&*$h_*&<&'header&~name'&>&*:*&" &&&
"&*$bheader_*&<&'header&~name'&>&*:*&&~or&~&&&
&*$bh_*&<&'header&~name'&>&*:*&" &&&
+ "&*$lheader_*&<&'header&~name'&>&*:*&&~or&~&&&
+ &*$lh_*&<&'header&~name'&>&*:*&"
"&*$rheader_*&<&'header&~name'&>&*:*&&~or&~&&&
&*$rh_*&<&'header&~name'&>&*:*&"
.cindex "expansion" "header insertion"
.vindex "&$header_$&"
.vindex "&$bheader_$&"
+.vindex "&$lheader_$&"
.vindex "&$rheader_$&"
.cindex "header lines" "in expansion strings"
.cindex "header lines" "character sets"
internal newlines (caused by splitting the header line over several physical
lines) may be present.
-The difference between &%rheader%&, &%bheader%&, and &%header%& is in the way
+The difference between the four pairs of expansions is in the way
the data in the header line is interpreted.
.ilist
&%rheader%& gives the original &"raw"& content of the header line, with no
processing at all, and without the removal of leading and trailing white space.
+.next
+.cindex "list" "of header lines"
+&%lheader%& gives a colon-separated list, one element per header when there
+are multiple headers with a given name.
+Any embedded colon characters within an element are doubled, so normal Exim
+list-processing facilities can be used.
+The terminating newline of each element is removed; in other respects
+the content is &"raw"&.
+
.next
.cindex "base64 encoding" "in header lines"
&%bheader%& removes leading and trailing white space, and then decodes base64
implementations of TLS.
-option gnutls_allow_auto_pkcs11 main boolean unset
+.option gnutls_allow_auto_pkcs11 main boolean unset
This option will let GnuTLS (2.12.0 or later) autoload PKCS11 modules with
the p11-kit configuration files in &_/etc/pkcs11/modules/_&.
.cindex SSMTP
.cindex SMTPS
This option specifies a list of incoming SSMTP (aka SMTPS) ports that should
-operate the obsolete SSMTP (SMTPS) protocol, where a TLS session is immediately
+operate the SSMTP (SMTPS) protocol, where a TLS session is immediately
set up without waiting for the client to issue a STARTTLS command. For
further details, see section &<<SECTsupobssmt>>&.
The main use of these variables is expected to be to distinguish between
rejections of MAIL and rejections of RCPT in callouts.
+.new
+The above variables may also be set after a &*successful*&
+address verification to:
+
+.ilist
+&%random%&: A random local-part callout succeeded
+.endlist
+.wen
+
The number of signed body bytes. If zero ("0"), the body is unsigned. If no
limit was set by the signer, "9999999999999" is returned. This makes sure
that this variable always expands to an integer value.
+.new
+&*Note:*& The presence of the signature tag specifying a signing body length
+is one possible route to spoofing of valid DKIM signatures.
+A paranoid implementation might wish to regard signature where this variable
+shows less than the "no limit" return as being invalid.
+.wen
.vitem &%$dkim_created%&
UNIX timestamp reflecting the date and time when the signature was created.