exim_dumpdb: keys-only output option

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 0ac98d668ca2a76c6c92ee6abdf8f7eeb1cd55f3..2b445e3281eef063c0c3c909fa652248071fffa4 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -25515,6 +25515,36 @@ helo_data = ${lookup dnsdb{ptr=$sending_ip_address} \
 The use of &%helo_data%& applies both to sending messages and when doing
 callouts.
 
+.new
+.option host_name_extract smtp "string list&!!" "see below"
+.cindex "load balancer" "hosts behind"
+.cindex TLS resumption
+Some mail-accepting sites
+(notably Microsoft)
+operate many servers behind a network load-balancer.  When this is done,
+with separated TLS session caches, TLS session resuption becomes problematic.
+It will only succeed when the same server happens to be selected by the
+load-balancer, matching the session stored in the client's cache.
+
+Exim can pull out a server name, if there is one, from the response to the
+client's SMTP EHLO command.
+The default value of this option:
+.code
+    ${if and { {match {$host} {.outlook.com\$}} \
+               {match {$item} {\N^250-([\w.]+)\s\N}} \
+            } {$1}}
+.endd
+suffices for one known case.
+During the expansion of this option the &$item$& variable will have the
+server's EHLO response.
+The result of the option expansion is included in the key used to store and
+retrieve the TLS session, for sessino resumption.
+
+Operators of high-load sites may wish to evaluate their logs for indications
+of other destination sites operating load-balancers, and develop a suitable
+expression for this option.
+.wen
+
 .option hosts smtp "string list&!!" unset
 Hosts are associated with an address by a router such as &(dnslookup)&, which
 finds the hosts by looking up the address domain in the DNS, or by
@@ -25582,7 +25612,10 @@ so combines well with TCP Fast Open.
 See also the &%pipelining_connect_advertise_hosts%& main option.
 
 Note:
-When the facility is used, the transport &%helo_data%& option
+.new
+When the facility is used, if the transport &%interface%& option is unset
+the &%helo_data%& option
+.wen
 will be expanded before the &$sending_ip_address$& variable
 is filled in.
 A check is made for the use of that variable, without the
@@ -29858,8 +29891,10 @@ nothing more to it.  Choosing a sensible value not derived insecurely is the
 only point of caution.  The &$tls_out_sni$& variable will be set to this string
 for the lifetime of the client connection (including during authentication).
 
+.new
 If DANE validated the connection attempt then the value of the &%tls_sni%& option
-is forced to the domain part of the recipient address.
+is forced to the name of the destination host, after any MX- or CNAME-following.
+.wen
 
 Except during SMTP client sessions, if &$tls_in_sni$& is set then it is a string
 received from a client.
@@ -39919,8 +39954,9 @@ The entire contents of a database are written to the standard output by the
 &'exim_dumpdb'& program,
 .new
 taking as arguments the spool and database names.
-An option &'-z'& may be given to regest times in UTC;
+An option &'-z'& may be given to request times in UTC;
 otherwise times are in the local timezone.
+An option &'-k'& may be given to dump only the record keys.
 .wen
 For example, to dump the retry database:
 .code