Rename dns_use_dnssec to dns_dnssec_ok.

[exim.git] / doc / doc-txt / experimental-spec.txt

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 0073b07afccee53f9be7d22ff52ad521b190ca5a..8d1ebef13b227d987dabb449566a93aa75c71383 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -2,14 +2,42 @@ From time to time, experimental features may be added to Exim.
 While a feature  is experimental, there  will be a  build-time
 option whose name starts  "EXPERIMENTAL_" that must be  set in
 order to include the  feature. This file contains  information
 While a feature  is experimental, there  will be a  build-time
 option whose name starts  "EXPERIMENTAL_" that must be  set in
 order to include the  feature. This file contains  information

-about experimenatal  features, all  of which  are unstable and
-liable to incompatibile change.
+about experimental  features, all  of which  are unstable and
+liable to incompatible change.
+
+
+PRDR support
+--------------------------------------------------------------
+
+Per-Recipient Data Reponse is an SMTP extension proposed by Eric Hall
+in a (now-expired) IETF draft from 2007.  It's not hit mainstream
+use, but has apparently been implemented in the META1 MTA.
+
+There is mention at http://mail.aegee.org/intern/sendmail.html
+of a patch to sendmail "to make it PRDR capable".
+
+ ref: http://www.eric-a-hall.com/specs/draft-hall-prdr-00.txt
+
+If Exim is built with EXPERIMENTAL_PRDR there is a new config
+boolean "prdr_enable" which controls whether PRDR is advertised
+as part of an EHLO response, a new "acl_data_smtp_prdr" ACL
+(called for each recipient, after data arrives but before the
+data ACL), and a new smtp transport option "hosts_try_prdr".
+
+PRDR may be used to support per-user content filtering.  Without it
+one must defer any recipient after the first that has a different
+content-filter configuration.  With PRDR, the RCPT-time check
+for this can be disabled when the MAIL-time $smtp_command included
+"PRDR".  Any required difference in behaviour of the main DATA-time
+ACL should however depend on the PRDR-time ACL having run, as Exim
+will avoid doing so in some situations (eg.  single-recipient mails).
+

 
 
 OCSP Stapling support
 --------------------------------------------------------------
 
 
 
 OCSP Stapling support
 --------------------------------------------------------------
 

-X509 PKI certificates expire and can be revoked; to handle this, the
+X.509 PKI certificates expire and can be revoked; to handle this, the

 clients need some way to determine if a particular certificate, from a
 particular Certificate Authority (CA), is still valid.  There are three
 main ways to do so.
 clients need some way to determine if a particular certificate, from a
 particular Certificate Authority (CA), is still valid.  There are three
 main ways to do so.


@@ -55,12 +83,13 @@ contents are always valid.  Exim will expand the "tls_ocsp_file" option
 on each connection, so a new file will be handled transparently on the
 next connection.
 
 on each connection, so a new file will be handled transparently on the
 next connection.
 

-Exim will check for a validity next update timestamp in the OCSP proof;
+Exim will check for a valid next update timestamp in the OCSP proof;

 if not present, or if the proof has expired, it will be ignored.
 
 At this point in time, we're gathering feedback on use, to determine if
 it's worth adding complexity to the Exim daemon to periodically re-fetch
 if not present, or if the proof has expired, it will be ignored.
 
 At this point in time, we're gathering feedback on use, to determine if
 it's worth adding complexity to the Exim daemon to periodically re-fetch

-OCSP files and somehow handling multiple files.
+OCSP files and somehow handling multiple files.  There is no client support
+for OCSP in Exim, this is feature expected to be used by mail clients.

 
 
 
 
 
 


@@ -379,7 +408,7 @@ their default locations.
 
 You can now run SPF checks in incoming SMTP by using the "spf"
 ACL condition  in either  the MAIL,  RCPT or  DATA ACLs.  When
 
 You can now run SPF checks in incoming SMTP by using the "spf"
 ACL condition  in either  the MAIL,  RCPT or  DATA ACLs.  When

-using it in the RCPT ACL, you can make the checks dependend on
+using it in the RCPT ACL, you can make the checks dependent on

 the RCPT  address (or  domain), so  you can  check SPF records
 only  for   certain  target   domains.  This   gives  you  the
 possibility  to opt-out  certain customers  that do  not want
 the RCPT  address (or  domain), so  you can  check SPF records
 only  for   certain  target   domains.  This   gives  you  the
 possibility  to opt-out  certain customers  that do  not want


@@ -490,7 +519,7 @@ reject message.
 When the spf_guess condition has run, it sets up the same expansion
 variables as when spf condition is run, described above.
 
 When the spf_guess condition has run, it sets up the same expansion
 variables as when spf condition is run, described above.
 

-Additionally, since Best-guess is not standarized, you may redefine
+Additionally, since Best-guess is not standardized, you may redefine

 what "Best-guess" means to you by redefining spf_guess variable in
 global config.  For example, the following:
 
 what "Best-guess" means to you by redefining spf_guess variable in
 global config.  For example, the following:
 


@@ -520,6 +549,79 @@ EXPERIMENTAL_SRS=yes
 in your Local/Makefile.
 
 
 in your Local/Makefile.
 
 

+DCC Support
+--------------------------------------------------------------
+
+*) Building exim
+
+In order to build exim with DCC support add
+
+EXPERIMENTAL_DCC=yes
+
+to your Makefile. (Re-)build/install exim. exim -d should show
+EXPERIMENTAL_DCC under "Support for".
+
+
+*) Configuration
+
+In the main section of exim.cf add at least
+  dccifd_address = /usr/local/dcc/var/dccifd
+or
+  dccifd_address = <ip> <port>
+
+In the DATA ACL you can use the new condition
+        dcc = *
+
+After that "$dcc_header" contains the X-DCC-Header.
+
+Return values are:
+  fail    for overall "R", "G" from dccifd
+  defer   for overall "T" from dccifd
+  accept  for overall "A", "S" from dccifd
+
+dcc = */defer_ok works as for spamd.
+
+The "$dcc_result" variable contains the overall result from DCC
+answer.  There will an X-DCC: header added to the mail.
+
+Usually you'll use
+  defer   !dcc = *
+to greylist with DCC.
+
+If you set, in the main section,
+  dcc_direct_add_header = true
+then the dcc header will be added "in deep" and if the spool
+file was already written it gets removed. This forces Exim to
+write it again if needed.  This helps to get the DCC Header
+through to eg. SpamAssassin.
+
+If you want to pass even more headers in the middle of the
+DATA stage you can set
+  $acl_m_dcc_add_header
+to tell the DCC routines to add more information; eg, you might set
+this to some results from ClamAV.  Be careful.  Header syntax is
+not checked and is added "as is".
+
+In case you've troubles with sites sending the same queue items from several
+hosts and fail to get through greylisting you can use
+$acl_m_dcc_override_client_ip
+
+Setting $acl_m_dcc_override_client_ip to an IP address overrides the default
+of $sender_host_address. eg. use the following ACL in DATA stage:
+
+  warn    set acl_m_dcc_override_client_ip = \
+    ${lookup{$sender_helo_name}nwildlsearch{/etc/mail/multipleip_sites}{$value}{}}
+          condition = ${if def:acl_m_dcc_override_client_ip}
+          log_message = dbg: acl_m_dcc_override_client_ip set to \
+                        $acl_m_dcc_override_client_ip
+
+Then set something like
+# cat /etc/mail/multipleip_sites
+mout-xforward.gmx.net           82.165.159.12
+mout.gmx.net                    212.227.15.16
+
+Use a reasonable IP. eg. one the sending cluster acutally uses.
+

 --------------------------------------------------------------
 End of file
 --------------------------------------------------------------
 --------------------------------------------------------------
 End of file
 --------------------------------------------------------------