SpamAssassin: replace "backup" option on server spec with "pri=<N>". Bug 670

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index dfe0432c66c70d85d91db631de0e7adfd81ac788..411eb988e8bf4c67c435c82cb02b7e3a096bb1aa 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -12451,6 +12451,8 @@ inbound connection when the message was received.
 It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
 or a &%def%& condition.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
 
 .vitem &$tls_out_ourcert$&
 .vindex "&$tls_out_ourcert$&"
@@ -12465,6 +12467,8 @@ This variable refers to the certificate presented by the peer of an
 outbound connection.  It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
 or a &%def%& condition.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
 
 .vitem &$tls_in_certificate_verified$&
 .vindex "&$tls_in_certificate_verified$&"
@@ -12528,6 +12532,8 @@ When a message is received from a remote host over an encrypted SMTP
 connection, and Exim is configured to request a certificate from the client,
 the value of the Distinguished Name of the certificate is made available in the
 &$tls_in_peerdn$& during subsequent processing.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
 
 The deprecated &$tls_peerdn$& variable refers to the inbound side
 except when used in the context of an outbound SMTP delivery, when it refers to
@@ -12539,6 +12545,8 @@ When a message is being delivered to a remote host over an encrypted SMTP
 connection, and Exim is configured to request a certificate from the server,
 the value of the Distinguished Name of the certificate is made available in the
 &$tls_out_peerdn$& during subsequent processing.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
 
 .vitem &$tls_in_sni$&
 .vindex "&$tls_in_sni$&"
@@ -30821,20 +30829,29 @@ Elements after the first for Unix sockets, or second for TCP socket,
 are options.
 The supported option are:
 .code
-variant=rspamd      Use Rspamd rather than SpamAssassin protocol
+pri=<priority>      Selection priority
+weight=<value>      Selection bias
 time=<start>-<end>  Use only between these times of day
+retry=<timespec>    Retry on connect fail
 tmo=<timespec>      Connection time limit
-weight=<value>      Selection bias
-backup              Use only if all non-backup servers fail
-retry=<timespec>       Retry on connect fail
+variant=rspamd      Use Rspamd rather than SpamAssassin protocol
 .endd
 
+The &`pri`& option specifies a priority for the server within the list,
+higher values being tried first.
+The deafult priority is 1.
+
+The &`weight`& option specifies a selection bias.
+Within a priority set
+servers are queried in a random fashion, weighted by this value.
+The default value for selection bias is 1.
+
 Time specifications for the &`time`& option are <hour>.<minute>.<second>
 in the local time zone; each element being one or more digits.
 Either the seconds or both minutes and seconds, plus the leading &`.`&
 characters, may be omitted and will be taken as zero.
 
-Timeout specifications for the &`tmo`& and &`retry`& options
+Timeout specifications for the &`retry`& and &`tmo`& options
 are the usual Exim time interval standard, eg. &`20s`& or &`1m`&.
 
 The &`tmo`& option specifies an overall timeout for communication.
@@ -30843,9 +30860,6 @@ The default value is two minutes.
 The &`retry`& option specifies a time after which a single retry for
 a failed connect is made.
 The default is to not retry.
-
-Servers are queried in a random fashion, weighted by the selection bias.
-The default value for selection bias is 1.
 .wen
 
 The &%spamd_address%& variable is expanded before use if it starts with
@@ -30874,6 +30888,12 @@ have multiple recipients, not necessarily all in the same domain. Because the
 &%spam%& condition has to be called from a DATA ACL in order to be able to
 read the contents of the message, the variables &$local_part$& and &$domain$&
 are not set.
+Careful enforcement of single-recipient messages
+(eg. by responding with defer in the recipient ACL for all recipients
+after the first),
+or the use of PRDR,
+.cindex "PRDR" "use for per-user SpamAssassin profiles"
+are needed to use this feature.
 
 The right-hand side of the &%spam%& condition is expanded before being used, so
 you can put lookups or conditions there. When the right-hand side evaluates to