by Exim in conjunction with the &%-MC%& option, and passes on the fact that the
host to which Exim is connected supports TLS encryption.
+.new
+.vitem &%-MCr%&&~<&'SNI'&> &&&
+ &%-MCs%&&~<&'SNI'&>
+.oindex "&%-MCs%&"
+.oindex "&%-MCr%&"
+These options are not intended for use by external callers. It is used internally
+by Exim in conjunction with the &%-MCt%& option, and passes on the fact that
+a TLS Server Name Indication was sent as part of the channel establishment.
+The argument gives the SNI string.
+The "r" variant indicates a DANE-verified connection.
+.wen
+
.vitem &%-MCt%&&~<&'IP&~address'&>&~<&'port'&>&~<&'cipher'&>
.oindex "&%-MCt%&"
This option is not intended for use by external callers. It is used internally
deliveries if the configuration allows a delivery attempt as soon as a message
is received.
+See also the &%max_parallel%& generic transport option,
+and the &%serialize_hosts%& smtp transport option.
+
.cindex "number of deliveries"
.cindex "delivery" "maximum number of"
If you want to control the total number of deliveries on the system, you
.cindex "TLS" SNI
.cindex SNI "setting in client"
.vindex "&$tls_sni$&"
-If this option is set then it sets the $tls_out_sni variable and causes any
+If this option is set
+.new
+and the connection is not DANE-validated
+.wen
+then it sets the $tls_out_sni variable and causes any
TLS session to pass this value as the Server Name Indication extension to
the remote side, which can be used by the remote side to select an appropriate
certificate and private key for the session.
This should be documented with the feature. If the documentation does not
explicitly state that the feature is infeasible in the other TLS
implementation, then patches are welcome.
+.new
+.next
+The output from "exim -bV" will show which (if any) support was included
+in the build.
+Also, the macro "_HAVE_OPENSSL" or "_HAVE_GNUTLS" will be defined.
+.wen
.endlist
only point of caution. The &$tls_out_sni$& variable will be set to this string
for the lifetime of the client connection (including during authentication).
+.new
+If DAVE validated the connection attempt then the value of the &%tls_sni%& option
+is forced to the domain part of the recipient address.
+.wen
+
Except during SMTP client sessions, if &$tls_in_sni$& is set then it is a string
received from a client.
It can be logged with the &%log_selector%& item &`+tls_sni`&.
It also allows the server to declare (implicitly) that connections to it should use TLS. An MITM could simply
fail to pass on a server's STARTTLS.
-DANE scales better than having to maintain (and side-channel communicate) copies of server certificates
+DANE scales better than having to maintain (and communicate via side-channel) copies of server certificates
for every possible target server. It also scales (slightly) better than having to maintain on an SMTP
client a copy of the standard CAs bundle. It also means not having to pay a CA for certificates.
tls_verify_certificates
tls_crl
tls_verify_cert_hostnames
+ tls_sni
.endd
If DANE is not usable, whether requested or not, and CA-anchored
The &%per_rcpt%& option causes Exim to limit the rate at which recipients are
accepted. It can be used in the &%acl_smtp_rcpt%&, &%acl_smtp_predata%&,
-&%acl_smtp_mime%&, &%acl_smtp_data%&, or &%acl_smtp_rcpt%& ACLs. In
+&%acl_smtp_mime%&, or &%acl_smtp_data%& ACLs. In
&%acl_smtp_rcpt%& the rate is updated one recipient at a time; in the other
ACLs the rate is updated with the total (accepted) recipient count in one go. Note that
in either case the rate limiting engine will see a message with many
If SMTP AUTH was used for the delivery there is an additional item A=
followed by the name of the authenticator that was used.
If an authenticated identification was set up by the authenticator's &%client_set_id%&
-option, this is logged too, separated by a colon from the authenticator name.
+option, this is logged too, as a second colon-separated list item.
+Optionally (see the &%smtp_mailauth%& &%log_selector%&) there may be a third list item.
If a shadow transport was run after a successful local delivery, the log line
for the successful delivery has an item added on the end, of the form
"check address acceptance from given IP"
.irow &<<SECTdbmbuild>>& &'exim_dbmbuild'& "build a DBM file"
.irow &<<SECTfinindret>>& &'exinext'& "extract retry information"
-.irow &<<SECThindatmai>>& &'exim_dumpdb'& "dump a hints database"
-.irow &<<SECThindatmai>>& &'exim_tidydb'& "clean up a hints database"
-.irow &<<SECThindatmai>>& &'exim_fixdb'& "patch a hints database"
+.irow &<<SECTdumpdb>>& &'exim_dumpdb'& "dump a hints database"
+.irow &<<SECTtidydb>>& &'exim_tidydb'& "clean up a hints database"
+.irow &<<SECTfixdb>>& &'exim_fixdb'& "patch a hints database"
.irow &<<SECTmailboxmaint>>& &'exim_lock'& "lock a mailbox file"
.endtable
-.section "exim_dumpdb" "SECID261"
+.section "exim_dumpdb" "SECTdumpdb"
.cindex "&'exim_dumpdb'&"
The entire contents of a database are written to the standard output by the
&'exim_dumpdb'& program, which has no options or arguments other than the
-.section "exim_tidydb" "SECID262"
+.section "exim_tidydb" "SECTtidydb"
.cindex "&'exim_tidydb'&"
The &'exim_tidydb'& utility program is used to tidy up the contents of a hints
database. If run with no options, it removes all records that are more than 30
-.section "exim_fixdb" "SECID263"
+.section "exim_fixdb" "SECTfixdb"
.cindex "&'exim_fixdb'&"
The &'exim_fixdb'& program is a utility for interactively modifying databases.
Its main use is for testing Exim, but it might also be occasionally useful for
git://git.exim.org / exim.git / blobdiff