Docs: clarify helo_allow_chars option

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 8164dcd745a1728ecea77bad8456e387280d46c4..dbbed7cde45a2a96b8703db20c3f1612428fd9a9 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -16196,11 +16196,13 @@ set.
 .cindex "EHLO" "underscores in"
 .cindex "underscore in EHLO/HELO"
 This option can be set to a string of rogue characters that are permitted in
-all EHLO and HELO names in addition to the standard letters, digits,
-hyphens, and dots. If you really must allow underscores, you can set
+non-ip-literal EHLO and HELO names in addition to the standard letters, digits,
+hyphens, and dots. For examplem if you really must allow underscores,
+you can set
 .code
 helo_allow_chars = _
 .endd
+This option does not apply to names that look like ip-literals.
 Note that the value is one string, not a list.
 
 
@@ -30542,12 +30544,17 @@ Section 4.3 of that document.
 .subsection General
 Under GnuTLS, DANE is only supported from version 3.0.0 onwards.
 
-DANE is specified in published RFCs and decouples certificate authority trust
+DANE is specified in RFC 6698. It decouples certificate authority trust
 selection from a "race to the bottom" of "you must trust everything for mail
 to get through".
-There is an alternative technology called MTA-STS, which
-instead publishes MX trust anchor information on an HTTPS website.  At the
-time this text was last updated, MTA-STS was still a draft, not yet an RFC.
+It does retain the need to trust the assurances provided by the DNSSEC tree.
+
+There is an alternative technology called MTA-STS (RFC 8461), which
+instead publishes MX trust anchor information on an HTTPS website.
+The discovery of the address for that website does not (per standard)
+require DNSSEC, and could be regarded as being less secure than DANE
+as a result.
+
 Exim has no support for MTA-STS as a client, but Exim mail server operators
 can choose to publish information describing their TLS configuration using
 MTA-STS to let those clients who do use that protocol derive trust
@@ -42424,7 +42431,8 @@ Example usage:
     allow_fail
     data =      :fail: Invalid SRS recipient address
 
-  #... further routers here
+  #... further routers here get inbound_srs-redirected recipients
+  # and any that were not SRS'd
 
 
   # transport; should look like the non-forward outbound
@@ -43010,10 +43018,13 @@ Events have names which correspond to the point in process at which they fire.
 The name is placed in the variable &$event_name$& and the event action
 expansion must check this, as it will be called for every possible event type.
 
+.new
 The current list of events is:
+.wen
 .itable all 0 0 4 25* left 10* center 15* center 50* left
 .row auth:fail             after    both       "per driver per authentication attempt"
 .row dane:fail              after    transport  "per connection"
+.row dns:fail               after    both       "per lookup"
 .row msg:complete           after    main       "per message"
 .row msg:defer              after    transport  "per message per delivery try"
 .row msg:delivery           after    transport  "per recipient"
@@ -43047,6 +43058,7 @@ with the event type:
 .itable all 0 0 2 20* left 80* left
 .row auth:fail           "smtp response"
 .row dane:fail            "failure reason"
+.row dns:fail             "failure reason, key and lookup-type"
 .row msg:defer            "error string"
 .row msg:delivery         "smtp confirmation message"
 .row msg:fail:internal    "failure reason"
@@ -43096,6 +43108,11 @@ chain element received on the connection.
 For OpenSSL it will trigger for every chain element including those
 loaded locally.
 
+.new
+For dns:fail events from dnsdb lookups, a &"defer_never"& option does not
+affect the reporting of DNS_AGAIN.
+.wen
+
 . ////////////////////////////////////////////////////////////////////////////
 . ////////////////////////////////////////////////////////////////////////////