/spool/slist/.bin/flist \
${local_part}${local_part_suffix}
current_directory = /var/spool/slist
home_directory = /var/spool/slist
user = slist
group = slist
# in directors a list director is defined:
list_director:
driver = smartuser
suffix = -request
suffix_optional
local_parts = !.bin:!.etc
require_files = /var/spool/slist/${local_part}/rc.init
transport = list_transport
and thats it - no aliases, no special handling of out lists etc. What you do need is to ensure that choplist is used for distribution (that is, do not uncomment the alt_sendmail entry which is blank).
A couple of other things are forced - for example since the list runs in its own domain the domain value is forced to exim.org.
Then everything else is basic SmartList configuration - and that's moderately well documented. A confirmation stage on signup was added - now when you subscribe you are sent a confirmation which you must return before the system subscribes you (this prevents people subscribing their "friends" and makes sure that the addresses really do work). The confirm package is available at:
ftp://ftp.fatfree.com/confirm-1.1.tar.gz
and was written by Michelle Dick.
Q9804: How do I configure Exim to minic PP's "tripnote" facility?A9804: See C005.
Q9805: How do I configure Exim to handle local parts with extensions?A9805: See C010.
Q9806: How do I configure Exim so that only a restricted list of users can receive mail from external domains?A9806: See C013.
Q9807: I have someuser@mydomain.com that I only want certain users to be able to mail to. How do I accomplish this?A9807: This is a transport:
bounce:
driver = autoreply
from = postmaster@mydomain.com
to = $sender_address
user = exim
subject = "Re: Your mail to ${local_part}"
text = "You are not allowed to mail to ${local_part}."
This is a director that should come before all the others:
special_user:
driver = smartuser
local_parts = someuser
transport = bounce
senders = !: !lsearch;/list/of/permitted/senders
Note that leading "!:" in senders. It allows the null sender <> to be valid (i.e. not to match this director). This is necessary, since bounce messages have null senders. All other permitted senders must be in the file as complete addresses, including a domain.
Q9808: A site for which I provide secondary MX is down for some time. Is there a way to run the queue for that destination separately from the main queue?A9808: No, because Exim does not have the concept of "the queue for that destination". It simply has a single pool of messages awaiting delivery (and some of them may have several destinations). The best approach to this is to arrange for all messages for the site to be saved somewhere other than the main spool, either on a separate dedicated MTA, or in BSMTP files. There is an example of the latter approach in C014.
Q9809: How do I implement VERP (Variable Envelope Return Paths) in Exim?A9809: See C017.
Q9810: I'd like to make a copy of all outgoing messages to a local mailbox. Is there a solution for this using an Exim filter?A9810: The following filter makes a copy of every message, except for delivery failure reports:
# Exim filter
# Ignore error messages
if error_message then finish endif
# Copy if this is the first delivery attempt
if first_delivery then
unseen deliver copy@your.domain errors_to postmaster@your.domain
endif
The keyword "unseen" stops this being a "significant delivery", so that the message goes on to be delivered as normal. The errors_to setting changes the envelope sender on the copy so that if there is a problem delivering it, the bounce message is sent to postmaster.
You can add to the condition setting to select specific messages. To make a copy of outgoing messages only requires a definition of "outgoing". Because a message may have many recipients, simply testing for your own domain in both the From: and the To: headers is not enough. You can craft your own conditions, but here is one suggestion:
if $h_from: contains your.domain and
foranyaddress $h_to:,$h_cc:
($thisaddress does not contain your.domain)
then
unseen deliver copy@your.domain errors_to postmaster@your.domain
endif
This takes copies of messages whose From: header contains your.domain and whose To: and Cc: headers contain at least one address that does not contain your.domain. See also Q9817.
Q9811: I want to make a copy of outgoing messages to a specific file for each user in a specific directory, using a "save" command in a system filter. How can I arrange for Exim to write to these files under the correct UID/GID?A9811: You need to set up a special transport and tell Exim to use it for file deliveries from the system filter. Add the following setting to your configuration:
message_filter_file_transport = copy_transport
Then define copy_transport like this
copy_transport:
driver = appendfile
delivery_date_add
envelope_to_add
user = ${local_part:$sender_address}
This assumes that you want to run the delivery under the uid associated with the local part of the sender address. Alternatively, you could just use user=exim and do all the writing under the same UID/GID.
Q9812: How can I keep an archive of all mail for some specific local email addresses?A9812: You could use a system filter, along the lines of
if
first_delivery and <tests for appropriate addresses>
then
unseen save
/mail/archive/${substr_0_10:$tod_log}
endif
That would create a new file for each day. However, in order to use this, you will need to set message_filter_file_transport to point to an appropriate transport which includes a setting of "user" to specify which uid to run the saving under, as is described in Q9811.
Q9813: How can I configure Exim to provide a vacation message when there are no local users on my mail hub?A9813: See C019.
Q9814: We want to be able to temporarily lock out a user by disabling the password and moving the home directory to another place. How can we arrange to reject mail for users in this state?A9814: Change the home directory pointer in the passwd file to something distinctive. For example, we use /home/CANCELLED for cancelled users. Then you can pick up such users with this director, which is placed immediately after system_aliases:
cancelled_users:
driver = localuser
transport = cancelleduser_pipe
fail_verify
match_directory = /home/CANCELLED
This sends messages for cancelled users to the following special transport:
cancelleduser_pipe:
driver = pipe
command = "/opt/exim/util/cancelleduser.sh"
ignore_status
return_output
user = nobody
The script simply generates a message saying that the user is cancelled on its standard output. This gets returned to the original message sender in an error report.
If you don't want to change the home directory in the passwd file, an alternative is to check for the non-existence of the home directory with
require_files = +!$home
instead of setting match_directory.
Q9815: I need an alias, say "fakeaddress" that should receive a message, strip all reply-to: headers present, substitute another one pointing to "otheraddress" and forward a message to "realaddress".A9815: Add this director:
fakeaddress_director:
driver = smartuser
domain = (if necessary to restrict the domain)
local_parts = fakeaddress
headers_remove = reply-to
headers_add = reply-to: otheraddress
new_address = realaddress
If there are several of these aliases then you could list them in a file along with the corresponding other addresses, and use lookups instead of the fixed values shown above.
Q9816: How can I set up Exim to work with Listar?A9816: See http://www.cs.huji.ac.il/~vadik/listar-exim/.
Q9817: I need to take copies of all incoming and outgoing mail for certain users. For each user there may be a different monitoring address.A9817: You can adapt the filter solution given in Q9810 by adding a test for the relevant local parts. Create a file containing lines like this:
user1@domain1: monitor1@monitor.domain1
user2@domain2: monitor2@monitor.domain2
and then use the following command in a system filter:
if ${lookup{$sender_address}lsearch{/some/file}{$value}{}} is not ""
then
unseen deliver ${lookup{$sender_address}lsearch{/some/file}{$value}}
errors_address = postmaster@your.domain
else
if foranyaddress $recipients
(${lookup{$thisaddress}lsearch{/some/file}{$value}{}} is not "")
then
unseen deliver ${lookup{$thisaddress}lsearch{/some/file}{$value}}
errors_address = postmaster@your.domain
endif
endif
It is messy to have to repeat the lookups, but it won't be inefficient, because Exim caches the results of successful lookups.
Q9818: How can I add a disclaimer to the end of every message?A9818: See Q1501.
Q9819: I would like to append a simple advertisement text to all outgoing and local mails.A9819: See Q1501.
Q9820: How can I configure Exim so that all mails adressed to something@username.domain.net get delivered to /var/spool/mail/username?A9820: There are several possibilities, depending on exactly how you are set up. Here is one approach: First, arrange that all the domains you are interested in are local domains, for example, by listing them in a file:
local_domains = /list/of/domains
If there are lots of them, a DBM or cdb file should be used for a faster lookup. Assuming that "username" is set up as a user on your system, and you have a configuration that can handle username@domain.net in the normal way, all you have to do is to arrange to convert the recipient address by means of a smartuser director like this:
user_in_domain:
driver = smartuser
domains = /list/of/domains
new_address = ${if match{$domain}{^([^.]+)\\.domain\\.net\$}{$1}fail}@domain.net
This should be the first director.
Q9821: How do I get exim not to add a Sender: header to locally originated mail?A9821: It only adds it if the From: header doesn't correspond to the user sending the message. From release 3.14 onwards, you can suppress this by setting no_local_from_check. Alternatively,
(1) You can get it removed later, by putting
headers_remove = Sender
on all your transports. This doesn't test for locally originated mail, but you could use a more complicated expansion string to make that test. For example
headers_remove = ${if eq{$sender_host_address}{}{Sender}}
which removes it only if there is no sending host address.
(2) If your real question "how do I submit mail from UUCP without it adding Sender:?" Then see Q0603.
Q9822: How can I get Exim to work with mailman?A9822: The configuration in http://www.exim.org/howto/mailman.html was used for the Exim mailing list before it switched to SmartList.
Q9823: Is there any way to have messages sent to a specific local address delayed by - say - 24 hours?A9823: Using Exim 3.10 or later, the answer is "yes". Set up a smartuser director like this:
delay:
driver = smartuser
domains = the.domain
local_parts = thelocalpart
condition = ${if < ${$message_age}{86400}{yes}{no}}
new_address = :defer: message not old enough
Of course, this will also have the effect of setting a retry time for the address. You may want to set a special retry rule for it.
Q9824: I have a mailing list exploder on one host, and three other hosts where I want to do the actual deliveries from. How can I get Exim to split a message into groups of recipients between the three hosts?A9824: Splitting into groups of recipients can be done by setting max_rcpt in the SMTP transport. Persuading Exim to spread the groups between three hosts is a little harder. Suppose you have 300 addresses, and max_rcpt is set to 100. One approach is to try hosts_randomize in a domainlist router, like this:
split:
driver = domainlist
transport = remote_smtp
hosts_randomize
route_list = * hostA:hostB:hostC byname
Unfortunately, this doesn't work quite as you might expect. There are six different permutations of the host list, and so if the randomizing works perfectly, Exim will end up with
50 addresses routed to hostA:hostB:hostC
50 addresses routed to hostA:hostC:hostB
50 addresses routed to hostB:hostC:hostA
50 addresses routed to hostB:hostA:hostC
50 addresses routed to hostC:hostA:hostB
50 addresses routed to hostC:hostB:hostA
Although a total of 100 addresses have hostA as their first host, Exim will still send them in two separate SMTP calls, because it can only batch up addresses that have identical host lists. If hostA is down, it will send 50 of these to host B and 50 to host C. It will aways send six copies of the message.
With only three hosts, this isn't a major problem, but if the number of hosts increases, it becomes more serious. If there are four delivery hosts, there are 24 different permuations, and with five hosts there are 120, so 120 messages are sent. When the hosts are not all of the same power, you might want to use a list like
hostA:hostA:hostA:hostB:hostB:hostC
to send more to hostA, and this makes the situation worse. There is, however, a way to solve this. Instead of putting the host list on the router, put it on the transport. The router just contains one host:
split:
driver = domainlist
transport = special_smtp
route_list = * hostA byname
and the transport has the full list, set to override the router's host:
special_smtp:
driver = smtp
hosts = hostA:hostA:hostA:hostB:hostB:hostC
hosts_override
hosts_randomize
max_rcpt = 100
Now all 300 addresses are routed to the same host, so they are sent to the transport 100 at a time. The transport overrides the router's host with its own list, which it randomizes each time. (This works only for releases of Exim after 3.16 - up to and including that release, there is a bug that prevents it re-randomizing for each group.) See also C040.
Each sample configuration is held in a separate file in the config.samples directory. Those with names of the form Cnnn are Exim configurations; those with names of the form Fnnn are filter file fragments.
C001: "This config will support delivery across multiple systems using NIS to look up delivery addresses from the mail.aliases database."
C002: "Although exim not intended for use in UUCP environment (it doesn't know anything about bang!path addresses), I'm successfully using it for delivering mail to UUCP clients."
C003: "I've read down through Q0601 and your request for UUCP examples. Here's how I'm doing it." (This example uses routers.)
C004: "Here's a BSMTP over UUCP [configuration] - the transport is Taylor/GNU UUCP - which takes the long option types." (This example uses directors.)
C005: "I am using a virus scanner program that is invoked by a pipe, scans the mail and re-invokes Exim to do the delivery. The pipe is invoking a perl script that tries to unpack and MIME, zip and other archives and then applies the McAfee scanner on the results."
C006: "This is how I have configured a PP-inspired vacationnote, there is (was?) such a feature in PP. The user makes a file "tripnote" in his/her home directory, the message is passed to the sender once with a short leading text."
C007: "If I host a domain foo.dom on my machine as a virtual domain I expect it to be completely virtual and separate from other mail domains that end up on my machine."
C008: "And of course it is possible to do a very interesting solution to this [virtual domains] using LDAP."
C009: "These are suggested parts of a configuration for looking up users in /etc/passwd.domain rather than in /etc/passwd ..."
C010: "One of our customers is looking for us to support addresses of the form username+extension@domain.com, primarily for use with procmail."
C011: "Thanks to Philip and others I now have my ISP style config built and therefore am posting the final configuration fragments to the list in case anyone else wants to do a similar thing."
C012: "I've written a small chapter how-to configure Exim for use with UUCP (mostly condensed from the exim-user mailing list plus some experimenting) and would be glad if it could be included in the Exim documentation."
C013: "I've take some tips from the FAQ about permitting only certain users to send to external mail and came up with my own for the receiving part."
C014: "If I have a situation where a site I MX for has a known outage I stash all their mail into a directory in BSMTP format."
C015: "This approach to virtual domains has helped me a great deal, and is so easy to maintain (add and modify as appropriate)."
C016: "Herewith my configuration." (A complete configuration, including simple virtual domains, along the lines of C015).
C017: "I have gotten the new VERP feature of Exim 2.054 working in test, along with some supporting programs to handle bounces that do come back."
C018: "This Majordomo configuration removes a lot of the aliases, and automates a lot of the other functions based on whether the files or directories exist."
C019: "The following configuration file entries can be used to provide a 'vacation'-style function for a mailhub which has no local users."
C020: "I was asked for a copy of the programs we were using to mail everybody."
C021: "Here is some sample code that might be useful for handling X-Failed-Recipients headers generated by Exim, with mailing lists."
C022: "This is the Exim configuration file of a machine which delivers mail to several local domains where the mail is delivered locally, several hairy domains, handled as described below, and a half-virtual domain, which is first processed by its special alias file, then processed as other local domains (including the processing by the global alias file)."
C023: A Perl script and instructions for hooking it into Exim in order to handle disposition-notification-to and return-receipt-to by using a shadow transport to send copies of delivered messages to the script.
C024: "In case anybody wants to use a MySql database to store aliases this is how I managed to get my site working."
C025: "As promised here is the way I got Exim to delver to Cyrus mailboxes if the user exists in the MySql database."
C026: "The following configuration and program will allow messages going to AOL only, to be filtered thru a Perl script. This Perl script will convert any URL's to the HTML syntax. In addition, the transport will use VERP to send a unique envelope sender with each message."
C027: "This is an FYI to demonstrate how to have exim work with SSL using the stunnel wrapper and its underlying OpenSSL libraries and toolkit."
C028: "This Python script reads from stdin and writes to stdout. It strips all the MIME attachments from a mail message that are one of the mime types listed on the command line. Exim can use it in its configuration file, for example, as follows:"
C029: "The standard way to connect one's MTA to a list manager seems to be to add a set of aliases for every list one creates. Once upon a time, I crufted a set of configs from Smail to work with majordomo, to automaticaly recognize the standard patterns, for all lists in existence...I have setup a set of transports and directors for Exim, which will do the same thing for mailman."
C030: "I am currently configuring an exim for a site that will to mail hosting for several domains. I want the domain holders to have control over 'their' alias files, being able to create their own aliases. However, I don't want them to have postmaster, abuse and other role accounts under their control."
C031: "These are config file snippets for handling certain remote addresses as local, and making only real external addresses visible to users."
C032: "This is the Exim Nervous Mailbox Quota Suite. It does not impose hard quotas on users' mailboxes, but it makes a user nervous by putting all his mail in a secondary mailbox, inaccessible to the user, when he is over his quota. When the user clears his mailbox (i.e., deletes mail to make his mailbox below the quota again), mail from his secondary mailbox is transferred back to his primary mailbox, in FIFO order."
C033: "Here's our current automatic vacation recipe".
C034: "This is a HOW-TO for setting up Exim to support SMTP authentication under different environments, including regular password files, PAM and NIS."
C035: "These configurations enable exim and hylafax (www.hylafax.org) work together, I mean sending fax by email (user@123456.fax)."
C036: "My aim was to have an LDAP-driven system for mail delivery."
C037: An elegant way of using ETRN, which does immediate delivery if the host is online, but saves mail in a BSMTP file after some time on the queue. ETRN then re-injects the mail.
C038: Amavis virus scanning: "Here ya go. This is the config we use... this box is our main MX host then relays it to our real server for delivery."
C039: "For reference, this is how I got PAM authentication from a standard UNIX password database with Eudora 4.3 clients to work on a Debian 2.2 (Intel) system. This configuration assumes that you are using standard UNIX crypt passwords; pam-pwdfile is NOT compatible with MD5 encrypted passwords."
C040: "Exim 3.20 has a feature that allows a large mailing of a single message to be sent to many different relays. This is useful for mailing lists, as it allows the message to be relayed to multiple machines, in groups of 100 addresses, for final delivery."
C041: "Attached you will find a plain text file where I explain how to set up mailman to use virtual environment (single setup for many domains)."
F001: "I thought that the rest of the list may be interested in reviewing our filter as a starting point for their own system message filter."
F002: "... program which refused mail from unknown addresses until they mailed me promising not to spam me ... since I'd already thought through how to do it in Exim, and knew it'd be slightly easier than falling out of bed, I went ahead and did it."
F003: "Here's four checks installed in our system wide filter that knock out a lot of otherwise hard to detect rubbish."
F004: "This is an Exim filter snippet to change locally-generated Message-Id: and Resent-Message-Id: headers to world-unique values."