defined. AAAA records (analogous to A records for IPv4) are in use, and are
currently seen as the mainstream. Another record type called A6 was proposed
as better than AAAA because it had more flexibility. However, it was felt to be
defined. AAAA records (analogous to A records for IPv4) are in use, and are
currently seen as the mainstream. Another record type called A6 was proposed
as better than AAAA because it had more flexibility. However, it was felt to be
This option is interpreted by Sendmail to cause debug information to be sent
to the named file. It is ignored by Exim.
This option is interpreted by Sendmail to cause debug information to be sent
to the named file. It is ignored by Exim.
.vitem &%-z%&&~<&'log-line'&>
.oindex "&%-z%&"
This option writes its argument to Exim's logfile.
Use is restricted to administrators; the intent is for operational notes.
Quotes should be used to maintain a multi-word item as a single argument,
under most shells.
.vitem &%-z%&&~<&'log-line'&>
.oindex "&%-z%&"
This option writes its argument to Exim's logfile.
Use is restricted to administrators; the intent is for operational notes.
Quotes should be used to maintain a multi-word item as a single argument,
under most shells.
show how you can specify hosts that are permitted to send unqualified sender
and recipient addresses, respectively.
show how you can specify hosts that are permitted to send unqualified sender
and recipient addresses, respectively.
The &%log_selector%& option is used to increase the detail of logging
over the default:
.code
log_selector = +smtp_protocol_error +smtp_syntax_error \
+tls_certificate_verified
.endd
The &%log_selector%& option is used to increase the detail of logging
over the default:
.code
log_selector = +smtp_protocol_error +smtp_syntax_error \
+tls_certificate_verified
.endd
&`fail`& keyword causes a &'forced expansion failure'& &-- see section
&<<SECTforexpfai>>& for an explanation of what this means.
&`fail`& keyword causes a &'forced expansion failure'& &-- see section
&<<SECTforexpfai>>& for an explanation of what this means.
The supported DNS record types are A, CNAME, MX, NS, PTR, SOA, SPF, SRV, TLSA
and TXT, and, when Exim is compiled with IPv6 support, AAAA.
If no type is given, TXT is assumed.
The supported DNS record types are A, CNAME, MX, NS, PTR, SOA, SPF, SRV, TLSA
and TXT, and, when Exim is compiled with IPv6 support, AAAA.
If no type is given, TXT is assumed.
For any record type, if multiple records are found, the data is returned as a
concatenation, with newline as the default separator. The order, of course,
For any record type, if multiple records are found, the data is returned as a
concatenation, with newline as the default separator. The order, of course,
.cindex "SOA record" "in &(dnsdb)& lookup"
For an SOA lookup, while no result is obtained the lookup is redone with
successively more leading components dropped from the given domain.
.cindex "SOA record" "in &(dnsdb)& lookup"
For an SOA lookup, while no result is obtained the lookup is redone with
successively more leading components dropped from the given domain.
Retries for the dnsdb lookup can be controlled by a retry modifier.
The form if &"retry_VAL"& where VAL is an integer.
The default count is set by the main configuration option &%dns_retry%&.
Retries for the dnsdb lookup can be controlled by a retry modifier.
The form if &"retry_VAL"& where VAL is an integer.
The default count is set by the main configuration option &%dns_retry%&.
.vitem "&*${env{*&<&'key'&>&*}{*&<&'string1'&>&*}{*&<&'string2'&>&*}}*&"
.cindex "expansion" "extracting value from environment"
.cindex "environment" "value from"
.vitem "&*${env{*&<&'key'&>&*}{*&<&'string1'&>&*}{*&<&'string2'&>&*}}*&"
.cindex "expansion" "extracting value from environment"
.cindex "environment" "value from"
content-scanning extension and the obsolete &%demime%& condition. For details,
see section &<<SECTdemimecond>>&.
content-scanning extension and the obsolete &%demime%& condition. For details,
see section &<<SECTdemimecond>>&.
.vitem &$dkim_cur_signer$& &&&
&$dkim_verify_status$& &&&
&$dkim_verify_reason$& &&&
.vitem &$dkim_cur_signer$& &&&
&$dkim_verify_status$& &&&
&$dkim_verify_reason$& &&&
When a message has been received this variable contains
a colon-separated list of signer domains and identities for the message.
For details see chapter &<<CHAPdkim>>&.
When a message has been received this variable contains
a colon-separated list of signer domains and identities for the message.
For details see chapter &<<CHAPdkim>>&.
It will be empty if &(DNSSEC)& was not requested,
&"no"& if the result was not labelled as authenticated data
and &"yes"& if it was.
It will be empty if &(DNSSEC)& was not requested,
&"no"& if the result was not labelled as authenticated data
and &"yes"& if it was.
Results that are labelled as authoritive answer that match
the $%dns_trust_aa%$ configuration variable count also
as authenticated data.
Results that are labelled as authoritive answer that match
the $%dns_trust_aa%$ configuration variable count also
as authenticated data.
It is only useful as the argument of a
&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
or a &%def%& condition.
It is only useful as the argument of a
&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
or a &%def%& condition.
outbound connection. It is only useful as the argument of a
&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
or a &%def%& condition.
outbound connection. It is only useful as the argument of a
&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
or a &%def%& condition.
connection, and Exim is configured to request a certificate from the client,
the value of the Distinguished Name of the certificate is made available in the
&$tls_in_peerdn$& during subsequent processing.
connection, and Exim is configured to request a certificate from the client,
the value of the Distinguished Name of the certificate is made available in the
&$tls_in_peerdn$& during subsequent processing.
The deprecated &$tls_peerdn$& variable refers to the inbound side
except when used in the context of an outbound SMTP delivery, when it refers to
The deprecated &$tls_peerdn$& variable refers to the inbound side
except when used in the context of an outbound SMTP delivery, when it refers to
connection, and Exim is configured to request a certificate from the server,
the value of the Distinguished Name of the certificate is made available in the
&$tls_out_peerdn$& during subsequent processing.
connection, and Exim is configured to request a certificate from the server,
the value of the Distinguished Name of the certificate is made available in the
&$tls_out_peerdn$& during subsequent processing.
processed and the message itself has been received, but before the
acknowledgment is sent. See chapter &<<CHAPACL>>& for further details.
processed and the message itself has been received, but before the
acknowledgment is sent. See chapter &<<CHAPACL>>& for further details.
.option acl_smtp_dkim main string&!! unset
.cindex DKIM "ACL for"
This option defines the ACL that is run for each DKIM signature
of a received message.
See chapter &<<CHAPdkim>>& for further details.
.option acl_smtp_dkim main string&!! unset
.cindex DKIM "ACL for"
This option defines the ACL that is run for each DKIM signature
of a received message.
See chapter &<<CHAPdkim>>& for further details.
extension. It defines the ACL that is run for each MIME part in a message. See
section &<<SECTscanmimepart>>& for details.
extension. It defines the ACL that is run for each MIME part in a message. See
section &<<SECTscanmimepart>>& for details.
.option acl_smtp_notquit main string&!! unset
.cindex "not-QUIT, ACL for"
This option defines the ACL that is run when an SMTP session
ends without a QUIT command being received.
See chapter &<<CHAPACL>>& for further details.
.option acl_smtp_notquit main string&!! unset
.cindex "not-QUIT, ACL for"
This option defines the ACL that is run when an SMTP session
ends without a QUIT command being received.
See chapter &<<CHAPACL>>& for further details.
.option acl_smtp_predata main string&!! unset
This option defines the ACL that is run when an SMTP DATA command is
.option acl_smtp_predata main string&!! unset
This option defines the ACL that is run when an SMTP DATA command is
.option dkim_verify_signers main "domain list&!!" $dkim_signers
.cindex DKIM "controlling calls to the ACL"
This option gives a list of DKIM domains for which the DKIM ACL is run.
It is expanded after the message is received; by default it runs
the ACL once for each signature in the message.
See chapter &<<CHAPdkim>>&.
.option dkim_verify_signers main "domain list&!!" $dkim_signers
.cindex DKIM "controlling calls to the ACL"
This option gives a list of DKIM domains for which the DKIM ACL is run.
It is expanded after the message is received; by default it runs
the ACL once for each signature in the message.
See chapter &<<CHAPdkim>>&.
parameter values are available in the external resolver interface structure,
but nowhere does it seem to describe how they are used or what you might want
to set in them.
parameter values are available in the external resolver interface structure,
but nowhere does it seem to describe how they are used or what you might want
to set in them.
.option slow_lookup_log main integer 0
.cindex "logging" "slow lookups"
.cindex "dns" "logging slow lookups"
.option slow_lookup_log main integer 0
.cindex "logging" "slow lookups"
.cindex "dns" "logging slow lookups"
If the value is nonzero it is taken as a number of milliseconds
and lookups taking longer than this are logged.
Currently this applies only to DNS lookups.
If the value is nonzero it is taken as a number of milliseconds
and lookups taking longer than this are logged.
Currently this applies only to DNS lookups.
The former means that Exim was expecting to read an SMTP command; the latter
means that it was in the DATA phase, reading the contents of a message.
The former means that Exim was expecting to read an SMTP command; the latter
means that it was in the DATA phase, reading the contents of a message.
If the first character of the option is a &"$"& the option is
expanded before use and may depend on
&$sender_host_name$&, &$sender_host_address$& and &$sender_host_port$&.
If the first character of the option is a &"$"& the option is
expanded before use and may depend on
&$sender_host_name$&, &$sender_host_address$& and &$sender_host_port$&.
.option tls_eccurve main string&!! prime256v1
.cindex TLS "EC cryptography"
If built with a recent-enough version of OpenSSL,
.option tls_eccurve main string&!! prime256v1
.cindex TLS "EC cryptography"
If built with a recent-enough version of OpenSSL,
which tell the library to choose.
If the option is set to an empty string, no EC curves will be enabled.
which tell the library to choose.
If the option is set to an empty string, no EC curves will be enabled.
unless you really, really know what you are doing. See also the generic
transport option of the same name.
unless you really, really know what you are doing. See also the generic
transport option of the same name.
.option dnssec_request_domains routers "domain list&!!" unset
.cindex "MX record" "security"
.cindex "DNSSEC" "MX lookup"
.option dnssec_request_domains routers "domain list&!!" unset
.cindex "MX record" "security"
.cindex "DNSSEC" "MX lookup"
the dnssec request bit set. Any returns not having the Authenticated Data bit
(AD bit) set will be ignored and logged as a host-lookup failure.
This applies to all of the SRV, MX, AAAA, A lookup sequence.
the dnssec request bit set. Any returns not having the Authenticated Data bit
(AD bit) set will be ignored and logged as a host-lookup failure.
This applies to all of the SRV, MX, AAAA, A lookup sequence.
routers, and this can lead to problems with duplicates -- see the similar
warning for &%headers_add%& above.
routers, and this can lead to problems with duplicates -- see the similar
warning for &%headers_add%& above.
&*Warning 3*&: Because of the separate expansion of the list items,
items that contain a list separator must have it doubled.
To avoid this, change the list separator (&<<SECTlistsepchange>>&).
&*Warning 3*&: Because of the separate expansion of the list items,
items that contain a list separator must have it doubled.
To avoid this, change the list separator (&<<SECTlistsepchange>>&).
an address; if such a router is expected to handle "all remaining non-local
domains", then it is important to set &%no_more%&.
an address; if such a router is expected to handle "all remaining non-local
domains", then it is important to set &%no_more%&.
The router will defer rather than decline if the domain
is found in the &%fail_defer_domains%& router option.
The router will defer rather than decline if the domain
is found in the &%fail_defer_domains%& router option.
.option fail_defer_domains dnslookup "domain list&!!" unset
.cindex "MX record" "not found"
DNS lookups for domains matching &%fail_defer_domains%&
.option fail_defer_domains dnslookup "domain list&!!" unset
.cindex "MX record" "not found"
DNS lookups for domains matching &%fail_defer_domains%&
domain while the DNS configuration is not ready.
However, it will result in any message with mistyped domains
also being queued.
domain while the DNS configuration is not ready.
However, it will result in any message with mistyped domains
also being queued.
legitimate reasons for this (host died, network died), but if it repeats a lot
for the same host, it indicates something odd.
legitimate reasons for this (host died, network died), but if it repeats a lot
for the same host, it indicates something odd.
.vitem &%lookup%&
A DNS lookup for a host failed.
Note that a &%dnslookup%& router will need to have matched
its &%fail_defer_domains%& option for this retry type to be usable.
Also note that a &%manualroute%& router will probably need
its &%host_find_failed%& option set to &%defer%&.
.vitem &%lookup%&
A DNS lookup for a host failed.
Note that a &%dnslookup%& router will need to have matched
its &%fail_defer_domains%& option for this retry type to be usable.
Also note that a &%manualroute%& router will probably need
its &%host_find_failed%& option set to &%defer%&.
the PLAIN authentication mechanism (RFC 2595) or the LOGIN mechanism, which is
not formally documented, but used by several MUAs. The seventh authenticator
supports Microsoft's &'Secure Password Authentication'& mechanism.
the PLAIN authentication mechanism (RFC 2595) or the LOGIN mechanism, which is
not formally documented, but used by several MUAs. The seventh authenticator
supports Microsoft's &'Secure Password Authentication'& mechanism.
The eighth is an Exim authenticator but not an SMTP one;
instead it can use information from a TLS negotiation.
The eighth is an Exim authenticator but not an SMTP one;
instead it can use information from a TLS negotiation.
The authenticators are configured using the same syntax as other drivers (see
section &<<SECTfordricon>>&). If no authenticators are required, no
The authenticators are configured using the same syntax as other drivers (see
section &<<SECTfordricon>>&). If no authenticators are required, no
.cindex "QUIT, ACL for"
The ACL for the SMTP QUIT command is anomalous, in that the outcome of the ACL
does not affect the response code to QUIT, which is always 221. Thus, the ACL
.cindex "QUIT, ACL for"
The ACL for the SMTP QUIT command is anomalous, in that the outcome of the ACL
does not affect the response code to QUIT, which is always 221. Thus, the ACL
This ACL can be used for tasks such as custom logging at the end of an SMTP
session. For example, you can use ACL variables in other ACLs to count
This ACL can be used for tasks such as custom logging at the end of an SMTP
session. For example, you can use ACL variables in other ACLs to count
The option is usable in the RCPT ACL.
If enabled for a message recieved via smtp and routed to an smtp transport,
The option is usable in the RCPT ACL.
If enabled for a message recieved via smtp and routed to an smtp transport,
and only one transport, interface, destination host and port combination
is used for all recipients of the message,
and only one transport, interface, destination host and port combination
is used for all recipients of the message,
then the delivery connection is made while the receiving connection is open
and data is copied from one to the other.
then the delivery connection is made while the receiving connection is open
and data is copied from one to the other.
for a mail will be quietly ignored.
If a recipient-verify callout connection is subsequently
requested in the same ACL it is held open and used for
for a mail will be quietly ignored.
If a recipient-verify callout connection is subsequently
requested in the same ACL it is held open and used for
otherwise one is made after the initial RCPT ACL completes.
Note that routers are used in verify mode,
otherwise one is made after the initial RCPT ACL completes.
Note that routers are used in verify mode,
Cutthrough delivery is not supported via transport-filters or when DKIM signing
of outgoing messages is done, because it sends data to the ultimate destination
before the entire message has been received from the source.
Cutthrough delivery is not supported via transport-filters or when DKIM signing
of outgoing messages is done, because it sends data to the ultimate destination
before the entire message has been received from the source.
Should the ultimate destination system positively accept or reject the mail,
a corresponding indication is given to the source system and nothing is queued.
Should the ultimate destination system positively accept or reject the mail,
a corresponding indication is given to the source system and nothing is queued.
one of its aliases, does, when it is itself looked up in the DNS, yield the
original IP address.
one of its aliases, does, when it is itself looked up in the DNS, yield the
original IP address.
There is one possible option, &`defer_ok`&. If this is present and a
DNS operation returns a temporary error, the verify condition succeeds.
There is one possible option, &`defer_ok`&. If this is present and a
DNS operation returns a temporary error, the verify condition succeeds.
If this condition is used for a locally generated message (that is, when there
is no client host involved), it always succeeds.
If this condition is used for a locally generated message (that is, when there
is no client host involved), it always succeeds.
The name allows you to use per-domain or per-user antispam profiles in
principle, but this is not straightforward in practice, because a message may
have multiple recipients, not necessarily all in the same domain. Because the
The name allows you to use per-domain or per-user antispam profiles in
principle, but this is not straightforward in practice, because a message may
have multiple recipients, not necessarily all in the same domain. Because the
Careful enforcement of single-recipient messages
(eg. by responding with defer in the recipient ACL for all recipients
after the first),
or the use of PRDR,
.cindex "PRDR" "use for per-user SpamAssassin profiles"
are needed to use this feature.
Careful enforcement of single-recipient messages
(eg. by responding with defer in the recipient ACL for all recipients
after the first),
or the use of PRDR,
.cindex "PRDR" "use for per-user SpamAssassin profiles"
are needed to use this feature.
The right-hand side of the &%spam%& condition is expanded before being used, so
you can put lookups or conditions there. When the right-hand side evaluates to
The right-hand side of the &%spam%& condition is expanded before being used, so
you can put lookups or conditions there. When the right-hand side evaluates to
This is perhaps the most important of the MIME variables. It contains a
proposed filename for an attachment, if one was found in either the
&'Content-Type:'& or &'Content-Disposition:'& headers. The filename will be
This is perhaps the most important of the MIME variables. It contains a
proposed filename for an attachment, if one was found in either the
&'Content-Type:'& or &'Content-Disposition:'& headers. The filename will be
&` incoming_port `& remote port on <= lines
&`*lost_incoming_connection `& as it says (includes timeouts)
&` outgoing_port `& add remote port to => lines
&` incoming_port `& remote port on <= lines
&`*lost_incoming_connection `& as it says (includes timeouts)
&` outgoing_port `& add remote port to => lines
followed by a colon and the port number. The local interface and port are also
added to other SMTP log lines, for example &"SMTP connection from"& and to
rejection lines
followed by a colon and the port number. The local interface and port are also
added to other SMTP log lines, for example &"SMTP connection from"& and to
rejection lines