Improve OpenSSL/GnuTLS; enable DNSSEC for non-smarthost

[exim.git] / src / src / configure.default

diff --git a/src/src/configure.default b/src/src/configure.default
index 1dc9b913d95f93d841d5860344480cdcd2e7e7c7..4209ae8c11a9964f14df78ceb74271e41a3cfd9c 100644 (file)
--- a/src/src/configure.default
+++ b/src/src/configure.default
@@ -225,6 +225,13 @@ never_users = root
 host_lookup = *
 
 
+# The setting below causes Exim to try to initialize the system resolver
+# library with DNSSEC support.  It has no effect if your library lacks
+# DNSSEC support.
+
+dns_dnssec_ok = 1
+
+
 # The settings below cause Exim to make RFC 1413 (ident) callbacks
 # for all incoming SMTP calls. You can limit the hosts to which these
 # calls are made, and/or change the timeout that is used. If you set
@@ -520,6 +527,12 @@ acl_check_data:
                        got $max_received_linelength
           condition  = ${if > {$max_received_linelength}{998}}
 
+  # Deny if the headers contain badly-formed addresses.
+  #
+  deny   !verify =     header_syntax
+         message =     header syntax
+         log_message = header syntax ($acl_verify_message)
+
   # Deny if the message contains a virus. Before enabling this check, you
   # must install a virus scanner and set the av_scanner option above.
   #
@@ -587,6 +600,7 @@ dnslookup:
   ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
 # if ipv6-enabled then instead use:
 # ignore_target_hosts = <; 0.0.0.0 ; 127.0.0.0/8 ; ::1
+  dnssec_request_domains = *
   no_more
 
 
@@ -599,7 +613,7 @@ dnslookup:
 # smarthost:
 #   driver = manualroute
 #   domains = ! +local_domains
-#   transport = remote_smtp
+#   transport = smarthost_smtp
 #   route_data = MAIL.HOSTNAME.FOR.CENTRAL.SERVER.EXAMPLE
 #   ignore_target_hosts = <; 0.0.0.0 ; 127.0.0.0/8 ; ::1
 #   no_more
@@ -719,6 +733,42 @@ begin transports
 remote_smtp:
   driver = smtp
   message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
+.ifdef _HAVE_DANE
+  dnssec_request_domains = *
+  hosts_try_dane = *
+.endif
+
+
+# This transport is used for delivering messages to a smarthost, if the
+# smarthost router is enabled.  This starts from the same basis as
+# "remote_smtp" but then turns on various security options, because
+# we assume that if you're told "use smarthost.example.org as the smarthost"
+# then there will be TLS available, with a verifiable certificate for that
+# hostname, using decent TLS.
+
+smarthost_smtp:
+  driver = smtp
+  message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
+  multi_domain
+  #
+.ifdef _HAVE_TLS
+  # Comment out any of these which you have to, then file a Support
+  # request with your smarthost provider to get things fixed:
+  hosts_require_tls = *
+  tls_sni = $host
+  tls_verify_hosts = *
+  # As long as tls_verify_hosts is enabled, this won't matter, but if you
+  # have to comment it out then this will at least log whether you succeed
+  # or not:
+  tls_try_verify_hosts = *
+  #
+.ifdef _HAVE_OPENSSL
+  tls_require_ciphers = HIGH:!aNULL:@STRENGTH
+.endif
+.ifdef _HAVE_GNUTLS
+  tls_require_ciphers = SECURE192:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1
+.endif
+.endif
 
 
 # This transport is used for local delivery to user mailboxes in traditional