X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/8d69247061599b35b60308ca4b75ba529b8dcba2..4af0d74a886c7fbd4e3eec1743f4b1d2d8a4d457:/doc/doc-txt/experimental-spec.txt?ds=inline diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index 8192f3d76..d446f6b67 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -623,10 +623,10 @@ exim will send these forensic emails. It's also advised that you configure a dmarc_forensic_sender because the default sender address construction might be inadequate. - control = dmarc_forensic_enable + control = dmarc_enable_forensic (AGAIN: You can choose not to send these forensic reports by simply -not putting the dmarc_forensic_enable control line at any point in +not putting the dmarc_enable_forensic control line at any point in your exim config. If you don't tell it to send them, it will not send them.) @@ -755,7 +755,7 @@ b. Configure, somewhere before the DATA ACL, the control option to deny dmarc_status = reject !authenticated = * - message = Message from $domain_used_domain failed sender's DMARC policy, REJECT + message = Message from $dmarc_used_domain failed sender's DMARC policy, REJECT @@ -821,7 +821,7 @@ The following variables are likely to be useful depending on the event type: An example might look like: -event_action = ${if = {msg:delivery}{$event_name} \ +event_action = ${if eq {msg:delivery}{$event_name} \ {${lookup pgsql {SELECT * FROM record_Delivery( \ '${quote_pgsql:$sender_address_domain}',\ '${quote_pgsql:${lc:$sender_address_local_part}}', \ @@ -1084,92 +1084,37 @@ QUIT 221 mail.example.net closing connection -DSN Support --------------------------------------------------------------- - -DSN Support tries to add RFC 3461 support to Exim. It adds support for -*) the additional parameters for MAIL FROM and RCPT TO -*) RFC complient MIME DSN messages for all of - success, failure and delay notifications -*) dsn_advertise_hosts main option to select which hosts are able - to use the extension -*) dsn_lasthop router switch to end DSN processing - -In case of failure reports this means that the last three parts, the message body -intro, size info and final text, of the defined template are ignored since there is no -logical place to put them in the MIME message. - -All the other changes are made without changing any defaults - -Building exim: --------------- - -Define -EXPERIMENTAL_DSN=YES -in your Local/Makefile. - -Configuration: --------------- -All DSNs are sent in MIME format if you built exim with EXPERIMENTAL_DSN=YES -No option needed to activate it, and no way to turn it off. - -Failure and delay DSNs are triggered as usual except a sender used NOTIFY=... -to prevent them. - -Support for Success DSNs is added and activated by NOTIFY=SUCCESS by clients. - -Add -dsn_advertise_hosts = * -or a more restrictive host_list to announce DSN in EHLO answers -Those hosts can then use NOTIFY,ENVID,RET,ORCPT options. -If a message is relayed to a DSN aware host without changing the envelope -recipient the options are passed along and no success DSN is generated. - -A redirect router will always trigger a success DSN if requested and the DSN -options are not passed any further. - -A success DSN always contains the recipient address as submitted by the -client as required by RFC. Rewritten addresses are never exposed. - -If you used DSN patch up to 1.3 before remove all "dsn_process" switches from -your routers since you don't need them anymore. There is no way to "gag" -success DSNs anymore. Announcing DSN means answering as requested. - -You can prevent Exim from passing DSN options along to other DSN aware hosts by defining -dsn_lasthop -in a router. Exim will then send the success DSN himself if requested as if -the next hop does not support DSN. -Adding it to a redirect router makes no difference. - - - - -Certificate name checking --------------------------------------------------------------- -The X509 certificates used for TLS are supposed be verified -that they are owned by the expected host. The coding of TLS -support to date has not made these checks. +SOCKS +------------------------------------------------------------ +Support for proxying outbound SMTP via a Socks 5 proxy +(RFC 1928) is included if Exim is compiled with +EXPERIMENTAL_SOCKS defined. -If built with EXPERIMENTAL_CERTNAMES defined, code is -included to do so for server certificates, and a new smtp transport option -"tls_verify_cert_hostname" supported which takes a list of -names for which the checks must be made. The host must -also be in "tls_verify_hosts". +If an smtp transport has a nonempty socks_proxy option +defined, this is active. The option is expanded and +should be a list (colon-separated by default) of +proxy specifiers. Each proxy specifier is a list +(space-separated by default) where the initial element +is an IP address and any subsequent elements are options. -Both Subject and Subject-Alternate-Name certificate fields -are supported, as are wildcard certificates (limited to -a single wildcard being the initial component of a 3-or-more -component FQDN). +Options are a string =. +These options are currently defined: +- "auth", with possible values "none" and "name". + Using "name" selects username/password authentication + per RFC 1929. Default is "none". +- "name" sets the authentication username. Default is empty. +- "pass" sets the authentication password. Default is empty. +- "port" sets the tcp port number for the proxy. Default is 1080. +- "tmo" sets a connection timeout in seconds for this proxy. Default is 5. -The equivalent check on the server for client certificates is not -implemented. At least one major email provider is using a client -certificate which fails this check. They do not retry either without -hte client certificate or in clear. +Proxies from the list are tried in order until +one responds. The timeout for the overall connection +applies to the set of proxied attempts. -It is possible to duplicate the effect of this checking by -creative use of Events. +If events are used, the remote IP/port during a +tcp:connect event will be that of the proxy. @@ -1295,12 +1240,13 @@ MX, A and TLSA records. A TLSA lookup will be done if either of the above options match and the host-lookup succeded using dnssec. -If the TLSA lookup succeeds, a TLS connection will be required -for the host. +If a TLSA lookup is done and succeeds, a DANE-verified TLS connection +will be required for the host. (TODO: specify when fallback happens vs. when the host is not used) -If dane is in use the following transport options are ignored: +If DANE is requested and useable (see above) the following transport +options are ignored: hosts_require_tls tls_verify_hosts tls_try_verify_hosts @@ -1308,6 +1254,10 @@ If dane is in use the following transport options are ignored: tls_crl tls_verify_cert_hostnames +If DANE is not usable, whether requested or not, and CA-anchored +verification evaluation is wanted, the above variables should be set +appropriately. + Currently dnssec_request_domains must be active (need to think about that) and dnssec_require_domains is ignored. @@ -1320,6 +1270,73 @@ in combination with EXPERIMENTAL_EVENT), and a new variable $tls_out_tlsa_usage (detailed above). + +SMTPUTF8 +------------------------------------------------------------ +Internationalised mail name handling. +RFCs 6530, 6533, 5890 + +Compile with EXPERIMENTAL_INTERNATIONAL and libidn. + +New main config option smtputf8_advertise_hosts, default '*', +a host list. If this matches the sending host and +accept_8bitmime is true (the default) then the ESMTP option +SMTPUTF8 will be advertised. + +If the sender specifies the SMTPUTF8 option on a MAIL command +international handling for the message is enabled and +the expansion variable $message_smtputf8 will have value TRUE. + +The option allow_utf8_domains is set to true for this +message. All DNS lookups are converted to a-label form +whatever the setting of allow_utf8_domains. + +Both localparts and domain are maintained as the original +utf8 form internally; any matching or regex use will +require appropriate care. Filenames created, eg. by +the appendfile transport, will have utf8 name. + +Helo names sent by the smtp transport will have any utf8 +components expanded to a-label form. + +Any certificate name checks will be done using the a-label +form of the name. + +Log lines and Received-by: header lines will aquire a "utf8" +prefix on the protocol element, eg. utf8esmtp. + +New expansion operators: + ${utf8_domain_to_alabel:str} + ${utf8_domain_from_alabel:str} + ${utf8_localpart_to_alabel:str} + ${utf8_localpart_from_alabel:str} + +New "control = utf8_downconvert" ACL modifier, +sets a flag requiring that addresses are converted to +a-label form before smtp delivery, for use in a +Message Submission Agent context. Can also be +phrased as "control = utf8_downconvert/1" and is +mandatory. The flag defaults to zero and can be cleared +by "control = utf8_downconvert/0". The value "-1" +may also be used, to use a-label for only if the +destination host does not support SMTPUTF8. + +If mua_wrapper is set, the utf8_downconvert control +defaults to -1 (convert if needed). + + +There is no explicit support for VRFY and EXPN. +Configurations supporting these should inspect +$smtp_command_argument for an SMTPUTF8 argument. + +There is no support for LMTP on Unix sockets. +Using the "lmtp" protocol option on an smtp transport, +for LMTP over TCP, should work as expected. + +Known issues: + - DSN unitext handling is not present + - no provision for converting logging from or to UTF-8 + -------------------------------------------------------------- End of file --------------------------------------------------------------