When the lookup succeeds, the result of the expansion is a list of domains (and
possibly other types of item that are allowed in domain lists).
.cindex "tainted data" "de-tainting"
-.cindex "de-tainting" "using a lookup expansion""
+.cindex "de-tainting" "using a lookup expansion"
The result of the expansion is not tainted.
.next
default, but the separator can be changed in the usual way (&<<SECTlistsepchange>>&).
For each item
in this list, its value is place in &$item$&, and then the condition is
-evaluated. If the condition is true, &$item$& is added to the output as an
+evaluated.
+.new
+Any modification of &$value$& by this evaluation is discarded.
+.wen
+If the condition is true, &$item$& is added to the output as an
item in a new list; if the condition is false, the item is discarded. The
separator used for the output list is the same as the one used for the
input, but a separator setting is not included in the output. For example:
${filter{a:b:c}{!eq{$item}{b}}}
.endd
yields &`a:c`&. At the end of the expansion, the value of &$item$& is restored
-to what it was before. See also the &%map%& and &%reduce%& expansion items.
+to what it was before.
+See also the &%map%& and &%reduce%& expansion items.
.vitem &*${hash{*&<&'string1'&>&*}{*&<&'string2'&>&*}{*&<&'string3'&>&*}}*&
restored to what they were before. See also the &%filter%& and &%map%&
expansion items.
+. A bit of a special-case logic error in writing an expansion;
+. probably not worth including in the mainline of documentation.
+. If only we had footnotes (the html output variant is the problem).
+.
+. .new
+. &*Note*&: if an &'expansion condition'& is used in <&'string3'&>
+. and that condition modifies &$value$&,
+. then the string expansions dependent on the condition cannot use
+. the &$value$& of the reduce iteration.
+. .wen
+
.vitem &*$rheader_*&<&'header&~name'&>&*:*&&~or&~&*$rh_*&<&'header&~name'&>&*:*&
This item inserts &"raw"& header lines. It is described with the &%header%&
expansion item in section &<<SECTexpansionitems>>& above.
.cindex "first delivery"
.cindex "expansion" "first delivery test"
.cindex "&%first_delivery%& expansion condition"
+.cindex retry condition
This condition, which has no data, is true during a message's first delivery
attempt. It is false during any subsequent delivery attempts.
.cindex "host" "rejecting connections from"
If this option is set, incoming SMTP calls from the hosts listed are rejected
as soon as the connection is made.
-This option is obsolete, and retained only for backward compatibility, because
+This option is mostly obsolete, retained for backward compatibility because
nowadays the ACL specified by &%acl_smtp_connect%& can also reject incoming
-connections immediately.
+connections immediately
+.new
+(except for tls-on-connect connections).
+.wen
The ability to give an immediate rejection (either by this option or using an
ACL) is provided for use in unusual cases. Many hosts will just try again,
&<<CHAPSMTPAUTH>>& for details of authentication.
-.option hosts_request_ocsp smtp "host list&!!" *
+.option hosts_request_ocsp smtp "host list&!!" "see below"
.cindex "TLS" "requiring for certain servers"
Exim will request a Certificate Status on a
TLS session for any host that matches this list.
&%tls_verify_certificates%& should also be set for the transport.
+.new
+The default is &"**"& if DANE is not in use for the connection,
+or if DANE-TA us used.
+It is empty if DANE-EE is used.
+.wen
+
.option hosts_require_alpn smtp "host list&!!" unset
.cindex ALPN "require negotiation in client"
.cindex TLS ALPN
operation is as if this option selected all hosts.
&*Warning*&: Including a host in &%tls_verify_hosts%& does not require
that connections use TLS.
-Fallback to in-clear communication will be done unless restricted by
+Fallback to in-clear communication will be done unless restricted by
the &%hosts_require_tls%& option.
.option utf8_downconvert smtp integer&!! -1
The client for the connection proposes a set of protocol names, and
the server responds with a selected one.
It is not, as of 2021, commonly used for SMTP connections.
-However, to guard against misirected or malicious use of web clients
+However, to guard against misdirected or malicious use of web clients
(which often do use ALPN) against MTA ports, Exim by default check that
there is no incompatible ALPN specified by a client for a TLS connection.
If there is, the connection is rejected.
&%tls_alpn%& and &%hosts_require_alpn%&.
There are no variables providing observability.
Some feature-specific logging may appear on denied connections, but this
-depends on the behavious of the peer
+depends on the behaviour of the peer
(not all peers can send a feature-specific TLS Alert).
This feature is available when Exim is built with
for every possible target server. It also scales (slightly) better than having to maintain on an SMTP
client a copy of the standard CAs bundle. It also means not having to pay a CA for certificates.
-DANE requires a server operator to do three things: 1) run DNSSEC. This provides assurance to clients
+DANE requires a server operator to do three things:
+.olist
+Run DNSSEC. This provides assurance to clients
that DNS lookups they do for the server have not been tampered with. The domain MX record applying
to this server, its A record, its TLSA record and any associated CNAME records must all be covered by
DNSSEC.
-2) add TLSA DNS records. These say what the server certificate for a TLS connection should be.
-3) offer a server certificate, or certificate chain, in TLS connections which is is anchored by one of the TLSA records.
+.next
+Add TLSA DNS records. These say what the server certificate for a TLS connection should be.
+.next
+Offer a server certificate, or certificate chain, in TLS connections which is is anchored by one of the TLSA records.
+.endlist
There are no changes to Exim specific to server-side operation of DANE.
Support for client-side operation of DANE can be included at compile time by defining SUPPORT_DANE=yes
in &_Local/Makefile_&.
If it has been included, the macro "_HAVE_DANE" will be defined.
+.subsection "DNS records"
A TLSA record consist of 4 fields, the "Certificate Usage", the
"Selector", the "Matching type", and the "Certificate Association Data".
For a detailed description of the TLSA record see
This means no MD5 and no SHA-1. SHA2-256 is the minimum for reliable
interoperability (and probably the maximum too, in 2018).
+.subsection "Interaction with OCSP"
The use of OCSP-stapling should be considered, allowing for fast revocation of certificates (which would otherwise
be limited by the DNS TTL on the TLSA records). However, this is likely to only be usable with DANE-TA. NOTE: the
default of requesting OCSP for all hosts is modified iff DANE is in use, to:
those who use &%hosts_require_ocsp%&, should consider the interaction with DANE in their OCSP settings.
+.subsection "Client configuration"
For client-side DANE there are three new smtp transport options, &%hosts_try_dane%&, &%hosts_require_dane%&
and &%dane_require_tls_ciphers%&.
The &"require"& variant will result in failure if the target host is not
The router and transport option &%dnssec_request_domains%& must not be
set to &"never"&, and &%dnssec_require_domains%& is ignored.
+.subsection Observability
If verification was successful using DANE then the "CV" item in the delivery log line will show as "CV=dane".
There is a new variable &$tls_out_dane$& which will have "yes" if
The &$event_data$& will be one of the Result Types defined in
Section 4.3 of that document.
+.subsection General
Under GnuTLS, DANE is only supported from version 3.0.0 onwards.
DANE is specified in published RFCs and decouples certificate authority trust
selection from a "race to the bottom" of "you must trust everything for mail
-to get through". There is an alternative technology called MTA-STS, which
+to get through".
+There is an alternative technology called MTA-STS, which
instead publishes MX trust anchor information on an HTTPS website. At the
time this text was last updated, MTA-STS was still a draft, not yet an RFC.
Exim has no support for MTA-STS as a client, but Exim mail server operators
The &%seen%& ACL condition can be used to test whether a
situation has been previously met.
It uses a hints database to record a timestamp against a key.
-host. The syntax of the condition is:
+The syntax of the condition is:
.display
&`seen =`& <&'optional flag'&><&'time interval'&> &`/`& <&'options'&>
.endd
.subsection "Ratelimit options for what is being measured" ratoptmea
.cindex "rate limiting" "per_* options"
-The &%per_conn%& option limits the client's connection rate. It is not
+.vlist
+.vitem per_conn
+.cindex "rate limiting" per_conn
+This option limits the client's connection rate. It is not
normally used in the &%acl_not_smtp%&, &%acl_not_smtp_mime%&, or
&%acl_not_smtp_start%& ACLs.
-The &%per_mail%& option limits the client's rate of sending messages. This is
+.vitem per_mail
+.cindex "rate limiting" per_conn
+This option limits the client's rate of sending messages. This is
the default if none of the &%per_*%& options is specified. It can be used in
&%acl_smtp_mail%&, &%acl_smtp_rcpt%&, &%acl_smtp_predata%&, &%acl_smtp_mime%&,
&%acl_smtp_data%&, or &%acl_not_smtp%&.
-The &%per_byte%& option limits the sender's email bandwidth. It can be used in
+.vitem per_byte
+.cindex "rate limiting" per_conn
+This option limits the sender's email bandwidth. It can be used in
the same ACLs as the &%per_mail%& option, though it is best to use this option
in the &%acl_smtp_mime%&, &%acl_smtp_data%& or &%acl_not_smtp%& ACLs; if it is
used in an earlier ACL, Exim relies on the SIZE parameter given by the client
follow the limit &'m'& in the configuration with K, M, or G to specify limits
in kilobytes, megabytes, or gigabytes, respectively.
-The &%per_rcpt%& option causes Exim to limit the rate at which recipients are
+.vitem per_rcpt
+.cindex "rate limiting" per_rcpt
+This option causes Exim to limit the rate at which recipients are
accepted. It can be used in the &%acl_smtp_rcpt%&, &%acl_smtp_predata%&,
&%acl_smtp_mime%&, or &%acl_smtp_data%& ACLs. In
&%acl_smtp_rcpt%& the rate is updated one recipient at a time; in the other
in either case the rate limiting engine will see a message with many
recipients as a large high-speed burst.
-The &%per_addr%& option is like the &%per_rcpt%& option, except it counts the
+.vitem per_addr
+.cindex "rate limiting" per_addr
+This option is like the &%per_rcpt%& option, except it counts the
number of different recipients that the client has sent messages to in the
last time period. That is, if the client repeatedly sends messages to the same
recipient, its measured rate is not increased. This option can only be used in
&%acl_smtp_rcpt%&.
-The &%per_cmd%& option causes Exim to recompute the rate every time the
+.vitem per_cmd
+.cindex "rate limiting" per_cmd
+This option causes Exim to recompute the rate every time the
condition is processed. This can be used to limit the rate of any SMTP
command. If it is used in multiple ACLs it can limit the aggregate rate of
multiple different commands.
-The &%count=%& option can be used to alter how much Exim adds to the client's
-measured rate. For example, the &%per_byte%& option is equivalent to
-&`per_mail/count=$message_size`&. If there is no &%count=%& option, Exim
+.vitem count
+.cindex "rate limiting" count
+This option can be used to alter how much Exim adds to the client's
+measured rate.
+A value is required, after an equals sign.
+For example, the &%per_byte%& option is equivalent to
+&`per_mail/count=$message_size`&.
+If there is no &%count=%& option, Exim
increases the measured rate by one (except for the &%per_rcpt%& option in ACLs
-other than &%acl_smtp_rcpt%&). The count does not have to be an integer.
+other than &%acl_smtp_rcpt%&).
+The count does not have to be an integer.
-The &%unique=%& option is described in section &<<ratoptuniq>>& below.
+.vitem unique
+.cindex "rate limiting" unique
+This option is described in section &<<ratoptuniq>>& below.
+.endlist
.subsection "Ratelimit update modes" ratoptupd
is done. If a message fails to be completely delivered at the first attempt,
the system filter is run again at the start of every retry.
If you want your filter to do something only once per message, you can make use
+.cindex retry condition
of the &%first_delivery%& condition in an &%if%& command in the filter to
prevent it happening on retries.
.subsection ACL SSECDMARCACL
.cindex DMARC "ACL condition"
-DMARC checks cam be run on incoming SMTP messages by using the
+DMARC checks can be run on incoming SMTP messages by using the
&"dmarc_status"& ACL condition in the DATA ACL. You are required to
call the &"spf"& condition first in the ACLs, then the &"dmarc_status"&
condition. Putting this condition in the ACLs is required in order
git://git.exim.org / exim.git / blobdiff