X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/76146973f89f0e9265d85827285b9258910a56d7..4e0983dcef8dd8630fc77aad39f7606e2ed32199:/doc/doc-docbook/spec.xfpt?ds=sidebyside diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index f7636f85a..0e6a38bd9 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -6959,11 +6959,16 @@ The data from each lookup is concatenated, with newline separators by default, in the same way that multiple DNS records for a single item are handled. A different separator can be specified, as described above. +Modifiers for &(dnsdb)& lookups are givien by optional keywords, +each followed by a comma, +that may appear before the record type. + The &(dnsdb)& lookup fails only if all the DNS lookups fail. If there is a temporary DNS error for any of them, the behaviour is controlled by -an optional keyword followed by a comma that may appear before the record -type. The possible keywords are &"defer_strict"&, &"defer_never"&, and -&"defer_lax"&. With &"strict"& behaviour, any temporary DNS error causes the +a defer-option modifier. +The possible keywords are +&"defer_strict"&, &"defer_never"&, and &"defer_lax"&. +With &"strict"& behaviour, any temporary DNS error causes the whole lookup to defer. With &"never"& behaviour, a temporary DNS error is ignored, and the behaviour is as if the DNS lookup failed to find anything. With &"lax"& behaviour, all the queries are attempted, but a temporary DNS @@ -6976,6 +6981,21 @@ ${lookup dnsdb{a=one.host.com:two.host.com}} Thus, in the default case, as long as at least one of the DNS lookups yields some data, the lookup succeeds. +.new +.cindex "DNSSEC" "dns lookup" +Use of &(DNSSEC)& is controlled by a dnssec modifier. +The possible keywords are +&"dnssec_strict"&, &"dnssec_lax"&, and &"dnssec_never"&. +With &"strict"& or &"lax"& DNSSEC information is requested +with the lookup. +With &"strict"& a response from the DNS resolver that +is not labelled as authenticated data +is treated as equivalent to a temporary DNS error. +The default is &"never"&. + +See also the &$lookup_dnssec_authenticated$& variable. +.wen + @@ -7198,6 +7218,9 @@ them. The following names are recognized: &`USER `& set the DN, for authenticating the LDAP bind &`PASS `& set the password, likewise &`REFERRALS `& set the referrals parameter +.new +&`SERVERS `& set alternate server list for this query only +.wen &`SIZE `& set the limit for the number of entries returned &`TIME `& set the maximum waiting time for a query .endd @@ -7219,6 +7242,15 @@ Netscape SDK; for OpenLDAP no action is taken. The TIME parameter (also a number of seconds) is passed to the server to set a server-side limit on the time taken to complete a search. +.new +The SERVERS parameter allows you to specify an alternate list of ldap servers +to use for an individual lookup. The global ldap_servers option provides a +default list of ldap servers, and a single lookup can specify a single ldap +server to use. But when you need to do a lookup with a list of servers that is +different than the default list (maybe different order, maybe a completely +different set of servers), the SERVERS parameter allows you to specify this +alternate list. +.wen Here is an example of an LDAP query in an Exim lookup that uses some of these values. This is a single line, folded to fit on the page: @@ -8298,7 +8330,14 @@ Both &`+include_unknown`& and &`+ignore_unknown`& may appear in the same list. The effect of each one lasts until the next, or until the end of the list. -To explain the host/ip processing logic a different way for the same ACL: +.new +.section "Mixing wildcarded host names and addresses in host lists" &&& + "SECTmixwilhos" +.cindex "host list" "mixing names and addresses in" + +This section explains the host/ip processing logic with the same concepts +as the previous section, but specifically addresses what happens when a +wildcarded hostname is one of the items in the hostlist. .ilist If you have name lookups or wildcarded host names and @@ -8327,7 +8366,7 @@ If the first &%accept%& fails, Exim goes on to try the second one. See chapter &`+ignore_unknown`&, which was discussed in depth in the first example in this section. .endlist - +.wen .section "Temporary DNS errors when looking up host information" &&& @@ -8399,33 +8438,6 @@ See section &<>&.) -.section "Mixing wildcarded host names and addresses in host lists" &&& - "SECTmixwilhos" -.cindex "host list" "mixing names and addresses in" -If you have name lookups or wildcarded host names and IP addresses in the same -host list, you should normally put the IP addresses first. For example, in an -ACL you could have: -.code -accept hosts = 10.9.8.7 : *.friend.example -.endd -The reason for this lies in the left-to-right way that Exim processes lists. -It can test IP addresses without doing any DNS lookups, but when it reaches an -item that requires a host name, it fails if it cannot find a host name to -compare with the pattern. If the above list is given in the opposite order, the -&%accept%& statement fails for a host whose name cannot be found, even if its -IP address is 10.9.8.7. - -If you really do want to do the name check first, and still recognize the IP -address, you can rewrite the ACL like this: -.code -accept hosts = *.friend.example -accept hosts = 10.9.8.7 -.endd -If the first &%accept%& fails, Exim goes on to try the second one. See chapter -&<>& for details of ACLs. - - - .section "Address lists" "SECTaddresslist" @@ -11441,6 +11453,16 @@ ability to find the amount of free space (only true for experimental systems), the space value is -1. See also the &%check_log_space%& option. +.new +.vitem &$lookup_dnssec_authenticated$& +.vindex "&$lookup_dnssec_authenticated$&" +This variable is set after a DNS lookup done by +either a dnslookup router or a dnsdb lookup expansion. +It will be empty if &(DNSSEC)& was not requested, +&"no"& if the result was not labelled as authenticated data +and &"yes"& if it was. +.wen + .vitem &$mailstore_basename$& .vindex "&$mailstore_basename$&" This variable is set only when doing deliveries in &"mailstore"& format in the @@ -17642,6 +17664,35 @@ when there is a DNS lookup error. +.new +.option dnssec_request_domains dnslookup "domain list&!!" unset +.cindex "MX record" "security" +.cindex "DNSSEC" "MX lookup" +.cindex "security" "MX lookup" +.cindex "DNS" "DNSSEC" +DNS lookups for domains matching &%dnssec_request_domains%& will be done with +the dnssec request bit set. +This applies to all of the SRV, MX A6, AAAA, A lookup sequence. + +See also the &$lookup_dnssec_authenticated$& variable. +.wen + + + +.new +.option dnssec_require_domains dnslookup "domain list&!!" unset +.cindex "MX record" "security" +.cindex "DNSSEC" "MX lookup" +.cindex "security" "MX lookup" +.cindex "DNS" "DNSSEC" +DNS lookups for domains matching &%dnssec_request_domains%& will be done with +the dnssec request bit set. Any returns not having the Authenticated Data bit +(AD bit) set wil be ignored and logged as a host-lookup failure. +This applies to all of the SRV, MX A6, AAAA, A lookup sequence. +.wen + + + .option mx_domains dnslookup "domain list&!!" unset .cindex "MX record" "required to exist" .cindex "SRV record" "required to exist" @@ -34653,9 +34704,17 @@ This utility is a Perl script contributed by Matt Hubbard. It runs .code exim -bpu .endd -to obtain a queue listing with undelivered recipients only, and then greps the -output to select messages that match given criteria. The following selection -options are available: +or (in case &*-a*& switch is specified) +.code +exim -bp +.endd +.new +The &*-C*& option is used to specify an alternate &_exim.conf_& which might +contain alternate exim configuration the queue management might be using. +.wen + +to obtain a queue listing, and then greps the output to select messages +that match given criteria. The following selection options are available: .vlist .vitem &*-f*&&~<&'regex'&> @@ -34702,6 +34761,9 @@ Brief format &-- one line per message. .vitem &*-R*& Display messages in reverse order. + +.vitem &*-a*& +Include delivered recipients in queue listing. .endlist There is one more option, &%-h%&, which outputs a list of options.