Silence compiler

[exim.git] / src / src / configure.default

diff --git a/src/src/configure.default b/src/src/configure.default
index 946137fc9ff838c9eff24b01bc12c51e8e9ea675..87f255aa91fbdd7f6c8c383f633dc5eb04954c62 100644 (file)
--- a/src/src/configure.default
+++ b/src/src/configure.default
@@ -458,6 +458,20 @@ acl_check_rcpt:
 
   require verify        = sender
 
+  # Reject all RCPT commands after too many bad recipients
+  # This is partly a defense against spam abuse and partly attacker abuse.
+  # Real senders should manage, by the time they get to 10 RCPT directives,
+  # to have had at least half of them be real addresses.
+  #
+  # This is a lightweight check and can protect you against repeated
+  # invocations of more heavy-weight checks which would come after it.
+
+  deny    condition     = ${if and {\
+                        {>{$rcpt_count}{10}}\
+                        {<{$recipients_count}{${eval:$rcpt_count/2}}} }}
+          message       = Rejected for too many bad recipients
+          logwrite      = REJECT [$sender_host_address]: bad recipient count high [${eval:$rcpt_count-$recipients_count}]
+
   # Accept if the message comes from one of the hosts for which we are an
   # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
   # so we set control=submission to make Exim treat the message as a
@@ -540,11 +554,11 @@ acl_check_rcpt:
   # to the first recipient must be deferred unless the sender talks PRDR.
   #
   # defer  !condition     = $prdr_requested
-  #        condition      = ${if > {0}{$receipients_count}}
+  #        condition      = ${if > {0}{$recipients_count}}
   #        condition      = ${if !eq {$acl_m_content_filter} \
   #                                  {${lookup PER_RCPT_CONTENT_FILTER}}}
   # warn   !condition     = $prdr_requested
-  #        condition      = ${if > {0}{$receipients_count}}
+  #        condition      = ${if > {0}{$recipients_count}}
   #        set acl_m_content_filter = ${lookup PER_RCPT_CONTENT_FILTER}
   #############################################################################
 
@@ -834,9 +848,9 @@ smarthost_smtp:
   # request with your smarthost provider to get things fixed:
   hosts_require_tls = *
   tls_verify_hosts = *
-  # As long as tls_verify_hosts is enabled, this won't matter, but if you
-  # have to comment it out then this will at least log whether you succeed
-  # or not:
+  # As long as tls_verify_hosts is enabled, this this will have no effect,
+  # but if you have to comment it out then this will at least log whether
+  # you succeed or not:
   tls_try_verify_hosts = *
   #
   # The SNI name should match the name which we'll expect to verify;