A-label transform functions

[users/heiko/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 77d966d6df2cd82aed58bb65361d73eee1506c12..f274db74e38bb550519cb2f8d8ac03e780a4df00 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -1985,10 +1985,9 @@ Two different types of DNS record for handling IPv6 addresses have been
 defined. AAAA records (analogous to A records for IPv4) are in use, and are
 currently seen as the mainstream. Another record type called A6 was proposed
 as better than AAAA because it had more flexibility. However, it was felt to be
 defined. AAAA records (analogous to A records for IPv4) are in use, and are
 currently seen as the mainstream. Another record type called A6 was proposed
 as better than AAAA because it had more flexibility. However, it was felt to be

-over-complex, and its status was reduced to &"experimental"&. It is not known
-if anyone is actually using A6 records. Exim has support for A6 records, but
-this is included only if you set &`SUPPORT_A6=YES`& in &_Local/Makefile_&. The
-support has not been tested for some time.
+over-complex, and its status was reduced to &"experimental"&. Exim used to
+have a compile option for including A6 record support but this has now been
+withdrawn.

 
 
 
 
 
 


@@ -6880,8 +6879,8 @@ is used on its own as the result. If the lookup does not succeed, the
 &<<SECTforexpfai>>& for an explanation of what this means.
 
 The supported DNS record types are A, CNAME, MX, NS, PTR, SPF, SRV, TLSA and TXT,
 &<<SECTforexpfai>>& for an explanation of what this means.
 
 The supported DNS record types are A, CNAME, MX, NS, PTR, SPF, SRV, TLSA and TXT,

-and, when Exim is compiled with IPv6 support, AAAA (and A6 if that is also
-configured). If no type is given, TXT is assumed. When the type is PTR,
+and, when Exim is compiled with IPv6 support, AAAA.
+If no type is given, TXT is assumed. When the type is PTR,

 the data can be an IP address, written as normal; inversion and the addition of
 &%in-addr.arpa%& or &%ip6.arpa%& happens automatically. For example:
 .code
 the data can be an IP address, written as normal; inversion and the addition of
 &%in-addr.arpa%& or &%ip6.arpa%& happens automatically. For example:
 .code


@@ -6890,8 +6889,7 @@ ${lookup dnsdb{ptr=192.168.4.5}{$value}fail}
 If the data for a PTR record is not a syntactically valid IP address, it is not
 altered and nothing is added.
 
 If the data for a PTR record is not a syntactically valid IP address, it is not
 altered and nothing is added.
 

-For any record type, if multiple records are found (or, for A6 lookups, if a
-single record leads to multiple addresses), the data is returned as a
+For any record type, if multiple records are found, the data is returned as a

 concatenation, with newline as the default separator. The order, of course,
 depends on the DNS resolver. You can specify a different separator character
 between multiple records by putting a right angle-bracket followed immediately
 concatenation, with newline as the default separator. The order, of course,
 depends on the DNS resolver. You can specify a different separator character
 between multiple records by putting a right angle-bracket followed immediately


@@ -7013,7 +7011,7 @@ The authorization code can be &"Y"& for yes, &"N"& for no, &"X"& for explicit
 authorization required but absent, or &"?"& for unknown.
 
 .cindex "A+" "in &(dnsdb)& lookup"
 authorization required but absent, or &"?"& for unknown.
 
 .cindex "A+" "in &(dnsdb)& lookup"

-The pseudo-type A+ performs an A6 lookup (if configured) followed by an AAAA
+The pseudo-type A+ performs an AAAA

 and then an A lookup.  All results are returned; defer processing
 (see below) is handled separately for each lookup.  Example:
 .code
 and then an A lookup.  All results are returned; defer processing
 (see below) is handled separately for each lookup.  Example:
 .code


@@ -12451,6 +12449,8 @@ inbound connection when the message was received.
 It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
 or a &%def%& condition.
 It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
 or a &%def%& condition.

+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.

 
 .vitem &$tls_out_ourcert$&
 .vindex "&$tls_out_ourcert$&"
 
 .vitem &$tls_out_ourcert$&
 .vindex "&$tls_out_ourcert$&"


@@ -12465,6 +12465,8 @@ This variable refers to the certificate presented by the peer of an
 outbound connection.  It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
 or a &%def%& condition.
 outbound connection.  It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
 or a &%def%& condition.

+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.

 
 .vitem &$tls_in_certificate_verified$&
 .vindex "&$tls_in_certificate_verified$&"
 
 .vitem &$tls_in_certificate_verified$&
 .vindex "&$tls_in_certificate_verified$&"


@@ -12528,6 +12530,8 @@ When a message is received from a remote host over an encrypted SMTP
 connection, and Exim is configured to request a certificate from the client,
 the value of the Distinguished Name of the certificate is made available in the
 &$tls_in_peerdn$& during subsequent processing.
 connection, and Exim is configured to request a certificate from the client,
 the value of the Distinguished Name of the certificate is made available in the
 &$tls_in_peerdn$& during subsequent processing.

+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.

 
 The deprecated &$tls_peerdn$& variable refers to the inbound side
 except when used in the context of an outbound SMTP delivery, when it refers to
 
 The deprecated &$tls_peerdn$& variable refers to the inbound side
 except when used in the context of an outbound SMTP delivery, when it refers to


@@ -12539,6 +12543,8 @@ When a message is being delivered to a remote host over an encrypted SMTP
 connection, and Exim is configured to request a certificate from the server,
 the value of the Distinguished Name of the certificate is made available in the
 &$tls_out_peerdn$& during subsequent processing.
 connection, and Exim is configured to request a certificate from the server,
 the value of the Distinguished Name of the certificate is made available in the
 &$tls_out_peerdn$& during subsequent processing.

+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.

 
 .vitem &$tls_in_sni$&
 .vindex "&$tls_in_sni$&"
 
 .vitem &$tls_in_sni$&
 .vindex "&$tls_in_sni$&"


@@ -13282,6 +13288,7 @@ listed in more than one group.
 .row &%acl_smtp_mail%&               "ACL for MAIL"
 .row &%acl_smtp_mailauth%&           "ACL for AUTH on MAIL command"
 .row &%acl_smtp_mime%&               "ACL for MIME parts"
 .row &%acl_smtp_mail%&               "ACL for MAIL"
 .row &%acl_smtp_mailauth%&           "ACL for AUTH on MAIL command"
 .row &%acl_smtp_mime%&               "ACL for MIME parts"

+.row &%acl_smtp_notquit%&            "ACL for non-QUIT terminations"

 .row &%acl_smtp_predata%&            "ACL for start of data"
 .row &%acl_smtp_quit%&               "ACL for QUIT"
 .row &%acl_smtp_rcpt%&               "ACL for RCPT"
 .row &%acl_smtp_predata%&            "ACL for start of data"
 .row &%acl_smtp_quit%&               "ACL for QUIT"
 .row &%acl_smtp_rcpt%&               "ACL for RCPT"


@@ -13631,6 +13638,12 @@ This option is available when Exim is built with the content-scanning
 extension. It defines the ACL that is run for each MIME part in a message. See
 section &<<SECTscanmimepart>>& for details.
 
 extension. It defines the ACL that is run for each MIME part in a message. See
 section &<<SECTscanmimepart>>& for details.
 

+.option acl_smtp_notquit main string&!! unset
+.cindex "not-QUIT, ACL for"
+This option defines the ACL that is run when an SMTP session
+ends without a QUIT command being received.
+See chapter &<<CHAPACL>>& for further details.
+

 .option acl_smtp_predata main string&!! unset
 This option defines the ACL that is run when an SMTP DATA command is
 received, before the message itself is received. See chapter &<<CHAPACL>>& for
 .option acl_smtp_predata main string&!! unset
 This option defines the ACL that is run when an SMTP DATA command is
 received, before the message itself is received. See chapter &<<CHAPACL>>& for


@@ -17154,7 +17167,10 @@ and the discussion in chapter &<<CHAPenvironment>>&.
 .option headers_add routers list&!! unset
 .cindex "header lines" "adding"
 .cindex "router" "adding header lines"
 .option headers_add routers list&!! unset
 .cindex "header lines" "adding"
 .cindex "router" "adding header lines"

-This option specifies a list of text headers, newline-separated,
+This option specifies a list of text headers,
+.new
+newline-separated (by default, changeable in the usual way),
+.wen

 that is associated with any addresses that are accepted by the router.
 Each item is separately expanded, at routing time.  However, this
 option has no effect when an address is just being verified. The way in which
 that is associated with any addresses that are accepted by the router.
 Each item is separately expanded, at routing time.  However, this
 option has no effect when an address is just being verified. The way in which


@@ -17191,7 +17207,10 @@ avoided. The &%repeat_use%& option of the &%redirect%& router may be of help.
 .option headers_remove routers list&!! unset
 .cindex "header lines" "removing"
 .cindex "router" "removing header lines"
 .option headers_remove routers list&!! unset
 .cindex "header lines" "removing"
 .cindex "router" "removing header lines"

-This option specifies a list of text headers, colon-separated,
+This option specifies a list of text headers,
+.new
+colon-separated (by default, changeable in the usual way),
+.wen

 that is associated with any addresses that are accepted by the router.
 Each item is separately expanded, at routing time.  However, this
 option has no effect when an address is just being verified. The way in which
 that is associated with any addresses that are accepted by the router.
 Each item is separately expanded, at routing time.  However, this
 option has no effect when an address is just being verified. The way in which


@@ -17970,6 +17989,9 @@ There are a few cases where a &(dnslookup)& router will decline to accept
 an address; if such a router is expected to handle "all remaining non-local
 domains", then it is important to set &%no_more%&.
 
 an address; if such a router is expected to handle "all remaining non-local
 domains", then it is important to set &%no_more%&.
 

+The router will defer rather than decline if the domain
+is found in the &%fail_defer_domains%& router option.
+

 Reasons for a &(dnslookup)& router to decline currently include:
 .ilist
 The domain does not exist in DNS
 Reasons for a &(dnslookup)& router to decline currently include:
 .ilist
 The domain does not exist in DNS


@@ -18055,7 +18077,7 @@ when there is a DNS lookup error.
 .cindex "DNS" "DNSSEC"
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.
 .cindex "DNS" "DNSSEC"
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.

-This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
+This applies to all of the SRV, MX, AAAA, A lookup sequence.

 
 
 
 
 
 


@@ -18067,8 +18089,19 @@ This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.  Any returns not having the Authenticated Data bit
 (AD bit) set wil be ignored and logged as a host-lookup failure.
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.  Any returns not having the Authenticated Data bit
 (AD bit) set wil be ignored and logged as a host-lookup failure.

-This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
+This applies to all of the SRV, MX, AAAA, A lookup sequence.
+
+

 
 

+.option fail_defer_domains dnslookup "domain list&!!" unset
+.cindex "MX record" "not found"
+DNS lookups for domains matching &%fail_defer_domains%&
+which find no matching record will cause the router to defer
+rather than the default behaviour of decline.
+This maybe be useful for queueing messages for a newly created
+domain while the DNS configuration is not ready.
+However, it will result in any message with mistyped domains
+also being queued.

 
 
 .option mx_domains dnslookup "domain list&!!" unset
 
 
 .option mx_domains dnslookup "domain list&!!" unset


@@ -20238,7 +20271,10 @@ value that the router supplies, and also overriding any value associated with
 .option headers_add transports list&!! unset
 .cindex "header lines" "adding in transport"
 .cindex "transport" "header lines; adding"
 .option headers_add transports list&!! unset
 .cindex "header lines" "adding in transport"
 .cindex "transport" "header lines; adding"

-This option specifies a list of text headers, newline-separated,
+This option specifies a list of text headers,
+.new
+newline-separated (by default, changeable in the usual way),
+.wen

 which are (separately) expanded and added to the header
 portion of a message as it is transported, as described in section
 &<<SECTheadersaddrem>>&. Additional header lines can also be specified by
 which are (separately) expanded and added to the header
 portion of a message as it is transported, as described in section
 &<<SECTheadersaddrem>>&. Additional header lines can also be specified by


@@ -20263,7 +20299,10 @@ checked, since this option does not automatically suppress them.
 .option headers_remove transports list&!! unset
 .cindex "header lines" "removing"
 .cindex "transport" "header lines; removing"
 .option headers_remove transports list&!! unset
 .cindex "header lines" "removing"
 .cindex "transport" "header lines; removing"

-This option specifies a list of header names, colon-separated;
+This option specifies a list of header names,
+.new
+colon-separated (by default, changeable in the usual way);
+.wen

 these headers are omitted from the message as it is transported, as described
 in section &<<SECTheadersaddrem>>&. Header removal can also be specified by
 routers.
 these headers are omitted from the message as it is transported, as described
 in section &<<SECTheadersaddrem>>&. Header removal can also be specified by
 routers.


@@ -22988,7 +23027,7 @@ details.
 .cindex "DNS" "DNSSEC"
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.
 .cindex "DNS" "DNSSEC"
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.

-This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
+This applies to all of the SRV, MX, AAAA, A lookup sequence.

 
 
 
 
 
 


@@ -23000,7 +23039,7 @@ This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.  Any returns not having the Authenticated Data bit
 (AD bit) set wil be ignored and logged as a host-lookup failure.
 DNS lookups for domains matching &%dnssec_request_domains%& will be done with
 the dnssec request bit set.  Any returns not having the Authenticated Data bit
 (AD bit) set wil be ignored and logged as a host-lookup failure.

-This applies to all of the SRV, MX A6, AAAA, A lookup sequence.
+This applies to all of the SRV, MX, AAAA, A lookup sequence.

 
 
 
 
 
 


@@ -23151,12 +23190,13 @@ that matches this list, even if the server host advertises PIPELINING support.
 Exim will not try to start a TLS session when delivering to any host that
 matches this list. See chapter &<<CHAPTLS>>& for details of TLS.
 
 Exim will not try to start a TLS session when delivering to any host that
 matches this list. See chapter &<<CHAPTLS>>& for details of TLS.
 

-.option hosts_verify_avoid_tls smtp "host list&!!" *
+.new
+.option hosts_verify_avoid_tls smtp "host list&!!" unset

 .cindex "TLS" "avoiding for certain hosts"
 Exim will not try to start a TLS session for a verify callout,
 or when delivering in cutthrough mode,
 to any host that matches this list.
 .cindex "TLS" "avoiding for certain hosts"
 Exim will not try to start a TLS session for a verify callout,
 or when delivering in cutthrough mode,
 to any host that matches this list.

-Note that the default is to not use TLS.
+.wen

 
 
 .option hosts_max_try smtp integer 5
 
 
 .option hosts_max_try smtp integer 5


@@ -24335,6 +24375,13 @@ A server unexpectedly closed the SMTP connection. There may, of course,
 legitimate reasons for this (host died, network died), but if it repeats a lot
 for the same host, it indicates something odd.
 
 legitimate reasons for this (host died, network died), but if it repeats a lot
 for the same host, it indicates something odd.
 

+.vitem &%lookup%&
+A DNS lookup for a host failed.
+Note that a &%dnslookup%& router will need to have matched
+its &%fail_defer_domains%& option for this retry type to be usable.
+Also note that a &%manualroute%& router will probably need
+its &%host_find_failed%& option set to &%defer%&.
+

 .vitem &%refused_MX%&
 A connection to a host obtained from an MX record was refused.
 
 .vitem &%refused_MX%&
 A connection to a host obtained from an MX record was refused.
 


@@ -27087,8 +27134,8 @@ the feature was not requested by the client.
 .cindex "QUIT, ACL for"
 The ACL for the SMTP QUIT command is anomalous, in that the outcome of the ACL
 does not affect the response code to QUIT, which is always 221. Thus, the ACL
 .cindex "QUIT, ACL for"
 The ACL for the SMTP QUIT command is anomalous, in that the outcome of the ACL
 does not affect the response code to QUIT, which is always 221. Thus, the ACL

-does not in fact control any access. For this reason, the only verbs that are
-permitted are &%accept%& and &%warn%&.
+does not in fact control any access. For this reason, it may only accept
+or warn as its final result.

 
 This ACL can be used for tasks such as custom logging at the end of an SMTP
 session. For example, you can use ACL variables in other ACLs to count
 
 This ACL can be used for tasks such as custom logging at the end of an SMTP
 session. For example, you can use ACL variables in other ACLs to count


@@ -30458,17 +30505,39 @@ av_scanner = aveserver:/var/run/aveserver
 This daemon-type scanner is GPL and free. You can get it at
 &url(http://www.clamav.net/). Some older versions of clamd do not seem to
 unpack MIME containers, so it used to be recommended to unpack MIME attachments
 This daemon-type scanner is GPL and free. You can get it at
 &url(http://www.clamav.net/). Some older versions of clamd do not seem to
 unpack MIME containers, so it used to be recommended to unpack MIME attachments

-in the MIME ACL. This no longer believed to be necessary. One option is
-required: either the path and name of a UNIX socket file, or a hostname or IP
-number, and a port, separated by space, as in the second of these examples:
+in the MIME ACL. This is no longer believed to be necessary.
+
+The options are a list of server specifiers, which may be
+a UNIX socket specification,
+a TCP socket specification,
+or a (global) option.
+
+A socket specification consists of a space-separated list.
+For a Unix socket the first element is a full path for the socket,
+for a TCP socket the first element is the IP address
+and the second a port number,
+Any further elements are per-server (non-global) options.
+These per-server options are supported:
+.code
+retry=<timespec>       Retry on connect fail
+.endd
+
+The &`retry`& option specifies a time after which a single retry for
+a failed connect is made.  The default is to not retry.
+
+If a Unix socket file is specified, only one server is supported.
+
+Examples:

 .code
 av_scanner = clamd:/opt/clamd/socket
 av_scanner = clamd:192.0.2.3 1234
 av_scanner = clamd:192.0.2.3 1234:local
 .code
 av_scanner = clamd:/opt/clamd/socket
 av_scanner = clamd:192.0.2.3 1234
 av_scanner = clamd:192.0.2.3 1234:local

+av_scanner = clamd:192.0.2.3 1234 retry=10s

 av_scanner = clamd:192.0.2.3 1234 : 192.0.2.4 1234
 .endd
 av_scanner = clamd:192.0.2.3 1234 : 192.0.2.4 1234
 .endd

-If the value of av_scanner points to a UNIX socket file or contains the local
-keyword, then the ClamAV interface will pass a filename containing the data
+If the value of av_scanner points to a UNIX socket file or contains the
+&`local`&
+option, then the ClamAV interface will pass a filename containing the data

 to be scanned, which will should normally result in less I/O happening and be
 more efficient.  Normally in the TCP case, the data is streamed to ClamAV as
 Exim does not assume that there is a common filesystem with the remote host.
 to be scanned, which will should normally result in less I/O happening and be
 more efficient.  Normally in the TCP case, the data is streamed to ClamAV as
 Exim does not assume that there is a common filesystem with the remote host.


@@ -30711,14 +30780,22 @@ deny message = This message contains malware ($malware_name)
 .endd
 
 
 .endd
 
 

-.section "Scanning with SpamAssassin" "SECTscanspamass"
+.section "Scanning with SpamAssassin and Rspamd" "SECTscanspamass"

 .cindex "content scanning" "for spam"
 .cindex "spam scanning"
 .cindex "SpamAssassin"
 .cindex "content scanning" "for spam"
 .cindex "spam scanning"
 .cindex "SpamAssassin"

+.cindex "Rspamd"

 The &%spam%& ACL condition calls SpamAssassin's &%spamd%& daemon to get a spam
 The &%spam%& ACL condition calls SpamAssassin's &%spamd%& daemon to get a spam

-score and a report for the message. You can get SpamAssassin at
-&url(http://www.spamassassin.org), or, if you have a working Perl
-installation, you can use CPAN by running:
+score and a report for the message.
+.new
+Support is also provided for Rspamd.
+
+For more information about installation and configuration of SpamAssassin or 
+Rspamd refer to their respective websites at
+&url(http://spamassassin.apache.org) and &url(http://www.rspamd.com)
+.wen
+
+SpamAssassin can be installed with CPAN by running:

 .code
 perl -MCPAN -e 'install Mail::SpamAssassin'
 .endd
 .code
 perl -MCPAN -e 'install Mail::SpamAssassin'
 .endd


@@ -30727,36 +30804,90 @@ documentation to see how you can tweak it. The default installation should work
 nicely, however.
 
 .oindex "&%spamd_address%&"
 nicely, however.
 
 .oindex "&%spamd_address%&"

-After having installed and configured SpamAssassin, start the &%spamd%& daemon.
-By default, it listens on 127.0.0.1, TCP port 783. If you use another host or
-port for &%spamd%&, you must set the &%spamd_address%& option in the global
-part of the Exim configuration as follows (example):
+By default, SpamAssassin listens on 127.0.0.1, TCP port 783 and if you 
+intend to use an instance running on the local host you do not need to set
+&%spamd_address%&. If you intend to use another host or port for SpamAssassin,
+you must set the &%spamd_address%& option in the global part of the Exim
+configuration as follows (example):

 .code
 spamd_address = 192.168.99.45 387
 .endd
 .code
 spamd_address = 192.168.99.45 387
 .endd

-You do not need to set this option if you use the default. As of version 2.60,
-&%spamd%& also supports communication over UNIX sockets. If you want to use
-these, supply &%spamd_address%& with an absolute file name instead of a
-address/port pair:
+
+.new
+To use Rspamd (which by default listens on all local addresses
+on TCP port 11333)
+you should add &%variant=rspamd%& after the address/port pair, for example:
+.code
+spamd_address = 127.0.0.1 11333 variant=rspamd
+.endd
+.wen
+
+As of version 2.60, &%SpamAssassin%& also supports communication over UNIX
+sockets. If you want to us these, supply &%spamd_address%& with an absolute
+file name instead of an address/port pair:

 .code
 spamd_address = /var/run/spamd_socket
 .endd
 You can have multiple &%spamd%& servers to improve scalability. These can
 reside on other hardware reachable over the network. To specify multiple
 &%spamd%& servers, put multiple address/port pairs in the &%spamd_address%&
 .code
 spamd_address = /var/run/spamd_socket
 .endd
 You can have multiple &%spamd%& servers to improve scalability. These can
 reside on other hardware reachable over the network. To specify multiple
 &%spamd%& servers, put multiple address/port pairs in the &%spamd_address%&

-option, separated with colons:
+option, separated with colons (the separator can be changed in the usual way):

 .code
 spamd_address = 192.168.2.10 783 : \
                 192.168.2.11 783 : \
                 192.168.2.12 783
 .endd
 .code
 spamd_address = 192.168.2.10 783 : \
                 192.168.2.11 783 : \
                 192.168.2.12 783
 .endd

-Up to 32 &%spamd%& servers are supported. The servers are queried in a random
-fashion. When a server fails to respond to the connection attempt, all other
+Up to 32 &%spamd%& servers are supported.
+When a server fails to respond to the connection attempt, all other

 servers are tried until one succeeds. If no server responds, the &%spam%&
 condition defers.
 
 servers are tried until one succeeds. If no server responds, the &%spam%&
 condition defers.
 

-&*Warning*&: It is not possible to use the UNIX socket connection method with
-multiple &%spamd%& servers.
+.new
+Unix and TCP socket specifications may be mixed in any order.
+Each element of the list is a list itself, space-separated by default
+and changeable in the usual way.
+
+For TCP socket specifications a host name or IP (v4 or v6, but
+subject to list-separator quoting rules) address can be used,
+and the port can be one or a dash-separated pair.
+In the latter case, the range is tried in strict order.
+
+Elements after the first for Unix sockets, or second for TCP socket,
+are options.
+The supported option are:
+.code
+pri=<priority>      Selection priority
+weight=<value>      Selection bias
+time=<start>-<end>  Use only between these times of day
+retry=<timespec>    Retry on connect fail
+tmo=<timespec>      Connection time limit
+variant=rspamd      Use Rspamd rather than SpamAssassin protocol
+.endd
+
+The &`pri`& option specifies a priority for the server within the list,
+higher values being tried first.
+The deafult priority is 1.
+
+The &`weight`& option specifies a selection bias.
+Within a priority set
+servers are queried in a random fashion, weighted by this value.
+The default value for selection bias is 1.
+
+Time specifications for the &`time`& option are <hour>.<minute>.<second>
+in the local time zone; each element being one or more digits.
+Either the seconds or both minutes and seconds, plus the leading &`.`&
+characters, may be omitted and will be taken as zero.
+
+Timeout specifications for the &`retry`& and &`tmo`& options
+are the usual Exim time interval standard, eg. &`20s`& or &`1m`&.
+
+The &`tmo`& option specifies an overall timeout for communication.
+The default value is two minutes.
+
+The &`retry`& option specifies a time after which a single retry for
+a failed connect is made.
+The default is to not retry.
+.wen

 
 The &%spamd_address%& variable is expanded before use if it starts with
 a dollar sign. In this case, the expansion may return a string that is
 
 The &%spamd_address%& variable is expanded before use if it starts with
 a dollar sign. In this case, the expansion may return a string that is


@@ -30773,7 +30904,10 @@ The right-hand side of the &%spam%& condition specifies a name. This is
 relevant if you have set up multiple SpamAssassin profiles. If you do not want
 to scan using a specific profile, but rather use the SpamAssassin system-wide
 default profile, you can scan for an unknown name, or simply use &"nobody"&.
 relevant if you have set up multiple SpamAssassin profiles. If you do not want
 to scan using a specific profile, but rather use the SpamAssassin system-wide
 default profile, you can scan for an unknown name, or simply use &"nobody"&.

-However, you must put something on the right-hand side.
+.new
+Rspamd does not use this setting. However, you must put something on the
+right-hand side.
+.wen

 
 The name allows you to use per-domain or per-user antispam profiles in
 principle, but this is not straightforward in practice, because a message may
 
 The name allows you to use per-domain or per-user antispam profiles in
 principle, but this is not straightforward in practice, because a message may


@@ -30781,6 +30915,12 @@ have multiple recipients, not necessarily all in the same domain. Because the
 &%spam%& condition has to be called from a DATA ACL in order to be able to
 read the contents of the message, the variables &$local_part$& and &$domain$&
 are not set.
 &%spam%& condition has to be called from a DATA ACL in order to be able to
 read the contents of the message, the variables &$local_part$& and &$domain$&
 are not set.

+Careful enforcement of single-recipient messages
+(eg. by responding with defer in the recipient ACL for all recipients
+after the first),
+or the use of PRDR,
+.cindex "PRDR" "use for per-user SpamAssassin profiles"
+are needed to use this feature.

 
 The right-hand side of the &%spam%& condition is expanded before being used, so
 you can put lookups or conditions there. When the right-hand side evaluates to
 
 The right-hand side of the &%spam%& condition is expanded before being used, so
 you can put lookups or conditions there. When the right-hand side evaluates to


@@ -30827,6 +30967,14 @@ headers, since MUAs can match on such strings.
 .vitem &$spam_report$&
 A multiline text table, containing the full SpamAssassin report for the
 message. Useful for inclusion in headers or reject messages.
 .vitem &$spam_report$&
 A multiline text table, containing the full SpamAssassin report for the
 message. Useful for inclusion in headers or reject messages.

+
+.new
+.vitem &$spam_action$&
+For SpamAssassin either 'reject' or 'no action' depending on the
+spam score versus threshold.
+For Rspamd, the recommended action.
+.wen
+

 .endlist
 
 The &%spam%& condition caches its results unless expansion in
 .endlist
 
 The &%spam%& condition caches its results unless expansion in