From: Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
Date: Fri, 25 Nov 2016 10:23:26 +0000 (+0100)
Subject: Merge from master into 4.next
X-Git-Tag: exim-4_91_RC1~148^2~42^2~18
X-Git-Url: https://git.exim.org/users/heiko/exim.git/commitdiff_plain/4fab92fbc2b63bac2d89c1dae69fa1845cb640b7

Merge from master into 4.next

Done with git merge --squash -x theirs master
---

diff --git a/.editorconfig b/.editorconfig
index b348a15d8..90ad8b43a 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -16,12 +16,15 @@ root = true
 [*]
 end_of_line = lf
 insert_final_newline = true
-
-[*.{c,h}]
+trim_trailing_whitespace = true
 indent_style = space
-indent_size = 2
 tab_width = 8
-trim_trailing_whitespace = true
+
+[*.{c,h}{,-*}]
+indent_size = 2
+
+[runtest]
+indent_size = 2
 
 # Tab indentation (no size specified)
 [Makefile]
diff --git a/.mailmap b/.mailmap
new file mode 100644
index 000000000..8373e4697
--- /dev/null
+++ b/.mailmap
@@ -0,0 +1,46 @@
+Alexander Tsoy <alexander@tsoy.me>
+Alexandru Chirila <alex@alexkiro.com>
+Andreas Metzler <ametzler@bebt.de> <ametzler@downhill.at.eu.org>
+Andreas Metzler <ametzler@bebt.de> <eximusers@downhill.at.eu.org>
+Andrew Colin Kissa <andrew@topdog.za.net>
+Andrew Lewis <exim@judo.za.org>
+Axel Rau <axel.rau@chaos1.de>
+bes-internal <bes.internal@gmail.com>
+David Woodhouse <David.Woodhouse@intel.com>
+Dirk Mueller <dmueller@suse.com>
+Eric Andresen <eandres@google.com>
+Gedalya <gedalya@gedalya.net>
+Graeme Fowler <graemef@exim.org> <graeme@exim.org>
+Heiko Schlichting <heiko@fu-berlin.de>
+Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de>
+Heiko Schlittermann (HS12-RIPE) <hs@schlittermann.de> <hs+exim@schlittermann.de>
+Jasen Betts <jasen@xnet.co.nz>
+Jeremy Harris <jgh146exb@wizmail.org>
+Jeremy Harris <jgh146exb@wizmail.org> <jgh@exim.org>
+# root <jgh146exb@wizmail.org>
+J. Nick Koston <nick@cpanel.net>
+John Jetmore <jetmore@exim.org> <jj33@pobox.com>
+Julian Brown <julian.brown@cpanel.net>
+Lars Mueller <lmuelle@suse.com>
+Lars Timmann <lt@mcs.de>
+Magnus Holmgren <holmgren@lysator.liu.se>
+mg <mg@fork.pl>
+Michael Fischer v. Mollard <info@konfusator.de>
+Michael Haardt <michael@moria.de>
+Miroslav Lichvar <mlichvar@redhat.com>
+Nigel Metheringham <nigel@exim.org> <nigel.metheringham@jrtheatre.co.uk>
+Nigel Metheringham <nigel@exim.org> <nm9762github@muesli.org.uk>
+Philip Hazel <ph10@hermes.cam.ac.uk>
+Phil Pennock <pdp@exim.org> <pdp@spodhuis.org>
+Richard Clayton <richard@highwayman.com>
+Roman <rommer@active.by>
+Sebastian Wiedenroth <wiedi@frubar.net>
+Simon Amor <simon@leaky.org>
+Steve Campbell <steve@computurn.com>
+Ted Cooper <patches.exim.xiii.x@linuxwan.net>
+Timo Sirainen <tss@iki.fi>
+Todd Lyons <tlyons@exim.org> <tlyons@ivenue.com>
+Tom Kistner <tom@duncanthrax.net> <tom@tahini.csx.cam.ac.uk>
+Tony Finch <dot@dotat.at> <dot@dot.at>
+Viktor Dukhovni <viktor1dane@dukhovni.org>
+Wolfgang Breyha <wbreyha@gmx.net>
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index c03a9bd1b..f9a80558e 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -45,14 +45,14 @@
 . Update the Copyright year (only) when changing content.
 . /////////////////////////////////////////////////////////////////////////////
 
-.set previousversion "4.86"
+.set previousversion "4.87"
 .include ./local_params
 
 .set ACL "access control lists (ACLs)"
 .set I   "&nbsp;&nbsp;&nbsp;&nbsp;"
 
 .macro copyyear
-2015
+2016
 .endmacro
 
 . /////////////////////////////////////////////////////////////////////////////
@@ -2627,6 +2627,8 @@ users to set envelope senders.
 
 .cindex "&'From:'& header line"
 .cindex "&'Sender:'& header line"
+.cindex "header lines" "From:"
+.cindex "header lines" "Sender:"
 For a trusted user, there is never any check on the contents of the &'From:'&
 header line, and a &'Sender:'& line is never added. Furthermore, any existing
 &'Sender:'& line in incoming local (non-TCP/IP) messages is not removed.
@@ -2788,7 +2790,7 @@ continuations. As in Exim's run time configuration, white space at the start of
 continuation lines is ignored. Each argument or data line is passed through the
 string expansion mechanism, and the result is output. Variable values from the
 configuration file (for example, &$qualify_domain$&) are available, but no
-message-specific values (such as &$sender_domain$&) are set, because no message
+message-specific values (such as &$message_exim_id$&) are set, because no message
 is being processed (but see &%-bem%& and &%-Mset%&).
 
 &*Note*&: If you use this mechanism to test lookups, and you change the data
@@ -3049,7 +3051,8 @@ trusted user for the sender of a message to be set in this way.
 .oindex "&%-bmalware%&"
 .cindex "testing", "malware"
 .cindex "malware scan test"
-This debugging option causes Exim to scan the given file,
+This debugging option causes Exim to scan the given file or directory
+(depending on the used scanner interface),
 using the malware scanning framework.  The option of &%av_scanner%& influences
 this option, so if &%av_scanner%&'s value is dependent upon an expansion then
 the expansion should have defaults which apply to this invocation.  ACLs are
@@ -3151,6 +3154,11 @@ using one of the words &%router_list%&, &%transport_list%&, or
 settings can be obtained by using &%routers%&, &%transports%&, or
 &%authenticators%&.
 
+.cindex "environment"
+If &%environment%& is given as an argument, the set of environment
+variables is output, line by line. Using the &%-n%& flag suppresses the value of the
+variables.
+
 .cindex "options" "macro &-- extracting"
 If invoked by an admin user, then &%macro%&, &%macro_list%& and &%macros%&
 are available, similarly to the drivers.  Because macros are sometimes used
@@ -3552,9 +3560,7 @@ example:
 exim '-D ABC = something' ...
 .endd
 &%-D%& may be repeated up to 10 times on a command line.
-.new
 Only macro names up to 22 letters long can be set.
-.wen
 
 
 .vitem &%-d%&<&'debug&~options'&>
@@ -3821,6 +3827,14 @@ This option is not intended for use by external callers. It is used internally
 by Exim in conjunction with the &%-MC%& option. It signifies that the
 remote host supports the ESMTP &_DSN_& extension.
 
+.new
+.vitem &%-MCG%&
+.oindex "&%-MCG%&"
+This option is not intended for use by external callers. It is used internally
+by Exim in conjunction with the &%-MC%& option. It signifies that an
+alternate queue is used, named by the following option.
+.wen
+
 .vitem &%-MCP%&
 .oindex "&%-MCP%&"
 This option is not intended for use by external callers. It is used internally
@@ -4012,7 +4026,8 @@ for that message.
 .oindex "&%-n%&"
 This option is interpreted by Sendmail to mean &"no aliasing"&.
 For normal modes of operation, it is ignored by Exim.
-When combined with &%-bP%& it suppresses the name of an option from being output.
+When combined with &%-bP%& it makes the output more terse (suppresses
+option names, environment values and config pretty printing).
 
 .vitem &%-O%&&~<&'data'&>
 .oindex "&%-O%&"
@@ -4366,7 +4381,10 @@ relax this restriction (and also the same requirement for the &%-M%&, &%-R%&,
 and &%-S%& options).
 
 .cindex "queue runner" "description of operation"
-The &%-q%& option starts one queue runner process. This scans the queue of
+.new
+If other commandline options do not specify an action,
+.wen
+the &%-q%& option starts one queue runner process. This scans the queue of
 waiting messages, and runs a delivery process for each one in turn. It waits
 for each delivery process to finish before starting the next one. A delivery
 process may not actually do any deliveries if the retry times for the addresses
@@ -4451,8 +4469,29 @@ The &'l'& (the letter &"ell"&) flag specifies that only local deliveries are to
 be done. If a message requires any remote deliveries, it remains on the queue
 for later delivery.
 
-.vitem &%-q%&<&'qflags'&>&~<&'start&~id'&>&~<&'end&~id'&>
+.new
+.vitem &%-q[q][i][f[f]][l][G<name>[/<time>]]]%&
+.oindex "&%-qG%&"
+.cindex queue named
+.cindex "named queues"
 .cindex "queue" "delivering specific messages"
+If the &'G'& flag and a name is present, the queue runner operates on the
+queue with the given name rather than the default queue.
+The name should not contain a &'/'& character.
+For a periodic queue run (see below)
+append to the name a slash and a time value.
+
+If other commandline options speicify an action, a &'-qG<name>'& option
+will specify a queue to operate on.
+For example:
+.code
+exim -bp -qGquarantine
+mailq -qGquarantime
+exim -qGoffpeak -Rf @special.domain.example
+.endd
+.wen
+
+.vitem &%-q%&<&'qflags'&>&~<&'start&~id'&>&~<&'end&~id'&>
 When scanning the queue, Exim can be made to skip over messages whose ids are
 lexically less than a given value by following the &%-q%& option with a
 starting message id. For example:
@@ -4994,6 +5033,27 @@ address lists. In Exim 4 these are handled better by named lists &-- see
 section &<<SECTnamedlists>>&.
 
 
+.new
+.section "Builtin macros" "SECTbuiltinmacros"
+Exim defines some macros depending on facilities available, which may
+differ due to build-time definitions and from one release to another.
+All of these macros start with an underscore.
+They can be used to conditionally include parts of a configuration
+(see below).
+
+The following classes of macros are defined:
+.display
+&` _HAVE_                     `&  build-time defines
+&` _DRVR_AUTH_                `&  authehticator drivers
+&` _DRVR_RTR_                 `&  router drivers
+&` _DRVR_TPT_                 `&  transport drivers
+&` _OPT_                      `&  configuration option support
+.endd
+
+Use an &"exim -bP macros"& command to get the list of macros.
+.wen
+
+
 .section "Conditional skips in the configuration file" "SECID46"
 .cindex "configuration file" "conditional skips"
 .cindex "&`.ifdef`&"
@@ -5097,7 +5157,11 @@ with the characters &"0x"&, in which case the remainder is interpreted as a
 hexadecimal number.
 
 If an integer value is followed by the letter K, it is multiplied by 1024; if
-it is followed by the letter M, it is multiplied by 1024x1024. When the values
+it is followed by the letter M, it is multiplied by 1024x1024;
+.new
+if by the letter G, 1024x1024x1024.
+.wen
+When the values
 of integer option settings are output, values which are an exact multiple of
 1024 or 1024x1024 are sometimes, but not always, printed using the letters K
 and M. The printing style is independent of the actual input format that was
@@ -5617,7 +5681,7 @@ It provides a list of domains for which the &"percent hack"& is to operate.
 This is an almost obsolete form of explicit email routing. If you do not know
 anything about it, you can safely ignore this topic.
 
-The last two settings in the main part of the default configuration are
+The next two settings in the main part of the default configuration are
 concerned with messages that have been &"frozen"& on Exim's queue. When a
 message is frozen, Exim no longer continues to try to deliver it. Freezing
 occurs when a bounce message encounters a permanent failure because the sender
@@ -5635,6 +5699,44 @@ message (whether a bounce message or not) is to be timed out (and discarded)
 after a week. In this configuration, the first setting ensures that no failing
 bounce message ever lasts a week.
 
+Exim queues it's messages in a spool directory. If you expect to have
+large queues, you may consider using this option. It splits the spool
+directory into subdirectories to avoid file system degradation from
+many files in a single directory, resulting in better performance.
+Manual manipulation of queued messages becomes more complex (though fortunately
+not often needed).
+.code
+# split_spool_directory = true
+.endd
+
+In an ideal world everybody follows the standards. For non-ASCII
+messages RFC 2047 is a standard, allowing a maximum line length of 76
+characters. Exim adheres that standard and won't process messages which
+violate this standard. (Even ${rfc2047:...} expansions will fail.)
+In particular, the Exim maintainers have had multiple reports of
+problems from Russian administrators of issues until they disable this
+check, because of some popular, yet buggy, mail composition software.
+.code
+# check_rfc2047_length = false
+.endd
+
+If you need to be strictly RFC compliant you may wish to disable the
+8BITMIME advertisement. Use this, if you exchange mails with systems
+that are not 8-bit clean.
+.code
+# accept_8bitmime = false
+.endd
+
+Libraries you use may depend on specific environment settings.  This
+imposes a security risk (e.g. PATH). There are two lists:
+&%keep_environment%& for the variables to import as they are, and
+&%add_environment%& for variables we want to set to a fixed value.
+Note that TZ is handled separately, by the $%timezone%$ runtime
+option and by the TIMEZONE_DEFAULT buildtime option.
+.code
+# keep_environment = ^LDAP
+# add_environment = PATH=/usr/bin::/bin
+.endd
 
 
 .section "ACL configuration" "SECID54"
@@ -6105,7 +6207,8 @@ errors:
 This causes any temporarily failing address to be retried every 15 minutes for
 2 hours, then at intervals starting at one hour and increasing by a factor of
 1.5 until 16 hours have passed, then every 6 hours up to 4 days. If an address
-is not delivered after 4 days of temporary failure, it is bounced.
+is not delivered after 4 days of temporary failure, it is bounced. The time is
+measured from first failure, not from the time the message was received.
 
 If the retry section is removed from the configuration, or is empty (that is,
 if no retry rules are defined), Exim will not retry deliveries. This turns
@@ -6186,7 +6289,11 @@ Chapter &<<CHAPplaintext>>& covers both.
 Exim supports the use of regular expressions in many of its options. It
 uses the PCRE regular expression library; this provides regular expression
 matching that is compatible with Perl 5. The syntax and semantics of
-regular expressions is discussed in many Perl reference books, and also in
+regular expressions is discussed in
+.new
+online Perl manpages, in
+.wen
+many Perl reference books, and also in
 Jeffrey Friedl's &'Mastering Regular Expressions'&, which is published by
 O'Reilly (see &url(http://www.oreilly.com/catalog/regex2/)).
 
@@ -6567,7 +6674,7 @@ lookup types support only literal keys.
 .endlist ilist
 
 
-.section "Query-style lookup types" "SECID62"
+.section "Query-style lookup types" "SECTquerystylelookups"
 .cindex "lookup" "query-style types"
 .cindex "query-style lookup" "list of types"
 The supported query-style lookup types are listed below. Further details about
@@ -6625,12 +6732,10 @@ password value. For example:
 PostgreSQL database. See section &<<SECTsql>>&.
 
 .next
-.new
 .cindex "Redis lookup type"
 .cindex lookup Redis
 &(redis)&: The format of the query is an SQL statement that is passed to a
 Redis database. See section &<<SECTsql>>&.
-.wen
 
 .next
 .cindex "sqlite lookup type"
@@ -7008,14 +7113,12 @@ Retries for the dnsdb lookup can be controlled by a retry modifier.
 The form if &"retry_VAL"& where VAL is an integer.
 The default count is set by the main configuration option &%dns_retry%&.
 
-.new
 .cindex cacheing "of dns lookup"
 .cindex TTL "of dns lookup"
 .cindex DNS TTL
 Dnsdb lookup results are cached within a single process (and its children).
 The cache entry lifetime is limited to the smallest time-to-live (TTL)
 value of the set of returned DNS records.
-.wen
 
 
 .section "Pseudo dnsdb record types" "SECID66"
@@ -7568,7 +7671,6 @@ a query is successfully processed. The result of a query may be that no data is
 found, but that is still a successful query. In other words, the list of
 servers provides a backup facility, not a list of different places to look.
 
-.new
 For Redis the global option need not be specified if all queries contain their
 own server information &-- see section &<<SECTspeserque>>&.
 If specified, the option must be set to a colon-separated list of server
@@ -7584,9 +7686,7 @@ The database number is optional; if present that number is selected in the backe
 .next
 The password is optional; if present it is used to authenticate to the backend
 .endlist
-.wen
 
-.new
 The &%quote_mysql%&, &%quote_pgsql%&, and &%quote_oracle%& expansion operators
 convert newline, tab, carriage return, and backspace to \n, \t, \r, and \b
 respectively, and the characters single-quote, double-quote, and backslash
@@ -7594,7 +7694,6 @@ itself are escaped with backslashes.
 
 The &%quote_redis%& expansion operator
 escapes whitespace and backslash characters with a backslash.
-.wen
 
 .section "Specifying the server in the query" "SECTspeserque"
 For MySQL, PostgreSQL and Redis lookups (but not currently for Oracle and InterBase),
@@ -7641,10 +7740,8 @@ ${lookup pgsql{servers=master/db/name/pw; UPDATE ...} }
 For MySQL, an empty host name or the use of &"localhost"& in &%mysql_servers%&
 causes a connection to the server on the local host by means of a Unix domain
 socket. An alternate socket can be specified in parentheses.
-.new
 An option group name for MySQL option files can be specified in square brackets;
 the default value is &"exim"&.
-.wen
 The full syntax of each item in &%mysql_servers%& is:
 .display
 <&'hostname'&>::<&'port'&>(<&'socket name'&>)[<&'option group'&>]/&&&
@@ -7739,9 +7836,16 @@ domain, host, address and local part lists.
 
 
 
-.section "Expansion of lists" "SECID75"
+.section "Expansion of lists" "SECTlistexpand"
 .cindex "expansion" "of lists"
-Each list is expanded as a single string before it is used. The result of
+Each list is expanded as a single string before it is used.
+
+.new
+&'Exception: the router headers_remove option, where list-item
+splitting is done before string-expansion.'&
+.wen
+
+The result of
 expansion must be a list, possibly containing empty items, which is split up
 into separate items for matching. By default, colon is the separator character,
 but this can be varied if necessary. See sections &<<SECTlistconstruct>>& and
@@ -9110,7 +9214,7 @@ configuration, you must add &%-export-dynamic%& to EXTRALIBS.
 
 .vitem "&*${env{*&<&'key'&>&*}{*&<&'string1'&>&*}{*&<&'string2'&>&*}}*&"
 .cindex "expansion" "extracting value from environment"
-.cindex "environment" "value from"
+.cindex "environment" "values from"
 The key is first expanded separately, and leading and trailing white space
 removed.
 This is then searched for as a name in the environment.
@@ -9130,6 +9234,9 @@ search failure.
 If {<&'string1'&>} is omitted the search result is substituted on
 search success.
 
+The environment is adjusted by the &%keep_environment%& and
+&%add_environment%& main section options.
+
 
 .vitem "&*${extract{*&<&'key'&>&*}{*&<&'string1'&>&*}{*&<&'string2'&>&*}&&&
        {*&<&'string3'&>&*}}*&"
@@ -9137,8 +9244,8 @@ search success.
 .cindex "&%extract%&" "substrings by key"
 The key and <&'string1'&> are first expanded separately. Leading and trailing
 white space is removed from the key (but not from any of the strings). The key
-must not consist entirely of digits. The expanded <&'string1'&> must be of the
-form:
+must not be empty and must not consist entirely of digits.
+The expanded <&'string1'&> must be of the form:
 .display
 <&'key1'&> = <&'value1'&>  <&'key2'&> = <&'value2'&> ...
 .endd
@@ -9412,14 +9519,12 @@ condition = ${if >{$acl_m4}{3}}
 
 
 
-.new
 .vitem &*${imapfolder{*&<&'foldername'&>&*}}*&
 .cindex expansion "imap folder"
 .cindex "&%imapfolder%& expansion item"
 This item converts a (possibly multilevel, or with non-ASCII characters)
 folder specification to a Maildir name for filesystem use.
 For information on internationalisation support see &<<SECTi18nMDA>>&.
-.wen
 
 
 
@@ -10049,7 +10154,6 @@ environments where Exim uses base 36 instead of base 62 for its message
 identifiers, base-36 digits. The number is converted to decimal and output as a
 string.
 
-.new
 .vitem &*${base64:*&<&'string'&>&*}*&
 .cindex "expansion" "base64 encoding"
 .cindex "base64 encoding" "in string expansion"
@@ -10066,7 +10170,6 @@ returns the base64 encoding of the DER form of the certificate.
 .cindex "base64 decoding" "in string expansion"
 .cindex "&%base64d%& expansion item"
 This operator converts a base64-encoded string into the un-coded form.
-.wen
 
 
 .vitem &*${domain:*&<&'string'&>&*}*&
@@ -10084,6 +10187,15 @@ escape sequences starting with a backslash. Whether characters with the most
 significant bit set (so-called &"8-bit characters"&) count as printing or not
 is controlled by the &%print_topbitchars%& option.
 
+.new
+.vitem &*${escape8bit:*&<&'string'&>&*}*&
+.cindex "expansion" "escaping 8-bit characters"
+.cindex "&%escape8bit%& expansion item"
+If the string contains and characters with the most significant bit set,
+they are converted to escape sequences starting with a backslash.
+Backslashes and DEL characters are also converted.
+.wen
+
 
 .vitem &*${eval:*&<&'string'&>&*}*&&~and&~&*${eval10:*&<&'string'&>&*}*&
 .cindex "expansion" "expression evaluation"
@@ -10213,7 +10325,6 @@ as is, and other byte values are converted to &`\xNN`&, for example a
 byte value 127 is converted to &`\x7f`&.
 
 
-.new
 .vitem &*${ipv6denorm:*&<&'string'&>&*}*&
 .cindex "&%ipv6denorm%& expansion item"
 .cindex "IP address" normalisation
@@ -10231,7 +10342,6 @@ Leading zeroes of groups are omitted, and the longest
 set of zero-valued groups is replaced with a double colon.
 A trailing ipv4-style dotted-decimal set is converted to hex.
 Pure IPv4 addresses are converted to IPv4-mapped IPv6.
-.wen
 
 
 .vitem &*${lc:*&<&'string'&>&*}*&
@@ -10459,7 +10569,7 @@ variables or headers inside regular expressions.
 .cindex "SHA-1 hash"
 .cindex "expansion" "SHA-1 hashing"
 .cindex certificate fingerprint
-.cindex "&%sha2%& expansion item"
+.cindex "&%sha1%& expansion item"
 The &%sha1%& operator computes the SHA-1 hash value of the string, and returns
 it as a 40-digit hexadecimal number, in which any letters are in upper case.
 
@@ -10467,16 +10577,38 @@ If the string is a single variable of type certificate,
 returns the SHA-1 hash fingerprint of the certificate.
 
 
-.vitem &*${sha256:*&<&'certificate'&>&*}*&
+.vitem &*${sha256:*&<&'string'&>&*}*&
 .cindex "SHA-256 hash"
 .cindex certificate fingerprint
 .cindex "expansion" "SHA-256 hashing"
 .cindex "&%sha256%& expansion item"
-The &%sha256%& operator computes the SHA-256 hash fingerprint of the
-certificate,
+.new
+The &%sha256%& operator computes the SHA-256 hash value of the string
 and returns
 it as a 64-digit hexadecimal number, in which any letters are in upper case.
-Only arguments which are a single variable of certificate type are supported.
+.wen
+
+If the string is a single variable of type certificate,
+returns the SHA-256 hash fingerprint of the certificate.
+
+
+.new
+.vitem &*${sha3:*&<&'string'&>&*}*& &&&
+       &*${sha3_<n>:*&<&'string'&>&*}*&
+.cindex "SHA3 hash"
+.cindex "expansion" "SHA3 hashing"
+.cindex "&%sha3%& expansion item"
+The &%sha3%& operator computes the SHA3-256 hash value of the string
+and returns
+it as a 64-digit hexadecimal number, in which any letters are in upper case.
+
+If a number is appended, separated by an underbar, it specifies
+the output length.  Values of 224, 256, 384 and 512 are accepted;
+with 256 being the default.
+
+The &%sha3%& expansion item is only supported if Exim has been
+compiled with GnuTLS 3.5.0 or later.
+.wen
 
 
 .vitem &*${stat:*&<&'string'&>&*}*&
@@ -10499,9 +10631,7 @@ systems for files larger than 2GB.
 
 .vitem &*${str2b64:*&<&'string'&>&*}*&
 .cindex "&%str2b64%& expansion item"
-.new
 Now deprecated, a synonym for the &%base64%& expansion operator.
-.wen
 
 
 
@@ -10556,7 +10686,6 @@ This forces the letters in the string into upper-case.
 .cindex "&%utf8clean%& expansion item"
 This replaces any invalid utf-8 sequence in the string by the character &`?`&.
 
-.new
 .vitem "&*${utf8_domain_to_alabel:*&<&'string'&>&*}*&" &&&
        "&*${utf8_domain_from_alabel:*&<&'string'&>&*}*&" &&&
        "&*${utf8_localpart_to_alabel:*&<&'string'&>&*}*&" &&&
@@ -10571,7 +10700,6 @@ This replaces any invalid utf-8 sequence in the string by the character &`?`&.
 .cindex "&%utf8_localpart_from_alabel%& expansion item"
 These convert EAI mail name components between UTF-8 and a-label forms.
 For information on internationalisation support see &<<SECTi18nMTA>>&.
-.wen
 .endlist
 
 
@@ -11499,18 +11627,6 @@ contain the trailing slash. If &$config_file$& does not contain a slash,
 .vindex "&$config_file$&"
 The name of the main configuration file Exim is using.
 
-.vitem &$demime_errorlevel$&
-.vindex "&$demime_errorlevel$&"
-This variable is available when Exim is compiled with
-the content-scanning extension and the obsolete &%demime%& condition. For
-details, see section &<<SECTdemimecond>>&.
-
-.vitem &$demime_reason$&
-.vindex "&$demime_reason$&"
-This variable is available when Exim is compiled with the
-content-scanning extension and the obsolete &%demime%& condition. For details,
-see section &<<SECTdemimecond>>&.
-
 .vitem &$dkim_cur_signer$& &&&
        &$dkim_verify_status$& &&&
        &$dkim_verify_reason$& &&&
@@ -11642,12 +11758,6 @@ The first character is a major version number, currently 4.
 Then after a dot, the next group of digits is a minor version number.
 There may be other characters following the minor version.
 
-.vitem &$found_extension$&
-.vindex "&$found_extension$&"
-This variable is available when Exim is compiled with the
-content-scanning extension and the obsolete &%demime%& condition. For details,
-see section &<<SECTdemimecond>>&.
-
 .vitem &$header_$&<&'name'&>
 This is not strictly an expansion variable. It is expansion syntax for
 inserting the message header line with the given name. Note that the name must
@@ -11669,7 +11779,8 @@ explicitly set a home directory for use by a transport; this can be overridden
 by a setting on the transport itself.
 
 When running a filter test via the &%-bf%& option, &$home$& is set to the value
-of the environment variable HOME.
+of the environment variable HOME, which is subject to the
+&%keep_environment%& and &%add_environment%& main config options.
 
 .vitem &$host$&
 .vindex "&$host$&"
@@ -11745,6 +11856,12 @@ See &$host_lookup_deferred$&.
 This variable is set to the remote host's TCP port whenever &$host$& is set
 for an outbound connection.
 
+.vitem &$initial_cwd$&
+.vindex "&$initial_cwd$&
+This variable contains the full path name of the initial working
+directory of the current Exim process. This may differ from the current
+working directory, as Exim changes this to "/" during early startup, and
+to &$spool_directory$& later.
 
 .vitem &$inode$&
 .vindex "&$inode$&"
@@ -12141,22 +12258,20 @@ qualified host name. See also &$smtp_active_hostname$&.
 
 
 .new
-.vitem &$proxy_host_address$& &&&
-       &$proxy_host_port$& &&&
-       &$proxy_target_address$& &&&
-       &$proxy_target_port$& &&&
+.vitem &$proxy_external_address$& &&&
+       &$proxy_external_port$& &&&
+       &$proxy_local_address$& &&&
+       &$proxy_local_port$& &&&
        &$proxy_session$&
 These variables are only available when built with Proxy Protocol
 or Socks5 support
 For details see chapter &<<SECTproxyInbound>>&.
 .wen
 
-.new
 .vitem &$prdr_requested$&
 .cindex "PRDR" "variable for"
 This variable is set to &"yes"& if PRDR was requested by the client for the
 current message, otherwise &"no"&.
-.wen
 
 .vitem &$prvscheck_address$&
 This variable is used in conjunction with the &%prvscheck%& expansion item,
@@ -12182,6 +12297,14 @@ The value set for the &%qualify_domain%& option in the configuration file.
 The value set for the &%qualify_recipient%& option in the configuration file,
 or if not set, the value of &$qualify_domain$&.
 
+.new
+.vitem &$queue_name$&
+.vindex &$queue_name$&
+.cindex "named queues"
+.cindex queues named
+The name of the spool queue in use; empty for the default queue.
+.wen
+
 .vitem &$rcpt_count$&
 .vindex "&$rcpt_count$&"
 When a message is being received by SMTP, this variable contains the number of
@@ -12770,7 +12893,7 @@ When a message is received from a remote host over an encrypted SMTP
 connection, this variable is set to the cipher suite that was negotiated, for
 example DES-CBC3-SHA. In other circumstances, in particular, for message
 received over unencrypted connections, the variable is empty. Testing
-&$tls_cipher$& for emptiness is one way of distinguishing between encrypted and
+&$tls_in_cipher$& for emptiness is one way of distinguishing between encrypted and
 non-encrypted connections during ACL processing.
 
 The deprecated &$tls_cipher$& variable is the same as &$tls_in_cipher$& during message reception,
@@ -12905,8 +13028,7 @@ or external command, as described above. It is also used during a
 
 .vitem &$verify_mode$&
 .vindex "&$verify_mode$&"
-While a router or transport is being run in verify mode
-or for cutthrough delivery,
+While a router or transport is being run in verify mode or for cutthrough delivery,
 contains "S" for sender-verification or "R" for recipient-verification.
 Otherwise, empty.
 
@@ -13471,6 +13593,7 @@ listed in more than one group.
 .row &%slow_lookup_log%&             "control logging of slow DNS lookups"
 .row &%syslog_duplication%&          "controls duplicate log lines on syslog"
 .row &%syslog_facility%&             "set syslog &""facility""& field"
+.row &%syslog_pid%&                  "pid in syslog lines"
 .row &%syslog_processname%&          "set syslog &""ident""& field"
 .row &%syslog_timestamp%&            "timestamp syslog lines"
 .row &%write_rejectlog%&             "control use of message log"
@@ -13733,6 +13856,7 @@ See also the &'Policy controls'& section above.
 .table2
 .row &%accept_8bitmime%&             "advertise 8BITMIME"
 .row &%auth_advertise_hosts%&        "advertise AUTH to these hosts"
+.row &%chunking_advertise_hosts%&    "advertise CHUNKING to these hosts"
 .row &%dsn_advertise_hosts%&         "advertise DSN extensions to these hosts"
 .row &%ignore_fromline_hosts%&       "allow &""From ""& from these hosts"
 .row &%ignore_fromline_local%&       "allow &""From ""& from local SMTP"
@@ -13974,6 +14098,12 @@ received. See chapter &<<CHAPACL>>& for further details.
 This option defines the ACL that is run when an SMTP VRFY command is
 received. See chapter &<<CHAPACL>>& for further details.
 
+.option add_environment main "string list" empty
+.cindex "environment" "set values"
+This option allows to set individual environment variables that the
+currently linked libraries and programs in child processes use.
+See &<<SECTpipeenv>>& for the environment of &(pipe)& transports.
+
 .option admin_groups main "string list&!!" unset
 .cindex "admin user"
 This option is expanded just once, at the start of Exim's processing. If the
@@ -14135,7 +14265,7 @@ If the message being returned has lines longer than this value it is
 treated as if the &%bounce_return_size_limit%& (below) restriction was exceeded.
 
 The option also applies to bounces returned when an error is detected
-during reception of a messsage.
+during reception of a message.
 In this case lines from the original are truncated.
 
 The option does not apply to messages generated by an &(autoreply)& transport.
@@ -14216,11 +14346,15 @@ $primary_hostname-$tod_epoch-testing
 See section &<<CALLaddparcall>>& for details of how this value is used.
 
 
-.option check_log_inodes main integer 0
+.new
+.option check_log_inodes main integer 100
+.wen
 See &%check_spool_space%& below.
 
 
-.option check_log_space main integer 0
+.new
+.option check_log_space main integer 10M
+.wen
 See &%check_spool_space%& below.
 
 .oindex "&%check_rfc2047_length%&"
@@ -14235,11 +14369,15 @@ of the RFC, generates overlong encoded words. If &%check_rfc2047_length%& is
 set false, Exim recognizes encoded words of any length.
 
 
-.option check_spool_inodes main integer 0
+.new
+.option check_spool_inodes main integer 100
+.wen
 See &%check_spool_space%& below.
 
 
-.option check_spool_space main integer 0
+.new
+.option check_spool_space main integer 10M
+.wen
 .cindex "checking disk space"
 .cindex "disk space, checking"
 .cindex "spool directory" "checking space"
@@ -14250,7 +14388,7 @@ message is accepted.
 .vindex "&$log_space$&"
 .vindex "&$spool_inodes$&"
 .vindex "&$spool_space$&"
-When any of these options are set, they apply to all incoming messages. If you
+When any of these options are nonzero, they apply to all incoming messages. If you
 want to apply different checks to different kinds of message, you can do so by
 testing the variables &$log_inodes$&, &$log_space$&, &$spool_inodes$&, and
 &$spool_space$& in an ACL with appropriate additional conditions.
@@ -14259,7 +14397,7 @@ testing the variables &$log_inodes$&, &$log_space$&, &$spool_inodes$&, and
 &%check_spool_space%& and &%check_spool_inodes%& check the spool partition if
 either value is greater than zero, for example:
 .code
-check_spool_space = 10M
+check_spool_space = 100M
 check_spool_inodes = 100
 .endd
 The spool partition is the one that contains the directory defined by
@@ -14278,12 +14416,29 @@ SIZE parameter on the MAIL command, its value is added to the
 &%check_spool_space%& is zero, unless &%no_smtp_check_spool_space%& is set.
 
 The values for &%check_spool_space%& and &%check_log_space%& are held as a
-number of kilobytes. If a non-multiple of 1024 is specified, it is rounded up.
+number of kilobytes (though specified in bytes).
+If a non-multiple of 1024 is specified, it is rounded up.
 
 For non-SMTP input and for batched SMTP input, the test is done at start-up; on
 failure a message is written to stderr and Exim exits with a non-zero code, as
 it obviously cannot send an error message of any kind.
 
+.new
+There is a slight performance penalty for these checks.
+Versions of Exim preceding 4.88 had these disabled by default;
+high-rate intallations confident they will never run out of resources
+may wish to deliberately disable them.
+.wen
+
+.new
+.option chunking_advertise_hosts main "host list&!!" *
+.cindex CHUNKING advertisement
+.cindex "RFC 3030" "CHUNKING"
+The CHUNKING extension (RFC3030) will be advertised in the EHLO message to
+these hosts.
+Hosts may use the BDAT command as an alternate to DATA.
+.wen
+
 .option daemon_smtp_ports main string &`smtp`&
 .cindex "port" "for daemon"
 .cindex "TCP/IP" "setting listening ports"
@@ -14305,6 +14460,7 @@ See &%daemon_startup_retries%&.
 .option delay_warning main "time list" 24h
 .cindex "warning of delay"
 .cindex "delay warning, specifying"
+.cindex "queue" "delay warning"
 When a message is delayed, Exim sends a warning message to the sender at
 intervals specified by this option. The data is a colon-separated list of times
 after which to send warning messages. If the value of the option is an empty
@@ -14634,12 +14790,10 @@ own &'Reply-To:'& header line, the value of the &%errors_reply_to%& option is
 not used.
 
 
-.new
 .option event_action main string&!! unset
 .cindex events
 This option declares a string to be expanded for Exim's events mechanism.
 For details see &<<CHAPevents>>&.
-.wen
 
 
 .option exim_group main string "compile-time configured"
@@ -14987,12 +15141,10 @@ If the &%smtp_connection%& log selector is not set, this option has no effect.
 
 
 
-.new
 .option hosts_proxy main "host list&!!" unset
 .cindex proxy "proxy protocol"
 This option enables use of Proxy Protocol proxies for incoming
 connections.  For details see &<<SECTproxyInbound>>&.
-.wen
 
 
 .option hosts_treat_as_local main "domain list&!!" unset
@@ -15061,6 +15213,34 @@ process rather than a remote host, and is using &%-bs%& to inject the messages,
 .option ignore_fromline_local main boolean false
 See &%ignore_fromline_hosts%& above.
 
+.option keep_environment main "string list" unset
+.cindex "environment" "values from"
+This option contains a string list of environment variables to keep.
+You have to trust these variables or you have to be sure that
+these variables do not impose any security risk. Keep in mind that
+during the startup phase Exim is running with an effective UID 0 in most
+installations. As the default value is an empty list, the default
+environment for using libraries, running embedded Perl code, or running
+external binaries is empty, and does not not even contain PATH or HOME.
+
+Actually the list is interpreted as a list of patterns
+(&<<SECTlistexpand>>&), except that it is not expanded first.
+
+WARNING: Macro substitution is still done first, so having a macro
+FOO and having FOO_HOME in your &%keep_environment%& option may have
+unexpected results. You may work around this using a regular expression
+that does not match the macro name: ^[F]OO_HOME$.
+
+Current versions of Exim issue a warning during startup if you do not mention
+&%keep_environment%& in your runtime configuration file and if your
+current environment is not empty. Future versions may not issue that warning
+anymore.
+
+See the &%add_environment%& main config option for a way to set
+environment variables to a fixed value.  The environment for &(pipe)&
+transports is handled separately, see section &<<SECTpipeenv>>& for
+details.
+
 
 .option keep_malformed main time 4d
 This option specifies the length of time to keep messages whose spool files
@@ -15862,7 +16042,7 @@ large list. In most situations, &%queue_run_in_order%& should not be set.
 
 
 
-.option queue_run_max main integer 5
+.option queue_run_max main integer&!! 5
 .cindex "queue runner" "maximum number of"
 This controls the maximum number of queue runner processes that an Exim daemon
 can run simultaneously. This does not mean that it starts them all at once,
@@ -15877,6 +16057,13 @@ the limit, allowing any number of simultaneous queue runner processes to be
 run. If you do not want queue runs to occur, omit the &%-q%&&'xx'& setting on
 the daemon's command line.
 
+.new
+.cindex queues named
+.cindex "named queues"
+To set limits for different named queues use
+an expansion depending on the &$queue_name$& variable.
+.wen
+
 .option queue_smtp_domains main "domain list&!!" unset
 .cindex "queueing incoming messages"
 .cindex "message" "queueing remote deliveries"
@@ -16105,6 +16292,12 @@ it qualifies them only if the message came from a host that matches
 &%sender_unqualified_hosts%&, or if the message was submitted locally (not
 using TCP/IP), and the &%-bnq%& option was not set.
 
+.option set_environment main "string list" empty
+.cindex "environment"
+This option allows to set individual environment variables that the
+currently linked libraries and programs in child processes use. The
+default list is empty,
+
 
 .option slow_lookup_log main integer 0
 .cindex "logging" "slow lookups"
@@ -16540,14 +16733,12 @@ example, instead of &"Administrative prohibition"&, it might give:
 .endd
 
 
-.new
 .option smtputf8_advertise_hosts main "host list&!!" *
 .cindex "SMTPUTF8" "advertising"
 When Exim is built with support for internationalised mail names,
 the availability therof is advertised in
 response to EHLO only to those client hosts that match this option. See
 chapter &<<CHAPi18n>>& for details of Exim's support for internationalisation.
-.wen
 
 
 .option spamd_address main string "see below"
@@ -16666,6 +16857,15 @@ If this option is unset, &"mail"& is used. See chapter &<<CHAPlog>>& for
 details of Exim's logging.
 
 
+.option syslog_pid main boolean true
+.cindex "syslog" "pid"
+If &%syslog_pid%& is set false, the PID on Exim's log lines are
+omitted when these lines are sent to syslog. (Syslog normally prefixes
+the log lines with the PID of the logging process automatically.) You need
+to enable the &`+pid`& log selector item, if you want Exim to write it's PID
+into the logs.) See chapter &<<CHAPlog>>& for details of Exim's logging.
+
+
 
 .option syslog_processname main string &`exim`&
 .cindex "syslog" "process name; setting"
@@ -16778,6 +16978,7 @@ messages that are released by &%ignore_bounce_errors_after%&).
 
 .option timezone main string unset
 .cindex "timezone, setting"
+.cindex "environment" "values from"
 The value of &%timezone%& is used to set the environment variable TZ while
 running Exim (if it is different on entry). This ensures that all timestamps
 created by Exim are in the required timezone. If you want all your timestamps
@@ -16793,9 +16994,7 @@ runs. This is appropriate behaviour for obtaining wall-clock time on some, but
 unfortunately not all, operating systems.
 
 
-.new
 .option tls_advertise_hosts main "host list&!!" *
-.wen
 .cindex "TLS" "advertising"
 .cindex "encryption" "on SMTP connection"
 .cindex "SMTP" "encrypted connection"
@@ -16803,11 +17002,9 @@ When Exim is built with support for TLS encrypted connections, the availability
 of the STARTTLS command to set up an encrypted session is advertised in
 response to EHLO only to those client hosts that match this option. See
 chapter &<<CHAPTLS>>& for details of Exim's support for TLS.
-.new
 Note that the default value requires that a certificate be supplied
-using the &%tls_certificate%& option.  If no certificate is available then
-the &%tls_advertise_hosts%& option should be set empty.
-.wen
+using the &%tls_certificate%& option.  If TLS support for incoming connections
+is not required the &%tls_advertise_hosts%& option should be set empty.
 
 
 .option tls_certificate main string&!! unset
@@ -16828,6 +17025,11 @@ if the OpenSSL build supports TLS extensions and the TLS client sends the
 Server Name Indication extension, then this option and others documented in
 &<<SECTtlssni>>& will be re-expanded.
 
+.new
+If this option is unset or empty a fresh self-signed certificate will be
+generated for every connection.
+.wen
+
 .option tls_crl main string&!! unset
 .cindex "TLS" "server certificate revocation list"
 .cindex "certificate" "revocation list for server"
@@ -16863,7 +17065,15 @@ larger prime than requested.
 The value of this option is expanded and indicates the source of DH parameters
 to be used by Exim.
 
-If it is a filename starting with a &`/`&, then it names a file from which DH
+.new
+&*Note: The Exim Maintainers strongly recommend using a filename with site-generated
+local DH parameters*&, which has been supported across all versions of Exim.  The
+other specific constants available are a fallback so that even when
+"unconfigured", Exim can offer Perfect Forward Secrecy in older ciphersuites in TLS.
+.wen
+
+If &%tls_dhparam%& is a filename starting with a &`/`&,
+then it names a file from which DH
 parameters should be loaded.  If the file exists, it should hold a PEM-encoded
 PKCS#3 representation of the DH prime.  If the file does not exist, for
 OpenSSL it is an error.  For GnuTLS, Exim will attempt to create the file and
@@ -16879,23 +17089,39 @@ Exim will attempt to load a file from inside the spool directory.  If the file
 does not exist, Exim will attempt to create it.
 See section &<<SECTgnutlsparam>>& for further details.
 
+.new
 If Exim is using OpenSSL and this option is empty or unset, then Exim will load
-a default DH prime; the default is the 2048 bit prime described in section
+a default DH prime; the default is Exim-specific but lacks verifiable provenance.
+
+In older versions of Exim the default was the 2048 bit prime described in section
 2.2 of RFC 5114, "2048-bit MODP Group with 224-bit Prime Order Subgroup", which
 in IKE is assigned number 23.
 
 Otherwise, the option must expand to the name used by Exim for any of a number
-of DH primes specified in RFC 2409, RFC 3526 and RFC 5114.  As names, Exim uses
-"ike" followed by the number used by IKE, of "default" which corresponds to
-"ike23".
+of DH primes specified in RFC 2409, RFC 3526, RFC 5114, RFC 7919, or from other
+sources.  As names, Exim uses a standard specified name, else "ike" followed by
+the number used by IKE, or "default" which corresponds to
+&`exim.dev.20160529.3`&.
 
-The available primes are:
+The available standard primes are:
+&`ffdhe2048`&, &`ffdhe3072`&, &`ffdhe4096`&, &`ffdhe6144`&, &`ffdhe8192`&,
 &`ike1`&, &`ike2`&, &`ike5`&,
 &`ike14`&, &`ike15`&, &`ike16`&, &`ike17`&, &`ike18`&,
-&`ike22`&, &`ike23`& (aka &`default`&) and &`ike24`&.
+&`ike22`&, &`ike23`& and &`ike24`&.
+
+The available additional primes are:
+&`exim.dev.20160529.1`&, &`exim.dev.20160529.2`& and &`exim.dev.20160529.3`&.
 
 Some of these will be too small to be accepted by clients.
 Some may be too large to be accepted by clients.
+The open cryptographic community has suspicions about the integrity of some
+of the later IKE values, which led into RFC7919 providing new fixed constants
+(the "ffdhe" identifiers).
+
+At this point, all of the "ike" values should be considered obsolete;
+they're still in Exim to avoid breaking unusual configurations, but are
+candidates for removal the next time we have backwards-incompatible changes.
+.wen
 
 The TLS protocol does not negotiate an acceptable size for this; clients tend
 to hard-drop connections if what is offered by the server is unacceptable,
@@ -16921,7 +17147,7 @@ this option selects a EC curve for use by Exim.
 Curve names of the form &'prime256v1'& are accepted.
 For even more-recent library versions, names of the form &'P-512'&
 are also accepted, plus the special value &'auto'&
-which tell the library to choose.
+which tells the library to choose.
 
 If the option is set to an empty string, no EC curves will be enabled.
 
@@ -16934,9 +17160,7 @@ must if set expand to the absolute path to a file which contains a current
 status proof for the server's certificate, as obtained from the
 Certificate Authority.
 
-.new
 Usable for GnuTLS 3.4.4 or 3.3.17 or OpenSSL 1.1.0 (or later).
-.wen
 
 
 .option tls_on_connect_ports main "string list" unset
@@ -17463,7 +17687,7 @@ This applies to all of the SRV, MX, AAAA, A lookup sequence.
 .cindex "DNSSEC" "MX lookup"
 .cindex "security" "MX lookup"
 .cindex "DNS" "DNSSEC"
-DNS lookups for domains matching &%dnssec_request_domains%& will be done with
+DNS lookups for domains matching &%dnssec_require_domains%& will be done with
 the dnssec request bit set.  Any returns not having the Authenticated Data bit
 (AD bit) set will be ignored and logged as a host-lookup failure.
 This applies to all of the SRV, MX, AAAA, A lookup sequence.
@@ -19764,12 +19988,17 @@ list1:   :include:/opt/lists/list1
 .endd
 .next
 .cindex "address redirection" "to black hole"
-Sometimes you want to throw away mail to a particular local part. Making the
-&%data%& option expand to an empty string does not work, because that causes
-the router to decline. Instead, the alias item
+.cindex "delivery" "discard"
+.cindex "delivery" "blackhole"
 .cindex "black hole"
 .cindex "abandoning mail"
-&':blackhole:'& can be used. It does what its name implies. No delivery is
+Sometimes you want to throw away mail to a particular local part.  Making the
+&%data%& option expand to an empty string does not work, because that causes
+the router to decline. Instead, the alias item
+.code
+:blackhole:
+.endd
+can be used. It does what its name implies. No delivery is
 done, and no error message is generated. This has the same effect as specifying
 &_/dev/null_& as a destination, but it can be independently disabled.
 
@@ -20424,7 +20653,7 @@ See &%skip_syntax_errors%& above.
 .chapter "Environment for running local transports" "CHAPenvironment" &&&
          "Environment for local transports"
 .scindex IIDenvlotra1 "local transports" "environment for"
-.scindex IIDenvlotra2 "environment for local transports"
+.scindex IIDenvlotra2 "environment" "local transports"
 .scindex IIDenvlotra3 "transport" "local; environment for"
 Local transports handle deliveries to files and pipes. (The &(autoreply)&
 transport can be thought of as similar to a pipe.) Exim always runs transports
@@ -20690,7 +20919,6 @@ resent to other recipients.
 .cindex events
 This option declares a string to be expanded for Exim's events mechanism.
 For details see &<<CHAPevents>>&.
-.wen
 
 
 .option group transports string&!! "Exim group"
@@ -20740,7 +20968,7 @@ is forced to fail, no action is taken. Other expansion failures are treated as
 errors and cause the delivery to be deferred.
 
 Unlike most options, &%headers_remove%& can be specified multiple times
-for a router; all listed headers are removed.
+for a transport; all listed headers are removed.
 
 &*Warning*&: Because of the separate expansion of the list items,
 items that contain a list separator must have it doubled.
@@ -20794,7 +21022,6 @@ transport, the &[initgroups()]& function is called when running the transport
 to ensure that any additional groups associated with the uid are set up.
 
 
-.new
 .option max_parallel transports integer&!! unset
 .cindex limit "transport parallelism"
 .cindex transport "parallel processes"
@@ -20817,7 +21044,6 @@ relevant hints database whenever your system reboots. The names of the files
 start with &_misc_& and they are kept in the &_spool/db_& directory. There
 may be one or two files, depending on the type of DBM in use. The same files
 are used for ETRN and smtp transport serialization.
-.wen
 
 
 .option message_size_limit transports string&!! 0
@@ -20966,9 +21192,7 @@ headers that some sites insist on.
 This option sets up a filtering (in the Unix shell sense) process for messages
 at transport time. It should not be confused with mail filtering as set up by
 individual users or via a system filter.
-.new
 If unset, or expanding to an empty string, no filtering is done.
-.wen
 
 When the message is about to be written out, the command specified by
 &%transport_filter%& is started up in a separate, parallel process, and
@@ -22720,10 +22944,8 @@ If two messages arrive at almost the same time, and both are routed to a pipe
 delivery, the two pipe transports may be run concurrently. You must ensure that
 any pipe commands you set up are robust against this happening. If the commands
 write to a file, the &%exim_lock%& utility might be of use.
-.new
 Alternatively the &%max_parallel%& option could be used with a value
 of "1" to enforce serialization.
-.wen
 
 
 
@@ -22843,11 +23065,12 @@ with &%use_shell%&, and the whole mechanism is inherently less secure.
 
 .section "Environment variables" "SECTpipeenv"
 .cindex "&(pipe)& transport" "environment for command"
-.cindex "environment for pipe transport"
+.cindex "environment" "&(pipe)& transport"
 The environment variables listed below are set up when the command is invoked.
 This list is a compromise for maximum compatibility with other MTAs. Note that
 the &%environment%& option can be used to add additional variables to this
-environment.
+environment. The environment for the &(pipe)& transport is not subject
+to the &%add_environment%& and &%keep_environment%& main config options.
 .display
 &`DOMAIN            `&   the domain of the address
 &`HOME              `&   the home directory, if set
@@ -22942,7 +23165,7 @@ Exim, and each argument is separately expanded, as described in section
 
 .option environment pipe string&!! unset
 .cindex "&(pipe)& transport" "environment for command"
-.cindex "environment for &(pipe)& transport"
+.cindex "environment" "&(pipe)& transport"
 This option is used to add additional variables to the environment in which the
 command runs (see section &<<SECTpipeenv>>& for the default list). Its value is
 a string which is expanded, and then interpreted as a colon-separated list of
@@ -23513,7 +23736,7 @@ This applies to all of the SRV, MX, AAAA, A lookup sequence.
 .cindex "DNSSEC" "MX lookup"
 .cindex "security" "MX lookup"
 .cindex "DNS" "DNSSEC"
-DNS lookups for domains matching &%dnssec_request_domains%& will be done with
+DNS lookups for domains matching &%dnssec_require_domains%& will be done with
 the dnssec request bit set.  Any returns not having the Authenticated Data bit
 (AD bit) set will be ignored and logged as a host-lookup failure.
 This applies to all of the SRV, MX, AAAA, A lookup sequence.
@@ -23768,6 +23991,35 @@ connects. If authentication fails, Exim will try to transfer the message
 unauthenticated. See also &%hosts_require_auth%&, and chapter
 &<<CHAPSMTPAUTH>>& for details of authentication.
 
+.new
+.option hosts_try_chunking smtp "host list&!!" *
+.cindex CHUNKING "enabling, in client"
+.cindex BDAT "SMTP command"
+.cindex "RFC 3030" "CHUNKING"
+This option provides a list of servers to which, provided they announce
+CHUNKING support, Exim will attempt to use BDAT commands rather than DATA.
+BDAT will not be used in conjuction with a transport filter.
+.wen
+
+.new
+.option hosts_try_fastopen smtp "host list!!" unset
+.option "fast open, TCP" "enabling, in client"
+.option "TCP Fast Open" "enabling, in client"
+.option "RFC 7413" "TCP Fast Open"
+This option provides a list of servers to which, provided
+the facility is supported by this system, Exim will attempt to
+perform a TCP Fast Open.
+No data is sent on the SYN segment but, if the remote server also
+supports the facility, it can send its SMTP banner immediately after
+the SYN,ACK segment.  This can save up to one round-trip time.
+
+The facility is only active for previously-contacted servers,
+as the initiator must present a cookie in the SYN segment.
+
+On (at least some) current Linux distributions the facility must be enabled
+in the kernel by the sysadmin before the support is usable.
+.wen
+
 .option hosts_try_prdr smtp "host list&!!" *
 .cindex "PRDR" "enabling, optional in client"
 This option provides a list of servers to which, provided they announce
@@ -23915,9 +24167,7 @@ start with &_misc_& and they are kept in the &_spool/db_& directory. There
 may be one or two files, depending on the type of DBM in use. The same files
 are used for ETRN serialization.
 
-.new
 See also the &%max_parallel%& generic transport option.
-.wen
 
 
 .option size_addition smtp integer 1024
@@ -23937,12 +24187,10 @@ Alternatively, if the value of &%size_addition%& is set negative, it disables
 the use of the SIZE option altogether.
 
 
-.new
 .option socks_proxy smtp string&!! unset
 .cindex proxy SOCKS
 This option enables use of SOCKS proxies for connections made by the
 transport.  For details see &<<SECTproxySOCKS>>&.
-.wen
 
 
 .option tls_certificate smtp string&!! unset
@@ -24102,7 +24350,7 @@ and certificate verification fails the TLS connection is closed.
 .option tls_verify_hosts smtp "host list&!!" unset
 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
-This option gives a list of hosts for which. on encrypted connections,
+This option gives a list of hosts for which, on encrypted connections,
 certificate verification must succeed.
 The &%tls_verify_certificates%& option must also be set.
 If both this option and &%tls_try_verify_hosts%& are unset
@@ -26568,7 +26816,7 @@ whereas a plaintext SMTP AUTH done inside TLS is not.
 . to require one of a set of specific certs that define a given account
 . (the verification is still required, but mostly irrelevant).
 . This would help for per-device use.
-. 
+.
 . However, for the future we really need support for checking a
 . user cert in LDAP - which probably wants a base-64 DER.
 
@@ -26887,7 +27135,8 @@ Documentation of the strings accepted may be found in the GnuTLS manual, under
 &url(http://www.gnutls.org/manual/html_node/Priority-Strings.html),
 but beware that this relates to GnuTLS 3, which may be newer than the version
 installed on your system.  If you are using GnuTLS 3,
-&url(http://www.gnutls.org/manual/gnutls.html#Listing-the-ciphersuites-in-a-priority-string, then the example code)
+then the example code
+&url(http://www.gnutls.org/manual/gnutls.html#Listing-the-ciphersuites-in-a-priority-string)
 on that site can be used to test a given string.
 
 For example:
@@ -26932,10 +27181,17 @@ with the error
 If a STARTTLS command is issued within an existing TLS session, it is
 rejected with a 554 error code.
 
-To enable TLS operations on a server, you must set &%tls_advertise_hosts%& to
-match some hosts. You can, of course, set it to * to match all hosts.
-However, this is not all you need to do. TLS sessions to a server won't work
-without some further configuration at the server end.
+To enable TLS operations on a server, the &%tls_advertise_hosts%& option
+must be set to match some hosts. The default is * which matches all hosts.
+
+.new
+If this is all you do, TLS encryption will be enabled but not authentication -
+meaning that the peer has no assurance it is actually you he is talking to.
+You gain protection from a passive sniffer listening on the wire but not
+from someone able to intercept the communication.
+.wen
+
+Further protection requires some further configuration at the server end.
 
 It is rumoured that all existing clients that support TLS/SSL use RSA
 encryption. To make this work you need to set, in the server,
@@ -27103,9 +27359,7 @@ starts retrying to fetch an OCSP proof some time before its current
 proof expires.  The downside is that it requires server support.
 
 Unless Exim is built with the support disabled,
-.new
 or with GnuTLS earlier than version 3.3.16 / 3.4.8
-.wen
 support for OCSP stapling is included.
 
 There is a global option called &%tls_ocsp_file%&.
@@ -27312,8 +27566,13 @@ during TLS session handshake, to permit alternative values to be chosen:
 
 Great care should be taken to deal with matters of case, various injection
 attacks in the string (&`../`& or SQL), and ensuring that a valid filename
-can always be referenced; it is important to remember that &$tls_sni$& is
+can always be referenced; it is important to remember that &$tls_in_sni$& is
 arbitrary unverified data provided prior to authentication.
+.new
+Further, the initial cerificate is loaded before SNI is arrived, so
+an expansion for &%tls_certificate%& must have a default which is used
+when &$tls_in_sni$& is empty.
+.wen
 
 The Exim developers are proceeding cautiously and so far no other TLS options
 are re-expanded.
@@ -27493,9 +27752,6 @@ a realistic ACL for checking RCPT commands. This is discussed in chapter
 .section "Testing ACLs" "SECID188"
 The &%-bh%& command line option provides a way of testing your ACL
 configuration locally by running a fake SMTP session with which you interact.
-The host &'relay-test.mail-abuse.org'& provides a service for checking your
-relaying configuration (see section &<<SECTcheralcon>>& for more details).
-
 
 
 .section "Specifying when ACLs are used" "SECID189"
@@ -27610,11 +27866,9 @@ Note that a client may issue more than one EHLO or HELO command in an SMTP
 session, and indeed is required to issue a new EHLO or HELO after successfully
 setting up encryption following a STARTTLS command.
 
-.new
 Note also that a deny neither forces the client to go away nor means that
 mail will be refused on the connection.  Consider checking for
 &$sender_helo_name$& being defined in a MAIL or RCPT ACL to do that.
-.wen
 
 If the command is accepted by an &%accept%& verb that has a &%message%&
 modifier, the message may not contain more than one line (it will be truncated
@@ -27641,6 +27895,17 @@ received, before the final response to the DATA command is sent. This is
 the ACL specified by &%acl_smtp_data%&, which is the second ACL that is
 associated with the DATA command.
 
+.new
+.cindex CHUNKING "BDAT command"
+.cindex BDAT "SMTP command"
+.cindex "RFC 3030" CHUNKING
+If CHUNKING was advertised and a BDAT command sequence is received,
+the &%acl_smtp_predata%& ACL is not run.
+. XXX why not?  It should be possible, for the first BDAT.
+The &%acl_smtp_data%& is run after the last BDAT command and all of
+the data specified is received.
+.wen
+
 For both of these ACLs, it is not possible to reject individual recipients. An
 error response rejects the entire message. Unfortunately, it is known that some
 MTAs do not treat hard (5&'xx'&) responses to the DATA command (either
@@ -27693,11 +27958,9 @@ for some or all recipients.
 PRDR may be used to support per-user content filtering.  Without it
 one must defer any recipient after the first that has a different
 content-filter configuration.  With PRDR, the RCPT-time check
-.new
 .cindex "PRDR" "variable for"
 for this can be disabled when the variable &$prdr_requested$&
 is &"yes"&.
-.wen
 Any required difference in behaviour of the main DATA-time
 ACL should however depend on the PRDR-time ACL having run, as Exim
 will avoid doing so in some situations (e.g.  single-recipient mails).
@@ -27964,7 +28227,7 @@ provides a means of specifying an &"and"& conjunction between conditions. For
 example:
 .code
 deny  dnslists = list1.example
-dnslists = list2.example
+      dnslists = list2.example
 .endd
 If there are no conditions, the verb is always obeyed. Exim stops evaluating
 the conditions and modifiers when it reaches a condition that fails. What
@@ -27986,8 +28249,8 @@ after &%endpass%&, the ACL returns &"deny"&. Consider this statement, used to
 check a RCPT command:
 .code
 accept domains = +local_domains
-endpass
-verify = recipient
+       endpass
+       verify = recipient
 .endd
 If the recipient domain does not match the &%domains%& condition, control
 passes to the next statement. If it does match, the recipient is verified, and
@@ -28539,6 +28802,19 @@ all the conditions are true, wherever it appears in an ACL command, whereas
 effect.
 
 
+.new
+.vitem &*queue*&&~=&~<&'text'&>
+This modifier specifies the use of a named queue for spool files
+for the message.
+It can only be used before the message is received (i.e. not in
+the DATA ACL).
+This could be used, for example, for known high-volume burst sources
+of traffic, or for quarantine of messages.
+Separate queue-runner processes will be needed for named queues.
+If the text after expansion is empty, the default queue is used.
+.wen
+
+
 .vitem &*remove_header*&&~=&~<&'text'&>
 This modifier specifies one or more header names in a colon-separated list
  that are to be removed from an incoming message, assuming, of course, that
@@ -28625,7 +28901,7 @@ Notice that we put back the lower cased version afterwards, assuming that
 is what is wanted for subsequent tests.
 
 
-.vitem &*control&~=&~cutthrough_delivery*&
+.vitem &*control&~=&~cutthrough_delivery/*&<&'options'&>
 .cindex "&ACL;" "cutthrough routing"
 .cindex "cutthrough" "requesting"
 This option requests delivery be attempted while the item is being received.
@@ -28639,7 +28915,9 @@ and data is copied from one to the other.
 
 An attempt to set this option for any recipient but the first
 for a mail will be quietly ignored.
-If a recipient-verify callout connection is subsequently
+If a recipient-verify callout
+(with use_sender)
+connection is subsequently
 requested in the same ACL it is held open and used for
 any subsequent recipients and the data,
 otherwise one is made after the initial RCPT ACL completes.
@@ -28650,6 +28928,12 @@ Note also that headers cannot be
 modified by any of the post-data ACLs (DATA, MIME and DKIM).
 Headers may be modified by routers (subject to the above) and transports.
 
+All the usual ACLs are called; if one results in the message being
+rejected, all effort spent in delivery (including the costs on
+the ultimate destination) will be wasted.
+Note that in the case of data-time ACLs this includes the entire
+message body.
+
 Cutthrough delivery is not supported via transport-filters or when DKIM signing
 of outgoing messages is done, because it sends data to the ultimate destination
 before the entire message has been received from the source.
@@ -28657,11 +28941,20 @@ It is not supported for messages received with the SMTP PRDR option in use.
 
 Should the ultimate destination system positively accept or reject the mail,
 a corresponding indication is given to the source system and nothing is queued.
-If there is a temporary error the item is queued for later delivery in the
-usual fashion. If the item is successfully delivered in cutthrough mode
+If the item is successfully delivered in cutthrough mode
 the delivery log lines are tagged with ">>" rather than "=>" and appear
 before the acceptance "<=" line.
 
+.new
+If there is a temporary error the item is queued for later delivery in the
+usual fashion.
+This behaviour can be adjusted by appending the option &*defer=*&<&'value'&>
+to the control; the default value is &"spool"& and the alternate value
+&"pass"& copies an SMTP defer response from the target back to the initiator
+and does not queue the message.
+Note that this is independent of any receipient verify conditions in the ACL.
+.wen
+
 Delivery in this mode avoids the generation of a bounce mail to a
 (possibly faked)
 sender when the destination system is doing content-scan based rejection.
@@ -28675,13 +28968,18 @@ with &`-d`&, with the output going to a new logfile, by default called
 &'debuglog'&.  The filename can be adjusted with the &'tag'& option, which
 may access any variables already defined.  The logging may be adjusted with
 the &'opts'& option, which takes the same values as the &`-d`& command-line
-option.  Some examples (which depend on variables that don't exist in all
+option.
+.new
+Logging may be stopped, and the file removed, with the &'kill'& option.
+.wen
+Some examples (which depend on variables that don't exist in all
 contexts):
 .code
       control = debug
       control = debug/tag=.$sender_host_address
       control = debug/opts=+expand+acl
       control = debug/tag=.$message_exim_id/opts=+expand
+      control = debug/kill
 .endd
 
 
@@ -28878,12 +29176,10 @@ data is read.
 &*Note:*& This control applies only to the current message, not to any others
 that are being submitted at the same time using &%-bs%& or &%-bS%&.
 
-.new
 .vitem &*control&~=&~utf8_downconvert*&
 This control enables conversion of UTF-8 in message addresses
 to a-label form.
 For details see &<<SECTi18nMTA>>&.
-.wen
 .endlist vlist
 
 
@@ -28922,7 +29218,7 @@ any ACL verb, including &%deny%& (though this is potentially useful only in a
 RCPT ACL).
 
 Headers will not be added to the message if the modifier is used in
-DATA, MIME or DKIM ACLs for messages delivered by cutthrough routing.
+DATA, MIME or DKIM ACLs for a message delivered by cutthrough routing.
 
 Leading and trailing newlines are removed from
 the data for the &%add_header%& modifier; if it then
@@ -29023,8 +29319,8 @@ receiving a message). The message must ultimately be accepted for
 with any ACL verb, including &%deny%&, though this is really not useful for
 any verb that doesn't result in a delivered message.
 
-Headers will not be removed to the message if the modifier is used in
-DATA, MIME or DKIM ACLs for messages delivered by cutthrough routing.
+Headers will not be removed from the message if the modifier is used in
+DATA, MIME or DKIM ACLs for a message delivered by cutthrough routing.
 
 More than one header can be removed at the same time by using a colon separated
 list of header names. The header matching is case insensitive. Wildcards are
@@ -29162,12 +29458,6 @@ If all goes well, the condition is true. It is false only if there are
 problems such as a syntax error or a memory shortage. For more details, see
 chapter &<<CHAPexiscan>>&.
 
-.vitem &*demime&~=&~*&<&'extension&~list'&>
-.cindex "&%demime%& ACL condition"
-This condition is available only when Exim is compiled with the
-content-scanning extension. Its use is described in section
-&<<SECTdemimecond>>&.
-
 .vitem &*dnslists&~=&~*&<&'list&~of&~domain&~names&~and&~other&~data'&>
 .cindex "&%dnslists%& ACL condition"
 .cindex "DNS list" "in ACL"
@@ -29564,9 +29854,7 @@ warn  message  = X-Warn: sending host is on dialups list
 .cindex cacheing "of dns lookup"
 .cindex DNS TTL
 DNS list lookups are cached by Exim for the duration of the SMTP session
-.new
 (but limited by the DNS return TTL value),
-.wen
 so a lookup based on the IP address is done at most once for any incoming
 connection (assuming long-enough TTL).
 Exim does not share information between multiple incoming
@@ -30938,14 +31226,6 @@ in chapter &<<CHAPdefconfil>>&.
 You can check the relay characteristics of your configuration in the same way
 that you can test any ACL behaviour for an incoming SMTP connection, by using
 the &%-bh%& option to run a fake SMTP session with which you interact.
-
-For specifically testing for unwanted relaying, the host
-&'relay-test.mail-abuse.org'& provides a useful service. If you telnet to this
-host from the host on which Exim is running, using the normal telnet port, you
-will see a normal telnet connection message and then quite a long delay. Be
-patient. The remote host is making an SMTP connection back to your host, and
-trying a number of common probes to test for open relay vulnerability. The
-results of the tests will eventually appear on your terminal.
 .ecindex IIDacl
 
 
@@ -30988,10 +31268,6 @@ conditions.
 Two new main configuration options: &%av_scanner%& and &%spamd_address%&.
 .endlist
 
-There is another content-scanning configuration option for &_Local/Makefile_&,
-called WITH_OLD_DEMIME. If this is set, the old, deprecated &%demime%& ACL
-condition is compiled, in addition to all the other content-scanning features.
-
 Content-scanning is continually evolving, and new features are still being
 added. While such features are still unstable and liable to incompatible
 changes, they are made available in Exim by setting options whose names begin
@@ -31241,7 +31517,7 @@ This is a daemon type scanner that is aimed mainly at Polish users, though some
 parts of documentation are now available in English. You can get it at
 &url(http://linux.mks.com.pl/). The only option for this scanner type is
 the maximum number of processes used simultaneously to scan the attachments,
-provided that the demime facility is employed and also provided that mksd has
+provided that mksd has
 been run with at least the same number of child processes. For example:
 .code
 av_scanner = mksd:2
@@ -31332,23 +31608,17 @@ When a virus is found, the condition sets up an expansion variable called
 &%message%& modifier that specifies the error returned to the sender, and/or in
 logging data.
 
-If your virus scanner cannot unpack MIME and TNEF containers itself, you should
-use the &%demime%& condition (see section &<<SECTdemimecond>>&) before the
-&%malware%& condition.
-
 Beware the interaction of Exim's &%message_size_limit%& with any size limits
 imposed by your anti-virus scanner.
 
 Here is a very simple scanning example:
 .code
 deny message = This message contains malware ($malware_name)
-     demime = *
      malware = *
 .endd
 The next example accepts messages when there is a problem with the scanner:
 .code
 deny message = This message contains malware ($malware_name)
-     demime = *
      malware = */defer_ok
 .endd
 The next example shows how to use an ACL variable to scan with both sophie and
@@ -31428,7 +31698,7 @@ condition defers.
 
 Unix and TCP socket specifications may be mixed in any order.
 Each element of the list is a list itself, space-separated by default
-and changeable in the usual way.
+and changeable in the usual way; take care to not double the separator.
 
 For TCP socket specifications a host name or IP (v4 or v6, but
 subject to list-separator quoting rules) address can be used,
@@ -31555,6 +31825,11 @@ spam bar is 50 characters.
 A multiline text table, containing the full SpamAssassin report for the
 message. Useful for inclusion in headers or reject messages.
 This variable is only usable in a DATA-time ACL.
+.new
+Beware that SpamAssassin may return non-ASCII characters, especially
+when running in country-specific locales, which are not legal
+unencoded in headers.
+.wen
 
 .vitem &$spam_action$&
 For SpamAssassin either 'reject' or 'no action' depending on the
@@ -31844,90 +32119,6 @@ are set to any substrings captured by the regular expression.
 &*Warning*&: With large messages, these conditions can be fairly
 CPU-intensive.
 
-
-
-
-.section "The demime condition" "SECTdemimecond"
-.cindex "content scanning" "MIME checking"
-.cindex "MIME content scanning"
-The &%demime%& ACL condition provides MIME unpacking, sanity checking and file
-extension blocking. It is usable only in the DATA and non-SMTP ACLs. The
-&%demime%& condition uses a simpler interface to MIME decoding than the MIME
-ACL functionality, but provides no additional facilities. Please note that this
-condition is deprecated and kept only for backward compatibility. You must set
-the WITH_OLD_DEMIME option in &_Local/Makefile_& at build time to be able to
-use the &%demime%& condition.
-
-The &%demime%& condition unpacks MIME containers in the message. It detects
-errors in MIME containers and can match file extensions found in the message
-against a list. Using this facility produces files containing the unpacked MIME
-parts of the message in the temporary scan directory. If you do antivirus
-scanning, it is recommended that you use the &%demime%& condition before the
-antivirus (&%malware%&) condition.
-
-On the right-hand side of the &%demime%& condition you can pass a
-colon-separated list of file extensions that it should match against. For
-example:
-.code
-deny message = Found blacklisted file attachment
-     demime  = vbs:com:bat:pif:prf:lnk
-.endd
-If one of the file extensions is found, the condition is true, otherwise it is
-false. If there is a temporary error while demimeing (for example, &"disk
-full"&), the condition defers, and the message is temporarily rejected (unless
-the condition is on a &%warn%& verb).
-
-The right-hand side is expanded before being treated as a list, so you can have
-conditions and lookups there. If it expands to an empty string, &"false"&, or
-zero (&"0"&), no demimeing is done and the condition is false.
-
-The &%demime%& condition set the following variables:
-
-.vlist
-.vitem &$demime_errorlevel$&
-.vindex "&$demime_errorlevel$&"
-When an error is detected in a MIME container, this variable contains the
-severity of the error, as an integer number. The higher the value, the more
-severe the error (the current maximum value is 3). If this variable is unset or
-zero, no error occurred.
-
-.vitem &$demime_reason$&
-.vindex "&$demime_reason$&"
-When &$demime_errorlevel$& is greater than zero, this variable contains a
-human-readable text string describing the MIME error that occurred.
-.endlist
-
-.vlist
-.vitem &$found_extension$&
-.vindex "&$found_extension$&"
-When the &%demime%& condition is true, this variable contains the file
-extension it found.
-.endlist
-
-Both &$demime_errorlevel$& and &$demime_reason$& are set by the first call of
-the &%demime%& condition, and are not changed on subsequent calls.
-
-If you do not want to check for file extensions, but rather use the &%demime%&
-condition for unpacking or error checking purposes, pass &"*"& as the
-right-hand side value. Here is a more elaborate example of how to use this
-facility:
-.code
-# Reject messages with serious MIME container errors
-deny  message = Found MIME error ($demime_reason).
-      demime = *
-      condition = ${if >{$demime_errorlevel}{2}{1}{0}}
-
-# Reject known virus spreading file extensions.
-# Accepting these is pretty much braindead.
-deny  message = contains $found_extension file (blacklisted).
-      demime  = com:vbs:bat:pif:scr
-
-# Freeze .exe and .doc files. Postmaster can
-# examine them and eventually thaw them.
-deny  log_message = Another $found_extension file.
-      demime = exe:doc
-      control = freeze
-.endd
 .ecindex IIDcosca
 
 
@@ -33224,6 +33415,7 @@ incoming SMTP message from a source that is not permitted to send them.
 
 .section "Resent- header lines" "SECID220"
 .cindex "&%Resent-%& header lines"
+.cindex "header lines" "Resent-"
 RFC 2822 makes provision for sets of header lines starting with the string
 &`Resent-`& to be added to a message when it is resent by the original
 recipient to somebody else. These headers are &'Resent-Date:'&,
@@ -33280,6 +33472,7 @@ existing &'Bcc:'& is not removed.
 
 .section "The Date: header line" "SECID223"
 .cindex "&'Date:'& header line"
+.cindex "header lines" "Date:"
 If a locally-generated or submission-mode message has no &'Date:'& header line,
 Exim adds one, using the current date and time, unless the
 &%suppress_local_fixups%& control has been specified.
@@ -33297,6 +33490,7 @@ messages.
 
 .section "The Envelope-to: header line" "SECID225"
 .cindex "&'Envelope-to:'& header line"
+.cindex "header lines" "Envelope-to:"
 .oindex "&%envelope_to_remove%&"
 &'Envelope-to:'& header lines are not part of the standard RFC 2822 header set.
 Exim can be configured to add them to the final delivery of messages. (See the
@@ -33308,6 +33502,7 @@ messages.
 
 .section "The From: header line" "SECTthefrohea"
 .cindex "&'From:'& header line"
+.cindex "header lines" "From:"
 .cindex "Sendmail compatibility" "&""From""& line"
 .cindex "message" "submission"
 .cindex "submission mode"
@@ -33351,6 +33546,7 @@ name as described in section &<<SECTconstr>>&.
 
 .section "The Message-ID: header line" "SECID226"
 .cindex "&'Message-ID:'& header line"
+.cindex "header lines" "Message-ID:"
 .cindex "message" "submission"
 .oindex "&%message_id_header_text%&"
 If a locally-generated or submission-mode incoming message does not contain a
@@ -33366,6 +33562,7 @@ in this header line by setting the &%message_id_header_text%& and/or
 
 .section "The Received: header line" "SECID227"
 .cindex "&'Received:'& header line"
+.cindex "header lines" "Received:"
 A &'Received:'& header line is added at the start of every message. The
 contents are defined by the &%received_header_text%& configuration option, and
 Exim automatically adds a semicolon and a timestamp to the configured string.
@@ -33382,6 +33579,7 @@ changed to the time of acceptance, which is (apart from a small delay while the
 
 .section "The References: header line" "SECID228"
 .cindex "&'References:'& header line"
+.cindex "header lines" "References:"
 Messages created by the &(autoreply)& transport include a &'References:'&
 header line. This is constructed according to the rules that are described in
 section 3.64 of RFC 2822 (which states that replies should contain such a
@@ -33396,6 +33594,7 @@ incoming message. If there are more than 12, the first one and then the final
 
 .section "The Return-path: header line" "SECID229"
 .cindex "&'Return-path:'& header line"
+.cindex "header lines" "Return-path:"
 .oindex "&%return_path_remove%&"
 &'Return-path:'& header lines are defined as something an MTA may insert when
 it does the final delivery of messages. (See the generic &%return_path_add%&
@@ -33408,6 +33607,7 @@ default), Exim removes &'Return-path:'& header lines from incoming messages.
 .section "The Sender: header line" "SECTthesenhea"
 .cindex "&'Sender:'& header line"
 .cindex "message" "submission"
+.cindex "header lines" "Sender:"
 For a locally-originated message from an untrusted user, Exim may remove an
 existing &'Sender:'& header line, and it may add a new one. You can modify
 these actions by setting the &%local_sender_retain%& option true, the
@@ -34109,13 +34309,11 @@ When Exim receives a VRFY or EXPN command on a TCP/IP connection, it
 runs the ACL specified by &%acl_smtp_vrfy%& or &%acl_smtp_expn%& (as
 appropriate) in order to decide whether the command should be accepted or not.
 
-.new
 .cindex "VRFY" "processing"
 When no ACL is defined for VRFY, or if it rejects without
 setting an explicit response code, the command is accepted
 (with a 252 SMTP response code)
 in order to support awkward clients that do a VRFY before every RCPT.
-.wen
 When VRFY is accepted, it runs exactly the same code as when Exim is
 called with the &%-bv%& option, and returns 250/451/550
 SMTP response codes.
@@ -35378,6 +35576,7 @@ picked out by the distinctive two-character flags that immediately follow the
 timestamp. The flags are:
 .display
 &`<=`&     message arrival
+&`(=`&     message fakereject
 &`=>`&     normal message delivery
 &`->`&     additional address in same delivery
 &`>>`&     cutthrough message delivery
@@ -35605,19 +35804,23 @@ the following table:
 &`CV  `&        certificate verification status
 &`D   `&        duration of &"no mail in SMTP session"&
 &`DN  `&        distinguished name from peer certificate
+&`DS  `&        DNSSEC secured lookups
 &`DT  `&        on &`=>`& lines: time taken for a delivery
 &`F   `&        sender address (on delivery lines)
 &`H   `&        host name and IP address
 &`I   `&        local interface used
+&`K   `&        CHUNKING extension used
 &`id  `&        message id for incoming message
 &`P   `&        on &`<=`& lines: protocol used
 &`    `&        on &`=>`& and &`**`& lines: return path
-&`PRX `&        on &'<='& and&`=>`& lines: proxy address
+&`PRDR`&        PRDR extension used
+&`PRX `&        on &`<=`& and &`=>`& lines: proxy address
+&`Q   `&        alternate queue name
 &`QT  `&        on &`=>`& lines: time spent on queue so far
 &`    `&        on &"Completed"& lines: time spent on queue
 &`R   `&        on &`<=`& lines: reference for local bounce
-&`    `&        on &`=>`&  &`**`& and &`==`& lines: router name
-&`S   `&        size of message
+&`    `&        on &`=>`&  &`>>`& &`**`& and &`==`& lines: router name
+&`S   `&        size of message in bytes
 &`SNI `&        server name indication from TLS client hello
 &`ST  `&        shadow transport name
 &`T   `&        on &`<=`& lines: message subject (topic)
@@ -35695,23 +35898,20 @@ selection marked by asterisks:
 &` deliver_time               `&  time taken to perform delivery
 &` delivery_size              `&  add &`S=`&&'nnn'& to => lines
 &`*dnslist_defer              `&  defers of DNS list (aka RBL) lookups
+&` dnssec                     `&  DNSSEC secured lookups
 &`*etrn                       `&  ETRN commands
 &`*host_lookup_failed         `&  as it says
 &` ident_timeout              `&  timeout for ident connection
 &` incoming_interface         `&  local interface on <= and => lines
 &` incoming_port              `&  remote port on <= lines
 &`*lost_incoming_connection   `&  as it says (includes timeouts)
-.new
 &` outgoing_interface         `&  local interface on => lines
-.wen
 &` outgoing_port              `&  add remote port to => lines
 &`*queue_run                  `&  start and end queue runs
 &` queue_time                 `&  time on queue for one recipient
 &` queue_time_overall         `&  time on queue for whole message
 &` pid                        `&  Exim process id
-.new
 &` proxy                      `&  proxy address on <= and => lines
-.wen
 &` received_recipients        `&  recipients on <= lines
 &` received_sender            `&  sender on <= lines
 &`*rejected_header            `&  header contents on reject log
@@ -35806,6 +36006,14 @@ the &"=>"& line, tagged with S=.
 &%dnslist_defer%&: A log entry is written if an attempt to look up a host in a
 DNS black list suffers a temporary error.
 .next
+.cindex log dnssec
+.cindex dnssec logging
+&%dnssec%&: For message acceptance and (attempted) delivery log lines, when
+dns lookups gave secure results a tag of DS is added.
+For acceptance this covers the reverse and forward lookups for host name verification.
+It does not cover helo-name verification.
+For delivery this covers the SRV, MX, A and/or AAAA lookups.
+.next
 .cindex "log" "ETRN commands"
 .cindex "ETRN" "logging"
 &%etrn%&: Every valid ETRN command that is received is logged, before the ACL
@@ -35834,11 +36042,8 @@ to the &"<="& line as an IP address in square brackets, tagged by I= and
 followed by a colon and the port number. The local interface and port are also
 added to other SMTP log lines, for example &"SMTP connection from"&, to
 rejection lines, and (despite the name) to outgoing &"=>"& and &"->"& lines.
-.new
 The latter can be disabled by turning off the &%outgoing_interface%& option.
-.wen
 .next
-.new
 .cindex log "incoming proxy address"
 .cindex proxy "logging proxy address"
 .cindex "TCP/IP" "logging proxy address"
@@ -35847,7 +36052,6 @@ of the proxy, tagged by PRX=, on the &"<="& line for a message accepted
 on a proxied connection
 or the &"=>"& line for a message delivered on a proxied connection..
 See &<<SECTproxyInbound>>& for more information.
-.wen
 .next
 .cindex "log" "incoming remote port"
 .cindex "port" "logging remote"
@@ -35870,22 +36074,18 @@ connection is unexpectedly dropped.
 .cindex "log" "local address and port"
 .cindex "TCP/IP" "logging local address and port"
 .cindex "interface" "logging"
-.new
 &%outgoing_interface%&: If &%incoming_interface%& is turned on, then the
 interface on which a message was sent is added to delivery lines as an I= tag
 followed by IP address in square brackets. You can disable this by turning
 off the &%outgoing_interface%& option.
-.wen
 .next
 .cindex "log" "outgoing remote port"
 .cindex "port" "logging outgoint remote"
 .cindex "TCP/IP" "logging ougtoing remote port"
 &%outgoing_port%&: The remote port number is added to delivery log lines (those
 containing => tags) following the IP address.
-.new
 The local port is also added if &%incoming_interface%& and
 &%outgoing_interface%& are both enabled.
-.wen
 This option is not included in the default setting, because for most ordinary
 configurations, the remote port number is always 25 (the SMTP port), and the
 local port is a random ephemeral port.
@@ -38010,19 +38210,17 @@ linked to a domain which that entity controls.  It permits reputation to
 be tracked on a per-domain basis, rather than merely upon source IP address.
 DKIM is documented in RFC 4871.
 
-.new
 DKIM support is compiled into Exim by default if TLS support is present.
-.wen
 It can be disabled by setting DISABLE_DKIM=yes in &_Local/Makefile_&.
 
-Exim's DKIM implementation allows to
+Exim's DKIM implementation allows for
 .olist
-Sign outgoing messages: This function is implemented in the SMTP transport.
+Signing outgoing messages: This function is implemented in the SMTP transport.
 It can co-exist with all other Exim features
 (including transport filters)
 except cutthrough delivery.
 .next
-Verify signatures in incoming messages: This is implemented by an additional
+Verifying signatures in incoming messages: This is implemented by an additional
 ACL (acl_smtp_dkim), which can be called several times per message, with
 different signature contexts.
 .endlist
@@ -38051,7 +38249,7 @@ senders).
 .section "Signing outgoing messages" "SECDKIMSIGN"
 .cindex "DKIM" "signing"
 
-Signing is implemented by setting private options on the SMTP transport.
+Signing is enabled by setting private options on the SMTP transport.
 These options take (expandable) strings as arguments.
 
 .option dkim_domain smtp string&!! unset
@@ -38108,7 +38306,7 @@ used.
 .section "Verifying DKIM signatures in incoming mail" "SECID514"
 .cindex "DKIM" "verification"
 
-Verification of DKIM signatures in incoming email is implemented via the
+Verification of DKIM signatures in SMTP incoming email is implemented via the
 &%acl_smtp_dkim%& ACL. By default, this ACL is called once for each
 syntactically(!) correct signature in the incoming message.
 A missing ACL definition defaults to accept.
@@ -38161,6 +38359,7 @@ available (from most to least important):
 The signer that is being evaluated in this ACL run. This can be a domain or
 an identity. This is one of the list items from the expanded main option
 &%dkim_verify_signers%& (see above).
+
 .vitem &%$dkim_verify_status%&
 A string describing the general status of the signature. One of
 .ilist
@@ -38175,6 +38374,7 @@ available in &%$dkim_verify_reason%&.
 .next
 &%pass%&: The signature passed verification. It is valid.
 .endlist
+
 .vitem &%$dkim_verify_reason%&
 A string giving a little bit more detail when &%$dkim_verify_status%& is either
 "fail" or "invalid". One of
@@ -38194,51 +38394,73 @@ could not be verified. This may mean that headers were modified,
 re-written or otherwise changed in a way which is incompatible with
 DKIM verification. It may of course also mean that the signature is forged.
 .endlist
+
 .vitem &%$dkim_domain%&
 The signing domain. IMPORTANT: This variable is only populated if there is
 an actual signature in the message for the current domain or identity (as
 reflected by &%$dkim_cur_signer%&).
+
 .vitem &%$dkim_identity%&
 The signing identity, if present. IMPORTANT: This variable is only populated
 if there is an actual signature in the message for the current domain or
 identity (as reflected by &%$dkim_cur_signer%&).
+
 .vitem &%$dkim_selector%&
 The key record selector string.
+
 .vitem &%$dkim_algo%&
 The algorithm used. One of 'rsa-sha1' or 'rsa-sha256'.
+
 .vitem &%$dkim_canon_body%&
 The body canonicalization method. One of 'relaxed' or 'simple'.
+
 .vitem &%dkim_canon_headers%&
 The header canonicalization method. One of 'relaxed' or 'simple'.
+
 .vitem &%$dkim_copiedheaders%&
 A transcript of headers and their values which are included in the signature
 (copied from the 'z=' tag of the signature).
+.new
+Note that RFC6376 requires that verification fail if the From: header is
+not included in the signature.  Exim does not enforce this; sites wishing
+strict enforcement should code the check explicitly.
+.wen
+
 .vitem &%$dkim_bodylength%&
 The number of signed body bytes. If zero ("0"), the body is unsigned. If no
 limit was set by the signer, "9999999999999" is returned. This makes sure
 that this variable always expands to an integer value.
+
 .vitem &%$dkim_created%&
 UNIX timestamp reflecting the date and time when the signature was created.
 When this was not specified by the signer, "0" is returned.
+
 .vitem &%$dkim_expires%&
 UNIX timestamp reflecting the date and time when the signer wants the
 signature to be treated as "expired". When this was not specified by the
 signer, "9999999999999" is returned. This makes it possible to do useful
 integer size comparisons against this value.
+
 .vitem &%$dkim_headernames%&
 A colon-separated list of names of headers included in the signature.
+
 .vitem &%$dkim_key_testing%&
 "1" if the key record has the "testing" flag set, "0" if not.
+
 .vitem &%$dkim_key_nosubdomains%&
 "1" if the key record forbids subdomaining, "0" otherwise.
+
 .vitem &%$dkim_key_srvtype%&
 Service type (tag s=) from the key record. Defaults to "*" if not specified
 in the key record.
+
 .vitem &%$dkim_key_granularity%&
 Key granularity (tag g=) from the key record. Defaults to "*" if not specified
 in the key record.
+
 .vitem &%$dkim_key_notes%&
 Notes from the key record (tag n=).
+
 .vitem &%$dkim_key_length%&
 Number of bits in the key.
 .endlist
@@ -38253,13 +38475,18 @@ for a match against the domain or identity that the ACL is currently verifying
 verb to a group of domains or identities. For example:
 
 .code
-# Warn when Mail purportedly from GMail has no signature at all
-warn log_message = GMail sender without DKIM signature
+# Warn when Mail purportedly from GMail has no gmail signature
+warn log_message = GMail sender without gmail.com DKIM signature
      sender_domains = gmail.com
      dkim_signers = gmail.com
      dkim_status = none
 .endd
 
+.new
+Note that the above does not check for a total lack of DKIM signing;
+for that check for empty &$h_DKIM-Signature:$& in the data ACL.
+.wen
+
 .vitem &%dkim_status%&
 ACL condition that checks a colon-separated list of possible DKIM verification
 results against the actual result of verification. This is typically used
@@ -38285,7 +38512,6 @@ for more information of what they mean.
 .cindex "proxy support"
 .cindex "proxy" "access via"
 
-.new
 A proxy is an intermediate system through which communication is passed.
 Proxies may provide a security, availability or load-distribution function.
 
@@ -38319,18 +38545,20 @@ Use of a proxy is enabled by setting the &%hosts_proxy%&
 main configuration option to a hostlist; connections from these
 hosts will use Proxy Protocol.
 
+.new
 The following expansion variables are usable
 (&"internal"& and &"external"& here refer to the interfaces
 of the proxy):
 .display
-&'proxy_host_address   '& internal IP address of the proxy
-&'proxy_host_port      '& internal TCP port of the proxy
-&'proxy_target_address '& external IP address of the proxy
-&'proxy_target_port    '& external TCP port of the proxy
+&'proxy_external_address   '& IP of host being proxied or IP of remote interface of proxy
+&'proxy_external_port      '& Port of host being proxied or Port on remote interface of proxy
+&'proxy_local_address '& IP of proxy server inbound or IP of local interface of proxy
+&'proxy_local_port    '& Port of proxy server inbound or Port on local interface of proxy
 &'proxy_session        '& boolean: SMTP connection via proxy
 .endd
-If &$proxy_session$& is set but &$proxy_host_address$& is empty
+If &$proxy_session$& is set but &$proxy_external_address$& is empty
 there was a protocol error.
+.wen
 
 Since the real connections are all coming from the proxy, and the
 per host connection tracking is done before Proxy Protocol is
@@ -38371,7 +38599,7 @@ Each proxy specifier is a list
 (space-separated by default) where the initial element
 is an IP address and any subsequent elements are options.
 
-Options are a string <name>=<value>. 
+Options are a string <name>=<value>.
 The list of options is in the following table:
 .display
 &'auth   '& authentication method
@@ -38423,7 +38651,6 @@ overall connection applies to the set of proxied attempts.
 To log the (local) IP of a proxy in the incoming or delivery logline,
 add &"+proxy"& to the &%log_selector%& option.
 This will add a component tagged with &"PRX="& to the line.
-.wen
 
 . ////////////////////////////////////////////////////////////////////////////
 . ////////////////////////////////////////////////////////////////////////////
@@ -38435,7 +38662,6 @@ This will add a component tagged with &"PRX="& to the line.
 .cindex i18n
 .cindex UTF-8 "mail name handling"
 
-.new
 Exim has support for Internationalised mail names.
 To include this it must be built with SUPPORT_I18N and the libidn library.
 Standards supported are RFCs 2060, 5890, 6530 and 6533.
@@ -38471,7 +38697,7 @@ form of the name.
 Log lines and Received-by: header lines will acquire a "utf8"
 prefix on the protocol element, eg. utf8esmtp.
 
-The following expansion operator can be used:
+The following expansion operators can be used:
 .code
 ${utf8_domain_to_alabel:str}
 ${utf8_domain_from_alabel:str}
@@ -38544,7 +38770,6 @@ Examples:
 Note that the source charset setting is vital, and also that characters
 must be representable in UTF-16.
 
-.wen
 
 . ////////////////////////////////////////////////////////////////////////////
 . ////////////////////////////////////////////////////////////////////////////
@@ -38553,7 +38778,6 @@ must be representable in UTF-16.
          "Events"
 .cindex events
 
-.new
 The events mechanism in Exim can be used to intercept processing at a number
 of points.  It was originally invented to giave a way to do customised logging
 actions (for example, to a database) but can also be used to modify some
@@ -38659,7 +38883,6 @@ For tls:cert events, if GnuTLS is in use this will trigger only per
 chain element received on the connection.
 For OpenSSL it will trigger for every chain element including those
 loaded locally.
-.wen
 
 . ////////////////////////////////////////////////////////////////////////////
 . ////////////////////////////////////////////////////////////////////////////
diff --git a/doc/doc-src/FAQ.src b/doc/doc-src/FAQ.src
index 03360be6a..9280e0314 100644
--- a/doc/doc-src/FAQ.src
+++ b/doc/doc-src/FAQ.src
@@ -2316,7 +2316,7 @@ A0310: If a DNS lookup returns no MXs, Exim looks for an address record, in
 
 
 Q0311: When a DNS lookup for MX records fails to complete, why doesn't Exim
-       send the messsage to the host defined by the A record?
+       send the message to the host defined by the A record?
 
 A0311: The RFCs are quite clear on this. Only if it is known that there are no
        MX records is an MTA allowed to make use of the A record. When an MX
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 01848573b..d4d091ed2 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,12 +1,135 @@
 Change log file for Exim from version 4.21
 -------------------------------------------
 
-
-Exim version 4.next
+Exim version 4.88
 -----------------
 JH/01 Use SIZE on MAIL FROM in a cutthrough connection, if the destination
       supports it and a size is available (ie. the sending peer gave us one).
 
+JH/02 The obsolete acl condition "demime" is removed (finally, after ten
+      years of being deprecated). The replacements are the ACLs
+      acl_smtp_mime and acl_not_smtp_mime.
+
+JH/03 Upgrade security requirements imposed for hosts_try_dane: previously
+      a downgraded non-dane trust-anchor for the TLS connection (CA-style)
+      or even an in-clear connection were permitted.  Now, if the host lookup
+      was dnssec and dane was requested then the host is only used if the
+      TLSA lookup succeeds and is dnssec.  Further hosts (eg. lower priority
+      MXs) will be tried (for hosts_try_dane though not for hosts_require_dane)
+      if one fails this test.
+      This means that a poorly-configured remote DNS will make it incommunicado;
+      but it protects against a DNS-interception attack on it.
+
+JH/04 Bug 1810: make continued-use of an open smtp transport connection
+      non-noisy when a race steals the message being considered.
+
+JH/05 If main configuration option tls_certificate is unset, generate a
+      self-signed certificate for inbound TLS connections.
+
+JH/06 Bug 165: hide more cases of password exposure - this time in expansions
+      in rewrites and routers.
+
+JH/07 Retire gnutls_require_mac et.al.  These were nonfunctional since 4.80
+      and logged a warning sing 4.83; now they are a configuration file error.
+
+JH/08 Bug 1836: Fix crash in VRFY handling when handed an unqualified name
+      (lacking @domain).  Apply the same qualification processing as RCPT.
+
+JH/09 Bug 1804: Avoid writing msglog files when in -bh or -bhc mode.
+
+JH/10 Support ${sha256:} applied to a string (as well as the previous
+      certificate).
+
+JH/11 Cutthrough: avoid using the callout hints db on a verify callout when
+      a cutthrough deliver is pending, as we always want to make a connection.
+      This also avoids re-routing the message when later placing the cutthrough
+      connection after a verify cache hit.
+      Do not update it with the verify result either.
+
+JH/12 Cutthrough: disable when verify option success_on_redirect is used, and
+      when routing results in more than one destination address.
+
+JH/13 Cutthrough: expand transport dkim_domain option when testing for dkim
+      signing (which inhibits the cutthrough capability).  Previously only
+      the presence of an option was tested; now an expansion evaluating as
+      empty is permissible (obviously it should depend only on data available
+      when the cutthrough connection is made).
+
+JH/14 Fix logging of errors under PIPELINING.  Previously the log line giving
+      the relevant preceding SMTP command did not note the pipelining mode.
+
+JH/15 Fix counting of empty lines in $body_linecount and $message_linecount.
+      Previously they were not counted.
+
+JH/16 DANE: treat a TLSA lookup response having all non-TLSA RRs, the same
+      as one having no matching records.  Previously we deferred the message
+      that needed the lookup.
+
+JH/17 Fakereject: previously logged as a norml message arrival "<="; now
+      distinguished as "(=".
+
+JH/18 Bug 1867: make the fail_defer_domains option on a dnslookup router work
+      for missing MX records.  Previously it only worked for missing A records.
+
+JH/19 Bug 1850: support Radius libraries that return REJECT_RC.
+
+JH/20 Bug 1872: Ensure that acl_smtp_notquit is run when the connection drops
+      after the data-go-ahead and data-ack.  Patch from Jason Betts.
+
+JH/21 Bug 1846: Send DMARC forensic reports for reject and quaratine results,
+      even for a "none" policy.  Patch from Tony Meyer.
+
+JH/22 Fix continued use of a connection for further deliveries. If a port was
+      specified by a router, it must also match for the delivery to be
+      compatible.
+
+JH/23 Bug 1874: fix continued use of a connection for further deliveries.
+      When one of the recipients of a message was unsuitable for the connection
+      (has no matching addresses), we lost track of needing to mark it
+      deferred.  As a result mail would be lost.
+
+JH/24 Bug 1832: Log EHLO response on getting conn-close response for HELO.
+
+JH/25 Decoding ACL controls is now done using a binary search; the source code
+      takes up less space and should be simpler to maintain.  Merge the ACL
+      condition decode tables also, with similar effect.
+
+JH/26 Fix problem with one_time used on a redirect router which returned the
+      parent address unchanged.  A retry would see the parent address marked as
+      delivered, so not attempt the (identical) child.  As a result mail would
+      be lost.
+
+JH/27 Fix a possible security hole, wherein a process operating with the Exim
+      UID can gain a root shell.  Credit to http://www.halfdog.net/ for
+      discovery and writeup.  Ubuntu bug 1580454; no bug raised against Exim
+      itself :(
+
+JH/28 Enable {spool,log} filesystem space and inode checks as default.
+      Main config options check_{log,spool}_{inodes,space} are now
+      100 inodes, 10MB unless set otherwise in the configuration.
+
+JH/29 Fix the connection_reject log selector to apply to the connect ACL.
+      Previously it only applied to the main-section connection policy
+      options.
+
+JH/30 Bug 1897: fix callouts connection fallback from TLS to cleartext.
+
+PP/01 Changed default Diffie-Hellman parameters to be Exim-specific, created
+      by me.  Added RFC7919 DH primes as an alternative.
+
+PP/02 Unbreak build via pkg-config with new hash support when crypto headers
+      are not in the system include path.
+
+JH/31 Fix longstanding bug with aborted TLS server connection handling.  Under
+      GnuTLS, when a session startup failed (eg because the client disconnected)
+      Exim did stdio operations after fclose.  This was exposed by a recent
+      change which nulled out the file handle after the fclose.
+
+JH/32 Bug 1909: Fix OCSP proof verification for cases where the proof is
+      signed directly by the cert-signing cert, rather than an intermediate
+      OCSP-signing cert.  This is the model used by LetsEncrypt.
+
+JH/33 Bug 1914: Ensure socket is nonblocking before draining after SMTP QUIT.
 
 
 Exim version 4.87
@@ -171,7 +294,40 @@ JH/38 Fix cutthrough bug with body lines having a single dot. The dot was
       received - but deduplicating mailstores were liable to retain only the
       initial truncated version.
 
-JH/39 Bug 1781: Fix use of private-keys having trailing '=' in the base-64.
+JH/39 Bug 1781: Fix use of DKIM private-keys having trailing '=' in the base-64.
+
+JH/40 Fix crash in queryprogram router when compiled with EXPERIMENTAL_SRS.
+
+JH/41 Bug 1792: Fix selection of headers to sign for DKIM: bottom-up.  While
+      we're in there, support oversigning also; bug 1309.
+
+JH/42 Bug 1796: Fix error logged on a malware scanner connection failure.
+
+HS/04 Add support for keep_environment and add_environment options.
+
+JH/43 Tidy coding issues detected by gcc --fsanitize=undefined.  Some remain;
+      either intentional arithmetic overflow during PRNG, or testing config-
+      induced overflows.
+
+JH/44 Bug 1800: The combination of a -bhc commandline option and cutthrough
+      delivery resulted in actual delivery.  Cancel cutthrough before DATA
+      stage.
+
+JH/45 Fix cutthrough, when connection not opened by verify and target hard-
+      rejects a recipient: pass the reject to the originator.
+
+JH/46 Multiple issues raised by Coverity. Some were obvious or plausible bugs.
+      Many were false-positives and ignorable, but it's worth fixing the
+      former class.
+
+JH/47 Fix build on HP-UX and older Solaris, which need (un)setenv now also
+      for the new environment-manipulation done at startup.  Move the routines
+      from being local to tls.c to being global via the os.c file.
+
+JH/48 Bug 1807: Fix ${extract } for the numeric/3-string case. While preparsing
+      an extract embedded as result-arg for a map, the first arg for extract
+      is unavailable so we cannot tell if this is a numbered or keyed
+      extraction.  Accept either.
 
 
 
@@ -241,7 +397,7 @@ JH/18 Bug 1581: Router and transport options headers_add/remove can
       now have the list separator specified.
 
 JH/19 Bug 392: spamd_address, and clamd av_scanner, now support retry
-      option values. 
+      option values.
 
 JH/20 Bug 1571: Ensure that $tls_in_peerdn is set, when verification fails
       under OpenSSL.
@@ -256,7 +412,7 @@ JH/23 Bug 1572: Increase limit on SMTP confirmation message copy size
 
 JH/24 Verification callouts now attempt to use TLS by default.
 
-HS/01 DNSSEC options (dnssec_require_domains, dnssec_request_domains) 
+HS/01 DNSSEC options (dnssec_require_domains, dnssec_request_domains)
       are generic router options now. The defaults didn't change.
 
 JH/25 Bug 466: Add RFC2322 support for MIME attachment filenames.
@@ -294,6 +450,8 @@ JH/35 Bug 1642: Fix support of $spam_ variables at delivery time.  Was
 JH/36 Bug 1659: Guard checking of input smtp commands again pseudo-command
       added for tls authenticator.
 
+HS/03 Add perl_taintmode main config option
+
 
 Exim version 4.85
 -----------------
@@ -874,7 +1032,7 @@ PP/12 MAIL args handles TAB as well as SP, for better interop with
       Analysis and variant patch by Todd Lyons.
 
 NM/04 Bugzilla 1237 - fix cases where printf format usage not indicated
-      Bug report from Lars Müller <lars@samba.org> (via SUSE), 
+      Bug report from Lars Müller <lars@samba.org> (via SUSE),
       Patch from Dirk Mueller <dmueller@suse.com>
 
 PP/13 tls_peerdn now print-escaped for spool files.
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index 65dd4b593..ac1968627 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -6,12 +6,62 @@ Before a formal release, there may be quite a lot of detail so that people can
 test from the snapshots or the CVS before the documentation is updated. Once
 the documentation is updated, this file is reduced to a short list.
 
-Version 4.next
---------------
+Version 4.88
+------------
+
+ 1. The new perl_taintmode option allows to run the embedded perl
+    interpreter in taint mode.
+
+ 2. New log_selector: dnssec, adds a "DS" tag to acceptance and delivery lines.
+
+ 3. Speculative debugging, via a "kill" option to the "control=debug" ACL
+    modifier.
+
+ 4. New expansion item ${sha3:<string>} / ${sha3_<N>:<string>}.
+    N can be 224, 256 (default), 384, 512.
+    With GnuTLS 3.5.0 or later, only.
+
+ 5. Facility for named queues:  A command-line argument can specify
+    the queue name for a queue operation, and an ACL modifier can set
+    the queue to be used for a message.  A $queue_name variable gives
+    visibility.
+
+ 6. New expansion operators base32/base32d.
+
+ 7. The CHUNKING ESMTP extension from RFC 3030.  May give some slight
+    performance increase and network load decrease.  Main config option
+    chunking_advertise_hosts, and smtp transport option hosts_try_chunking
+    for control.
 
- 1. New perl_taintmode main config option.
+ 8. LMDB lookup support, as Experimental. Patch supplied by Andrew Colin Kissa.
 
- 2. New expansion operators base32/base32d.
+ 9. Expansion operator escape8bit, like escape but not touching newline etc..
+
+10. Feature macros, generated from compile options.  All start with "_HAVE_"
+    and go on with some roughly recognisable name.  Driver macros, for
+    router, transport and authentication drivers; names starting with "_DRVR_".
+    Option macros, for each configuration-file option; all start with "_OPT_".
+    Use the "-bP macros" command-line option to see what is present.
+
+11. Integer values for options can take a "G" multiplier.
+
+12. defer=pass option for the ACL control cutthrough_delivery, to reflect 4xx
+    returns from the target back to the initiator, rather than spooling the
+    message.
+
+13. New built-in constants available for tls_dhparam and default changed.
+
+14. If built with EXPERIMENTAL_QUEUEFILE, a queuefile transport, for writing
+    out copies of the message spool files for use by 3rd-party scanners.
+
+15. A new option on the smtp transport, hosts_try_fastopen.  If the system
+    supports it (on Linux it must be enabled in the kernel by the sysadmin)
+    try to use RFC 7413 "TCP Fast Open".  No data is sent on the SYN segment
+    but it permits a peer that also supports the facility to send its SMTP
+    banner immediately after the SYN,ACK segment rather then waiting for
+    another ACK - so saving up to one roundtrip time.  Because it requires
+    previous communication with the peer (we save a cookie from it) this
+    will only become active on frequently-contacted destinations.
 
 
 Version 4.87
@@ -40,9 +90,11 @@ Version 4.87
     synonym of the latter).  Add support in base64 for certificates.
 
  8. New main configuration option "bounce_return_linesize_limit" to
-    avoid oversize bodies in bounces. The dafault value matches RFC
+    avoid oversize bodies in bounces. The default value matches RFC
     limits.
 
+ 9. New $initial_cwd expansion variable.
+
 
 Version 4.86
 ------------
@@ -58,7 +110,7 @@ Version 4.86
 
  5. Assorted options on malware= and spam= scanners.
 
- 6. A commandline option to write a comment into the logfile.
+ 6. A command-line option to write a comment into the logfile.
 
  7. If built with EXPERIMENTAL_SOCKS feature enabled, the smtp transport can
     be configured to make connections via socks5 proxies.
@@ -86,7 +138,7 @@ Version 4.85
 ------------
 
  1. If built with EXPERIMENTAL_DANE feature enabled, Exim will follow the
-    DANE smtp draft to assess a secure chain of trust of the certificate
+    DANE SMTP draft to assess a secure chain of trust of the certificate
     used to establish the TLS connection based on a TLSA record in the
     domain of the sender.
 
@@ -275,14 +327,14 @@ Version 4.82
     "aaaa" and "a" lookups is done and the full set of results returned.
 
 14. New expansion variable $headers_added with content from ACL add_header
-    modifier (but not yet added to messsage).
+    modifier (but not yet added to message).
 
 15. New 8bitmime status logging option for received messages.  Log field "M8S".
 
 16. New authenticated_sender logging option, adding to log field "A".
 
 17. New expansion variables $router_name and $transport_name.  Useful
-    particularly for debug_print as -bt commandline option does not
+    particularly for debug_print as -bt command-line option does not
     require privilege whereas -d does.
 
 18. If built with EXPERIMENTAL_PRDR, per-recipient data responses per a
diff --git a/doc/doc-txt/OptionLists.txt b/doc/doc-txt/OptionLists.txt
index 375850d6b..dc16b6dee 100644
--- a/doc/doc-txt/OptionLists.txt
+++ b/doc/doc-txt/OptionLists.txt
@@ -300,6 +300,7 @@ hosts_require_ocsp                   host list       unset         smtp
 hosts_require_tls                    host list       unset         smtp              3.20
 hosts_treat_as_local                 domain list     unset         main              1.95
 hosts_try_auth                       host list       unset         smtp              4.00
+hosts_try_fastopen                   host list       unset         smtp              4.88
 hosts_try_prdr                       host list       unset         smtp              4.82 if experimental_prdr
 ibase_servers                        string          unset         main              4.23
 ignore_bounce_errors_after           time            0s            main              4.00
@@ -968,7 +969,7 @@ TCP_WRAPPERS_DAEMON_NAME     system*      daemon name used by tcpwrappers librar
 TIMEZONE_DEFAULT             optional     default for timezone option
 TLS_INCLUDE                  optional     path to include files for TLS
 TLS_LIBS                     optional     additional libraries for TLS
-TMPDIR                       system       value for TMPDIR environment variable
+EXIM_TMPDIR                  system       value for TMPDIR environment variable
 TRANSPORT_APPENDFILE         driver       include appendfile transport
 TRANSPORT_AUTOREPLY          driver       include autoreply transport
 TRANSPORT_LMTP               driver       include lmtp transport
diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 4836a7d51..5213d8be4 100644
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -884,18 +884,20 @@ with DANE in their OCSP settings.
 
 
 For client-side DANE there are two new smtp transport options,
-hosts_try_dane and hosts_require_dane.  They do the obvious thing.
+hosts_try_dane and hosts_require_dane.
 [ should they be domain-based rather than host-based? ]
 
+Hosts_require_dane will result in failure if the target host
+is not DNSSEC-secured.
+
 DANE will only be usable if the target host has DNSSEC-secured
 MX, A and TLSA records.
 
 A TLSA lookup will be done if either of the above options match
 and the host-lookup succeded using dnssec.
 If a TLSA lookup is done and succeeds, a DANE-verified TLS connection
-will be required for the host.
-
-(TODO: specify when fallback happens vs. when the host is not used)
+will be required for the host.  If it does not, the host will not
+be used; there is no fallback to non-DANE or non-TLS.
 
 If DANE is requested and useable (see above) the following transport
 options are ignored:
@@ -965,6 +967,107 @@ Rationale:
 Note that non-RFC-documented field names and data types are used.
 
 
+LMDB Lookup support
+-------------------
+LMDB is an ultra-fast, ultra-compact, crash-proof key-value embedded data store.
+It is modeled loosely on the BerkeleyDB API. You shoul read about the feature
+set as well as operation modes at https://symas.com/products/lightning-memory-mapped-database/
+
+LMDB single key lookup support is provided by linking to the LMDB C library.
+The current implementation does not support writing to the LMDB database.
+
+Visit https://github.com/LMDB/lmdb to download the library or find it in your
+operating systems package repository.
+
+If building from source, this description assumes that headers will be in
+/usr/local/include, and that the libraries are in /usr/local/lib.
+
+1. In order to build exim with LMDB lookup support add or uncomment
+
+EXPERIMENTAL_LMDB=yes
+
+to your Local/Makefile. (Re-)build/install exim. exim -d should show
+Experimental_LMDB in the line "Support for:".
+
+EXPERIMENTAL_LMDB=yes
+LDFLAGS += -llmdb
+# CFLAGS += -I/usr/local/include
+# LDFLAGS += -L/usr/local/lib
+
+The first line sets the feature to include the correct code, and
+the second line says to link the LMDB libraries into the
+exim binary.  The commented out lines should be uncommented if you
+built LMDB from source and installed in the default location.
+Adjust the paths if you installed them elsewhere, but you do not
+need to uncomment them if an rpm (or you) installed them in the
+package controlled locations (/usr/include and /usr/lib).
+
+2. Create your LMDB files, you can use the mdb_load utility which is
+part of the LMDB distribution our your favourite language bindings.
+
+3. Add the single key lookups to your exim.conf file, example lookups
+are below.
+
+${lookup{$sender_address_domain}lmdb{/var/lib/baruwa/data/db/relaydomains.mdb}{$value}}
+${lookup{$sender_address_domain}lmdb{/var/lib/baruwa/data/db/relaydomains.mdb}{$value}fail}
+${lookup{$sender_address_domain}lmdb{/var/lib/baruwa/data/db/relaydomains.mdb}}
+
+
+Queuefile transport
+-------------------
+Queuefile is a pseudo transport which does not perform final delivery.
+It simply copies the exim spool files out of the spool directory into
+an external directory retaining the exim spool format.
+
+The spool files can then be processed by external processes and then
+requeued into exim spool directories for final delivery.
+
+The motivation/inspiration for the transport is to allow external
+processes to access email queued by exim and have access to all the
+information which would not be available if the messages were delivered
+to the process in the standard email formats.
+
+The mailscanner package is one of the processes that can take advantage
+of this transport to filter email.
+
+The transport can be used in the same way as the other existing transports,
+i.e by configuring a router to route mail to a transport configured with
+the queuefile driver.
+
+The transport only takes one option:
+
+* directory - This is used to specify the directory messages should be
+copied to
+
+The generic transport options (body_only, current_directory, disable_logging,
+debug_print, delivery_date_add, envelope_to_add, event_action, group,
+headers_add, headers_only, headers_remove, headers_rewrite, home_directory,
+initgroups, max_parallel, message_size_limit, rcpt_include_affixes,
+retry_use_local_part, return_path, return_path_add, shadow_condition,
+shadow_transport, transport_filter, transport_filter_timeout, user) are
+ignored.
+
+Sample configuration:
+
+(Router)
+
+scan:
+   driver = accept
+   transport = scan
+
+(Transport)
+
+scan:
+  driver = queuefile
+  directory = /var/spool/baruwa-scanner/input
+
+
+In order to build exim with Queuefile transport support add or uncomment
+
+EXPERIMENTAL_QUEUEFILE=yes
+
+to your Local/Makefile. (Re-)build/install exim. exim -d should show
+Experimental_QUEUEFILE in the line "Support for:".
 
 
 --------------------------------------------------------------
diff --git a/release-process/scripts/mk_exim_release.pl b/release-process/scripts/mk_exim_release.pl
index 995720e2c..9b2971f07 100755
--- a/release-process/scripts/mk_exim_release.pl
+++ b/release-process/scripts/mk_exim_release.pl
@@ -1,4 +1,5 @@
 #!/usr/bin/env perl
+# Copyright (c) The Exim Maintainers 2016
 
 use strict;
 use warnings;
@@ -22,16 +23,15 @@ sub get_and_check_version {
     my $context = shift;
 
     # make sure this looks like a real release version
-    # which should (currently) be 4.xx or 4.xx_RCx
-    unless ( $release =~ /^(4\.\d\d(?:_RC\d+)?)$/ ) {
+    # which should (currently) be 4.xx[.y] or 4.xx[.y]_RCx
+    unless ( $release =~ /^(?<release>(?<major>4\.\d\d)(?:\.(?<minor>\d+))?(?:_RC\d+)?)$/ ) {
         croak "The given version number does not look right - $release";
     }
-    my $full_release  = $1;              # untainted here...
-    my $trunc_release = $full_release;
-    $trunc_release =~ s/^(4\.\d\d)(?:_RC\d+)?$/$1/;
+    $context->{release}  = $+{release};
+    $context->{major} = $+{major};
+    $context->{minor} = $+{minor};
 
-    $context->{release}  = $full_release;
-    $context->{trelease} = $trunc_release;
+    ($context->{trelease} = $+{release}) =~ s/_RC\d+//;
 }
 
 # ------------------------------------------------------------------
@@ -87,7 +87,6 @@ sub export_git_tree {
     my $archive_file = sprintf( '%s/%s-%s.tar', $context->{tmp}, $context->{pkgname}, $context->{release} );
     $context->{tmp_archive_file} = $archive_file;
     my @cmd = ( 'git', 'archive', '--format=tar', "--output=$archive_file", $context->{tag} );
-
     # run git command
     print( "Running: ", join( ' ', @cmd ), "\n" ) if ($verbose);
     system(@cmd) == 0 || croak "Export failed";
@@ -124,13 +123,37 @@ sub make_version_script {
         return;
     }
 
-    my @cmd = ("../scripts/reversion", "release");
+    # Currently (25. Feb. 2016) the mk_exim_release.pl up to now can't
+    # deal with security releases.!? So we need a current
+    # mk_exim_release.pl. But if we use a current (master), the
+    # reversion script returns wrong version info (it's running inside
+    # the Git tree and uses git --describe, which always returns the
+    # current version of master.) I do not want to change the old
+    # reversion scripts (in 4.86.1, 4.85.1).
+    #
+    # Thus we've to provide the version.sh, based on the info we have
+    # about the release. If reversion finds this, it doesn't try to find
+    # it's own way to get a valid version number from the git.
+    open(my $v, '>', 'version.sh') or die "Can't open '>version.sh' $!\n";
+    print {$v} <<__;
+# initial version automatically generated from $0
+EXIM_RELEASE_VERSION=$context->{major}
+EXIM_VARIANT_VERSION=@{[$context->{minor}?'_'.$context->{minor}:'']}
+EXIM_COMPILE_NUMBER=0
+__
+    close($v);
+    unlink 'version.h';
+    return;
+
+    # Later, if we get the reversion script fixed, we can call it again.
+    # For now (25. Feb. 2016) we'll leave it unused.
+    my @cmd = ("../scripts/reversion", "release", $context->{tag});
     print( "Running: ", join( ' ', @cmd ), "\n" ) if ($verbose);
     system(@cmd) == 0 || croak "reversion failed";
 
     unlink "version.h";
 
-    -f "version.sh" or die "failed to create version.h";
+    -f "version.sh" or die "failed to create version.sh";
 }
 
 # ------------------------------------------------------------------
@@ -288,7 +311,7 @@ sub build_package_directories {
     my $context = shift;
 
     build_main_package_directory($context);
-    build_pspdfinfo_directory($context);
+    build_pspdfinfo_directory($context) if $context->{build_docs};
 }
 
 # ------------------------------------------------------------------
@@ -370,6 +393,7 @@ sub create_tar_files {
                 bzip2   => 1,
                 lzip    => 0,
         },
+        build_docs   => 1,
     };
     my $delete;
     my $cleanup = 1;
@@ -388,6 +412,7 @@ sub create_tar_files {
             'man!'          => \$man,
             'delete!'       => \$delete,
             'cleanup!'      => \$cleanup,
+            'build-docs!'   => \$context->{build_docs},
         )
       )
     {
@@ -404,7 +429,7 @@ sub create_tar_files {
     chdir( $context->{directory} ) || die;
     unpack_tree($context);
     make_version_script($context);
-    build_documentation($context);
+    build_documentation($context) if $context->{build_docs};
     build_package_directories($context);
     create_tar_files($context);
     do_cleanup($context) if ($cleanup);
@@ -423,7 +448,7 @@ mk_exim_release.pl - Build an exim release
 mk_exim_release.pl [options] version
 
  Options:
-   --debug             force debug mode (SQL Trace)
+   --debug             force debug mode
    --verbose           force verbose mode
    --help              display this help and exits
    --man               displays man page
@@ -432,6 +457,7 @@ mk_exim_release.pl [options] version
    --directory=dir     dir to package
    --no-lzip           do not create .tar.lz files
    --delete            Delete packaging directory at start
+   --noweb             skip the website generation
 
 =head1 OPTIONS
 
@@ -439,8 +465,7 @@ mk_exim_release.pl [options] version
 
 =item B<--debug>
 
-Forces debug mode cause all SQL statements generated by L<DBIx::Class>
-to be output.
+Forces debug mode.
 
 =item B<--tar>
 
@@ -478,7 +503,7 @@ Builds an exim release.
 Starting in a populated git repo that has already been tagged for
 release, build docs, build packages etc.
 
-Parameter is the version number to build as - ie 4.72 4.72RC1 etc
+Parameter is the version number to build as - ie 4.72 4.72RC1, 4.86.1, etc
 
 =head1 AUTHOR
 
diff --git a/src/Makefile b/src/Makefile
index adda7ceb3..ccaca1c13 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -19,8 +19,14 @@ RM_COMMAND=/bin/rm
 # provide an override for the OS type and architecture type; they still have
 # to be used for the OS-specific files. To override them, you can set the
 # shell variables OSTYPE and ARCHTYPE when running make.
-
-buildname=$${build:-`$(SHELL) scripts/os-type`-`$(SHELL) scripts/arch-type`}
+#
+# EXIM_BUILD_SUFFIX should be used to enable parallel builds on a file
+# system shared among different Linux distros (same os-type, same
+# arch-type). The ../test/runtest script is expected to honour the
+# EXIM_BUILD_SUFFIX when searching the Exim binary.
+# NOTE: EXIM_BUILD_SUFFIX is considered *experimental*.
+
+buildname=$${build:-`$(SHELL) scripts/os-type`-`$(SHELL) scripts/arch-type`}$${EXIM_BUILD_SUFFIX:+.$$EXIM_BUILD_SUFFIX}
 
 # The default target checks for the existence of Local/Makefile, that the main
 # makefile is built and up-to-date, and then it runs it.
diff --git a/src/OS/Makefile-Base b/src/OS/Makefile-Base
index 9bc819dd7..b9eaabaa6 100644
--- a/src/OS/Makefile-Base
+++ b/src/OS/Makefile-Base
@@ -4,6 +4,8 @@
 # concatentates the configuration settings from Local/Makefile and other,
 # optional, Local/* files at the front of this file, to create Makefile in the
 # build directory.
+#
+# Copyright (c) The Exim Maintainers 2016
 
 SHELL      = $(MAKE_SHELL)
 SCRIPTS    = ../scripts
@@ -277,6 +279,7 @@ exipick: Makefile ../src/exipick.src
 	@rm -f exipick
 	@sed -e "s?PERL_COMMAND?$(PERL_COMMAND)?" \
 	  -e "s?SPOOL_DIRECTORY?$(SPOOL_DIRECTORY)?" \
+	  -e "s?BIN_DIRECTORY?$(BIN_DIRECTORY)?" \
 	  ../src/exipick.src > exipick-t
 	@mv exipick-t exipick
 	@chmod a+x exipick
@@ -312,7 +315,6 @@ convert4r4: Makefile ../src/convert4r4.src
 # are thrown away by the linker.
 
 OBJ_WITH_CONTENT_SCAN = malware.o mime.o regex.o spam.o spool_mbox.o
-OBJ_WITH_OLD_DEMIME = demime.o
 OBJ_EXPERIMENTAL = bmi_spam.o \
 				dane.o \
 				dcc.o \
@@ -329,15 +331,16 @@ OBJ_LOOKUPS = lookups/lf_quote.o lookups/lf_check_file.o lookups/lf_sqlperform.o
 
 OBJ_EXIM = acl.o base64.o child.o crypt16.o daemon.o dbfn.o debug.o deliver.o \
         directory.o dns.o drtables.o enq.o exim.o expand.o filter.o \
-        filtertest.o globals.o dkim.o \
+        filtertest.o globals.o dkim.o hash.o \
         header.o host.o ip.o log.o lss.o match.o moan.o \
         os.o parse.o queue.o \
         rda.o readconf.o receive.o retry.o rewrite.o rfc2047.o \
         route.o search.o sieve.o smtp_in.o smtp_out.o spool_in.o spool_out.o \
         std-crypto.o store.o string.o tls.o tod.o transport.o tree.o verify.o \
+        environment.o \
         $(OBJ_LOOKUPS) \
         local_scan.o $(EXIM_PERL) $(OBJ_WITH_CONTENT_SCAN) \
-        $(OBJ_WITH_OLD_DEMIME) $(OBJ_EXPERIMENTAL)
+        $(OBJ_EXPERIMENTAL)
 
 exim:   buildlookups buildauths pdkim/pdkim.a \
         buildrouters buildtransports \
@@ -407,7 +410,7 @@ exim_tidydb: $(OBJ_TIDYDB)
 
 exim_dbmbuild: exim_dbmbuild.o
 	@echo "$(LNCC) -o exim_dbmbuild"
-	$(FE)$(LNCC) -o exim_dbmbuild $(LFLAGS) exim_dbmbuild.o \
+	$(FE)$(LNCC) $(CFLAGS) $(INCLUDE) -o exim_dbmbuild $(LFLAGS) exim_dbmbuild.o \
 	  $(LIBS) $(EXTRALIBS) $(DBMLIB)
 	@if [ x"$(STRIP_COMMAND)" != x"" ]; then \
 	  echo $(STRIP_COMMAND) exim_dbmbuild; \
@@ -445,7 +448,13 @@ MONBIN = em_StripChart.o $(EXIMON_TEXTPOP) em_globals.o em_init.o \
 # The complete modules list also includes some specially compiled versions of
 # code from the main Exim source tree.
 
-OBJ_MONBIN = util-spool_in.o util-store.o util-string.o tod.o tree.o $(MONBIN)
+OBJ_MONBIN = util-spool_in.o \
+	     util-store.o \
+	     util-string.o \
+	     util-queue.o \
+	     tod.o \
+	     tree.o \
+	     $(MONBIN)
 
 eximon.bin: $(EXIMON_EDITME) eximon $(OBJ_MONBIN) \
             ../exim_monitor/em_version.c
@@ -454,7 +463,7 @@ eximon.bin: $(EXIMON_EDITME) eximon $(OBJ_MONBIN) \
 	  $(CFLAGS) $(XINCLUDE) -I. ../exim_monitor/em_version.c
 	@echo "$(LNCC) -o eximon.bin"
 	$(FE)$(PURIFY) $(LNCC) -o eximon.bin em_version.o $(LFLAGS) $(XLFLAGS) \
-	$(OBJ_MONBIN) -lXaw -lXmu -lXt -lXext -lX11 $(PCRE_LIBS) \
+	  $(OBJ_MONBIN) -lXaw -lXmu -lXt -lXext -lX11 $(PCRE_LIBS) \
 	  $(LIBS) $(LIBS_EXIMON) $(EXTRALIBS) $(EXTRALIBS_EXIMON) -lc
 	@if [ x"$(STRIP_COMMAND)" != x"" ]; then \
 	  echo $(STRIP_COMMAND) eximon.bin; \
@@ -470,15 +479,18 @@ eximon.bin: $(EXIMON_EDITME) eximon $(OBJ_MONBIN) \
 # in one. This list is overkill, but it doesn't really take much time to
 # rebuild Exim on a modern computer.
 
-HDRS  =	config.h \
+HDRS  =	blob.h \
+	config.h \
 	dbfunctions.h \
 	dbstuff.h \
 	exim.h \
 	functions.h \
 	globals.h \
+	hash.h \
 	local_scan.h \
 	macros.h \
 	mytypes.h \
+	sha_ver.h \
 	structs.h \
 	os.h
 PHDRS = ../config.h \
@@ -562,6 +574,10 @@ util-string.o:   $(HDRS) string.c
 	@echo "$(CC) -DCOMPILE_UTILITY string.c"
 	$(FE)$(CC) -c $(CFLAGS) $(INCLUDE) -DCOMPILE_UTILITY -o util-string.o string.c
 
+util-queue.o:   $(HDRS) queue.c
+	@echo "$(CC) -DCOMPILE_UTILITY queue.c"
+	$(FE)$(CC) -c $(CFLAGS) $(INCLUDE) -DCOMPILE_UTILITY -o util-queue.o queue.c
+
 util-os.o:       $(HDRS) os.c
 	@echo "$(CC) -DCOMPILE_UTILITY os.c"
 	$(FE)$(CC) -c $(CFLAGS) $(INCLUDE) \
@@ -592,9 +608,11 @@ dns.o:           $(HDRS) dns.c
 enq.o:           $(HDRS) enq.c
 exim.o:          $(HDRS) exim.c
 expand.o:        $(HDRS) expand.c
+environment.o:   $(HDRS) environment.c
 filter.o:        $(HDRS) filter.c
 filtertest.o:    $(HDRS) filtertest.c
 globals.o:       $(HDRS) globals.c
+hash.o:          $(HDRS) hash.c
 header.o:        $(HDRS) header.c
 host.o:          $(HDRS) host.c
 ip.o:            $(HDRS) ip.c
@@ -602,7 +620,7 @@ log.o:           $(HDRS) log.c
 lss.o:           $(HDRS) lss.c
 match.o:         $(HDRS) match.c
 moan.o:          $(HDRS) moan.c
-os.o:            $(HDRS) os.c
+os.o:            $(HDRS) $(OS_C_INCLUDES) os.c
 parse.o:         $(HDRS) parse.c
 queue.o:         $(HDRS) queue.c
 rda.o:           $(HDRS) rda.c
@@ -621,7 +639,7 @@ spool_out.o:     $(HDRS) spool_out.c
 std-crypto.o:    $(HDRS) std-crypto.c
 store.o:         $(HDRS) store.c
 string.o:        $(HDRS) string.c
-tls.o:           $(HDRS) tls.c setenv.c \
+tls.o:           $(HDRS) tls.c \
 		 tls-gnu.c tlscert-gnu.c \
 		 tls-openssl.c tlscert-openssl.c
 tod.o:           $(HDRS) tod.c
@@ -639,11 +657,6 @@ spam.o:          $(HDRS) spam.c
 spool_mbox.o:    $(HDRS) spool_mbox.c
 
 
-# Dependencies for WITH_OLD_DEMIME modules
-
-demime.o:       $(HDRS) demime.c
-
-
 # Dependencies for EXPERIMENTAL_* modules
 
 bmi_spam.o:	$(HDRS) bmi_spam.c
diff --git a/src/OS/Makefile-CYGWIN b/src/OS/Makefile-CYGWIN
index 23981d479..cda5d26cc 100644
--- a/src/OS/Makefile-CYGWIN
+++ b/src/OS/Makefile-CYGWIN
@@ -80,7 +80,6 @@ LOOKUP_PASSWD=yes
 LDAP_LIB_TYPE=OPENLDAP2
 LOOKUP_LIBS=-lldap -llber
 
-# WITH_OLD_DEMIME=yes
 WITH_CONTENT_SCAN=yes
 
 # It is important to define these variables but the values are always overridden
diff --git a/src/OS/Makefile-HP-UX b/src/OS/Makefile-HP-UX
index 073d67aba..ea35144bb 100644
--- a/src/OS/Makefile-HP-UX
+++ b/src/OS/Makefile-HP-UX
@@ -22,4 +22,6 @@ EXIMON_TEXTPOP=
 DBMLIB=-lndbm
 RANLIB=@true
 
+OS_C_INCLUDES=setenv.c
+
 # End
diff --git a/src/OS/Makefile-SunOS5 b/src/OS/Makefile-SunOS5
index e60a6c088..568e99f1c 100644
--- a/src/OS/Makefile-SunOS5
+++ b/src/OS/Makefile-SunOS5
@@ -19,4 +19,6 @@ XINCLUDE=-I$(X11)/include
 XLFLAGS=-L$(X11)/lib -R$(X11)/lib
 X11LIB=$(X11)/lib
 
+OS_C_INCLUDES=setenv.c
+
 # End
diff --git a/src/OS/os.c-BSDI b/src/OS/os.c-BSDI
new file mode 100644
index 000000000..3cef2ac6d
--- /dev/null
+++ b/src/OS/os.c-BSDI
@@ -0,0 +1,19 @@
+/*************************************************
+*     Exim - an Internet mail transport agent    *
+*************************************************/
+
+/* Copyright (c) 2016 Heiko Schlittermann <hs@schlittermann.de> */
+/* See the file NOTICE for conditions of use and distribution. */
+
+/* BSDI-specific code. This is concatenated onto the generic
+src/os.c file. */
+
+#ifndef OS_UNSETENV
+#define OS_UNSETENV
+
+int
+os_unsetenv(const unsigned char * name)
+{
+unsetenv((char *)name);
+return 0;
+}
diff --git a/src/OS/os.c-HP-UX b/src/OS/os.c-HP-UX
new file mode 100644
index 000000000..fdd8708a2
--- /dev/null
+++ b/src/OS/os.c-HP-UX
@@ -0,0 +1,16 @@
+/*************************************************
+*     Exim - an Internet mail transport agent    *
+*************************************************/
+
+/* Copyright (c) University of Cambridge 2016 */
+/* Copyright (c) Jeremy Harris 2016 */
+/* See the file NOTICE for conditions of use and distribution. */
+
+/* HP-UX-specific code. This is concatenated onto the generic
+src/os.c file. */
+
+#ifndef COMPILE_UTILITY
+# include "setenv.c"
+#endif
+
+/* End of os.c-SunHP-UX */
diff --git a/src/OS/os.c-Linux b/src/OS/os.c-Linux
index 0043e8627..4bca77615 100644
--- a/src/OS/os.c-Linux
+++ b/src/OS/os.c-Linux
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1997 - 2014 */
+/* Copyright (c) University of Cambridge 1997 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Linux-specific code. This is concatenated onto the generic
diff --git a/src/OS/os.c-SunOS5 b/src/OS/os.c-SunOS5
new file mode 100644
index 000000000..162486958
--- /dev/null
+++ b/src/OS/os.c-SunOS5
@@ -0,0 +1,16 @@
+/*************************************************
+*     Exim - an Internet mail transport agent    *
+*************************************************/
+
+/* Copyright (c) University of Cambridge 2016 */
+/* Copyright (c) Jeremy Harris 2016 */
+/* See the file NOTICE for conditions of use and distribution. */
+
+/* Solaris-specific code. This is concatenated onto the generic
+src/os.c file. */
+
+#if defined(MISSING_UNSETENV_3) && !defined(COMPILE_UTILITY)
+# include "setenv.c"
+#endif
+
+/* End of os.c-SunOS5 */
diff --git a/src/OS/os.h-BSDI b/src/OS/os.h-BSDI
index 6e16722fd..a1705ec95 100644
--- a/src/OS/os.h-BSDI
+++ b/src/OS/os.h-BSDI
@@ -5,6 +5,7 @@
 #define HAVE_MMAP
 #define HAVE_SYS_MOUNT_H
 #define SIOCGIFCONF_GIVES_ADDR
+#define OS_UNSETENV
 
 typedef struct flock flock_t;
 
diff --git a/src/OS/os.h-HP-UX b/src/OS/os.h-HP-UX
index 1b599231d..4998734f6 100644
--- a/src/OS/os.h-HP-UX
+++ b/src/OS/os.h-HP-UX
@@ -10,7 +10,6 @@
 #define FSCALE          1.0
 
 #define HAVE_SYS_STATVFS_H
-#define MISSING_UNSETENV_3
 
 #define F_FREESP           O_TRUNC
 #define NEED_H_ERRNO       1
diff --git a/src/OS/os.h-Linux b/src/OS/os.h-Linux
index 05c153e2c..510865c66 100644
--- a/src/OS/os.h-Linux
+++ b/src/OS/os.h-Linux
@@ -65,5 +65,13 @@ then change the 0 to 1 in the next block. */
 # define LLONG_MAX LONG_LONG_MAX
 #endif
 
+#if _POSIX_C_SOURCE >= 200809L || _ATFILE_SOUCE
+# define EXIM_HAVE_OPENAT
+#endif
+
+#if defined(TCP_FASTOPEN) && !defined(MSG_FASTOPEN)
+# define MSG_FASTOPEN 0x20000000
+#endif
+
 
 /* End */
diff --git a/src/OS/os.h-SunOS5 b/src/OS/os.h-SunOS5
index 45a1171c8..807212b85 100644
--- a/src/OS/os.h-SunOS5
+++ b/src/OS/os.h-SunOS5
@@ -37,4 +37,10 @@ it seems. */
 #endif
 
 
+/* SunOS5 doesn't accept getcwd(NULL, 0) to auto-allocate
+a buffer */
+
+#define OS_GETCWD
+
+
 /* End */
diff --git a/src/README.UPDATING b/src/README.UPDATING
index 590642f3e..8cb59e91e 100644
--- a/src/README.UPDATING
+++ b/src/README.UPDATING
@@ -26,6 +26,17 @@ The rest of this document contains information about changes in 4.xx releases
 that might affect a running system.
 
 
+Exim version 4.88
+-----------------
+
+ * The "demime" ACL condition, deprecated for the past 10 years, has
+   now been removed.
+
+ * Old GnuTLS configuration options "gnutls_require_kx", "gnutls_require_mac",
+   and "gnutls_require_protocols" have now been removed.  (Inoperative from
+   4.80, per below; logging warnings since 4.83, again per below).
+
+
 Exim version 4.83
 -----------------
 
diff --git a/src/exim_monitor/em_TextPop.c b/src/exim_monitor/em_TextPop.c
index faa51ed89..03f97da52 100644
--- a/src/exim_monitor/em_TextPop.c
+++ b/src/exim_monitor/em_TextPop.c
@@ -468,7 +468,7 @@ struct SearchAndReplace * search;
   text.firstPos = 0;
   text.format = FMT8BIT;
 
-  dir = (XawTextScanDirection)(int) ((caddr_t)XawToggleGetCurrent(search->left_toggle) -
+  dir = (XawTextScanDirection) ((long)XawToggleGetCurrent(search->left_toggle) -
 				R_OFFSET);
 
   pos = XawTextSearch( tw, dir, &text);
diff --git a/src/exim_monitor/em_globals.c b/src/exim_monitor/em_globals.c
index 6415e4238..54032362c 100644
--- a/src/exim_monitor/em_globals.c
+++ b/src/exim_monitor/em_globals.c
@@ -187,13 +187,15 @@ uid_t   originator_uid;
 
 uschar *primary_hostname       = NULL;
 
+uschar *queue_name             = US"";
+
 int     received_count         = 0;
 uschar *received_protocol      = NULL;
 int     received_time          = 0;
 int     recipients_count       = 0;
 recipient_item *recipients_list = NULL;
 int     recipients_list_max    = 0;
-int     running_in_test_harness=FALSE;
+BOOL    running_in_test_harness=FALSE;
 
 uschar *sender_address         = NULL;
 uschar *sender_fullhost        = NULL;
diff --git a/src/exim_monitor/em_hdr.h b/src/exim_monitor/em_hdr.h
index ed95716a3..a7e874a87 100644
--- a/src/exim_monitor/em_hdr.h
+++ b/src/exim_monitor/em_hdr.h
@@ -92,6 +92,7 @@ the benefit of structs.h. One of these days I should tidy up this interface so
 that this kind of kludge isn't needed. */
 
 #define MAXPACKET 1024
+typedef void hctx;
 
 #include "config.h"
 #include "mytypes.h"
diff --git a/src/exim_monitor/em_log.c b/src/exim_monitor/em_log.c
index 6efd9c0c9..9ff994ced 100644
--- a/src/exim_monitor/em_log.c
+++ b/src/exim_monitor/em_log.c
@@ -2,7 +2,7 @@
 *                 Exim Monitor                   *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2014 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* This module contains code for scanning the main log,
@@ -217,7 +217,11 @@ uschar buffer[log_buffer_len];
 
 if (LOG != NULL)
   {
-  fseek(LOG, log_position, SEEK_SET);
+  if (fseek(LOG, log_position, SEEK_SET))
+    {
+    perror("logfile fseek");
+    exit(1);
+    }
 
   while (Ufgets(buffer, log_buffer_len, LOG) != NULL)
     {
@@ -393,7 +397,11 @@ if (LOG == NULL ||
     {
     if (LOG != NULL) fclose(LOG);
     LOG = TEST;
-    fstat(fileno(LOG), &statdata);
+    if (fstat(fileno(LOG), &statdata))
+      {
+      fprintf(stderr, "fstat %s: %s\n", log_file_open, strerror(errno));
+      exit(1);
+      }
     log_inode = statdata.st_ino;
     }
   }
diff --git a/src/exim_monitor/em_main.c b/src/exim_monitor/em_main.c
index 69354c086..3034a041c 100644
--- a/src/exim_monitor/em_main.c
+++ b/src/exim_monitor/em_main.c
@@ -2,7 +2,7 @@
 *                  Exim Monitor                  *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2014 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -669,8 +669,14 @@ if (log_file[0] != 0)
     {
     fseek(LOG, 0, SEEK_END);
     log_position = ftell(LOG);
-    fstat(fileno(LOG), &statdata);
-    log_inode = statdata.st_ino;
+    if (fstat(fileno(LOG), &statdata))
+      {
+      perror("log file fstat");
+      fclose(LOG);
+      LOG=NULL;
+      }
+    else
+      log_inode = statdata.st_ino;
     }
   }
 else
diff --git a/src/exim_monitor/em_menu.c b/src/exim_monitor/em_menu.c
index 9d3ca1c14..6deb909da 100644
--- a/src/exim_monitor/em_menu.c
+++ b/src/exim_monitor/em_menu.c
@@ -2,7 +2,7 @@
 *                  Exim Monitor                  *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2009 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -133,32 +133,33 @@ menu_is_up = FALSE;
 *          Display the message log               *
 *************************************************/
 
-static void msglogAction(Widget w, XtPointer client_data, XtPointer call_data)
+static void
+msglogAction(Widget w, XtPointer client_data, XtPointer call_data)
 {
 int i;
-uschar buffer[256];
-Widget text = text_create((uschar *)client_data, text_depth);
-FILE *f = NULL;
+Widget text = text_create(US client_data, text_depth);
+uschar * fname = NULL;
+FILE * f = NULL;
 
 w = w;      /* Keep picky compilers happy */
 call_data = call_data;
 
 /* End up with the split version, so message looks right when non-exist */
 
-for (i = 0; i < (spool_is_split? 2:1); i++)
+for (i = 0; i < (spool_is_split ? 2:1); i++)
   {
-  message_subdir[0] = (i != 0)? ((uschar *)client_data)[5] : 0;
-  sprintf(CS buffer, "%s/msglog/%s/%s", spool_directory, message_subdir,
-    (uschar *)client_data);
-  f = fopen(CS buffer, "r");
-  if (f != NULL) break;
+  message_subdir[0] = i != 0 ? (US client_data)[5] : 0;
+  fname = spool_fname(US"msglog", message_subdir, US client_data, US"");
+  if ((f = fopen(CS fname, "r")))
+    break;
   }
 
-if (f == NULL)
-  text_showf(text, "%s: %s\n", buffer, strerror(errno));
+if (!f)
+  text_showf(text, "%s: %s\n", fname, strerror(errno));
 else
   {
-  while (Ufgets(buffer, 256, f) != NULL) text_show(text, buffer);
+  uschar buffer[256];
+  while (Ufgets(buffer, sizeof(buffer), f) != NULL) text_show(text, buffer);
   fclose(f);
   }
 }
@@ -169,10 +170,10 @@ else
 *          Display the message body               *
 *************************************************/
 
-static void bodyAction(Widget w, XtPointer client_data, XtPointer call_data)
+static void
+bodyAction(Widget w, XtPointer client_data, XtPointer call_data)
 {
 int i;
-uschar buffer[256];
 Widget text = text_create((uschar *)client_data, text_depth);
 FILE *f = NULL;
 
@@ -181,19 +182,21 @@ call_data = call_data;
 
 for (i = 0; i < (spool_is_split? 2:1); i++)
   {
-  message_subdir[0] = (i != 0)? ((uschar *)client_data)[5] : 0;
-  sprintf(CS buffer, "%s/input/%s/%s-D", spool_directory, message_subdir,
-    (uschar *)client_data);
-  f = fopen(CS buffer, "r");
-  if (f != NULL) break;
+  uschar * fname;
+  message_subdir[0] = i != 0 ? ((uschar *)client_data)[5] : 0;
+  fname = spool_fname(US"input", message_subdir, US client_data, US"-D");
+  if ((f = fopen(CS fname, "r")))
+    break;
   }
 
 if (f == NULL)
   text_showf(text, "Failed to open file: %s\n", strerror(errno));
 else
   {
+  uschar buffer[256];
   int count = 0;
-  while (Ufgets(buffer, 256, f) != NULL)
+
+  while (Ufgets(buffer, sizeof(buffer), f) != NULL)
     {
     text_show(text, buffer);
     count += Ustrlen(buffer);
@@ -273,8 +276,12 @@ if (pipe(pipe_fd) != 0)
   return;
   }
 
-fcntl(pipe_fd[0], F_SETFL, O_NONBLOCK);
-fcntl(pipe_fd[1], F_SETFL, O_NONBLOCK);
+if (  fcntl(pipe_fd[0], F_SETFL, O_NONBLOCK)
+   || fcntl(pipe_fd[1], F_SETFL, O_NONBLOCK))
+  {
+  perror("set nonblocking on pipe");
+  exit(1);
+  }
 
 /* Delivering a message can take some time, and we want to show the
 output as it goes along. This requires subprocesses and is coded below. For
@@ -373,7 +380,7 @@ if ((pid = fork()) == 0)
 
 /* Main process - set up an item for the main ticker to watch. */
 
-if (pid < 0) text_showf(text, "Failed to fork: %s\n", strerror(pid)); else
+if (pid < 0) text_showf(text, "Failed to fork: %s\n", strerror(errno)); else
   {
   pipe_item *p = (pipe_item *)store_malloc(sizeof(pipe_item));
 
@@ -551,7 +558,8 @@ static void addrecipAction(Widget w, XtPointer client_data, XtPointer call_data)
 {
 w = w;      /* Keep picky compilers happy */
 call_data = call_data;
-Ustrcpy(actioned_message, (uschar *)client_data);
+Ustrncpy(actioned_message, client_data, 24);
+actioned_message[23] = '\0';
 action_required = US"-Mar";
 dialog_ref_widget = menushell;
 create_dialog(US"Recipient address to add?", US"");
@@ -567,7 +575,8 @@ static void markdelAction(Widget w, XtPointer client_data, XtPointer call_data)
 {
 w = w;      /* Keep picky compilers happy */
 call_data = call_data;
-Ustrcpy(actioned_message, (uschar *)client_data);
+Ustrncpy(actioned_message, client_data, 24);
+actioned_message[23] = '\0';
 action_required = US"-Mmd";
 dialog_ref_widget = menushell;
 create_dialog(US"Recipient address to mark delivered?", US"");
@@ -582,7 +591,7 @@ static void markalldelAction(Widget w, XtPointer client_data, XtPointer call_dat
 {
 w = w;      /* Keep picky compilers happy */
 call_data = call_data;
-ActOnMessage((uschar *)client_data, US"-Mmad", US"");
+ActOnMessage(US client_data, US"-Mmad", US"");
 }
 
 
@@ -597,9 +606,10 @@ queue_item *q;
 uschar *sender;
 w = w;      /* Keep picky compilers happy */
 call_data = call_data;
-Ustrcpy(actioned_message, (uschar *)client_data);
+Ustrncpy(actioned_message, client_data, 24);
+actioned_message[23] = '\0';
 q = find_queue(actioned_message, queue_noop, 0);
-sender = (q == NULL)? US"" : (q->sender[0] == 0)? US"<>" : q->sender;
+sender = !q ? US"" : q->sender[0] == 0 ? US"<>" : q->sender;
 action_required = US"-Mes";
 dialog_ref_widget = menushell;
 create_dialog(US"New sender address?", sender);
diff --git a/src/exim_monitor/em_queue.c b/src/exim_monitor/em_queue.c
index c01a80fe0..4bdc57ab9 100644
--- a/src/exim_monitor/em_queue.c
+++ b/src/exim_monitor/em_queue.c
@@ -263,7 +263,8 @@ else
 
 sender_address = NULL;
 
-sprintf(CS buffer, "%s/input/%s/%s-D", spool_directory, message_subdir, name);
+snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s-D",
+  spool_directory, queue_name, message_subdir, name);
 if (Ustat(buffer, &statdata) == 0)
   q->size = message_size + statdata.st_size - SPOOL_DATA_START_OFFSET + 1;
 
@@ -271,7 +272,6 @@ if (Ustat(buffer, &statdata) == 0)
 been delivered, and removing visible names. */
 
 if (recipients_list != NULL)
-  {
   for (i = 0; i < recipients_count; i++)
     {
     uschar *r = recipients_list[i].address;
@@ -282,7 +282,6 @@ if (recipients_list != NULL)
       (void)find_dest(q, r, dest_add, FALSE);
       }
     }
-  }
 
 /* Recover the dynamic store used by spool_read_header(). */
 
@@ -617,11 +616,13 @@ uschar buffer[1024];
 
 message_subdir[0] = p->dir_char;
 
-sprintf(CS buffer, "%s/input/%s/%s-J", spool_directory, message_subdir, p->name);
-jread = fopen(CS buffer, "r");
-if (jread == NULL)
+snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s-J",
+  spool_directory, queue_name, message_subdir, p->name);
+
+if (!(jread = fopen(CS buffer, "r")))
   {
-  sprintf(CS buffer, "%s/input/%s/%s-H", spool_directory, message_subdir, p->name);
+  snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s-H",
+    spool_directory, queue_name, message_subdir, p->name);
   if (Ustat(buffer, &statdata) < 0 || p->update_time == statdata.st_mtime)
     return;
   }
@@ -655,32 +656,23 @@ if (jread != NULL)
 been delivered, and removing visible names. In the nonrecipients tree,
 domains are lower cased. */
 
-if (recipients_list != NULL)
-  {
+if (recipients_list)
   for (i = 0; i < recipients_count; i++)
     {
-    uschar *pp;
-    uschar *r = recipients_list[i].address;
-    tree_node *node = tree_search(tree_nonrecipients, r);
+    uschar * pp;
+    uschar * r = recipients_list[i].address;
+    tree_node * node;
 
-    if (node == NULL)
-      {
-      uschar temp[256];
-      uschar *rr = temp;
-      Ustrcpy(temp, r);
-      while (*rr != 0 && *rr != '@') rr++;
-      while (*rr != 0) { *rr = tolower(*rr); rr++; }
-      node = tree_search(tree_nonrecipients, temp);
-      }
+    if (!(node = tree_search(tree_nonrecipients, r)))
+      node = tree_search(tree_nonrecipients, string_copylc(r));
 
-    if ((pp = strstric(r+1, qualify_domain, FALSE)) != NULL &&
-      *(--pp) == '@') *pp = 0;
-    if (node == NULL)
+    if ((pp = strstric(r+1, qualify_domain, FALSE)) && *(--pp) == '@')
+       *pp = 0;
+    if (!node)
       (void)find_dest(p, r, dest_add, FALSE);
     else
       (void)find_dest(p, r, dest_remove, FALSE);
     }
-  }
 
 /* We also need to scan the tree of non-recipients, which might
 contain child addresses that are not in the recipients list, but
diff --git a/src/exim_monitor/em_strip.c b/src/exim_monitor/em_strip.c
index 00675d46f..f0ad3abbb 100644
--- a/src/exim_monitor/em_strip.c
+++ b/src/exim_monitor/em_strip.c
@@ -58,12 +58,13 @@ a little game in order to ensure that the double value is correctly
 passed back via the value pointer without the compiler doing an
 unwanted cast. */
 
-static void stripchartAction(Widget w, XtPointer client_data, XtPointer value)
+static void
+stripchartAction(Widget w, XtPointer client_data, XtPointer value)
 {
-double *ptr = (double *)value;
+double * ptr = (double *)value;
 static int thresholds[] =
   {10, 20, 50, 100, 200, 500, 1000, 2000, 5000, 10000, 0};
-int num = (int)client_data;
+int num = (long)client_data;
 int oldmax = 0;
 int newmax = 0;
 int newvalue = 0;
@@ -213,7 +214,8 @@ and for the second if it is a partition size display; its update time is
 initially set to 1 second so that it gives an immediate display of the queue.
 The first time its callback function is obeyed, the update time gets reset. */
 
-void create_stripchart(Widget parent, uschar *title)
+void
+create_stripchart(Widget parent, uschar *title)
 {
 Widget chart;
 
@@ -249,7 +251,7 @@ xs_SetValues(chart, 11,
   XtNfromVert,  label);
 
 XtAddCallback(chart, "getValue", stripchartAction,
-  (XtPointer)stripchart_count);
+  (XtPointer)(long)stripchart_count);
 
 stripchart_last_total[stripchart_count] = 0;
 stripchart_max[stripchart_count] = 10;
diff --git a/src/exim_monitor/em_xs.c b/src/exim_monitor/em_xs.c
index 87371b50c..b145fb993 100644
--- a/src/exim_monitor/em_xs.c
+++ b/src/exim_monitor/em_xs.c
@@ -2,7 +2,7 @@
 *               Exim Monitor                     *
 *************************************************/
 
-/* Copyright (c) University of Cambridge, 1995 - 2007 */
+/* Copyright (c) University of Cambridge, 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* This file contains a number of subroutines that are in effect
@@ -37,6 +37,7 @@ for (i = 0; i < num_args; i++)
   aa[i].name = va_arg(ap, String);
   aa[i].value = va_arg(ap, XtArgVal);
   }
+va_end(ap);
 XtSetValues(w, aa, num_args);
 if (num_args > 15) free(aa);
 }
diff --git a/src/scripts/Configure-Makefile b/src/scripts/Configure-Makefile
index eeb26eeb1..3e486a6bb 100755
--- a/src/scripts/Configure-Makefile
+++ b/src/scripts/Configure-Makefile
@@ -4,6 +4,8 @@
 # from inside the directory. It does its own checking of when to rebuild; it
 # just got too horrendous to get it right in "make", because of the optionally
 # existing configuration files.
+#
+# Copyright (c) The Exim Maintainers 2016
 
 
 # First off, get the OS type, and check that there is a make file for it.
@@ -110,7 +112,9 @@ do   if test -r ../$f
             echo "# End of $f"
             echo ""
      fi
-done >> $mft || exit 1
+done \
+     | sed 's/^TMPDIR=/EXIM_&/' \
+     >> $mft || exit 1
 
 # handle pkg-config
 # beware portability of extended regexps with sed.
@@ -132,13 +136,16 @@ then
       USE_*_PC)
         eval "pc_value=\"\$$var\""
         need_this=''
+        need_core=''
         if [ ".$SUPPORT_TLS" = "." ]; then
           # no TLS, not referencing
           true
         elif [ ".$var" = ".USE_GNUTLS_PC" ] && [ ".$USE_GNUTLS" != "." ]; then
           need_this=t
+          need_core="gnutls-special"
         elif [ ".$var" = ".USE_OPENSSL_PC" ] && [ ".$USE_GNUTLS" = "." ]; then
           need_this=t
+          need_core=t
         fi
         if [ ".$need_this" != "." ]; then
           tls_include=`pkg-config --cflags $pc_value`
@@ -149,6 +156,19 @@ then
           tls_libs=`pkg-config --libs $pc_value`
           echo "TLS_INCLUDE=$tls_include"
           echo "TLS_LIBS=$tls_libs"
+          # With hash.h pulling crypto into the core, we need to also handle that
+          if [ ".$need_this" = ".t" ]; then
+            echo "CFLAGS += $tls_include"
+            echo "LDFLAGS += $tls_libs"
+          elif [ ".$need_this" = ".gnutls-special" ]; then
+            if pkg-config --atleast-version=2.10 gnutls ; then
+              echo "CFLAGS += $tls_include"
+              echo "LDFLAGS += $tls_libs"
+            else
+              echo "CFLAGS += $(libgcrypt-config --cflags)"
+              echo "LDFLAGS += $(libgcrypt-config --libs)"
+            fi
+          fi
         fi
         ;;
 
diff --git a/src/scripts/MakeLinks b/src/scripts/MakeLinks
index 886214030..b710c2fd8 100755
--- a/src/scripts/MakeLinks
+++ b/src/scripts/MakeLinks
@@ -2,6 +2,8 @@
 
 # Script to build links for all the exim source files from the system-
 # specific build directory. It should be run from within that directory.
+#
+# Copyright (c) The Exim Maintainers 2016
 
 test ! -d ../src && \
   echo "*** $0 should be run in a system-specific subdirectory." && \
@@ -29,7 +31,7 @@ mkdir lookups
 cd lookups
 # Makefile is generated
 for f in README cdb.c dbmdb.c dnsdb.c dsearch.c ibase.c ldap.h ldap.c \
-  lsearch.c mysql.c redis.c nis.c nisplus.c oracle.c passwd.c \
+  lmdb.c lsearch.c mysql.c redis.c nis.c nisplus.c oracle.c passwd.c \
   pgsql.c spf.c sqlite.c testdb.c whoson.c \
   lf_functions.h lf_check_file.c lf_quote.c lf_sqlperform.c
 do
@@ -57,8 +59,8 @@ cd ..
 mkdir transports
 cd transports
 for f in README Makefile appendfile.h appendfile.c autoreply.h \
-  autoreply.c lmtp.h lmtp.c pipe.h pipe.c smtp.h smtp.c smtp_socks.c \
-  tf_maildir.c tf_maildir.h
+  autoreply.c lmtp.h lmtp.c pipe.h pipe.c queuefile.c queuefile.h \
+  smtp.h smtp.c smtp_socks.c tf_maildir.c tf_maildir.h
 do
   ln -s ../../src/transports/$f $f
 done
@@ -93,15 +95,16 @@ cd ..
 # but local_scan.c does not, because its location is taken from the build-time
 # configuration. Likewise for the os.c file, which gets build dynamically.
 
-for f in dbfunctions.h dbstuff.h exim.h functions.h globals.h local_scan.h \
-  macros.h mytypes.h osfunctions.h store.h structs.h lookupapi.h \
+for f in blob.h dbfunctions.h dbstuff.h exim.h functions.h globals.h \
+  hash.h local_scan.h \
+  macros.h mytypes.h osfunctions.h store.h structs.h lookupapi.h sha_ver.h \
   \
   acl.c buildconfig.c base64.c child.c crypt16.c daemon.c dbfn.c debug.c deliver.c \
   directory.c dns.c drtables.c dummies.c enq.c exim.c exim_dbmbuild.c \
   exim_dbutil.c exim_lock.c expand.c filter.c filtertest.c globals.c \
-  header.c host.c ip.c log.c lss.c match.c moan.c parse.c perl.c queue.c \
+  hash.c header.c host.c ip.c log.c lss.c match.c moan.c parse.c perl.c queue.c \
   rda.c readconf.c receive.c retry.c rewrite.c rfc2047.c route.c search.c \
-  setenv.c \
+  setenv.c environment.c \
   sieve.c smtp_in.c smtp_out.c spool_in.c spool_out.c std-crypto.c store.c \
   string.c tls.c tlscert-gnu.c tlscert-openssl.c tls-gnu.c tls-openssl.c \
   tod.c transport.c tree.c verify.c version.c dkim.c dkim.h dmarc.c dmarc.h \
@@ -116,12 +119,6 @@ do
   ln -s ../src/$f $f
 done
 
-# WITH_OLD_DEMIME
-for f in  demime.c demime.h
-do
-  ln -s ../src/$f $f
-done
-
 # EXPERIMENTAL_*
 for f in  bmi_spam.c bmi_spam.h dcc.c dcc.h dane.c dane-gnu.c dane-openssl.c \
   danessl.h imap_utf7.c spf.c spf.h srs.c srs.h utf8.c
diff --git a/src/scripts/exim_install b/src/scripts/exim_install
index b9330ae0c..1e8805024 100755
--- a/src/scripts/exim_install
+++ b/src/scripts/exim_install
@@ -217,13 +217,15 @@ while [ $# -gt 0 ]; do
   # The exim binary is handled specially
 
   if [ $name = exim${EXE} ]; then
-    version=exim-`./exim -bV -C /dev/null | \
+    exim="./exim -bV -C /dev/null"
+    version=exim-`$exim 2>/dev/null | \
       awk '/Exim version/ { OFS=""; print $3,"-",substr($4,2,length($4)-1) }'`${EXE}
 
     if [ "${version}" = "exim-${EXE}" ]; then
       echo $com ""
-      echo $com "*** Could not run ./exim to find version number ***"
+      echo $com "*** Could not run $exim to find version number ***"
       echo $com "*** Exim installation ${ver}failed ***"
+      $exim
       exit 1
     fi
 
diff --git a/src/scripts/lookups-Makefile b/src/scripts/lookups-Makefile
index 4e69a9a77..db2d184a7 100755
--- a/src/scripts/lookups-Makefile
+++ b/src/scripts/lookups-Makefile
@@ -177,6 +177,11 @@ fi
 
 OBJ="${OBJ} spf.o"
 
+if want_experimental LMDB
+then
+  OBJ="${OBJ} lmdb.o"
+fi
+
 echo "MODS = $MODS"
 echo "OBJ = $OBJ"
 
diff --git a/src/scripts/reversion b/src/scripts/reversion
index c4618868e..9707b9c1c 100755
--- a/src/scripts/reversion
+++ b/src/scripts/reversion
@@ -1,4 +1,9 @@
 #!/bin/sh
+# Copyright (c) The Exim Maintainers 2016
+
+set -e
+LC_ALL=C
+export LC_ALL
 
 # Update Exim's version header file.
 
@@ -37,8 +42,13 @@ then
 	# Modify the output of git describe into separate parts for
 	# the name "exim" and the release and variant versions.
 	# Put a dot in the version number and remove a spurious g.
-	set $(git describe --dirty=-XX --match 'exim-4*' |
-		sed 's|-| |;s|_|.|;s|[-_]| _|;s|-g|-|')
+	if [ "$2" ]
+	then
+	    description=$(git describe "$2")
+	else
+	    description=$(git describe --dirty=-XX --match 'exim-4*')
+	fi
+	set $(echo "$description" | sed 's|-| |;s|_|.|;s|[-_]| _|;s|-g|-|')
 	# Only update if we need to
 	if [ "$2 $3" != "$EXIM_RELEASE_VERSION $EXIM_VARIANT_VERSION" ]
 	then
diff --git a/src/scripts/source_checks b/src/scripts/source_checks
index eac4b8d1b..918a6f8eb 100644
--- a/src/scripts/source_checks
+++ b/src/scripts/source_checks
@@ -19,6 +19,7 @@ done <<-END
 	globals.c	header_names
 	globals.c	log_options
 	expand.c	item_table
+	std-crypto.c	dh_constants
 	transport.c	optionlist_transports
 	route.c		optionlist_routers
 	transports/appendfile.c	appendfile_transport_options
@@ -27,6 +28,8 @@ done <<-END
 	transports/pipe.c	pipe_transport_options
 	transports/smtp.c	smtp_transport_options
 	expand.c	var_table
+	acl.c		conditions
+	acl.c		controls_list
 END
 
 # Tables with just string items
@@ -45,6 +48,5 @@ done <<-END
 	expand.c	op_table_main
 	expand.c	cond_table
 	acl.c		verbs
-	acl.c		conditions
 END
 
diff --git a/src/src/EDITME b/src/src/EDITME
index 30a296e89..69293467e 100644
--- a/src/src/EDITME
+++ b/src/src/EDITME
@@ -392,13 +392,6 @@ EXIM_MONITOR=eximon.bin
 
 # WITH_CONTENT_SCAN=yes
 
-# If you want to use the deprecated "demime" condition in the DATA ACL,
-# uncomment the line below. Doing so will also explicitly turn on the
-# WITH_CONTENT_SCAN option. If possible, use the MIME ACL instead of
-# the "demime" condition.
-
-# WITH_OLD_DEMIME=yes
-
 #------------------------------------------------------------------------------
 # If you're using ClamAV and are backporting fixes to an old version, instead
 # of staying current (which is the more usual approach) then you may need to
@@ -472,6 +465,12 @@ EXIM_MONITOR=eximon.bin
 # CFLAGS  += -I/usr/local/include
 # LDFLAGS += -lsrs_alt
 
+# Uncomment the following line to add DMARC checking capability, implemented
+# using libopendmarc libraries.  You must have SPF support enabled also.
+# EXPERIMENTAL_DMARC=yes
+# CFLAGS += -I/usr/local/include
+# LDFLAGS += -lopendmarc
+
 # Uncomment the following lines to add Brightmail AntiSpam support. You need
 # to have the Brightmail client SDK installed. Please check the experimental
 # documentation for implementation details. You need to edit the CFLAGS and
@@ -481,19 +480,24 @@ EXIM_MONITOR=eximon.bin
 # CFLAGS  += -I/opt/brightmail/bsdk-6.0/include
 # LDFLAGS += -lxml2_single -lbmiclient_single -L/opt/brightmail/bsdk-6.0/lib
 
-# Uncomment the following line to add DMARC checking capability, implemented
-# using libopendmarc libraries.
-# EXPERIMENTAL_DMARC=yes
-# CFLAGS += -I/usr/local/include
-# LDFLAGS += -lopendmarc
-
 # Uncomment the following line to add DANE support
 # Note: Enabling this unconditionally overrides DISABLE_DNSSEC
+# Note: DANE is only supported when using OpenSSL
 # EXPERIMENTAL_DANE=yes
 
 # Uncomment the following to include extra information in fail DSN message (bounces)
 # EXPERIMENTAL_DSN_INFO=yes
 
+# Uncomment the following to add LMDB lookup support
+# You need to have LMDB installed on your system (https://github.com/LMDB/lmdb)
+# Depending on where it is installed you may have to edit the CFLAGS and LDFLAGS lines.
+# EXPERIMENTAL_LMDB=yes
+# CFLAGS += -I/usr/local/include
+# LDFLAGS += -llmdb
+
+# Uncomment the following line to add queuefile transport support
+# EXPERIMENTAL_QUEUEFILE=yes
+
 ###############################################################################
 #                 THESE ARE THINGS YOU MIGHT WANT TO SPECIFY                  #
 ###############################################################################
@@ -742,6 +746,10 @@ HEADERS_CHARSET="ISO-8859-1"
 # USE_GNUTLS_PC=gnutls
 # TLS_LIBS=-lgnutls -ltasn1 -lgcrypt
 
+# If using GnuTLS older than 2.10 and using pkg-config then note that Exim's
+# build process will require libgcrypt-config to exist in your $PATH.  A
+# version that old is likely to become unsupported by Exim in 2017.
+
 # The security fix we provide with the gnutls_allow_auto_pkcs11 option
 # (4.82 PP/09) introduces a compatibility regression.  The symbol is
 # not available if GnuTLS is build without p11-kit (--without-p11-kit
@@ -1121,9 +1129,11 @@ SYSTEM_ALIASES_FILE=/etc/aliases
 # files, and thus be influenced by the value of TMPDIR. For this reason, when
 # Exim starts, it checks the environment for TMPDIR, and if it finds it is set,
 # it replaces the value with what is defined here. Commenting this setting
-# suppresses the check altogether.
+# suppresses the check altogether. Older installations call this macro
+# just TMPDIR, but this has side effects at build time. At runtime
+# TMPDIR is checked as before.
 
-TMPDIR="/tmp"
+EXIM_TMPDIR="/tmp"
 
 
 #------------------------------------------------------------------------------
diff --git a/src/src/acl.c b/src/src/acl.c
index 684b93bbb..1ac2bee23 100644
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Code for handling Access Control Lists (ACLs) */
@@ -46,7 +46,7 @@ static int msgcond[] = {
   };
 
 /* ACL condition and modifier codes - keep in step with the table that
-follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
+follows.
 down. */
 
 enum { ACLC_ACL,
@@ -65,9 +65,6 @@ enum { ACLC_ACL,
        ACLC_DECODE,
 #endif
        ACLC_DELAY,
-#ifdef WITH_OLD_DEMIME
-       ACLC_DEMIME,
-#endif
 #ifndef DISABLE_DKIM
        ACLC_DKIM_SIGNER,
        ACLC_DKIM_STATUS,
@@ -91,6 +88,7 @@ enum { ACLC_ACL,
 #ifdef WITH_CONTENT_SCAN
        ACLC_MIME_REGEX,
 #endif
+       ACLC_QUEUE,
        ACLC_RATELIMIT,
        ACLC_RECIPIENTS,
 #ifdef WITH_CONTENT_SCAN
@@ -111,79 +109,251 @@ enum { ACLC_ACL,
        ACLC_VERIFY };
 
 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
-"message", "log_message", "log_reject_target", "logwrite", and "set" are
+"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
 modifiers that look like conditions but always return TRUE. They are used for
 their side effects. */
 
-static uschar *conditions[] = {
-  US"acl",
-  US"add_header",
-  US"authenticated",
+typedef struct condition_def {
+  uschar	*name;
+
+/* Flag to indicate the condition/modifier has a string expansion done
+at the outer level. In the other cases, expansion already occurs in the
+checking functions. */
+  BOOL		expand_at_top:1;
+
+  BOOL		is_modifier:1;
+
+/* Bit map vector of which conditions and modifiers are not allowed at certain
+times. For each condition and modifier, there's a bitmap of dis-allowed times.
+For some, it is easier to specify the negation of a small number of allowed
+times. */
+  unsigned	forbids;
+
+} condition_def;
+
+static condition_def conditions[] = {
+  { US"acl",		FALSE, FALSE,	0 },
+
+  { US"add_header",	TRUE, TRUE,
+    (unsigned int)
+    ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
+      (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
+#ifndef DISABLE_PRDR
+      (1<<ACL_WHERE_PRDR)|
+#endif
+      (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
+      (1<<ACL_WHERE_DKIM)|
+      (1<<ACL_WHERE_NOTSMTP_START)),
+  },
+
+  { US"authenticated",	FALSE, FALSE,
+    (1<<ACL_WHERE_NOTSMTP)|
+      (1<<ACL_WHERE_NOTSMTP_START)|
+      (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
+  },
 #ifdef EXPERIMENTAL_BRIGHTMAIL
-  US"bmi_optin",
+  { US"bmi_optin",	TRUE, TRUE,
+    (1<<ACL_WHERE_AUTH)|
+      (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
+      (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
+# ifndef DISABLE_PRDR
+      (1<<ACL_WHERE_PRDR)|
+# endif
+      (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
+      (1<<ACL_WHERE_MAILAUTH)|
+      (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
+      (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
+      (1<<ACL_WHERE_NOTSMTP_START),
+  },
 #endif
-  US"condition",
-  US"continue",
-  US"control",
+  { US"condition",	TRUE, FALSE,	0 },
+  { US"continue",	TRUE, TRUE,	0 },
+
+  /* Certain types of control are always allowed, so we let it through
+  always and check in the control processing itself. */
+  { US"control",	TRUE, TRUE,	0 },
+
 #ifdef EXPERIMENTAL_DCC
-  US"dcc",
+  { US"dcc",		TRUE, FALSE,
+    (unsigned int)
+    ~((1<<ACL_WHERE_DATA)|
+# ifndef DISABLE_PRDR
+      (1<<ACL_WHERE_PRDR)|
+# endif
+      (1<<ACL_WHERE_NOTSMTP)),
+  },
 #endif
 #ifdef WITH_CONTENT_SCAN
-  US"decode",
-#endif
-  US"delay",
-#ifdef WITH_OLD_DEMIME
-  US"demime",
+  { US"decode",		TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_MIME) },
+
 #endif
+  { US"delay",		TRUE, TRUE, (1<<ACL_WHERE_NOTQUIT) },
 #ifndef DISABLE_DKIM
-  US"dkim_signers",
-  US"dkim_status",
+  { US"dkim_signers",	TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DKIM) },
+  { US"dkim_status",	TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DKIM) },
 #endif
 #ifdef EXPERIMENTAL_DMARC
-  US"dmarc_status",
+  { US"dmarc_status",	TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DATA) },
+#endif
+
+  /* Explicit key lookups can be made in non-smtp ACLs so pass
+  always and check in the verify processing itself. */
+  { US"dnslists",	TRUE, FALSE,	0 },
+
+  { US"domains",	FALSE, FALSE,
+    (unsigned int)
+    ~((1<<ACL_WHERE_RCPT)
+      |(1<<ACL_WHERE_VRFY)
+#ifndef DISABLE_PRDR
+      |(1<<ACL_WHERE_PRDR)
 #endif
-  US"dnslists",
-  US"domains",
-  US"encrypted",
-  US"endpass",
-  US"hosts",
-  US"local_parts",
-  US"log_message",
-  US"log_reject_target",
-  US"logwrite",
+      ),
+  },
+  { US"encrypted",	FALSE, FALSE,
+    (1<<ACL_WHERE_NOTSMTP)|
+      (1<<ACL_WHERE_CONNECT)|
+      (1<<ACL_WHERE_NOTSMTP_START)|
+      (1<<ACL_WHERE_HELO),
+  },
+
+  { US"endpass",	TRUE, TRUE,	0 },
+
+  { US"hosts",		FALSE, FALSE,
+    (1<<ACL_WHERE_NOTSMTP)|
+      (1<<ACL_WHERE_NOTSMTP_START),
+  },
+  { US"local_parts",	FALSE, FALSE,
+    (unsigned int)
+    ~((1<<ACL_WHERE_RCPT)
+      |(1<<ACL_WHERE_VRFY)
+    #ifndef DISABLE_PRDR
+      |(1<<ACL_WHERE_PRDR)
+    #endif
+      ),
+  },
+
+  { US"log_message",	TRUE, TRUE,	0 },
+  { US"log_reject_target", TRUE, TRUE,	0 },
+  { US"logwrite",	TRUE, TRUE,	0 },
+
 #ifdef WITH_CONTENT_SCAN
-  US"malware",
+  { US"malware",	TRUE, FALSE,
+    (unsigned int)
+    ~((1<<ACL_WHERE_DATA)|
+# ifndef DISABLE_PRDR
+      (1<<ACL_WHERE_PRDR)|
+# endif
+      (1<<ACL_WHERE_NOTSMTP)),
+  },
 #endif
-  US"message",
+
+  { US"message",	TRUE, TRUE,	0 },
 #ifdef WITH_CONTENT_SCAN
-  US"mime_regex",
+  { US"mime_regex",	TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_MIME) },
 #endif
-  US"ratelimit",
-  US"recipients",
+
+  { US"queue",		TRUE, TRUE,
+    (1<<ACL_WHERE_NOTSMTP)|
+#ifndef DISABLE_PRDR
+      (1<<ACL_WHERE_PRDR)|
+#endif
+      (1<<ACL_WHERE_DATA),
+  },
+
+  { US"ratelimit",	TRUE, FALSE,	0 },
+  { US"recipients",	FALSE, FALSE, (unsigned int) ~(1<<ACL_WHERE_RCPT) },
+
 #ifdef WITH_CONTENT_SCAN
-  US"regex",
+  { US"regex",		TRUE, FALSE,
+    (unsigned int)
+    ~((1<<ACL_WHERE_DATA)|
+# ifndef DISABLE_PRDR
+      (1<<ACL_WHERE_PRDR)|
+# endif
+      (1<<ACL_WHERE_NOTSMTP)|
+      (1<<ACL_WHERE_MIME)),
+  },
+
+#endif
+  { US"remove_header",	TRUE, TRUE,
+    (unsigned int)
+    ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
+      (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
+#ifndef DISABLE_PRDR
+      (1<<ACL_WHERE_PRDR)|
 #endif
-  US"remove_header",
-  US"sender_domains", US"senders", US"set",
+      (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
+      (1<<ACL_WHERE_NOTSMTP_START)),
+  },
+  { US"sender_domains",	FALSE, FALSE,
+    (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
+      (1<<ACL_WHERE_HELO)|
+      (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
+      (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
+      (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
+  },
+  { US"senders",	FALSE, FALSE,
+    (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
+      (1<<ACL_WHERE_HELO)|
+      (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
+      (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
+      (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
+  },
+
+  { US"set",		TRUE, TRUE,	0 },
+
 #ifdef WITH_CONTENT_SCAN
-  US"spam",
+  { US"spam",		TRUE, FALSE,
+    (unsigned int)
+    ~((1<<ACL_WHERE_DATA)|
+# ifndef DISABLE_PRDR
+      (1<<ACL_WHERE_PRDR)|
+# endif
+      (1<<ACL_WHERE_NOTSMTP)),
+  },
 #endif
 #ifdef EXPERIMENTAL_SPF
-  US"spf",
-  US"spf_guess",
+  { US"spf",		TRUE, FALSE,
+    (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
+      (1<<ACL_WHERE_HELO)|
+      (1<<ACL_WHERE_MAILAUTH)|
+      (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
+      (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
+      (1<<ACL_WHERE_NOTSMTP)|
+      (1<<ACL_WHERE_NOTSMTP_START),
+  },
+  { US"spf_guess",	TRUE, FALSE,
+    (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
+      (1<<ACL_WHERE_HELO)|
+      (1<<ACL_WHERE_MAILAUTH)|
+      (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
+      (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
+      (1<<ACL_WHERE_NOTSMTP)|
+      (1<<ACL_WHERE_NOTSMTP_START),
+  },
 #endif
-  US"udpsend",
-  US"verify" };
+  { US"udpsend",	TRUE, TRUE,	0 },
 
+  /* Certain types of verify are always allowed, so we let it through
+  always and check in the verify function itself */
+  { US"verify",		TRUE, FALSE,
+    0
+  },
+};
 
-/* Return values from decode_control(); keep in step with the table of names
-that follows! */
+
+
+/* Return values from decode_control(); used as index so keep in step
+with the controls_list table that follows! */
 
 enum {
   CONTROL_AUTH_UNADVERTISED,
 #ifdef EXPERIMENTAL_BRIGHTMAIL
   CONTROL_BMI_RUN,
 #endif
+  CONTROL_CASEFUL_LOCAL_PART,
+  CONTROL_CASELOWER_LOCAL_PART,
+  CONTROL_CUTTHROUGH_DELIVERY,
   CONTROL_DEBUG,
 #ifndef DISABLE_DKIM
   CONTROL_DKIM_VERIFY,
@@ -193,571 +363,155 @@ enum {
   CONTROL_DMARC_FORENSIC,
 #endif
   CONTROL_DSCP,
-  CONTROL_ERROR,
-  CONTROL_CASEFUL_LOCAL_PART,
-  CONTROL_CASELOWER_LOCAL_PART,
-  CONTROL_CUTTHROUGH_DELIVERY,
   CONTROL_ENFORCE_SYNC,
-  CONTROL_NO_ENFORCE_SYNC,
+  CONTROL_ERROR,		/* pseudo-value for decode errors */
+  CONTROL_FAKEDEFER,
+  CONTROL_FAKEREJECT,
   CONTROL_FREEZE,
-  CONTROL_QUEUE_ONLY,
-  CONTROL_SUBMISSION,
-  CONTROL_SUPPRESS_LOCAL_FIXUPS,
+
+  CONTROL_NO_CALLOUT_FLUSH,
+  CONTROL_NO_DELAY_FLUSH,
+  CONTROL_NO_ENFORCE_SYNC,
 #ifdef WITH_CONTENT_SCAN
   CONTROL_NO_MBOX_UNSPOOL,
-#endif
-  CONTROL_FAKEDEFER,
-  CONTROL_FAKEREJECT,
-#ifdef SUPPORT_I18N
-  CONTROL_UTF8_DOWNCONVERT,
 #endif
   CONTROL_NO_MULTILINE,
   CONTROL_NO_PIPELINING,
-  CONTROL_NO_DELAY_FLUSH,
-  CONTROL_NO_CALLOUT_FLUSH
-};
 
-/* ACL control names; keep in step with the table above! This list is used for
-turning ids into names. The actual list of recognized names is in the variable
-control_def controls_list[] below. The fact that there are two lists is a mess
-and should be tidied up. */
-
-static uschar *controls[] = {
-  US"allow_auth_unadvertised",
-#ifdef EXPERIMENTAL_BRIGHTMAIL
-  US"bmi_run",
-#endif
-  US"debug",
-#ifndef DISABLE_DKIM
-  US"dkim_disable_verify",
-#endif
-#ifdef EXPERIMENTAL_DMARC
-  US"dmarc_disable_verify",
-  US"dmarc_enable_forensic",
-#endif
-  US"dscp",
-  US"error",
-  US"caseful_local_part",
-  US"caselower_local_part",
-  US"cutthrough_delivery",
-  US"enforce_sync",
-  US"no_enforce_sync",
-  US"freeze",
-  US"queue_only",
-  US"submission",
-  US"suppress_local_fixups",
-#ifdef WITH_CONTENT_SCAN
-  US"no_mbox_unspool",
-#endif
-  US"fakedefer",
-  US"fakereject",
+  CONTROL_QUEUE_ONLY,
+  CONTROL_SUBMISSION,
+  CONTROL_SUPPRESS_LOCAL_FIXUPS,
 #ifdef SUPPORT_I18N
-  US"utf8_downconvert",
-#endif
-  US"no_multiline_responses",
-  US"no_pipelining",
-  US"no_delay_flush",
-  US"no_callout_flush"
-};
-
-/* Flags to indicate for which conditions/modifiers a string expansion is done
-at the outer level. In the other cases, expansion already occurs in the
-checking functions. */
-
-static uschar cond_expand_at_top[] = {
-  FALSE,   /* acl */
-  TRUE,    /* add_header */
-  FALSE,   /* authenticated */
-#ifdef EXPERIMENTAL_BRIGHTMAIL
-  TRUE,    /* bmi_optin */
-#endif
-  TRUE,    /* condition */
-  TRUE,    /* continue */
-  TRUE,    /* control */
-#ifdef EXPERIMENTAL_DCC
-  TRUE,    /* dcc */
-#endif
-#ifdef WITH_CONTENT_SCAN
-  TRUE,    /* decode */
-#endif
-  TRUE,    /* delay */
-#ifdef WITH_OLD_DEMIME
-  TRUE,    /* demime */
-#endif
-#ifndef DISABLE_DKIM
-  TRUE,    /* dkim_signers */
-  TRUE,    /* dkim_status */
-#endif
-#ifdef EXPERIMENTAL_DMARC
-  TRUE,    /* dmarc_status */
-#endif
-  TRUE,    /* dnslists */
-  FALSE,   /* domains */
-  FALSE,   /* encrypted */
-  TRUE,    /* endpass */
-  FALSE,   /* hosts */
-  FALSE,   /* local_parts */
-  TRUE,    /* log_message */
-  TRUE,    /* log_reject_target */
-  TRUE,    /* logwrite */
-#ifdef WITH_CONTENT_SCAN
-  TRUE,    /* malware */
-#endif
-  TRUE,    /* message */
-#ifdef WITH_CONTENT_SCAN
-  TRUE,    /* mime_regex */
-#endif
-  TRUE,    /* ratelimit */
-  FALSE,   /* recipients */
-#ifdef WITH_CONTENT_SCAN
-  TRUE,    /* regex */
-#endif
-  TRUE,    /* remove_header */
-  FALSE,   /* sender_domains */
-  FALSE,   /* senders */
-  TRUE,    /* set */
-#ifdef WITH_CONTENT_SCAN
-  TRUE,    /* spam */
-#endif
-#ifdef EXPERIMENTAL_SPF
-  TRUE,    /* spf */
-  TRUE,    /* spf_guess */
-#endif
-  TRUE,    /* udpsend */
-  TRUE     /* verify */
-};
-
-/* Flags to identify the modifiers */
-
-static uschar cond_modifiers[] = {
-  FALSE,   /* acl */
-  TRUE,    /* add_header */
-  FALSE,   /* authenticated */
-#ifdef EXPERIMENTAL_BRIGHTMAIL
-  TRUE,    /* bmi_optin */
-#endif
-  FALSE,   /* condition */
-  TRUE,    /* continue */
-  TRUE,    /* control */
-#ifdef EXPERIMENTAL_DCC
-  FALSE,   /* dcc */
-#endif
-#ifdef WITH_CONTENT_SCAN
-  FALSE,   /* decode */
-#endif
-  TRUE,    /* delay */
-#ifdef WITH_OLD_DEMIME
-  FALSE,   /* demime */
-#endif
-#ifndef DISABLE_DKIM
-  FALSE,   /* dkim_signers */
-  FALSE,   /* dkim_status */
-#endif
-#ifdef EXPERIMENTAL_DMARC
-  FALSE,   /* dmarc_status */
-#endif
-  FALSE,   /* dnslists */
-  FALSE,   /* domains */
-  FALSE,   /* encrypted */
-  TRUE,    /* endpass */
-  FALSE,   /* hosts */
-  FALSE,   /* local_parts */
-  TRUE,    /* log_message */
-  TRUE,    /* log_reject_target */
-  TRUE,    /* logwrite */
-#ifdef WITH_CONTENT_SCAN
-  FALSE,   /* malware */
-#endif
-  TRUE,    /* message */
-#ifdef WITH_CONTENT_SCAN
-  FALSE,   /* mime_regex */
-#endif
-  FALSE,   /* ratelimit */
-  FALSE,   /* recipients */
-#ifdef WITH_CONTENT_SCAN
-  FALSE,   /* regex */
-#endif
-  TRUE,    /* remove_header */
-  FALSE,   /* sender_domains */
-  FALSE,   /* senders */
-  TRUE,    /* set */
-#ifdef WITH_CONTENT_SCAN
-  FALSE,   /* spam */
-#endif
-#ifdef EXPERIMENTAL_SPF
-  FALSE,   /* spf */
-  FALSE,   /* spf_guess */
+  CONTROL_UTF8_DOWNCONVERT,
 #endif
-  TRUE,    /* udpsend */
-  FALSE    /* verify */
 };
 
-/* Bit map vector of which conditions and modifiers are not allowed at certain
-times. For each condition and modifier, there's a bitmap of dis-allowed times.
-For some, it is easier to specify the negation of a small number of allowed
-times. */
 
-static unsigned int cond_forbids[] = {
-  0,                                               /* acl */
-
-  (unsigned int)
-  ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|       /* add_header */
-    (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
-  #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
-  #endif
-    (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
-    (1<<ACL_WHERE_DKIM)|
-    (1<<ACL_WHERE_NOTSMTP_START)),
-
-  (1<<ACL_WHERE_NOTSMTP)|                          /* authenticated */
-    (1<<ACL_WHERE_NOTSMTP_START)|
-    (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
-
-  #ifdef EXPERIMENTAL_BRIGHTMAIL
-  (1<<ACL_WHERE_AUTH)|                             /* bmi_optin */
-    (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
-    (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
-  #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
-  #endif
-    (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
-    (1<<ACL_WHERE_MAILAUTH)|
-    (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
-    (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
-    (1<<ACL_WHERE_NOTSMTP_START),
-  #endif
-
-  0,                                               /* condition */
-
-  0,                                               /* continue */
 
-  /* Certain types of control are always allowed, so we let it through
-  always and check in the control processing itself. */
-
-  0,                                               /* control */
-
-  #ifdef EXPERIMENTAL_DCC
-  (unsigned int)
-  ~((1<<ACL_WHERE_DATA)|                           /* dcc */
-  #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
-  #endif
-    (1<<ACL_WHERE_NOTSMTP)),
-  #endif
-
-  #ifdef WITH_CONTENT_SCAN
-  (unsigned int)
-  ~(1<<ACL_WHERE_MIME),                            /* decode */
-  #endif
-
-  (1<<ACL_WHERE_NOTQUIT),                          /* delay */
-
-  #ifdef WITH_OLD_DEMIME
-  (unsigned int)
-  ~((1<<ACL_WHERE_DATA)|                           /* demime */
-  #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
-  #endif
-    (1<<ACL_WHERE_NOTSMTP)),
-  #endif
-
-  #ifndef DISABLE_DKIM
-  (unsigned int)
-  ~(1<<ACL_WHERE_DKIM),                            /* dkim_signers */
-
-  (unsigned int)
-  ~(1<<ACL_WHERE_DKIM),                            /* dkim_status */
-  #endif
-
-  #ifdef EXPERIMENTAL_DMARC
-  (unsigned int)
-  ~(1<<ACL_WHERE_DATA),                            /* dmarc_status */
-  #endif
-
-  /* Explicit key lookups can be made in non-smtp ACLs so pass
-  always and check in the verify processing itself. */
-
-  0,						   /* dnslists */
-
-  (unsigned int)
-  ~((1<<ACL_WHERE_RCPT)                            /* domains */
-    |(1<<ACL_WHERE_VRFY)
-  #ifndef DISABLE_PRDR
-    |(1<<ACL_WHERE_PRDR)
-  #endif
-    ),
-
-  (1<<ACL_WHERE_NOTSMTP)|                          /* encrypted */
-    (1<<ACL_WHERE_CONNECT)|
-    (1<<ACL_WHERE_NOTSMTP_START)|
-    (1<<ACL_WHERE_HELO),
-
-  0,                                               /* endpass */
-
-  (1<<ACL_WHERE_NOTSMTP)|                          /* hosts */
-    (1<<ACL_WHERE_NOTSMTP_START),
+/* Structure listing various control arguments, with their characteristics.
+For each control, there's a bitmap of dis-allowed times. For some, it is easier
+to specify the negation of a small number of allowed times. */
 
-  (unsigned int)
-  ~((1<<ACL_WHERE_RCPT)                             /* local_parts */
-    |(1<<ACL_WHERE_VRFY)
-  #ifndef DISABLE_PRDR
-    |(1<<ACL_WHERE_PRDR)
-  #endif
-    ),
-
-  0,                                               /* log_message */
-
-  0,                                               /* log_reject_target */
-
-  0,                                               /* logwrite */
-
-  #ifdef WITH_CONTENT_SCAN
-  (unsigned int)
-  ~((1<<ACL_WHERE_DATA)|                           /* malware */
-  #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
-  #endif
-    (1<<ACL_WHERE_NOTSMTP)),
-  #endif
-
-  0,                                               /* message */
-
-  #ifdef WITH_CONTENT_SCAN
-  (unsigned int)
-  ~(1<<ACL_WHERE_MIME),                            /* mime_regex */
-  #endif
-
-  0,                                               /* ratelimit */
-
-  (unsigned int)
-  ~(1<<ACL_WHERE_RCPT),                            /* recipients */
-
-  #ifdef WITH_CONTENT_SCAN
-  (unsigned int)
-  ~((1<<ACL_WHERE_DATA)|                           /* regex */
-  #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
-  #endif
-    (1<<ACL_WHERE_NOTSMTP)|
-    (1<<ACL_WHERE_MIME)),
-  #endif
-
-  (unsigned int)
-  ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|       /* remove_header */
-    (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
-  #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
-  #endif
-    (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
-    (1<<ACL_WHERE_NOTSMTP_START)),
-
-  (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|      /* sender_domains */
-    (1<<ACL_WHERE_HELO)|
-    (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
-    (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
-    (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
-
-  (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|      /* senders */
-    (1<<ACL_WHERE_HELO)|
-    (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
-    (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
-    (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
-
-  0,                                               /* set */
-
-  #ifdef WITH_CONTENT_SCAN
-  (unsigned int)
-  ~((1<<ACL_WHERE_DATA)|                           /* spam */
-  #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
-  #endif
-    (1<<ACL_WHERE_NOTSMTP)),
-  #endif
-
-  #ifdef EXPERIMENTAL_SPF
-  (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|      /* spf */
-    (1<<ACL_WHERE_HELO)|
-    (1<<ACL_WHERE_MAILAUTH)|
-    (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
-    (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
-    (1<<ACL_WHERE_NOTSMTP)|
-    (1<<ACL_WHERE_NOTSMTP_START),
-
-  (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|      /* spf_guess */
-    (1<<ACL_WHERE_HELO)|
-    (1<<ACL_WHERE_MAILAUTH)|
-    (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
-    (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
-    (1<<ACL_WHERE_NOTSMTP)|
-    (1<<ACL_WHERE_NOTSMTP_START),
-  #endif
-
-  0,                                               /* udpsend */
-
-  /* Certain types of verify are always allowed, so we let it through
-  always and check in the verify function itself */
-
-  0                                                /* verify */
-};
-
-
-/* Bit map vector of which controls are not allowed at certain times. For
-each control, there's a bitmap of dis-allowed times. For some, it is easier to
-specify the negation of a small number of allowed times. */
-
-static unsigned int control_forbids[] = {
-  (unsigned int)
-  ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)),   /* allow_auth_unadvertised */
+typedef struct control_def {
+  uschar	*name;
+  BOOL		has_option;     /* Has /option(s) following */
+  unsigned	forbids;	/* bitmap of dis-allowed times */
+} control_def;
 
+static control_def controls_list[] = {
+  { US"allow_auth_unadvertised", FALSE,
+    (unsigned)
+    ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO))
+  },
 #ifdef EXPERIMENTAL_BRIGHTMAIL
-  0,                                               /* bmi_run */
+  { US"bmi_run",                 FALSE, 0 },
 #endif
-
-  0,                                               /* debug */
+  { US"caseful_local_part",      FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
+  { US"caselower_local_part",    FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
+  { US"cutthrough_delivery",     TRUE, 0 },
+  { US"debug",                   TRUE, 0 },
 
 #ifndef DISABLE_DKIM
-  (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|      /* dkim_disable_verify */
+  { US"dkim_disable_verify",     FALSE,
+    (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|
 # ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
+      (1<<ACL_WHERE_PRDR)|
 # endif
-    (1<<ACL_WHERE_NOTSMTP_START),
+      (1<<ACL_WHERE_NOTSMTP_START)
+  },
 #endif
 
 #ifdef EXPERIMENTAL_DMARC
-  (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|      /* dmarc_disable_verify */
-    (1<<ACL_WHERE_NOTSMTP_START),
-  (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|      /* dmarc_enable_forensic */
-    (1<<ACL_WHERE_NOTSMTP_START),
+  { US"dmarc_disable_verify",    FALSE,
+    (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
+  },
+  { US"dmarc_enable_forensic",   FALSE,
+    (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
+  },
 #endif
 
-  (1<<ACL_WHERE_NOTSMTP)|
-    (1<<ACL_WHERE_NOTSMTP_START)|
-    (1<<ACL_WHERE_NOTQUIT),                        /* dscp */
-
-  0,                                               /* error */
-
-  (unsigned int)
-  ~(1<<ACL_WHERE_RCPT),                            /* caseful_local_part */
-
-  (unsigned int)
-  ~(1<<ACL_WHERE_RCPT),                            /* caselower_local_part */
-
-  (unsigned int)
-  0,						   /* cutthrough_delivery */
-
-  (1<<ACL_WHERE_NOTSMTP)|                          /* enforce_sync */
-    (1<<ACL_WHERE_NOTSMTP_START),
-
-  (1<<ACL_WHERE_NOTSMTP)|                          /* no_enforce_sync */
-    (1<<ACL_WHERE_NOTSMTP_START),
+  { US"dscp",                    TRUE,
+    (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)|(1<<ACL_WHERE_NOTQUIT)
+  },
+  { US"enforce_sync",            FALSE,
+    (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
+  },
 
-  (unsigned int)
-  ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|       /* freeze */
-    (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
-    // (1<<ACL_WHERE_PRDR)|    /* Not allow one user to freeze for all */
-    (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
+  /* Pseudo-value for decode errors */
+  { US"error",                   FALSE, 0 },
 
-  (unsigned int)
-  ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|       /* queue_only */
-    (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
-    // (1<<ACL_WHERE_PRDR)|    /* Not allow one user to freeze for all */
-    (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
-
-  (unsigned int)
-  ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|       /* submission */
-    (1<<ACL_WHERE_PREDATA)),
-
-  (unsigned int)
-  ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|       /* suppress_local_fixups */
-    (1<<ACL_WHERE_PREDATA)|
-    (1<<ACL_WHERE_NOTSMTP_START)),
-
-#ifdef WITH_CONTENT_SCAN
-  (unsigned int)
-  ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|       /* no_mbox_unspool */
-    (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
-    // (1<<ACL_WHERE_PRDR)|    /* Not allow one user to freeze for all */
-    (1<<ACL_WHERE_MIME)),
-#endif
-
-  (unsigned int)
-  ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|       /* fakedefer */
-    (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
+  { US"fakedefer",               TRUE,
+    (unsigned)
+    ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
+      (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
 #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
+      (1<<ACL_WHERE_PRDR)|
 #endif
-    (1<<ACL_WHERE_MIME)),
-
-  (unsigned int)
-  ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|       /* fakereject */
-    (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
+      (1<<ACL_WHERE_MIME))
+  },
+  { US"fakereject",              TRUE,
+    (unsigned)
+    ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
+      (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
 #ifndef DISABLE_PRDR
-    (1<<ACL_WHERE_PRDR)|
-#endif
-    (1<<ACL_WHERE_MIME)),
-
-#ifdef SUPPORT_I18N
-  0,                                               /* utf8_downconvert */
-#endif
-
-  (1<<ACL_WHERE_NOTSMTP)|                          /* no_multiline */
-    (1<<ACL_WHERE_NOTSMTP_START),
-
-  (1<<ACL_WHERE_NOTSMTP)|                          /* no_pipelining */
-    (1<<ACL_WHERE_NOTSMTP_START),
-
-  (1<<ACL_WHERE_NOTSMTP)|                          /* no_delay_flush */
-    (1<<ACL_WHERE_NOTSMTP_START),
-
-  (1<<ACL_WHERE_NOTSMTP)|                          /* no_callout_flush */
-    (1<<ACL_WHERE_NOTSMTP_START)
-};
-
-/* Structure listing various control arguments, with their characteristics. */
-
-typedef struct control_def {
-  uschar *name;
-  int    value;                  /* CONTROL_xxx value */
-  BOOL   has_option;             /* Has /option(s) following */
-} control_def;
-
-static control_def controls_list[] = {
-  { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED,     FALSE },
-#ifdef EXPERIMENTAL_BRIGHTMAIL
-  { US"bmi_run",                 CONTROL_BMI_RUN,               FALSE },
-#endif
-  { US"debug",                   CONTROL_DEBUG,                 TRUE },
-#ifndef DISABLE_DKIM
-  { US"dkim_disable_verify",     CONTROL_DKIM_VERIFY,           FALSE },
-#endif
-#ifdef EXPERIMENTAL_DMARC
-  { US"dmarc_disable_verify",    CONTROL_DMARC_VERIFY,          FALSE },
-  { US"dmarc_enable_forensic",   CONTROL_DMARC_FORENSIC,        FALSE },
+      (1<<ACL_WHERE_PRDR)|
 #endif
-  { US"dscp",                    CONTROL_DSCP,                  TRUE },
-  { US"caseful_local_part",      CONTROL_CASEFUL_LOCAL_PART,    FALSE },
-  { US"caselower_local_part",    CONTROL_CASELOWER_LOCAL_PART,  FALSE },
-  { US"enforce_sync",            CONTROL_ENFORCE_SYNC,          FALSE },
-  { US"freeze",                  CONTROL_FREEZE,                TRUE },
-  { US"no_callout_flush",        CONTROL_NO_CALLOUT_FLUSH,      FALSE },
-  { US"no_delay_flush",          CONTROL_NO_DELAY_FLUSH,        FALSE },
-  { US"no_enforce_sync",         CONTROL_NO_ENFORCE_SYNC,       FALSE },
-  { US"no_multiline_responses",  CONTROL_NO_MULTILINE,          FALSE },
-  { US"no_pipelining",           CONTROL_NO_PIPELINING,         FALSE },
-  { US"queue_only",              CONTROL_QUEUE_ONLY,            FALSE },
+      (1<<ACL_WHERE_MIME))
+  },
+  { US"freeze",                  TRUE,
+    (unsigned)
+    ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
+      (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
+      // (1<<ACL_WHERE_PRDR)|    /* Not allow one user to freeze for all */
+      (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
+  },
+
+  { US"no_callout_flush",        FALSE,
+    (1<<ACL_WHERE_NOTSMTP)| (1<<ACL_WHERE_NOTSMTP_START)
+  },
+  { US"no_delay_flush",          FALSE,
+    (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
+  },
+  
+  { US"no_enforce_sync",         FALSE,
+    (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
+  },
 #ifdef WITH_CONTENT_SCAN
-  { US"no_mbox_unspool",         CONTROL_NO_MBOX_UNSPOOL,       FALSE },
+  { US"no_mbox_unspool",         FALSE,
+    (unsigned)
+    ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
+      (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
+      // (1<<ACL_WHERE_PRDR)|    /* Not allow one user to freeze for all */
+      (1<<ACL_WHERE_MIME))
+  },
 #endif
-  { US"fakedefer",               CONTROL_FAKEDEFER,             TRUE },
-  { US"fakereject",              CONTROL_FAKEREJECT,            TRUE },
-  { US"submission",              CONTROL_SUBMISSION,            TRUE },
-  { US"suppress_local_fixups",   CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
-  { US"cutthrough_delivery",     CONTROL_CUTTHROUGH_DELIVERY,   FALSE },
+  { US"no_multiline_responses",  FALSE,
+    (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
+  },
+  { US"no_pipelining",           FALSE,
+    (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
+  },
+
+  { US"queue_only",              FALSE,
+    (unsigned)
+    ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
+      (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
+      // (1<<ACL_WHERE_PRDR)|    /* Not allow one user to freeze for all */
+      (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
+  },
+  { US"submission",              TRUE,
+    (unsigned)
+    ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA))
+  },
+  { US"suppress_local_fixups",   FALSE,
+    (unsigned)
+    ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
+      (1<<ACL_WHERE_NOTSMTP_START))
+  },
 #ifdef SUPPORT_I18N
-  { US"utf8_downconvert",        CONTROL_UTF8_DOWNCONVERT,      TRUE }
+  { US"utf8_downconvert",        TRUE, 0 }
 #endif
-  };
+};
 
 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
 caches its result in a tree to avoid repeated DNS queries. The result is an
@@ -823,6 +577,68 @@ static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
     uschar **);
 
 
+/*************************************************
+*            Find control in list                *
+*************************************************/
+
+/* The lists are always in order, so binary chop can be used.
+
+Arguments:
+  name      the control name to search for
+  ol        the first entry in the control list
+  last      one more than the offset of the last entry in the control list
+
+Returns:    index of a control entry, or -1 if not found
+*/
+
+static int
+find_control(const uschar * name, control_def * ol, int last)
+{
+int first = 0;
+while (last > first)
+  {
+  int middle = (first + last)/2;
+  uschar * s =  ol[middle].name;
+  int c = Ustrncmp(name, s, Ustrlen(s));
+  if (c == 0) return middle;
+  else if (c > 0) first = middle + 1;
+  else last = middle;
+  }
+return -1;
+}
+
+
+
+/*************************************************
+*         Pick out condition from list           *
+*************************************************/
+
+/* Use a binary chop method
+
+Arguments:
+  name        name to find
+  list        list of conditions
+  end         size of list
+
+Returns:      offset in list, or -1 if not found
+*/
+
+static int
+acl_checkcondition(uschar * name, condition_def * list, int end)
+{
+int start = 0;
+while (start < end)
+  {
+  int mid = (start + end)/2;
+  int c = Ustrcmp(name, list[mid].name);
+  if (c == 0) return mid;
+  if (c < 0) end = mid;
+  else start = mid + 1;
+  }
+return -1;
+}
+
+
 /*************************************************
 *         Pick out name from list                *
 *************************************************/
@@ -910,8 +726,7 @@ while ((s = (*func)()) != NULL)
   /* If a verb is unrecognized, it may be another condition or modifier that
   continues the previous verb. */
 
-  v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
-  if (v < 0)
+  if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
     {
     if (this == NULL)
       {
@@ -948,8 +763,7 @@ while ((s = (*func)()) != NULL)
 
   /* Handle a condition or modifier. */
 
-  c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
-  if (c < 0)
+  if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
     {
     *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
       saveline);
@@ -958,10 +772,10 @@ while ((s = (*func)()) != NULL)
 
   /* The modifiers may not be negated */
 
-  if (negated && cond_modifiers[c])
+  if (negated && conditions[c].is_modifier)
     {
     *error = string_sprintf("ACL error: negation is not allowed with "
-      "\"%s\"", conditions[c]);
+      "\"%s\"", conditions[c].name);
     return NULL;
     }
 
@@ -972,7 +786,7 @@ while ((s = (*func)()) != NULL)
       this->verb != ACL_DISCARD)
     {
     *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
-      conditions[c], verbs[this->verb]);
+      conditions[c].name, verbs[this->verb]);
     return NULL;
     }
 
@@ -1039,7 +853,7 @@ while ((s = (*func)()) != NULL)
     if (*s++ != '=')
       {
       *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
-        cond_modifiers[c]? US"modifier" : US"condition");
+        conditions[c].is_modifier ? US"modifier" : US"condition");
       return NULL;
       }
     while (isspace(*s)) s++;
@@ -1076,9 +890,9 @@ while (*hstring == '\n') hstring++, hlen--;
 
 /* An empty string does nothing; ensure exactly one final newline. */
 if (hlen <= 0) return;
-if (hstring[--hlen] != '\n')
+if (hstring[--hlen] != '\n')		/* no newline */
   q = string_sprintf("%s\n", hstring);
-else if (hstring[hlen-1] == '\n')
+else if (hstring[hlen-1] == '\n')	/* double newline */
   {
   uschar * s = string_copy(hstring);
   while(s[--hlen] == '\n')
@@ -1101,7 +915,7 @@ for (p = q; *p != 0; )
 
   for (;;)
     {
-    q = Ustrchr(q, '\n');
+    q = Ustrchr(q, '\n');		/* we know there was a newline */
     if (*(++q) != ' ' && *q != '\t') break;
     }
 
@@ -1180,11 +994,11 @@ uschar *
 fn_hdrs_added(void)
 {
 uschar * ret = NULL;
+int size = 0;
+int ptr = 0;
 header_line * h = acl_added_headers;
 uschar * s;
 uschar * cp;
-int size = 0;
-int ptr = 0;
 
 if (!h) return NULL;
 
@@ -1196,13 +1010,13 @@ do
     if (cp[1] == '\0') break;
 
     /* contains embedded newline; needs doubling */
-    ret = string_cat(ret, &size, &ptr, s, cp-s+1);
-    ret = string_cat(ret, &size, &ptr, US"\n", 1);
+    ret = string_catn(ret, &size, &ptr, s, cp-s+1);
+    ret = string_catn(ret, &size, &ptr, US"\n", 1);
     s = cp+1;
     }
   /* last bit of header */
 
-  ret = string_cat(ret, &size, &ptr, s, cp-s+1);	/* newline-sep list */
+  ret = string_catn(ret, &size, &ptr, s, cp-s+1);	/* newline-sep list */
   }
 while((h = h->next));
 
@@ -1469,7 +1283,6 @@ acl_verify_csa(const uschar *domain)
 {
 tree_node *t;
 const uschar *found;
-uschar *p;
 int priority, weight, port;
 dns_answer dnsa;
 dns_scan dnss;
@@ -1547,14 +1360,13 @@ switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
 /* Scan the reply for well-formed CSA SRV records. */
 
 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
-     rr != NULL;
-     rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
+     rr;
+     rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
   {
-  if (rr->type != T_SRV) continue;
+  const uschar * p = rr->data;
 
   /* Extract the numerical SRV fields (p is incremented) */
 
-  p = rr->data;
   GETSHORT(priority, p);
   GETSHORT(weight, p);
   GETSHORT(port, p);
@@ -1573,12 +1385,7 @@ for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
   SRV records of their own. */
 
   if (Ustrcmp(found, domain) != 0)
-    {
-    if (port & 1)
-      return t->data.val = CSA_FAIL_EXPLICIT;
-    else
-      return t->data.val = CSA_UNKNOWN;
-    }
+    return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
 
   /* This CSA SRV record refers directly to our domain, so we check the value
   in the weight field to work out the domain's authorization. 0 and 1 are
@@ -2026,15 +1833,15 @@ message if giving out verification details. */
 if (verify_header_sender)
   {
   int verrno;
-  rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
+
+  if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
     callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
-    &verrno);
-  if (rc != OK)
+    &verrno)) != OK)
     {
     *basic_errno = verrno;
     if (smtp_return_error_details)
       {
-      if (*user_msgptr == NULL && *log_msgptr != NULL)
+      if (!*user_msgptr && *log_msgptr)
         *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
       if (rc == DEFER) acl_temp_details = TRUE;
       }
@@ -2056,10 +1863,9 @@ Therefore, we always do a full sender verify when any kind of callout is
 specified. Caching elsewhere, for instance in the DNS resolver and in the
 callout handling, should ensure that this is not terribly inefficient. */
 
-else if (verify_sender_address != NULL)
+else if (verify_sender_address)
   {
-  if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
-       != 0)
+  if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
     {
     *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
       "sender verify callout";
@@ -2075,7 +1881,9 @@ else if (verify_sender_address != NULL)
     callout that was done previously). If the "routed" flag is not set, routing
     must have failed, so we use the saved return code. */
 
-    if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
+    if (testflag(sender_vaddr, af_verify_routed))
+      rc = OK;
+    else
       {
       rc = sender_vaddr->special_action;
       *basic_errno = sender_vaddr->basic_errno;
@@ -2129,22 +1937,21 @@ else if (verify_sender_address != NULL)
 
       HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
 
-      if (rc == OK)
-        {
-        if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
-          {
-          DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
-            verify_sender_address, sender_vaddr->address);
-          }
-        else
-          {
-          DEBUG(D_acl) debug_printf("sender %s verified ok\n",
-            verify_sender_address);
-          }
-        }
-      else *basic_errno = sender_vaddr->basic_errno;
+      if (rc != OK)
+        *basic_errno = sender_vaddr->basic_errno;
+      else
+	DEBUG(D_acl)
+	  {
+	  if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
+	    debug_printf("sender %s verified ok as %s\n",
+	      verify_sender_address, sender_vaddr->address);
+	  else
+	    debug_printf("sender %s verified ok\n",
+	      verify_sender_address);
+	  }
       }
-    else rc = OK;  /* Null sender */
+    else
+      rc = OK;  /* Null sender */
 
     /* Cache the result code */
 
@@ -2265,26 +2072,20 @@ Returns:      CONTROL_xxx value
 static int
 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
 {
-int len;
-control_def *d;
+int idx, len;
+control_def * d;
 
-for (d = controls_list;
-     d < controls_list + sizeof(controls_list)/sizeof(control_def);
-     d++)
-  {
-  len = Ustrlen(d->name);
-  if (Ustrncmp(d->name, arg, len) == 0) break;
-  }
-
-if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
-   (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
+if (  (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
+   || (  arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
+      && (!d->has_option || arg[len] != '/')
+   )  )
   {
   *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
   return CONTROL_ERROR;
   }
 
 *pptr = arg + len;
-return d->value;
+return idx;
 }
 
 
@@ -2376,17 +2177,13 @@ rate measurement as opposed to rate limiting. */
 
 sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
 if (sender_rate_limit == NULL)
-  {
-  limit = -1.0;
-  ss = NULL;	/* compiler quietening */
-  }
-else
-  {
-  limit = Ustrtod(sender_rate_limit, &ss);
-  if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
-  else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
-  else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
-  }
+  return ratelimit_error(log_msgptr, "sender rate limit not set");
+
+limit = Ustrtod(sender_rate_limit, &ss);
+if      (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
+else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
+else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
+
 if (limit < 0.0 || *ss != '\0')
   return ratelimit_error(log_msgptr,
     "\"%s\" is not a positive number", sender_rate_limit);
@@ -2892,17 +2689,17 @@ uschar * errstr;
 hostname = string_nextinlist(&arg, &sep, NULL, 0);
 portstr = string_nextinlist(&arg, &sep, NULL, 0);
 
-if (hostname == NULL)
+if (!hostname)
   {
   *log_msgptr = US"missing destination host in \"udpsend\" modifier";
   return ERROR;
   }
-if (portstr == NULL)
+if (!portstr)
   {
   *log_msgptr = US"missing destination port in \"udpsend\" modifier";
   return ERROR;
   }
-if (arg == NULL)
+if (!arg)
   {
   *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
   return ERROR;
@@ -3001,8 +2798,6 @@ acl_check_condition(int verb, acl_condition_block *cb, int where,
 {
 uschar *user_message = NULL;
 uschar *log_message = NULL;
-uschar *debug_tag = NULL;
-uschar *debug_opts = NULL;
 int rc = OK;
 #ifdef WITH_CONTENT_SCAN
 int sep = -'/';
@@ -3043,7 +2838,7 @@ for (; cb != NULL; cb = cb->next)
   of them, but not for all, because expansion happens down in some lower level
   checking functions in some cases. */
 
-  if (cond_expand_at_top[cb->type])
+  if (conditions[cb->type].expand_at_top)
     {
     arg = expand_string(cb->arg);
     if (arg == NULL)
@@ -3062,8 +2857,8 @@ for (; cb != NULL; cb = cb->next)
     {
     int lhswidth = 0;
     debug_printf("check %s%s %n",
-      (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
-      conditions[cb->type], &lhswidth);
+      (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
+      conditions[cb->type].name, &lhswidth);
 
     if (cb->type == ACLC_SET)
       {
@@ -3080,11 +2875,11 @@ for (; cb != NULL; cb = cb->next)
 
   /* Check that this condition makes sense at this time */
 
-  if ((cond_forbids[cb->type] & (1 << where)) != 0)
+  if ((conditions[cb->type].forbids & (1 << where)) != 0)
     {
     *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
-      cond_modifiers[cb->type]? "use" : "test",
-      conditions[cb->type], acl_wherenames[where]);
+      conditions[cb->type].is_modifier ? "use" : "test",
+      conditions[cb->type].name, acl_wherenames[where]);
     return ERROR;
     }
 
@@ -3155,10 +2950,10 @@ for (; cb != NULL; cb = cb->next)
 
       /* Check if this control makes sense at this time */
 
-      if ((control_forbids[control_type] & (1 << where)) != 0)
+      if (controls_list[control_type].forbids & (1 << where))
 	{
 	*log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
-	  controls[control_type], acl_wherenames[where]);
+	  controls_list[control_type].name, acl_wherenames[where]);
 	return ERROR;
 	}
 
@@ -3354,24 +3149,39 @@ for (; cb != NULL; cb = cb->next)
 	break;
 
 	case CONTROL_DEBUG:
-	while (*p == '/')
 	  {
-	  if (Ustrncmp(p, "/tag=", 5) == 0)
-	    {
-	    const uschar *pp = p + 5;
-	    while (*pp != '\0' && *pp != '/') pp++;
-	    debug_tag = string_copyn(p+5, pp-p-5);
-	    p = pp;
-	    }
-	  else if (Ustrncmp(p, "/opts=", 6) == 0)
+	  uschar * debug_tag = NULL;
+	  uschar * debug_opts = NULL;
+	  BOOL kill = FALSE;
+
+	  while (*p == '/')
 	    {
-	    const uschar *pp = p + 6;
-	    while (*pp != '\0' && *pp != '/') pp++;
-	    debug_opts = string_copyn(p+6, pp-p-6);
+	    const uschar * pp = p+1;
+	    if (Ustrncmp(pp, "tag=", 4) == 0)
+	      {
+	      for (pp += 4; *pp && *pp != '/';) pp++;
+	      debug_tag = string_copyn(p+5, pp-p-5);
+	      }
+	    else if (Ustrncmp(pp, "opts=", 5) == 0)
+	      {
+	      for (pp += 5; *pp && *pp != '/';) pp++;
+	      debug_opts = string_copyn(p+6, pp-p-6);
+	      }
+	    else if (Ustrncmp(pp, "kill", 4) == 0)
+	      {
+	      for (pp += 4; *pp && *pp != '/';) pp++;
+	      kill = TRUE;
+	      }
+	    else
+	      while (*pp && *pp != '/') pp++;
 	    p = pp;
 	    }
+
+	    if (kill)
+	      debug_logging_stop();
+	    else
+	      debug_logging_activate(debug_tag, debug_opts);
 	  }
-	  debug_logging_activate(debug_tag, debug_opts);
 	break;
 
 	case CONTROL_SUPPRESS_LOCAL_FIXUPS:
@@ -3398,7 +3208,23 @@ for (; cb != NULL; cb = cb->next)
 	    *log_msgptr = US"fakereject";
 	  else
 	    {
-	    if (rcpt_count == 1) cutthrough.delivery = TRUE;
+	    if (rcpt_count == 1)
+	      {
+	      cutthrough.delivery = TRUE;
+	      while (*p == '/')
+		{
+		const uschar * pp = p+1;
+		if (Ustrncmp(pp, "defer=", 6) == 0)
+		  {
+		  pp += 6;
+		  if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
+		  /* else if (Ustrncmp(pp, "spool") == 0) ;	default */
+		  }
+		else
+		  while (*pp && *pp != '/') pp++;
+		p = pp;
+		}
+	      }
 	    break;
 	    }
 	  *log_msgptr = string_sprintf("\"control=%s\" on %s item",
@@ -3537,19 +3363,13 @@ for (; cb != NULL; cb = cb->next)
       }
     break;
 
-    #ifdef WITH_OLD_DEMIME
-    case ACLC_DEMIME:
-      rc = demime(&arg);
-    break;
-    #endif
-
     #ifndef DISABLE_DKIM
     case ACLC_DKIM_SIGNER:
     if (dkim_cur_signer != NULL)
       rc = match_isinlist(dkim_cur_signer,
                           &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
     else
-       rc = FAIL;
+      rc = FAIL;
     break;
 
     case ACLC_DKIM_STATUS:
@@ -3708,6 +3528,10 @@ for (; cb != NULL; cb = cb->next)
     break;
     #endif
 
+    case ACLC_QUEUE:
+    queue_name = string_copy_malloc(arg);
+    break;
+
     case ACLC_RATELIMIT:
     rc = acl_ratelimit(arg, where, log_msgptr);
     break;
@@ -3813,11 +3637,9 @@ for (; cb != NULL; cb = cb->next)
 
   /* If a condition was negated, invert OK/FAIL. */
 
-  if (!cond_modifiers[cb->type] && cb->u.negated)
-    {
+  if (!conditions[cb->type].is_modifier && cb->u.negated)
     if (rc == OK) rc = FAIL;
-      else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
-    }
+    else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
 
   if (rc != OK) break;   /* Conditions loop */
   }
@@ -4489,8 +4311,8 @@ and WHERE_RCPT and not yet opened conn as result of recipient-verify,
 and rcpt acl returned accept,
 and first recipient (cancel on any subsequents)
 open one now and run it up to RCPT acceptance.
-A failed verify should cancel cutthrough request.
-
+A failed verify should cancel cutthrough request,
+and will pass the fail to the originator.
 Initial implementation:  dual-write to spool.
 Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
 
@@ -4504,30 +4326,50 @@ If temp-reject, close the conn (and keep the spooled copy).
 If conn-failure, no action (and keep the spooled copy).
 */
 switch (where)
-{
-case ACL_WHERE_RCPT:
+  {
+  case ACL_WHERE_RCPT:
 #ifndef DISABLE_PRDR
-case ACL_WHERE_PRDR:
+  case ACL_WHERE_PRDR:
 #endif
-  if (rc == OK  &&  cutthrough.delivery  && rcpt_count > cutthrough.nrcpt)
-    open_cutthrough_connection(addr);
-  break;
+    if (host_checking_callout)	/* -bhc mode */
+      cancel_cutthrough_connection("host-checking mode");
+
+    else if (  rc == OK
+	    && cutthrough.delivery
+	    && rcpt_count > cutthrough.nrcpt
+	    && (rc = open_cutthrough_connection(addr)) == DEFER
+	    )
+      if (cutthrough.defer_pass)
+	{
+	uschar * s = addr->message;
+	/* Horrid kludge to recover target's SMTP message */
+	while (*s) s++;
+	do --s; while (!isdigit(*s));
+	if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
+	acl_temp_details = TRUE;
+	}
+	else
+	{
+	HDEBUG(D_acl) debug_printf("cutthrough defer; will spool\n");
+	rc = OK;
+	}
+    break;
 
-case ACL_WHERE_PREDATA:
-  if( rc == OK )
-    cutthrough_predata();
-  else
-    cancel_cutthrough_connection("predata acl not ok");
-  break;
+  case ACL_WHERE_PREDATA:
+    if (rc == OK)
+      cutthrough_predata();
+    else
+      cancel_cutthrough_connection("predata acl not ok");
+    break;
 
-case ACL_WHERE_QUIT:
-case ACL_WHERE_NOTQUIT:
-  cancel_cutthrough_connection("quit or notquit");
-  break;
+  case ACL_WHERE_QUIT:
+  case ACL_WHERE_NOTQUIT:
+    cancel_cutthrough_connection("quit or notquit");
+    break;
 
-default:
-  break;
-}
+  default:
+    break;
+  }
 
 deliver_domain = deliver_localpart = deliver_address_data =
   sender_address_data = NULL;
diff --git a/src/src/auths/Makefile b/src/src/auths/Makefile
index 358d018e3..62ce9d0a9 100644
--- a/src/src/auths/Makefile
+++ b/src/src/auths/Makefile
@@ -8,7 +8,7 @@
 OBJ = auth-spa.o call_pam.o call_pwcheck.o \
       call_radius.o check_serv_cond.o cram_md5.o cyrus_sasl.o dovecot.o \
       get_data.o get_no64_data.o gsasl_exim.o heimdal_gssapi.o \
-      md5.o plaintext.o pwcheck.o sha1.o \
+      md5.o plaintext.o pwcheck.o \
       spa.o tls.o xtextdecode.o xtextencode.o
 
 auths.a:         $(OBJ)
@@ -30,7 +30,6 @@ get_data.o:         $(HDRS) get_data.c
 get_no64_data.o:    $(HDRS) get_no64_data.c
 md5.o:              $(HDRS) md5.c
 pwcheck.o:          $(HDRS) pwcheck.c pwcheck.h
-sha1.o:             $(HDRS) sha1.c
 xtextdecode.o:      $(HDRS) xtextdecode.c
 xtextencode.o:      $(HDRS) xtextencode.c
 
diff --git a/src/src/auths/auth-spa.c b/src/src/auths/auth-spa.c
index 9abc7b778..d1df7f2cb 100644
--- a/src/src/auths/auth-spa.c
+++ b/src/src/auths/auth-spa.c
@@ -68,7 +68,7 @@ int main (int argc, char ** argv)
 
        spa_build_auth_request (&request, username, domain);
 
-       spa_bits_to_base64 (msgbuf, (unsigned char*)&request,
+       spa_bits_to_base64 (msgbuf, US &request,
                spa_request_length(&request));
 
        printf ("SPA Login request for username=%s:\n   %s\n",
@@ -91,7 +91,7 @@ int main (int argc, char ** argv)
        }
 
        spa_build_auth_response (&challenge, &response, username, password);
-       spa_bits_to_base64 (msgbuf, (unsigned char*)&response,
+       spa_bits_to_base64 (msgbuf, US &response,
                spa_request_length(&response));
 
        printf ("SPA Response to challenge:\n   %s\n for " \
@@ -153,87 +153,73 @@ int main (int argc, char ** argv)
    up with a different answer to the one above)
 */
 
-#define DEBUG(a,b) ;
+#define DEBUG_X(a,b) ;
 
 extern int DEBUGLEVEL;
 
-#include <sys/types.h>     /* For size_t */
+#include "../exim.h"
 #include "auth-spa.h"
 #include <assert.h>
-#include <ctype.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <unistd.h>
-
-#ifndef _AIX
-typedef unsigned char uchar;
-#endif
-
 
-typedef int BOOL;
-#define False 0
-#define True  1
 
 #ifndef _BYTEORDER_H
-#define _BYTEORDER_H
+# define _BYTEORDER_H
 
-#define RW_PCVAL(read,inbuf,outbuf,len) \
+# define RW_PCVAL(read,inbuf,outbuf,len) \
        { if (read) { PCVAL (inbuf,0,outbuf,len); } \
        else      { PSCVAL(inbuf,0,outbuf,len); } }
 
-#define RW_PIVAL(read,big_endian,inbuf,outbuf,len) \
+# define RW_PIVAL(read,big_endian,inbuf,outbuf,len) \
        { if (read) { if (big_endian) { RPIVAL(inbuf,0,outbuf,len); } else { PIVAL(inbuf,0,outbuf,len); } } \
        else      { if (big_endian) { RPSIVAL(inbuf,0,outbuf,len); } else { PSIVAL(inbuf,0,outbuf,len); } } }
 
-#define RW_PSVAL(read,big_endian,inbuf,outbuf,len) \
+# define RW_PSVAL(read,big_endian,inbuf,outbuf,len) \
        { if (read) { if (big_endian) { RPSVAL(inbuf,0,outbuf,len); } else { PSVAL(inbuf,0,outbuf,len); } } \
        else      { if (big_endian) { RPSSVAL(inbuf,0,outbuf,len); } else { PSSVAL(inbuf,0,outbuf,len); } } }
 
-#define RW_CVAL(read, inbuf, outbuf, offset) \
+# define RW_CVAL(read, inbuf, outbuf, offset) \
        { if (read) { (outbuf) = CVAL (inbuf,offset); } \
        else      { SCVAL(inbuf,offset,outbuf); } }
 
-#define RW_IVAL(read, big_endian, inbuf, outbuf, offset) \
+# define RW_IVAL(read, big_endian, inbuf, outbuf, offset) \
        { if (read) { (outbuf) = ((big_endian) ? RIVAL(inbuf,offset) : IVAL (inbuf,offset)); } \
        else      { if (big_endian) { RSIVAL(inbuf,offset,outbuf); } else { SIVAL(inbuf,offset,outbuf); } } }
 
-#define RW_SVAL(read, big_endian, inbuf, outbuf, offset) \
+# define RW_SVAL(read, big_endian, inbuf, outbuf, offset) \
        { if (read) { (outbuf) = ((big_endian) ? RSVAL(inbuf,offset) : SVAL (inbuf,offset)); } \
        else      { if (big_endian) { RSSVAL(inbuf,offset,outbuf); } else { SSVAL(inbuf,offset,outbuf); } } }
 
-#undef CAREFUL_ALIGNMENT
+# undef CAREFUL_ALIGNMENT
 
 /* we know that the 386 can handle misalignment and has the "right"
    byteorder */
-#ifdef __i386__
-#define CAREFUL_ALIGNMENT 0
-#endif
+# ifdef __i386__
+#  define CAREFUL_ALIGNMENT 0
+# endif
 
-#ifndef CAREFUL_ALIGNMENT
-#define CAREFUL_ALIGNMENT 1
-#endif
+# ifndef CAREFUL_ALIGNMENT
+#  define CAREFUL_ALIGNMENT 1
+# endif
 
-#define CVAL(buf,pos) (((unsigned char *)(buf))[pos])
-#define PVAL(buf,pos) ((unsigned)CVAL(buf,pos))
-#define SCVAL(buf,pos,val) (CVAL(buf,pos) = (val))
+# define CVAL(buf,pos) ((US (buf))[pos])
+# define PVAL(buf,pos) ((unsigned)CVAL(buf,pos))
+# define SCVAL(buf,pos,val) (CVAL(buf,pos) = (val))
 
 
-#if CAREFUL_ALIGNMENT
+# if CAREFUL_ALIGNMENT
 
-#define SVAL(buf,pos) (PVAL(buf,pos)|PVAL(buf,(pos)+1)<<8)
-#define IVAL(buf,pos) (SVAL(buf,pos)|SVAL(buf,(pos)+2)<<16)
-#define SSVALX(buf,pos,val) (CVAL(buf,pos)=(val)&0xFF,CVAL(buf,pos+1)=(val)>>8)
-#define SIVALX(buf,pos,val) (SSVALX(buf,pos,val&0xFFFF),SSVALX(buf,pos+2,val>>16))
-#define SVALS(buf,pos) ((int16x)SVAL(buf,pos))
-#define IVALS(buf,pos) ((int32x)IVAL(buf,pos))
-#define SSVAL(buf,pos,val) SSVALX((buf),(pos),((uint16x)(val)))
-#define SIVAL(buf,pos,val) SIVALX((buf),(pos),((uint32x)(val)))
-#define SSVALS(buf,pos,val) SSVALX((buf),(pos),((int16x)(val)))
-#define SIVALS(buf,pos,val) SIVALX((buf),(pos),((int32x)(val)))
+#  define SVAL(buf,pos) (PVAL(buf,pos)|PVAL(buf,(pos)+1)<<8)
+#  define IVAL(buf,pos) (SVAL(buf,pos)|SVAL(buf,(pos)+2)<<16)
+#  define SSVALX(buf,pos,val) (CVAL(buf,pos)=(val)&0xFF,CVAL(buf,pos+1)=(val)>>8)
+#  define SIVALX(buf,pos,val) (SSVALX(buf,pos,val&0xFFFF),SSVALX(buf,pos+2,val>>16))
+#  define SVALS(buf,pos) ((int16x)SVAL(buf,pos))
+#  define IVALS(buf,pos) ((int32x)IVAL(buf,pos))
+#  define SSVAL(buf,pos,val) SSVALX((buf),(pos),((uint16x)(val)))
+#  define SIVAL(buf,pos,val) SIVALX((buf),(pos),((uint32x)(val)))
+#  define SSVALS(buf,pos,val) SSVALX((buf),(pos),((int16x)(val)))
+#  define SIVALS(buf,pos,val) SIVALX((buf),(pos),((int32x)(val)))
 
-#else /* CAREFUL_ALIGNMENT */
+# else /* CAREFUL_ALIGNMENT */
 
 /* this handles things for architectures like the 386 that can handle
    alignment errors */
@@ -243,116 +229,116 @@ typedef int BOOL;
 */
 
 /* get single value from an SMB buffer */
-#define SVAL(buf,pos) (*(uint16x *)((char *)(buf) + (pos)))
-#define IVAL(buf,pos) (*(uint32x *)((char *)(buf) + (pos)))
-#define SVALS(buf,pos) (*(int16x *)((char *)(buf) + (pos)))
-#define IVALS(buf,pos) (*(int32x *)((char *)(buf) + (pos)))
+#  define SVAL(buf,pos) (*(uint16x *)((char *)(buf) + (pos)))
+#  define IVAL(buf,pos) (*(uint32x *)((char *)(buf) + (pos)))
+#  define SVALS(buf,pos) (*(int16x *)((char *)(buf) + (pos)))
+#  define IVALS(buf,pos) (*(int32x *)((char *)(buf) + (pos)))
 
 /* store single value in an SMB buffer */
-#define SSVAL(buf,pos,val) SVAL(buf,pos)=((uint16x)(val))
-#define SIVAL(buf,pos,val) IVAL(buf,pos)=((uint32x)(val))
-#define SSVALS(buf,pos,val) SVALS(buf,pos)=((int16x)(val))
-#define SIVALS(buf,pos,val) IVALS(buf,pos)=((int32x)(val))
+#  define SSVAL(buf,pos,val) SVAL(buf,pos)=((uint16x)(val))
+#  define SIVAL(buf,pos,val) IVAL(buf,pos)=((uint32x)(val))
+#  define SSVALS(buf,pos,val) SVALS(buf,pos)=((int16x)(val))
+#  define SIVALS(buf,pos,val) IVALS(buf,pos)=((int32x)(val))
 
-#endif /* CAREFUL_ALIGNMENT */
+# endif /* CAREFUL_ALIGNMENT */
 
 /* macros for reading / writing arrays */
 
-#define SMBMACRO(macro,buf,pos,val,len,size) \
+# define SMBMACRO(macro,buf,pos,val,len,size) \
 { int l; for (l = 0; l < (len); l++) (val)[l] = macro((buf), (pos) + (size)*l); }
 
-#define SSMBMACRO(macro,buf,pos,val,len,size) \
+# define SSMBMACRO(macro,buf,pos,val,len,size) \
 { int l; for (l = 0; l < (len); l++) macro((buf), (pos) + (size)*l, (val)[l]); }
 
 /* reads multiple data from an SMB buffer */
-#define PCVAL(buf,pos,val,len) SMBMACRO(CVAL,buf,pos,val,len,1)
-#define PSVAL(buf,pos,val,len) SMBMACRO(SVAL,buf,pos,val,len,2)
-#define PIVAL(buf,pos,val,len) SMBMACRO(IVAL,buf,pos,val,len,4)
-#define PCVALS(buf,pos,val,len) SMBMACRO(CVALS,buf,pos,val,len,1)
-#define PSVALS(buf,pos,val,len) SMBMACRO(SVALS,buf,pos,val,len,2)
-#define PIVALS(buf,pos,val,len) SMBMACRO(IVALS,buf,pos,val,len,4)
+# define PCVAL(buf,pos,val,len) SMBMACRO(CVAL,buf,pos,val,len,1)
+# define PSVAL(buf,pos,val,len) SMBMACRO(SVAL,buf,pos,val,len,2)
+# define PIVAL(buf,pos,val,len) SMBMACRO(IVAL,buf,pos,val,len,4)
+# define PCVALS(buf,pos,val,len) SMBMACRO(CVALS,buf,pos,val,len,1)
+# define PSVALS(buf,pos,val,len) SMBMACRO(SVALS,buf,pos,val,len,2)
+# define PIVALS(buf,pos,val,len) SMBMACRO(IVALS,buf,pos,val,len,4)
 
 /* stores multiple data in an SMB buffer */
-#define PSCVAL(buf,pos,val,len) SSMBMACRO(SCVAL,buf,pos,val,len,1)
-#define PSSVAL(buf,pos,val,len) SSMBMACRO(SSVAL,buf,pos,val,len,2)
-#define PSIVAL(buf,pos,val,len) SSMBMACRO(SIVAL,buf,pos,val,len,4)
-#define PSCVALS(buf,pos,val,len) SSMBMACRO(SCVALS,buf,pos,val,len,1)
-#define PSSVALS(buf,pos,val,len) SSMBMACRO(SSVALS,buf,pos,val,len,2)
-#define PSIVALS(buf,pos,val,len) SSMBMACRO(SIVALS,buf,pos,val,len,4)
+# define PSCVAL(buf,pos,val,len) SSMBMACRO(SCVAL,buf,pos,val,len,1)
+# define PSSVAL(buf,pos,val,len) SSMBMACRO(SSVAL,buf,pos,val,len,2)
+# define PSIVAL(buf,pos,val,len) SSMBMACRO(SIVAL,buf,pos,val,len,4)
+# define PSCVALS(buf,pos,val,len) SSMBMACRO(SCVALS,buf,pos,val,len,1)
+# define PSSVALS(buf,pos,val,len) SSMBMACRO(SSVALS,buf,pos,val,len,2)
+# define PSIVALS(buf,pos,val,len) SSMBMACRO(SIVALS,buf,pos,val,len,4)
 
 
 /* now the reverse routines - these are used in nmb packets (mostly) */
-#define SREV(x) ((((x)&0xFF)<<8) | (((x)>>8)&0xFF))
-#define IREV(x) ((SREV(x)<<16) | (SREV((x)>>16)))
-
-#define RSVAL(buf,pos) SREV(SVAL(buf,pos))
-#define RSVALS(buf,pos) SREV(SVALS(buf,pos))
-#define RIVAL(buf,pos) IREV(IVAL(buf,pos))
-#define RIVALS(buf,pos) IREV(IVALS(buf,pos))
-#define RSSVAL(buf,pos,val) SSVAL(buf,pos,SREV(val))
-#define RSSVALS(buf,pos,val) SSVALS(buf,pos,SREV(val))
-#define RSIVAL(buf,pos,val) SIVAL(buf,pos,IREV(val))
-#define RSIVALS(buf,pos,val) SIVALS(buf,pos,IREV(val))
+# define SREV(x) ((((x)&0xFF)<<8) | (((x)>>8)&0xFF))
+# define IREV(x) ((SREV(x)<<16) | (SREV((x)>>16)))
+
+# define RSVAL(buf,pos) SREV(SVAL(buf,pos))
+# define RSVALS(buf,pos) SREV(SVALS(buf,pos))
+# define RIVAL(buf,pos) IREV(IVAL(buf,pos))
+# define RIVALS(buf,pos) IREV(IVALS(buf,pos))
+# define RSSVAL(buf,pos,val) SSVAL(buf,pos,SREV(val))
+# define RSSVALS(buf,pos,val) SSVALS(buf,pos,SREV(val))
+# define RSIVAL(buf,pos,val) SIVAL(buf,pos,IREV(val))
+# define RSIVALS(buf,pos,val) SIVALS(buf,pos,IREV(val))
 
 /* reads multiple data from an SMB buffer (big-endian) */
-#define RPSVAL(buf,pos,val,len) SMBMACRO(RSVAL,buf,pos,val,len,2)
-#define RPIVAL(buf,pos,val,len) SMBMACRO(RIVAL,buf,pos,val,len,4)
-#define RPSVALS(buf,pos,val,len) SMBMACRO(RSVALS,buf,pos,val,len,2)
-#define RPIVALS(buf,pos,val,len) SMBMACRO(RIVALS,buf,pos,val,len,4)
+# define RPSVAL(buf,pos,val,len) SMBMACRO(RSVAL,buf,pos,val,len,2)
+# define RPIVAL(buf,pos,val,len) SMBMACRO(RIVAL,buf,pos,val,len,4)
+# define RPSVALS(buf,pos,val,len) SMBMACRO(RSVALS,buf,pos,val,len,2)
+# define RPIVALS(buf,pos,val,len) SMBMACRO(RIVALS,buf,pos,val,len,4)
 
 /* stores multiple data in an SMB buffer (big-endian) */
-#define RPSSVAL(buf,pos,val,len) SSMBMACRO(RSSVAL,buf,pos,val,len,2)
-#define RPSIVAL(buf,pos,val,len) SSMBMACRO(RSIVAL,buf,pos,val,len,4)
-#define RPSSVALS(buf,pos,val,len) SSMBMACRO(RSSVALS,buf,pos,val,len,2)
-#define RPSIVALS(buf,pos,val,len) SSMBMACRO(RSIVALS,buf,pos,val,len,4)
+# define RPSSVAL(buf,pos,val,len) SSMBMACRO(RSSVAL,buf,pos,val,len,2)
+# define RPSIVAL(buf,pos,val,len) SSMBMACRO(RSIVAL,buf,pos,val,len,4)
+# define RPSSVALS(buf,pos,val,len) SSMBMACRO(RSSVALS,buf,pos,val,len,2)
+# define RPSIVALS(buf,pos,val,len) SSMBMACRO(RSIVALS,buf,pos,val,len,4)
 
-#define DBG_RW_PCVAL(charmode,string,depth,base,read,inbuf,outbuf,len) \
+# define DBG_RW_PCVAL(charmode,string,depth,base,read,inbuf,outbuf,len) \
        { RW_PCVAL(read,inbuf,outbuf,len) \
-       DEBUG(5,("%s%04x %s: ", \
+       DEBUG_X(5,("%s%04x %s: ", \
              tab_depth(depth), base,string)); \
-    if (charmode) print_asc(5, (unsigned char*)(outbuf), (len)); else \
-       { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%02x ", (outbuf)[idx])); } } \
-       DEBUG(5,("\n")); }
+    if (charmode) print_asc(5, US (outbuf), (len)); else \
+       { int idx; for (idx = 0; idx < len; idx++) { DEBUG_X(5,("%02x ", (outbuf)[idx])); } } \
+       DEBUG_X(5,("\n")); }
 
-#define DBG_RW_PSVAL(charmode,string,depth,base,read,big_endian,inbuf,outbuf,len) \
+# define DBG_RW_PSVAL(charmode,string,depth,base,read,big_endian,inbuf,outbuf,len) \
        { RW_PSVAL(read,big_endian,inbuf,outbuf,len) \
-       DEBUG(5,("%s%04x %s: ", \
+       DEBUG_X(5,("%s%04x %s: ", \
              tab_depth(depth), base,string)); \
-    if (charmode) print_asc(5, (unsigned char*)(outbuf), 2*(len)); else \
-       { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%04x ", (outbuf)[idx])); } } \
-       DEBUG(5,("\n")); }
+    if (charmode) print_asc(5, US (outbuf), 2*(len)); else \
+       { int idx; for (idx = 0; idx < len; idx++) { DEBUG_X(5,("%04x ", (outbuf)[idx])); } } \
+       DEBUG_X(5,("\n")); }
 
-#define DBG_RW_PIVAL(charmode,string,depth,base,read,big_endian,inbuf,outbuf,len) \
+# define DBG_RW_PIVAL(charmode,string,depth,base,read,big_endian,inbuf,outbuf,len) \
        { RW_PIVAL(read,big_endian,inbuf,outbuf,len) \
-       DEBUG(5,("%s%04x %s: ", \
+       DEBUG_X(5,("%s%04x %s: ", \
              tab_depth(depth), base,string)); \
-    if (charmode) print_asc(5, (unsigned char*)(outbuf), 4*(len)); else \
-       { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%08x ", (outbuf)[idx])); } } \
-       DEBUG(5,("\n")); }
+    if (charmode) print_asc(5, US (outbuf), 4*(len)); else \
+       { int idx; for (idx = 0; idx < len; idx++) { DEBUG_X(5,("%08x ", (outbuf)[idx])); } } \
+       DEBUG_X(5,("\n")); }
 
-#define DBG_RW_CVAL(string,depth,base,read,inbuf,outbuf) \
+# define DBG_RW_CVAL(string,depth,base,read,inbuf,outbuf) \
        { RW_CVAL(read,inbuf,outbuf,0) \
-       DEBUG(5,("%s%04x %s: %02x\n", \
+       DEBUG_X(5,("%s%04x %s: %02x\n", \
              tab_depth(depth), base, string, outbuf)); }
 
-#define DBG_RW_SVAL(string,depth,base,read,big_endian,inbuf,outbuf) \
+# define DBG_RW_SVAL(string,depth,base,read,big_endian,inbuf,outbuf) \
        { RW_SVAL(read,big_endian,inbuf,outbuf,0) \
-       DEBUG(5,("%s%04x %s: %04x\n", \
+       DEBUG_X(5,("%s%04x %s: %04x\n", \
              tab_depth(depth), base, string, outbuf)); }
 
-#define DBG_RW_IVAL(string,depth,base,read,big_endian,inbuf,outbuf) \
+# define DBG_RW_IVAL(string,depth,base,read,big_endian,inbuf,outbuf) \
        { RW_IVAL(read,big_endian,inbuf,outbuf,0) \
-       DEBUG(5,("%s%04x %s: %08x\n", \
+       DEBUG_X(5,("%s%04x %s: %08x\n", \
              tab_depth(depth), base, string, outbuf)); }
 
 #endif /* _BYTEORDER_H */
 
-void E_P16 (unsigned char *p14, unsigned char *p16);
-void E_P24 (unsigned char *p21, unsigned char *c8, unsigned char *p24);
-void D_P16 (unsigned char *p14, unsigned char *in, unsigned char *out);
-void SMBOWFencrypt (uchar passwd[16], uchar * c8, uchar p24[24]);
+void E_P16 (uschar *p14, uschar *p16);
+void E_P24 (uschar *p21, uschar *c8, uschar *p24);
+void D_P16 (uschar *p14, uschar *in, uschar *out);
+void SMBOWFencrypt (uschar passwd[16], uschar * c8, uschar p24[24]);
 
-void mdfour (unsigned char *out, unsigned char *in, int n);
+void mdfour (uschar *out, uschar *in, int n);
 
 
 /*
@@ -385,7 +371,7 @@ static const char base64val[] = {
 #define DECODE64(c)  (isascii(c) ? base64val[c] : BAD)
 
 void
-spa_bits_to_base64 (unsigned char *out, const unsigned char *in, int inlen)
+spa_bits_to_base64 (uschar *out, const uschar *in, int inlen)
 /* raw bytes in quasi-big-endian order to base 64 string (NUL-terminated) */
 {
   for (; inlen >= 3; inlen -= 3)
@@ -398,7 +384,7 @@ spa_bits_to_base64 (unsigned char *out, const unsigned char *in, int inlen)
     }
   if (inlen > 0)
     {
-      unsigned char fragment;
+      uschar fragment;
 
       *out++ = base64digits[in[0] >> 2];
       fragment = (in[0] << 4) & 0x30;
@@ -419,7 +405,7 @@ spa_base64_to_bits (char *out, int outlength, const char *in)
 /* base 64 to raw bytes in quasi-big-endian order, returning count of bytes */
 {
   int len = 0;
-  register unsigned char digit1, digit2, digit3, digit4;
+  register uschar digit1, digit2, digit3, digit4;
 
   if (in[0] == '+' && in[1] == ' ')
     in += 2;
@@ -467,9 +453,7 @@ spa_base64_to_bits (char *out, int outlength, const char *in)
 }
 
 
-#define uchar unsigned char
-
-static uchar perm1[56] = { 57, 49, 41, 33, 25, 17, 9,
+static uschar perm1[56] = { 57, 49, 41, 33, 25, 17, 9,
   1, 58, 50, 42, 34, 26, 18,
   10, 2, 59, 51, 43, 35, 27,
   19, 11, 3, 60, 52, 44, 36,
@@ -479,7 +463,7 @@ static uchar perm1[56] = { 57, 49, 41, 33, 25, 17, 9,
   21, 13, 5, 28, 20, 12, 4
 };
 
-static uchar perm2[48] = { 14, 17, 11, 24, 1, 5,
+static uschar perm2[48] = { 14, 17, 11, 24, 1, 5,
   3, 28, 15, 6, 21, 10,
   23, 19, 12, 4, 26, 8,
   16, 7, 27, 20, 13, 2,
@@ -489,7 +473,7 @@ static uchar perm2[48] = { 14, 17, 11, 24, 1, 5,
   46, 42, 50, 36, 29, 32
 };
 
-static uchar perm3[64] = { 58, 50, 42, 34, 26, 18, 10, 2,
+static uschar perm3[64] = { 58, 50, 42, 34, 26, 18, 10, 2,
   60, 52, 44, 36, 28, 20, 12, 4,
   62, 54, 46, 38, 30, 22, 14, 6,
   64, 56, 48, 40, 32, 24, 16, 8,
@@ -499,7 +483,7 @@ static uchar perm3[64] = { 58, 50, 42, 34, 26, 18, 10, 2,
   63, 55, 47, 39, 31, 23, 15, 7
 };
 
-static uchar perm4[48] = { 32, 1, 2, 3, 4, 5,
+static uschar perm4[48] = { 32, 1, 2, 3, 4, 5,
   4, 5, 6, 7, 8, 9,
   8, 9, 10, 11, 12, 13,
   12, 13, 14, 15, 16, 17,
@@ -509,7 +493,7 @@ static uchar perm4[48] = { 32, 1, 2, 3, 4, 5,
   28, 29, 30, 31, 32, 1
 };
 
-static uchar perm5[32] = { 16, 7, 20, 21,
+static uschar perm5[32] = { 16, 7, 20, 21,
   29, 12, 28, 17,
   1, 15, 23, 26,
   5, 18, 31, 10,
@@ -520,7 +504,7 @@ static uchar perm5[32] = { 16, 7, 20, 21,
 };
 
 
-static uchar perm6[64] = { 40, 8, 48, 16, 56, 24, 64, 32,
+static uschar perm6[64] = { 40, 8, 48, 16, 56, 24, 64, 32,
   39, 7, 47, 15, 55, 23, 63, 31,
   38, 6, 46, 14, 54, 22, 62, 30,
   37, 5, 45, 13, 53, 21, 61, 29,
@@ -531,9 +515,9 @@ static uchar perm6[64] = { 40, 8, 48, 16, 56, 24, 64, 32,
 };
 
 
-static uchar sc[16] = { 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 };
+static uschar sc[16] = { 1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1 };
 
-static uchar sbox[8][4][16] = {
+static uschar sbox[8][4][16] = {
   {{14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7},
    {0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8},
    {4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0},
@@ -576,7 +560,7 @@ static uchar sbox[8][4][16] = {
 };
 
 static void
-permute (char *out, char *in, uchar * p, int n)
+permute (char *out, char *in, uschar * p, int n)
 {
   int i;
   for (i = 0; i < n; i++)
@@ -696,7 +680,7 @@ dohash (char *out, char *in, char *key, int forw)
 }
 
 static void
-str_to_key (unsigned char *str, unsigned char *key)
+str_to_key (uschar *str, uschar *key)
 {
   int i;
 
@@ -716,13 +700,13 @@ str_to_key (unsigned char *str, unsigned char *key)
 
 
 static void
-smbhash (unsigned char *out, unsigned char *in, unsigned char *key, int forw)
+smbhash (uschar *out, uschar *in, uschar *key, int forw)
 {
   int i;
   char outb[64];
   char inb[64];
   char keyb[64];
-  unsigned char key2[8];
+  uschar key2[8];
 
   str_to_key (key, key2);
 
@@ -748,15 +732,15 @@ smbhash (unsigned char *out, unsigned char *in, unsigned char *key, int forw)
 }
 
 void
-E_P16 (unsigned char *p14, unsigned char *p16)
+E_P16 (uschar *p14, uschar *p16)
 {
-  unsigned char sp8[8] = { 0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25 };
+  uschar sp8[8] = { 0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25 };
   smbhash (p16, sp8, p14, 1);
   smbhash (p16 + 8, sp8, p14 + 7, 1);
 }
 
 void
-E_P24 (unsigned char *p21, unsigned char *c8, unsigned char *p24)
+E_P24 (uschar *p21, uschar *c8, uschar *p24)
 {
   smbhash (p24, c8, p21, 1);
   smbhash (p24 + 8, c8, p21 + 7, 1);
@@ -764,7 +748,7 @@ E_P24 (unsigned char *p21, unsigned char *c8, unsigned char *p24)
 }
 
 void
-D_P16 (unsigned char *p14, unsigned char *in, unsigned char *out)
+D_P16 (uschar *p14, uschar *in, uschar *out)
 {
   smbhash (out, in, p14, 0);
   smbhash (out + 8, in + 8, p14 + 7, 0);
@@ -814,7 +798,7 @@ safe_strcpy (char *dest, const char *src, size_t maxlength)
 
   if (!dest)
     {
-      DEBUG (0, ("ERROR: NULL dest in safe_strcpy\n"));
+      DEBUG_X (0, ("ERROR: NULL dest in safe_strcpy\n"));
       return NULL;
     }
 
@@ -828,7 +812,7 @@ safe_strcpy (char *dest, const char *src, size_t maxlength)
 
   if (len > maxlength)
     {
-      DEBUG (0, ("ERROR: string overflow by %d in safe_strcpy [%.50s]\n",
+      DEBUG_X (0, ("ERROR: string overflow by %d in safe_strcpy [%.50s]\n",
                 (int) (len - maxlength), src));
       len = maxlength;
     }
@@ -850,7 +834,7 @@ strupper (char *s)
          s += skip;
        else
          {
-           if (islower ((unsigned char)(*s)))
+           if (islower ((uschar)(*s)))
              *s = toupper (*s);
            s++;
          }
@@ -866,9 +850,9 @@ strupper (char *s)
  */
 
 void
-spa_smb_encrypt (uchar * passwd, uchar * c8, uchar * p24)
+spa_smb_encrypt (uschar * passwd, uschar * c8, uschar * p24)
 {
-  uchar p14[15], p21[21];
+  uschar p14[15], p21[21];
 
   memset (p21, '\0', 21);
   memset (p14, '\0', 14);
@@ -880,7 +864,7 @@ spa_smb_encrypt (uchar * passwd, uchar * c8, uchar * p24)
   SMBOWFencrypt (p21, c8, p24);
 
 #ifdef DEBUG_PASSWORD
-  DEBUG (100, ("spa_smb_encrypt: lm#, challenge, response\n"));
+  DEBUG_X (100, ("spa_smb_encrypt: lm#, challenge, response\n"));
   dump_data (100, (char *) p21, 16);
   dump_data (100, (char *) c8, 8);
   dump_data (100, (char *) p24, 24);
@@ -905,7 +889,7 @@ _my_wcslen (int16x * str)
  */
 
 static int
-_my_mbstowcs (int16x * dst, uchar * src, int len)
+_my_mbstowcs (int16x * dst, uschar * src, int len)
 {
   int i;
   int16x val;
@@ -927,7 +911,7 @@ _my_mbstowcs (int16x * dst, uchar * src, int len)
  */
 
 void
-E_md4hash (uchar * passwd, uchar * p16)
+E_md4hash (uschar * passwd, uschar * p16)
 {
   int len;
   int16x wpwd[129];
@@ -942,12 +926,12 @@ E_md4hash (uchar * passwd, uchar * p16)
   /* Calculate length in bytes */
   len = _my_wcslen (wpwd) * sizeof (int16x);
 
-  mdfour (p16, (unsigned char *) wpwd, len);
+  mdfour (p16, US wpwd, len);
 }
 
 /* Does both the NT and LM owfs of a user's password */
 void
-nt_lm_owf_gen (char *pwd, uchar nt_p16[16], uchar p16[16])
+nt_lm_owf_gen (char *pwd, uschar nt_p16[16], uschar p16[16])
 {
   char passwd[130];
 
@@ -956,10 +940,10 @@ nt_lm_owf_gen (char *pwd, uchar nt_p16[16], uchar p16[16])
 
   /* Calculate the MD4 hash (NT compatible) of the password */
   memset (nt_p16, '\0', 16);
-  E_md4hash ((uchar *) passwd, nt_p16);
+  E_md4hash (US passwd, nt_p16);
 
 #ifdef DEBUG_PASSWORD
-  DEBUG (100, ("nt_lm_owf_gen: pwd, nt#\n"));
+  DEBUG_X (100, ("nt_lm_owf_gen: pwd, nt#\n"));
   dump_data (120, passwd, strlen (passwd));
   dump_data (100, (char *) nt_p16, 16);
 #endif
@@ -971,10 +955,10 @@ nt_lm_owf_gen (char *pwd, uchar nt_p16[16], uchar p16[16])
   /* Calculate the SMB (lanman) hash functions of the password */
 
   memset (p16, '\0', 16);
-  E_P16 ((uchar *) passwd, (uchar *) p16);
+  E_P16 (US passwd, US p16);
 
 #ifdef DEBUG_PASSWORD
-  DEBUG (100, ("nt_lm_owf_gen: pwd, lm#\n"));
+  DEBUG_X (100, ("nt_lm_owf_gen: pwd, lm#\n"));
   dump_data (120, passwd, strlen (passwd));
   dump_data (100, (char *) p16, 16);
 #endif
@@ -984,9 +968,9 @@ nt_lm_owf_gen (char *pwd, uchar nt_p16[16], uchar p16[16])
 
 /* Does the des encryption from the NT or LM MD4 hash. */
 void
-SMBOWFencrypt (uchar passwd[16], uchar * c8, uchar p24[24])
+SMBOWFencrypt (uschar passwd[16], uschar * c8, uschar p24[24])
 {
-  uchar p21[21];
+  uschar p21[21];
 
   memset (p21, '\0', 21);
 
@@ -996,9 +980,9 @@ SMBOWFencrypt (uchar passwd[16], uchar * c8, uchar p24[24])
 
 /* Does the des encryption from the FIRST 8 BYTES of the NT or LM MD4 hash. */
 void
-NTLMSSPOWFencrypt (uchar passwd[8], uchar * ntlmchalresp, uchar p24[24])
+NTLMSSPOWFencrypt (uschar passwd[8], uschar * ntlmchalresp, uschar p24[24])
 {
-  uchar p21[21];
+  uschar p21[21];
 
   memset (p21, '\0', 21);
   memcpy (p21, passwd, 8);
@@ -1006,7 +990,7 @@ NTLMSSPOWFencrypt (uchar passwd[8], uchar * ntlmchalresp, uchar p24[24])
 
   E_P24 (p21, ntlmchalresp, p24);
 #ifdef DEBUG_PASSWORD
-  DEBUG (100, ("NTLMSSPOWFencrypt: p21, c8, p24\n"));
+  DEBUG_X (100, ("NTLMSSPOWFencrypt: p21, c8, p24\n"));
   dump_data (100, (char *) p21, 21);
   dump_data (100, (char *) ntlmchalresp, 8);
   dump_data (100, (char *) p24, 24);
@@ -1017,9 +1001,9 @@ NTLMSSPOWFencrypt (uchar passwd[8], uchar * ntlmchalresp, uchar p24[24])
 /* Does the NT MD4 hash then des encryption. */
 
 void
-spa_smb_nt_encrypt (uchar * passwd, uchar * c8, uchar * p24)
+spa_smb_nt_encrypt (uschar * passwd, uschar * c8, uschar * p24)
 {
-  uchar p21[21];
+  uschar p21[21];
 
   memset (p21, '\0', 21);
 
@@ -1027,7 +1011,7 @@ spa_smb_nt_encrypt (uchar * passwd, uchar * c8, uchar * p24)
   SMBOWFencrypt (p21, c8, p24);
 
 #ifdef DEBUG_PASSWORD
-  DEBUG (100, ("spa_smb_nt_encrypt: nt#, challenge, response\n"));
+  DEBUG_X (100, ("spa_smb_nt_encrypt: nt#, challenge, response\n"));
   dump_data (100, (char *) p21, 16);
   dump_data (100, (char *) c8, 8);
   dump_data (100, (char *) p24, 24);
@@ -1147,7 +1131,7 @@ spa_mdfour64 (uint32x * M)
 }
 
 static void
-copy64 (uint32x * M, unsigned char *in)
+copy64 (uint32x * M, uschar *in)
 {
   int i;
 
@@ -1157,7 +1141,7 @@ copy64 (uint32x * M, unsigned char *in)
 }
 
 static void
-copy4 (unsigned char *out, uint32x x)
+copy4 (uschar *out, uint32x x)
 {
   out[0] = x & 0xFF;
   out[1] = (x >> 8) & 0xFF;
@@ -1167,9 +1151,9 @@ copy4 (unsigned char *out, uint32x x)
 
 /* produce a md4 message digest from data of length n bytes */
 void
-mdfour (unsigned char *out, unsigned char *in, int n)
+mdfour (uschar *out, uschar *in, int n)
 {
-  unsigned char buf[128];
+  uschar buf[128];
   uint32x M[16];
   uint32x b = n * 8;
   int i;
@@ -1257,13 +1241,13 @@ else \
 char *p = string; \
 int len = 0; \
 if (p) len = strlen(p); \
-spa_bytes_add(ptr, header, ((unsigned char*)p), len); \
+spa_bytes_add(ptr, header, (US p), len); \
 }
 
 #define spa_unicode_add_string(ptr, header, string) \
 { \
 char *p = string; \
-unsigned char *b = NULL; \
+uschar *b = NULL; \
 int len = 0; \
 if (p) \
   { \
@@ -1278,12 +1262,15 @@ spa_bytes_add(ptr, header, b, len*2); \
 unicodeToString(((char*)structPtr) + IVAL(&structPtr->header.offset,0) , SVAL(&structPtr->header.len,0)/2)
 #define GetString(structPtr, header) \
 toString((((char *)structPtr) + IVAL(&structPtr->header.offset,0)), SVAL(&structPtr->header.len,0))
+
+#ifdef notdef
+
 #define DumpBuffer(fp, structPtr, header) \
-dumpRaw(fp,((unsigned char*)structPtr)+IVAL(&structPtr->header.offset,0),SVAL(&structPtr->header.len,0))
+dumpRaw(fp,(US structPtr)+IVAL(&structPtr->header.offset,0),SVAL(&structPtr->header.len,0))
 
 
 static void
-dumpRaw (FILE * fp, unsigned char *buf, size_t len)
+dumpRaw (FILE * fp, uschar *buf, size_t len)
 {
   int i;
 
@@ -1293,6 +1280,8 @@ dumpRaw (FILE * fp, unsigned char *buf, size_t len)
   fprintf (fp, "\n");
 }
 
+#endif
+
 char *
 unicodeToString (char *p, size_t len)
 {
@@ -1311,10 +1300,10 @@ unicodeToString (char *p, size_t len)
   return buf;
 }
 
-static unsigned char *
+static uschar *
 strToUnicode (char *p)
 {
-  static unsigned char buf[1024];
+  static uschar buf[1024];
   size_t l = strlen (p);
   int i = 0;
 
@@ -1329,10 +1318,10 @@ strToUnicode (char *p)
   return buf;
 }
 
-static unsigned char *
+static uschar *
 toString (char *p, size_t len)
 {
-  static unsigned char buf[1024];
+  static uschar buf[1024];
 
   assert (len + 1 < sizeof buf);
 
@@ -1341,6 +1330,8 @@ toString (char *p, size_t len)
   return buf;
 }
 
+#ifdef notdef
+
 void
 dumpSmbNtlmAuthRequest (FILE * fp, SPAAuthRequest * request)
 {
@@ -1381,6 +1372,7 @@ dumpSmbNtlmAuthResponse (FILE * fp, SPAAuthResponse * response)
   DumpBuffer (fp, response, sessionKey);
   fprintf (fp, "      Flags = %08x\n", IVAL (&response->flags, 0));
 }
+#endif
 
 void
 spa_build_auth_request (SPAAuthRequest * request, char *user, char *domain)
@@ -1432,7 +1424,7 @@ spa_build_auth_challenge (SPAAuthRequest * request, SPAAuthChallenge * challenge
   /* generate eight pseudo random bytes (method ripped from host.c) */
 
   for(i=0;i<8;i++) {
-    chalstr[i] = (unsigned char)(random_seed >> 16) % 256;
+    chalstr[i] = (uschar)(random_seed >> 16) % 256;
     random_seed = (1103515245 - (chalstr[i])) * random_seed + 12345;
   };
 
@@ -1467,8 +1459,8 @@ spa_build_auth_response (SPAAuthChallenge * challenge,
       *p = '\0';
     }
 
-  spa_smb_encrypt ((uchar *)password, challenge->challengeData, lmRespData);
-  spa_smb_nt_encrypt ((uchar *)password, challenge->challengeData, ntRespData);
+  spa_smb_encrypt (US password, challenge->challengeData, lmRespData);
+  spa_smb_nt_encrypt (US password, challenge->challengeData, ntRespData);
 
   response->bufIndex = 0;
   memcpy (response->ident, "NTLMSSP\0\0\0", 8);
@@ -1514,8 +1506,8 @@ spa_build_auth_response (SPAAuthChallenge * challenge,
     (const char *)GetUnicodeString(challenge, uDomain) :
     (const char *)GetString(challenge, uDomain));
 
-  spa_smb_encrypt ((uchar *)password, challenge->challengeData, lmRespData);
-  spa_smb_nt_encrypt ((uchar *)password, challenge->challengeData, ntRespData);
+  spa_smb_encrypt (US password, challenge->challengeData, lmRespData);
+  spa_smb_nt_encrypt (US password, challenge->challengeData, ntRespData);
 
   response->bufIndex = 0;
   memcpy (response->ident, "NTLMSSP\0\0\0", 8);
diff --git a/src/src/auths/call_radius.c b/src/src/auths/call_radius.c
index 455000ea7..c3637436d 100644
--- a/src/src/auths/call_radius.c
+++ b/src/src/auths/call_radius.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* This file was originally supplied by Ian Kirk. The libradius support came
@@ -165,6 +165,7 @@ switch (result)
   case OK_RC:
   return OK;
 
+  case REJECT_RC:
   case ERROR_RC:
   return FAIL;
 
diff --git a/src/src/auths/cram_md5.c b/src/src/auths/cram_md5.c
index 2d5c0d1e2..3be00082d 100644
--- a/src/src/auths/cram_md5.c
+++ b/src/src/auths/cram_md5.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -263,7 +263,7 @@ uschar digest[16];
 /* If expansion of either the secret or the user name failed, return CANCELLED
 or ERROR, as approriate. */
 
-if (secret == NULL || name == NULL)
+if (!secret || !name)
   {
   if (expand_string_forcedfail)
     {
@@ -272,7 +272,7 @@ if (secret == NULL || name == NULL)
     }
   string_format(buffer, buffsize, "expansion of \"%s\" failed in "
     "%s authenticator: %s",
-    (secret == NULL)? ob->client_secret : ob->client_name,
+    !secret ? ob->client_secret : ob->client_name,
     ablock->name, expand_string_message);
   return ERROR;
   }
@@ -282,7 +282,7 @@ in base 64. */
 
 if (smtp_write_command(outblock, FALSE, "AUTH %s\r\n", ablock->public_name) < 0)
   return FAIL_SEND;
-if (smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout) < 0)
+if (!smtp_read_response(inblock, buffer, buffsize, '3', timeout))
   return FAIL;
 
 if (b64decode(buffer + 4, &challenge) < 0)
@@ -299,8 +299,7 @@ compute_cram_md5(secret, challenge, digest);
 /* Create the response from the user name plus the CRAM-MD5 digest */
 
 string_format(big_buffer, big_buffer_size - 36, "%s", name);
-p = big_buffer;
-while (*p != 0) p++;
+for (p = big_buffer; *p; ) p++;
 *p++ = ' ';
 
 for (i = 0; i < 16; i++)
@@ -317,8 +316,8 @@ buffer[0] = 0;
 if (smtp_write_command(outblock, FALSE, "%s\r\n", b64encode(big_buffer,
   p - big_buffer)) < 0) return FAIL_SEND;
 
-return smtp_read_response(inblock, (uschar *)buffer, buffsize, '2', timeout)?
-  OK : FAIL;
+return smtp_read_response(inblock, (uschar *)buffer, buffsize, '2', timeout)
+  ? OK : FAIL;
 }
 #endif  /* STAND_ALONE */
 
diff --git a/src/src/auths/dovecot.c b/src/src/auths/dovecot.c
index c89411af8..5bf7b9cc3 100644
--- a/src/src/auths/dovecot.c
+++ b/src/src/auths/dovecot.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2004 Andrey Panin <pazke@donpac.ru>
- * Copyright (c) 2006-2014 The Exim Maintainers
+ * Copyright (c) 2006-2016 The Exim Maintainers
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published
@@ -228,244 +228,270 @@ return s;
 *              Server entry point                *
 *************************************************/
 
-int auth_dovecot_server(auth_instance *ablock, uschar *data)
+int
+auth_dovecot_server(auth_instance * ablock, uschar * data)
 {
-       auth_dovecot_options_block *ob =
-               (auth_dovecot_options_block *)(ablock->options_block);
-       struct sockaddr_un sa;
-       uschar buffer[DOVECOT_AUTH_MAXLINELEN];
-       uschar *args[DOVECOT_AUTH_MAXFIELDCOUNT];
-       uschar *auth_command;
-       uschar *auth_extra_data = US"";
-       uschar *p;
-       int nargs, tmp;
-       int crequid = 1, cont = 1, fd, ret = DEFER;
-       BOOL found = FALSE, have_mech_line = FALSE;
-
-       HDEBUG(D_auth) debug_printf("dovecot authentication\n");
-
-       memset(&sa, 0, sizeof(sa));
-       sa.sun_family = AF_UNIX;
-
-       /* This was the original code here: it is nonsense because strncpy()
-       does not return an integer. I have converted this to use the function
-       that formats and checks length. PH */
-
-       /*
-       if (strncpy(sa.sun_path, ob->server_socket, sizeof(sa.sun_path)) < 0) {
-       */
-
-       if (!string_format(US sa.sun_path, sizeof(sa.sun_path), "%s",
-                          ob->server_socket)) {
-               auth_defer_msg = US"authentication socket path too long";
-               return DEFER;
-       }
-
-       auth_defer_msg = US"authentication socket connection error";
-
-       fd = socket(PF_UNIX, SOCK_STREAM, 0);
-       if (fd < 0)
-               return DEFER;
-
-       if (connect(fd, (struct sockaddr *) &sa, sizeof(sa)) < 0)
-               goto out;
+auth_dovecot_options_block *ob =
+       (auth_dovecot_options_block *) ablock->options_block;
+struct sockaddr_un sa;
+uschar buffer[DOVECOT_AUTH_MAXLINELEN];
+uschar *args[DOVECOT_AUTH_MAXFIELDCOUNT];
+uschar *auth_command;
+uschar *auth_extra_data = US"";
+uschar *p;
+int nargs, tmp;
+int crequid = 1, cont = 1, fd = -1, ret = DEFER;
+BOOL found = FALSE, have_mech_line = FALSE;
+
+HDEBUG(D_auth) debug_printf("dovecot authentication\n");
+
+if (!data)
+  {
+  ret = FAIL;
+  goto out;
+  }
 
-       auth_defer_msg = US"authentication socket protocol error";
+memset(&sa, 0, sizeof(sa));
+sa.sun_family = AF_UNIX;
 
-       socket_buffer_left = 0;  /* Global, used to read more than a line but return by line */
-       while (cont) {
-               if (dc_gets(buffer, sizeof(buffer), fd) == NULL)
-                       OUT("authentication socket read error or premature eof");
-               p = buffer + Ustrlen(buffer) - 1;
-               if (*p != '\n') {
-                       OUT("authentication socket protocol line too long");
-               }
-               *p = '\0';
-               HDEBUG(D_auth) debug_printf("received: %s\n", buffer);
-               nargs = strcut(buffer, args, sizeof(args) / sizeof(args[0]));
-               /* HDEBUG(D_auth) debug_strcut(args, nargs, sizeof(args) / sizeof(args[0])); */
-
-               /* Code below rewritten by Kirill Miazine (km@krot.org). Only check commands that
-                  Exim will need. Original code also failed if Dovecot server sent unknown
-                  command. E.g. COOKIE in version 1.1 of the protocol would cause troubles. */
-               /* pdp: note that CUID is a per-connection identifier sent by the server,
-                  which increments at server discretion.
-                  By contrast, the "id" field of the protocol is a connection-specific request
-                  identifier, which needs to be unique per request from the client and is not
-                  connected to the CUID value, so we ignore CUID from server.  It's purely for
-                  diagnostics. */
-               if (Ustrcmp(args[0], US"VERSION") == 0) {
-                       CHECK_COMMAND("VERSION", 2, 2);
-                       if (Uatoi(args[1]) != VERSION_MAJOR)
-                               OUT("authentication socket protocol version mismatch");
-               } else if (Ustrcmp(args[0], US"MECH") == 0) {
-                       CHECK_COMMAND("MECH", 1, INT_MAX);
-                       have_mech_line = TRUE;
-                       if (strcmpic(US args[1], ablock->public_name) == 0)
-                               found = TRUE;
-               } else if (Ustrcmp(args[0], US"SPID") == 0) {
-                       /* Unfortunately the auth protocol handshake wasn't designed well
-                          to differentiate between auth-client/userdb/master. auth-userdb
-                          and auth-master send VERSION + SPID lines only and nothing
-                          afterwards, while auth-client sends VERSION + MECH + SPID +
-                          CUID + more. The simplest way that we can determine if we've
-                          connected to the correct socket is to see if MECH line exists or
-                          not (alternatively we'd have to have a small timeout after SPID
-                          to see if CUID is sent or not). */
-                       if (!have_mech_line)
-                               OUT("authentication socket type mismatch (connected to auth-master instead of auth-client)");
-               } else if (Ustrcmp(args[0], US"DONE") == 0) {
-                       CHECK_COMMAND("DONE", 0, 0);
-                       cont = 0;
-               }
-       }
+/* This was the original code here: it is nonsense because strncpy()
+does not return an integer. I have converted this to use the function
+that formats and checks length. PH */
 
-       if (!found) {
-               auth_defer_msg = string_sprintf("Dovecot did not advertise mechanism \"%s\" to us", ablock->public_name);
-               goto out;
-       }
+/*
+if (strncpy(sa.sun_path, ob->server_socket, sizeof(sa.sun_path)) < 0) {
+}
+*/
 
-       /* Added by PH: data must not contain tab (as it is
-       b64 it shouldn't, but check for safety). */
+if (!string_format(US sa.sun_path, sizeof(sa.sun_path), "%s",
+		  ob->server_socket))
+  {
+  auth_defer_msg = US"authentication socket path too long";
+  return DEFER;
+  }
 
-       if (Ustrchr(data, '\t') != NULL) {
-               ret = FAIL;
-               goto out;
-       }
+auth_defer_msg = US"authentication socket connection error";
 
-       /* Added by PH: extra fields when TLS is in use or if the TCP/IP
-       connection is local. */
+if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
+  return DEFER;
 
-       if (tls_in.cipher != NULL)
-               auth_extra_data = string_sprintf("secured\t%s%s",
-                   tls_in.certificate_verified? "valid-client-cert" : "",
-                   tls_in.certificate_verified? "\t" : "");
-       else if (interface_address != NULL &&
-                Ustrcmp(sender_host_address, interface_address) == 0)
-               auth_extra_data = US"secured\t";
+if (connect(fd, (struct sockaddr *) &sa, sizeof(sa)) < 0)
+  goto out;
 
+auth_defer_msg = US"authentication socket protocol error";
 
-/****************************************************************************
-   The code below was the original code here. It didn't work. A reading of the
-   file auth-protocol.txt.gz that came with Dovecot 1.0_beta8 indicated that
-   this was not right. Maybe something changed. I changed it to move the
-   service indication into the AUTH command, and it seems to be better. PH
-
-       fprintf(f, "VERSION\t%d\t%d\r\nSERVICE\tSMTP\r\nCPID\t%d\r\n"
-               "AUTH\t%d\t%s\trip=%s\tlip=%s\tresp=%s\r\n",
-               VERSION_MAJOR, VERSION_MINOR, getpid(), cuid,
-               ablock->public_name, sender_host_address, interface_address,
-               data ? (char *) data : "");
-
-   Subsequently, the command was modified to add "secured" and "valid-client-
-   cert" when relevant.
-****************************************************************************/
+socket_buffer_left = 0;  /* Global, used to read more than a line but return by line */
+while (cont)
+  {
+  if (dc_gets(buffer, sizeof(buffer), fd) == NULL)
+    OUT("authentication socket read error or premature eof");
+  p = buffer + Ustrlen(buffer) - 1;
+  if (*p != '\n')
+    OUT("authentication socket protocol line too long");
+
+  *p = '\0';
+  HDEBUG(D_auth) debug_printf("received: %s\n", buffer);
+
+  nargs = strcut(buffer, args, sizeof(args) / sizeof(args[0]));
+
+  /* HDEBUG(D_auth) debug_strcut(args, nargs, sizeof(args) / sizeof(args[0])); */
+
+  /* Code below rewritten by Kirill Miazine (km@krot.org). Only check commands that
+    Exim will need. Original code also failed if Dovecot server sent unknown
+    command. E.g. COOKIE in version 1.1 of the protocol would cause troubles. */
+  /* pdp: note that CUID is a per-connection identifier sent by the server,
+    which increments at server discretion.
+    By contrast, the "id" field of the protocol is a connection-specific request
+    identifier, which needs to be unique per request from the client and is not
+    connected to the CUID value, so we ignore CUID from server.  It's purely for
+    diagnostics. */
+
+  if (Ustrcmp(args[0], US"VERSION") == 0)
+    {
+    CHECK_COMMAND("VERSION", 2, 2);
+    if (Uatoi(args[1]) != VERSION_MAJOR)
+      OUT("authentication socket protocol version mismatch");
+    }
+  else if (Ustrcmp(args[0], US"MECH") == 0)
+    {
+    CHECK_COMMAND("MECH", 1, INT_MAX);
+    have_mech_line = TRUE;
+    if (strcmpic(US args[1], ablock->public_name) == 0)
+      found = TRUE;
+    }
+  else if (Ustrcmp(args[0], US"SPID") == 0)
+    {
+    /* Unfortunately the auth protocol handshake wasn't designed well
+    to differentiate between auth-client/userdb/master. auth-userdb
+    and auth-master send VERSION + SPID lines only and nothing
+    afterwards, while auth-client sends VERSION + MECH + SPID +
+    CUID + more. The simplest way that we can determine if we've
+    connected to the correct socket is to see if MECH line exists or
+    not (alternatively we'd have to have a small timeout after SPID
+    to see if CUID is sent or not). */
+
+    if (!have_mech_line)
+      OUT("authentication socket type mismatch"
+	" (connected to auth-master instead of auth-client)");
+    }
+  else if (Ustrcmp(args[0], US"DONE") == 0)
+    {
+    CHECK_COMMAND("DONE", 0, 0);
+    cont = 0;
+    }
+  }
 
-       auth_command = string_sprintf("VERSION\t%d\t%d\nCPID\t%d\n"
-               "AUTH\t%d\t%s\tservice=smtp\t%srip=%s\tlip=%s\tnologin\tresp=%s\n",
-               VERSION_MAJOR, VERSION_MINOR, getpid(), crequid,
-               ablock->public_name, auth_extra_data, sender_host_address,
-               interface_address, data ? (char *) data : "");
+if (!found)
+  {
+  auth_defer_msg = string_sprintf(
+    "Dovecot did not advertise mechanism \"%s\" to us", ablock->public_name);
+  goto out;
+  }
 
-       if (write(fd, auth_command, Ustrlen(auth_command)) < 0)
-              HDEBUG(D_auth) debug_printf("error sending auth_command: %s\n",
-                strerror(errno));
+/* Added by PH: data must not contain tab (as it is
+b64 it shouldn't, but check for safety). */
 
-       HDEBUG(D_auth) debug_printf("sent: %s", auth_command);
+if (Ustrchr(data, '\t') != NULL)
+  {
+  ret = FAIL;
+  goto out;
+  }
 
-       while (1) {
-               uschar *temp;
-               uschar *auth_id_pre = NULL;
-               int i;
+/* Added by PH: extra fields when TLS is in use or if the TCP/IP
+connection is local. */
 
-               if (dc_gets(buffer, sizeof(buffer), fd) == NULL) {
-                       auth_defer_msg = US"authentication socket read error or premature eof";
-                       goto out;
-               }
+if (tls_in.cipher != NULL)
+  auth_extra_data = string_sprintf("secured\t%s%s",
+     tls_in.certificate_verified? "valid-client-cert" : "",
+     tls_in.certificate_verified? "\t" : "");
 
-               buffer[Ustrlen(buffer) - 1] = 0;
-               HDEBUG(D_auth) debug_printf("received: %s\n", buffer);
-               nargs = strcut(buffer, args, sizeof(args) / sizeof(args[0]));
+else if (  interface_address != NULL
+        && Ustrcmp(sender_host_address, interface_address) == 0)
+  auth_extra_data = US"secured\t";
 
-               if (Uatoi(args[1]) != crequid)
-                       OUT("authentication socket connection id mismatch");
 
-               switch (toupper(*args[0])) {
-               case 'C':
-                       CHECK_COMMAND("CONT", 1, 2);
+/****************************************************************************
+The code below was the original code here. It didn't work. A reading of the
+file auth-protocol.txt.gz that came with Dovecot 1.0_beta8 indicated that
+this was not right. Maybe something changed. I changed it to move the
+service indication into the AUTH command, and it seems to be better. PH
+
+fprintf(f, "VERSION\t%d\t%d\r\nSERVICE\tSMTP\r\nCPID\t%d\r\n"
+       "AUTH\t%d\t%s\trip=%s\tlip=%s\tresp=%s\r\n",
+       VERSION_MAJOR, VERSION_MINOR, getpid(), cuid,
+       ablock->public_name, sender_host_address, interface_address,
+       data ? (char *) data : "");
+
+Subsequently, the command was modified to add "secured" and "valid-client-
+cert" when relevant.
+****************************************************************************/
 
-                       tmp = auth_get_no64_data(&data, US args[2]);
-                       if (tmp != OK) {
-                               ret = tmp;
-                               goto out;
-                       }
+auth_command = string_sprintf("VERSION\t%d\t%d\nCPID\t%d\n"
+       "AUTH\t%d\t%s\tservice=smtp\t%srip=%s\tlip=%s\tnologin\tresp=%s\n",
+       VERSION_MAJOR, VERSION_MINOR, getpid(), crequid,
+       ablock->public_name, auth_extra_data, sender_host_address,
+       interface_address, data);
 
-                       /* Added by PH: data must not contain tab (as it is
-                       b64 it shouldn't, but check for safety). */
+if (write(fd, auth_command, Ustrlen(auth_command)) < 0)
+  HDEBUG(D_auth) debug_printf("error sending auth_command: %s\n",
+    strerror(errno));
 
-                       if (Ustrchr(data, '\t') != NULL) {
-                               ret = FAIL;
-                               goto out;
-                       }
+HDEBUG(D_auth) debug_printf("sent: %s", auth_command);
 
-                       temp = string_sprintf("CONT\t%d\t%s\n", crequid, data);
-                       if (write(fd, temp, Ustrlen(temp)) < 0)
-                               OUT("authentication socket write error");
-                       break;
-
-               case 'F':
-                       CHECK_COMMAND("FAIL", 1, -1);
-
-                       for (i=2; (i<nargs) && (auth_id_pre == NULL); i++)
-                       {
-                               if ( Ustrncmp(args[i], US"user=", 5) == 0 )
-                               {
-                                       auth_id_pre = args[i]+5;
-                                       expand_nstring[1] = auth_vars[0] =
-                                               string_copy(auth_id_pre); /* PH */
-                                       expand_nlength[1] = Ustrlen(auth_id_pre);
-                                       expand_nmax = 1;
-                               }
-                       }
+while (1)
+  {
+  uschar *temp;
+  uschar *auth_id_pre = NULL;
+  int i;
 
-                       ret = FAIL;
-                       goto out;
-
-               case 'O':
-                       CHECK_COMMAND("OK", 2, -1);
-
-                       /*
-                        * Search for the "user=$USER" string in the args array
-                        * and return the proper value.
-                        */
-                       for (i=2; (i<nargs) && (auth_id_pre == NULL); i++)
-                       {
-                               if ( Ustrncmp(args[i], US"user=", 5) == 0 )
-                               {
-                                       auth_id_pre = args[i]+5;
-                                       expand_nstring[1] = auth_vars[0] =
-                                               string_copy(auth_id_pre); /* PH */
-                                       expand_nlength[1] = Ustrlen(auth_id_pre);
-                                       expand_nmax = 1;
-                               }
-                       }
+  if (dc_gets(buffer, sizeof(buffer), fd) == NULL)
+    {
+    auth_defer_msg = US"authentication socket read error or premature eof";
+    goto out;
+    }
 
-                       if (auth_id_pre == NULL)
-                               OUT("authentication socket protocol error, username missing");
+  buffer[Ustrlen(buffer) - 1] = 0;
+  HDEBUG(D_auth) debug_printf("received: %s\n", buffer);
+  nargs = strcut(buffer, args, sizeof(args) / sizeof(args[0]));
 
-                       ret = OK;
-                       /* fallthrough */
+  if (Uatoi(args[1]) != crequid)
+    OUT("authentication socket connection id mismatch");
 
-               default:
-                       goto out;
-               }
-       }
+  switch (toupper(*args[0]))
+    {
+    case 'C':
+      CHECK_COMMAND("CONT", 1, 2);
+
+      if ((tmp = auth_get_no64_data(&data, US args[2])) != OK)
+	{
+	ret = tmp;
+	goto out;
+	}
+
+      /* Added by PH: data must not contain tab (as it is
+      b64 it shouldn't, but check for safety). */
+
+      if (Ustrchr(data, '\t') != NULL)
+        {
+	ret = FAIL;
+	goto out;
+	}
+
+      temp = string_sprintf("CONT\t%d\t%s\n", crequid, data);
+      if (write(fd, temp, Ustrlen(temp)) < 0)
+	OUT("authentication socket write error");
+      break;
+
+    case 'F':
+      CHECK_COMMAND("FAIL", 1, -1);
+
+      for (i=2; (i<nargs) && (auth_id_pre == NULL); i++)
+	{
+	if ( Ustrncmp(args[i], US"user=", 5) == 0 )
+	  {
+	  auth_id_pre = args[i]+5;
+	  expand_nstring[1] = auth_vars[0] = string_copy(auth_id_pre); /* PH */
+	  expand_nlength[1] = Ustrlen(auth_id_pre);
+	  expand_nmax = 1;
+	  }
+	}
+
+      ret = FAIL;
+      goto out;
+
+    case 'O':
+      CHECK_COMMAND("OK", 2, -1);
+
+      /* Search for the "user=$USER" string in the args array
+      and return the proper value.  */
+
+      for (i=2; (i<nargs) && (auth_id_pre == NULL); i++)
+	{
+	if ( Ustrncmp(args[i], US"user=", 5) == 0 )
+	  {
+	  auth_id_pre = args[i]+5;
+	  expand_nstring[1] = auth_vars[0] = string_copy(auth_id_pre); /* PH */
+	  expand_nlength[1] = Ustrlen(auth_id_pre);
+	  expand_nmax = 1;
+	  }
+	}
+
+      if (auth_id_pre == NULL)
+        OUT("authentication socket protocol error, username missing");
+
+      ret = OK;
+      /* fallthrough */
+
+    default:
+      goto out;
+    }
+  }
 
 out:
-       /* close the socket used by dovecot */
-       if (fd >= 0)
-              close(fd);
+/* close the socket used by dovecot */
+if (fd >= 0)
+  close(fd);
 
-       /* Expand server_condition as an authorization check */
-       return (ret == OK)? auth_check_serv_cond(ablock) : ret;
+/* Expand server_condition as an authorization check */
+return ret == OK ? auth_check_serv_cond(ablock) : ret;
 }
diff --git a/src/src/auths/get_data.c b/src/src/auths/get_data.c
index 4d6c6d4a6..f839a010e 100644
--- a/src/src/auths/get_data.c
+++ b/src/src/auths/get_data.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 #include "../exim.h"
diff --git a/src/src/auths/heimdal_gssapi.c b/src/src/auths/heimdal_gssapi.c
index 94e689d58..732a67381 100644
--- a/src/src/auths/heimdal_gssapi.c
+++ b/src/src/auths/heimdal_gssapi.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Copyright (c) Twitter Inc 2012
diff --git a/src/src/auths/sha1.c b/src/src/auths/sha1.c
deleted file mode 100644
index 67a11912e..000000000
--- a/src/src/auths/sha1.c
+++ /dev/null
@@ -1,552 +0,0 @@
-/*************************************************
-*     Exim - an Internet mail transport agent    *
-*************************************************/
-
-/* Copyright (c) University of Cambridge 1995 - 2009 */
-/* See the file NOTICE for conditions of use and distribution. */
-
-#ifndef STAND_ALONE
-#include "../exim.h"
-
-/* For stand-alone testing, we need to have the structure defined, and
-to be able to do I/O */
-
-#else
-#include <stdio.h>
-#include <stdlib.h>
-typedef unsigned char uschar;
-typedef struct sha1 {
-  unsigned int H[5];
-  unsigned int length;
-  }
-sha1;
-#endif
-
-
-
-/*************************************************
-*        Start off a new SHA-1 computation.      *
-*************************************************/
-
-/*
-Argument:  pointer to sha1 storage structure
-Returns:   nothing
-*/
-
-void
-sha1_start(sha1 *base)
-{
-base->H[0] = 0x67452301;
-base->H[1] = 0xefcdab89;
-base->H[2] = 0x98badcfe;
-base->H[3] = 0x10325476;
-base->H[4] = 0xc3d2e1f0;
-base->length = 0;
-}
-
-
-
-/*************************************************
-*       Process another 64-byte block            *
-*************************************************/
-
-/* This function implements central part of the algorithm
-
-Arguments:
-  base       pointer to sha1 storage structure
-  text       pointer to next 64 bytes of subject text
-
-Returns:     nothing
-*/
-
-void
-sha1_mid(sha1 *base, const uschar *text)
-{
-register int i;
-unsigned int A, B, C, D, E;
-unsigned int W[80];
-
-base->length += 64;
-
-for (i = 0; i < 16; i++)
-  {
-  W[i] = (text[0] << 24) | (text[1] << 16) | (text[2] << 8) | text[3];
-  text += 4;
-  }
-
-for (i = 16; i < 80; i++)
-  {
-  register unsigned int x = W[i-3] ^ W[i-8] ^ W[i-14] ^ W[i-16];
-  W[i] = (x << 1) | (x >> 31);
-  }
-
-A = base->H[0];
-B = base->H[1];
-C = base->H[2];
-D = base->H[3];
-E = base->H[4];
-
-for (i = 0; i < 20; i++)
-  {
-  unsigned int T;
-  T = ((A << 5) | (A >> 27)) + ((B & C) | ((~B) & D)) + E + W[i] + 0x5a827999;
-  E = D;
-  D = C;
-  C = (B << 30) | (B >> 2);
-  B = A;
-  A = T;
-  }
-
-for (i = 20; i < 40; i++)
-  {
-  unsigned int T;
-  T = ((A << 5) | (A >> 27)) + (B ^ C ^ D) + E + W[i] + 0x6ed9eba1;
-  E = D;
-  D = C;
-  C = (B << 30) | (B >> 2);
-  B = A;
-  A = T;
-  }
-
-for (i = 40; i < 60; i++)
-  {
-  unsigned int T;
-  T = ((A << 5) | (A >> 27)) + ((B & C) | (B & D) | (C & D)) + E + W[i] +
-    0x8f1bbcdc;
-  E = D;
-  D = C;
-  C = (B << 30) | (B >> 2);
-  B = A;
-  A = T;
-  }
-
-for (i = 60; i < 80; i++)
-  {
-  unsigned int T;
-  T = ((A << 5) | (A >> 27)) + (B ^ C ^ D) + E + W[i] + 0xca62c1d6;
-  E = D;
-  D = C;
-  C = (B << 30) | (B >> 2);
-  B = A;
-  A = T;
-  }
-
-base->H[0] += A;
-base->H[1] += B;
-base->H[2] += C;
-base->H[3] += D;
-base->H[4] += E;
-}
-
-
-
-
-/*************************************************
-*     Process the final text string              *
-*************************************************/
-
-/* The string may be of any length. It is padded out according to the rules
-for computing SHA-1 digests. The final result is then converted to text form
-and returned.
-
-Arguments:
-  base      pointer to the sha1 storage structure
-  text      pointer to the final text vector
-  length    length of the final text vector
-  digest    points to 16 bytes in which to place the result
-
-Returns:    nothing
-*/
-
-void
-sha1_end(sha1 *base, const uschar *text, int length, uschar *digest)
-{
-int i;
-uschar work[64];
-
-/* Process in chunks of 64 until we have less than 64 bytes left. */
-
-while (length >= 64)
-  {
-  sha1_mid(base, text);
-  text += 64;
-  length -= 64;
-  }
-
-/* If the remaining string contains more than 55 bytes, we must pad it
-out to 64, process it, and then set up the final chunk as 56 bytes of
-padding. If it has less than 56 bytes, we pad it out to 56 bytes as the
-final chunk. */
-
-memcpy(work, text, length);
-work[length] = 0x80;
-
-if (length > 55)
-  {
-  memset(work+length+1, 0, 63-length);
-  sha1_mid(base, work);
-  base->length -= 64;
-  memset(work, 0, 56);
-  }
-else
-  {
-  memset(work+length+1, 0, 55-length);
-  }
-
-/* The final 8 bytes of the final chunk are a 64-bit representation of the
-length of the input string *bits*, before padding, high order word first, and
-high order bytes first in each word. This implementation is designed for short
-strings, and so operates with a single int counter only. */
-
-length += base->length;   /* Total length in bytes */
-length <<= 3;             /* Total length in bits */
-
-work[63] = length         & 0xff;
-work[62] = (length >>  8) & 0xff;
-work[61] = (length >> 16) & 0xff;
-work[60] = (length >> 24) & 0xff;
-
-memset(work+56, 0, 4);
-
-/* Process the final 64-byte chunk */
-
-sha1_mid(base, work);
-
-/* Pass back the result, high-order byte first in each word. */
-
-for (i = 0; i < 5; i++)
-  {
-  register int x = base->H[i];
-  *digest++ = (x >> 24) & 0xff;
-  *digest++ = (x >> 16) & 0xff;
-  *digest++ = (x >>  8) & 0xff;
-  *digest++ =  x        & 0xff;
-  }
-}
-
-
-
-/*************************************************
-**************************************************
-*             Stand-alone test program           *
-**************************************************
-*************************************************/
-
-#ifdef STAND_ALONE
-
-/* Test values. The first 128 may contain binary zeros and have increasing
-length. */
-
-static uschar *tests[] = {
-  "",
-  "\x24",
-  "\x70\xf0",
-  "\x0e\x1e\xf0",
-  "\x08\x38\x78\x8f",
-  "\x10\x3e\x08\xfc\x0f",
-  "\xe7\xc7\x1e\x07\xef\x03",
-  "\xe0\xfb\x71\xf8\xf9\xc1\xfc",
-  "\xff\x7c\x60\x3c\x1f\x80\xe2\x07",
-  "\xf0\x3f\xc8\x60\x81\xfe\x01\xf8\x7f",
-  "\x9f\xc7\xf8\x1f\xc1\xe3\xc7\xc7\x3f\x00",
-  "\x00\x7f\xbf\xdf\xc0\xfe\x02\x7e\x00\xf8\x7f",
-  "\x01\x01\xc0\x1e\x03\xf8\x30\x08\x0f\xf3\xf9\xff",
-  "\xc4\x03\xfc\x0f\xf8\x01\xc0\x0f\xf0\x06\x10\x41\xff",
-  "\xff\x07\x80\x47\xfc\x1f\xc0\x60\x30\x1f\xe0\x3c\x03\xff",
-  "\x80\x3f\x84\x3e\xff\xc0\x3f\x0f\x00\x7f\xc0\x1f\xe7\xfc\x00",
-  "\xff\xe0\x7f\x01\x81\x81\xff\x81\xff\x00\x3e\x00\x20\x7f\x80\x0f",
-  "\x00\x3e\x00\x70\x1f\xe0\x0f\xfa\xff\xc8\x3f\xf3\xfe\x00\xff\x80\xff",
-  "\x7f\xef\xc0\x1e\x7c\xff\xe0\x1f\xfe\x00\x1f\xf0\x08\xff\xc0\x7f\xf0\x00",
-  "\xe0\x0f\x80\x07\x0c\x01\xff\xe0\x03\xf0\x2f\xf8\x3f\xef\x00\x78\x01\xfe\x00",
-  "\xe7\x00\x10\x00\xf8\x18\x0f\xf0\xff\x00\xff\x80\x3f\xc3\xfe\xf0\x0f\xfc\x01\xff",
-  "\x00\x1f\xf8\x0f\xfc\x00\xfc\x00\xff\x87\xc0\x0f\x80\x7b\xff\x00\x0f\x02\x01\xff\xc0",
-  "\x00\x0f\xf0\x03\xc7\xf8\x3e\x03\xff\x80\x03\xff\x80\x07\xff\x0f\xff\x1f\x83\xff\x80\x1f",
-  "\xff\xc0\x1f\x80\x3f\x9f\xf8\x78\x3e\x7f\xf8\x00\x3e\x20\x04\x3f\x80\x7f\xfc\x00\x1f\xfe\x00",
-  "\x3f\x07\x80\xe0\x07\xe0\x00\xfc\x7f\xc0\xc0\x0f\x8f\xf0\x80\x0e\x0e\x03\xff\xbf\xfc\x01\xff\xe0",
-  "\xff\xfc\x11\xfc\xe0\x0e\x1f\xff\x87\x80\x1f\xe0\xff\xfd\xff\xc0\x03\xff\xc0\x0f\x00\x07\xf0\x01\xff",
-  "\xf0\x07\xc1\xfe\x00\xf8\x01\xe7\x80\xff\x80\x3f\x1f\x7f\x8c\x00\x1c\x00\x0f\xf8\x07\xfc\x00\xff\xfc\x00",
-  "\x00\x0f\xf8\x3f\xc0\x60\x00\x7f\xf8\xff\x00\x03\xf0\x3c\x07\xc0\x7f\xe0\x3f\xf8\x01\x00\x7e\x03\xff\xc0\x00",
-  "\x00\x0f\xf8\x03\x00\x1f\xff\x00\x0f\xfe\x00\x3f\x00\x03\xff\xe0\x07\xc0\xff\x00\x3c\x7f\xf0\x01\xff\xf8\x3f\xff",
-  "\x00\x01\xe0\xe0\x1f\xfe\x00\x03\xfc\x00\x0f\xff\xe0\x0f\xff\x00\x0e\x00\x7f\xfc\x0f\xfe\x00\x78\x00\x3f\xff\x00\xff",
-  "\x80\x41\xff\xc3\xfe\x00\x1e\x00\x0f\xff\xe0\xff\x80\x0f\xe0\x00\x7f\xf7\xff\x01\xfe\x01\xff\xdf\xff\x00\x01\xff\xe0\x00",
-  "\xf8\x07\x00\xff\xc0\x7f\xbe\x00\x0f\xff\x00\x03\xe3\xf0\xff\xf0\x00\x1f\x81\xff\x80\x0f\xff\x80\x20\x03\xf0\x03\x80\xff\xfc",
-  "\x00\x38\x20\x00\x7f\xf0\x01\xff\xfe\xcf\xfe\x07\xff\xc0\x00\x7f\xf8\x1f\x00\x00\xc0\x00\xc0\x0f\xff\x3e\x0f\xc0\x0f\xff\x80\x00",
-  "\x1f\xf8\x07\xff\xf8\x03\xe0\x01\xff\xfc\x3f\xf8\x00\x38\x1f\x00\x3f\xdc\x01\xc0\x04\xff\xff\x00\x0f\xfc\x08\x02\x00\x01\xf0\x3f\xff",
-  "\x80\x07\x86\x00\x03\xff\xe0\x00\x3f\xf8\x00\x0f\x80\x0f\xf8\x0f\xff\xe0\x00\x1f\x80\x00\x7f\xf8\xc0\x0f\xff\xf0\x7c\x04\x07\xff\x00\x00",
-  "\x01\xff\x00\x18\x3e\x0f\x00\x07\xff\xc0\x00\xf0\x1f\xfe\x07\x80\x60\x0f\xf8\x00\x3f\xfe\x38\x1f\xc0\x00\x3f\x81\xff\xfc\x1f\xe0\x00\x3f\xff",
-  "\xf0\x3f\xff\xc0\x00\x7f\xf0\x00\x3f\xff\x0f\xe0\x07\x0f\xfc\x7e\x03\xff\xf0\xfc\x0f\x9f\xc0\x3f\xff\xcf\xff\x00\x00\xff\xc0\x00\xe7\x01\xff\xf8",
-  "\x00\x01\xff\x80\x20\x00\x7f\xe0\x00\x7e\x07\xff\xf8\xc7\xf8\xff\xf0\x0f\xfe\x00\x00\xe0\x0f\xe0\x00\x1f\xff\x87\xff\x00\x01\xf0\x00\x7f\xc1\xff\xff",
-  "\x00\x00\x7f\xff\xc0\x01\xfe\x7e\x01\xff\xfe\xff\xf0\x7f\xff\xcf\xf8\x07\xfe\x00\x0f\xff\xc0\x07\xff\xfc\x00\x3e\x00\x07\xfc\x00\x7f\xc0\x07\x80\x0f\xff",
-  "\xff\xff\x03\xff\x07\xf8\xff\xff\x80\x00\x7f\xfe\xff\xfe\x00\x03\xff\xf8\x1f\xff\x3f\xf8\x1f\xff\x00\x1f\xff\x0f\xc0\x7f\xf0\x01\xff\xe0\x00\x1f\xff\x00\x00",
-  "\xff\xff\x00\x00\xff\xfc\x00\x03\x0f\xff\xf0\x01\xf8\x00\x0f\xe1\xff\xff\x03\xe0\x3f\x1f\xff\x80\x00\x7c\x00\x01\xff\xc0\x01\x7f\xfe\x00\x0e\x07\xff\xe0\xff\xff",
-  "\xc0\x00\x3f\xfe\x03\xfc\x0c\x00\x04\x01\xff\xe1\xe0\x03\xff\xe0\x30\x01\xff\x00\x00\x3c\x1e\x01\x80\x01\xff\x00\x40\x3f\xfe\x00\x3f\xff\x80\x7c\x01\xff\x80\x00\x7f",
-  "\x3f\xa0\x00\x0f\xff\x81\xff\xc0\x0f\xf0\x7f\xf8\x00\x0f\xc0\x00\x7f\xe0\x01\xe0\x00\x04\xff\x00\x1f\xfe\x00\x01\xff\x80\x07\xff\xfe\x00\x3f\xff\xc0\x03\xff\x80\x00\x3f",
-  "\xf0\x1f\xff\x01\xff\x80\xff\xc0\x80\x07\xf0\x00\x03\xff\x80\x00\x18\x01\xff\xfc\x00\xff\xfc\x03\xff\xff\x00\x7f\xc0\x03\xff\xc7\xff\xc0\x03\xf0\xff\x80\x00\x3f\xfe\x00\x00",
-  "\x07\xf1\xbf\xff\xe0\x00\x78\x00\x07\xe0\x00\x80\x03\xf0\x3f\xf7\x00\x00\x38\x00\xfe\x00\xf8\x0f\xfe\x00\x00\x80\x3f\xff\xc1\xff\xfc\x00\xff\xff\x8f\xf0\x00\x1f\xff\xf0\x0f\xff",
-  "\x00\x1c\x00\x07\xff\xfc\x00\x5e\x3f\xff\x00\x00\x3c\xff\xff\xc0\x3f\xff\x81\xe0\x70\x00\x1f\xfc\x00\x03\xff\x00\x00\x7f\xff\xc0\x1f\x8c\x0f\xff\xf0\xff\x80\x07\xe0\x10\x01\xff\xff",
-  "\xc0\x00\x07\xff\x80\x7f\xff\x80\x01\x80\x3f\xff\xcf\xc0\xfe\x00\xff\xc0\x1f\xfc\x01\xff\xf8\x00\xff\xfe\x0f\xff\xf0\x06\x00\x00\xc0\x3f\xff\x80\x78\xff\xfc\x00\x0f\xff\xf0\x00\x0f\xff",
-  "\xff\xe0\x07\xff\xf8\x00\x7f\xf0\x1f\xff\x80\x01\xff\xf8\x1f\xf8\x01\x03\xff\xe0\x00\x03\xe0\x78\x0f\xff\x00\x0f\xfc\x1f\xf8\x00\x0f\xff\xe0\x1f\x00\x07\xff\xfc\x00\x1f\x03\xff\xf7\xff\xff",
-  "\xc0\xf8\x00\x03\xfe\x00\x3f\xff\xf0\x00\x03\xfc\x0f\xff\x80\x00\xe3\xff\xf8\x3f\xfe\x00\x00\x73\xe0\xff\xfc\x07\xff\xc3\xff\xfe\x03\x00\x00\x70\x00\x03\xff\xf8\x0f\xff\xe0\x00\x1f\xff\xf8\x00",
-  "\xff\xf0\x0f\xc7\xff\xfc\x00\x3f\xfe\x00\x00\x3f\xff\x80\x3f\x80\x00\x3f\xff\xc0\x00\x70\x01\xff\xc1\x80\x03\xff\xff\x80\x00\x61\xff\xfe\x03\xfd\x80\x3f\xff\xe0\x01\xc1\xff\xff\x80\x00\x0f\xfe\x00",
-  "\xff\xfc\x00\x03\xff\xf0\x0f\xf8\x00\x07\xdf\x8f\xff\xf8\x00\x01\xff\xfe\x00\x80\x00\xff\x80\x1f\xf0\x00\x01\x1c\x00\x00\x3f\xf8\x00\x3f\xff\xef\xff\xfe\x01\xc3\x80\x80\x01\xff\xff\xc0\x00\x07\xff\xff",
-  "\xff\xff\xc0\x01\xff\xc1\xff\xff\x87\xff\xff\x00\x3f\x00\x00\x1f\xfc\x00\x01\xff\x80\x1f\xc0\x1f\xff\x00\x00\xff\x80\x1f\xff\xf8\x7f\xf8\x3f\xff\xc1\xff\xff\xe0\x01\xc0\x3f\xf7\xff\xfe\xfc\x00\x00\x3f\xff",
-  "\x00\xff\x81\xff\xe0\x03\xf8\x0e\x00\x00\xff\xf8\x1f\xff\xfe\x00\x00\xff\x80\x00\x07\xff\xf8\x01\xff\xe0\x00\x0f\xf0\x01\xfe\x00\x3f\xf0\x7f\xe0\x00\x7f\xff\xe0\x1f\xff\xfc\x01\xff\xe0\x01\x80\x00\x07\xff\xff",
-  "\x00\x0f\xff\xf0\x00\x00\xe0\x0f\xf8\x00\x00\xff\xff\x80\x03\xff\xe1\xff\xff\x3f\xf8\x0f\xff\xc7\xe0\x00\x1f\xff\x00\x3f\xfe\x0f\xff\xf0\x03\x00\xc0\x00\x1f\xff\xfc\x3f\xff\xe0\x3f\xff\xf8\x1f\xf0\x00\x1f\xff\xc0",
-  "\x01\x80\x00\x1f\x01\xff\xff\x83\x00\x01\xfc\x00\x7f\xe0\x0e\x7f\xfe\x00\x00\x38\x00\xff\x00\x00\x3f\xff\x83\x83\xff\xc0\x00\x7f\xff\x80\x1f\xff\xf0\x1f\xff\xfc\x00\x03\x7f\xff\x81\xc0\x00\x07\xff\x83\xff\xff\x00\x00",
-  "\xff\x80\x0d\xff\xe0\x03\xff\xf0\x00\xff\xfc\x00\xf0\x01\xf8\x07\xff\xf8\x0f\x80\x0f\xff\xff\x00\xff\xff\x87\xff\xe1\xff\xfc\x67\x8c\x7f\xfe\x00\x03\xff\x3f\xfc\x07\x01\xff\xff\xe0\x00\x01\xff\xff\xc0\x0c\x40\x0f\xff\xff",
-  "\x00\x00\x1f\xff\xfe\x00\x1f\x00\x00\x1f\xff\xff\x07\xff\xff\xc0\x07\xff\xe0\x00\x02\x00\x00\xff\x00\x78\x00\x00\xe0\x00\x08\x00\x1f\xff\xff\x00\x03\xf8\x1f\x00\x00\x0f\xff\xc0\x00\x01\xff\xff\xe1\xf8\x00\x00\x3f\x80\x0f\xff",
-  "\x00\x0f\xf8\x00\xfc\x00\x03\xff\xff\x00\x00\x3f\xf0\x01\xff\xff\xe0\x7f\xf8\x00\xf8\x0f\xff\xff\x80\x00\x0f\xff\xfc\x0f\xff\xe0\x00\x00\xff\xc3\xff\xf0\x07\xff\xff\x00\x38\xf8\x00\x20\x1f\xfe\x3f\xfe\x00\xfe\x00\x7f\xff\xc0\x00",
-  "\x00\x3f\x00\xe0\x00\x0f\xff\xfc\x7f\xff\xfc\x00\x00\x7e\x00\x00\xff\xfe\x1f\xf0\x00\x1f\xf0\x00\x1f\xff\x87\xf0\x00\x3f\xc0\x0f\xff\x87\xff\x00\x3f\x81\xff\xff\xf7\xff\xe0\xff\xe0\x3f\x9f\xff\x00\x07\x00\x7f\xfc\x03\xff\xf0\x00\x00",
-  "\xe0\x3f\xff\xf0\xff\x80\x3e\x00\x03\xff\xe0\x00\x0f\xfc\x00\x07\xff\xf8\x00\x00\x7f\x80\x00\x0f\xf8\x01\xff\x7f\xff\xf0\x00\x3f\xff\xfe\x7f\xff\xe0\x00\xff\xc3\xff\xff\x00\x00\xf0\x00\x00\x7f\xff\x00\x3f\xff\xf0\x00\x01\xc0\x03\xff\xff",
-  "\x00\x03\xc0\x01\xff\xdf\xfd\xff\x9f\xfe\x1f\xff\xff\x00\x3f\xff\xfe\x00\x00\x7f\xcf\xff\xf0\x1f\xff\xfe\x07\xf0\x00\xff\xff\xe0\x00\x01\x00\x07\xff\x80\x1f\xe0\x00\x00\xff\xfe\x03\xff\xff\x80\x03\xf0\x0f\xff\xfe\x00\x00\x1f\xff\xf8\x00\x00",
-  "\x00\x1f\xff\xfb\xff\xfe\x00\x07\xff\xf0\x00\x00\xff\xff\x00\x00\x0f\xf3\xff\xfe\x00\x78\x00\x00\x3e\x00\x00\x3f\xff\xf8\x00\x1f\xff\xff\x80\x00\x03\xff\xff\x00\x07\xff\xee\x00\x1f\xfc\x00\x78\x00\x00\x1f\xff\x07\xff\xfe\x03\xff\xff\xe0\x00\x00",
-  "\x00\x7f\xff\xfe\x00\x00\x3f\xfc\x03\xff\xfc\x1f\xff\xf0\x7f\xd8\x03\xf0\x00\xfd\xfc\x38\x00\x08\x00\x10\x00\xe0\x06\x00\x7f\xfe\x00\x00\x0f\xff\x80\x00\x3f\x03\xff\xfe\xff\xff\xf9\xff\xf8\x00\x07\xff\xfc\x01\xff\xc0\x00\x03\xff\xff\xe0\x03\xff\xff",
-  "\xff\xf0\x0f\xff\xff\x00\x06\x00\xff\xff\xf0\x07\xff\xe0\x04\x00\x03\x00\x00\x03\xf0\xff\xff\x00\x03\xff\xfb\xff\xc3\xff\xf0\x07\xff\xff\xc7\x00\x7f\x80\x00\x03\xff\xf8\x00\x1f\xe1\xff\xf8\x63\xfc\x00\x3f\xc0\x9f\xff\xf8\x00\x00\x7f\xff\x1f\xff\xfc\x00",
-  "\x00\x3f\xff\xfc\x00\x0f\xc7\x80\x00\x02\x00\x1e\x00\x00\x60\x7f\x03\xfe\x00\x00\x1f\xff\x80\x1f\xf8\x00\x00\xff\xff\x80\x00\x03\xff\xc0\x00\x7f\xff\xc0\x7f\xe0\x03\xfc\x00\xff\xf7\xff\xff\x00\x00\x1f\xf0\x00\x03\xff\xff\xe1\xff\xff\x80\x0f\xf8\x00\x00\x1f",
-  "\x00\x01\xfe\x00\x03\x83\xf3\xff\xff\x80\x07\xff\xfc\x3f\xff\xfc\x03\xff\x80\x00\x06\x00\x00\x78\x00\x07\xff\xff\x80\x07\xfc\x01\xf8\x00\x07\xff\xff\xc0\x00\x38\x00\x07\xff\xfe\x3f\xff\xf8\x3f\xff\xcf\x3f\xfc\x00\x7f\xff\x00\x1f\xff\x80\x00\x30\x03\xff\xff\x00",
-  "\xf8\x00\x38\x00\x00\x3e\x3f\x00\x00\x3f\xff\xf0\x02\x00\x00\x0f\xff\xff\x80\x80\x03\xff\xc0\x00\x04\x00\x0f\xc0\x3f\xff\xfe\x00\x00\x3f\xff\xfe\x00\x3f\xff\xf8\x00\x30\x00\x7b\xff\x00\x00\x03\xff\xfc\x3f\xe1\xff\x80\x00\x70\x1f\xff\xc0\x07\xfc\x00\x1f\xff\xf0\x00",
-  "\x00\x03\xf8\x18\x00\x00\x70\x3f\xff\xf8\x00\x00\xff\xcf\xff\xff\xc0\x03\xff\xfe\x00\x10\x00\x00\xfe\x03\xff\xf8\x00\x00\x7e\x00\x00\x7f\x8f\xff\xc0\x00\x00\x7f\xff\xe0\x00\x3c\x07\xc0\x00\x00\x7f\xff\x01\xff\xf8\x01\xff\x80\x00\x0f\xff\xf9\xe0\x00\x3f\xff\xe0\x00\x00",
-  "\xff\xfe\x00\x3f\xc0\x1f\xff\xf0\x7f\xf8\x00\x01\xff\xf8\x1f\xff\xfe\x00\x00\xff\xff\xf8\x00\x7f\xff\x80\x3f\xff\xff\x00\x7f\xff\xf8\x00\x0c\x00\x00\x0f\xfe\x7e\x00\x3f\xe0\x18\x7f\xfe\x00\x00\x38\x00\x00\x3f\xff\xfe\x00\x00\x03\xfc\xff\xe1\xfe\x1f\xff\xfe\x00\x00\x07\xff",
-  "\x00\x00\x07\xff\xfe\x00\x00\x07\xfe\x00\x00\x3f\xe0\x00\x7f\xff\xc0\x00\x00\x7f\xff\xfc\x00\xfe\x00\x03\xff\xe0\x00\x1f\x0f\xfc\x00\x1f\xff\x80\x00\x07\xff\xff\xf0\x00\xff\xff\xf0\x00\x00\x1f\xff\xf8\x01\xff\xe0\x1f\xff\xff\x00\x1f\x80\x07\xf0\x00\x01\xff\xf8\x00\x01\xff\xff",
-  "\x00\x00\x3f\xff\xff\x03\xfe\x00\x00\x07\xc0\x00\x00\x7f\xfc\x0f\xf0\x00\x00\x1f\xff\xfe\x00\x00\x07\xc0\x00\x00\xff\xfe\x00\x00\x3f\xff\xfc\x01\xff\x7f\xfc\x00\x1f\xf8\x00\x1f\xff\x07\xff\xff\xe0\x00\x7f\xff\xfc\x01\xff\xff\xf0\x00\x01\xff\xf8\x00\x1e\x00\x00\x7f\xfc\x00\x3f\xff",
-  "\xfe\x3f\xff\x83\xff\xfe\x00\x07\xff\xff\xf0\x00\x3e\x00\x00\xff\xff\xfc\x00\x40\x3f\xfe\x00\x00\x03\xf0\x00\x00\x70\x3f\xf8\x0f\xff\xff\xe0\x1f\x80\x00\x03\xc3\xff\xff\xf0\x00\x01\xff\xf0\x0f\x80\x00\x0f\xe0\xff\xff\xfe\xf0\x00\x01\xff\xc0\x00\x00\x7f\xf0\x00\x00\x7f\xfe\xe0\x00\x00",
-  "\x00\x00\x03\xff\xf0\x01\xfc\x00\x00\xff\xff\x00\x00\x7f\xff\xff\x80\x07\xff\x8f\xff\x80\x00\x0f\xff\xf0\x00\x00\x3c\x00\x03\xc0\xff\xff\xfe\x01\xff\xff\x80\x0c\x7f\xff\xf8\x00\x00\x1f\xf0\x00\x00\x7f\x80\x00\x00\x80\x00\x00\xff\xff\xf0\x1f\xff\xe0\x00\xff\xff\xfe\x1f\xff\x1f\xc0\x00\x00",
-  "\xff\xff\xfe\x07\xff\xc0\x00\x06\x3f\x9f\xf0\x07\xff\xf0\x3f\xfe\x1f\xff\xff\x81\xff\xff\xc0\x00\x02\x00\xfe\x00\x04\x00\x07\x00\x00\x01\xff\xff\xfe\x00\x00\x07\xff\xfe\x00\x1f\xfe\x00\x00\xff\xff\xe0\x07\xf8\x00\xff\xff\xfc\x00\x3f\xf3\xff\xff\xc0\x00\x7f\xff\xe0\x00\x0f\xff\xfc\x07\xff\xff",
-  "\xff\xf0\x00\x00\x7e\x00\x1e\x03\xff\xff\x00\x00\x73\xff\xf0\x00\x00\x0f\xff\xdf\xff\xff\xdf\xfc\x00\x07\xfe\x07\xff\xfe\x00\x00\x1f\xdf\xef\xff\xf0\x3f\xff\xfc\x00\x00\x07\xff\xff\xf0\x00\x00\x7f\xe0\x07\xff\x80\x00\x00\x7f\xe0\x03\xff\xff\xf9\xff\xe0\x00\x00\x3f\xe3\xff\xff\xfc\x00\x00\x03\xff",
-  "\x00\x03\xff\x00\x00\x3f\xff\x80\x01\xf0\x00\x0f\xfe\x00\x00\x06\x00\x03\xff\xff\xfc\x03\xff\xff\xf7\x80\x00\x00\x7f\xc0\x0f\xff\xe3\xfe\x0f\x00\x00\x7f\xff\x00\x7f\xf8\x00\x00\xff\xff\xee\x00\x7e\x01\xc0\x00\x1f\xe0\x00\x07\xff\xff\xf8\x00\x00\xe1\xff\xfc\x3f\xe7\xff\xff\xf8\x3f\xff\xfc\x00\x1f\xff",
-  "\x00\x00\x0f\xff\xf8\x00\x00\xff\xff\xfc\x00\x1f\xe0\x07\xff\xff\x00\x01\xff\xdf\xff\x80\x00\x3f\xff\xfc\x00\x00\x0f\xfc\x07\xff\x00\x00\xff\x80\x00\x03\xff\xff\xf0\x00\x07\xff\xff\xf0\x00\xff\xfe\x1f\xff\xff\xe0\x3f\xff\xfe\x00\x00\x60\x00\x00\xff\xff\x7f\xff\xf0\x00\x03\xff\xff\xc0\x07\x00\x01\xff\xff",
-  "\x00\x00\x20\x7f\xfe\x0f\x83\xff\xff\x80\x03\xff\x00\x00\x00\xff\xff\xe0\x00\x1f\xff\xff\xe0\x00\x3f\xfe\x7f\xff\xf0\x00\x1f\xff\xff\xe0\x00\x00\xff\xff\x87\xff\xc0\x00\x17\xfd\xff\x9f\xff\xfb\xff\xff\xe0\x00\x03\xe0\x00\x07\xff\x9f\xff\xff\x80\x00\x7f\xff\xff\x00\x01\xff\xff\xc0\xff\xff\xc0\x10\x00\x00\x1f",
-  "\x00\x00\x07\xff\xc0\x00\xff\xe0\x00\x07\xff\x80\x03\x80\x00\x0f\xf8\x00\x00\x7f\xff\xfe\x00\x00\x18\x00\xff\xf0\x20\x01\xff\xfe\x00\x00\x60\x0f\xf0\xe0\x03\xff\xfe\x00\x3e\x1f\xff\xfc\x00\x03\xff\x80\x00\x00\xff\xf8\x00\x01\x00\x00\x0f\xf3\xff\xfc\x00\x03\xff\xff\xe1\xff\xff\xc1\xf0\x00\x00\xff\xff\xff\x00\x00",
-  "\xff\xff\xf0\x00\x00\x07\xff\xfc\x00\x7f\x87\xff\xff\x00\x00\x00\x7f\xff\xc0\x7f\xff\x80\x00\x03\xf0\xff\x3f\xff\x80\x30\x07\xff\xff\x1f\x8e\x00\x7f\xff\xff\xc0\x01\xff\xfc\x07\xf8\x00\x00\x7f\xff\xfc\x00\x3f\xf0\x00\xf8\x00\x00\x07\xff\x00\x00\x0e\x00\x0f\xff\x80\x00\x7f\xc0\x01\xff\x8f\xf8\x00\x07\x01\xff\xff\xff",
-  "\xff\x80\x3f\xff\x3f\xfe\x00\x00\xff\xff\xff\x9f\xff\xf8\x3f\xff\xf8\x00\x00\x0f\xf8\x00\x00\x03\xfe\x00\x7f\xff\xff\x00\x0f\xff\x01\xff\xf0\x0f\xff\xe0\x20\x7f\xff\xfc\xff\x01\xf8\x00\x07\xff\xe0\x00\x7f\xf8\x00\x0f\xff\x80\x00\x00\x7f\xe0\x00\x3f\xf8\x01\xfe\x00\x07\xff\xf0\x00\x00\x7f\xff\xff\xc0\x00\x01\xff\xff\xff",
-  "\x00\x7f\xff\xe0\x00\x01\xff\xff\xf8\x00\x00\x3f\xff\xfc\x00\x7f\xfe\x00\x00\x03\xff\xff\xf0\x03\xff\xe0\x00\x7f\x80\x00\x0f\xff\x3f\xf8\x00\x00\x7f\xff\xff\x00\x07\x80\x1f\x83\xf8\x00\x00\x0f\xfe\x3f\xff\xc0\x3f\xff\xfe\x1f\xe0\x00\x07\xc0\x03\xff\xf0\x0f\xc0\x00\x03\xff\xff\x80\x00\x00\x7f\x80\x00\x00\xff\xff\x80\x00\x00",
-  "\xfe\x00\x00\x20\x00\x04\x00\x0f\xff\xff\xc0\x01\xff\xf8\x3f\xc0\x00\x00\xff\xff\xc0\x00\xff\xff\xff\x80\x00\x3f\xf8\x00\x7f\xff\xfe\x7f\xf8\x00\x7f\xff\x80\x07\xff\xc0\x00\x0f\xff\xf8\x00\x7f\xff\xc0\x00\xff\xff\xc0\x3f\xff\xff\xe0\x0f\xff\xff\xe0\xe0\x1f\xff\x80\x00\x00\x7f\xff\xc0\x71\xff\xff\xfc\x00\x01\xff\xff\xf8\x00\x00",
-  "\xff\xff\xe0\x00\x0f\xff\xf0\x00\x00\x3f\xff\xff\xc0\x00\xff\xff\x00\x00\x0f\xff\xff\xe0\x00\x01\xff\x00\x00\x1f\xff\xe0\x3f\xfc\x00\x03\xe0\x1f\xf0\x1f\xf8\x00\x00\x3f\xff\xff\xc0\x0f\xfe\x00\x00\x20\x00\x00\xff\xfc\x00\x0f\xff\xfe\x3f\xff\xff\x00\xff\xf0\x00\x00\x80\x00\x1f\x03\xe0\x01\xff\xfa\x00\x3f\xe0\x00\x00\x70\x00\x00\x0f",
-  "\xfd\xff\xc0\x00\x20\x01\xfe\x00\x3f\xf8\x00\x03\xff\x00\x00\x03\xf8\xff\xcf\xc3\xff\xff\xfc\x00\x03\xff\xff\xfc\x00\x00\x78\x3f\xff\xf0\x01\xff\xe0\x0f\xff\xff\x00\x00\x07\xff\xff\xfc\xff\xff\xf8\x00\x01\xff\x80\x00\x07\xff\xff\xfc\x00\x00\x1c\x00\x01\xff\xff\x07\xf8\x00\x00\x1f\xff\xff\xf0\x00\x01\xfe\x00\x7f\xff\xf0\x1f\xfc\x00\x00",
-  "\x00\x00\x00\x3f\xff\x00\x00\x07\xff\xff\xfc\x00\x00\x01\xe0\x0f\xff\x83\xfc\x01\xff\xff\xf0\x0f\xff\x00\x00\x00\x3f\xff\xff\xc0\x1f\xff\xff\xe0\x00\x20\x00\x00\x3f\xff\xff\x00\x00\xff\xfc\x03\xff\xff\xf0\x00\x1f\xff\xfc\x00\x00\x03\xff\xff\xc0\x7f\x80\x00\xff\xff\xff\x00\x0f\x0f\xff\xff\xe0\x00\x00\xff\xf8\x00\x00\xff\xfe\x00\x00\x0f\xff",
-  "\xff\xfe\x03\x80\x00\x03\xff\xff\xc0\x3f\xff\xff\x00\x03\xff\xff\xf8\x00\x00\x01\xff\xff\xcf\xfc\x00\x00\xe0\xef\xf8\x00\x0f\xff\xe3\xf8\x00\x3f\xff\xff\x80\x3f\xbf\xfe\x00\x00\xff\xfc\x00\x00\x01\xff\x00\x00\xcf\xc0\x01\xfc\x00\x00\x7f\xff\xff\xc0\x00\x10\x7f\xff\xfc\xfe\x00\x00\x07\xc0\xff\xff\xff\x8f\xff\x00\x00\x1f\x9e\x00\x00\x01\xff\xff",
-  "\x00\x7f\xff\xe0\x00\x01\xff\xff\xc3\xff\x80\x01\x03\xfc\x00\x00\x00\xfc\x01\xff\xff\xf8\x7f\xe7\xf0\x00\x00\x7f\xc0\x3f\xff\xff\xc0\x00\x00\x1f\xff\x80\x00\x01\xff\xe0\x00\x00\x70\x00\x00\x1c\x7f\xff\xf8\x1f\xfc\x00\x00\x07\xef\xe0\xff\xff\xc1\xff\xfc\x00\x00\x01\xff\xff\xff\xa0\x07\xff\x00\x1e\x00\x1f\xfc\x00\x00\x38\x00\x18\xc0\x00\x00\x7f\xff",
-  "\x00\x0f\xff\xf8\x00\x00\x07\xff\x00\xfc\x00\x00\x03\xff\xfc\x00\x07\xff\xff\xe0\x00\x00\xff\xfc\x0f\xff\x00\x00\x0f\xff\xfe\x0f\x80\x07\xff\x03\xff\xff\xf9\xff\xfe\x00\x00\x03\xf8\x00\x00\x07\xe0\x00\x00\xc0\x00\x1f\xff\xf0\x7f\xff\xff\xc0\x07\xff\xff\xfc\x00\x00\x3f\xff\xff\xe0\x00\x00\x1f\xff\xf8\x1f\xfe\x00\x00\x3f\xff\xff\xe0\x3f\x06\x00\x00\x00",
-  "\xff\xf0\x00\x08\x00\x0f\xef\xff\xff\xfc\x00\x00\x7f\xff\xf0\x00\x7f\xff\xf8\x00\xff\xff\x81\xff\xff\xe0\xff\xff\xff\x00\x00\x00\x80\x00\x03\xff\x80\x3f\xff\xfc\x00\x00\x1f\xff\xc0\x0f\xff\xfe\x00\x00\x00\x73\xf0\x1f\xfe\x00\xff\xc0\x3f\xff\x00\x3f\xff\x83\xff\xfe\x01\xff\xff\xf7\xff\xff\x80\x00\x00\x3f\x00\x00\x1f\xe3\xff\xff\xf0\x00\x0f\xff\xf0\x00\x00",
-  "\x00\x00\x7f\xfc\x00\x7f\xe0\x00\x0f\xff\xe0\x01\xf8\x00\x3f\xff\x00\x00\x78\x00\x7f\xe0\x00\x00\x1f\x00\x07\xff\xff\xf8\xf9\xf0\x01\xff\xf8\x07\xc0\x0f\xff\xf8\x00\x07\xf8\x7f\xfe\x00\x00\x0f\xff\xe3\xf0\x00\x07\xff\xff\xfc\x03\x1c\x00\x00\x7f\xe0\x00\xff\xff\xfc\x00\x00\x0f\xf3\xff\xe0\x00\x00\x0f\xff\xf9\x00\x00\x10\x00\x3f\xff\xfc\xf8\x7f\xff\x00\x00\x00",
-  "\x00\x03\xff\xff\xc0\x7f\xff\xff\xc0\x00\x03\xff\xff\xff\x00\x00\x0f\xff\xf0\x1f\xff\xf0\x00\x07\xff\xff\xef\xff\x81\xf7\xff\xfe\x00\x07\xff\xf0\x00\x00\x1f\xff\xc0\x0f\x80\x00\x0f\xff\xfc\x00\x00\xff\xff\xff\xc0\x03\xff\xe3\xff\xff\xfe\x00\x1f\xff\xff\x00\x00\xff\xff\xff\x0f\xff\xf1\xf8\x00\x00\x01\xff\xff\xff\x80\x1f\xff\xfe\x00\x08\x00\x00\x7f\xff\xff\x80\x00",
-  "\x1f\xe0\x00\x7c\x1f\xc0\x07\xff\xc0\x07\xff\xff\xfe\x00\x3c\x00\x00\x00\xff\xff\x80\x00\x07\xff\xff\x00\x1f\xf8\xff\xc0\x00\xff\x81\xff\x01\xff\xfe\x00\x78\x7f\xff\xf0\x00\x01\x80\x00\x00\x1f\xff\x00\x00\x1f\xff\xf0\x00\x1f\xff\xff\xe0\x00\x3c\x00\x00\x1f\xff\xff\x80\x03\xff\xe0\x01\xff\xff\xf9\xff\xf8\x00\x00\x7c\x00\x00\xfe\x00\x00\xff\xff\xff\x00\x00\x0f\xff\xff",
-  "\xfc\x00\x01\xff\x00\x00\x0c\x00\xff\xff\xe3\xff\xff\xf0\x80\x0e\x0e\x00\x00\x0f\xfe\x00\x03\xff\xc0\x00\x00\x7f\xff\xff\xe0\xc0\x00\x00\x07\xe0\xff\xff\x03\x9f\xff\xff\xc1\xc0\x00\x03\xff\xff\xc3\xff\xff\xfc\xff\xff\xc0\x00\x01\xfc\x00\x0f\xfc\x00\x00\x00\x7f\xff\xff\x03\xff\xff\xfc\x0f\xff\xfe\x00\x00\x03\x80\x3f\xff\xff\x00\x00\xff\xff\xf8\x00\x03\xff\xff\x80\x00\x00",
-  "\xff\xff\x80\xff\xff\xf8\x00\x00\xfc\x00\x03\xff\xf8\x00\x0f\xff\xff\x00\x03\x00\x00\x00\x7f\xff\xf0\x00\x3f\xff\xf0\x00\x01\xfc\x01\x00\x03\xff\x80\x1f\xff\xe3\xff\xff\xf8\x00\x1f\xff\xff\xf8\x01\xff\xdf\xff\xfb\xff\xc0\x00\x00\x3f\xff\xf8\x00\x00\x80\xc7\xff\xff\xf8\x0f\xff\x00\x60\x1f\xff\xe0\x00\x01\xff\xff\xfe\x0f\xff\xff\xfc\x00\x00\x00\xf0\x06\x03\xff\xff\xfe\x00\x00",
-  "\xff\x00\x0f\xff\xfc\x00\x0f\xff\xff\xfc\x07\xff\xfc\x00\x00\xf0\x00\x00\x80\x00\x7f\xfe\x00\x00\x0f\xff\xff\xfc\x3f\x00\xff\xff\xff\x00\x1f\xff\xff\xf0\x00\x1f\xff\xff\xe0\x00\x1f\xff\xff\xc3\xff\x00\x00\x01\xff\xff\xf0\x00\x00\x0f\xff\xe0\x07\xfc\x00\x00\x00\xfe\x00\x07\xff\xff\xf8\x00\x00\x3f\x00\x00\x0f\x80\x00\x3f\xff\xc0\x00\x11\xff\xef\x00\x07\x00\x7f\xff\xfc\x00\x00\x00",
-  "\xfe\x00\x00\x7f\xf7\xff\xff\x00\x00\x0f\xff\xff\xe0\x01\xff\xe0\x00\x00\x03\xff\xe0\x00\xff\xfe\x00\x01\xff\xf7\xff\xf8\x00\x0f\xff\x00\x00\x00\x38\x00\x07\xff\xf8\x07\xff\xfc\x00\x1f\xff\xff\x0f\xc1\xff\xff\xc0\x00\xff\xff\x0f\xff\xf0\x01\xff\xf8\x00\x01\xff\xff\x80\x00\x00\x0f\xf8\x00\x3f\xff\xfe\x3f\xff\xff\xf0\x00\x00\x38\x0f\xc3\xff\xff\xff\x1f\xff\xc0\x3f\xff\xff\xe0\x00\x00",
-  "\xff\xff\xf0\x00\x7f\xc0\x07\xff\xff\x81\xff\xc0\x00\x01\xff\xff\xff\xc0\x00\x00\x1f\xff\xfe\x03\xc0\x00\x0f\xff\xff\xfc\x00\x03\xff\xff\xff\x83\xff\xc0\x00\x07\xf0\x00\x00\x1f\x80\x00\x00\x3f\xff\xff\xe7\xff\x00\x07\xff\xff\xfc\x00\x00\x1f\xff\xf8\x00\x03\xf0\x00\xff\xfc\x00\x1f\xff\xff\xe0\x03\xff\xf0\x00\x01\xff\xff\xff\x80\x00\x00\x0f\xff\xff\xf8\x10\x00\x1e\x03\xff\xff\xff\x80\x00",
-  "\x00\x01\xff\xfe\x00\x00\x00\x7f\xff\xff\xf0\x00\x00\x1f\xff\x80\x07\xff\xff\xff\x80\x00\x01\xff\xfc\x03\xff\xff\x9f\xff\xfe\x00\x08\x00\x00\x06\x00\x00\x00\x81\xff\xff\xc0\x00\x07\xf8\x00\xff\xff\xff\x00\x00\x00\xff\xff\xf8\x00\x3f\xff\xff\xf8\x3f\xf8\x00\x00\x00\x7f\xff\xc0\x7f\xff\xff\xc0\xff\xff\xfe\x00\x00\x01\xff\xf8\x00\x00\x03\xff\xc1\xff\xf0\x00\x00\x03\x07\xf8\x01\xff\xfe\x00\x00",
-  "\xf8\x00\x00\x01\xff\xff\x80\x00\x0f\xff\xff\x8f\xff\x00\x1f\xff\x0f\xff\xc0\x00\x00\xff\xff\xfc\x00\x0f\xff\xf0\x00\x70\x00\x00\x3f\xff\xc0\x00\x00\x7c\x00\x00\x7e\x00\x0f\xfc\x00\x00\x00\xff\xff\x80\x00\x00\x0f\xff\xff\xfc\x38\x00\x00\x03\xf0\x00\x31\xf0\x1f\xff\xff\xc0\x07\xff\xff\xe0\x1f\xff\xff\xf3\xfe\x00\x00\x00\xff\xff\xc0\x00\x1f\xe7\xff\xe1\xff\xff\xdf\x00\x00\x00\x1f\xff\x00\x00\x00",
-  "\x3f\xff\xff\xf8\x00\x00\x00\x60\x00\x0f\xff\xff\xe0\x07\xff\xff\xff\x00\x00\x3f\xff\xff\xf0\x1f\xff\xff\x80\x00\x70\x00\x00\x01\x00\x00\x00\x3f\xff\xfe\x00\x00\x00\x1f\xf8\xfc\xc0\x0f\xff\xf8\x00\x3f\xff\xc0\xff\xff\x80\x00\x03\xff\xff\xf8\x00\x3f\xff\xfc\x00\x00\x0f\x81\xff\xc0\x03\xff\xc0\x3f\xff\xff\x80\x03\xff\xfe\x00\xff\xff\xfe\x00\x00\x1c\x00\x00\x00\x3f\xff\xff\xf8\x00\x7f\xff\xc0\x00\x00",
-  "\x00\x00\x00\x0f\xff\xfe\x0f\xff\xff\x87\xff\xff\xff\x00\x80\x00\x0f\xff\xc0\x00\x03\xf0\x1f\xf7\xe0\x00\x00\x70\x00\x01\xff\xff\xff\x80\x01\xfe\x07\xf0\x00\x01\xff\xfc\x00\x00\x04\x00\x01\xff\xfe\x07\xff\xff\xfe\x00\x07\xc0\x00\x00\xff\xff\xff\x87\xf0\x03\xff\xfc\x00\x00\x1f\xf8\x00\x01\xff\xff\xc0\x00\x00\x3f\xff\xc0\x00\x00\x7f\x8f\xff\xf8\x00\x00\x00\x7f\xff\xe0\x06\x0e\x00\x00\x0f\xff\xff\x80\x00",
-  "\x03\xff\xff\xfd\xe0\x00\x00\x1f\xff\xf8\x01\xff\xff\xfb\xff\xff\xe0\x01\xf0\xf0\x00\x00\xff\xff\xff\x80\x00\x00\x7f\xff\xff\xe0\x1f\xff\xff\xf0\x01\x80\xff\xff\xff\xe0\x00\x00\x7f\xff\xf0\xff\xff\xc0\x00\x00\x07\xfe\x00\x00\x00\x1e\x00\x1f\xff\xff\xe0\x1f\xff\xe0\x01\xff\xc0\x00\x3f\xff\xe0\x00\x00\x0f\xf0\x00\xff\xff\x7f\xc0\x1f\xf8\x3f\xff\xff\xc0\x00\x00\x7f\xff\xe0\xff\xfc\x00\x00\xff\x0f\xff\xff\xff",
-  "\x07\xff\xfc\x03\xff\xff\xff\xdf\xff\xff\x87\xff\x18\x00\x03\x80\x01\xff\x00\x00\x00\x1f\xff\x00\x00\x3f\xff\xff\xc0\x1f\xe0\x3f\xff\xff\xfc\x00\x00\x01\xff\xf8\x00\x00\x3f\xff\xff\xf8\x00\x00\x07\xe0\x00\x07\xff\xf9\xff\xe0\x00\x3f\xe0\x00\x7f\xef\xf0\x00\x07\x81\xff\xfc\x00\x00\x00\xff\xe0\x00\x30\x00\x00\x00\xff\xff\xf0\x00\x00\x03\xff\xfc\x7f\x07\xf8\x03\xff\xff\xff\x00\x3f\xfc\x00\x00\x01\xff\xc0\x00\x00",
-  "\x00\x7f\xfc\x00\x00\x03\xff\xf8\x00\x00\x61\xfe\x7f\xff\xfe\x00\x00\x1f\xff\xfc\x3f\xff\x80\x01\xff\xff\xff\xe0\x00\xff\xff\xff\x80\x1f\xf8\x00\x7f\xff\xff\xf8\x00\x00\x07\xff\xff\xe0\x00\x00\x07\xff\xff\xff\x80\x00\xff\x80\x0f\xff\xff\xfc\x00\x00\x7f\xff\xfe\x00\x00\x00\x30\x00\x00\x7f\x80\x00\x07\xff\xff\xf0\x00\x00\x03\xff\xc0\x0f\xff\xff\x80\x3f\xff\x80\x03\xff\xff\xfe\x03\xff\xff\xff\x7f\xfc\x1f\xf0\x00\x00",
-  "\x1f\xf0\x00\x00\x7f\xff\xfe\x02\x00\x00\x03\xff\xff\xff\xd8\x07\xff\xff\xe0\x01\xff\xff\x80\x00\x00\x07\xc0\x00\x0f\xff\xc0\x7f\xf0\x00\x07\xff\xff\x80\x00\x07\xf0\x00\x00\x7f\xfc\x03\xff\xff\xff\xc0\x00\x01\xff\xff\xf9\xff\xfe\x00\x00\x1f\xff\xc0\x00\x00\x03\xfe\x3f\xff\xff\x00\x07\xfe\x00\x00\x03\xc0\x00\x3f\xf8\x00\x10\x03\xfc\x00\x0f\xff\xc0\x00\x7f\xff\xe0\x00\xff\xf0\x00\x00\x7f\xff\xe0\x00\x00\x0f\xff\xff\xff",
-  "\xff\xff\xff\xf8\x00\x00\x60\x00\x00\x00\xff\xff\xfc\x03\xff\xfc\x00\x00\x3c\x00\x3f\xe0\x7f\xf8\x00\x07\xff\xf8\x0f\xf8\x00\x00\x7f\xff\xff\xfc\x00\x7f\xc2\x00\x03\xff\xff\xfe\x00\x01\xff\xff\xff\xf0\x03\xff\xff\xf0\x18\x07\xc0\x00\x0f\xff\xc0\x00\x00\x7f\xff\xff\x87\xe0\x00\x00\x07\x00\x1f\x80\x04\x07\xff\xe0\x00\x00\x1f\xff\x81\xff\x80\x00\x03\xff\xfc\x00\x00\x07\xff\xff\xff\xc0\x00\x00\x1f\x80\x01\xff\xff\x00\x00\x00",
-  "\x00\x0f\xfc\x1f\xf8\x00\x0f\xff\xff\xf8\x07\xff\xf1\xfc\x00\x1f\xff\xff\xf0\x00\x0f\xff\xdf\xff\xff\xff\x00\x00\x03\xff\xff\xff\x00\x01\xff\xff\xff\xc0\x10\x0f\xf0\x00\x00\x00\xfc\x00\x1f\x00\x07\x00\x01\xf0\x00\x00\x1f\xe0\x00\x00\x30\x7c\x3f\xff\xe0\x00\xff\xfc\x07\xff\xfc\x00\x3f\xff\xff\xf8\xff\xff\xc1\xfc\x1f\xff\xff\xf8\x00\x01\xff\xfc\x00\x00\x0f\xff\xff\xff\x00\x00\xff\xf8\x0c\x00\x00\x07\xff\xff\x00\x00\x00\x7f\xff",
-  "\xff\xff\x80\xff\xff\x00\x00\x00\x7f\xff\xff\x00\x1f\xfc\x00\x06\x00\x0f\xf8\x00\x00\x01\x80\x00\x00\x7f\xff\xff\xe0\x3f\xff\xff\xfc\x00\x60\x00\x00\x00\xfe\x00\x00\x07\xff\xff\xf0\x7f\xff\xff\xf8\x00\x00\x80\x00\x00\x0f\xff\xff\xff\xbf\xff\xff\xc0\x07\xff\xfe\x00\x00\x1c\x00\x1f\xfc\x07\x00\x01\xff\xff\x00\x00\x00\x80\x00\x1f\xff\x03\x80\x00\x00\x3f\xff\xff\xf8\x00\x07\xff\xff\xff\x80\x00\x1f\xff\xff\xe0\x1f\xff\xff\xc0\x00\x00",
-  "\xff\xff\xff\xf8\x00\x00\x00\x7e\x00\x00\x00\x1f\xff\x80\x07\xff\xff\xff\x80\x00\x00\x0f\xff\xff\xc3\xff\xf0\x00\x00\x04\x7f\xc0\x7f\xf0\x00\x3f\xff\x80\x00\x7f\xe0\x00\x03\xff\xc0\x00\x07\xff\x00\x00\x0f\xff\x80\x00\x00\x07\x80\x00\x00\x0f\xff\xff\xff\x01\xff\xff\xff\xc0\x03\xc0\x00\x00\x03\xff\xff\xe0\x00\x0f\xff\xff\xc0\x00\x03\xff\xfe\x00\x03\xff\xf8\x00\x00\x0f\xff\xff\xc0\x01\xff\xe0\x00\x00\xff\xff\xfc\x00\x00\x1f\xff\xff\xff",
-  "\xff\xf0\x00\x3f\xfc\x00\x00\xff\xff\xff\xe0\x1f\xc3\xfe\x00\x07\xff\xf8\x00\x0f\xf0\x01\xff\xff\xf0\x00\x00\xff\xc0\x0f\xff\xff\x80\x00\x00\xff\xff\xf3\xff\x80\x00\x00\x80\x08\x38\x00\x00\x0f\xff\xf0\x00\x1f\xff\xff\xfc\x00\x0f\x80\x00\x70\x00\x00\x31\xff\xff\xfe\x3f\xff\xf8\x00\x00\x00\x3c\x3f\xf0\x0f\xff\xff\x00\x03\xff\xfb\xff\xff\xff\x00\x0f\xff\xff\xfe\x00\x00\x00\xf0\x00\x00\x00\xff\xff\xfc\x00\x7f\xff\xf0\x00\x01\xff\xff\xfe\x00",
-  "\xff\xff\xf0\x0f\xf8\x3f\xff\xff\xe0\x00\x03\xff\xfe\x00\x00\x3f\xff\x80\xff\xff\xff\x00\x00\x00\xff\xff\xf8\xff\xff\xf0\x00\x0f\xf1\xff\xff\x00\x00\x00\x0f\xff\xfc\x00\x00\x00\x1f\xf0\x00\x00\x1f\xf0\x03\xff\xff\xff\xe1\xff\xe0\x00\x00\x1f\xff\xc1\xfe\x00\x00\x07\xff\xfc\x00\x00\x00\x1f\xfe\x3f\xc0\x00\x00\x01\xff\xfc\x00\x00\x1f\xff\xff\x0f\xe0\x00\x01\xfc\x00\xfe\x00\x00\x00\x7f\xe0\x00\x1f\xff\xff\xe0\x7f\x00\x0f\xf0\x00\xff\xfe\x00\x00",
-  "\x00\x7f\xff\xc0\x07\xff\xff\xff\x80\x07\xff\xff\xfe\x00\x00\x00\x7e\x00\x00\x00\x0f\xff\x80\x1f\xff\xfe\x07\xff\xff\xf0\x03\xc7\xff\xff\xfe\x00\x00\x00\x7f\xfe\x00\x00\x1f\xff\xfe\x00\x00\x00\xff\xfc\x00\x1f\xff\xc0\x00\x00\x3f\xff\x00\x1e\x00\x00\x03\xff\xff\xff\x80\x00\x00\x7f\xff\xf8\x03\xff\xfc\x00\x01\xff\xff\xfe\x00\x0f\xff\x02\x00\x07\xff\xff\xfe\x00\x00\x00\xfe\x01\xff\xff\xf7\xff\xff\x19\xff\xff\x00\x00\x07\xff\xc1\xff\x00\x00\x07\xff",
-  "\x00\x00\x00\x40\x00\x00\x07\xff\xff\xf8\x1f\xff\xff\xc0\x00\x3e\xff\xff\xf0\x00\x00\x00\x7f\xff\xfe\x00\x00\x00\xff\x80\x00\x00\x3f\xf1\xff\xff\xff\xe0\x00\x00\x01\xff\xff\xff\x00\x00\x1f\xff\xf8\x00\x07\xff\xff\xf8\x00\x1f\xff\xc1\xff\xff\xff\xe0\x01\xff\xff\xff\xe0\x00\x00\x07\xff\xff\xff\xcf\xff\xe0\x00\x3f\xe0\xff\xff\xc0\x00\x07\xff\xff\xe0\x01\xff\xfc\x3f\x00\x01\xff\xff\xfe\x00\x01\xff\x0f\xff\xff\xfc\x00\x00\x01\xff\xff\x80\x00\x00\x0f\xff",
-  "\xff\xff\xf0\xff\xff\xff\xc0\x03\x80\x00\x01\x00\x00\x03\xff\xff\xff\xf1\xff\xff\xff\xe0\x07\xfc\x00\x00\x03\xff\xf0\x00\x00\x00\x7e\x00\x00\x00\x07\x00\x3f\xff\xfc\x00\x0f\xc7\xff\xff\x00\x00\x07\xff\xff\xc0\x00\x00\x03\xff\xfc\x00\x00\xff\xe0\x00\x00\x00\x7f\xf0\x00\x00\xff\xff\xff\xfd\xff\x00\xff\xe0\xff\xff\xe0\x07\xff\xff\xf8\x7f\xff\xfe\x18\x00\x00\x01\xf0\x00\x1f\xff\xfe\x01\xc0\x01\xff\xff\xff\xf8\x00\x01\xfe\xff\xff\xff\x80\x00\x00\x07\xff\xff",
-  "\xff\xff\xf0\x00\x1f\xff\xff\x00\x00\x3f\xff\xf0\x00\xff\xff\x00\x07\xff\xff\xf8\x03\xff\xff\xe7\xff\xff\xff\x81\x00\x00\x01\xff\x00\x00\x3f\xff\xff\xf8\x00\x00\x00\xf0\x07\xff\xc0\x0f\xf0\x00\x3f\xff\xc0\x00\x7f\xf8\x00\xff\xfc\x00\x00\x1f\xff\x80\x1f\xfc\x00\x00\x01\xff\xff\x00\x00\x7f\xff\xff\xfe\x00\x00\x0f\xff\x80\x00\x00\x0f\xff\xff\xfc\x00\x00\x00\xff\xff\xfc\x00\x0f\xff\x80\x00\x3f\xff\xfe\x00\x00\x3f\xe0\x0f\xff\xff\x00\x00\x01\xff\xf0\x00\x00\x00",
-  "\xff\xc0\x00\x00\x03\xff\xff\xfc\x00\xff\xff\xfc\x00\x00\x00\x7f\xff\xff\x00\x00\x00\x1f\xe0\x00\x0f\xff\xc0\xf0\x00\x00\x7f\xff\xff\xe0\x00\x20\x1f\xff\xff\xff\x00\x00\x00\x1f\x80\x00\x00\x07\xff\xf1\xff\xff\xff\xc0\x00\x00\x1f\xff\xff\xf0\x00\x3f\xff\xf8\x00\x3f\xff\xff\xfe\x01\xff\xff\xfe\x7f\x9e\x00\x1f\xff\xfc\x00\x7f\xe0\x7f\xff\xff\xe0\x00\x7f\xff\xfe\x00\x00\x01\xff\xff\xff\xf8\x01\xff\xc0\x03\x00\x0f\xff\xf8\x00\x00\x0f\xf0\x0f\xff\x00\x00\x00\x0f\xff",
-  "\x00\x03\xff\xff\xff\xcf\xff\xf8\x7f\x8f\xff\xff\xfc\x01\xff\xff\xfc\x00\x00\x1f\xff\xff\xff\x80\x00\x00\x01\xff\xff\xe1\xff\xf0\x00\x00\x00\xff\xff\xff\xf8\x03\x80\x00\x3f\x80\x00\x0f\xff\xff\xff\xc0\x00\x00\x02\x7f\xff\xf8\x03\xff\xc0\x00\x00\x3f\xff\x80\x00\x00\x01\xff\xff\xe0\x00\x00\x03\x80\x00\x00\xff\xe0\x7f\xff\xff\xfc\x00\x00\x01\xff\xff\xfc\x00\x00\x00\xff\xff\x80\x00\x07\xfe\x00\x00\x07\xff\xf0\x00\x00\x1f\x80\x00\x00\x3e\x1f\xff\xff\xff\x9f\xff\xff\xff",
-  "\xff\xff\xfe\x00\x03\xff\xff\xff\x80\x01\xff\xff\xff\xa0\x3f\xff\xf8\x00\x7f\x03\xff\xff\xc0\x00\x0f\xff\xc3\xff\xf8\x00\x03\xff\xff\xff\xc0\x7f\xf0\x1f\xe0\x0f\xff\xff\xc0\x00\x1f\xfe\x0f\xff\xff\xe0\x00\x07\xff\xff\xfc\x00\x00\xfc\x00\x3f\xff\xff\xf0\x00\x00\x00\x3f\xfc\x00\x00\x00\x0f\xff\xc4\x00\x00\xff\xc0\x00\x03\xff\xff\xff\x80\x00\x03\xfc\x0f\xff\xff\xf0\x00\x00\x03\xff\xff\xc0\x07\xff\xff\xf8\x0c\x3f\xff\xf0\x00\x1f\xff\x80\x00\x00\x01\xff\xfe\x00\x00\x3f\xff",
-  "\x00\x00\x00\x1f\xff\xc3\xff\xff\x80\x00\x00\x3f\xff\xff\xfe\x00\x00\x00\x0f\xe0\x00\x7f\xff\xe0\x0f\xfe\x00\xff\xff\xff\xe0\x03\xff\xf8\x00\x00\x00\x3f\xe0\x00\x00\x01\xff\xff\xe7\xff\xff\xff\xe0\x00\x00\x07\xff\xff\xc0\x00\x1f\xe0\x00\x00\x01\xff\xff\x00\x00\x03\xff\xff\xff\xe0\x00\x00\x1f\xe0\x03\xff\xff\x00\x00\x00\x07\xff\xf0\x3f\x80\x00\x00\x0f\xff\xff\xfe\x00\x00\xff\xff\xff\x00\x00\x3f\xff\xff\x80\x0f\xff\xfe\x01\xff\xff\xff\xf8\x3f\xff\xff\xc0\x00\x00\xff\xff\xff",
-  "\xff\xff\xff\x80\x00\xff\xff\xff\xf0\x00\x00\x1f\x00\x3f\xff\xfe\x0f\xf0\x1c\x00\xff\xff\xe0\x00\x0f\xc0\x1f\xff\xc0\x00\x00\x01\xff\x80\xf7\xff\xf8\x00\x00\x3f\xff\xc0\x00\x00\x01\xff\xf0\x00\x03\xe3\xfc\x00\x07\xf8\x00\x00\x3f\xff\xff\xfe\x00\x00\x1f\x00\x00\x00\x18\x00\x3f\xff\xff\xf8\x0f\xe0\x00\x00\x00\x60\x00\x07\xff\xff\xfe\x00\x60\xff\xff\xff\xf8\x00\x00\x3f\xff\x80\x00\x00\x3f\xff\xff\xf0\x00\x00\x0f\xf0\x00\xff\xff\xf1\xff\x00\x3f\xff\xff\xff\x01\xff\xe0\x00\x00\x00",
-  "\xff\xff\xff\xfc\x00\x00\x00\xff\xff\xf0\x01\xff\xff\xf8\x00\x00\xff\xff\xff\xe7\xff\xf8\x01\xf8\x7f\xff\xff\x80\x00\x3f\xff\xfc\x00\x00\x01\xff\xff\xe0\x00\x3f\xc0\x00\x00\x7f\xff\xff\x00\x00\x0f\xff\xff\xff\xc0\x00\x0f\xff\xf1\xff\xff\xff\xf8\x00\x0f\xff\xff\xfc\x00\x00\x07\xff\xff\xff\x80\xff\xff\xf8\x07\xf0\x00\x00\x00\x1f\xff\xff\xff\xc0\x00\xff\xff\xff\xc0\x00\x0e\xff\xff\xff\xc0\x00\x00\x03\xff\xf8\x00\x00\x03\xff\x80\x00\x00\x00\xe0\x00\x00\x0f\xf8\x00\x00\x3f\xff\xff\xff",
-  "\x3f\x00\x03\xc0\x1f\x00\x00\x00\x0f\xf0\x00\x07\xff\xff\xef\x00\xfe\x00\x7f\xfe\x00\x00\x3f\xf0\x00\x3f\xc0\x00\x00\x07\xfc\x00\x00\x03\xff\xff\xff\x0f\xff\xff\xff\xc0\x07\xf8\x00\x00\xf8\x00\x00\x3f\x9f\xff\xff\xfc\x00\x00\x3f\xff\xc0\x00\x03\xff\xff\xc0\x00\x00\xff\xfc\x00\x1f\xff\xe0\x00\x00\x07\xff\xe0\x07\x00\x00\x00\x7f\xff\xfe\x00\x00\x00\xff\xff\xfe\x00\x00\x0f\xfc\x00\x07\xff\xf0\x00\x00\x00\x7f\x80\x03\xcf\xff\x80\x00\x01\xff\xff\xe0\x3c\x00\x00\x3f\xff\xff\xff\x80\x00\x00",
-  "\x30\x00\x00\x00\xff\xf8\x00\x00\xff\xfc\x00\x3f\xff\xff\x80\x00\x00\x0f\xcf\xff\xcf\xff\xff\xc0\xff\xff\xff\x80\x00\x00\x01\xff\xff\xff\xf0\x00\x00\x00\x1f\xff\x00\x03\xff\xfc\x00\x00\x00\x07\xff\x80\x00\x7f\xff\xff\xfe\x0f\xff\xc0\x00\x00\x00\x7f\xf0\xbf\xff\xff\xe0\x00\x00\xff\xf8\x00\x00\x01\xff\xff\xf8\x00\x00\x3e\x00\x00\x07\xff\xe0\x00\x00\x00\x80\x00\x03\x80\x01\xff\xff\xff\xf8\x60\x00\x00\x00\xff\xf0\x00\x1f\xff\xff\xc7\xff\xf0\x40\xff\xff\xfe\x00\x00\x07\xff\xdf\xff\x80\x00\x00",
-  "\xff\xff\xff\x83\xff\xf8\x1f\xff\x1f\xff\xff\x80\x0f\xff\xff\xe0\x00\x00\x00\x3f\xff\xff\xc0\xf8\x00\x00\x78\x00\x1c\x00\x00\x00\x1f\xe0\x00\x00\x00\xff\xff\xe0\x3f\xff\xff\xfe\x00\x00\x03\xff\xff\xfe\x00\x00\x00\x1f\xff\xfc\x00\x7f\xff\x00\x00\x00\x1f\xff\xff\x00\x02\x00\x00\x3f\xff\xfc\x00\x00\x00\xff\xf0\x1f\xfe\xff\xff\xc0\x01\xff\xff\xff\xf0\x00\x00\x00\xff\xff\xfe\x00\x00\x00\x0f\xff\xc0\x00\x00\x7f\x7f\xc0\x00\x00\x01\xff\xff\xfe\x0f\xff\xff\xff\xc0\x00\x0f\x80\x00\x00\x3f\xff\xff\xff",
-  "\xff\xff\xff\xfe\x00\x00\x00\xff\xf8\x0f\xff\xff\xf0\x00\x00\x07\xff\xff\xfb\xff\xc0\x00\x07\xfc\x07\xe0\x00\x00\x01\xff\xff\xe0\x00\x7f\xff\xff\xf8\x00\x00\x3f\xff\xf8\x00\x00\x00\x0f\xff\xff\x00\x00\x0f\xc0\x00\x00\x3f\xff\xf0\x00\x00\x01\xff\xff\xfe\x1f\xff\xf8\x00\x00\x20\x00\x00\x00\x3f\xff\xbf\xff\x9f\xff\xff\xfc\x3f\xff\xff\xf0\x00\x00\x07\x80\x00\x00\xff\xff\xe7\xff\xff\xff\xf0\x00\x00\x3f\xff\xff\xff\x00\x00\x07\xff\xff\xe0\xff\xff\xff\xe0\x01\xff\xff\xff\xf8\x00\x00\x00\x7f\xff\xff\xff",
-  "\x00\x00\x00\x1f\xff\xc0\x00\x0f\xff\xc0\x00\x00\x1f\xff\xc0\x00\x1f\xc0\x00\x00\x03\xff\x80\x00\x00\x07\xff\xff\xff\xc0\x00\x00\x00\x80\x00\x3f\xfc\x00\xc0\x00\x0f\xff\xff\x00\x00\x06\x00\x3f\xfc\x1e\x00\x1f\xff\xff\xf0\x00\x3e\x0f\xff\xff\xf0\x00\x00\x3f\xff\xf0\x00\x00\x00\x1f\xff\xc0\x00\x00\xff\xff\xff\xf8\x00\xe0\x00\x00\xff\xff\xff\xfe\x00\x00\x0f\xff\xff\xfe\x3f\xff\xff\xfc\x07\xfe\x00\x00\x00\xc0\x00\x7f\xff\xff\xfe\x00\xff\xff\xff\xfc\x07\xff\xff\xe0\x00\x3f\xe3\xff\xff\xc0\x00\x00\x3f\xff",
-  "\x00\x00\x00\x0f\xff\xc0\x00\x0f\xf8\x00\x00\x00\xff\xfc\x00\x00\x0f\xff\xff\xfe\x00\x00\x00\x03\xff\x00\xff\xfc\x07\xff\xf0\x1f\xff\xfe\x0f\xff\xff\xfd\xff\xff\xff\xf0\x1f\xff\xf0\x00\x07\xf8\xff\xf8\x00\x00\x00\xff\xff\xc0\x3f\xff\xff\xff\x80\x00\x00\x0f\xff\xff\xff\x00\x00\x03\xff\xff\xf0\x00\x07\xff\xff\x00\x00\x3f\xff\xf0\x01\xff\xff\xc0\x01\xff\xff\xff\x00\x3f\xff\xf8\x1f\xff\xff\xfe\x1f\xff\xff\xff\xc0\x00\x00\x7f\xe0\x00\x07\xff\xff\xfe\x00\x00\x00\x03\xe0\x07\xff\xc0\x03\xfc\x00\x07\xff\xff\xff",
-  "\xff\xff\xff\x00\x00\x03\xc0\x00\x00\x01\xff\xff\xf8\x00\x00\x00\x0f\xff\xff\xff\x00\x00\x0f\x00\x00\xff\xff\xf8\x80\x00\xf8\x00\x0f\xc0\x00\x00\x00\xe0\x00\x00\x00\xff\xff\xff\xf8\x0f\xff\xff\xfe\x00\x00\x18\x00\x00\x7f\xff\xff\xff\x00\x00\x03\xff\xff\xff\x00\x7f\xff\xff\xfc\x00\x03\xc0\x00\x00\x0f\xff\xff\xff\xf0\x00\x07\xff\xff\x80\x01\xff\xff\xff\xe0\x00\x0f\xff\xfe\x07\xff\xff\xf8\x00\xff\xff\xff\xc0\x00\x00\x03\xe0\x00\x07\xff\xf0\x0f\xff\xf0\x00\x00\xff\xff\xf8\x7f\xc0\x03\xc0\x3f\xff\xe0\x00\x00\x00",
-
-  /* These are zero-terminated strings */
-
-  "abc",
-  "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
-};
-
-static uschar *hashes[] = {
-  "DA39A3EE5E6B4B0D3255BFEF95601890AFD80709",
-  "3CDF2936DA2FC556BFA533AB1EB59CE710AC80E5",
-  "19C1E2048FA7393CFBF2D310AD8209EC11D996E5",
-  "CA775D8C80FAA6F87FA62BECA6CA6089D63B56E5",
-  "71AC973D0E4B50AE9E5043FF4D615381120A25A0",
-  "A6B5B9F854CFB76701C3BDDBF374B3094EA49CBA",
-  "D87A0EE74E4B9AD72E6847C87BDEEB3D07844380",
-  "1976B8DD509FE66BF09C9A8D33534D4EF4F63BFD",
-  "5A78F439B6DB845BB8A558E4CEB106CD7B7FF783",
-  "F871BCE62436C1E280357416695EE2EF9B83695C",
-  "62B243D1B780E1D31CF1BA2DE3F01C72AEEA0E47",
-  "1698994A273404848E56E7FDA4457B5900DE1342",
-  "056F4CDC02791DA7ED1EB2303314F7667518DEEF",
-  "9FE2DA967BD8441EEA1C32DF68DDAA9DC1FC8E4B",
-  "73A31777B4ACE9384EFA8BBEAD45C51A71ABA6DD",
-  "3F9D7C4E2384EDDABFF5DD8A31E23DE3D03F42AC",
-  "4814908F72B93FFD011135BEE347DE9A08DA838F",
-  "0978374B67A412A3102C5AA0B10E1A6596FC68EB",
-  "44AD6CB618BD935460D46D3F921D87B99AB91C1E",
-  "02DC989AF265B09CF8485640842128DCF95E9F39",
-  "67507B8D497B35D6E99FC01976D73F54AECA75CF",
-  "1EAE0373C1317CB60C36A42A867B716039D441F5",
-  "9C3834589E5BFFAC9F50950E0199B3EC2620BEC8",
-  "209F7ABC7F3B878EE46CDF3A1FBB9C21C3474F32",
-  "05FC054B00D97753A9B3E2DA8FBBA3EE808CEF22",
-  "0C4980EA3A46C757DFBFC5BAA38AC6C8E72DDCE7",
-  "96A460D2972D276928B69864445BEA353BDCFFD2",
-  "F3EF04D8FA8C6FA9850F394A4554C080956FA64B",
-  "F2A31D875D1D7B30874D416C4D2EA6BAF0FFBAFE",
-  "F4942D3B9E9588DCFDC6312A84DF75D05F111C20",
-  "310207DF35B014E4676D30806FA34424813734DD",
-  "4DA1955B2FA7C7E74E3F47D7360CE530BBF57CA3",
-  "74C4BC5B26FB4A08602D40CCEC6C6161B6C11478",
-  "0B103CE297338DFC7395F7715EE47539B556DDB6",
-  "EFC72D99E3D2311CE14190C0B726BDC68F4B0821",
-  "660EDAC0A8F4CE33DA0D8DBAE597650E97687250",
-  "FE0A55A988B3B93946A63EB36B23785A5E6EFC3E",
-  "0CBDF2A5781C59F907513147A0DE3CC774B54BF3",
-  "663E40FEE5A44BFCB1C99EA5935A6B5BC9F583B0",
-  "00162134256952DD9AE6B51EFB159B35C3C138C7",
-  "CEB88E4736E354416E2010FC1061B3B53B81664B",
-  "A6A2C4B6BCC41DDC67278F3DF4D8D0B9DD7784EF",
-  "C23D083CD8820B57800A869F5F261D45E02DC55D",
-  "E8AC31927B78DDEC41A31CA7A44EB7177165E7AB",
-  "E864EC5DBAB0F9FF6984AB6AD43A8C9B81CC9F9C",
-  "CFED6269069417A84D6DE2347220F4B858BCD530",
-  "D9217BFB46C96348722C3783D29D4B1A3FEDA38C",
-  "DEC24E5554F79697218D317315FA986229CE3350",
-  "83A099DF7071437BA5495A5B0BFBFEFE1C0EF7F3",
-  "AA3198E30891A83E33CE3BFA0587D86A197D4F80",
-  "9B6ACBEB4989CBEE7015C7D515A75672FFDE3442",
-  "B021EB08A436B02658EAA7BA3C88D49F1219C035",
-  "CAE36DAB8AEA29F62E0855D9CB3CD8E7D39094B1",
-  "02DE8BA699F3C1B0CB5AD89A01F2346E630459D7",
-  "88021458847DD39B4495368F7254941859FAD44B",
-  "91A165295C666FE85C2ADBC5A10329DAF0CB81A0",
-  "4B31312EAF8B506811151A9DBD162961F7548C4B",
-  "3FE70971B20558F7E9BAC303ED2BC14BDE659A62",
-  "93FB769D5BF49D6C563685954E2AECC024DC02D6",
-  "BC8827C3E614D515E83DEA503989DEA4FDA6EA13",
-  "E83868DBE4A389AB48E61CFC4ED894F32AE112AC",
-  "55C95459CDE4B33791B4B2BCAAF840930AF3F3BD",
-  "36BB0E2BA438A3E03214D9ED2B28A4D5C578FCAA",
-  "3ACBF874199763EBA20F3789DFC59572ACA4CF33",
-  "86BE037C4D509C9202020767D860DAB039CADACE",
-  "51B57D7080A87394EEC3EB2E0B242E553F2827C9",
-  "1EFBFA78866315CE6A71E457F3A750A38FACAB41",
-  "57D6CB41AEEC20236F365B3A490C61D0CFA39611",
-  "C532CB64B4BA826372BCCF2B4B5793D5B88BB715",
-  "15833B5631032663E783686A209C6A2B47A1080E",
-  "D04F2043C96E10CD83B574B1E1C217052CD4A6B2",
-  "E8882627C64DB743F7DB8B4413DD033FC63BEB20",
-  "CD2D32286B8867BC124A0AF2236FC74BE3622199",
-  "019B70D745375091ED5C7B218445EC986D0F5A82",
-  "E5FF5FEC1DADBAED02BF2DAD4026BE6A96B3F2AF",
-  "6F4E23B3F2E2C068D13921FE4E5E053FFED4E146",
-  "25E179602A575C915067566FBA6DA930E97F8678",
-  "67DED0E68E235C8A523E051E86108EEB757EFBFD",
-  "AF78536EA83C822796745556D62A3EE82C7BE098",
-  "64D7AC52E47834BE72455F6C64325F9C358B610D",
-  "9D4866BAA3639C13E541F250FFA3D8BC157A491F",
-  "2E258811961D3EB876F30E7019241A01F9517BEC",
-  "8E0EBC487146F83BC9077A1630E0FB3AB3C89E63",
-  "CE8953741FFF3425D2311FBBF4AB481B669DEF70",
-  "789D1D2DAB52086BD90C0E137E2515ED9C6B59B5",
-  "B76CE7472700DD68D6328B7AA8437FB051D15745",
-  "F218669B596C5FFB0B1C14BD03C467FC873230A0",
-  "1FF3BDBE0D504CB0CDFAB17E6C37ABA6B3CFFDED",
-  "2F3CBACBB14405A4652ED52793C1814FD8C4FCE0",
-  "982C8AB6CE164F481915AF59AAED9FFF2A391752",
-  "5CD92012D488A07ECE0E47901D0E083B6BD93E3F",
-  "69603FEC02920851D4B3B8782E07B92BB2963009",
-  "3E90F76437B1EA44CF98A08D83EA24CECF6E6191",
-  "34C09F107C42D990EB4881D4BF2DDDCAB01563AE",
-  "474BE0E5892EB2382109BFC5E3C8249A9283B03D",
-  "A04B4F75051786682483252438F6A75BF4705EC6",
-  "BE88A6716083EB50ED9416719D6A247661299383",
-  "C67E38717FEE1A5F65EC6C7C7C42AFC00CD37F04",
-  "959AC4082388E19E9BE5DE571C047EF10C174A8D",
-  "BAA7AA7B7753FA0ABDC4A541842B5D238D949F0A",
-  "351394DCEBC08155D100FCD488578E6AE71D0E9C",
-  "AB8BE94C5AF60D9477EF1252D604E58E27B2A9EE",
-  "3429EC74A695FDD3228F152564952308AFE0680A",
-  "907FA46C029BC67EAA8E4F46E3C2A232F85BD122",
-  "2644C87D1FBBBC0FC8D65F64BCA2492DA15BAAE4",
-  "110A3EEB408756E2E81ABAF4C5DCD4D4C6AFCF6D",
-  "CD4FDC35FAC7E1ADB5DE40F47F256EF74D584959",
-  "8E6E273208AC256F9ECCF296F3F5A37BC8A0F9F7",
-  "FE0606100BDBC268DB39B503E0FDFE3766185828",
-  "6C63C3E58047BCDB35A17F74EEBA4E9B14420809",
-  "BCC2BD305F0BCDA8CF2D478EF9FE080486CB265F",
-  "CE5223FD3DD920A3B666481D5625B16457DCB5E8",
-  "948886776E42E4F5FAE1B2D0C906AC3759E3F8B0",
-  "4C12A51FCFE242F832E3D7329304B11B75161EFB",
-  "C54BDD2050504D92F551D378AD5FC72C9ED03932",
-  "8F53E8FA79EA09FD1B682AF5ED1515ECA965604C",
-  "2D7E17F6294524CE78B33EAB72CDD08E5FF6E313",
-  "64582B4B57F782C9302BFE7D07F74AA176627A3A",
-  "6D88795B71D3E386BBD1EB830FB9F161BA98869F",
-  "86AD34A6463F12CEE6DE9596ABA72F0DF1397FD1",
-  "7EB46685A57C0D466152DC339C8122548C757ED1",
-  "E7A98FB0692684054407CC221ABC60C199D6F52A",
-  "34DF1306662206FD0A5FC2969A4BEEC4EB0197F7",
-  "56CF7EBF08D10F0CB9FE7EE3B63A5C3A02BCB450",
-  "3BAE5CB8226642088DA760A6F78B0CF8EDDEA9F1",
-  "6475DF681E061FA506672C27CBABFA9AA6DDFF62",
-  "79D81991FA4E4957C8062753439DBFD47BBB277D",
-  "BAE224477B20302E881F5249F52EC6C34DA8ECEF",
-  "EDE4DEB4293CFE4138C2C056B7C46FF821CC0ACC",
-
-  "A9993E364706816ABA3E25717850C26C9CD0D89D",
-  "84983E441C3BD26EBAAE4AA1F95129E5E54670F1"
-};
-
-static uschar *atest = "34AA973CD4C4DAA4F61EEB2BDBAD27316534016F";
-
-int main(void)
-{
-sha1 base;
-int j;
-int i = 0x01020304;
-uschar *ctest = (uschar *)(&i);
-uschar buffer[256];
-uschar digest[20];
-uschar s[41];
-printf("Checking sha1: %s-endian\n\n", (ctest[0] == 0x04)? "little" : "big");
-
-for (i = 0; i < sizeof(tests)/sizeof(uschar *); i ++)
-  {
-  printf("%d.\nShould be: %s\n", i, hashes[i]);
-  sha1_start(&base);
-  sha1_end(&base, tests[i], (i <= 128)? i : strlen(tests[i]), digest);
-  for (j = 0; j < 20; j++) sprintf(s+2*j, "%02X", digest[j]);
-  printf("Computed:  %s\n", s);
-  if (strcmp(s, hashes[i]) != 0) printf("*** No match ***\n");
-  printf("\n");
-  }
-
-/* 1 000 000 repetitions of "a" */
-
-ctest = malloc(1000000);
-memset(ctest, 'a', 1000000);
-
-printf("1 000 000 repetitions of 'a'\n");
-printf("Should be: %s\n", atest);
-sha1_start(&base);
-sha1_end(&base, ctest, 1000000, digest);
-for (j = 0; j < 20; j++) sprintf(s+2*j, "%02X", digest[j]);
-printf("Computed:  %s\n", s);
-if (strcmp(s, atest) != 0) printf("*** No match ***\n");
-
-}
-#endif
-
-/* End of sha1.c */
diff --git a/src/src/auths/tls.c b/src/src/auths/tls.c
index 51c096cd0..99c756374 100644
--- a/src/src/auths/tls.c
+++ b/src/src/auths/tls.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Jeremy Harris 2015 */
+/* Copyright (c) Jeremy Harris 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* This file provides an Exim authenticator driver for
@@ -71,7 +71,7 @@ if (ob->server_param1)
   auth_vars[expand_nmax++] = expand_string(ob->server_param1);
 if (ob->server_param2)
   auth_vars[expand_nmax++] = expand_string(ob->server_param2);
-if (ob->server_param2)
+if (ob->server_param3)
   auth_vars[expand_nmax++] = expand_string(ob->server_param3);
 return auth_check_serv_cond(ablock);
 }
diff --git a/src/src/base64.c b/src/src/base64.c
index 031beb923..cee77c3c3 100644
--- a/src/src/base64.c
+++ b/src/src/base64.c
@@ -5,7 +5,7 @@
 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004, 2015 */
 /* License: GPL */
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
diff --git a/src/src/blob.h b/src/src/blob.h
new file mode 100644
index 000000000..a3f1e24d4
--- /dev/null
+++ b/src/src/blob.h
@@ -0,0 +1,15 @@
+/*
+ *  Blob - a general pointer/size item for a memory chunk
+ *
+ *  Copyright (C) 2016  Exim maintainers
+ */
+
+#ifndef BLOB_H	/* entire file */
+#define BLOB_H
+
+typedef struct {
+  uschar * data;
+  size_t   len;
+} blob;
+
+#endif
diff --git a/src/src/buildconfig.c b/src/src/buildconfig.c
index 45e820c81..4ed287414 100644
--- a/src/src/buildconfig.c
+++ b/src/src/buildconfig.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2012 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -105,8 +105,10 @@ time_t test_time_t = 0;
 size_t test_size_t = 0;
 ssize_t test_ssize_t = 0;
 unsigned long test_ulong_t = 0L;
+unsigned int test_uint_t = 0;
 #endif
 long test_long_t = 0;
+int test_int_t = 0;
 FILE *base;
 FILE *new;
 int last_initial = 'A';
@@ -190,12 +192,17 @@ fprintf(new, "#define SSIZE_T_FMT  \"%%zd\"\n");
 #else
 if (sizeof(test_size_t) > sizeof (test_ulong_t))
   fprintf(new, "#define SIZE_T_FMT  \"%%llu\"\n");
-else
+else if (sizeof(test_size_t) > sizeof (test_uint_t))
   fprintf(new, "#define SIZE_T_FMT  \"%%lu\"\n");
+else
+  fprintf(new, "#define SIZE_T_FMT  \"%%u\"\n");
+
 if (sizeof(test_ssize_t) > sizeof(test_long_t))
   fprintf(new, "#define SSIZE_T_FMT  \"%%lld\"\n");
-else
+else if (sizeof(test_ssize_t) > sizeof(test_int_t))
   fprintf(new, "#define SSIZE_T_FMT  \"%%ld\"\n");
+else
+  fprintf(new, "#define SSIZE_T_FMT  \"%%d\"\n");
 #endif
 
 /* Now search the makefile for certain settings */
@@ -720,17 +727,16 @@ else if (isgroup)
     continue;
     }
 
-  /* WITH_CONTENT_SCAN is another special case: it must be set if either it or
-  WITH_OLD_DEMIME is set. */
+  /* WITH_CONTENT_SCAN is another special case: it must be set if it or
+  EXPERIMENTAL_DCC is set. */
 
   if (strcmp(name, "WITH_CONTENT_SCAN") == 0)
     {
     char *wcs = getenv("WITH_CONTENT_SCAN");
-    char *wod = getenv("WITH_OLD_DEMIME");
     char *dcc = getenv("EXPERIMENTAL_DCC");
-    if (wcs != NULL || wod != NULL || dcc != NULL)
-      fprintf(new, "#define WITH_CONTENT_SCAN     yes\n");
-    else fprintf(new, "/* WITH_CONTENT_SCAN not set */\n");
+    fprintf(new, wcs || dcc
+      ? "#define WITH_CONTENT_SCAN     yes\n"
+      : "/* WITH_CONTENT_SCAN not set */\n");
     continue;
     }
 
@@ -819,7 +825,11 @@ else if (isgroup)
             strncpy(buffer, ss, sss-ss);
             buffer[sss-ss] = 0;  /* For empty case */
             }
-          else strcpy(buffer, ss);
+          else
+	    {
+       	    strncpy(buffer, ss, sizeof(buffer));
+	    buffer[sizeof(buffer)-1] = 0;
+	    }
           pp = buffer + (int)strlen(buffer);
           while (pp > buffer && isspace((unsigned char)pp[-1])) pp--;
           *pp = 0;
diff --git a/src/src/child.c b/src/src/child.c
index 36d192e9a..7f5b90929 100644
--- a/src/src/child.c
+++ b/src/src/child.c
@@ -72,9 +72,9 @@ child_exec_exim(int exec_type, BOOL kill_v, int *pcount, BOOL minimal,
 {
 int first_special = -1;
 int n = 0;
-int extra = (pcount != NULL)? *pcount : 0;
+int extra = pcount ? *pcount : 0;
 uschar **argv =
-  store_get((extra + acount + MAX_CLMACROS + 16) * sizeof(char *));
+  store_get((extra + acount + MAX_CLMACROS + 18) * sizeof(char *));
 
 /* In all case, the list starts out with the path, any macros, and a changed
 config file. */
@@ -113,6 +113,11 @@ if (!minimal)
   if (synchronous_delivery) argv[n++] = US"-odi";
   if (connection_max_messages >= 0)
     argv[n++] = string_sprintf("-oB%d", connection_max_messages);
+  if (*queue_name)
+    {
+    argv[n++] = US"-MCG";
+    argv[n++] = queue_name;
+    }
   }
 
 /* Now add in any others that are in the call. Remember which they were,
diff --git a/src/src/config.h.defaults b/src/src/config.h.defaults
index 14de083fe..bafdc1ba4 100644
--- a/src/src/config.h.defaults
+++ b/src/src/config.h.defaults
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* The default settings for Exim configuration variables. A #define without
@@ -150,7 +150,7 @@ it's a default value. */
 
 #define TCP_WRAPPERS_DAEMON_NAME "exim"
 #define TIMEZONE_DEFAULT
-#define TMPDIR
+#define EXIM_TMPDIR
 
 #define TRANSPORT_APPENDFILE
 #define TRANSPORT_AUTOREPLY
@@ -169,7 +169,6 @@ it's a default value. */
 #define WHITELIST_D_MACROS
 
 #define WITH_CONTENT_SCAN
-#define WITH_OLD_DEMIME
 #define WITH_OLD_CLAMAV_STREAM
 
 /* EXPERIMENTAL features */
@@ -178,6 +177,8 @@ it's a default value. */
 #define EXPERIMENTAL_DCC
 #define EXPERIMENTAL_DSN_INFO
 #define EXPERIMENTAL_DMARC
+#define EXPERIMENTAL_LMDB
+#define EXPERIMENTAL_QUEUEFILE
 #define EXPERIMENTAL_SPF
 #define EXPERIMENTAL_SRS
 
@@ -195,7 +196,7 @@ just in case. */
 /* Sizes for integer arithmetic.
 Go for 64bit; can be overridden in OS/Makefile-FOO
 If you make it a different number of bits, provide a definition
-for EXIM_64B_MAX and _MIN in OS/oh.h-FOO */
+for EXIM_ARITH_MAX and _MIN in OS/oh.h-FOO */
 #define int_eximarith_t int64_t
 #define PR_EXIM_ARITH "%" PRId64		/* C99 standard, printf %lld */
 #define SC_EXIM_ARITH "%" SCNi64		/* scanf incl. 0x prefix */
diff --git a/src/src/configure.default b/src/src/configure.default
index ee94d2f91..985f1d0d8 100644
--- a/src/src/configure.default
+++ b/src/src/configure.default
@@ -40,6 +40,7 @@
 ######################################################################
 #                    MAIN CONFIGURATION SETTINGS                     #
 ######################################################################
+#
 
 # Specify your host's canonical name here. This should normally be the fully
 # qualified "official" name of your host. If this option is not set, the
@@ -329,6 +330,18 @@ timeout_frozen_after = 7d
 # accept_8bitmime = false
 
 
+# Exim does not make use of environment variables itself. However,
+# libraries that Exim uses (e.g. LDAP) depend on specific environment settings.
+# There are two lists: keep_environment for the variables we trust, and
+# add_environment for variables we want to set to a specific value.
+# Note that TZ is handled separateley by the timezone runtime option
+# and TIMEZONE_DEFAULT buildtime option.
+
+# keep_environment = ^LDAP
+# add_environment = PATH=/usr/bin::/bin
+
+
+
 ######################################################################
 #                       ACL CONFIGURATION                            #
 #         Specifies access control lists for incoming SMTP mail      #
@@ -500,7 +513,9 @@ acl_check_data:
   # Deny if the message contains an overlong line.  Per the standards
   # we should never receive one such via SMTP.
   #
-  deny    condition  = ${if > {$max_received_linelength}{998}}
+  deny    message    = maximum allowed line length is 998 octets, \
+                       got $max_received_linelength
+          condition  = ${if > {$max_received_linelength}{998}}
 
   # Deny if the message contains a virus. Before enabling this check, you
   # must install a virus scanner and set the av_scanner option above.
@@ -694,8 +709,8 @@ begin transports
 
 
 # This transport is used for delivering messages over SMTP connections.
-# Refuse to send any messsage with over-long lines, which could have
-# been receved other than via SMTP. The use of message_size_limit to
+# Refuse to send any message with over-long lines, which could have
+# been received other than via SMTP. The use of message_size_limit to
 # enforce this is a red herring.
 
 remote_smtp:
diff --git a/src/src/crypt16.c b/src/src/crypt16.c
index e8a4fe8a7..56353c326 100644
--- a/src/src/crypt16.c
+++ b/src/src/crypt16.c
@@ -44,31 +44,33 @@ static void dummy(int x) { dummy(x-1); }
 #include <crypt.h>
 #endif
 
-char *crypt16(char *key, char *salt)
+char *
+crypt16(char *key, char *salt)
 {
-       static char res[25];
-       static char s2[3];
-       char *p;
+static char res[25];	/* Not threadsafe; like crypt() */
+static char s2[3];
+char *p;
 
-       /* Clear the string of any previous data */
-       memset (res, 0, sizeof (res));
+/* Clear the string of any previous data */
+memset (res, 0, sizeof (res));
 
-       /* crypt the first part */
-       p = crypt (key, salt);
-       strncpy (res, p, 13);
+/* crypt the first part */
+if (!(p = crypt (key, salt))) return NULL;
+strncpy (res, p, 13);
 
-       if (strlen (key) > 8)
-       {
-               /* crypt the rest
-                * the first two characters of the first block (not counting
-                * the salt) make up the new salt */
-               strncpy (s2, &(res[2]), 2);
-               p = crypt (&(key[8]), s2);
-               strncpy (&(res[13]), &(p[2]), 11);
-               memset (s2, 0, sizeof (s2));
-       }
+if (strlen (key) > 8)
+  {
+  /* crypt the rest
+   * the first two characters of the first block (not counting
+   * the salt) make up the new salt */
 
-       return (res);
+  strncpy (s2, res+2, 2);
+  p = crypt (key+8, s2);
+  strncpy (res+13, p+2, 11);
+  memset (s2, 0, sizeof(s2));
+  }
+
+return (res);
 }
 #endif
 
diff --git a/src/src/daemon.c b/src/src/daemon.c
index f2c8dbfaf..bc33aec45 100644
--- a/src/src/daemon.c
+++ b/src/src/daemon.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions concerned with running Exim as a daemon */
@@ -161,23 +161,20 @@ DEBUG(D_any) debug_printf("Connection request from %s port %d\n",
 input stream. These operations fail only the exceptional circumstances. Note
 that never_error() won't use smtp_out if it is NULL. */
 
-smtp_out = fdopen(accept_socket, "wb");
-if (smtp_out == NULL)
+if (!(smtp_out = fdopen(accept_socket, "wb")))
   {
   never_error(US"daemon: fdopen() for smtp_out failed", US"", errno);
   goto ERROR_RETURN;
   }
 
-dup_accept_socket = dup(accept_socket);
-if (dup_accept_socket < 0)
+if ((dup_accept_socket = dup(accept_socket)) < 0)
   {
   never_error(US"daemon: couldn't dup socket descriptor",
     US"Connection setup failed", errno);
   goto ERROR_RETURN;
   }
 
-smtp_in = fdopen(dup_accept_socket, "rb");
-if (smtp_in == NULL)
+if (!(smtp_in = fdopen(dup_accept_socket, "rb")))
   {
   never_error(US"daemon: fdopen() for smtp_in failed",
     US"Connection setup failed", errno);
@@ -293,7 +290,6 @@ if ((max_for_this_host > 0) &&
   int other_host_count = 0;    /* keep a count of non matches to optimise */
 
   for (i = 0; i < smtp_accept_max; ++i)
-    {
     if (smtp_slots[i].host_address != NULL)
       {
       if (Ustrcmp(sender_host_address, smtp_slots[i].host_address) == 0)
@@ -309,7 +305,6 @@ if ((max_for_this_host > 0) &&
          ((smtp_accept_count - other_host_count) < max_for_this_host))
        break;
       }
-    }
 
   if (host_accept_count >= max_for_this_host)
     {
@@ -390,10 +385,10 @@ if (pid == 0)
   likely what it depends on.) */
 
   smtp_active_hostname = primary_hostname;
-  if (raw_active_hostname != NULL)
+  if (raw_active_hostname)
     {
-    uschar *nah = expand_string(raw_active_hostname);
-    if (nah == NULL)
+    uschar * nah = expand_string(raw_active_hostname);
+    if (!nah)
       {
       if (!expand_string_forcedfail)
         {
@@ -407,7 +402,7 @@ if (pid == 0)
         _exit(EXIT_FAILURE);
         }
       }
-    else if (nah[0] != 0) smtp_active_hostname = nah;
+    else if (*nah) smtp_active_hostname = nah;
     }
 
   /* Initialize the queueing flags */
@@ -523,10 +518,23 @@ if (pid == 0)
       }
     else
       {
-      mac_smtp_fflush();
+      if (smtp_out)
+	{
+	int i, fd = fileno(smtp_in);
+	uschar buf[128];
+
+	mac_smtp_fflush();
+	/* drain socket, for clean TCP FINs */
+	if (fcntl(fd, F_SETFL, O_NONBLOCK) == 0)
+	  for(i = 16; read(fd, buf, sizeof(buf)) > 0 && i > 0; ) i--;
+	}
       search_tidyup();
       smtp_log_no_mail();                 /* Log no mail if configured */
-      _exit((rc == 0)? EXIT_SUCCESS : EXIT_FAILURE);
+
+      /*XXX should we pause briefly, hoping that the client will be the
+      active TCP closer hence get the TCP_WAIT endpoint? */
+      DEBUG(D_receive) debug_printf("SMTP>>(close on process exit)\n");
+      _exit(rc ? EXIT_FAILURE : EXIT_SUCCESS);
       }
 
     /* Show the recipients when debugging */
@@ -582,15 +590,13 @@ if (pid == 0)
     very long-lived connections from scanning appliances where this is not the
     best strategy. In such cases, queue_only_load_latch should be set false. */
 
-    local_queue_only = session_local_queue_only;
-    if (!local_queue_only && queue_only_load >= 0)
+    if (  !(local_queue_only = session_local_queue_only)
+       && queue_only_load >= 0
+       && (local_queue_only = (load_average = OS_GETLOADAVG()) > queue_only_load)
+       )
       {
-      local_queue_only = (load_average = OS_GETLOADAVG()) > queue_only_load;
-      if (local_queue_only)
-        {
-        queue_only_reason = 3;
-        if (queue_only_load_latch) session_local_queue_only = TRUE;
-        }
+      queue_only_reason = 3;
+      if (queue_only_load_latch) session_local_queue_only = TRUE;
       }
 
     /* Log the queueing here, when it will get a message id attached, but
@@ -598,23 +604,20 @@ if (pid == 0)
 
     if (local_queue_only) switch(queue_only_reason)
       {
-      case 1:
-      log_write(L_delay_delivery,
+      case 1: log_write(L_delay_delivery,
                 LOG_MAIN, "no immediate delivery: too many connections "
                 "(%d, max %d)", smtp_accept_count, smtp_accept_queue);
-      break;
+	      break;
 
-      case 2:
-      log_write(L_delay_delivery,
+      case 2: log_write(L_delay_delivery,
                 LOG_MAIN, "no immediate delivery: more than %d messages "
                 "received in one connection", smtp_accept_queue_per_connection);
-      break;
+	      break;
 
-      case 3:
-      log_write(L_delay_delivery,
+      case 3: log_write(L_delay_delivery,
                 LOG_MAIN, "no immediate delivery: load average %.2f",
                 (double)load_average/1000.0);
-      break;
+	      break;
       }
 
     /* If a delivery attempt is required, spin off a new process to handle it.
@@ -651,8 +654,8 @@ if (pid == 0)
         if (geteuid() != root_uid && !deliver_drop_privilege)
           {
           signal(SIGALRM, SIG_DFL);
-          (void)child_exec_exim(CEE_EXEC_PANIC, FALSE, NULL, FALSE, 2, US"-Mc",
-            message_id);
+          (void)child_exec_exim(CEE_EXEC_PANIC, FALSE, NULL, FALSE,
+	    2, US"-Mc", message_id);
           /* Control does not return here. */
           }
 
@@ -668,10 +671,8 @@ if (pid == 0)
         DEBUG(D_any) debug_printf("forked delivery process %d\n", (int)dpid);
         }
       else
-        {
         log_write(0, LOG_MAIN|LOG_PANIC, "daemon: delivery process fork "
           "failed: %s", strerror(errno));
-        }
       }
     }
   }
@@ -682,14 +683,11 @@ failed. Otherwise, keep count of the number of accepting processes and
 remember the pid for ticking off when the child completes. */
 
 if (pid < 0)
-  {
   never_error(US"daemon: accept process fork failed", US"Fork failed", errno);
-  }
 else
   {
   int i;
   for (i = 0; i < smtp_accept_max; ++i)
-    {
     if (smtp_slots[i].pid <= 0)
       {
       smtp_slots[i].pid = pid;
@@ -698,7 +696,6 @@ else
       smtp_accept_count++;
       break;
       }
-    }
   DEBUG(D_any) debug_printf("%d SMTP accept process%s running\n",
     smtp_accept_count, (smtp_accept_count == 1)? "" : "es");
   }
@@ -715,7 +712,7 @@ manifest itself as a broken pipe, so drop that one too. If the streams don't
 exist, something went wrong while setting things up. Make sure the socket
 descriptors are closed, in order to drop the connection. */
 
-if (smtp_out != NULL)
+if (smtp_out)
   {
   if (fclose(smtp_out) != 0 && errno != ECONNRESET && errno != EPIPE)
     log_write(0, LOG_MAIN|LOG_PANIC, "daemon: fclose(smtp_out) failed: %s",
@@ -724,7 +721,7 @@ if (smtp_out != NULL)
   }
 else (void)close(accept_socket);
 
-if (smtp_in != NULL)
+if (smtp_in)
   {
   if (fclose(smtp_in) != 0 && errno != ECONNRESET && errno != EPIPE)
     log_write(0, LOG_MAIN|LOG_PANIC, "daemon: fclose(smtp_in) failed: %s",
@@ -866,10 +863,10 @@ while ((pid = waitpid(-1, &status, WNOHANG)) > 0)
   /* If it wasn't an accepting process, see if it was a queue-runner
   process that we are tracking. */
 
-  if (queue_pid_slots != NULL)
+  if (queue_pid_slots)
     {
-    for (i = 0; i < queue_run_max; i++)
-      {
+    int max = atoi(CS expand_string(queue_run_max));
+    for (i = 0; i < max; i++)
       if (queue_pid_slots[i] == pid)
         {
         queue_pid_slots[i] = 0;
@@ -878,7 +875,6 @@ while ((pid = waitpid(-1, &status, WNOHANG)) > 0)
           queue_run_count, (queue_run_count == 1)? "" : "es");
         break;
         }
-      }
     }
   }
 }
@@ -916,6 +912,7 @@ int *listen_sockets = NULL;
 int listen_socket_count = 0;
 ip_address_item *addresses = NULL;
 time_t last_connection_time = (time_t)0;
+int local_queue_run_max = atoi(CS expand_string(queue_run_max));
 
 /* If any debugging options are set, turn on the D_pid bit so that all
 debugging lines get the pid added. */
@@ -924,16 +921,13 @@ DEBUG(D_any|D_v) debug_selector |= D_pid;
 
 if (inetd_wait_mode)
   {
-  int on = 1;
-
   listen_socket_count = 1;
-  listen_sockets = store_get(sizeof(int *));
+  listen_sockets = store_get(sizeof(int));
   (void) close(3);
   if (dup2(0, 3) == -1)
-    {
     log_write(0, LOG_MAIN|LOG_PANIC_DIE,
         "failed to dup inetd socket safely away: %s", strerror(errno));
-    }
+
   listen_sockets[0] = 3;
   (void) close(0);
   (void) close(1);
@@ -957,8 +951,10 @@ if (inetd_wait_mode)
   /* As per below, when creating sockets ourselves, we handle tcp_nodelay for
   our own buffering; we assume though that inetd set the socket REUSEADDR. */
 
-  if (tcp_nodelay) setsockopt(3, IPPROTO_TCP, TCP_NODELAY,
-    (uschar *)(&on), sizeof(on));
+  if (tcp_nodelay)
+    if (setsockopt(3, IPPROTO_TCP, TCP_NODELAY, US &on, sizeof(on)))
+      log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to set socket NODELAY: %s",
+	strerror(errno));
   }
 
 
@@ -1097,11 +1093,11 @@ if (daemon_listen && !inetd_wait_mode)
         {
         joinstr[0] = sep;
         joinstr[1] = ' ';
-        *ptr = string_cat(*ptr, sizeptr, ptrptr, US"<", 1);
+        *ptr = string_catn(*ptr, sizeptr, ptrptr, US"<", 1);
         }
 
-      *ptr = string_cat(*ptr, sizeptr, ptrptr, joinstr, 2);
-      *ptr = string_cat(*ptr, sizeptr, ptrptr, s, Ustrlen(s));
+      *ptr = string_catn(*ptr, sizeptr, ptrptr, joinstr, 2);
+      *ptr = string_cat (*ptr, sizeptr, ptrptr, s);
       }
 
     if (new_smtp_port != NULL)
@@ -1276,7 +1272,7 @@ if (daemon_listen && !inetd_wait_mode)
 
   for (ipa = addresses; ipa != NULL; ipa = ipa->next)
     listen_socket_count++;
-  listen_sockets = store_get(sizeof(int *) * listen_socket_count);
+  listen_sockets = store_get(sizeof(int) * listen_socket_count);
 
   } /* daemon_listen but not inetd_wait_mode */
 
@@ -1355,7 +1351,6 @@ the listening sockets if required. */
 if (daemon_listen && !inetd_wait_mode)
   {
   int sk;
-  int on = 1;
   ip_address_item *ipa;
 
   /* For each IP address, create a socket, bind it to the appropriate port, and
@@ -1381,8 +1376,7 @@ if (daemon_listen && !inetd_wait_mode)
       wildcard = ipa->address[0] == 0;
       }
 
-    listen_sockets[sk] = ip_socket(SOCK_STREAM, af);
-    if (listen_sockets[sk] < 0)
+    if ((listen_sockets[sk] = ip_socket(SOCK_STREAM, af)) < 0)
       {
       if (check_special_case(0, addresses, ipa, FALSE))
         {
@@ -1458,13 +1452,17 @@ if (daemon_listen && !inetd_wait_mode)
       }
 
     DEBUG(D_any)
-      {
       if (wildcard)
         debug_printf("listening on all interfaces (IPv%c) port %d\n",
-          (af == AF_INET6)? '6' : '4', ipa->port);
+          af == AF_INET6 ? '6' : '4', ipa->port);
       else
         debug_printf("listening on %s port %d\n", ipa->address, ipa->port);
-      }
+
+#ifdef TCP_FASTOPEN
+    if (setsockopt(listen_sockets[sk], IPPROTO_TCP, TCP_FASTOPEN,
+		    &smtp_connect_backlog, sizeof(smtp_connect_backlog)))
+      DEBUG(D_any) debug_printf("setsockopt FASTOPEN: %s\n", strerror(errno));
+#endif
 
     /* Start listening on the bound socket, establishing the maximum backlog of
     connections that is allowed. On success, continue to the next address. */
@@ -1479,8 +1477,8 @@ if (daemon_listen && !inetd_wait_mode)
 
     if (!check_special_case(errno, addresses, ipa, TRUE))
       log_write(0, LOG_PANIC_DIE, "listen() failed on interface %s: %s",
-        wildcard? ((af == AF_INET6)? US"(any IPv6)" : US"(any IPv4)") :
-        ipa->address,
+        wildcard
+	? af == AF_INET6 ? US"(any IPv6)" : US"(any IPv4)" : ipa->address,
         strerror(errno));
 
     DEBUG(D_any) debug_printf("wildcard IPv4 listen() failed after IPv6 "
@@ -1572,11 +1570,11 @@ originator_login = ((pw = getpwuid(exim_uid)) != NULL)?
 /* Get somewhere to keep the list of queue-runner pids if we are keeping track
 of them (and also if we are doing queue runs). */
 
-if (queue_interval > 0 && queue_run_max > 0)
+if (queue_interval > 0 && local_queue_run_max > 0)
   {
   int i;
-  queue_pid_slots = store_get(queue_run_max * sizeof(pid_t));
-  for (i = 0; i < queue_run_max; i++) queue_pid_slots[i] = 0;
+  queue_pid_slots = store_get(local_queue_run_max * sizeof(pid_t));
+  for (i = 0; i < local_queue_run_max; i++) queue_pid_slots[i] = 0;
   }
 
 /* Set up the handler for termination of child processes. */
@@ -1615,12 +1613,11 @@ else if (daemon_listen)
   int i, j;
   int smtp_ports = 0;
   int smtps_ports = 0;
-  ip_address_item *ipa;
-  uschar *p = big_buffer;
-  uschar *qinfo = (queue_interval > 0)?
-    string_sprintf("-q%s", readconf_printtime(queue_interval))
-    :
-    US"no queue runs";
+  ip_address_item * ipa;
+  uschar * p = big_buffer;
+  uschar * qinfo = queue_interval > 0
+    ? string_sprintf("-q%s", readconf_printtime(queue_interval))
+    : US"no queue runs";
 
   /* Build a list of listening addresses in big_buffer, but limit it to 10
   items. The style is for backwards compatibility.
@@ -1631,30 +1628,30 @@ else if (daemon_listen)
 
   for (j = 0; j < 2; j++)
     {
-    for (i = 0, ipa = addresses; i < 10 && ipa != NULL; i++, ipa = ipa->next)
+    for (i = 0, ipa = addresses; i < 10 && ipa; i++, ipa = ipa->next)
        {
        /* First time round, look for SMTP ports; second time round, look for
        SMTPS ports. For the first one of each, insert leading text. */
 
        if (host_is_tls_on_connect_port(ipa->port) == (j > 0))
          {
-         if (j == 0)
-           {
-           if (smtp_ports++ == 0)
+	 if (j == 0)
+	   {
+	   if (smtp_ports++ == 0)
              {
              memcpy(p, "SMTP on", 8);
              p += 7;
              }
-           }
-         else
-           {
-           if (smtps_ports++ == 0)
+	   }
+	 else
+	   {
+	   if (smtps_ports++ == 0)
              {
              (void)sprintf(CS p, "%sSMTPS on",
-               (smtp_ports == 0)? "":" and for ");
-             while (*p != 0) p++;
+               smtp_ports == 0 ? "" : " and for ");
+             while (*p) p++;
              }
-           }
+	   }
 
          /* Now the information about the port (and sometimes interface) */
 
@@ -1679,7 +1676,7 @@ else if (daemon_listen)
          }
        }
 
-    if (ipa != NULL)
+    if (ipa)
       {
       memcpy(p, " ...", 5);
       p += 4;
@@ -1689,17 +1686,19 @@ else if (daemon_listen)
   log_write(0, LOG_MAIN,
     "exim %s daemon started: pid=%d, %s, listening for %s",
     version_string, getpid(), qinfo, big_buffer);
-  set_process_info("daemon(%s): %s, listening for %s", version_string, qinfo, big_buffer);
+  set_process_info("daemon(%s): %s, listening for %s",
+    version_string, qinfo, big_buffer);
   }
 
 else
   {
+  uschar * s = *queue_name
+    ? string_sprintf("-qG%s/%s", queue_name, readconf_printtime(queue_interval))
+    : string_sprintf("-q%s", readconf_printtime(queue_interval));
   log_write(0, LOG_MAIN,
-    "exim %s daemon started: pid=%d, -q%s, not listening for SMTP",
-    version_string, getpid(), readconf_printtime(queue_interval));
-  set_process_info("daemon(%s): -q%s, not listening",
-    version_string,
-    readconf_printtime(queue_interval));
+    "exim %s daemon started: pid=%d, %s, not listening for SMTP",
+    version_string, getpid(), s);
+  set_process_info("daemon(%s): %s, not listening", version_string, s);
   }
 
 /* Do any work it might be useful to amortize over our children
@@ -1791,7 +1790,7 @@ for (;;)
       re-exec is required. */
 
       if (queue_interval > 0 &&
-         (queue_run_max <= 0 || queue_run_count < queue_run_max))
+         (local_queue_run_max <= 0 || queue_run_count < local_queue_run_max))
         {
         if ((pid = fork()) == 0)
           {
@@ -1835,21 +1834,22 @@ for (;;)
             if (deliver_force_thaw) *p++ = 'f';
             if (queue_run_local) *p++ = 'l';
             *p = 0;
-            extra[0] = opt;
+	    extra[0] = queue_name
+	      ? string_sprintf("%sG%s", opt, queue_name) : opt;
 
             /* If -R or -S were on the original command line, ensure they get
             passed on. */
 
-            if (deliver_selectstring != NULL)
+            if (deliver_selectstring)
               {
-              extra[extracount++] = deliver_selectstring_regex? US"-Rr" : US"-R";
+              extra[extracount++] = deliver_selectstring_regex ? US"-Rr" : US"-R";
               extra[extracount++] = deliver_selectstring;
               }
 
-            if (deliver_selectstring_sender != NULL)
+            if (deliver_selectstring_sender)
               {
-              extra[extracount++] = deliver_selectstring_sender_regex?
-                US"-Sr" : US"-S";
+              extra[extracount++] = deliver_selectstring_sender_regex
+	        ? US"-Sr" : US"-S";
               extra[extracount++] = deliver_selectstring_sender;
               }
 
@@ -1876,15 +1876,13 @@ for (;;)
         else
           {
           int i;
-          for (i = 0; i < queue_run_max; ++i)
-            {
+          for (i = 0; i < local_queue_run_max; ++i)
             if (queue_pid_slots[i] <= 0)
               {
               queue_pid_slots[i] = pid;
               queue_run_count++;
               break;
               }
-            }
           DEBUG(D_any) debug_printf("%d queue-runner process%s running\n",
             queue_run_count, (queue_run_count == 1)? "" : "es");
           }
diff --git a/src/src/dane-openssl.c b/src/src/dane-openssl.c
index 803fb0652..62778d18f 100644
--- a/src/src/dane-openssl.c
+++ b/src/src/dane-openssl.c
@@ -1,6 +1,8 @@
 /*
  *  Author: Viktor Dukhovni
  *  License: THIS CODE IS IN THE PUBLIC DOMAIN.
+ *
+ * Copyright (c) The Exim Maintainers 2014 - 2016
  */
 #include <stdio.h>
 #include <string.h>
@@ -18,11 +20,35 @@
 
 #if OPENSSL_VERSION_NUMBER < 0x1000000fL
 # error "OpenSSL 1.0.0 or higher required"
-#else   /* remainder of file */
+#endif
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 # define X509_up_ref(x) CRYPTO_add(&((x)->references), 1, CRYPTO_LOCK_X509)
 #endif
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+# define EXIM_HAVE_ASN1_MACROS
+# define EXIM_OPAQUE_X509
+#else
+# define X509_STORE_CTX_get_verify(ctx)		(ctx)->verify
+# define X509_STORE_CTX_get_verify_cb(ctx)	(ctx)->verify_cb
+# define X509_STORE_CTX_get0_cert(ctx)		(ctx)->cert
+# define X509_STORE_CTX_get0_chain(ctx)		(ctx)->chain
+# define X509_STORE_CTX_get0_untrusted(ctx)	(ctx)->untrusted
+
+# define X509_STORE_CTX_set_verify(ctx, verify_chain)	(ctx)->verify = (verify_chain)
+# define X509_STORE_CTX_set0_verified_chain(ctx, sk)	(ctx)->chain = (sk)
+# define X509_STORE_CTX_set_error_depth(ctx, val)	(ctx)->error_depth = (val)
+# define X509_STORE_CTX_set_current_cert(ctx, cert)	(ctx)->current_cert = (cert)
+
+# define ASN1_STRING_get0_data	ASN1_STRING_data
+# define X509_getm_notBefore	X509_get_notBefore
+# define X509_getm_notAfter	X509_get_notAfter
+
+# define CRYPTO_ONCE_STATIC_INIT 0
+# define CRYPTO_THREAD_run_once	 run_once
+typedef int CRYPTO_ONCE;
+#endif
+
 
 #include "danessl.h"
 
@@ -39,6 +65,7 @@
 #define DANESSL_F_SET_TRUST_ANCHOR	110
 #define DANESSL_F_VERIFY_CERT		111
 #define DANESSL_F_WRAP_CERT		112
+#define DANESSL_F_DANESSL_VERIFY_CHAIN	113
 
 #define DANESSL_R_BAD_CERT		100
 #define DANESSL_R_BAD_CERT_PKEY		101
@@ -275,13 +302,14 @@ return matched;
 static int
 push_ext(X509 *cert, X509_EXTENSION *ext)
 {
-    if (ext) {
-	if (X509_add_ext(cert, ext, -1))
-	    return 1;
-	X509_EXTENSION_free(ext);
-    }
-    DANEerr(DANESSL_F_PUSH_EXT, ERR_R_MALLOC_FAILURE);
-    return 0;
+if (ext)
+  {
+  if (X509_add_ext(cert, ext, -1))
+      return 1;
+  X509_EXTENSION_free(ext);
+  }
+DANEerr(DANESSL_F_PUSH_EXT, ERR_R_MALLOC_FAILURE);
+return 0;
 }
 
 static int
@@ -320,7 +348,7 @@ static int
 add_akid(X509 *cert, AUTHORITY_KEYID *akid)
 {
 int nid = NID_authority_key_identifier;
-ASN1_STRING *id;
+ASN1_OCTET_STRING *id;
 unsigned char c = 0;
 int ret = 0;
 
@@ -331,13 +359,17 @@ int ret = 0;
  * exempt from any potential (off by default for now in OpenSSL)
  * self-signature checks!
  */
-id =  (akid && akid->keyid) ? akid->keyid : 0;
-if (id && ASN1_STRING_length(id) == 1 && *ASN1_STRING_data(id) == c)
+id =  akid && akid->keyid ? akid->keyid : 0;
+if (id && ASN1_STRING_length(id) == 1 && *ASN1_STRING_get0_data(id) == c)
   c = 1;
 
 if (  (akid = AUTHORITY_KEYID_new()) != 0
    && (akid->keyid = ASN1_OCTET_STRING_new()) != 0
+#ifdef EXIM_HAVE_ASN1_MACROS
+   && ASN1_OCTET_STRING_set(akid->keyid, (void *) &c, 1)
+#else
    && M_ASN1_OCTET_STRING_set(akid->keyid, (void *) &c, 1)
+#endif
    && X509_add1_ext_i2d(cert, nid, akid, 0, X509V3_ADD_APPEND))
   ret = 1;
 if (akid)
@@ -412,7 +444,11 @@ if (cert)
   {
   if (trusted && !X509_add1_trust_object(cert, serverAuth))
     return 0;
+#ifdef EXIM_OPAQUE_X509
+  X509_up_ref(cert);
+#else
   CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509);
+#endif
   if (!sk_X509_push(*xs, cert))
     {
     X509_free(cert);
@@ -462,10 +498,10 @@ akid = X509_get_ext_d2i(subject, NID_authority_key_identifier, 0, 0);
  */
 if (  !X509_set_version(cert, 2)
    || !set_serial(cert, akid, subject)
-   || !X509_set_subject_name(cert, name)
    || !set_issuer_name(cert, akid)
-   || !X509_gmtime_adj(X509_get_notBefore(cert), -30 * 86400L)
-   || !X509_gmtime_adj(X509_get_notAfter(cert), 30 * 86400L)
+   || !X509_gmtime_adj(X509_getm_notBefore(cert), -30 * 86400L)
+   || !X509_gmtime_adj(X509_getm_notAfter(cert), 30 * 86400L)
+   || !X509_set_subject_name(cert, name)
    || !X509_set_pubkey(cert, newkey)
    || !add_ext(0, cert, NID_basic_constraints, "CA:TRUE")
    || (!top && !add_akid(cert, akid))
@@ -577,7 +613,7 @@ int i;
 int depth = 0;
 EVP_PKEY *takey;
 X509 *ca;
-STACK_OF(X509) *in = ctx->untrusted;        /* XXX: Accessor? */
+STACK_OF(X509) *in = X509_STORE_CTX_get0_untrusted(ctx);
 
 if (!grow_chain(dane, UNTRUSTED, 0))
   return -1;
@@ -688,13 +724,17 @@ if (matched > 0)
   dane->mdpth = 0;
   dane->match = cert;
   X509_up_ref(cert);
-  if(!ctx->chain)
+  if(!X509_STORE_CTX_get0_chain(ctx))
     {
-    if (  (ctx->chain = sk_X509_new_null()) != 0
-       && sk_X509_push(ctx->chain, cert))
+    STACK_OF(X509) * sk = sk_X509_new_null();
+    if (sk && sk_X509_push(sk, cert))
+      {
       X509_up_ref(cert);
+      X509_STORE_CTX_set0_verified_chain(ctx, sk);
+      }
     else
       {
+      if (sk) sk_X509_free(sk);
       DANEerr(DANESSL_F_CHECK_END_ENTITY, ERR_R_MALLOC_FAILURE);
       return -1;
       }
@@ -751,10 +791,10 @@ for (hosts = dane->hosts; hosts; hosts = hosts->next)
 return 0;
 }
 
-static char *
-check_name(char *name, int len)
+static const char *
+check_name(const char *name, int len)
 {
-char *cp = name + len;
+const char *cp = name + len;
 
 while (len > 0 && !*--cp)
   --len;                          /* Ignore trailing NULs */
@@ -775,14 +815,14 @@ if (cp - name != len)               /* Guard against internal NULs */
 return name;
 }
 
-static char *
+static const char *
 parse_dns_name(const GENERAL_NAME *gn)
 {
 if (gn->type != GEN_DNS)
   return 0;
 if (ASN1_STRING_type(gn->d.ia5) != V_ASN1_IA5STRING)
   return 0;
-return check_name((char *) ASN1_STRING_data(gn->d.ia5),
+return check_name((const char *) ASN1_STRING_get0_data(gn->d.ia5),
 		  ASN1_STRING_length(gn->d.ia5));
 }
 
@@ -870,21 +910,21 @@ return matched;
 static int
 verify_chain(X509_STORE_CTX *ctx)
 {
-dane_selector_list issuer_rrs;
-dane_selector_list leaf_rrs;
-int (*cb)(int, X509_STORE_CTX *) = ctx->verify_cb;
+int (*cb)(int, X509_STORE_CTX *) = X509_STORE_CTX_get_verify_cb(ctx);
+X509 *cert = X509_STORE_CTX_get0_cert(ctx);
+STACK_OF(X509) * chain = X509_STORE_CTX_get0_chain(ctx);
+int chain_length = sk_X509_num(chain);
 int ssl_idx = SSL_get_ex_data_X509_STORE_CTX_idx();
 SSL *ssl = X509_STORE_CTX_get_ex_data(ctx, ssl_idx);
 ssl_dane *dane = SSL_get_ex_data(ssl, dane_idx);
-X509 *cert = ctx->cert;             /* XXX: accessor? */
+dane_selector_list issuer_rrs = dane->selectors[DANESSL_USAGE_PKIX_TA];
+dane_selector_list leaf_rrs = dane->selectors[DANESSL_USAGE_PKIX_EE];
 int matched = 0;
-int chain_length = sk_X509_num(ctx->chain);
 
 DEBUG(D_tls) debug_printf("Dane verify_chain\n");
 
-issuer_rrs = dane->selectors[DANESSL_USAGE_PKIX_TA];
-leaf_rrs = dane->selectors[DANESSL_USAGE_PKIX_EE];
-ctx->verify = dane->verify;
+/* Restore OpenSSL's internal_verify() as the signature check function */
+X509_STORE_CTX_set_verify(ctx, dane->verify);
 
 if ((matched = name_check(dane, cert)) < 0)
   {
@@ -894,8 +934,8 @@ if ((matched = name_check(dane, cert)) < 0)
 
 if (!matched)
   {
-  ctx->error_depth = 0;
-  ctx->current_cert = cert;
+  X509_STORE_CTX_set_error_depth(ctx, 0);
+  X509_STORE_CTX_set_current_cert(ctx, cert);
   X509_STORE_CTX_set_error(ctx, X509_V_ERR_HOSTNAME_MISMATCH);
   if (!cb(0, ctx))
     return 0;
@@ -907,28 +947,28 @@ matched = 0;
  * matched a usage 2 trust anchor.
  *
  * XXX: internal_verify() doesn't callback with top certs that are not
- * self-issued.  This should be fixed in a future OpenSSL.
+ * self-issued.  This is fixed in OpenSSL 1.1.0.
  */
 if (dane->roots && sk_X509_num(dane->roots))
   {
-  X509 *top = sk_X509_value(ctx->chain, dane->depth);
+  X509 *top = sk_X509_value(chain, dane->depth);
 
   dane->mdpth = dane->depth;
   dane->match = top;
   X509_up_ref(top);
 
-#ifndef NO_CALLBACK_WORKAROUND
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
   if (X509_check_issued(top, top) != X509_V_OK)
     {
-    ctx->error_depth = dane->depth;
-    ctx->current_cert = top;
+    X509_STORE_CTX_set_error_depth(ctx, dane->depth);
+    X509_STORE_CTX_set_current_cert(ctx, top);
     if (!cb(1, ctx))
       return 0;
     }
 #endif
   /* Pop synthetic trust-anchor ancestors off the chain! */
   while (--chain_length > dane->depth)
-      X509_free(sk_X509_pop(ctx->chain));
+      X509_free(sk_X509_pop(chain));
   }
 else
   {
@@ -946,7 +986,7 @@ else
   if (!matched && issuer_rrs)
     for (n = chain_length-1; !matched && n >= 0; --n)
       {
-      xn = sk_X509_value(ctx->chain, n);
+      xn = sk_X509_value(chain, n);
       if (n > 0 || X509_check_issued(xn, xn) == X509_V_OK)
 	matched = match(issuer_rrs, xn, n);
       }
@@ -955,8 +995,8 @@ else
 
   if (!matched)
     {
-    ctx->current_cert = cert;
-    ctx->error_depth = 0;
+    X509_STORE_CTX_set_error_depth(ctx, 0);
+    X509_STORE_CTX_set_current_cert(ctx, cert);
     X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_UNTRUSTED);
     if (!cb(0, ctx))
       return 0;
@@ -969,7 +1009,8 @@ else
     }
   }
 
-return ctx->verify(ctx);
+/* Tail recurse into OpenSSL's internal_verify */
+return dane->verify(ctx);
 }
 
 static void
@@ -1005,9 +1046,9 @@ verify_cert(X509_STORE_CTX *ctx, void *unused_ctx)
 static int ssl_idx = -1;
 SSL *ssl;
 ssl_dane *dane;
-int (*cb)(int, X509_STORE_CTX *) = ctx->verify_cb;
+int (*cb)(int, X509_STORE_CTX *) = X509_STORE_CTX_get_verify_cb(ctx);
+X509 *cert = X509_STORE_CTX_get0_cert(ctx);
 int matched;
-X509 *cert = ctx->cert;             /* XXX: accessor? */
 
 DEBUG(D_tls) debug_printf("Dane verify_cert\n");
 
@@ -1030,8 +1071,8 @@ if (dane->selectors[DANESSL_USAGE_DANE_EE])
   {
   if ((matched = check_end_entity(ctx, dane, cert)) > 0)
     {
-    ctx->error_depth = 0;
-    ctx->current_cert = cert;
+    X509_STORE_CTX_set_error_depth(ctx, 0);
+    X509_STORE_CTX_set_current_cert(ctx, cert);
     return cb(1, ctx);
     }
   if (matched < 0)
@@ -1056,7 +1097,7 @@ if (dane->selectors[DANESSL_USAGE_DANE_EE])
        */
       X509_STORE_CTX_trusted_stack(ctx, dane->roots);
       X509_STORE_CTX_set_chain(ctx, dane->chain);
-      OPENSSL_assert(ctx->untrusted == dane->chain);
+      OPENSSL_assert(dane->chain == X509_STORE_CTX_get0_untrusted(ctx));
       }
     }
 
@@ -1065,8 +1106,8 @@ if (dane->selectors[DANESSL_USAGE_DANE_EE])
    * X509_verify_cert() builds the full chain and calls our verify_chain()
    * wrapper.
    */
-  dane->verify = ctx->verify;
-  ctx->verify = verify_chain;
+  dane->verify = X509_STORE_CTX_get_verify(ctx);
+  X509_STORE_CTX_set_verify(ctx, verify_chain);
 
   if (X509_verify_cert(ctx))
     return 1;
@@ -1126,10 +1167,16 @@ for (head = (dane_list) list; head; head = next)
   }
 }
 
+static void
+ossl_free(void * p)
+{
+OPENSSL_free(p);
+}
+
 static void
 dane_mtype_free(void *p)
 {
-list_free(((dane_mtype) p)->data, CRYPTO_free);
+list_free(((dane_mtype) p)->data, ossl_free);
 OPENSSL_free(p);
 }
 
@@ -1170,7 +1217,7 @@ if (dane_idx < 0 || !(dane = SSL_get_ex_data(ssl, dane_idx)))
 
 dane_reset(dane);
 if (dane->hosts)
-  list_free(dane->hosts, CRYPTO_free);
+  list_free(dane->hosts, ossl_free);
 for (u = 0; u <= DANESSL_USAGE_LAST; ++u)
   if (dane->selectors[u])
     list_free(dane->selectors[u], dane_selector_free);
@@ -1191,7 +1238,7 @@ while (*src)
   dane_host_list elem = (dane_host_list) OPENSSL_malloc(sizeof(*elem));
   if (elem == 0)
     {
-    list_free(head, CRYPTO_free);
+    list_free(head, ossl_free);
     return 0;
     }
   elem->value = OPENSSL_strdup(*src++);
@@ -1232,28 +1279,36 @@ DANESSL_verify_chain(SSL *ssl, STACK_OF(X509) *chain)
 {
 int ret;
 X509 *cert;
-X509_STORE_CTX store_ctx;
+X509_STORE_CTX * store_ctx;
 SSL_CTX *ssl_ctx = SSL_get_SSL_CTX(ssl);
 X509_STORE *store = SSL_CTX_get_cert_store(ssl_ctx);
 int store_ctx_idx = SSL_get_ex_data_X509_STORE_CTX_idx();
 
 cert = sk_X509_value(chain, 0);
-if (!X509_STORE_CTX_init(&store_ctx, store, cert, chain))
+if (!(store_ctx = X509_STORE_CTX_new()))
+  {
+  DANEerr(DANESSL_F_DANESSL_VERIFY_CHAIN, ERR_R_MALLOC_FAILURE);
   return 0;
-X509_STORE_CTX_set_ex_data(&store_ctx, store_ctx_idx, ssl);
+  }
+if (!X509_STORE_CTX_init(store_ctx, store, cert, chain))
+  {
+  X509_STORE_CTX_free(store_ctx);
+  return 0;
+  }
+X509_STORE_CTX_set_ex_data(store_ctx, store_ctx_idx, ssl);
 
-X509_STORE_CTX_set_default(&store_ctx,
+X509_STORE_CTX_set_default(store_ctx,
             SSL_is_server(ssl) ? "ssl_client" : "ssl_server");
-X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(&store_ctx),
+X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(store_ctx),
             SSL_get0_param(ssl));
 
 if (SSL_get_verify_callback(ssl))
-  X509_STORE_CTX_set_verify_cb(&store_ctx, SSL_get_verify_callback(ssl));
+  X509_STORE_CTX_set_verify_cb(store_ctx, SSL_get_verify_callback(ssl));
 
-ret = verify_cert(&store_ctx, NULL);
+ret = verify_cert(store_ctx, NULL);
 
-SSL_set_verify_result(ssl, X509_STORE_CTX_get_error(&store_ctx));
-X509_STORE_CTX_cleanup(&store_ctx);
+SSL_set_verify_result(ssl, X509_STORE_CTX_get_error(store_ctx));
+X509_STORE_CTX_cleanup(store_ctx);
 
 return (ret);
 }
@@ -1422,7 +1477,7 @@ if (!m)
   {
   if ((m = (dane_mtype_list) list_alloc(sizeof(*m->value))) == 0)
     {
-    list_free(d, CRYPTO_free);
+    list_free(d, ossl_free);
     xkfreeret(0);
     }
   m->value->data = 0;
@@ -1563,31 +1618,6 @@ DANEerr(DANESSL_F_CTX_INIT, DANESSL_R_LIBRARY_INIT);
 return -1;
 }
 
-static int
-init_once(volatile int *value, int (*init)(void), void (*postinit)(void))
-{
-int wlock = 0;
-
-CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
-if (*value < 0)
-  {
-  CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
-  CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
-  wlock = 1;
-  if (*value < 0)
-    {
-    *value = init();
-    if (postinit)
-      postinit();
-    }
-  }
-if (wlock)
-    CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
-else
-    CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
-return *value;
-}
-
 static void
 dane_init(void)
 {
@@ -1595,10 +1625,15 @@ dane_init(void)
  * Store library id in zeroth function slot, used to locate the library
  * name.  This must be done before we load the error strings.
  */
+err_lib_dane = ERR_get_next_error_library();
+
 #ifndef OPENSSL_NO_ERR
-dane_str_functs[0].error |= ERR_PACK(err_lib_dane, 0, 0);
-ERR_load_strings(err_lib_dane, dane_str_functs);
-ERR_load_strings(err_lib_dane, dane_str_reasons);
+if (err_lib_dane > 0)
+  {
+  dane_str_functs[0].error |= ERR_PACK(err_lib_dane, 0, 0);
+  ERR_load_strings(err_lib_dane, dane_str_functs);
+  ERR_load_strings(err_lib_dane, dane_str_reasons);
+  }
 #endif
 
 /*
@@ -1623,6 +1658,32 @@ dane_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
 }
 
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+static void
+run_once(volatile int * once, void (*init)(void))
+{
+int wlock = 0;
+
+CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
+if (!*once)
+  {
+  CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
+  CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
+  wlock = 1;
+  if (!*once)
+    {
+    *once = 1;
+    init();
+    }
+  }
+if (wlock)
+  CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
+else
+  CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
+}
+#endif
+
+
 
 /*
 
@@ -1639,9 +1700,10 @@ Return
 int
 DANESSL_library_init(void)
 {
+static CRYPTO_ONCE once = CRYPTO_ONCE_STATIC_INIT;
+
 DEBUG(D_tls) debug_printf("Dane lib-init\n");
-if (err_lib_dane < 0)
-  init_once(&err_lib_dane, ERR_get_next_error_library, dane_init);
+(void) CRYPTO_THREAD_run_once(&once, dane_init);
 
 #if defined(LN_sha256)
 /* No DANE without SHA256 support */
@@ -1653,6 +1715,5 @@ return 0;
 }
 
 
-#endif /* OPENSSL_VERSION_NUMBER */
 /* vi: aw ai sw=2
 */
diff --git a/src/src/dbfn.c b/src/src/dbfn.c
index f521f2c20..c9c6fb707 100644
--- a/src/src/dbfn.c
+++ b/src/src/dbfn.c
@@ -141,14 +141,14 @@ if (sigalrm_seen) errno = ETIMEDOUT;
 if (rc < 0)
   {
   log_write(0, LOG_MAIN|LOG_PANIC, "Failed to get %s lock for %s: %s",
-    read_only? "read" : "write", buffer,
-    (errno == ETIMEDOUT)? "timed out" : strerror(errno));
+    read_only ? "read" : "write", buffer,
+    errno == ETIMEDOUT ? "timed out" : strerror(errno));
   (void)close(dbblock->lockfd);
   errno = 0;       /* Indicates locking failure */
   return NULL;
   }
 
-DEBUG(D_hints_lookup) debug_printf("locked %s\n", buffer);
+DEBUG(D_hints_lookup) debug_printf("locked  %s\n", buffer);
 
 /* At this point we have an opened and locked separate lock file, that is,
 exclusive access to the database, so we can go ahead and open it. If we are
@@ -164,7 +164,7 @@ DEBUG(D_hints_lookup) debug_printf("EXIM_DBOPEN(%s)\n", buffer);
 EXIM_DBOPEN(buffer, flags, EXIMDB_MODE, &(dbblock->dbptr));
 DEBUG(D_hints_lookup) debug_printf("returned from EXIM_DBOPEN\n");
 
-if (dbblock->dbptr == NULL && errno == ENOENT && flags == O_RDWR)
+if (!dbblock->dbptr && errno == ENOENT && flags == O_RDWR)
   {
   DEBUG(D_hints_lookup)
     debug_printf("%s appears not to exist: trying to create\n", buffer);
@@ -199,8 +199,7 @@ if (created && geteuid() == root_uid)
   *lastname = 0;
   dd = opendir(CS buffer);
 
-  while ((ent = readdir(dd)) != NULL)
-    {
+  while ((ent = readdir(dd)))
     if (Ustrncmp(ent->d_name, name, namelen) == 0)
       {
       struct stat statbuf;
@@ -212,7 +211,6 @@ if (created && geteuid() == root_uid)
           DEBUG(D_hints_lookup) debug_printf("failed setting %s to owned by exim\n", buffer);
         }
       }
-    }
 
   closedir(dd);
   }
@@ -220,10 +218,9 @@ if (created && geteuid() == root_uid)
 /* If the open has failed, return NULL, leaving errno set. If lof is TRUE,
 log the event - also for debugging - but not if the file just doesn't exist. */
 
-if (dbblock->dbptr == NULL)
+if (!dbblock->dbptr)
   {
   if (save_errno != ENOENT)
-    {
     if (lof)
       log_write(0, LOG_MAIN, "%s", string_open_failed(save_errno, "DB file %s",
         buffer));
@@ -231,7 +228,6 @@ if (dbblock->dbptr == NULL)
       DEBUG(D_hints_lookup)
         debug_printf("%s", CS string_open_failed(save_errno, "DB file %s\n",
           buffer));
-    }
   (void)close(dbblock->lockfd);
   errno = save_errno;
   return NULL;
@@ -239,8 +235,10 @@ if (dbblock->dbptr == NULL)
 
 DEBUG(D_hints_lookup)
   debug_printf("opened hints database %s: flags=%s\n", buffer,
-    (flags == O_RDONLY)? "O_RDONLY" : (flags == O_RDWR)? "O_RDWR" :
-    (flags == (O_RDWR|O_CREAT))? "O_RDWR|O_CREAT" : "??");
+    flags == O_RDONLY ? "O_RDONLY"
+    : flags == O_RDWR ? "O_RDWR"
+    : flags == (O_RDWR|O_CREAT) ? "O_RDWR|O_CREAT"
+    : "??");
 
 /* Pass back the block containing the opened database handle and the open fd
 for the lock. */
@@ -267,6 +265,7 @@ dbfn_close(open_db *dbblock)
 {
 EXIM_DBCLOSE(dbblock->dbptr);
 (void)close(dbblock->lockfd);
+DEBUG(D_hints_lookup) debug_printf("closed hints database and lockfile\n");
 }
 
 
diff --git a/src/src/dbstuff.h b/src/src/dbstuff.h
index ce81f1eb4..93c715ac2 100644
--- a/src/src/dbstuff.h
+++ b/src/src/dbstuff.h
@@ -64,7 +64,7 @@ tdb_traverse to be called) */
 
 /* EXIM_DBCREATE_CURSOR - initialize for scanning operation */
 #define EXIM_DBCREATE_CURSOR(db, cursor) { \
-   *(cursor) = malloc(sizeof(TDB_DATA)); (*(cursor))->dptr = NULL; }
+   *(cursor) = store_malloc(sizeof(TDB_DATA)); (*(cursor))->dptr = NULL; }
 
 /* EXIM_DBSCAN - This is complicated because we have to free the last datum
 free() must not die when passed NULL */
diff --git a/src/src/dcc.c b/src/src/dcc.c
index b03690ca6..1841e733d 100644
--- a/src/src/dcc.c
+++ b/src/src/dcc.c
@@ -6,6 +6,8 @@
  * Vienna University Computer Center
  * wbreyha@gmx.net
  * See the file NOTICE for conditions of use and distribution.
+ *
+ * Copyright (c) The Exim Maintainers 2015 - 2016
  */
 
 /* This patch is based on code from Tom Kistners exiscan (ACL integration) and
@@ -70,7 +72,6 @@ dcc_process(uschar **listptr)
   uschar sendbuf[4096];
   uschar recvbuf[4096];
   uschar dcc_return_text[1024];
-  uschar mbox_path[1024];
   uschar message_subdir[2];
   struct header_line *dcchdr;
   uschar *dcc_acl_options;
@@ -79,50 +80,42 @@ dcc_process(uschar **listptr)
 
   /* grep 1st option */
   if ((dcc_acl_options = string_nextinlist(&list, &sep,
-                                           dcc_acl_options_buffer,
-                                           sizeof(dcc_acl_options_buffer))) != NULL)
-  {
+		   dcc_acl_options_buffer, sizeof(dcc_acl_options_buffer))))
+    {
     /* parse 1st option */
-    if ( (strcmpic(dcc_acl_options,US"false") == 0) ||
-         (Ustrcmp(dcc_acl_options,"0") == 0) ) {
-      /* explicitly no matching */
-      return FAIL;
-    };
-
-    /* special cases (match anything except empty) */
-    if ( (strcmpic(dcc_acl_options,US"true") == 0) ||
-         (Ustrcmp(dcc_acl_options,"*") == 0) ||
-         (Ustrcmp(dcc_acl_options,"1") == 0) ) {
-      dcc_acl_options = dcc_acl_options;
-    };
-  }
-  else {
-    /* empty means "don't match anything" */
-    return FAIL;
-  };
+    if (  strcmpic(dcc_acl_options, US"false") == 0
+       || Ustrcmp(dcc_acl_options, "0") == 0
+       )
+      return FAIL;	/* explicitly no matching */
+    }
+  else
+    return FAIL;	/* empty means "don't match anything" */
 
   sep = 0;
 
   /* if we scanned this message last time, just return */
-  if ( dcc_ok )
-      return dcc_rc;
+  if (dcc_ok)
+    return dcc_rc;
 
   /* open the spooled body */
   message_subdir[1] = '\0';
-  for (i = 0; i < 2; i++) {
-    message_subdir[0] = (split_spool_directory == (i == 0))? message_id[5] : 0;
-    sprintf(CS mbox_path, "%s/input/%s/%s-D", spool_directory, message_subdir, message_id);
-    data_file = Ufopen(mbox_path,"rb");
-    if (data_file != NULL)
+  for (i = 0; i < 2; i++)
+    {
+    message_subdir[0] = split_spool_directory == (i == 0) ? message_id[5] : 0;
+
+    if ((data_file = Ufopen(
+	    spool_fname(US"input", message_subdir, message_id, US"-D"),
+	    "rb")))
       break;
-  };
+    }
 
-  if (data_file == NULL) {
+  if (!data_file)
+    {
     /* error while spooling */
     log_write(0, LOG_MAIN|LOG_PANIC,
            "dcc acl condition: error while opening spool file");
     return DEFER;
-  };
+    }
 
   /* Initialize the variables */
 
@@ -216,9 +209,9 @@ dcc_process(uschar **listptr)
     }
   } else {
     /* connecting to the dccifd UNIX socket */
-    bzero((char *)&serv_addr,sizeof(serv_addr));
+    bzero(&serv_addr, sizeof(serv_addr));
     serv_addr.sun_family = AF_UNIX;
-    Ustrcpy(serv_addr.sun_path, sockpath);
+    Ustrncpy(serv_addr.sun_path, sockpath, sizeof(serv_addr.sun_path));
     if ((sockfd = socket(AF_UNIX, SOCK_STREAM,0)) < 0){
       DEBUG(D_acl)
         debug_printf("DCC: Creating UNIX socket connection failed: %s\n", strerror(errno));
@@ -434,11 +427,11 @@ dcc_process(uschar **listptr)
             }
           }
           else {
-          /* We're on the first line but not on the first character,
-           * there must be something wrong. */
-            DEBUG(D_acl)
-              debug_printf("DCC: Line = %d but i = %d != 0  character is %c - This is wrong!\n", line, i, recvbuf[i]);
-              log_write(0,LOG_MAIN,"Wrong header from DCC, output is %s\n", recvbuf);
+            /* We're on the first line but not on the first character,
+             * there must be something wrong. */
+            DEBUG(D_acl) debug_printf("DCC: Line = %d but i = %d != 0"
+		"  character is %c - This is wrong!\n", line, i, recvbuf[i]);
+            log_write(0,LOG_MAIN,"Wrong header from DCC, output is %s\n", recvbuf);
           }
         }
         else if(line == 2) {
@@ -456,8 +449,8 @@ dcc_process(uschar **listptr)
             k++;
           }
           else {
-            DEBUG(D_acl)
-              debug_printf("DCC: We got more output than we can store in the X-DCC header. Truncating at 120 characters.\n");
+            DEBUG(D_acl) debug_printf("DCC: We got more output than we can store"
+		" in the X-DCC header. Truncating at 120 characters.\n");
           }
         }
         else {
diff --git a/src/src/deliver.c b/src/src/deliver.c
index e588ee4a4..9fe74df7c 100644
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* The main code for delivering a message. */
@@ -76,8 +76,6 @@ static int  return_count;
 static uschar *frozen_info = US"";
 static uschar *used_return_path = NULL;
 
-static uschar spoolname[PATH_MAX];
-
 
 
 /*************************************************
@@ -270,6 +268,8 @@ msglog directory that are used to catch output from pipes. Try to create the
 directory if it does not exist. From release 4.21, normal message logs should
 be created when the message is received.
 
+Called from deliver_message(), can be operating as root.
+
 Argument:
   filename  the file name
   mode      the mode required
@@ -281,38 +281,49 @@ Returns:    a file descriptor, or -1 (with errno set)
 static int
 open_msglog_file(uschar *filename, int mode, uschar **error)
 {
-int fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
-
-if (fd < 0 && errno == ENOENT)
-  {
-  uschar temp[16];
-  sprintf(CS temp, "msglog/%s", message_subdir);
-  if (message_subdir[0] == 0) temp[6] = 0;
-  (void)directory_make(spool_directory, temp, MSGLOG_DIRECTORY_MODE, TRUE);
-  fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
-  }
-
-/* Set the close-on-exec flag and change the owner to the exim uid/gid (this
-function is called as root). Double check the mode, because the group setting
-doesn't always get set automatically. */
+int fd, i;
 
-if (fd >= 0)
+for (i = 2; i > 0; i--)
   {
-  (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
-  if (fchown(fd, exim_uid, exim_gid) < 0)
-    {
-    *error = US"chown";
-    return -1;
-    }
-  if (fchmod(fd, mode) < 0)
+  fd = Uopen(filename,
+#ifdef O_CLOEXEC
+    O_CLOEXEC |
+#endif
+#ifdef O_NOFOLLOW
+    O_NOFOLLOW |
+#endif
+		O_WRONLY|O_APPEND|O_CREAT, mode);
+  if (fd >= 0)
     {
-    *error = US"chmod";
-    return -1;
+    /* Set the close-on-exec flag and change the owner to the exim uid/gid (this
+    function is called as root). Double check the mode, because the group setting
+    doesn't always get set automatically. */
+
+#ifndef O_CLOEXEC
+    (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+#endif
+    if (fchown(fd, exim_uid, exim_gid) < 0)
+      {
+      *error = US"chown";
+      return -1;
+      }
+    if (fchmod(fd, mode) < 0)
+      {
+      *error = US"chmod";
+      return -1;
+      }
+    return fd;
     }
+  if (errno != ENOENT)
+    break;
+
+  (void)directory_make(spool_directory,
+			spool_sname(US"msglog", message_subdir),
+			MSGLOG_DIRECTORY_MODE, TRUE);
   }
-else *error = US"create";
 
-return fd;
+*error = US"create";
+return -1;
 }
 
 
@@ -449,6 +460,10 @@ while (one && two)
     two = end_two;
     }
 
+  /* if the names matched but ports do not, mismatch */
+  else if (one->port != two->port)
+    return FALSE;
+
   /* Hosts matched */
 
   one = one->next;
@@ -703,7 +718,7 @@ if (LOGGING(incoming_interface) && LOGGING(outgoing_interface)
   s = LOGGING(outgoing_port)
     ? string_append(s, sizep, ptrp, 2, US"]:",
 	string_sprintf("%d", sending_port))
-    : string_cat(s, sizep, ptrp, US"]", 1);
+    : string_catn(s, sizep, ptrp, US"]", 1);
   }
 return s;
 }
@@ -711,25 +726,31 @@ return s;
 
 
 static uschar *
-d_hostlog(uschar *s, int *sizep, int *ptrp, address_item *addr)
+d_hostlog(uschar * s, int * sp, int * pp, address_item * addr)
 {
-s = string_append(s, sizep, ptrp, 5, US" H=", addr->host_used->name,
-  US" [", addr->host_used->address, US"]");
+host_item * h = addr->host_used;
+
+s = string_append(s, sp, pp, 2, US" H=", h->name);
+
+if (LOGGING(dnssec) && h->dnssec == DS_YES)
+  s = string_catn(s, sp, pp, US" DS", 3);
+
+s = string_append(s, sp, pp, 3, US" [", h->address, US"]");
+
 if (LOGGING(outgoing_port))
-  s = string_append(s, sizep, ptrp, 2, US":", string_sprintf("%d",
-    addr->host_used->port));
+  s = string_append(s, sp, pp, 2, US":", string_sprintf("%d", h->port));
 
 #ifdef SUPPORT_SOCKS
 if (LOGGING(proxy) && proxy_local_address)
   {
-  s = string_append(s, sizep, ptrp, 3, US" PRX=[", proxy_local_address, US"]");
+  s = string_append(s, sp, pp, 3, US" PRX=[", proxy_local_address, US"]");
   if (LOGGING(outgoing_port))
-    s = string_append(s, sizep, ptrp, 2, US":", string_sprintf("%d",
+    s = string_append(s, sp, pp, 2, US":", string_sprintf("%d",
       proxy_local_port));
   }
 #endif
 
-return d_log_interface(s, sizep, ptrp);
+return d_log_interface(s, sp, pp);
 }
 
 
@@ -833,6 +854,184 @@ router_name = transport_name = NULL;
 
 
 
+/******************************************************************************/
+
+
+/*************************************************
+*        Generate local prt for logging          *
+*************************************************/
+
+/* This function is a subroutine for use in string_log_address() below.
+
+Arguments:
+  addr        the address being logged
+  yield       the current dynamic buffer pointer
+  sizeptr     points to current size
+  ptrptr      points to current insert pointer
+
+Returns:      the new value of the buffer pointer
+*/
+
+static uschar *
+string_get_localpart(address_item *addr, uschar *yield, int *sizeptr,
+  int *ptrptr)
+{
+uschar * s;
+
+s = addr->prefix;
+if (testflag(addr, af_include_affixes) && s)
+  {
+#ifdef SUPPORT_I18N
+  if (testflag(addr, af_utf8_downcvt))
+    s = string_localpart_utf8_to_alabel(s, NULL);
+#endif
+  yield = string_cat(yield, sizeptr, ptrptr, s);
+  }
+
+s = addr->local_part;
+#ifdef SUPPORT_I18N
+if (testflag(addr, af_utf8_downcvt))
+  s = string_localpart_utf8_to_alabel(s, NULL);
+#endif
+yield = string_cat(yield, sizeptr, ptrptr, s);
+
+s = addr->suffix;
+if (testflag(addr, af_include_affixes) && s)
+  {
+#ifdef SUPPORT_I18N
+  if (testflag(addr, af_utf8_downcvt))
+    s = string_localpart_utf8_to_alabel(s, NULL);
+#endif
+  yield = string_cat(yield, sizeptr, ptrptr, s);
+  }
+
+return yield;
+}
+
+
+/*************************************************
+*          Generate log address list             *
+*************************************************/
+
+/* This function generates a list consisting of an address and its parents, for
+use in logging lines. For saved onetime aliased addresses, the onetime parent
+field is used. If the address was delivered by a transport with rcpt_include_
+affixes set, the af_include_affixes bit will be set in the address. In that
+case, we include the affixes here too.
+
+Arguments:
+  str           points to start of growing string, or NULL
+  size          points to current allocation for string
+  ptr           points to offset for append point; updated on exit
+  addr          bottom (ultimate) address
+  all_parents   if TRUE, include all parents
+  success       TRUE for successful delivery
+
+Returns:        a growable string in dynamic store
+*/
+
+static uschar *
+string_log_address(uschar * str, int * size, int * ptr,
+  address_item *addr, BOOL all_parents, BOOL success)
+{
+BOOL add_topaddr = TRUE;
+address_item *topaddr;
+
+/* Find the ultimate parent */
+
+for (topaddr = addr; topaddr->parent; topaddr = topaddr->parent) ;
+
+/* We start with just the local part for pipe, file, and reply deliveries, and
+for successful local deliveries from routers that have the log_as_local flag
+set. File deliveries from filters can be specified as non-absolute paths in
+cases where the transport is goin to complete the path. If there is an error
+before this happens (expansion failure) the local part will not be updated, and
+so won't necessarily look like a path. Add extra text for this case. */
+
+if (  testflag(addr, af_pfr)
+   || (  success
+      && addr->router && addr->router->log_as_local
+      && addr->transport && addr->transport->info->local
+   )  )
+  {
+  if (testflag(addr, af_file) && addr->local_part[0] != '/')
+    str = string_catn(str, size, ptr, CUS"save ", 5);
+  str = string_get_localpart(addr, str, size, ptr);
+  }
+
+/* Other deliveries start with the full address. It we have split it into local
+part and domain, use those fields. Some early failures can happen before the
+splitting is done; in those cases use the original field. */
+
+else
+  {
+  uschar * cmp = str + *ptr;
+
+  if (addr->local_part)
+    {
+    const uschar * s;
+    str = string_get_localpart(addr, str, size, ptr);
+    str = string_catn(str, size, ptr, US"@", 1);
+    s = addr->domain;
+#ifdef SUPPORT_I18N
+    if (testflag(addr, af_utf8_downcvt))
+      s = string_localpart_utf8_to_alabel(s, NULL);
+#endif
+    str = string_cat(str, size, ptr, s);
+    }
+  else
+    str = string_cat(str, size, ptr, addr->address);
+
+  /* If the address we are going to print is the same as the top address,
+  and all parents are not being included, don't add on the top address. First
+  of all, do a caseless comparison; if this succeeds, do a caseful comparison
+  on the local parts. */
+
+  str[*ptr] = 0;
+  if (  strcmpic(cmp, topaddr->address) == 0
+     && Ustrncmp(cmp, topaddr->address, Ustrchr(cmp, '@') - cmp) == 0
+     && !addr->onetime_parent
+     && (!all_parents || !addr->parent || addr->parent == topaddr)
+     )
+    add_topaddr = FALSE;
+  }
+
+/* If all parents are requested, or this is a local pipe/file/reply, and
+there is at least one intermediate parent, show it in brackets, and continue
+with all of them if all are wanted. */
+
+if (  (all_parents || testflag(addr, af_pfr))
+   && addr->parent
+   && addr->parent != topaddr)
+  {
+  uschar *s = US" (";
+  address_item *addr2;
+  for (addr2 = addr->parent; addr2 != topaddr; addr2 = addr2->parent)
+    {
+    str = string_catn(str, size, ptr, s, 2);
+    str = string_cat (str, size, ptr, addr2->address);
+    if (!all_parents) break;
+    s = US", ";
+    }
+  str = string_catn(str, size, ptr, US")", 1);
+  }
+
+/* Add the top address if it is required */
+
+if (add_topaddr)
+  str = string_append(str, size, ptr, 3,
+    US" <",
+    addr->onetime_parent ? addr->onetime_parent : topaddr->address,
+    US">");
+
+return str;
+}
+
+
+/******************************************************************************/
+
+
+
 /* If msg is NULL this is a delivery log and logchar is used. Otherwise
 this is a nonstandard call; no two-character delivery flag is written
 but sender-host and sender are prefixed and "msg" is inserted in the log line.
@@ -843,11 +1042,10 @@ Arguments:
 void
 delivery_log(int flags, address_item * addr, int logchar, uschar * msg)
 {
-uschar *log_address;
 int size = 256;         /* Used for a temporary, */
 int ptr = 0;            /* expanding buffer, for */
-uschar *s;              /* building log lines;   */
-void *reset_point;      /* released afterwards.  */
+uschar * s;             /* building log lines;   */
+void * reset_point;     /* released afterwards.  */
 
 /* Log the delivery on the main log. We use an extensible string to build up
 the log line, and reset the store afterwards. Remote deliveries should always
@@ -861,14 +1059,14 @@ pointer to a single host item in their host list, for use by the transport. */
 
 s = reset_point = store_get(size);
 
-log_address = string_log_address(addr, LOGGING(all_parents), TRUE);
 if (msg)
-  s = string_append(s, &size, &ptr, 3, host_and_ident(TRUE), US" ", log_address);
+  s = string_append(s, &size, &ptr, 2, host_and_ident(TRUE), US" ");
 else
   {
   s[ptr++] = logchar;
-  s = string_append(s, &size, &ptr, 2, US"> ", log_address);
+  s = string_catn(s, &size, &ptr, US"> ", 2);
   }
+s = string_log_address(s, &size, &ptr, addr, LOGGING(all_parents), TRUE);
 
 if (LOGGING(sender_on_delivery) || msg)
   s = string_append(s, &size, &ptr, 3, US" F=<",
@@ -880,6 +1078,9 @@ if (LOGGING(sender_on_delivery) || msg)
       sender_address,
   US">");
 
+if (*queue_name)
+  s = string_append(s, &size, &ptr, 2, US" Q=", queue_name);
+
 #ifdef EXPERIMENTAL_SRS
 if(addr->prop.srs_sender)
   s = string_append(s, &size, &ptr, 3, US" SRS=<", addr->prop.srs_sender, US">");
@@ -914,8 +1115,7 @@ if (addr->transport->info->local)
     s = string_append(s, &size, &ptr, 2, US" H=", addr->host_list->name);
   s = d_log_interface(s, &size, &ptr);
   if (addr->shadow_message)
-    s = string_cat(s, &size, &ptr, addr->shadow_message,
-      Ustrlen(addr->shadow_message));
+    s = string_cat(s, &size, &ptr, addr->shadow_message);
   }
 
 /* Remote delivery */
@@ -926,7 +1126,7 @@ else
     {
     s = d_hostlog(s, &size, &ptr, addr);
     if (continue_sequence > 1)
-      s = string_cat(s, &size, &ptr, US"*", 1);
+      s = string_catn(s, &size, &ptr, US"*", 1);
 
 #ifndef DISABLE_EVENT
     deliver_host_address = addr->host_used->address;
@@ -957,8 +1157,11 @@ else
 
 #ifndef DISABLE_PRDR
   if (addr->flags & af_prdr_used)
-    s = string_append(s, &size, &ptr, 1, US" PRDR");
+    s = string_catn(s, &size, &ptr, US" PRDR", 5);
 #endif
+
+  if (addr->flags & af_chunking_used)
+    s = string_catn(s, &size, &ptr, US" K", 2);
   }
 
 /* confirmation message (SMTP (host_used) and LMTP (driver_name)) */
@@ -1009,6 +1212,163 @@ return;
 
 
 
+static void
+deferral_log(address_item * addr, uschar * now,
+  int logflags, uschar * driver_name, uschar * driver_kind)
+{
+int size = 256;         /* Used for a temporary, */
+int ptr = 0;            /* expanding buffer, for */
+uschar * s;             /* building log lines;   */
+void * reset_point;     /* released afterwards.  */
+
+uschar ss[32];
+
+/* Build up the line that is used for both the message log and the main
+log. */
+
+s = reset_point = store_get(size);
+
+/* Create the address string for logging. Must not do this earlier, because
+an OK result may be changed to FAIL when a pipe returns text. */
+
+s = string_log_address(s, &size, &ptr, addr, LOGGING(all_parents), FALSE);
+
+if (*queue_name)
+  s = string_append(s, &size, &ptr, 2, US" Q=", queue_name);
+
+/* Either driver_name contains something and driver_kind contains
+" router" or " transport" (note the leading space), or driver_name is
+a null string and driver_kind contains "routing" without the leading
+space, if all routing has been deferred. When a domain has been held,
+so nothing has been done at all, both variables contain null strings. */
+
+if (driver_name)
+  {
+  if (driver_kind[1] == 't' && addr->router)
+    s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
+  Ustrcpy(ss, " ?=");
+  ss[1] = toupper(driver_kind[1]);
+  s = string_append(s, &size, &ptr, 2, ss, driver_name);
+  }
+else if (driver_kind)
+  s = string_append(s, &size, &ptr, 2, US" ", driver_kind);
+
+/*XXX need an s+s+p sprintf */
+sprintf(CS ss, " defer (%d)", addr->basic_errno);
+s = string_cat(s, &size, &ptr, ss);
+
+if (addr->basic_errno > 0)
+  s = string_append(s, &size, &ptr, 2, US": ",
+    US strerror(addr->basic_errno));
+
+if (addr->host_used)
+  {
+  s = string_append(s, &size, &ptr, 5,
+		    US" H=", addr->host_used->name,
+		    US" [",  addr->host_used->address, US"]");
+  if (LOGGING(outgoing_port))
+    {
+    int port = addr->host_used->port;
+    s = string_append(s, &size, &ptr, 2,
+	  US":", port == PORT_NONE ? US"25" : string_sprintf("%d", port));
+    }
+  }
+
+if (addr->message)
+  s = string_append(s, &size, &ptr, 2, US": ", addr->message);
+
+s[ptr] = 0;
+
+/* Log the deferment in the message log, but don't clutter it
+up with retry-time defers after the first delivery attempt. */
+
+if (deliver_firsttime || addr->basic_errno > ERRNO_RETRY_BASE)
+  deliver_msglog("%s %s\n", now, s);
+
+/* Write the main log and reset the store.
+For errors of the type "retry time not reached" (also remotes skipped
+on queue run), logging is controlled by L_retry_defer. Note that this kind
+of error number is negative, and all the retry ones are less than any
+others. */
+
+
+log_write(addr->basic_errno <= ERRNO_RETRY_BASE ? L_retry_defer : 0, logflags,
+  "== %s", s);
+
+store_reset(reset_point);
+return;
+}
+
+
+
+static void
+failure_log(address_item * addr, uschar * driver_kind, uschar * now)
+{
+int size = 256;         /* Used for a temporary, */
+int ptr = 0;            /* expanding buffer, for */
+uschar * s;             /* building log lines;   */
+void * reset_point;     /* released afterwards.  */
+
+/* Build up the log line for the message and main logs */
+
+s = reset_point = store_get(size);
+
+/* Create the address string for logging. Must not do this earlier, because
+an OK result may be changed to FAIL when a pipe returns text. */
+
+s = string_log_address(s, &size, &ptr, addr, LOGGING(all_parents), FALSE);
+
+if (LOGGING(sender_on_delivery))
+  s = string_append(s, &size, &ptr, 3, US" F=<", sender_address, US">");
+
+if (*queue_name)
+  s = string_append(s, &size, &ptr, 2, US" Q=", queue_name);
+
+/* Return path may not be set if no delivery actually happened */
+
+if (used_return_path && LOGGING(return_path_on_delivery))
+  s = string_append(s, &size, &ptr, 3, US" P=<", used_return_path, US">");
+
+if (addr->router)
+  s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
+if (addr->transport)
+  s = string_append(s, &size, &ptr, 2, US" T=", addr->transport->name);
+
+if (addr->host_used)
+  s = d_hostlog(s, &size, &ptr, addr);
+
+#ifdef SUPPORT_TLS
+s = d_tlslog(s, &size, &ptr, addr);
+#endif
+
+if (addr->basic_errno > 0)
+  s = string_append(s, &size, &ptr, 2, US": ", US strerror(addr->basic_errno));
+
+if (addr->message)
+  s = string_append(s, &size, &ptr, 2, US": ", addr->message);
+
+s[ptr] = 0;
+
+/* Do the logging. For the message log, "routing failed" for those cases,
+just to make it clearer. */
+
+if (driver_kind)
+  deliver_msglog("%s %s failed for %s\n", now, driver_kind, s);
+else
+  deliver_msglog("%s %s\n", now, s);
+
+log_write(0, LOG_MAIN, "** %s", s);
+
+#ifndef DISABLE_EVENT
+msg_event_raise(US"msg:fail:delivery", addr);
+#endif
+
+store_reset(reset_point);
+return;
+}
+
+
+
 /*************************************************
 *    Actions at the end of handling an address   *
 *************************************************/
@@ -1034,12 +1394,6 @@ post_process_one(address_item *addr, int result, int logflags, int driver_type,
 uschar *now = tod_stamp(tod_log);
 uschar *driver_kind = NULL;
 uschar *driver_name = NULL;
-uschar *log_address;
-
-int size = 256;         /* Used for a temporary, */
-int ptr = 0;            /* expanding buffer, for */
-uschar *s;              /* building log lines;   */
-void *reset_point;      /* released afterwards.  */
 
 DEBUG(D_deliver) debug_printf("post-process %s (%d)\n", addr->address, result);
 
@@ -1077,21 +1431,9 @@ malformed, it won't ever have gone near LDAP.) */
 if (addr->message)
   {
   const uschar * s = string_printing(addr->message);
-  if (s != addr->message)
-    addr->message = US s;
-    /* deconst cast ok as string_printing known to have alloc'n'copied */
-  if (  (  Ustrstr(s, "failed to expand") != NULL
-	|| Ustrstr(s, "expansion of ")    != NULL
-	)
-     && (  Ustrstr(s, "mysql")   != NULL
-        || Ustrstr(s, "pgsql")   != NULL
-	|| Ustrstr(s, "redis")   != NULL
-	|| Ustrstr(s, "sqlite")  != NULL
-	|| Ustrstr(s, "ldap:")   != NULL
-	|| Ustrstr(s, "ldapdn:") != NULL
-	|| Ustrstr(s, "ldapm:")  != NULL
-     )  )
-    addr->message = string_sprintf("Temporary internal error");
+
+  /* deconst cast ok as string_printing known to have alloc'n'copied */
+  addr->message = expand_hide_passwords(US s);
   }
 
 /* If we used a transport that has one of the "return_output" options set, and
@@ -1257,82 +1599,7 @@ else if (result == DEFER || result == PANIC)
   log or the main log for SMTP defers. */
 
   if (!queue_2stage || addr->basic_errno != 0)
-    {
-    uschar ss[32];
-
-    /* For errors of the type "retry time not reached" (also remotes skipped
-    on queue run), logging is controlled by L_retry_defer. Note that this kind
-    of error number is negative, and all the retry ones are less than any
-    others. */
-
-    unsigned int use_log_selector = addr->basic_errno <= ERRNO_RETRY_BASE
-      ? L_retry_defer : 0;
-
-    /* Build up the line that is used for both the message log and the main
-    log. */
-
-    s = reset_point = store_get(size);
-
-    /* Create the address string for logging. Must not do this earlier, because
-    an OK result may be changed to FAIL when a pipe returns text. */
-
-    log_address = string_log_address(addr, LOGGING(all_parents), result == OK);
-
-    s = string_cat(s, &size, &ptr, log_address, Ustrlen(log_address));
-
-    /* Either driver_name contains something and driver_kind contains
-    " router" or " transport" (note the leading space), or driver_name is
-    a null string and driver_kind contains "routing" without the leading
-    space, if all routing has been deferred. When a domain has been held,
-    so nothing has been done at all, both variables contain null strings. */
-
-    if (driver_name)
-      {
-      if (driver_kind[1] == 't' && addr->router)
-        s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
-      Ustrcpy(ss, " ?=");
-      ss[1] = toupper(driver_kind[1]);
-      s = string_append(s, &size, &ptr, 2, ss, driver_name);
-      }
-    else if (driver_kind)
-      s = string_append(s, &size, &ptr, 2, US" ", driver_kind);
-
-    sprintf(CS ss, " defer (%d)", addr->basic_errno);
-    s = string_cat(s, &size, &ptr, ss, Ustrlen(ss));
-
-    if (addr->basic_errno > 0)
-      s = string_append(s, &size, &ptr, 2, US": ",
-        US strerror(addr->basic_errno));
-
-    if (addr->host_used)
-      {
-      s = string_append(s, &size, &ptr, 5,
-			US" H=", addr->host_used->name,
-			US" [",  addr->host_used->address, US"]");
-      if (LOGGING(outgoing_port))
-	{
-	int port = addr->host_used->port;
-	s = string_append(s, &size, &ptr, 2,
-	      US":", port == PORT_NONE ? US"25" : string_sprintf("%d", port));
-	}
-      }
-
-    if (addr->message)
-      s = string_append(s, &size, &ptr, 2, US": ", addr->message);
-
-    s[ptr] = 0;
-
-    /* Log the deferment in the message log, but don't clutter it
-    up with retry-time defers after the first delivery attempt. */
-
-    if (deliver_firsttime || addr->basic_errno > ERRNO_RETRY_BASE)
-      deliver_msglog("%s %s\n", now, s);
-
-    /* Write the main log and reset the store */
-
-    log_write(use_log_selector, logflags, "== %s", s);
-    store_reset(reset_point);
-    }
+    deferral_log(addr, now, logflags, driver_name, driver_kind);
   }
 
 
@@ -1348,7 +1615,7 @@ else
   force the af_ignore_error flag. This will cause the address to be discarded
   later (with a log entry). */
 
-  if (sender_address[0] == 0 && message_age >= ignore_bounce_errors_after)
+  if (!*sender_address && message_age >= ignore_bounce_errors_after)
     setflag(addr, af_ignore_error);
 
   /* Freeze the message if requested, or if this is a bounce message (or other
@@ -1387,61 +1654,7 @@ else
     addr_failed = addr;
     }
 
-  /* Build up the log line for the message and main logs */
-
-  s = reset_point = store_get(size);
-
-  /* Create the address string for logging. Must not do this earlier, because
-  an OK result may be changed to FAIL when a pipe returns text. */
-
-  log_address = string_log_address(addr, LOGGING(all_parents), result == OK);
-
-  s = string_cat(s, &size, &ptr, log_address, Ustrlen(log_address));
-
-  if (LOGGING(sender_on_delivery))
-    s = string_append(s, &size, &ptr, 3, US" F=<", sender_address, US">");
-
-  /* Return path may not be set if no delivery actually happened */
-
-  if (used_return_path && LOGGING(return_path_on_delivery))
-    s = string_append(s, &size, &ptr, 3, US" P=<", used_return_path, US">");
-
-  if (addr->router)
-    s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
-  if (addr->transport)
-    s = string_append(s, &size, &ptr, 2, US" T=", addr->transport->name);
-
-  if (addr->host_used)
-    s = d_hostlog(s, &size, &ptr, addr);
-
-#ifdef SUPPORT_TLS
-  s = d_tlslog(s, &size, &ptr, addr);
-#endif
-
-  if (addr->basic_errno > 0)
-    s = string_append(s, &size, &ptr, 2, US": ",
-      US strerror(addr->basic_errno));
-
-  if (addr->message)
-    s = string_append(s, &size, &ptr, 2, US": ", addr->message);
-
-  s[ptr] = 0;
-
-  /* Do the logging. For the message log, "routing failed" for those cases,
-  just to make it clearer. */
-
-  if (driver_name)
-    deliver_msglog("%s %s\n", now, s);
-  else
-    deliver_msglog("%s %s failed for %s\n", now, driver_kind, s);
-
-  log_write(0, LOG_MAIN, "** %s", s);
-
-#ifndef DISABLE_EVENT
-  msg_event_raise(US"msg:fail:delivery", addr);
-#endif
-
-  store_reset(reset_point);
+  failure_log(addr, driver_name ? NULL : driver_kind, now);
   }
 
 /* Ensure logging is turned on again in all cases */
@@ -1957,12 +2170,13 @@ if (  !shadowing
       || tp->log_output || tp->log_fail_output || tp->log_defer_output
    )  )
   {
-  uschar *error;
+  uschar * error;
+
   addr->return_filename =
-    string_sprintf("%s/msglog/%s/%s-%d-%d", spool_directory, message_subdir,
-      message_id, getpid(), return_count++);
-  addr->return_file = open_msglog_file(addr->return_filename, 0400, &error);
-  if (addr->return_file < 0)
+    spool_fname(US"msglog", message_subdir, message_id,
+      string_sprintf("-%d-%d", getpid(), return_count++));
+  
+  if ((addr->return_file = open_msglog_file(addr->return_filename, 0400, &error)) < 0)
     {
     common_error(TRUE, addr, errno, US"Unable to %s file for %s transport "
       "to return message: %s", error, tp->name, strerror(errno));
@@ -2146,7 +2360,7 @@ if ((pid = fork()) == 0)
 	     )
 	 )
       )
-      log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s\n",
+      log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s",
 	ret == -1 ? strerror(errno) : "short write");
 
     /* Now any messages */
@@ -2157,7 +2371,7 @@ if ((pid = fork()) == 0)
       if(  (ret = write(pfd[pipe_write], &message_length, sizeof(int))) != sizeof(int)
         || message_length > 0  && (ret = write(pfd[pipe_write], s, message_length)) != message_length
 	)
-        log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s\n",
+        log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s",
 	  ret == -1 ? strerror(errno) : "short write");
       }
     }
@@ -2188,8 +2402,7 @@ will remain. Afterwards, close the reading end. */
 
 for (addr2 = addr; addr2; addr2 = addr2->next)
   {
-  len = read(pfd[pipe_read], &status, sizeof(int));
-  if (len > 0)
+  if ((len = read(pfd[pipe_read], &status, sizeof(int))) > 0)
     {
     int i;
     uschar **sptr;
@@ -2206,10 +2419,24 @@ for (addr2 = addr; addr2; addr2 = addr2->next)
 
     if (testflag(addr2, af_file))
       {
-      int local_part_length;
-      len = read(pfd[pipe_read], &local_part_length, sizeof(int));
-      len = read(pfd[pipe_read], big_buffer, local_part_length);
-      big_buffer[local_part_length] = 0;
+      int llen;
+      if (  read(pfd[pipe_read], &llen, sizeof(int)) != sizeof(int)
+	 || llen > 64*4	/* limit from rfc 5821, times I18N factor */
+         )
+	{
+	log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part length read"
+	  " from delivery subprocess");
+	break;
+	}
+      /* sanity-checked llen so disable the Coverity error */
+      /* coverity[tainted_data] */
+      if (read(pfd[pipe_read], big_buffer, llen) != llen)
+	{
+	log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part read"
+	  " from delivery subprocess");
+	break;
+	}
+      big_buffer[llen] = 0;
       addr2->local_part = string_copy(big_buffer);
       }
 
@@ -2220,6 +2447,7 @@ for (addr2 = addr; addr2; addr2 = addr2->next)
       if (message_length > 0)
         {
         len = read(pfd[pipe_read], big_buffer, message_length);
+	big_buffer[big_buffer_size-1] = '\0';		/* guard byte */
         if (len > 0) *sptr = string_copy(big_buffer);
         }
       }
@@ -3288,6 +3516,10 @@ while (!done)
     break;
 #endif
 
+    case 'K':
+    addr->flags |= af_chunking_used;
+    break;
+
     case 'D':
     if (!addr) goto ADDR_MISMATCH;
     memcpy(&(addr->dsn_aware), ptr, sizeof(addr->dsn_aware));
@@ -3855,7 +4087,8 @@ static void
 rmt_dlv_checked_write(int fd, char id, char subid, void * buf, int size)
 {
 uschar	writebuffer[PIPE_HEADER_SIZE + BIG_BUFFER_SIZE];
-int     header_length;
+int header_length;
+int ret;
 
 /* we assume that size can't get larger then BIG_BUFFER_SIZE which currently is set to 16k */
 /* complain to log if someone tries with buffer sizes we can't handle*/
@@ -3885,8 +4118,7 @@ if (buf && size > 0)
   memcpy(writebuffer + PIPE_HEADER_SIZE, buf, size);
 
 size += PIPE_HEADER_SIZE;
-int ret = write(fd, writebuffer, size);
-if(ret != size)
+if ((ret = write(fd, writebuffer, size)) != size)
   log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Failed writing transport result to pipe: %s\n",
     ret == -1 ? strerror(errno) : "short write");
 }
@@ -4220,6 +4452,7 @@ for (delivery_count = 0; addr_remote; delivery_count++)
       ok = FALSE;
       for (h = addr->host_list; h; h = h->next)
         if (Ustrcmp(h->name, continue_hostname) == 0)
+/*XXX should also check port here */
           { ok = TRUE; break; }
       }
 
@@ -4245,7 +4478,11 @@ for (delivery_count = 0; addr_remote; delivery_count++)
 
       else
 	{
-	while (next->next) next = next->next;
+	for (next = addr; ; next = next->next)
+	  {
+	  DEBUG(D_deliver) debug_printf(" %s to def list\n", next->address);
+          if (!next->next) break;
+	  }
 	next->next = addr_defer;
 	addr_defer = addr;
 	}
@@ -4384,18 +4621,23 @@ for (delivery_count = 0; addr_remote; delivery_count++)
     a dup-with-new-file-pointer. */
 
     (void)close(deliver_datafile);
-    sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir,
-      message_id);
-    deliver_datafile = Uopen(spoolname, O_RDWR | O_APPEND, 0);
+    {
+    uschar * fname = spool_fname(US"input", message_subdir, message_id, US"-D");
 
-    if (deliver_datafile < 0)
+    if ((deliver_datafile = Uopen(fname,
+#ifdef O_CLOEXEC
+					O_CLOEXEC |
+#endif
+					O_RDWR | O_APPEND, 0)) < 0)
       log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Failed to reopen %s for remote "
-        "parallel delivery: %s", spoolname, strerror(errno));
+        "parallel delivery: %s", fname, strerror(errno));
+    }
 
     /* Set the close-on-exec flag */
-
+#ifndef O_CLOEXEC
     (void)fcntl(deliver_datafile, F_SETFD, fcntl(deliver_datafile, F_GETFD) |
       FD_CLOEXEC);
+#endif
 
     /* Set the uid/gid of this process; bombs out on failure. */
 
@@ -4526,6 +4768,9 @@ for (delivery_count = 0; addr_remote; delivery_count++)
 	rmt_dlv_checked_write(fd, 'P', '0', NULL, 0);
 #endif
 
+      if (addr->flags & af_chunking_used)
+	rmt_dlv_checked_write(fd, 'K', '0', NULL, 0);
+
       memcpy(big_buffer, &addr->dsn_aware, sizeof(addr->dsn_aware));
       rmt_dlv_checked_write(fd, 'D', '0', big_buffer, sizeof(addr->dsn_aware));
       DEBUG(D_deliver) debug_printf("DSN write: addr->dsn_aware = %d\n", addr->dsn_aware);
@@ -4721,13 +4966,17 @@ Returns:    OK
 */
 
 int
-deliver_split_address(address_item *addr)
+deliver_split_address(address_item * addr)
 {
-uschar *address = addr->address;
-uschar *domain = Ustrrchr(address, '@');
-uschar *t;
-int len = domain - address;
+uschar * address = addr->address;
+uschar * domain;
+uschar * t;
+int len;
 
+if (!(domain = Ustrrchr(address, '@')))
+  return DEFER;		/* should always have a domain, but just in case... */
+
+len = domain - address;
 addr->domain = string_copylc(domain+1);    /* Domains are always caseless */
 
 /* The implication in the RFCs (though I can't say I've seen it spelled out
@@ -4739,7 +4988,7 @@ removing quoting backslashes and any unquoted doublequotes. */
 t = addr->cc_local_part = store_get(len+1);
 while(len-- > 0)
   {
-  register int c = *address++;
+  int c = *address++;
   if (c == '\"') continue;
   if (c == '\\')
     {
@@ -4831,7 +5080,7 @@ if (!Ufgets(buffer, sizeof(buffer), f) || Ustrcmp(buffer, "****\n") == 0)
 para = store_get(size);
 for (;;)
   {
-  para = string_cat(para, &size, &ptr, buffer, Ustrlen(buffer));
+  para = string_cat(para, &size, &ptr, buffer);
   if (!Ufgets(buffer, sizeof(buffer), f) || Ustrcmp(buffer, "****\n") == 0)
     break;
   }
@@ -5131,6 +5380,8 @@ A delivery operation has a process all to itself; we never deliver more than
 one message in the same process. Therefore we needn't worry too much about
 store leakage.
 
+Liable to be called as root.
+
 Arguments:
   id          the id of the message to be delivered
   forced      TRUE if delivery was forced by an administrator; this overrides
@@ -5155,7 +5406,6 @@ int final_yield = DELIVER_ATTEMPTED_NORMAL;
 time_t now = time(NULL);
 address_item *addr_last = NULL;
 uschar *filter_message = NULL;
-FILE *jread;
 int process_recipients = RECIP_ACCEPT;
 open_db dbblock;
 open_db *dbm_file;
@@ -5226,7 +5476,7 @@ Any failures cause messages to be written to the log, except for missing files
 while queue running - another process probably completed delivery. As part of
 opening the data file, message_subdir gets set. */
 
-if (!spool_open_datafile(id))
+if ((deliver_datafile = spool_open_datafile(id)) < 0)
   return continue_closedown();  /* yields DELIVER_NOT_ATTEMPTED */
 
 /* The value of message_size at this point has been set to the data length,
@@ -5237,53 +5487,51 @@ store, and also the list of recipients and the tree of non-recipients and
 assorted flags. It updates message_size. If there is a reading or format error,
 give up; if the message has been around for sufficiently long, remove it. */
 
-sprintf(CS spoolname, "%s-H", id);
-if ((rc = spool_read_header(spoolname, TRUE, TRUE)) != spool_read_OK)
   {
-  if (errno == ERRNO_SPOOLFORMAT)
+  uschar * spoolname = string_sprintf("%s-H", id);
+  if ((rc = spool_read_header(spoolname, TRUE, TRUE)) != spool_read_OK)
     {
-    struct stat statbuf;
-    sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-      spoolname);
-    if (Ustat(big_buffer, &statbuf) == 0)
-      log_write(0, LOG_MAIN, "Format error in spool file %s: "
-        "size=" OFF_T_FMT, spoolname, statbuf.st_size);
-    else log_write(0, LOG_MAIN, "Format error in spool file %s", spoolname);
-    }
-  else
-    log_write(0, LOG_MAIN, "Error reading spool file %s: %s", spoolname,
-      strerror(errno));
+    if (errno == ERRNO_SPOOLFORMAT)
+      {
+      struct stat statbuf;
+      if (Ustat(spool_fname(US"input", message_subdir, spoolname, US""),
+		&statbuf) == 0)
+	log_write(0, LOG_MAIN, "Format error in spool file %s: "
+	  "size=" OFF_T_FMT, spoolname, statbuf.st_size);
+      else
+	log_write(0, LOG_MAIN, "Format error in spool file %s", spoolname);
+      }
+    else
+      log_write(0, LOG_MAIN, "Error reading spool file %s: %s", spoolname,
+	strerror(errno));
 
-  /* If we managed to read the envelope data, received_time contains the
-  time the message was received. Otherwise, we can calculate it from the
-  message id. */
+    /* If we managed to read the envelope data, received_time contains the
+    time the message was received. Otherwise, we can calculate it from the
+    message id. */
 
-  if (rc != spool_read_hdrerror)
-    {
-    received_time = 0;
-    for (i = 0; i < 6; i++)
-      received_time = received_time * BASE_62 + tab62[id[i] - '0'];
-    }
+    if (rc != spool_read_hdrerror)
+      {
+      received_time = 0;
+      for (i = 0; i < 6; i++)
+	received_time = received_time * BASE_62 + tab62[id[i] - '0'];
+      }
 
-  /* If we've had this malformed message too long, sling it. */
+    /* If we've had this malformed message too long, sling it. */
 
-  if (now - received_time > keep_malformed)
-    {
-    sprintf(CS spoolname, "%s/msglog/%s/%s", spool_directory, message_subdir, id);
-    Uunlink(spoolname);
-    sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir, id);
-    Uunlink(spoolname);
-    sprintf(CS spoolname, "%s/input/%s/%s-H", spool_directory, message_subdir, id);
-    Uunlink(spoolname);
-    sprintf(CS spoolname, "%s/input/%s/%s-J", spool_directory, message_subdir, id);
-    Uunlink(spoolname);
-    log_write(0, LOG_MAIN, "Message removed because older than %s",
-      readconf_printtime(keep_malformed));
-    }
+    if (now - received_time > keep_malformed)
+      {
+      Uunlink(spool_fname(US"msglog", message_subdir, id, US""));
+      Uunlink(spool_fname(US"input", message_subdir, id, US"-D"));
+      Uunlink(spool_fname(US"input", message_subdir, id, US"-H"));
+      Uunlink(spool_fname(US"input", message_subdir, id, US"-J"));
+      log_write(0, LOG_MAIN, "Message removed because older than %s",
+	readconf_printtime(keep_malformed));
+      }
 
-  (void)close(deliver_datafile);
-  deliver_datafile = -1;
-  return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
+    (void)close(deliver_datafile);
+    deliver_datafile = -1;
+    return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
+    }
   }
 
 /* The spool header file has been read. Look to see if there is an existing
@@ -5295,37 +5543,55 @@ existence, as it will get further successful deliveries added to it in this
 run, and it will be deleted if this function gets to its end successfully.
 Otherwise it might be needed again. */
 
-sprintf(CS spoolname, "%s/input/%s/%s-J", spool_directory, message_subdir, id);
-jread = Ufopen(spoolname, "rb");
-if (jread)
   {
-  while (Ufgets(big_buffer, big_buffer_size, jread))
+  uschar * fname = spool_fname(US"input", message_subdir, id, US"-J");
+  FILE * jread;
+
+  if (  (journal_fd = Uopen(fname, O_RDWR|O_APPEND
+#ifdef O_CLOEXEC
+				    | O_CLOEXEC
+#endif
+#ifdef O_NOFOLLOW
+				    | O_NOFOLLOW
+#endif
+	, SPOOL_MODE)) >= 0
+     && lseek(journal_fd, 0, SEEK_SET) == 0
+     && (jread = fdopen(journal_fd, "rb"))
+     )
+    {
+    while (Ufgets(big_buffer, big_buffer_size, jread))
+      {
+      int n = Ustrlen(big_buffer);
+      big_buffer[n-1] = 0;
+      tree_add_nonrecipient(big_buffer);
+      DEBUG(D_deliver) debug_printf("Previously delivered address %s taken from "
+	"journal file\n", big_buffer);
+      }
+    rewind(jread);
+    if ((journal_fd = dup(fileno(jread))) < 0)
+      journal_fd = fileno(jread);
+    else
+      (void) fclose(jread);	/* Try to not leak the FILE resource */
+
+    /* Panic-dies on error */
+    (void)spool_write_header(message_id, SW_DELIVERING, NULL);
+    }
+  else if (errno != ENOENT)
     {
-    int n = Ustrlen(big_buffer);
-    big_buffer[n-1] = 0;
-    tree_add_nonrecipient(big_buffer);
-    DEBUG(D_deliver) debug_printf("Previously delivered address %s taken from "
-      "journal file\n", big_buffer);
+    log_write(0, LOG_MAIN|LOG_PANIC, "attempt to open journal for reading gave: "
+      "%s", strerror(errno));
+    return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
     }
-  (void)fclose(jread);
-  /* Panic-dies on error */
-  (void)spool_write_header(message_id, SW_DELIVERING, NULL);
-  }
-else if (errno != ENOENT)
-  {
-  log_write(0, LOG_MAIN|LOG_PANIC, "attempt to open journal for reading gave: "
-    "%s", strerror(errno));
-  return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
-  }
 
-/* A null recipients list indicates some kind of disaster. */
+  /* A null recipients list indicates some kind of disaster. */
 
-if (!recipients_list)
-  {
-  (void)close(deliver_datafile);
-  deliver_datafile = -1;
-  log_write(0, LOG_MAIN, "Spool error: no recipients for %s", spoolname);
-  return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
+  if (!recipients_list)
+    {
+    (void)close(deliver_datafile);
+    deliver_datafile = -1;
+    log_write(0, LOG_MAIN, "Spool error: no recipients for %s", fname);
+    return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
+    }
   }
 
 
@@ -5361,10 +5627,8 @@ if (deliver_freeze)
   ignore timer is exceeded. The message will be discarded if this delivery
   fails. */
 
-  else if (sender_address[0] == 0 && message_age >= ignore_bounce_errors_after)
-    {
+  else if (!*sender_address && message_age >= ignore_bounce_errors_after)
     log_write(0, LOG_MAIN, "Unfrozen by errmsg timer");
-    }
 
   /* If this is a bounce message, or there's no auto thaw, or we haven't
   reached the auto thaw time yet, and this delivery is not forced by an admin
@@ -5413,16 +5677,14 @@ done by rewriting the header spool file. */
 
 if (message_logs)
   {
-  uschar *error;
+  uschar * fname = spool_fname(US"msglog", message_subdir, id, US"");
+  uschar * error;
   int fd;
 
-  sprintf(CS spoolname, "%s/msglog/%s/%s", spool_directory, message_subdir, id);
-  fd = open_msglog_file(spoolname, SPOOL_MODE, &error);
-
-  if (fd < 0)
+  if ((fd = open_msglog_file(fname, SPOOL_MODE, &error)) < 0)
     {
     log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't %s message log %s: %s", error,
-      spoolname, strerror(errno));
+      fname, strerror(errno));
     return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
     }
 
@@ -5431,7 +5693,7 @@ if (message_logs)
   if (!(message_log = fdopen(fd, "a")))
     {
     log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't fdopen message log %s: %s",
-      spoolname, strerror(errno));
+      fname, strerror(errno));
     return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
     }
   }
@@ -5698,22 +5960,18 @@ else if (system_filter && process_recipients != RECIP_FAIL_TIMEOUT)
           tpname = tmp;
           }
         else
-          {
           p->message = string_sprintf("system_filter_%s_transport is unset",
             type);
-          }
 
         if (tpname)
           {
           transport_instance *tp;
           for (tp = transports; tp; tp = tp->next)
-            {
             if (Ustrcmp(tp->name, tpname) == 0)
               {
               p->transport = tp;
               break;
               }
-            }
           if (!tp)
             p->message = string_sprintf("failed to find \"%s\" transport "
               "for system filter delivery", tpname);
@@ -6626,10 +6884,8 @@ there is only address to be delivered - if it succeeds the spool write need not
 happen. */
 
 if (  header_rewritten
-   && (  (  addr_local
-         && (addr_local->next || addr_remote)
-	 )
-      || (addr_remote && addr_remote->next)
+   && (  addr_local && (addr_local->next || addr_remote)
+      || addr_remote && addr_remote->next
    )  )
   {
   /* Panic-dies on error */
@@ -6638,10 +6894,10 @@ if (  header_rewritten
   }
 
 
-/* If there are any deliveries to be done, open the journal file. This is used
-to record successful deliveries as soon as possible after each delivery is
-known to be complete. A file opened with O_APPEND is used so that several
-processes can run simultaneously.
+/* If there are any deliveries to be and we do not already have the journal
+file, create it. This is used to record successful deliveries as soon as
+possible after each delivery is known to be complete. A file opened with
+O_APPEND is used so that several processes can run simultaneously.
 
 The journal is just insurance against crashes. When the spool file is
 ultimately updated at the end of processing, the journal is deleted. If a
@@ -6650,34 +6906,47 @@ therein are added to the non-recipients. */
 
 if (addr_local || addr_remote)
   {
-  sprintf(CS spoolname, "%s/input/%s/%s-J", spool_directory, message_subdir, id);
-  journal_fd = Uopen(spoolname, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE);
-
   if (journal_fd < 0)
     {
-    log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't open journal file %s: %s",
-      spoolname, strerror(errno));
-    return DELIVER_NOT_ATTEMPTED;
-    }
+    uschar * fname = spool_fname(US"input", message_subdir, id, US"-J");
+    
+    if ((journal_fd = Uopen(fname,
+#ifdef O_CLOEXEC
+			O_CLOEXEC |
+#endif
+			O_WRONLY|O_APPEND|O_CREAT|O_EXCL, SPOOL_MODE)) < 0)
+      {
+      log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't open journal file %s: %s",
+	fname, strerror(errno));
+      return DELIVER_NOT_ATTEMPTED;
+      }
 
-  /* Set the close-on-exec flag, make the file owned by Exim, and ensure
-  that the mode is correct - the group setting doesn't always seem to get
-  set automatically. */
+    /* Set the close-on-exec flag, make the file owned by Exim, and ensure
+    that the mode is correct - the group setting doesn't always seem to get
+    set automatically. */
 
-  if(  fcntl(journal_fd, F_SETFD, fcntl(journal_fd, F_GETFD) | FD_CLOEXEC)
-    || fchown(journal_fd, exim_uid, exim_gid)
-    || fchmod(journal_fd, SPOOL_MODE)
-    )
-    {
-    int ret = Uunlink(spoolname);
-    log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't set perms on journal file %s: %s",
-      spoolname, strerror(errno));
-    if(ret  &&  errno != ENOENT)
-      log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
-        spoolname, strerror(errno));
-    return DELIVER_NOT_ATTEMPTED;
+    if(  fchown(journal_fd, exim_uid, exim_gid)
+      || fchmod(journal_fd, SPOOL_MODE)
+#ifndef O_CLOEXEC
+      || fcntl(journal_fd, F_SETFD, fcntl(journal_fd, F_GETFD) | FD_CLOEXEC)
+#endif
+      )
+      {
+      int ret = Uunlink(fname);
+      log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't set perms on journal file %s: %s",
+	fname, strerror(errno));
+      if(ret  &&  errno != ENOENT)
+	log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
+	  fname, strerror(errno));
+      return DELIVER_NOT_ATTEMPTED;
+      }
     }
   }
+else if (journal_fd >= 0)
+  {
+  close(journal_fd);
+  journal_fd = -1;
+  }
 
 
 
@@ -6904,8 +7173,8 @@ if (addr_senddsn)
     {
     FILE *f = fdopen(fd, "wb");
     /* header only as required by RFC. only failure DSN needs to honor RET=FULL */
-    int topt = topt_add_return_path | topt_no_body;
     uschar * bound;
+    transport_ctx tctx = {0};
 
     DEBUG(D_deliver)
       debug_printf("sending error message to: %s\n", sender_address);
@@ -6953,7 +7222,7 @@ if (addr_senddsn)
       if (auth_xtextdecode(dsn_envid, &xdec_envid) > 0)
         fprintf(f, "Original-Envelope-ID: %s\n", dsn_envid);
       else
-        fprintf(f, "X-Original-Envelope-ID: error decoding xtext formated ENVID\n");
+        fprintf(f, "X-Original-Envelope-ID: error decoding xtext formatted ENVID\n");
       }
     fputc('\n', f);
 
@@ -6984,7 +7253,9 @@ if (addr_senddsn)
     return_path = sender_address;   /* In case not previously set */
 
     /* Write the original email out */
-    transport_write_message(NULL, fileno(f), topt, 0, NULL, NULL, NULL, NULL, NULL, 0);
+
+    tctx.options = topt_add_return_path | topt_no_body;
+    transport_write_message(fileno(f), &tctx, 0);
     fflush(f);
 
     fprintf(f,"\n--%s--\n", bound);
@@ -7339,7 +7610,7 @@ wording. */
         if (auth_xtextdecode(dsn_envid, &xdec_envid) > 0)
           fprintf(f, "Original-Envelope-ID: %s\n", dsn_envid);
         else
-          fprintf(f, "X-Original-Envelope-ID: error decoding xtext formated ENVID\n");
+          fprintf(f, "X-Original-Envelope-ID: error decoding xtext formatted ENVID\n");
         }
       fputc('\n', f);
 
@@ -7439,8 +7710,16 @@ wording. */
       fflush(f);
       transport_filter_argv = NULL;   /* Just in case */
       return_path = sender_address;   /* In case not previously set */
-      transport_write_message(NULL, fileno(f), topt,
-        0, dsnnotifyhdr, NULL, NULL, NULL, NULL, 0);
+	{			      /* Dummy transport for headers add */
+	transport_ctx tctx = {0};
+	transport_instance tb = {0};
+
+	tctx.tblock = &tb;
+	tctx.options = topt;
+	tb.add_headers = dsnnotifyhdr;
+
+	transport_write_message(fileno(f), &tctx, 0);
+	}
       fflush(f);
 
       /* we never add the final text. close the file */
@@ -7515,40 +7794,43 @@ Then delete the message itself. */
 
 if (!addr_defer)
   {
+  uschar * fname;
+
   if (message_logs)
     {
-    sprintf(CS spoolname, "%s/msglog/%s/%s", spool_directory, message_subdir,
-      id);
+    fname = spool_fname(US"msglog", message_subdir, id, US"");
     if (preserve_message_logs)
       {
       int rc;
-      sprintf(CS big_buffer, "%s/msglog.OLD/%s", spool_directory, id);
-      if ((rc = Urename(spoolname, big_buffer)) < 0)
+      uschar * moname = spool_fname(US"msglog.OLD", US"", id, US"");
+
+      if ((rc = Urename(fname, moname)) < 0)
         {
-        (void)directory_make(spool_directory, US"msglog.OLD",
-          MSGLOG_DIRECTORY_MODE, TRUE);
-        rc = Urename(spoolname, big_buffer);
+        (void)directory_make(spool_directory,
+			      spool_sname(US"msglog.OLD", US""),
+			      MSGLOG_DIRECTORY_MODE, TRUE);
+        rc = Urename(fname, moname);
         }
       if (rc < 0)
         log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to move %s to the "
-          "msglog.OLD directory", spoolname);
+          "msglog.OLD directory", fname);
       }
     else
-      if (Uunlink(spoolname) < 0)
+      if (Uunlink(fname) < 0)
         log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
-		  spoolname, strerror(errno));
+		  fname, strerror(errno));
     }
 
   /* Remove the two message files. */
 
-  sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir, id);
-  if (Uunlink(spoolname) < 0)
+  fname = spool_fname(US"input", message_subdir, id, US"-D");
+  if (Uunlink(fname) < 0)
     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
-      spoolname, strerror(errno));
-  sprintf(CS spoolname, "%s/input/%s/%s-H", spool_directory, message_subdir, id);
-  if (Uunlink(spoolname) < 0)
+      fname, strerror(errno));
+  fname = spool_fname(US"input", message_subdir, id, US"-H");
+  if (Uunlink(fname) < 0)
     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
-      spoolname, strerror(errno));
+      fname, strerror(errno));
 
   /* Log the end of this message, with queue time if requested. */
 
@@ -7642,10 +7924,12 @@ else if (addr_defer != (address_item *)(+1))
         }
 
       /* Didn't find the address already in the list, and did find the
-      ultimate parent's address in the list. After adding the recipient,
+      ultimate parent's address in the list, and they really are different
+      (i.e. not from an identity-redirect). After adding the recipient,
       update the errors address in the recipients list. */
 
-      if (i >= recipients_count && t < recipients_count)
+      if (  i >= recipients_count && t < recipients_count
+         && Ustrcmp(otaddr->address, otaddr->parent->address) != 0)
         {
         DEBUG(D_deliver) debug_printf("one_time: adding %s in place of %s\n",
           otaddr->address, otaddr->parent->address);
@@ -7660,19 +7944,14 @@ else if (addr_defer != (address_item *)(+1))
     this deferred address or, if there is none, the sender address, is on the
     list of recipients for a warning message. */
 
-    if (sender_address[0] != 0)
-      if (addr->prop.errors_address)
-        {
-        if (Ustrstr(recipients, addr->prop.errors_address) == NULL)
-          recipients = string_sprintf("%s%s%s", recipients,
-            (recipients[0] == 0)? "" : ",", addr->prop.errors_address);
-        }
-      else
-        {
-        if (Ustrstr(recipients, sender_address) == NULL)
-          recipients = string_sprintf("%s%s%s", recipients,
-            (recipients[0] == 0)? "" : ",", sender_address);
-        }
+    if (sender_address[0])
+      {
+      uschar * s = addr->prop.errors_address;
+      if (!s) s = sender_address;
+      if (Ustrstr(recipients, s) == NULL)
+	recipients = string_sprintf("%s%s%s", recipients,
+	  recipients[0] ? "," : "", s);
+      }
     }
 
   /* Send a warning message if the conditions are right. If the condition check
@@ -7753,7 +8032,7 @@ else if (addr_defer != (address_item *)(+1))
         FILE *wmf = NULL;
         FILE *f = fdopen(fd, "wb");
 	uschar * bound;
-        int topt;
+	transport_ctx tctx = {0};
 
         if (warn_message_file)
           if (!(wmf = Ufopen(warn_message_file, "rb")))
@@ -7872,7 +8151,7 @@ else if (addr_defer != (address_item *)(+1))
           if (auth_xtextdecode(dsn_envid, &xdec_envid) > 0)
             fprintf(f,"Original-Envelope-ID: %s\n", dsn_envid);
           else
-            fprintf(f,"X-Original-Envelope-ID: error decoding xtext formated ENVID\n");
+            fprintf(f,"X-Original-Envelope-ID: error decoding xtext formatted ENVID\n");
           }
         fputc('\n', f);
 
@@ -7900,11 +8179,12 @@ else if (addr_defer != (address_item *)(+1))
 
         fflush(f);
         /* header only as required by RFC. only failure DSN needs to honor RET=FULL */
-        topt = topt_add_return_path | topt_no_body;
+        tctx.options = topt_add_return_path | topt_no_body;
         transport_filter_argv = NULL;   /* Just in case */
         return_path = sender_address;   /* In case not previously set */
+
         /* Write the original email out */
-        transport_write_message(NULL, fileno(f), topt, 0, NULL, NULL, NULL, NULL, NULL, 0);
+        transport_write_message(fileno(f), &tctx, 0);
         fflush(f);
 
         fprintf(f,"\n--%s--\n", bound);
@@ -8015,9 +8295,10 @@ if (journal_fd >= 0) (void)close(journal_fd);
 
 if (remove_journal)
   {
-  sprintf(CS spoolname, "%s/input/%s/%s-J", spool_directory, message_subdir, id);
-  if (Uunlink(spoolname) < 0 && errno != ENOENT)
-    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", spoolname,
+  uschar * fname = spool_fname(US"input", message_subdir, id, US"-J");
+
+  if (Uunlink(fname) < 0 && errno != ENOENT)
+    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", fname,
       strerror(errno));
 
   /* Move the message off the spool if reqested */
@@ -8067,6 +8348,9 @@ if (!regex_STARTTLS) regex_STARTTLS =
   regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
 #endif
 
+if (!regex_CHUNKING) regex_CHUNKING =
+  regex_must_compile(US"\\n250[\\s\\-]CHUNKING(\\s|\\n|$)", FALSE, TRUE);
+
 #ifndef DISABLE_PRDR
 if (!regex_PRDR) regex_PRDR =
   regex_must_compile(US"\\n250[\\s\\-]PRDR(\\s|\\n|$)", FALSE, TRUE);
@@ -8091,8 +8375,18 @@ deliver_get_sender_address (uschar * id)
 int rc;
 uschar * new_sender_address,
        * save_sender_address;
+BOOL save_qr = queue_running;
+uschar * spoolname;
+
+/* make spool_open_datafile non-noisy on fail */
+
+queue_running = TRUE;
+
+/* Side effect: message_subdir is set for the (possibly split) spool directory */
 
-if (!spool_open_datafile(id))
+deliver_datafile = spool_open_datafile(id);
+queue_running = save_qr;
+if (deliver_datafile < 0)
   return NULL;
 
 /* Save and restore the global sender_address.  I'm not sure if we should
@@ -8101,7 +8395,7 @@ spool_read_header() may change all of them. But OTOH, when this
 deliver_get_sender_address() gets called, the current message is done
 already and nobody needs the globals anymore. (HS12, 2015-08-21) */
 
-sprintf(CS spoolname, "%s-H", id);
+spoolname = string_sprintf("%s-H", id);
 save_sender_address = sender_address;
 
 rc = spool_read_header(spoolname, TRUE, TRUE);
diff --git a/src/src/demime.c b/src/src/demime.c
deleted file mode 100644
index 887678db3..000000000
--- a/src/src/demime.c
+++ /dev/null
@@ -1,1243 +0,0 @@
-/*************************************************
-*     Exim - an Internet mail transport agent    *
-*************************************************/
-
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003-???? */
-/* License: GPL */
-
-/* Code for unpacking MIME containers. Called from acl.c. */
-
-#include "exim.h"
-#ifdef WITH_OLD_DEMIME
-
-#include "demime.h"
-
-uschar demime_reason_buffer[1024];
-struct file_extension *file_extensions = NULL;
-
-int demime(uschar **listptr) {
-  int sep = 0;
-  uschar *list = *listptr;
-  uschar *option;
-  uschar option_buffer[64];
-  unsigned long mbox_size;
-  FILE *mbox_file;
-  uschar defer_error_buffer[1024];
-  int demime_rc = 0;
-
-  /* reset found_extension variable */
-  found_extension = NULL;
-
-  /* try to find 1st option */
-  if ((option = string_nextinlist(&list, &sep,
-                                  option_buffer,
-                                  sizeof(option_buffer))) != NULL) {
-
-    /* parse 1st option */
-    if ( (Ustrcmp(option,"false") == 0) || (Ustrcmp(option,"0") == 0) ) {
-      /* explicitly no demimeing */
-      return FAIL;
-    };
-  }
-  else {
-    /* no options -> no demimeing */
-    return FAIL;
-  };
-
-  /* make sure the eml mbox file is spooled up */
-  mbox_file = spool_mbox(&mbox_size, NULL);
-
-  if (mbox_file == NULL) {
-    /* error while spooling */
-    log_write(0, LOG_MAIN|LOG_PANIC,
-           "demime acl condition: error while creating mbox spool file");
-    return DEFER;
-  };
-
-  /* call demimer if not already done earlier */
-  if (!demime_ok)
-    demime_rc = mime_demux(mbox_file, defer_error_buffer);
-
-  (void)fclose(mbox_file);
-
-  if (demime_rc == DEFER) {
-    /* temporary failure (DEFER => DEFER) */
-    log_write(0, LOG_MAIN,
-        "demime acl condition: %s", defer_error_buffer);
-    return DEFER;
-  };
-
-  /* set demime_ok to avoid unpacking again */
-  demime_ok = 1;
-
-  /* check for file extensions, if there */
-  while (option != NULL) {
-    struct file_extension *this_extension = file_extensions;
-
-    /* Look for the wildcard. If it is found, we always return true.
-    The user must then use a custom condition to evaluate demime_errorlevel */
-    if (Ustrcmp(option,"*") == 0) {
-      found_extension = NULL;
-      return OK;
-    };
-
-    /* loop thru extension list */
-    while (this_extension != NULL) {
-      if (strcmpic(option, this_extension->file_extension_string) == 0) {
-        /* found one */
-        found_extension = this_extension->file_extension_string;
-        return OK;
-      };
-      this_extension = this_extension->next;
-    };
-
-    /* grab next extension from option list */
-    option = string_nextinlist(&list, &sep,
-                               option_buffer,
-                               sizeof(option_buffer));
-  };
-
-  /* nothing found */
-  return FAIL;
-}
-
-
-/*************************************************
-* small hex_str -> integer conversion function   *
-*************************************************/
-
-/* needed for quoted-printable
-*/
-
-unsigned int mime_hstr_i(uschar *cptr) {
-  unsigned int i, j = 0;
-
-  while (cptr && *cptr && isxdigit(*cptr)) {
-    i = *cptr++ - '0';
-    if (9 < i) i -= 7;
-    j <<= 4;
-    j |= (i & 0x0f);
-  }
-
-  return(j);
-}
-
-
-/*************************************************
-* decode quoted-printable chars                  *
-*************************************************/
-
-/* gets called when we hit a =
-   returns: new pointer position
-   result code in c:
-          -2 - decode error
-          -1 - soft line break, no char
-           0-255 - char to write
-*/
-
-uschar *mime_decode_qp(uschar *qp_p,int *c) {
-  uschar hex[] = {0,0,0};
-  int nan = 0;
-  uschar *initial_pos = qp_p;
-
-  /* advance one char */
-  qp_p++;
-
-  REPEAT_FIRST:
-  if ( (*qp_p == '\t') || (*qp_p == ' ') || (*qp_p == '\r') )  {
-    /* tab or whitespace may follow
-       just ignore it, but remember
-       that this is not a valid hex
-       encoding any more */
-    nan = 1;
-    qp_p++;
-    goto REPEAT_FIRST;
-  }
-  else if ( (('0' <= *qp_p) && (*qp_p <= '9')) || (('A' <= *qp_p) && (*qp_p <= 'F'))  || (('a' <= *qp_p) && (*qp_p <= 'f')) ) {
-    /* this is a valid hex char, if nan is unset */
-    if (nan) {
-      /* this is illegal */
-      *c = -2;
-      return initial_pos;
-    }
-    else {
-      hex[0] = *qp_p;
-      qp_p++;
-    };
-  }
-  else if (*qp_p == '\n') {
-    /* hit soft line break already, continue */
-    *c = -1;
-    return qp_p;
-  }
-  else {
-    /* illegal char here */
-    *c = -2;
-    return initial_pos;
-  };
-
-  if ( (('0' <= *qp_p) && (*qp_p <= '9')) || (('A' <= *qp_p) && (*qp_p <= 'F')) || (('a' <= *qp_p) && (*qp_p <= 'f')) ) {
-    if (hex[0] > 0) {
-      hex[1] = *qp_p;
-      /* do hex conversion */
-      *c = mime_hstr_i(hex);
-      qp_p++;
-      return qp_p;
-    }
-    else {
-      /* huh ? */
-      *c = -2;
-      return initial_pos;
-    };
-  }
-  else {
-    /* illegal char */
-    *c = -2;
-    return initial_pos;
-  };
-
-}
-
-
-/*************************************************
-* open new dump file                             *
-*************************************************/
-
-/* open new dump file
-   returns: -2 soft error
-            or file #, FILE * in f
-*/
-
-int mime_get_dump_file(uschar *extension, FILE **f, uschar *info) {
-  uschar file_name[1024];
-  int result;
-  unsigned int file_nr;
-  uschar default_extension[] = ".com";
-  uschar *p;
-
-  if (extension == NULL)
-    extension = default_extension;
-
-  /* scan the proposed extension.
-     if it is longer than 4 chars, or
-     contains exotic chars, use the default extension */
-
-/*  if (Ustrlen(extension) > 4) {
-    extension = default_extension;
-  };
-*/
-
-  p = extension+1;
-
-  while (*p != 0) {
-    *p = (uschar)tolower((uschar)*p);
-    if ( (*p < 97) || (*p > 122) ) {
-      extension = default_extension;
-      break;
-    };
-    p++;
-  };
-
-  /* find a new file to write to */
-  file_nr = 0;
-  do {
-    struct stat mystat;
-
-    (void)string_format(file_name,1024,"%s/scan/%s/%s-%05u%s",spool_directory,message_id,message_id,file_nr,extension);
-    file_nr++;
-    if (file_nr >= MIME_SANITY_MAX_DUMP_FILES) {
-      /* max parts reached */
-      mime_trigger_error(MIME_ERRORLEVEL_TOO_MANY_PARTS);
-      break;
-    };
-    result = stat(CS file_name,&mystat);
-  }
-  while(result != -1);
-
-  *f = modefopen(file_name,"wb+",SPOOL_MODE);
-  if (*f == NULL) {
-    /* cannot open new dump file, disk full ? -> soft error */
-    (void)string_format(info, 1024,"unable to open dump file");
-    return -2;
-  };
-
-  return file_nr;
-}
-
-
-/*************************************************
-* Find a string in a mime header                 *
-*************************************************/
-
-/* Find a string in a mime header, and optionally fill in
-   the value associated with it into *value
-
-   returns: 0 - nothing found
-            1 - found param
-            2 - found param + value
-*/
-
-int mime_header_find(uschar *header, uschar *param, uschar **value) {
-  uschar *needle;
-
-  needle = strstric(header,param,FALSE);
-  if (needle != NULL) {
-    if (value != NULL) {
-      needle += Ustrlen(param);
-      if (*needle == '=') {
-        uschar *value_start;
-        uschar *value_end;
-
-        value_start = needle + 1;
-        value_end = strstric(value_start,US";",FALSE);
-        if (value_end != NULL) {
-          /* allocate mem for value */
-          *value = (uschar *)malloc((value_end - value_start)+1);
-          if (*value == NULL)
-            return 0;
-
-          Ustrncpy(*value,value_start,(value_end - value_start));
-          (*value)[(value_end - value_start)] = '\0';
-          return 2;
-        };
-      };
-    };
-    return 1;
-  };
-  return 0;
-}
-
-
-/*************************************************
-* Read a line of MIME input                      *
-*************************************************/
-/* returns status code, one of
-   MIME_READ_LINE_EOF 0
-   MIME_READ_LINE_OK 1
-   MIME_READ_LINE_OVERFLOW 2
-
-   In header mode, the line will be "cooked".
-*/
-
-int mime_read_line(FILE *f, int mime_demux_mode, uschar *buffer, long *num_copied) {
-  int c = EOF;
-  int done = 0;
-  int header_value_mode = 0;
-  int header_open_brackets = 0;
-
-  *num_copied = 0;
-
-  while(!done) {
-
-    c = fgetc(f);
-    if (c == EOF) break;
-
-    /* --------- header mode -------------- */
-    if (mime_demux_mode == MIME_DEMUX_MODE_MIME_HEADERS) {
-
-      /* always skip CRs */
-      if (c == '\r') continue;
-
-      if (c == '\n') {
-        if ((*num_copied) > 0) {
-          /* look if next char is '\t' or ' ' */
-          c = fgetc(f);
-          if (c == EOF) break;
-          if ( (c == '\t') || (c == ' ') ) continue;
-          (void)ungetc(c,f);
-        };
-        /* end of the header, terminate with ';' */
-        c = ';';
-        done = 1;
-      };
-
-      /* skip control characters */
-      if (c < 32) continue;
-
-      /* skip whitespace + tabs */
-      if ( (c == ' ') || (c == '\t') )
-        continue;
-
-      if (header_value_mode) {
-        /* --------- value mode ----------- */
-        /* skip quotes */
-        if (c == '"') continue;
-
-        /* leave value mode on ';' */
-        if (c == ';') {
-          header_value_mode = 0;
-        };
-        /* -------------------------------- */
-      }
-      else {
-        /* -------- non-value mode -------- */
-        if (c == '\\') {
-          /* quote next char. can be used
-          to escape brackets. */
-          c = fgetc(f);
-          if (c == EOF) break;
-        }
-        else if (c == '(') {
-          header_open_brackets++;
-          continue;
-        }
-        else if ((c == ')') && header_open_brackets) {
-          header_open_brackets--;
-          continue;
-        }
-        else if ( (c == '=') && !header_open_brackets ) {
-          /* enter value mode */
-          header_value_mode = 1;
-        };
-
-        /* skip chars while we are in a comment */
-        if (header_open_brackets > 0)
-          continue;
-        /* -------------------------------- */
-      };
-    }
-    /* ------------------------------------ */
-    else {
-    /* ----------- non-header mode -------- */
-      /* break on '\n' */
-      if (c == '\n')
-        done = 1;
-    /* ------------------------------------ */
-    };
-
-    /* copy the char to the buffer */
-    buffer[*num_copied] = (uschar)c;
-    /* raise counter */
-    (*num_copied)++;
-
-    /* break if buffer is full */
-    if (*num_copied > MIME_SANITY_MAX_LINE_LENGTH-1) {
-      done = 1;
-    };
-  }
-
-  /* 0-terminate */
-  buffer[*num_copied] = '\0';
-
-  if (*num_copied > MIME_SANITY_MAX_LINE_LENGTH-1)
-    return MIME_READ_LINE_OVERFLOW;
-  else
-    if (c == EOF)
-      return MIME_READ_LINE_EOF;
-    else
-      return MIME_READ_LINE_OK;
-}
-
-
-/*************************************************
-* Check for a MIME boundary                      *
-*************************************************/
-
-/* returns: 0 - no boundary found
-            1 - start boundary found
-            2 - end boundary found
-*/
-
-int mime_check_boundary(uschar *line, struct boundary *boundaries) {
-  struct boundary *thisboundary = boundaries;
-  uschar workbuf[MIME_SANITY_MAX_LINE_LENGTH+1];
-  unsigned int i,j=0;
-
-  /* check for '--' first */
-  if (Ustrncmp(line,"--",2) == 0) {
-
-    /* strip tab and space */
-    for (i = 2; i < Ustrlen(line); i++) {
-      if ((line[i] != ' ') && (line[i] != '\t')) {
-        workbuf[j] = line[i];
-        j++;
-      };
-    };
-    workbuf[j+1]='\0';
-
-    while(thisboundary != NULL) {
-      if (Ustrncmp(workbuf,thisboundary->boundary_string,Ustrlen(thisboundary->boundary_string)) == 0) {
-        if (Ustrncmp(&workbuf[Ustrlen(thisboundary->boundary_string)],"--",2) == 0) {
-          /* final boundary found */
-          return 2;
-        };
-        return 1;
-      };
-      thisboundary = thisboundary->next;
-    };
-  };
-
-  return 0;
-}
-
-
-/*************************************************
-* Check for start of a UUENCODE block            *
-*************************************************/
-
-/* returns 0 for no hit,
-           >0 for hit
-*/
-
-int mime_check_uu_start(uschar *line, uschar *uu_file_extension, int *has_tnef) {
-
-  if ( (strncmpic(line,US"begin ",6) == 0)) {
-    uschar *uu_filename = &line[6];
-
-    /* skip perms, if present */
-    Ustrtoul(&line[6],&uu_filename,10);
-
-    /* advance one char */
-    uu_filename++;
-
-    /* This should be the filename.
-    Check if winmail.dat is present,
-    which indicates TNEF. */
-    if (strncmpic(uu_filename,US"winmail.dat",11) == 0) {
-      *has_tnef = 1;
-    };
-
-    /* reverse to dot if present,
-    copy up to 4 chars for the extension */
-    if (Ustrrchr(uu_filename,'.') != NULL)
-      uu_filename = Ustrrchr(uu_filename,'.');
-
-    return sscanf(CS uu_filename, "%4[.0-9A-Za-z]",CS uu_file_extension);
-  }
-  else {
-    /* nothing found */
-    return 0;
-  };
-}
-
-
-/*************************************************
-* Decode a uu line                               *
-*************************************************/
-
-/* returns number of decoded bytes
-         -2 for soft errors
-*/
-
-int warned_about_uudec_line_sanity_1 = 0;
-int warned_about_uudec_line_sanity_2 = 0;
-long uu_decode_line(uschar *line, uschar **data, long line_len, uschar *info) {
-  uschar *p;
-  long num_decoded = 0;
-  uschar tmp_c;
-  uschar *work;
-  int uu_decoded_line_len, uu_encoded_line_len;
-
-  /* allocate memory for data and work buffer */
-  *data = (uschar *)malloc(line_len);
-  if (*data == NULL) {
-    (void)string_format(info, 1024,"unable to allocate %lu bytes",line_len);
-    return -2;
-  };
-
-  work = (uschar *)malloc(line_len);
-  if (work == NULL) {
-    (void)string_format(info, 1024,"unable to allocate %lu bytes",line_len);
-    return -2;
-  };
-
-  memcpy(work,line,line_len);
-
-  /* First char is line length
-  This is microsofts way of getting it. Scary. */
-  if (work[0] < 32) {
-    /* ignore this line */
-    return 0;
-  }
-  else {
-    uu_decoded_line_len = uudec[work[0]];
-  };
-
-  p = &work[1];
-
-  while (*p > 32) {
-    *p = uudec[*p];
-    p++;
-  };
-
-  uu_encoded_line_len = (p - &work[1]);
-  p = &work[1];
-
-  /* check that resulting line length is a multiple of 4 */
-  if ( ( uu_encoded_line_len % 4 ) != 0) {
-    if (!warned_about_uudec_line_sanity_1) {
-      mime_trigger_error(MIME_ERRORLEVEL_UU_MISALIGNED);
-      warned_about_uudec_line_sanity_1 = 1;
-    };
-    return -1;
-  };
-
-  /* check that the line length matches */
-  if ( ( (((uu_encoded_line_len/4)*3)-2) > uu_decoded_line_len ) || (((uu_encoded_line_len/4)*3) < uu_decoded_line_len) ) {
-    if (!warned_about_uudec_line_sanity_2) {
-      mime_trigger_error(MIME_ERRORLEVEL_UU_LINE_LENGTH);
-      warned_about_uudec_line_sanity_2 = 1;
-    };
-    return -1;
-  };
-
-  while ( ((p - &work[1]) < uu_encoded_line_len) && (num_decoded < uu_decoded_line_len)) {
-
-    /* byte 0 ---------------------- */
-    if ((p - &work[1] + 1) >= uu_encoded_line_len) {
-      return 0;
-    }
-
-    (*data)[num_decoded] = *p;
-    (*data)[num_decoded] <<= 2;
-
-    tmp_c = *(p+1);
-    tmp_c >>= 4;
-    (*data)[num_decoded] |= tmp_c;
-
-    num_decoded++;
-    p++;
-
-    /* byte 1 ---------------------- */
-    if ((p - &work[1] + 1) >= uu_encoded_line_len) {
-      return 0;
-    }
-
-    (*data)[num_decoded] = *p;
-    (*data)[num_decoded] <<= 4;
-
-    tmp_c = *(p+1);
-    tmp_c >>= 2;
-    (*data)[num_decoded] |= tmp_c;
-
-    num_decoded++;
-    p++;
-
-    /* byte 2 ---------------------- */
-    if ((p - &work[1] + 1) >= uu_encoded_line_len) {
-      return 0;
-    }
-
-    (*data)[num_decoded] = *p;
-    (*data)[num_decoded] <<= 6;
-
-    (*data)[num_decoded] |= *(p+1);
-
-    num_decoded++;
-    p+=2;
-
-  };
-
-  return uu_decoded_line_len;
-}
-
-
-/*************************************************
-* Decode a b64 or qp line                        *
-*************************************************/
-
-/* returns number of decoded bytes
-         -1 for hard errors
-         -2 for soft errors
-*/
-
-int warned_about_b64_line_length = 0;
-int warned_about_b64_line_sanity = 0;
-int warned_about_b64_illegal_char = 0;
-int warned_about_qp_line_sanity = 0;
-long mime_decode_line(int mime_demux_mode,uschar *line, uschar **data, long max_data_len, uschar *info) {
-  uschar *p;
-  long num_decoded = 0;
-  int offset = 0;
-  uschar tmp_c;
-
-  /* allocate memory for data */
-  *data = (uschar *)malloc(max_data_len);
-  if (*data == NULL) {
-    (void)string_format(info, 1024,"unable to allocate %lu bytes",max_data_len);
-    return -2;
-  };
-
-  if (mime_demux_mode == MIME_DEMUX_MODE_BASE64) {
-    /* ---------------------------------------------- */
-
-    /* NULL out trailing '\r' and '\n' chars */
-    while (Ustrrchr(line,'\r') != NULL) {
-      *(Ustrrchr(line,'\r')) = '\0';
-    };
-    while (Ustrrchr(line,'\n') != NULL) {
-      *(Ustrrchr(line,'\n')) = '\0';
-    };
-
-    /* check maximum base 64 line length */
-    if (Ustrlen(line) > MIME_SANITY_MAX_B64_LINE_LENGTH ) {
-      if (!warned_about_b64_line_length) {
-        mime_trigger_error(MIME_ERRORLEVEL_B64_LINE_LENGTH);
-        warned_about_b64_line_length = 1;
-      };
-    };
-
-    p = line;
-    offset = 0;
-    while (*(p+offset) != '\0') {
-      /* hit illegal char ? */
-      if (b64[*(p+offset)] == 128) {
-        if (!warned_about_b64_illegal_char) {
-          mime_trigger_error(MIME_ERRORLEVEL_B64_ILLEGAL_CHAR);
-          warned_about_b64_illegal_char = 1;
-        };
-        offset++;
-      }
-      else {
-        *p = b64[*(p+offset)];
-        p++;
-      };
-    };
-    *p = 255;
-
-    /* check that resulting line length is a multiple of 4 */
-    if ( ( (p - &line[0]) % 4 ) != 0) {
-      if (!warned_about_b64_line_sanity) {
-        mime_trigger_error(MIME_ERRORLEVEL_B64_MISALIGNED);
-        warned_about_b64_line_sanity = 1;
-      };
-    };
-
-    /* line is translated, start bit shifting */
-    p = line;
-    num_decoded = 0;
-
-    while(*p != 255) {
-
-      /* byte 0 ---------------------- */
-      if (*(p+1) == 255) {
-        break;
-      }
-
-      (*data)[num_decoded] = *p;
-      (*data)[num_decoded] <<= 2;
-
-      tmp_c = *(p+1);
-      tmp_c >>= 4;
-      (*data)[num_decoded] |= tmp_c;
-
-      num_decoded++;
-      p++;
-
-      /* byte 1 ---------------------- */
-      if (*(p+1) == 255) {
-        break;
-      }
-
-      (*data)[num_decoded] = *p;
-      (*data)[num_decoded] <<= 4;
-
-      tmp_c = *(p+1);
-      tmp_c >>= 2;
-      (*data)[num_decoded] |= tmp_c;
-
-      num_decoded++;
-      p++;
-
-      /* byte 2 ---------------------- */
-      if (*(p+1) == 255) {
-        break;
-      }
-
-      (*data)[num_decoded] = *p;
-      (*data)[num_decoded] <<= 6;
-
-      (*data)[num_decoded] |= *(p+1);
-
-      num_decoded++;
-      p+=2;
-
-    };
-    return num_decoded;
-    /* ---------------------------------------------- */
-  }
-  else if (mime_demux_mode == MIME_DEMUX_MODE_QP) {
-    /* ---------------------------------------------- */
-    p = line;
-
-    while (*p != 0) {
-      if (*p == '=') {
-        int decode_qp_result;
-
-        p = mime_decode_qp(p,&decode_qp_result);
-
-        if (decode_qp_result == -2) {
-          /* Error from decoder. p is unchanged. */
-          if (!warned_about_qp_line_sanity) {
-            mime_trigger_error(MIME_ERRORLEVEL_QP_ILLEGAL_CHAR);
-            warned_about_qp_line_sanity = 1;
-          };
-          (*data)[num_decoded] = '=';
-          num_decoded++;
-          p++;
-        }
-        else if (decode_qp_result == -1) {
-          /* End of the line with soft line break.
-          Bail out. */
-          goto QP_RETURN;
-        }
-        else if (decode_qp_result >= 0) {
-          (*data)[num_decoded] = decode_qp_result;
-          num_decoded++;
-        };
-      }
-      else {
-        (*data)[num_decoded] = *p;
-        num_decoded++;
-        p++;
-      };
-    };
-    QP_RETURN:
-    return num_decoded;
-    /* ---------------------------------------------- */
-  };
-
-  return 0;
-}
-
-
-
-/*************************************************
-* Log demime errors and set mime error level     *
-*************************************************/
-
-/* This sets the global demime_reason expansion
-variable and the demime_errorlevel gauge. */
-
-void mime_trigger_error(int level, uschar *format, ...) {
-  char *f;
-  va_list ap;
-
-  if( (f = malloc(16384+23)) != NULL ) {
-    /* first log the incident */
-    sprintf(f,"demime acl condition: ");
-    f+=22;
-    va_start(ap, format);
-    (void)string_vformat(US f, 16383,(char *)format, ap);
-    va_end(ap);
-    f-=22;
-    log_write(0, LOG_MAIN, "%s", f);
-    /* then copy to demime_reason_buffer if new
-    level is greater than old level */
-    if (level > demime_errorlevel) {
-      demime_errorlevel = level;
-      Ustrcpy(demime_reason_buffer, US f);
-      demime_reason = demime_reason_buffer;
-    };
-    free(f);
-  };
-}
-
-/*************************************************
-* Demultiplex MIME stream.                       *
-*************************************************/
-
-/* We can handle BASE64, QUOTED-PRINTABLE, and UUENCODE.
- UUENCODE does not need to have a proper
- transfer-encoding header, we detect it with "begin"
-
- This function will report human parsable errors in
- *info.
-
- returns DEFER -> soft error (see *info)
-         OK    -> EOF hit, all ok
-*/
-
-int mime_demux(FILE *f, uschar *info) {
-  int mime_demux_mode = MIME_DEMUX_MODE_MIME_HEADERS;
-  int uu_mode = MIME_UU_MODE_OFF;
-  FILE *mime_dump_file = NULL;
-  FILE *uu_dump_file = NULL;
-  uschar *line;
-  int mime_read_line_status = MIME_READ_LINE_OK;
-  long line_len;
-  struct boundary *boundaries = NULL;
-  struct mime_part mime_part_p;
-  int has_tnef = 0;
-  int has_rfc822 = 0;
-
-  /* allocate room for our linebuffer */
-  line = (uschar *)malloc(MIME_SANITY_MAX_LINE_LENGTH);
-  if (line == NULL) {
-    (void)string_format(info, 1024,"unable to allocate %u bytes",MIME_SANITY_MAX_LINE_LENGTH);
-    return DEFER;
-  };
-
-  /* clear MIME header structure */
-  memset(&mime_part_p,0,sizeof(mime_part));
-
-  /* ----------------------- start demux loop --------------------- */
-  while (mime_read_line_status == MIME_READ_LINE_OK) {
-
-    /* read a line of input. Depending on the mode we are in,
-    the returned format will differ. */
-    mime_read_line_status = mime_read_line(f,mime_demux_mode,line,&line_len);
-
-    if (mime_read_line_status == MIME_READ_LINE_OVERFLOW) {
-      mime_trigger_error(MIME_ERRORLEVEL_LONG_LINE);
-      /* despite the error, continue  .. */
-      mime_read_line_status = MIME_READ_LINE_OK;
-      continue;
-    }
-    else if (mime_read_line_status == MIME_READ_LINE_EOF) {
-      break;
-    };
-
-    if (mime_demux_mode == MIME_DEMUX_MODE_MIME_HEADERS) {
-      /* -------------- header mode --------------------- */
-
-      /* Check for an empty line, which is the end of the headers.
-       In HEADER mode, the line is returned "cooked", with the
-       final '\n' replaced by a ';' */
-      if (line_len == 1) {
-        int tmp;
-
-        /* We have reached the end of the headers. Start decoding
-        with the collected settings. */
-        if (mime_part_p.seen_content_transfer_encoding > 1) {
-          mime_demux_mode = mime_part_p.seen_content_transfer_encoding;
-        }
-        else {
-          /* default to plain mode if no specific encoding type found */
-          mime_demux_mode = MIME_DEMUX_MODE_PLAIN;
-        };
-
-        /* open new dump file */
-        tmp = mime_get_dump_file(mime_part_p.extension, &mime_dump_file, info);
-        if (tmp < 0) {
-          return DEFER;
-        };
-
-        /* clear out mime_part */
-        memset(&mime_part_p,0,sizeof(mime_part));
-      }
-      else {
-        /* Another header to check for file extensions,
-        encoding type and boundaries */
-        if (strncmpic(US"content-type:",line,Ustrlen("content-type:")) == 0) {
-          /* ---------------------------- Content-Type header ------------------------------- */
-          uschar *value = line;
-
-          /* check for message/partial MIME type and reject it */
-          if (mime_header_find(line,US"message/partial",NULL) > 0)
-            mime_trigger_error(MIME_ERRORLEVEL_MESSAGE_PARTIAL);
-
-          /* check for TNEF content type, remember to unpack TNEF later. */
-          if (mime_header_find(line,US"application/ms-tnef",NULL) > 0)
-            has_tnef = 1;
-
-          /* check for message/rfcxxx attachments */
-          if (mime_header_find(line,US"message/rfc822",NULL) > 0)
-            has_rfc822 = 1;
-
-          /* find the file extension, but do not fill it in
-          it is already set, since content-disposition has
-          precedence. */
-          if (mime_part_p.extension == NULL) {
-            if (mime_header_find(line,US"name",&value) == 2) {
-              if (Ustrlen(value) > MIME_SANITY_MAX_FILENAME)
-                mime_trigger_error(MIME_ERRORLEVEL_FILENAME_LENGTH);
-              mime_part_p.extension = value;
-              mime_part_p.extension = Ustrrchr(value,'.');
-              if (mime_part_p.extension == NULL) {
-                /* file without extension, setting
-                NULL will use the default extension later */
-                mime_part_p.extension = NULL;
-              }
-              else {
-                struct file_extension *this_extension =
-                  (struct file_extension *)malloc(sizeof(file_extension));
-
-                this_extension->file_extension_string =
-                  (uschar *)malloc(Ustrlen(mime_part_p.extension)+1);
-                Ustrcpy(this_extension->file_extension_string,
-                        mime_part_p.extension+1);
-                this_extension->next = file_extensions;
-                file_extensions = this_extension;
-              };
-            };
-          };
-
-          /* find a boundary and add it to the list, if present */
-          value = line;
-          if (mime_header_find(line,US"boundary",&value) == 2) {
-            struct boundary *thisboundary;
-
-            if (Ustrlen(value) > MIME_SANITY_MAX_BOUNDARY_LENGTH) {
-              mime_trigger_error(MIME_ERRORLEVEL_BOUNDARY_LENGTH);
-            }
-            else {
-              thisboundary = (struct boundary*)malloc(sizeof(boundary));
-              thisboundary->next = boundaries;
-              thisboundary->boundary_string = value;
-              boundaries = thisboundary;
-            };
-          };
-
-          if (mime_part_p.seen_content_type == 0) {
-            mime_part_p.seen_content_type = 1;
-          }
-          else {
-            mime_trigger_error(MIME_ERRORLEVEL_DOUBLE_HEADERS);
-          };
-          /* ---------------------------------------------------------------------------- */
-        }
-        else if (strncmpic(US"content-transfer-encoding:",line,Ustrlen("content-transfer-encoding:")) == 0) {
-          /* ---------------------------- Content-Transfer-Encoding header -------------- */
-
-         if (mime_part_p.seen_content_transfer_encoding == 0) {
-            if (mime_header_find(line,US"base64",NULL) > 0) {
-              mime_part_p.seen_content_transfer_encoding = MIME_DEMUX_MODE_BASE64;
-            }
-            else if (mime_header_find(line,US"quoted-printable",NULL) > 0) {
-              mime_part_p.seen_content_transfer_encoding = MIME_DEMUX_MODE_QP;
-            }
-            else {
-              mime_part_p.seen_content_transfer_encoding = MIME_DEMUX_MODE_PLAIN;
-            };
-          }
-          else {
-            mime_trigger_error(MIME_ERRORLEVEL_DOUBLE_HEADERS);
-          };
-          /* ---------------------------------------------------------------------------- */
-        }
-        else if (strncmpic(US"content-disposition:",line,Ustrlen("content-disposition:")) == 0) {
-          /* ---------------------------- Content-Disposition header -------------------- */
-          uschar *value = line;
-
-          if (mime_part_p.seen_content_disposition == 0) {
-            mime_part_p.seen_content_disposition = 1;
-
-            if (mime_header_find(line,US"filename",&value) == 2) {
-              if (Ustrlen(value) > MIME_SANITY_MAX_FILENAME)
-                mime_trigger_error(MIME_ERRORLEVEL_FILENAME_LENGTH);
-              mime_part_p.extension = value;
-              mime_part_p.extension = Ustrrchr(value,'.');
-              if (mime_part_p.extension == NULL) {
-                /* file without extension, setting
-                NULL will use the default extension later */
-                mime_part_p.extension = NULL;
-              }
-              else {
-                struct file_extension *this_extension =
-                  (struct file_extension *)malloc(sizeof(file_extension));
-
-                this_extension->file_extension_string =
-                  (uschar *)malloc(Ustrlen(mime_part_p.extension)+1);
-                Ustrcpy(this_extension->file_extension_string,
-                        mime_part_p.extension+1);
-                this_extension->next = file_extensions;
-                file_extensions = this_extension;
-              };
-            };
-          }
-          else {
-            mime_trigger_error(MIME_ERRORLEVEL_DOUBLE_HEADERS);
-          };
-          /* ---------------------------------------------------------------------------- */
-        };
-      };    /* End of header checks */
-      /* ------------------------------------------------ */
-    }
-    else {
-      /* -------------- non-header mode ----------------- */
-      int tmp;
-
-      if (uu_mode == MIME_UU_MODE_OFF) {
-        uschar uu_file_extension[5];
-        /* We are not currently decoding UUENCODE
-        Check for possible UUENCODE start tag. */
-        if (mime_check_uu_start(line,uu_file_extension,&has_tnef)) {
-          /* possible UUENCODING start detected.
-          Set unconfirmed mode first. */
-          uu_mode = MIME_UU_MODE_UNCONFIRMED;
-          /* open new uu dump file */
-          tmp = mime_get_dump_file(uu_file_extension, &uu_dump_file, info);
-          if (tmp < 0) {
-            free(line);
-            return DEFER;
-          };
-        };
-      }
-      else {
-        uschar *data;
-        long data_len = 0;
-
-        if (uu_mode == MIME_UU_MODE_UNCONFIRMED) {
-         /* We are in unconfirmed UUENCODE mode. */
-
-         data_len = uu_decode_line(line,&data,line_len,info);
-
-         if (data_len == -2) {
-           /* temp error, turn off uudecode mode */
-           if (uu_dump_file != NULL) {
-            (void)fclose(uu_dump_file); uu_dump_file = NULL;
-           };
-           uu_mode = MIME_UU_MODE_OFF;
-           return DEFER;
-         }
-         else if (data_len == -1) {
-           if (uu_dump_file != NULL) {
-            (void)fclose(uu_dump_file); uu_dump_file = NULL;
-           };
-           uu_mode = MIME_UU_MODE_OFF;
-           data_len = 0;
-         }
-         else if (data_len > 0) {
-           /* we have at least decoded a valid byte
-           turn on confirmed mode */
-           uu_mode = MIME_UU_MODE_CONFIRMED;
-         };
-        }
-        else if (uu_mode == MIME_UU_MODE_CONFIRMED) {
-          /* If we are in confirmed UU mode,
-          check for single "end" tag on line */
-          if ((strncmpic(line,US"end",3) == 0) && (line[3] < 32)) {
-            if (uu_dump_file != NULL) {
-              (void)fclose(uu_dump_file); uu_dump_file = NULL;
-            };
-            uu_mode = MIME_UU_MODE_OFF;
-          }
-          else {
-            data_len = uu_decode_line(line,&data,line_len,info);
-            if (data_len == -2) {
-               /* temp error, turn off uudecode mode */
-               if (uu_dump_file != NULL) {
-                 (void)fclose(uu_dump_file); uu_dump_file = NULL;
-               };
-               uu_mode = MIME_UU_MODE_OFF;
-               return DEFER;
-             }
-             else if (data_len == -1) {
-               /* skip this line */
-               data_len = 0;
-             };
-          };
-        };
-
-        /* write data to dump file, if available */
-        if (data_len > 0) {
-          if (fwrite(data,1,data_len,uu_dump_file) < data_len) {
-            /* short write */
-            (void)string_format(info, 1024,"short write on uudecode dump file");
-            free(line);
-            return DEFER;
-          };
-        };
-      };
-
-      if (mime_demux_mode != MIME_DEMUX_MODE_SCANNING) {
-        /* Non-scanning and Non-header mode. That means
-        we are currently decoding data to the dump
-        file. */
-
-        /* Check for a known boundary. */
-        tmp = mime_check_boundary(line,boundaries);
-        if (tmp == 1) {
-          /* We have hit a known start boundary.
-          That will put us back in header mode. */
-          mime_demux_mode = MIME_DEMUX_MODE_MIME_HEADERS;
-          if (mime_dump_file != NULL) {
-            /* if the attachment was a RFC822 message, recurse into it */
-            if (has_rfc822) {
-              has_rfc822 = 0;
-              rewind(mime_dump_file);
-              mime_demux(mime_dump_file,info);
-            };
-
-            (void)fclose(mime_dump_file); mime_dump_file = NULL;
-          };
-        }
-        else if (tmp == 2) {
-          /* We have hit a known end boundary.
-          That puts us into scanning mode, which will end when we hit another known start boundary */
-          mime_demux_mode = MIME_DEMUX_MODE_SCANNING;
-          if (mime_dump_file != NULL) {
-            /* if the attachment was a RFC822 message, recurse into it */
-            if (has_rfc822) {
-              has_rfc822 = 0;
-              rewind(mime_dump_file);
-              mime_demux(mime_dump_file,info);
-            };
-
-            (void)fclose(mime_dump_file); mime_dump_file = NULL;
-          };
-        }
-        else {
-          uschar *data;
-          long data_len = 0;
-
-          /* decode the line with the appropriate method */
-          if (mime_demux_mode == MIME_DEMUX_MODE_PLAIN) {
-            /* in plain mode, just dump the line */
-            data = line;
-            data_len = line_len;
-          }
-          else if ( (mime_demux_mode == MIME_DEMUX_MODE_QP) || (mime_demux_mode == MIME_DEMUX_MODE_BASE64) ) {
-            data_len = mime_decode_line(mime_demux_mode,line,&data,line_len,info);
-            if (data_len < 0) {
-              /* Error reported from the line decoder. */
-              data_len = 0;
-            };
-          };
-
-          /* write data to dump file */
-          if (data_len > 0) {
-            if (fwrite(data,1,data_len,mime_dump_file) < data_len) {
-              /* short write */
-              (void)string_format(info, 1024,"short write on dump file");
-              free(line);
-              return DEFER;
-            };
-          };
-
-        };
-      }
-      else {
-        /* Scanning mode. We end up here after a end boundary.
-        This will usually be at the end of a message or at
-        the end of a MIME container.
-        We need to look for another start boundary to get
-        back into header mode. */
-        if (mime_check_boundary(line,boundaries) == 1) {
-          mime_demux_mode = MIME_DEMUX_MODE_MIME_HEADERS;
-        };
-
-      };
-      /* ------------------------------------------------ */
-    };
-  };
-  /* ----------------------- end demux loop ----------------------- */
-
-  /* close files, they could still be open */
-  if (mime_dump_file != NULL)
-    (void)fclose(mime_dump_file);
-  if (uu_dump_file != NULL)
-    (void)fclose(uu_dump_file);
-
-  /* release line buffer */
-  free(line);
-
-  /* FIXME: release boundary buffers.
-  Not too much of a problem since
-  this instance of exim is not resident. */
-
-  if (has_tnef) {
-    uschar file_name[1024];
-    /* at least one file could be TNEF encoded.
-    attempt to send all decoded files thru the TNEF decoder */
-
-    (void)string_format(file_name,1024,"%s/scan/%s",spool_directory,message_id);
-    /* Removed FTTB. We need to decide on TNEF inclusion */
-    /* mime_unpack_tnef(file_name); */
-  };
-
-  return 0;
-}
-
-#endif
diff --git a/src/src/demime.h b/src/src/demime.h
deleted file mode 100644
index 0fec5be0c..000000000
--- a/src/src/demime.h
+++ /dev/null
@@ -1,134 +0,0 @@
-/*************************************************
-*     Exim - an Internet mail transport agent    *
-*************************************************/
-
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003-???? */
-/* License: GPL */
-
-/* demime defines */
-
-#ifdef WITH_OLD_DEMIME
-
-#define MIME_DEMUX_MODE_SCANNING     0
-#define MIME_DEMUX_MODE_MIME_HEADERS 1
-#define MIME_DEMUX_MODE_BASE64       2
-#define MIME_DEMUX_MODE_QP           3
-#define MIME_DEMUX_MODE_PLAIN        4
-
-#define MIME_UU_MODE_OFF             0
-#define MIME_UU_MODE_UNCONFIRMED     1
-#define MIME_UU_MODE_CONFIRMED       2
-
-#define MIME_MAX_EXTENSION 128
-
-#define MIME_READ_LINE_EOF 0
-#define MIME_READ_LINE_OK 1
-#define MIME_READ_LINE_OVERFLOW 2
-
-#define MIME_SANITY_MAX_LINE_LENGTH 131071
-#define MIME_SANITY_MAX_FILENAME 512
-#define MIME_SANITY_MAX_HEADER_OPTION_VALUE 1024
-#define MIME_SANITY_MAX_B64_LINE_LENGTH 76
-#define MIME_SANITY_MAX_BOUNDARY_LENGTH 1024
-#define MIME_SANITY_MAX_DUMP_FILES 1024
-
-
-
-/* MIME errorlevel settings */
-
-#define MIME_ERRORLEVEL_LONG_LINE        3,US"line length in message or single header size exceeds %u bytes",MIME_SANITY_MAX_LINE_LENGTH
-#define MIME_ERRORLEVEL_TOO_MANY_PARTS   3,US"too many MIME parts (max %u)",MIME_SANITY_MAX_DUMP_FILES
-#define MIME_ERRORLEVEL_MESSAGE_PARTIAL  3,US"'message/partial' MIME type"
-#define MIME_ERRORLEVEL_FILENAME_LENGTH  3,US"proposed filename exceeds %u characters",MIME_SANITY_MAX_FILENAME
-#define MIME_ERRORLEVEL_BOUNDARY_LENGTH  3,US"boundary length exceeds %u characters",MIME_SANITY_MAX_BOUNDARY_LENGTH
-#define MIME_ERRORLEVEL_DOUBLE_HEADERS   2,US"double headers (content-type, content-disposition or content-transfer-encoding)"
-#define MIME_ERRORLEVEL_UU_MISALIGNED    1,US"uuencoded line length is not a multiple of 4 characters"
-#define MIME_ERRORLEVEL_UU_LINE_LENGTH   1,US"uuencoded line length does not match advertised number of bytes"
-#define MIME_ERRORLEVEL_B64_LINE_LENGTH  1,US"base64 line length exceeds %u characters",MIME_SANITY_MAX_B64_LINE_LENGTH
-#define MIME_ERRORLEVEL_B64_ILLEGAL_CHAR 2,US"base64 line contains illegal character"
-#define MIME_ERRORLEVEL_B64_MISALIGNED   1,US"base64 line length is not a multiple of 4 characters"
-#define MIME_ERRORLEVEL_QP_ILLEGAL_CHAR  1,US"quoted-printable encoding contains illegal character"
-
-
-/* demime structures */
-
-typedef struct mime_part {
-  /* true if there was a content-type header */
-  int seen_content_type;
-  /* true if there was a content-transfer-encoding header
-     contains the encoding type */
-  int seen_content_transfer_encoding;
-  /* true if there was a content-disposition header */
-  int seen_content_disposition;
-  /* pointer to a buffer with the proposed file extension */
-  uschar *extension;
-} mime_part;
-
-typedef struct boundary {
-  struct boundary *next;
-  uschar *boundary_string;
-} boundary;
-
-typedef struct file_extension {
-  struct file_extension *next;
-  uschar *file_extension_string;
-} file_extension;
-
-/* demime.c prototypes */
-
-unsigned int mime_hstr_i(uschar *);
-uschar      *mime_decode_qp(uschar *, int *);
-int          mime_get_dump_file(uschar *, FILE **, uschar *);
-int          mime_header_find(uschar *, uschar *, uschar **);
-int          mime_read_line(FILE *, int, uschar *, long *);
-int          mime_check_boundary(uschar *, struct boundary *);
-int          mime_check_uu_start(uschar *, uschar *, int *);
-long         uu_decode_line(uschar *, uschar **, long, uschar *);
-long         mime_decode_line(int ,uschar *, uschar **, long, uschar *);
-void         mime_trigger_error(int, uschar *, ...);
-int          mime_demux(FILE *, uschar *);
-
-
-
-/* BASE64 decoder matrix */
-static unsigned char b64[256]={
-/*   0 */ 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,
-/*  16 */ 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,
-/*  32 */ 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,   62,  128,  128,  128,   63,
-/*  48 */  52,   53,   54,   55,   56,   57,   58,   59,   60,   61,  128,  128,  128,  255,  128,  128,
-/*  64 */ 128,    0,    1,    2,    3,    4,    5,    6,    7,    8,    9,   10,   11,   12,   13,   14,
-/*  80 */  15,   16,   17,   18,   19,   20,   21,   22,   23,   24,   25,  128,  128,  128,  128,  128,
-/*  96 */ 128,   26,   27,   28,   29,   30,   31,   32,   33,   34,   35,   36,   37,   38,   39,   40,
-  41,   42,   43,   44,   45,   46,   47,   48,   49,   50,   51,  128,  128,  128,  128,  128,
- 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,
- 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,
- 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,
- 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,
- 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,
- 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,
- 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,
- 128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128,  128
-};
-
-
-/* Microsoft-Style uudecode matrix */
-static unsigned char uudec[256]={
-/*   0 */   0,   33,   34,   35,   36,   37,   38,   39,   40,   41,   42,   43,   44,   45,   46,   47,
-/*  16 */  48,   49,   50,   51,   52,   53,   54,   55,   56,   57,   58,   59,   60,   61,   62,   63,
-/*  32 */   0,    1,    2,    3,    4,    5,    6,    7,    8,    9,   10,   11,   12,   13,   14,   15,
-/*  48 */  16,   17,   18,   19,   20,   21,   22,   23,   24,   25,   26,   27,   28,   29,   30,   31,
-/*  64 */  32,   33,   34,   35,   36,   37,   38,   39,   40,   41,   42,   43,   44,   45,   46,   47,
-/*  80 */  48,   49,   50,   51,   52,   53,   54,   55,   56,   57,   58,   59,   60,   61,   62,   63,
-/*  96 */   0,    1,    2,    3,    4,    5,    6,    7,    8,    9,   10,   11,   12,   13,   14,   15,
-/* 112 */  16,   17,   18,   19,   20,   21,   22,   23,   24,   25,   26,   27,   28,   29,   30,   31,
-/* 128 */  32,   33,   34,   35,   36,   37,   38,   39,   40,   41,   42,   43,   44,   45,   46,   47,
-/* 144 */  48,   49,   50,   51,   52,   53,   54,   55,   56,   57,   58,   59,   60,   61,   62,   63,
-/* 160 */   0,    1,    2,    3,    4,    5,    6,    7,    8,    9,   10,   11,   12,   13,   14,   15,
-/* 176 */  16,   17,   18,   19,   20,   21,   22,   23,   24,   25,   26,   27,   28,   29,   30,   31,
-/* 192 */  32,   33,   34,   35,   36,   37,   38,   39,   40,   41,   42,   43,   44,   45,   46,   47,
-/* 208 */  48,   49,   50,   51,   52,   53,   54,   55,   56,   57,   58,   59,   60,   61,   62,   63,
-/* 224 */   0,    1,    2,    3,    4,    5,    6,    7,    8,    9,   10,   11,   12,   13,   14,   15,
-/* 240 */  16,   17,   18,   19,   20,   21,   22,   23,   24,   25,   26,   27,   28,   29,   30,   31
-};
-
-#endif
diff --git a/src/src/dkim.c b/src/src/dkim.c
index 349947ab1..3fa11c800 100644
--- a/src/src/dkim.c
+++ b/src/src/dkim.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge, 1995 - 2015 */
+/* Copyright (c) University of Cambridge, 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Code for DKIM support. Other DKIM relevant code is in
@@ -14,6 +14,7 @@
 
 #include "pdkim/pdkim.h"
 
+int dkim_verify_oldpool;
 pdkim_ctx *dkim_verify_ctx = NULL;
 pdkim_signature *dkim_signatures = NULL;
 pdkim_signature *dkim_cur_sig = NULL;
@@ -27,7 +28,7 @@ dns_record *rr;
 
 lookup_dnssec_authenticated = NULL;
 if (dns_lookup(&dnsa, US name, T_TXT, NULL) != DNS_SUCCEED)
-  return PDKIM_FAIL;
+  return PDKIM_FAIL;	/*XXX better error detail?  logging? */
 
 /* Search for TXT record */
 
@@ -50,12 +51,12 @@ for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
       rr_offset += len;
       answer_offset += len;
       if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN)
-	return PDKIM_FAIL;
+	return PDKIM_FAIL;	/*XXX better error detail?  logging? */
       }
     return PDKIM_OK;
     }
 
-return PDKIM_FAIL;
+return PDKIM_FAIL;	/*XXX better error detail?  logging? */
 }
 
 
@@ -66,9 +67,17 @@ pdkim_init();
 }
 
 
+
 void
-dkim_exim_verify_init(void)
+dkim_exim_verify_init(BOOL dot_stuffing)
 {
+/* There is a store-reset between header & body reception
+so cannot use the main pool. Any allocs done by Exim
+memory-handling must use the perm pool. */
+
+dkim_verify_oldpool = store_pool;
+store_pool = POOL_PERM;
+
 /* Free previous context if there is one */
 
 if (dkim_verify_ctx)
@@ -76,17 +85,30 @@ if (dkim_verify_ctx)
 
 /* Create new context */
 
-dkim_verify_ctx = pdkim_init_verify(&dkim_exim_query_dns_txt);
+dkim_verify_ctx = pdkim_init_verify(&dkim_exim_query_dns_txt, dot_stuffing);
 dkim_collect_input = !!dkim_verify_ctx;
+
+/* Start feed up with any cached data */
+receive_get_cache();
+
+store_pool = dkim_verify_oldpool;
 }
 
 
 void
 dkim_exim_verify_feed(uschar * data, int len)
 {
+int rc;
+
+store_pool = POOL_PERM;
 if (  dkim_collect_input
-   && pdkim_feed(dkim_verify_ctx, (char *)data, len) != PDKIM_OK)
+   && (rc = pdkim_feed(dkim_verify_ctx, CS data, len)) != PDKIM_OK)
+  {
+  log_write(0, LOG_MAIN,
+	     "DKIM: validation error: %.100s", pdkim_errstr(rc));
   dkim_collect_input = FALSE;
+  }
+store_pool = dkim_verify_oldpool;
 }
 
 
@@ -97,6 +119,9 @@ pdkim_signature *sig = NULL;
 int dkim_signers_size = 0;
 int dkim_signers_ptr = 0;
 dkim_signers = NULL;
+int rc;
+
+store_pool = POOL_PERM;
 
 /* Delete eventual previous signature chain */
 
@@ -112,15 +137,19 @@ if (!dkim_collect_input)
 	     "DKIM: Error while running this message through validation,"
 	     " disabling signature verification.");
   dkim_disable_verify = TRUE;
-  return;
+  goto out;
   }
 
 dkim_collect_input = FALSE;
 
 /* Finish DKIM operation and fetch link to signatures chain */
 
-if (pdkim_feed_finish(dkim_verify_ctx, &dkim_signatures) != PDKIM_OK)
-  return;
+if ((rc = pdkim_feed_finish(dkim_verify_ctx, &dkim_signatures)) != PDKIM_OK)
+  {
+  log_write(0, LOG_MAIN,
+	     "DKIM: validation error: %.100s", pdkim_errstr(rc));
+  goto out;
+  }
 
 for (sig = dkim_signatures; sig; sig = sig->next)
   {
@@ -133,10 +162,12 @@ for (sig = dkim_signatures; sig; sig = sig->next)
 	string_sprintf("d=%s s=%s c=%s/%s a=%s b=%d ",
 	      sig->domain,
 	      sig->selector,
-	      sig->canon_headers == PDKIM_CANON_SIMPLE ?  "simple" : "relaxed",
-	      sig->canon_body == PDKIM_CANON_SIMPLE ?  "simple" : "relaxed",
-	      sig->algo == PDKIM_ALGO_RSA_SHA256 ?  "rsa-sha256" : "rsa-sha1",
-	      sig->sigdata.len * 8
+	      sig->canon_headers == PDKIM_CANON_SIMPLE ? "simple" : "relaxed",
+	      sig->canon_body == PDKIM_CANON_SIMPLE ? "simple" : "relaxed",
+	      sig->algo == PDKIM_ALGO_RSA_SHA256
+	      ? "rsa-sha256"
+	      : sig->algo == PDKIM_ALGO_RSA_SHA1 ? "rsa-sha1" : "err",
+	      (int)sig->sigdata.len > -1 ? sig->sigdata.len * 8 : 0
 	      ),
 
 	sig->identity ? string_sprintf("i=%s ", sig->identity) : US"",
@@ -171,6 +202,16 @@ for (sig = dkim_signatures; sig; sig = sig->next)
 		       "syntax error in public key record]");
 	  break;
 
+        case PDKIM_VERIFY_INVALID_SIGNATURE_ERROR:
+          logmsg = string_append(logmsg, &size, &ptr, 1,
+                       "signature tag missing or invalid]");
+          break;
+
+        case PDKIM_VERIFY_INVALID_DKIM_VERSION:
+          logmsg = string_append(logmsg, &size, &ptr, 1,
+                       "unsupported DKIM version]");
+          break;
+
 	default:
 	  logmsg = string_append(logmsg, &size, &ptr, 1,
 			"unspecified problem]");
@@ -228,6 +269,9 @@ if (dkim_signers)
   if (Ustrlen(dkim_signers) > 0)
   dkim_signers[Ustrlen(dkim_signers) - 1] = '\0';
   }
+
+out:
+store_pool = dkim_verify_oldpool;
 }
 
 
@@ -416,10 +460,9 @@ switch (what)
 
 
 uschar *
-dkim_exim_sign(int dkim_fd, uschar * dkim_private_key,
-		const uschar * dkim_domain, uschar * dkim_selector,
-		uschar * dkim_canon, uschar * dkim_sign_headers)
+dkim_exim_sign(int dkim_fd, struct ob_dkim * dkim)
 {
+const uschar * dkim_domain;
 int sep = 0;
 uschar *seen_items = NULL;
 int seen_items_size = 0;
@@ -443,13 +486,12 @@ int old_pool = store_pool;
 
 store_pool = POOL_MAIN;
 
-if (!(dkim_domain = expand_cstring(dkim_domain)))
+if (!(dkim_domain = expand_cstring(dkim->dkim_domain)))
   {
   /* expansion error, do not send message. */
   log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
 	     "dkim_domain: %s", expand_string_message);
-  rc = NULL;
-  goto CLEANUP;
+  goto bad;
   }
 
 /* Set $dkim_domain expansion variable to each unique domain in list. */
@@ -482,24 +524,23 @@ while ((dkim_signing_domain = string_nextinlist(&dkim_domain, &sep,
 
   /* Set up $dkim_selector expansion variable. */
 
-  if (!(dkim_signing_selector = expand_string(dkim_selector)))
+  if (!(dkim_signing_selector = expand_string(dkim->dkim_selector)))
     {
     log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
 	       "dkim_selector: %s", expand_string_message);
-    rc = NULL;
-    goto CLEANUP;
+    goto bad;
     }
 
   /* Get canonicalization to use */
 
-  dkim_canon_expanded = dkim_canon ? expand_string(dkim_canon) : US"relaxed";
+  dkim_canon_expanded = dkim->dkim_canon
+    ? expand_string(dkim->dkim_canon) : US"relaxed";
   if (!dkim_canon_expanded)
     {
     /* expansion error, do not send message. */
     log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
 	       "dkim_canon: %s", expand_string_message);
-    rc = NULL;
-    goto CLEANUP;
+    goto bad;
     }
 
   if (Ustrcmp(dkim_canon_expanded, "relaxed") == 0)
@@ -515,24 +556,22 @@ while ((dkim_signing_domain = string_nextinlist(&dkim_domain, &sep,
     }
 
   dkim_sign_headers_expanded = NULL;
-  if (dkim_sign_headers)
-    if (!(dkim_sign_headers_expanded = expand_string(dkim_sign_headers)))
+  if (dkim->dkim_sign_headers)
+    if (!(dkim_sign_headers_expanded = expand_string(dkim->dkim_sign_headers)))
       {
       log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
 		 "dkim_sign_headers: %s", expand_string_message);
-      rc = NULL;
-      goto CLEANUP;
+      goto bad;
       }
     			/* else pass NULL, which means default header list */
 
   /* Get private key to use. */
 
-  if (!(dkim_private_key_expanded = expand_string(dkim_private_key)))
+  if (!(dkim_private_key_expanded = expand_string(dkim->dkim_private_key)))
     {
     log_write(0, LOG_MAIN | LOG_PANIC, "failed to expand "
 	       "dkim_private_key: %s", expand_string_message);
-    rc = NULL;
-    goto CLEANUP;
+    goto bad;
     }
 
   if (  Ustrlen(dkim_private_key_expanded) == 0
@@ -548,62 +587,53 @@ while ((dkim_signing_domain = string_nextinlist(&dkim_domain, &sep,
     /* Looks like a filename, load the private key. */
 
     memset(big_buffer, 0, big_buffer_size);
-    privkey_fd = open(CS dkim_private_key_expanded, O_RDONLY);
-    if (privkey_fd < 0)
+
+    if ((privkey_fd = open(CS dkim_private_key_expanded, O_RDONLY)) < 0)
       {
       log_write(0, LOG_MAIN | LOG_PANIC, "unable to open "
 		 "private key file for reading: %s",
 		 dkim_private_key_expanded);
-      rc = NULL;
-      goto CLEANUP;
+      goto bad;
       }
 
     if (read(privkey_fd, big_buffer, big_buffer_size - 2) < 0)
       {
       log_write(0, LOG_MAIN|LOG_PANIC, "unable to read private key file: %s",
 		 dkim_private_key_expanded);
-      rc = NULL;
-      goto CLEANUP;
+      goto bad;
       }
 
     (void) close(privkey_fd);
     dkim_private_key_expanded = big_buffer;
     }
 
-  ctx = pdkim_init_sign( (char *) dkim_signing_domain,
-			 (char *) dkim_signing_selector,
-			 (char *) dkim_private_key_expanded,
-			 PDKIM_ALGO_RSA_SHA256);
+  ctx = pdkim_init_sign( CS dkim_signing_domain,
+			 CS dkim_signing_selector,
+			 CS dkim_private_key_expanded,
+			 PDKIM_ALGO_RSA_SHA256,
+			 dkim->dot_stuffed);
   pdkim_set_optional(ctx,
-		      (char *) dkim_sign_headers_expanded,
+		      CS dkim_sign_headers_expanded,
 		      NULL,
 		      pdkim_canon,
 		      pdkim_canon, -1, 0, 0);
 
   lseek(dkim_fd, 0, SEEK_SET);
 
-  while ((sread = read(dkim_fd, &buf, 4096)) > 0)
-    if (pdkim_feed(ctx, buf, sread) != PDKIM_OK)
-      {
-      rc = NULL;
-      goto CLEANUP;
-      }
+  while ((sread = read(dkim_fd, &buf, sizeof(buf))) > 0)
+    if ((pdkim_rc = pdkim_feed(ctx, buf, sread)) != PDKIM_OK)
+      goto pk_bad;
 
   /* Handle failed read above. */
   if (sread == -1)
     {
     debug_printf("DKIM: Error reading -K file.\n");
     save_errno = errno;
-    rc = NULL;
-    goto CLEANUP;
+    goto bad;
     }
 
   if ((pdkim_rc = pdkim_feed_finish(ctx, &signature)) != PDKIM_OK)
-    {
-    log_write(0, LOG_MAIN|LOG_PANIC, "DKIM: signing failed (RC %d)", pdkim_rc);
-    rc = NULL;
-    goto CLEANUP;
-    }
+    goto pk_bad;
 
   sigbuf = string_append(sigbuf, &sigsize, &sigptr, 2,
 			  US signature->signature_header, US"\r\n");
@@ -621,11 +651,18 @@ else
   rc = US"";
 
 CLEANUP:
-if (ctx)
-  pdkim_free_ctx(ctx);
-store_pool = old_pool;
-errno = save_errno;
-return rc;
+  if (ctx)
+    pdkim_free_ctx(ctx);
+  store_pool = old_pool;
+  errno = save_errno;
+  return rc;
+
+pk_bad:
+  log_write(0, LOG_MAIN|LOG_PANIC,
+	       	"DKIM: signing failed: %.100s", pdkim_errstr(pdkim_rc));
+bad:
+  rc = NULL;
+  goto CLEANUP;
 }
 
 #endif
diff --git a/src/src/dkim.h b/src/src/dkim.h
index 1655f8e45..8474962fc 100644
--- a/src/src/dkim.h
+++ b/src/src/dkim.h
@@ -2,12 +2,12 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge, 1995 - 2015 */
+/* Copyright (c) University of Cambridge, 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 void    dkim_exim_init(void);
-uschar *dkim_exim_sign(int, uschar *, const uschar *, uschar *, uschar *, uschar *);
-void    dkim_exim_verify_init(void);
+uschar *dkim_exim_sign(int, struct ob_dkim *);
+void    dkim_exim_verify_init(BOOL);
 void    dkim_exim_verify_feed(uschar *, int);
 void    dkim_exim_verify_finish(void);
 void    dkim_exim_acl_setup(uschar *);
diff --git a/src/src/dmarc.c b/src/src/dmarc.c
index 769e4d40e..c005d4ab9 100644
--- a/src/src/dmarc.c
+++ b/src/src/dmarc.c
@@ -57,7 +57,7 @@ static dmarc_exim_p dmarc_policy_description[] = {
 static error_block *
 add_to_eblock(error_block *eblock, uschar *t1, uschar *t2)
 {
-error_block *eb = malloc(sizeof(error_block));
+error_block *eb = store_malloc(sizeof(error_block));
 if (eblock == NULL)
   eblock = eb;
 else
@@ -150,6 +150,63 @@ int dmarc_store_data(header_line *hdr) {
 }
 
 
+static void
+dmarc_send_forensic_report(u_char **ruf)
+{
+int   c;
+uschar *recipient, *save_sender;
+BOOL  send_status = FALSE;
+error_block *eblock = NULL;
+FILE *message_file = NULL;
+
+/* Earlier ACL does not have *required* control=dmarc_enable_forensic */
+if (!dmarc_enable_forensic)
+  return;
+
+if (  dmarc_policy == DMARC_POLICY_REJECT     && action == DMARC_RESULT_REJECT
+   || dmarc_policy == DMARC_POLICY_QUARANTINE && action == DMARC_RESULT_QUARANTINE
+   || dmarc_policy == DMARC_POLICY_NONE       && action == DMARC_RESULT_REJECT
+   || dmarc_policy == DMARC_POLICY_NONE       && action == DMARC_RESULT_QUARANTINE
+   )
+  if (ruf)
+    {
+    eblock = add_to_eblock(eblock, US"Sender Domain", dmarc_used_domain);
+    eblock = add_to_eblock(eblock, US"Sender IP Address", sender_host_address);
+    eblock = add_to_eblock(eblock, US"Received Date", tod_stamp(tod_full));
+    eblock = add_to_eblock(eblock, US"SPF Alignment",
+			   (sa==DMARC_POLICY_SPF_ALIGNMENT_PASS) ?US"yes":US"no");
+    eblock = add_to_eblock(eblock, US"DKIM Alignment",
+			   (da==DMARC_POLICY_DKIM_ALIGNMENT_PASS)?US"yes":US"no");
+    eblock = add_to_eblock(eblock, US"DMARC Results", dmarc_status_text);
+    /* Set a sane default envelope sender */
+    dsn_from = dmarc_forensic_sender ? dmarc_forensic_sender :
+	       dsn_from ? dsn_from :
+	       string_sprintf("do-not-reply@%s",primary_hostname);
+    for (c = 0; ruf[c]; c++)
+      {
+      recipient = string_copylc(ruf[c]);
+      if (Ustrncmp(recipient, "mailto:",7))
+	continue;
+      /* Move to first character past the colon */
+      recipient += 7;
+      DEBUG(D_receive)
+	debug_printf("DMARC forensic report to %s%s\n", recipient,
+	     (host_checking || running_in_test_harness) ? " (not really)" : "");
+      if (host_checking || running_in_test_harness)
+	continue;
+
+      save_sender = sender_address;
+      sender_address = recipient;
+      send_status = moan_to_sender(ERRMESS_DMARC_FORENSIC, eblock,
+				   header_list, message_file, FALSE);
+      sender_address = save_sender;
+      if (!send_status)
+	log_write(0, LOG_MAIN|LOG_PANIC,
+	  "failure to send DMARC forensic report to %s", recipient);
+      }
+    }
+}
+
 /* dmarc_process adds the envelope sender address to the existing
    context (if any), retrieves the result, sets up expansion
    strings and evaluates the condition outcome. */
@@ -295,7 +352,8 @@ if (!dmarc_abort && !sender_host_authenticated)
       vs == PDKIM_VERIFY_INVALID ?
        ves == PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE ? ARES_RESULT_PERMERROR :
        ves == PDKIM_VERIFY_INVALID_BUFFER_SIZE        ? ARES_RESULT_PERMERROR :
-       ves == PDKIM_VERIFY_INVALID_PUBKEY_PARSING     ? ARES_RESULT_PERMERROR :
+       ves == PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD   ? ARES_RESULT_PERMERROR :
+       ves == PDKIM_VERIFY_INVALID_PUBKEY_IMPORT      ? ARES_RESULT_PERMERROR :
        ARES_RESULT_UNKNOWN :
       ARES_RESULT_UNKNOWN;
     dkim_history_buffer = string_sprintf("%sdkim %s %d\n", dkim_history_buffer,
@@ -517,60 +575,6 @@ else
 return DMARC_HIST_OK;
 }
 
-void
-dmarc_send_forensic_report(u_char **ruf)
-{
-int   c;
-uschar *recipient, *save_sender;
-BOOL  send_status = FALSE;
-error_block *eblock = NULL;
-FILE *message_file = NULL;
-
-/* Earlier ACL does not have *required* control=dmarc_enable_forensic */
-if (!dmarc_enable_forensic)
-  return;
-
-if ((dmarc_policy == DMARC_POLICY_REJECT     && action == DMARC_RESULT_REJECT) ||
-    (dmarc_policy == DMARC_POLICY_QUARANTINE && action == DMARC_RESULT_QUARANTINE) )
-  if (ruf)
-    {
-    eblock = add_to_eblock(eblock, US"Sender Domain", dmarc_used_domain);
-    eblock = add_to_eblock(eblock, US"Sender IP Address", sender_host_address);
-    eblock = add_to_eblock(eblock, US"Received Date", tod_stamp(tod_full));
-    eblock = add_to_eblock(eblock, US"SPF Alignment",
-			   (sa==DMARC_POLICY_SPF_ALIGNMENT_PASS) ?US"yes":US"no");
-    eblock = add_to_eblock(eblock, US"DKIM Alignment",
-			   (da==DMARC_POLICY_DKIM_ALIGNMENT_PASS)?US"yes":US"no");
-    eblock = add_to_eblock(eblock, US"DMARC Results", dmarc_status_text);
-    /* Set a sane default envelope sender */
-    dsn_from = dmarc_forensic_sender ? dmarc_forensic_sender :
-	       dsn_from ? dsn_from :
-	       string_sprintf("do-not-reply@%s",primary_hostname);
-    for (c = 0; ruf[c]; c++)
-      {
-      recipient = string_copylc(ruf[c]);
-      if (Ustrncmp(recipient, "mailto:",7))
-	continue;
-      /* Move to first character past the colon */
-      recipient += 7;
-      DEBUG(D_receive)
-	debug_printf("DMARC forensic report to %s%s\n", recipient,
-	     (host_checking || running_in_test_harness) ? " (not really)" : "");
-      if (host_checking || running_in_test_harness)
-	continue;
-
-      save_sender = sender_address;
-      sender_address = recipient;
-      send_status = moan_to_sender(ERRMESS_DMARC_FORENSIC, eblock,
-				   header_list, message_file, FALSE);
-      sender_address = save_sender;
-      if (!send_status)
-	log_write(0, LOG_MAIN|LOG_PANIC,
-	  "failure to send DMARC forensic report to %s", recipient);
-      }
-    }
-}
-
 uschar *
 dmarc_exim_expand_query(int what)
 {
diff --git a/src/src/dmarc.h b/src/src/dmarc.h
index 63d451c5d..78e2a5b7b 100644
--- a/src/src/dmarc.h
+++ b/src/src/dmarc.h
@@ -24,7 +24,6 @@ uschar *dmarc_exim_expand_query(int);
 uschar *dmarc_exim_expand_defaults(int);
 uschar *dmarc_auth_results_header(header_line *,uschar *);
 int dmarc_write_history_file();
-void dmarc_send_forensic_report(u_char **);
 
 #define DMARC_AR_HEADER        US"Authentication-Results:"
 #define DMARC_VERIFY_STATUS    1
diff --git a/src/src/dns.c b/src/src/dns.c
index bb6693254..fc0ffb2ba 100644
--- a/src/src/dns.c
+++ b/src/src/dns.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for interfacing with the DNS. */
@@ -309,7 +309,7 @@ else
 Return: TRUE for a bad result
 */
 static BOOL
-dnss_inc(dns_answer * dnsa, dns_scan * dnss, unsigned delta)
+dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta)
 {
 return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen;
 }
@@ -332,9 +332,9 @@ Returns:    next dns record, or NULL when no more
 */
 
 dns_record *
-dns_next_rr(dns_answer *dnsa, dns_scan *dnss, int reset)
+dns_next_rr(const dns_answer *dnsa, dns_scan *dnss, int reset)
 {
-HEADER *h = (HEADER *)dnsa->answer;
+const HEADER * h = (const HEADER *)dnsa->answer;
 int namelen;
 
 char * trace = NULL;
@@ -363,7 +363,7 @@ if (reset != RESET_NEXT)
     if (namelen < 0) goto null_return;
     /* skip name & type & class */
     TRACE trace = "Q-skip";
-    if (dnss_inc(dnsa, dnss, namelen+4)) goto null_return;
+    if (dnss_inc_aptr(dnsa, dnss, namelen+4)) goto null_return;
     }
 
   /* Get the number of answer records. */
@@ -392,11 +392,11 @@ if (reset != RESET_NEXT)
       if (namelen < 0) goto null_return;
       /* skip name, type, class & TTL */
       TRACE trace = "A-hdr";
-      if (dnss_inc(dnsa, dnss, namelen+8)) goto null_return;
+      if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return;
       GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
       /* skip over it */
       TRACE trace = "A-skip";
-      if (dnss_inc(dnsa, dnss, dnss->srr.size)) goto null_return;
+      if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return;
       }
     dnss->rrcount = reset == RESET_AUTHORITY
       ? ntohs(h->nscount) : ntohs(h->arcount);
@@ -423,11 +423,11 @@ if (namelen < 0) goto null_return;
 from the following bytes. */
 
 TRACE trace = "R-name";
-if (dnss_inc(dnsa, dnss, namelen)) goto null_return;
+if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return;
 
 GETSHORT(dnss->srr.type, dnss->aptr);		/* Record type */
 TRACE trace = "R-class";
-if (dnss_inc(dnsa, dnss, 2)) goto null_return;	/* Don't want class */
+if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return;	/* Don't want class */
 GETLONG(dnss->srr.ttl, dnss->aptr);		/* TTL */
 GETSHORT(dnss->srr.size, dnss->aptr);		/* Size of data portion */
 dnss->srr.data = dnss->aptr;			/* The record's data follows */
@@ -450,29 +450,30 @@ null_return:
 }
 
 
-/* Extract the AUTHORITY information from the answer. If the
-answer isn't authoritive (AA not set), we do not extract anything.
+/* Extract the AUTHORITY information from the answer. If the answer isn't
+authoritive (AA not set), we do not extract anything.
 
-The AUTHORITIVE section contains NS records if
-the name in question was found, it contains a SOA record
-otherwise. (This is just from experience and some tests, is there
-some spec?)
+The AUTHORITIVE section contains NS records if the name in question was found,
+it contains a SOA record otherwise. (This is just from experience and some
+tests, is there some spec?)
 
-We've cycle through the AUTHORITY section, since it may contain
-other records (e.g. NSEC3) too.  */
+Scan the whole AUTHORITY section, since it may contain other records
+(e.g. NSEC3) too.
+
+Return: name for the authority, in an allocated string, or NULL if none found */
 
 static const uschar *
 dns_extract_auth_name(const dns_answer * dnsa)	/* FIXME: const dns_answer */
 {
 dns_scan dnss;
 dns_record * rr;
-HEADER * h = (HEADER *) dnsa->answer;
+const HEADER * h = (const HEADER *) dnsa->answer;
 
-if (!h->nscount || !h->aa) return NULL;
-for (rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_AUTHORITY);
-     rr;
-     rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_NEXT))
-  if (rr->type == (h->ancount ? T_NS : T_SOA)) return rr->name;
+if (h->nscount && h->aa)
+  for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
+       rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
+    if (rr->type == (h->ancount ? T_NS : T_SOA))
+      return string_copy(rr->name);
 return NULL;
 }
 
@@ -499,7 +500,7 @@ DEBUG(D_dns)
   debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
 return FALSE;
 #else
-HEADER * h = (HEADER *) dnsa->answer;
+const HEADER * h = (const HEADER *) dnsa->answer;
 const uschar * auth_name;
 const uschar * trusted;
 
@@ -534,7 +535,7 @@ dns_set_insecure(dns_answer * dnsa)
 {
 #ifndef DISABLE_DNSSEC
 HEADER * h = (HEADER *)dnsa->answer;
-h->ad = 0;
+h->aa = h->ad = 0;
 #endif
 }
 
@@ -550,7 +551,7 @@ dns_is_aa(const dns_answer *dnsa)
 #ifdef DISABLE_DNSSEC
 return FALSE;
 #else
-return ((HEADER*)dnsa->answer)->aa;
+return ((const HEADER*)dnsa->answer)->aa;
 #endif
 }
 
@@ -663,8 +664,7 @@ caching for successful lookups. */
 
 sprintf(CS node_name, "%.255s-%s-%lx", name, dns_text_type(type),
   (unsigned long) resp->options);
-previous = tree_search(tree_dns_fails, node_name);
-if (previous != NULL)
+if ((previous = tree_search(tree_dns_fails, node_name)))
   {
   DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
     name, dns_text_type(type),
@@ -769,48 +769,48 @@ if (dnsa->answerlen > MAXPACKET)
 if (dnsa->answerlen < 0) switch (h_errno)
   {
   case HOST_NOT_FOUND:
-  DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
-    "returning DNS_NOMATCH\n", name, dns_text_type(type));
-  return dns_return(name, type, DNS_NOMATCH);
+    DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
+      "returning DNS_NOMATCH\n", name, dns_text_type(type));
+    return dns_return(name, type, DNS_NOMATCH);
 
   case TRY_AGAIN:
-  DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
-    name, dns_text_type(type));
+    DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
+      name, dns_text_type(type));
 
-  /* Cut this out for various test programs */
+    /* Cut this out for various test programs */
 #ifndef STAND_ALONE
-  save_domain = deliver_domain;
-  deliver_domain = string_copy(name);  /* set $domain */
-  rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
-    MCL_DOMAIN, TRUE, NULL);
-  deliver_domain = save_domain;
-  if (rc != OK)
-    {
-    DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
-    return dns_return(name, type, DNS_AGAIN);
-    }
-  DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
-    "DNS_NOMATCH\n", name);
-  return dns_return(name, type, DNS_NOMATCH);
+    save_domain = deliver_domain;
+    deliver_domain = string_copy(name);  /* set $domain */
+    rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
+      MCL_DOMAIN, TRUE, NULL);
+    deliver_domain = save_domain;
+    if (rc != OK)
+      {
+      DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
+      return dns_return(name, type, DNS_AGAIN);
+      }
+    DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
+      "DNS_NOMATCH\n", name);
+    return dns_return(name, type, DNS_NOMATCH);
 
 #else   /* For stand-alone tests */
-  return dns_return(name, type, DNS_AGAIN);
+    return dns_return(name, type, DNS_AGAIN);
 #endif
 
   case NO_RECOVERY:
-  DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
-    "returning DNS_FAIL\n", name, dns_text_type(type));
-  return dns_return(name, type, DNS_FAIL);
+    DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
+      "returning DNS_FAIL\n", name, dns_text_type(type));
+    return dns_return(name, type, DNS_FAIL);
 
   case NO_DATA:
-  DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
-    "returning DNS_NODATA\n", name, dns_text_type(type));
-  return dns_return(name, type, DNS_NODATA);
+    DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
+      "returning DNS_NODATA\n", name, dns_text_type(type));
+    return dns_return(name, type, DNS_NODATA);
 
   default:
-  DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
-    "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
-  return dns_return(name, type, DNS_FAIL);
+    DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
+      "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
+    return dns_return(name, type, DNS_FAIL);
   }
 
 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
@@ -868,14 +868,15 @@ BOOL secure_so_far = TRUE;
 
 for (i = 0; i < 10; i++)
   {
-  uschar data[256];
+  uschar * data;
   dns_record *rr, cname_rr, type_rr;
   dns_scan dnss;
   int datalen, rc;
 
   /* DNS lookup failures get passed straight back. */
 
-  if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED) return rc;
+  if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED)
+    return rc;
 
   /* We should have either records of the required type, or a CNAME record,
   or both. We need to know whether both exist for getting the fully qualified
@@ -885,24 +886,22 @@ for (i = 0; i < 10; i++)
 
   cname_rr.data = type_rr.data = NULL;
   for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
-       rr;
-       rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
-    {
+       rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
     if (rr->type == type)
       {
       if (type_rr.data == NULL) type_rr = *rr;
       if (cname_rr.data != NULL) break;
       }
-    else if (rr->type == T_CNAME) cname_rr = *rr;
-    }
+    else if (rr->type == T_CNAME)
+      cname_rr = *rr;
 
   /* For the first time round this loop, if a CNAME was found, take the fully
   qualified name from it; otherwise from the first data record, if present. */
 
-  if (i == 0 && fully_qualified_name != NULL)
+  if (i == 0 && fully_qualified_name)
     {
-    uschar * rr_name = cname_rr.data ? cname_rr.name
-      : type_rr.data ? type_rr.name : NULL;
+    uschar * rr_name = cname_rr.data
+      ? cname_rr.name : type_rr.data ? type_rr.name : NULL;
     if (  rr_name
        && Ustrcmp(rr_name, *fully_qualified_name) != 0
        && rr_name[0] != '*'
@@ -918,7 +917,7 @@ for (i = 0; i < 10; i++)
 
   /* If any data records of the correct type were found, we are done. */
 
-  if (type_rr.data != NULL)
+  if (type_rr.data)
     {
     if (!secure_so_far)	/* mark insecure if any element of CNAME chain was */
       dns_set_insecure(dnsa);
@@ -930,10 +929,13 @@ for (i = 0; i < 10; i++)
   have had a failure from dns_lookup). However code against the possibility of
   its not existing. */
 
-  if (cname_rr.data == NULL) return DNS_FAIL;
-  datalen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
-    cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, sizeof(data));
-  if (datalen < 0) return DNS_FAIL;
+  if (!cname_rr.data)
+    return DNS_FAIL;
+
+  data = store_get(256);
+  if ((datalen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
+    cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256)) < 0)
+    return DNS_FAIL;
   name = data;
 
   if (!dns_is_secure(dnsa))
@@ -1080,7 +1082,7 @@ switch (type)
       success and packet length return values.) For added safety we only reset
       the packet length if the packet header looks plausible. */
 
-      HEADER *h = (HEADER *)dnsa->answer;
+      const HEADER * h = (const HEADER *)dnsa->answer;
       if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
 	  && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
 	  && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
@@ -1088,8 +1090,7 @@ switch (type)
 	    dnsa->answerlen = MAXPACKET;
 
       for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
-	   rr;
-	   rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
+	   rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
 	  )
 	if (rr->type != T_SOA) continue;
 	else if (strcmpic(rr->name, US"") == 0 ||
@@ -1124,13 +1125,11 @@ switch (type)
       might make stricter assertions than its parent domain. */
 
       for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
-	   rr;
-	   rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
+	   rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
 	{
-	if (rr->type != T_SRV) continue;
+	const uschar * p = rr->data;
 
 	/* Extract the numerical SRV fields (p is incremented) */
-	p = rr->data;
 	GETSHORT(priority, p);
 	GETSHORT(weight, p);	weight = weight; /* compiler quietening */
 	GETSHORT(port, p);
diff --git a/src/src/drtables.c b/src/src/drtables.c
index f6629634d..a3fa328b9 100644
--- a/src/src/drtables.c
+++ b/src/src/drtables.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -228,6 +228,10 @@ exim binary. */
 #include "transports/pipe.h"
 #endif
 
+#ifdef EXPERIMENTAL_QUEUEFILE
+#include "transports/queuefile.h"
+#endif
+
 #ifdef TRANSPORT_SMTP
 #include "transports/smtp.h"
 #endif
@@ -389,6 +393,20 @@ transport_info transports_available[] = {
   TRUE                                         /* local flag */
   },
 #endif
+#ifdef EXPERIMENTAL_QUEUEFILE
+  {
+  US"queuefile",                               /* driver name */
+  queuefile_transport_options,                 /* local options table */
+  &queuefile_transport_options_count,          /* number of entries */
+  &queuefile_transport_option_defaults,        /* private options defaults */
+  sizeof(queuefile_transport_options_block),   /* size of private block */
+  queuefile_transport_init,                    /* init entry point */
+  queuefile_transport_entry,                   /* main entry point */
+  NULL,                                        /* no tidyup entry */
+  NULL,                                        /* no closedown entry */
+  TRUE                                         /* local flag */
+  },
+#endif
 #ifdef TRANSPORT_SMTP
   {
   US"smtp",                                    /* driver name */
@@ -415,37 +433,42 @@ struct lookupmodulestr
 
 static struct lookupmodulestr *lookupmodules = NULL;
 
-static void addlookupmodule(void *dl, struct lookup_module_info *info)
+static void
+addlookupmodule(void *dl, struct lookup_module_info *info)
 {
-  struct lookupmodulestr *p = store_malloc(sizeof(struct lookupmodulestr));
-  p->dl = dl;
-  p->info = info;
-  p->next = lookupmodules;
-  lookupmodules = p;
-  lookup_list_count += info->lookupcount;
+struct lookupmodulestr *p = store_malloc(sizeof(struct lookupmodulestr));
+
+p->dl = dl;
+p->info = info;
+p->next = lookupmodules;
+lookupmodules = p;
+lookup_list_count += info->lookupcount;
 }
 
 /* only valid after lookup_list and lookup_list_count are assigned */
-static void add_lookup_to_list(lookup_info *info)
+static void
+add_lookup_to_list(lookup_info *info)
 {
-  /* need to add the lookup to lookup_list, sorted */
-  int pos = 0;
-
-  /* strategy is to go through the list until we find
-   * either an empty spot or a name that is higher.
-   * this can't fail because we have enough space. */
-  while (lookup_list[pos]
-      && (Ustrcmp(lookup_list[pos]->name, info->name) <= 0)) {
-    pos++;
-  }
-  if (lookup_list[pos]) {
-    /* need to insert it, so move all the other items up
-     * (last slot is still empty, of course) */
-    memmove(&lookup_list[pos+1],
-            &lookup_list[pos],
-            sizeof(lookup_info **) * (lookup_list_count-pos-1));
+/* need to add the lookup to lookup_list, sorted */
+int pos = 0;
+
+/* strategy is to go through the list until we find
+either an empty spot or a name that is higher.
+this can't fail because we have enough space. */
+
+while (lookup_list[pos] && (Ustrcmp(lookup_list[pos]->name, info->name) <= 0))
+  pos++;
+
+if (lookup_list[pos])
+  {
+  /* need to insert it, so move all the other items up
+  (last slot is still empty, of course) */
+
+  memmove(&lookup_list[pos+1],
+	  &lookup_list[pos],
+	  sizeof(lookup_info *) * (lookup_list_count-pos-1));
   }
-  lookup_list[pos] = info;
+lookup_list[pos] = info;
 }
 
 
@@ -453,62 +476,67 @@ static void add_lookup_to_list(lookup_info *info)
  * which give parse errors on an extern in function scope.  Each entry needs
  * to also be invoked in init_lookup_list() below  */
 
-#if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
-extern lookup_module_info whoson_lookup_module_info;
+#if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
+extern lookup_module_info cdb_lookup_module_info;
 #endif
-#if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
-extern lookup_module_info testdb_lookup_module_info;
+#if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
+extern lookup_module_info dbmdb_lookup_module_info;
 #endif
-#if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
-extern lookup_module_info sqlite_lookup_module_info;
+#if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
+extern lookup_module_info dnsdb_lookup_module_info;
 #endif
-#ifdef EXPERIMENTAL_SPF
-extern lookup_module_info spf_lookup_module_info;
+#if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
+extern lookup_module_info dsearch_lookup_module_info;
 #endif
-#if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
-extern lookup_module_info pgsql_lookup_module_info;
+#if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
+extern lookup_module_info ibase_lookup_module_info;
 #endif
-#if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
-extern lookup_module_info passwd_lookup_module_info;
+#if defined(LOOKUP_LDAP)
+extern lookup_module_info ldap_lookup_module_info;
 #endif
-#if defined(LOOKUP_REDIS) && LOOKUP_REDIS!=2
-extern lookup_module_info redis_lookup_module_info;
+#if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
+extern lookup_module_info lsearch_lookup_module_info;
 #endif
-#if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
-extern lookup_module_info oracle_lookup_module_info;
+#if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
+extern lookup_module_info mysql_lookup_module_info;
+#endif
+#if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
+extern lookup_module_info nis_lookup_module_info;
 #endif
 #if defined(LOOKUP_NISPLUS) && LOOKUP_NISPLUS!=2
 extern lookup_module_info nisplus_lookup_module_info;
 #endif
-#if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
-extern lookup_module_info nis_lookup_module_info;
+#if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
+extern lookup_module_info oracle_lookup_module_info;
 #endif
-#if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
-extern lookup_module_info mysql_lookup_module_info;
+#if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
+extern lookup_module_info passwd_lookup_module_info;
 #endif
-#if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
-extern lookup_module_info lsearch_lookup_module_info;
+#if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
+extern lookup_module_info pgsql_lookup_module_info;
 #endif
-#ifdef LOOKUP_LDAP
-extern lookup_module_info ldap_lookup_module_info;
+#if defined(LOOKUP_REDIS) && LOOKUP_REDIS!=2
+extern lookup_module_info redis_lookup_module_info;
 #endif
-#if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
-extern lookup_module_info ibase_lookup_module_info;
+#if defined(EXPERIMENTAL_LMDB)
+extern lookup_module_info lmdb_lookup_module_info;
 #endif
-#if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
-extern lookup_module_info dsearch_lookup_module_info;
+#if defined(EXPERIMENTAL_SPF)
+extern lookup_module_info spf_lookup_module_info;
 #endif
-#if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
-extern lookup_module_info dnsdb_lookup_module_info;
+#if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
+extern lookup_module_info sqlite_lookup_module_info;
 #endif
-#if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
-extern lookup_module_info dbmdb_lookup_module_info;
+#if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
+extern lookup_module_info testdb_lookup_module_info;
 #endif
-#if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
-extern lookup_module_info cdb_lookup_module_info;
+#if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
+extern lookup_module_info whoson_lookup_module_info;
 #endif
 
-void init_lookup_list(void)
+
+void
+init_lookup_list(void)
 {
 #ifdef LOOKUP_MODULE_DIR
   DIR *dd;
@@ -578,6 +606,10 @@ void init_lookup_list(void)
   addlookupmodule(NULL, &redis_lookup_module_info);
 #endif
 
+#ifdef EXPERIMENTAL_LMDB
+  addlookupmodule(NULL, &lmdb_lookup_module_info);
+#endif
+
 #ifdef EXPERIMENTAL_SPF
   addlookupmodule(NULL, &spf_lookup_module_info);
 #endif
diff --git a/src/src/environment.c b/src/src/environment.c
new file mode 100644
index 000000000..c394eb7e7
--- /dev/null
+++ b/src/src/environment.c
@@ -0,0 +1,72 @@
+/*************************************************
+*     Exim - an Internet mail transport agent    *
+*************************************************/
+
+/* Copyright (c) Heiko Schlittermann 2016
+ * hs@schlittermann.de
+ * See the file NOTICE for conditions of use and distribution.
+ */
+
+#include "exim.h"
+
+extern char **environ;
+
+/* The cleanup_environment() function is used during the startup phase
+of the Exim process, right after reading the configurations main
+part, before any expansions take place. It retains the environment
+variables we trust (via the keep_environment option) and allows to
+set additional variables (via add_environment).
+
+Returns:    TRUE if successful
+            FALSE otherwise
+*/
+
+BOOL
+cleanup_environment()
+{
+if (!keep_environment || *keep_environment == '\0')
+  {
+  /* From: https://github.com/dovecot/core/blob/master/src/lib/env-util.c#L55
+  Try to clear the environment.
+  a) environ = NULL crashes on OS X.
+  b) *environ = NULL doesn't work on FreeBSD 7.0.
+  c) environ = emptyenv doesn't work on Haiku OS
+  d) environ = calloc() should work everywhere */
+
+  if (environ) *environ = NULL;
+
+  }
+else if (Ustrcmp(keep_environment, "*") != 0)
+  {
+  uschar **p;
+  if (environ) for (p = USS environ; *p; /* see below */)
+    {
+    /* It's considered broken if we do not find the '=', according to
+    Florian Weimer. For now we ignore such strings. unsetenv() would complain,
+    getenv() would complain. */
+    uschar * eqp = Ustrchr(*p, '=');
+
+    if (eqp)
+      {
+      uschar * name = string_copyn(*p, eqp - *p);
+
+      if (OK != match_isinlist(name, CUSS &keep_environment,
+          0, NULL, NULL, MCL_NOEXPAND, FALSE, NULL))
+        if (os_unsetenv(name) < 0) return FALSE;
+        else p = USS environ; /* RESTART from the beginning */
+      else p++;
+      store_reset(name);
+      }
+    }
+  }
+if (add_environment)
+  {
+    uschar * p;
+    int sep = 0;
+    const uschar * envlist = add_environment;
+
+    while ((p = string_nextinlist(&envlist, &sep, NULL, 0))) putenv(CS p);
+  }
+
+  return TRUE;
+}
diff --git a/src/src/exim.c b/src/src/exim.c
index ed3035247..e63997030 100644
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -12,6 +12,10 @@ Also a few functions that don't naturally fit elsewhere. */
 
 #include "exim.h"
 
+#ifdef __GLIBC__
+# include <gnu/libc-version.h>
+#endif
+
 #ifdef USE_GNUTLS
 # include <gnutls/gnutls.h>
 # if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
@@ -170,10 +174,8 @@ Returns:   nothing
 void
 set_process_info(const char *format, ...)
 {
-int len;
+int len = sprintf(CS process_info, "%5d ", (int)getpid());
 va_list ap;
-sprintf(CS process_info, "%5d ", (int)getpid());
-len = Ustrlen(process_info);
 va_start(ap, format);
 if (!string_vformat(process_info + len, PROCESS_INFO_SIZE - len - 2, format, ap))
   Ustrcpy(process_info + len, "**** string overflowed buffer ****");
@@ -814,9 +816,6 @@ fprintf(f, "Support for:");
 #ifdef WITH_CONTENT_SCAN
   fprintf(f, " Content_Scanning");
 #endif
-#ifdef WITH_OLD_DEMIME
-  fprintf(f, " Old_Demime");
-#endif
 #ifndef DISABLE_DKIM
   fprintf(f, " DKIM");
 #endif
@@ -841,6 +840,15 @@ fprintf(f, "Support for:");
 #ifdef SUPPORT_SOCKS
   fprintf(f, " SOCKS");
 #endif
+#ifdef TCP_FASTOPEN
+  fprintf(f, " TCP_Fast_Open");
+#endif
+#ifdef EXPERIMENTAL_LMDB
+  fprintf(f, " Experimental_LMDB");
+#endif
+#ifdef EXPERIMENTAL_QUEUEFILE
+  fprintf(f, " Experimental_QUEUEFILE");
+#endif
 #ifdef EXPERIMENTAL_SPF
   fprintf(f, " Experimental_SPF");
 #endif
@@ -886,6 +894,9 @@ fprintf(f, "Lookups (built-in):");
 #if defined(LOOKUP_LDAP) && LOOKUP_LDAP!=2
   fprintf(f, " ldap ldapdn ldapm");
 #endif
+#ifdef EXPERIMENTAL_LMDB
+  fprintf(f, " lmdb");
+#endif
 #if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
   fprintf(f, " mysql");
 #endif
@@ -991,6 +1002,9 @@ fprintf(f, "Transports:");
 #ifdef TRANSPORT_PIPE
   fprintf(f, " pipe");
 #endif
+#ifdef EXPERIMENTAL_QUEUEFILE
+  fprintf(f, " queuefile");
+#endif
 #ifdef TRANSPORT_SMTP
   fprintf(f, " smtp");
 #endif
@@ -1005,6 +1019,8 @@ if (fixed_never_users[0] > 0)
   fprintf(f, "%d\n", (unsigned int)fixed_never_users[i]);
   }
 
+fprintf(f, "Configure owner: %d:%d\n", config_uid, config_gid);
+
 fprintf(f, "Size of off_t: " SIZE_T_FMT "\n", sizeof(off_t));
 
 /* Everything else is details which are only worth reporting when debugging.
@@ -1028,6 +1044,14 @@ DEBUG(D_any) do {
   fprintf(f, "Compiler: <unknown>\n");
 #endif
 
+#ifdef __GLIBC__
+  fprintf(f, "Library version: Glibc: Compile: %d.%d\n",
+	       	__GLIBC__, __GLIBC_MINOR__);
+  if (__GLIBC_PREREQ(2, 1))
+    fprintf(f, "                        Runtime: %s\n",
+	       	gnu_get_libc_version());
+#endif
+
 #ifdef SUPPORT_TLS
   tls_version_report(f);
 #endif
@@ -1043,7 +1067,7 @@ DEBUG(D_any) do {
   characters; unless it's an ancient version of PCRE in which case it
   is not defined. */
 #ifndef PCRE_PRERELEASE
-#define PCRE_PRERELEASE
+# define PCRE_PRERELEASE
 #endif
 #define QUOTE(X) #X
 #define EXPAND_AND_QUOTE(X) QUOTE(X)
@@ -1139,23 +1163,23 @@ for (t = lpart; !needs_quote && *t != 0; t++)
 if (!needs_quote) return lpart;
 
 size = ptr = 0;
-yield = string_cat(NULL, &size, &ptr, US"\"", 1);
+yield = string_catn(NULL, &size, &ptr, US"\"", 1);
 
 for (;;)
   {
   uschar *nq = US Ustrpbrk(lpart, "\\\"");
   if (nq == NULL)
     {
-    yield = string_cat(yield, &size, &ptr, lpart, Ustrlen(lpart));
+    yield = string_cat(yield, &size, &ptr, lpart);
     break;
     }
-  yield = string_cat(yield, &size, &ptr, lpart, nq - lpart);
-  yield = string_cat(yield, &size, &ptr, US"\\", 1);
-  yield = string_cat(yield, &size, &ptr, nq, 1);
+  yield = string_catn(yield, &size, &ptr, lpart, nq - lpart);
+  yield = string_catn(yield, &size, &ptr, US"\\", 1);
+  yield = string_catn(yield, &size, &ptr, nq, 1);
   lpart = nq + 1;
   }
 
-yield = string_cat(yield, &size, &ptr, US"\"", 1);
+yield = string_catn(yield, &size, &ptr, US"\"", 1);
 yield[ptr] = 0;
 return yield;
 }
@@ -1269,15 +1293,16 @@ for (i = 0;; i++)
     while (p < ss && isspace(*p)) p++;   /* leading space after cont */
     }
 
-  yield = string_cat(yield, &size, &ptr, p, ss - p);
+  yield = string_catn(yield, &size, &ptr, p, ss - p);
 
   #ifdef USE_READLINE
   if (fn_readline != NULL) free(readline_line);
   #endif
 
+  /* yield can only be NULL if ss==p */
   if (ss == p || yield[ptr-1] != '\\')
     {
-    yield[ptr] = 0;
+    if (yield) yield[ptr] = 0;
     break;
     }
   yield[--ptr] = 0;
@@ -1333,12 +1358,12 @@ exit(EXIT_FAILURE);
 /* Typically, Exim will drop privileges if macros are supplied.  In some
 cases, we want to not do so.
 
-Arguments:    none (macros is a global)
+Arguments:    opt_D_used - true if the commandline had a "-D" option
 Returns:      true if trusted, false otherwise
 */
 
 static BOOL
-macros_trusted(void)
+macros_trusted(BOOL opt_D_used)
 {
 #ifdef WHITELIST_D_MACROS
 macro_item *m;
@@ -1348,7 +1373,7 @@ size_t len;
 BOOL prev_char_item, found;
 #endif
 
-if (macros == NULL)
+if (!opt_D_used)
   return TRUE;
 #ifndef WHITELIST_D_MACROS
 return FALSE;
@@ -1405,8 +1430,9 @@ for (p = whitelisted, i = 0; (p != end) && (i < white_count); ++p)
   }
 whites[i] = NULL;
 
-/* The list of macros should be very short.  Accept the N*M complexity. */
-for (m = macros; m != NULL; m = m->next)
+/* The list of commandline macros should be very short.
+Accept the N*M complexity. */
+for (m = macros; m; m = m->next) if (m->command_line)
   {
   found = FALSE;
   for (w = whites; *w; ++w)
@@ -1496,6 +1522,7 @@ BOOL list_config = FALSE;
 BOOL local_queue_only;
 BOOL more = TRUE;
 BOOL one_msg_action = FALSE;
+BOOL opt_D_used = FALSE;
 BOOL queue_only_set = FALSE;
 BOOL receiving_message = TRUE;
 BOOL sender_ident_set = FALSE;
@@ -1637,8 +1664,7 @@ os_non_restarting_signal(SIGALRM, sigalrm_handler);
 /* Ensure we have a buffer for constructing log entries. Use malloc directly,
 because store_malloc writes a log entry on failure. */
 
-log_buffer = (uschar *)malloc(LOG_BUFFER_SIZE);
-if (log_buffer == NULL)
+if (!(log_buffer = US malloc(LOG_BUFFER_SIZE)))
   {
   fprintf(stderr, "exim: failed to get store for log buffer\n");
   exit(EXIT_FAILURE);
@@ -1999,7 +2025,7 @@ for (i = 1; i < argc; i++)
 
     else if (*argrest == 'F')
       {
-      filter_test |= FTEST_SYSTEM;
+      filter_test |= checking = FTEST_SYSTEM;
       if (*(++argrest) != 0) { badarg = TRUE; break; }
       if (++i < argc) filter_test_sfile = argv[i]; else
         {
@@ -2019,7 +2045,7 @@ for (i = 1; i < argc; i++)
       {
       if (*(++argrest) == 0)
         {
-        filter_test |= FTEST_USER;
+        filter_test |= checking = FTEST_USER;
         if (++i < argc) filter_test_ufile = argv[i]; else
           {
           fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
@@ -2049,6 +2075,7 @@ for (i = 1; i < argc; i++)
       sender_host_address = argv[i];
       host_checking = checking = log_testing_mode = TRUE;
       host_checking_callout = argrest[1] == 'c';
+      message_logs = FALSE;
       }
 
     /* -bi: This option is used by sendmail to initialize *the* alias file,
@@ -2094,6 +2121,7 @@ for (i = 1; i < argc; i++)
     else if (Ustrcmp(argrest, "malware") == 0)
       {
       if (++i >= argc) { badarg = TRUE; break; }
+      checking = TRUE;
       malware_test_file = argv[i];
       }
 
@@ -2175,6 +2203,7 @@ for (i = 1; i < argc; i++)
 
     else if (Ustrcmp(argrest, "rt") == 0)
       {
+      checking = TRUE;
       test_retry_arg = i + 1;
       goto END_ARG;
       }
@@ -2183,6 +2212,7 @@ for (i = 1; i < argc; i++)
 
     else if (Ustrcmp(argrest, "rw") == 0)
       {
+      checking = TRUE;
       test_rewrite_arg = i + 1;
       goto END_ARG;
       }
@@ -2225,6 +2255,7 @@ for (i = 1; i < argc; i++)
       printf("%s\n", CS version_copyright);
       version_printed = TRUE;
       show_whats_supported(stdout);
+      log_testing_mode = TRUE;
       }
 
     /* -bw: inetd wait mode, accept a listening socket as stdin */
@@ -2391,11 +2422,11 @@ for (i = 1; i < argc; i++)
     #else
       {
       int ptr = 0;
-      macro_item *mlast = NULL;
       macro_item *m;
       uschar name[24];
       uschar *s = argrest;
 
+      opt_D_used = TRUE;
       while (isspace(*s)) s++;
 
       if (*s < 'A' || *s > 'Z')
@@ -2419,22 +2450,14 @@ for (i = 1; i < argc; i++)
         while (isspace(*s)) s++;
         }
 
-      for (m = macros; m != NULL; m = m->next)
-        {
+      for (m = macros; m; m = m->next)
         if (Ustrcmp(m->name, name) == 0)
           {
           fprintf(stderr, "exim: duplicated -D in command line\n");
           exit(EXIT_FAILURE);
           }
-        mlast = m;
-        }
 
-      m = store_get(sizeof(macro_item) + Ustrlen(name));
-      m->next = NULL;
-      m->command_line = TRUE;
-      if (mlast == NULL) macros = m; else mlast->next = m;
-      Ustrcpy(m->name, name);
-      m->replacement = string_copy(s);
+      m = macro_create(name, s, TRUE, FALSE);
 
       if (clmacro_count >= MAX_CLMACROS)
         {
@@ -2702,66 +2725,63 @@ for (i = 1; i < argc; i++)
       break;
       }
 
+    else if (*argrest == 'C' && argrest[1] && !argrest[2])
+      {
+	switch(argrest[1])
+	{
     /* -MCA: set the smtp_authenticated flag; this is useful only when it
     precedes -MC (see above). The flag indicates that the host to which
     Exim is connected has accepted an AUTH sequence. */
 
-    else if (Ustrcmp(argrest, "CA") == 0)
-      {
-      smtp_authenticated = TRUE;
-      break;
-      }
+	case 'A': smtp_authenticated = TRUE; break;
 
     /* -MCD: set the smtp_use_dsn flag; this indicates that the host
        that exim is connected to supports the esmtp extension DSN */
-    else if (Ustrcmp(argrest, "CD") == 0)
-      {
-      smtp_use_dsn = TRUE;
-      break;
-      }
+
+	case 'D': smtp_peer_options |= PEER_OFFERED_DSN; break;
+
+    /* -MCG: set the queue name, to a non-default value */
+
+	case 'G': if (++i < argc) queue_name = string_copy(argv[i]);
+		  else badarg = TRUE;
+		  break;
+
+    /* -MCK: the peer offered CHUNKING.  Must precede -MC */
+
+	case 'K': smtp_peer_options |= PEER_OFFERED_CHUNKING; break;
 
     /* -MCP: set the smtp_use_pipelining flag; this is useful only when
     it preceded -MC (see above) */
 
-    else if (Ustrcmp(argrest, "CP") == 0)
-      {
-      smtp_use_pipelining = TRUE;
-      break;
-      }
+	case 'P': smtp_peer_options |= PEER_OFFERED_PIPE; break;
 
     /* -MCQ: pass on the pid of the queue-running process that started
     this chain of deliveries and the fd of its synchronizing pipe; this
     is useful only when it precedes -MC (see above) */
 
-    else if (Ustrcmp(argrest, "CQ") == 0)
-      {
-      if(++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
-        else badarg = TRUE;
-      if(++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
-        else badarg = TRUE;
-      break;
-      }
+	case 'Q': if (++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
+		  else badarg = TRUE;
+		  if (++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
+		  else badarg = TRUE;
+		  break;
 
     /* -MCS: set the smtp_use_size flag; this is useful only when it
     precedes -MC (see above) */
 
-    else if (Ustrcmp(argrest, "CS") == 0)
-      {
-      smtp_use_size = TRUE;
-      break;
-      }
+	case 'S': smtp_peer_options |= PEER_OFFERED_SIZE; break;
 
+#ifdef SUPPORT_TLS
     /* -MCT: set the tls_offered flag; this is useful only when it
     precedes -MC (see above). The flag indicates that the host to which
     Exim is connected has offered TLS support. */
 
-    #ifdef SUPPORT_TLS
-    else if (Ustrcmp(argrest, "CT") == 0)
-      {
-      tls_offered = TRUE;
-      break;
+	case 'T': smtp_peer_options |= PEER_OFFERED_TLS; break;
+#endif
+
+	default:  badarg = TRUE; break;
+	}
+	break;
       }
-    #endif
 
     /* -M[x]: various operations on the following list of message ids:
        -M    deliver the messages, ignoring next retry times and thawing
@@ -3212,7 +3232,7 @@ for (i = 1; i < argc; i++)
     if (*argrest == 'f')
       {
       queue_run_force = TRUE;
-      if (*(++argrest) == 'f')
+      if (*++argrest == 'f')
         {
         deliver_force_thaw = TRUE;
         argrest++;
@@ -3227,8 +3247,19 @@ for (i = 1; i < argc; i++)
       argrest++;
       }
 
-    /* -q[f][f][l]: Run the queue, optionally forced, optionally local only,
-    optionally starting from a given message id. */
+    /* -q[f][f][l][G<name>]... Work on the named queue */
+
+    if (*argrest == 'G')
+      {
+      int i;
+      for (argrest++, i = 0; argrest[i] && argrest[i] != '/'; ) i++;
+      queue_name = string_copyn(argrest, i);
+      argrest += i;
+      if (*argrest == '/') argrest++;
+      }
+
+    /* -q[f][f][l][G<name>]: Run the queue, optionally forced, optionally local
+    only, optionally named, optionally starting from a given message id. */
 
     if (*argrest == 0 &&
         (i + 1 >= argc || argv[i+1][0] == '-' || mac_ismsgid(argv[i+1])))
@@ -3240,20 +3271,14 @@ for (i = 1; i < argc; i++)
         stop_queue_run_id = argv[++i];
       }
 
-    /* -q[f][f][l]<n>: Run the queue at regular intervals, optionally forced,
-    optionally local only. */
+    /* -q[f][f][l][G<name>/]<n>: Run the queue at regular intervals, optionally
+    forced, optionally local only, optionally named. */
 
-    else
+    else if ((queue_interval = readconf_readtime(*argrest ? argrest : argv[++i],
+						0, FALSE)) <= 0)
       {
-      if (*argrest != 0)
-        queue_interval = readconf_readtime(argrest, 0, FALSE);
-      else
-        queue_interval = readconf_readtime(argv[++i], 0, FALSE);
-      if (queue_interval <= 0)
-        {
-        fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
-        exit(EXIT_FAILURE);
-        }
+      fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
+      exit(EXIT_FAILURE);
       }
     break;
 
@@ -3273,8 +3298,7 @@ for (i = 1; i < argc; i++)
     if (*argrest != 0)
       {
       int i;
-      for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
-        {
+      for (i = 0; i < nelem(rsopts); i++)
         if (Ustrcmp(argrest, rsopts[i]) == 0)
           {
           if (i != 2) queue_run_force = TRUE;
@@ -3282,21 +3306,20 @@ for (i = 1; i < argc; i++)
           if (i == 1 || i == 4) deliver_force_thaw = TRUE;
           argrest += Ustrlen(rsopts[i]);
           }
-        }
       }
 
     /* -R: Set string to match in addresses for forced queue run to
     pick out particular messages. */
 
-    if (*argrest == 0)
+    if (*argrest)
+      deliver_selectstring = argrest;
+    else if (i+1 < argc)
+      deliver_selectstring = argv[++i];
+    else
       {
-      if (i+1 < argc) deliver_selectstring = argv[++i]; else
-        {
-        fprintf(stderr, "exim: string expected after -R\n");
-        exit(EXIT_FAILURE);
-        }
+      fprintf(stderr, "exim: string expected after -R\n");
+      exit(EXIT_FAILURE);
       }
-    else deliver_selectstring = argrest;
     break;
 
 
@@ -3317,11 +3340,10 @@ for (i = 1; i < argc; i++)
     in all cases provided there are no further characters in this
     argument. */
 
-    if (*argrest != 0)
+    if (*argrest)
       {
       int i;
-      for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
-        {
+      for (i = 0; i < nelem(rsopts); i++)
         if (Ustrcmp(argrest, rsopts[i]) == 0)
           {
           if (i != 2) queue_run_force = TRUE;
@@ -3329,21 +3351,20 @@ for (i = 1; i < argc; i++)
           if (i == 1 || i == 4) deliver_force_thaw = TRUE;
           argrest += Ustrlen(rsopts[i]);
           }
-        }
       }
 
     /* -S: Set string to match in addresses for forced queue run to
     pick out particular messages. */
 
-    if (*argrest == 0)
+    if (*argrest)
+      deliver_selectstring_sender = argrest;
+    else if (i+1 < argc)
+      deliver_selectstring_sender = argv[++i];
+    else
       {
-      if (i+1 < argc) deliver_selectstring_sender = argv[++i]; else
-        {
-        fprintf(stderr, "exim: string expected after -S\n");
-        exit(EXIT_FAILURE);
-        }
+      fprintf(stderr, "exim: string expected after -S\n");
+      exit(EXIT_FAILURE);
       }
-    else deliver_selectstring_sender = argrest;
     break;
 
     /* -Tqt is an option that is exclusively for use by the testing suite.
@@ -3457,8 +3478,9 @@ for (i = 1; i < argc; i++)
 
 /* If -R or -S have been specified without -q, assume a single queue run. */
 
-if ((deliver_selectstring != NULL || deliver_selectstring_sender != NULL) &&
-  queue_interval < 0) queue_interval = 0;
+if (  (deliver_selectstring || deliver_selectstring_sender)
+   && queue_interval < 0)
+    queue_interval = 0;
 
 
 END_ARG:
@@ -3474,12 +3496,12 @@ if ((
     ) ||
     (
     msg_action_arg > 0 &&
-    (daemon_listen || queue_interval >= 0 || list_options ||
+    (daemon_listen || queue_interval > 0 || list_options ||
       (checking && msg_action != MSG_LOAD) ||
       bi_option || test_retry_arg >= 0 || test_rewrite_arg >= 0)
     ) ||
     (
-    (daemon_listen || queue_interval >= 0) &&
+    (daemon_listen || queue_interval > 0) &&
     (sender_address != NULL || list_options || list_queue || checking ||
       bi_option)
     ) ||
@@ -3666,7 +3688,7 @@ configuration file changes and macro definitions haven't happened. */
 
 if ((                                            /* EITHER */
     (!trusted_config ||                          /* Config changed, or */
-     !macros_trusted()) &&                       /*  impermissible macros and */
+     !macros_trusted(opt_D_used)) &&		 /*  impermissible macros and */
     real_uid != root_uid &&                      /* Not root, and */
     !running_in_test_harness                     /* Not fudged */
     ) ||                                         /*   OR   */
@@ -3741,9 +3763,42 @@ if (running_in_test_harness) smtputf8_advertise_hosts = NULL;
 
 /* Read the main runtime configuration data; this gives up if there
 is a failure. It leaves the configuration file open so that the subsequent
-configuration data for delivery can be read if needed. */
+configuration data for delivery can be read if needed.
+
+NOTE: immediatly after opening the configuration file we change the working
+directory to "/"! Later we change to $spool_directory. We do it there, because
+during readconf_main() some expansion takes place already. */
+
+/* Store the initial cwd before we change directories */
+if ((initial_cwd = os_getcwd(NULL, 0)) == NULL)
+  {
+  perror("exim: can't get the current working directory");
+  exit(EXIT_FAILURE);
+  }
+
+/* checking:
+    -be[m] expansion test        -
+    -b[fF] filter test           new
+    -bh[c] host test             -
+    -bmalware malware_test_file  new
+    -brt   retry test            new
+    -brw   rewrite test          new
+    -bt    address test          -
+    -bv[s] address verify        -
+   list_options:
+    -bP <option> (except -bP config, which sets list_config)
+
+If any of these options is set, we suppress warnings about configuration
+issues (currently about tls_advertise_hosts and keep_environment not being
+defined) */
+
+readconf_main(checking || list_options);
+
+/* Now in directory "/" */
+
+if (cleanup_environment() == FALSE)
+  log_write(0, LOG_PANIC_DIE, "Can't cleanup environment");
 
-readconf_main();
 
 /* If an action on specific messages is requested, or if a daemon or queue
 runner is being started, we need to know if Exim was called by an admin user.
@@ -3885,7 +3940,6 @@ if (Ustrlen(syslog_processname) > 32)
     "syslog_processname is longer than 32 chars: aborting");
 
 if (log_oneline)
-  {
   if (admin_user)
     {
     log_write(0, LOG_MAIN, "%s", log_oneline);
@@ -3893,28 +3947,27 @@ if (log_oneline)
     }
   else
     return EXIT_FAILURE;
-  }
 
 /* In some operating systems, the environment variable TMPDIR controls where
 temporary files are created; Exim doesn't use these (apart from when delivering
 to MBX mailboxes), but called libraries such as DBM libraries may require them.
 If TMPDIR is found in the environment, reset it to the value defined in the
-TMPDIR macro, if this macro is defined. */
+EXIM_TMPDIR macro, if this macro is defined.  For backward compatibility this
+macro may be called TMPDIR in old "Local/Makefile"s. It's converted to
+EXIM_TMPDIR by the build scripts.
+*/
 
-#ifdef TMPDIR
+#ifdef EXIM_TMPDIR
   {
   uschar **p;
-  for (p = USS environ; *p != NULL; p++)
-    {
-    if (Ustrncmp(*p, "TMPDIR=", 7) == 0 &&
-        Ustrcmp(*p+7, TMPDIR) != 0)
+  if (environ) for (p = USS environ; *p; p++)
+    if (Ustrncmp(*p, "TMPDIR=", 7) == 0 && Ustrcmp(*p+7, EXIM_TMPDIR) != 0)
       {
-      uschar *newp = malloc(Ustrlen(TMPDIR) + 8);
-      sprintf(CS newp, "TMPDIR=%s", TMPDIR);
+      uschar * newp = store_malloc(Ustrlen(EXIM_TMPDIR) + 8);
+      sprintf(CS newp, "TMPDIR=%s", EXIM_TMPDIR);
       *p = newp;
-      DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", TMPDIR);
+      DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", EXIM_TMPDIR);
       }
-    }
   }
 #endif
 
@@ -3928,33 +3981,28 @@ about this earlier - but hopefully nothing will normally be logged earlier than
 this. We have to make a new environment if TZ is wrong, but don't bother if
 timestamps_utc is set, because then all times are in UTC anyway. */
 
-if (timezone_string != NULL && strcmpic(timezone_string, US"UTC") == 0)
-  {
+if (timezone_string && strcmpic(timezone_string, US"UTC") == 0)
   timestamps_utc = TRUE;
-  }
 else
   {
   uschar *envtz = US getenv("TZ");
-  if ((envtz == NULL && timezone_string != NULL) ||
-      (envtz != NULL &&
-        (timezone_string == NULL ||
-         Ustrcmp(timezone_string, envtz) != 0)))
+  if (envtz
+      ? !timezone_string || Ustrcmp(timezone_string, envtz) != 0
+      : timezone_string != NULL
+     )
     {
     uschar **p = USS environ;
     uschar **new;
     uschar **newp;
     int count = 0;
-    while (*p++ != NULL) count++;
-    if (envtz == NULL) count++;
-    newp = new = malloc(sizeof(uschar *) * (count + 1));
-    for (p = USS environ; *p != NULL; p++)
+    if (environ) while (*p++) count++;
+    if (!envtz) count++;
+    newp = new = store_malloc(sizeof(uschar *) * (count + 1));
+    if (environ) for (p = USS environ; *p; p++)
+      if (Ustrncmp(*p, "TZ=", 3) != 0) *newp++ = *p;
+    if (timezone_string)
       {
-      if (Ustrncmp(*p, "TZ=", 3) == 0) continue;
-      *newp++ = *p;
-      }
-    if (timezone_string != NULL)
-      {
-      *newp = malloc(Ustrlen(timezone_string) + 4);
+      *newp = store_malloc(Ustrlen(timezone_string) + 4);
       sprintf(CS *newp++, "TZ=%s", timezone_string);
       }
     *newp = NULL;
@@ -3986,16 +4034,15 @@ Exim user", but it hasn't, because either the -D option set macros, or the
       root for -C or -D, the caller must either be root or be invoking a
       trusted configuration file (when deliver_drop_privilege is false). */
 
-if (removed_privilege && (!trusted_config || macros != NULL) &&
-    real_uid == exim_uid)
-  {
+if (  removed_privilege
+   && (!trusted_config || opt_D_used)
+   && real_uid == exim_uid)
   if (deliver_drop_privilege)
     really_exim = TRUE; /* let logging work normally */
   else
     log_write(0, LOG_MAIN|LOG_PANIC,
       "exim user lost privilege for using %s option",
       trusted_config? "-D" : "-C");
-  }
 
 /* Start up Perl interpreter if Perl support is configured and there is a
 perl_startup option, and the configuration or the command line specifies
@@ -4029,9 +4076,10 @@ if (((debug_selector & D_any) != 0 || LOGGING(arguments))
   {
   int i;
   uschar *p = big_buffer;
-  char * dummy;
   Ustrcpy(p, "cwd= (failed)");
-  dummy = /* quieten compiler */ getcwd(CS p+4, big_buffer_size - 4);
+
+  Ustrncpy(p + 4, initial_cwd, big_buffer_size-5);
+
   while (*p) p++;
   (void)string_format(p, big_buffer_size - (p - big_buffer), " %d args:", argc);
   while (*p) p++;
@@ -4163,7 +4211,7 @@ real, but are permitted when checking things (-be, -bv, -bt, -bh, -bf, -bF).
 Note that authority for performing certain actions on messages is tested in the
 queue_action() function. */
 
-if (!trusted_caller && !checking && filter_test == FTEST_NONE)
+if (!trusted_caller && !checking)
   {
   sender_host_name = sender_host_address = interface_address =
     sender_ident = received_protocol = NULL;
@@ -4537,7 +4585,8 @@ if (list_options)
           (Ustrcmp(argv[i], "router") == 0 ||
            Ustrcmp(argv[i], "transport") == 0 ||
            Ustrcmp(argv[i], "authenticator") == 0 ||
-           Ustrcmp(argv[i], "macro") == 0))
+           Ustrcmp(argv[i], "macro") == 0 ||
+           Ustrcmp(argv[i], "environment") == 0))
         {
         readconf_print(argv[i+1], argv[i], flag_n);
         i++;
@@ -4550,7 +4599,7 @@ if (list_options)
 if (list_config)
   {
   set_process_info("listing config");
-  readconf_print(US"config", NULL, FALSE);
+  readconf_print(US"config", NULL, flag_n);
   exim_exit(EXIT_SUCCESS);
   }
 
@@ -4617,7 +4666,10 @@ if (queue_interval == 0 && !daemon_listen)
     (start_queue_run_id == NULL)? US"" : start_queue_run_id,
     (stop_queue_run_id == NULL)?  US"" : US" stopping at ",
     (stop_queue_run_id == NULL)?  US"" : stop_queue_run_id);
-  set_process_info("running the queue (single queue run)");
+  if (*queue_name)
+    set_process_info("running the '%s' queue (single queue run)", queue_name);
+  else
+    set_process_info("running the queue (single queue run)");
   queue_run(start_queue_run_id, stop_queue_run_id, FALSE);
   exim_exit(EXIT_SUCCESS);
   }
@@ -4816,8 +4868,7 @@ if ((!smtp_input && sender_address == NULL) ||
   if (sender_address == NULL             /* No sender_address set */
        ||                                /*         OR            */
        (sender_address[0] != 0 &&        /* Non-empty sender address, AND */
-       !checking &&                      /* Not running tests, AND */
-       filter_test == FTEST_NONE))       /* Not testing a filter */
+       !checking))                       /* Not running tests, including filter tests */
     {
     sender_address = originator_login;
     sender_address_forced = FALSE;
@@ -4902,7 +4953,7 @@ Otherwise, if -bem was used, read a message from stdin. */
 
 if (expansion_test)
   {
-  dns_init(0, 0);
+  dns_init(FALSE, FALSE, FALSE);
   if (msg_action_arg > 0 && msg_action == MSG_LOAD)
     {
     uschar spoolname[256];  /* Not big_buffer; used in spool_read_header() */
@@ -4913,7 +4964,7 @@ if (expansion_test)
       }
     message_id = argv[msg_action_arg];
     (void)string_format(spoolname, sizeof(spoolname), "%s-H", message_id);
-    if (!spool_open_datafile(message_id))
+    if ((deliver_datafile = spool_open_datafile(message_id)) < 0)
       printf ("Failed to load message datafile %s\n", message_id);
     if (spool_read_header(spoolname, TRUE, FALSE) != spool_read_OK)
       printf ("Failed to load message %s\n", message_id);
@@ -5489,7 +5540,7 @@ while (more)
     ignored; rejecting here would just add complication, and it can just as
     well be done later. Allow $recipients to be visible in the ACL. */
 
-    if (acl_not_smtp_start != NULL)
+    if (acl_not_smtp_start)
       {
       uschar *user_msg, *log_msg;
       enable_dollar_recipients = TRUE;
@@ -5498,6 +5549,20 @@ while (more)
       enable_dollar_recipients = FALSE;
       }
 
+    /* Pause for a while waiting for input.  If none received in that time,
+    close the logfile, if we had one open; then if we wait for a long-running
+    datasource (months, in one use-case) log rotation will not leave us holding
+    the file copy. */
+
+    if (!receive_timeout)
+      {
+      struct timeval t = { 30*60, 0 };	/* 30 minutess */
+      fd_set r;
+
+      FD_ZERO(&r); FD_SET(0, &r);
+      if (select(1, &r, NULL, NULL, &t) == 0) mainlog_close();
+      }
+
     /* Read the data for the message. If filter_test is not FTEST_NONE, this
     will just read the headers for the message, and not write anything onto the
     spool. */
@@ -5662,8 +5727,8 @@ while (more)
 
       if (geteuid() != root_uid && !deliver_drop_privilege && !unprivileged)
         {
-        (void)child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 2, US"-Mc",
-          message_id);
+        (void)child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE,
+		2, US"-Mc", message_id);
         /* Control does not return here. */
         }
 
diff --git a/src/src/exim.h b/src/src/exim.h
index 385c3624e..9ae96b2a0 100644
--- a/src/src/exim.h
+++ b/src/src/exim.h
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -493,6 +493,7 @@ config.h, mytypes.h, and store.h, so we don't need to mention them explicitly.
 #include "dbstuff.h"
 #include "structs.h"
 #include "globals.h"
+#include "hash.h"
 #include "functions.h"
 #include "dbfunctions.h"
 #include "osfunctions.h"
@@ -584,19 +585,9 @@ default to EDQUOT if it exists, otherwise ENOSPC. */
 # endif
 #endif
 
-/* Ensure PATH_MAX is defined */
-
-#ifndef PATH_MAX
-  #ifdef MAXPATHLEN
-  # define PATH_MAX MAXPATHLEN
-  #else
-  # define PATH_MAX 1024
-  #endif
-#endif
-
 /* DANE w/o DNSSEC is useless */
 #if defined(EXPERIMENTAL_DANE) && defined(DISABLE_DNSSEC)
-  #undef DISABLE_DNSSEC
+# undef DISABLE_DNSSEC
 #endif
 
 #endif
diff --git a/src/src/exim_dbmbuild.c b/src/src/exim_dbmbuild.c
index 7babc643e..85ae9012b 100644
--- a/src/src/exim_dbmbuild.c
+++ b/src/src/exim_dbmbuild.c
@@ -478,9 +478,11 @@ if (yield == 0 || yield == 1)
 else
   {
   printf("dbmbuild abandoned\n");
-  #if defined(USE_DB) || defined(USE_TDB) || defined(USE_GDBM)
+#if defined(USE_DB) || defined(USE_TDB) || defined(USE_GDBM)
+  /* We created it, so safe to delete despite the name coming from outside */
+  /* coverity[tainted_string] */
   Uunlink(temp_dbmname);
-  #else
+#else
   if (is_db)
     {
     sprintf(CS real_dbmname, "%s.db", temp_dbmname);
@@ -493,7 +495,7 @@ else
     sprintf(CS real_dbmname, "%s.pag", temp_dbmname);
     Uunlink(real_dbmname);
     }
-  #endif /* USE_DB || USE_TDB */
+#endif /* USE_DB || USE_TDB */
   }
 
 return yield;
diff --git a/src/src/exim_dbutil.c b/src/src/exim_dbutil.c
index 417a42db6..c710772ed 100644
--- a/src/src/exim_dbutil.c
+++ b/src/src/exim_dbutil.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -259,7 +259,7 @@ uschar buffer[256];
 ensures that Exim has exclusive use of the database before it even tries to
 open it. If there is a database, there should be a lock file in existence. */
 
-sprintf(CS buffer, "%s/db/%s.lockfile", spool_directory, name);
+sprintf(CS buffer, "%s/db/%.200s.lockfile", spool_directory, name);
 
 dbblock->lockfd = Uopen(buffer, flags, 0);
 if (dbblock->lockfd < 0)
@@ -285,8 +285,9 @@ if (sigalrm_seen) errno = ETIMEDOUT;
 if (rc < 0)
   {
   printf("** Failed to get %s lock for %s: %s",
-    ((flags & O_RDONLY) != 0)? "read" : "write", buffer,
-    (errno == ETIMEDOUT)? "timed out" : strerror(errno));
+    flags & O_WRONLY ? "write" : "read",
+    buffer,
+    errno == ETIMEDOUT ? "timed out" : strerror(errno));
   (void)close(dbblock->lockfd);
   return NULL;
   }
@@ -801,13 +802,13 @@ for(;;)
         if (record == NULL) printf("not found\n"); else
           {
           time_t tt;
-          int length = 0;     /* Stops compiler warning */
+          /*int length = 0;      Stops compiler warning */
 
           switch(dbdata_type)
             {
             case type_retry:
             retry = (dbdata_retry *)record;
-            length = sizeof(dbdata_retry) + Ustrlen(retry->text);
+            /* length = sizeof(dbdata_retry) + Ustrlen(retry->text); */
 
             switch(fieldno)
               {
@@ -857,7 +858,7 @@ for(;;)
 
             case type_callout:
             callout = (dbdata_callout_cache *)record;
-            length = sizeof(dbdata_callout_cache);
+            /* length = sizeof(dbdata_callout_cache); */
             switch(fieldno)
               {
               case 0:
diff --git a/src/src/exim_lock.c b/src/src/exim_lock.c
index 37d974477..068216816 100644
--- a/src/src/exim_lock.c
+++ b/src/src/exim_lock.c
@@ -9,6 +9,8 @@ Options:  -fcntl    use fcntl() lock
 Default is -fcntl -lockfile.
 
 Argument: the name of the lock file
+
+Copyright (c) The Exim Maintainers 2016
 */
 
 #include "os.h"
@@ -36,7 +38,7 @@ in sys/file.h. */
 #endif
 
 
-typedef int BOOL;
+typedef unsigned BOOL;
 #define FALSE 0
 #define TRUE  1
 
@@ -216,7 +218,7 @@ for (i = 1; i < argc; i++)
   else usage();
   }
 
-if (quiet) verbose = 0;
+if (quiet) verbose = FALSE;
 
 /* Can't use flock() if the OS doesn't provide it */
 
@@ -322,7 +324,7 @@ for (j = 0; j < lock_retries; j++)
 
   if (use_lockfile)
     {
-    int rc;
+    int rc, rc2;
     if (verbose) printf("exim_lock: creating lock file\n");
     hd = open(hitchname, O_WRONLY | O_CREAT | O_EXCL, 0440);
     if (hd < 0)
@@ -334,11 +336,12 @@ for (j = 0; j < lock_retries; j++)
 
     /* Apply hitching post algorithm. */
 
-    if ((rc = link(hitchname, lockname)) != 0) fstat(hd, &statbuf);
+    if ((rc = link(hitchname, lockname)) != 0)
+     rc2 = fstat(hd, &statbuf);
     (void)close(hd);
     unlink(hitchname);
 
-    if (rc != 0 && statbuf.st_nlink != 2)
+    if (rc != 0 && (rc2 != 0 || statbuf.st_nlink != 2))
       {
       printf("exim_lock: failed to link hitching post to lock file\n");
       hd = -1;
@@ -354,8 +357,7 @@ for (j = 0; j < lock_retries; j++)
 
   /* Open the file for writing. */
 
-  fd = open(filename, O_RDWR + O_APPEND);
-  if (fd < 0)
+  if ((fd = open(filename, O_RDWR + O_APPEND)) < 0)
     {
     printf("exim_lock: failed to open %s for writing: %s\n", filename,
       strerror(errno));
@@ -374,7 +376,6 @@ for (j = 0; j < lock_retries; j++)
   a timeout changes it to blocking. */
 
   if (!use_mbx && (use_fcntl || use_flock))
-    {
     if (apply_lock(fd, F_WRLCK, use_fcntl, lock_fcntl_timeout, use_flock,
         lock_flock_timeout) >= 0)
       {
@@ -385,8 +386,8 @@ for (j = 0; j < lock_retries; j++)
         }
       break;
       }
-    else goto RETRY;   /* Message already output */
-    }
+    else
+      goto RETRY;   /* Message already output */
 
   /* Lock using MBX rules. This is complicated and is documented with the
   source of the c-client library that goes with Pine and IMAP. What has to
@@ -583,12 +584,37 @@ else
 if (restore_times)
   {
   struct stat strestore;
+#ifdef EXIM_HAVE_OPENAT
+  int fd = open(filename, O_RDWR); /* use fd for both get & restore */
+  struct timespec tt[2];
+
+  if (fd < 0)
+    {
+    printf("open '%s': %s\n", filename, strerror(errno));
+    yield = 1;
+    goto CLEAN_UP;
+    }
+  if (fstat(fd, &strestore) != 0)
+    {
+    printf("fstat '%s': %s\n", filename, strerror(errno));
+    yield = 1;
+    close(fd);
+    goto CLEAN_UP;
+    }
+  i = system(command);
+  tt[0] = strestore.st_atim;
+  tt[1] = strestore.st_mtim;
+  (void) futimens(fd, tt);
+  (void) close(fd);
+#else
   struct utimbuf ut;
+
   stat(filename, &strestore);
   i = system(command);
   ut.actime = strestore.st_atime;
   ut.modtime = strestore.st_mtime;
   utime(filename, &ut);
+#endif
   }
 else i = system(command);
 
diff --git a/src/src/eximstats.src b/src/src/eximstats.src
index 4370b4eab..e6485fffc 100644
--- a/src/src/eximstats.src
+++ b/src/src/eximstats.src
@@ -1,6 +1,6 @@
 #!PERL_COMMAND -w
 
-# Copyright (c) 2001-2014 University of Cambridge.
+# Copyright (c) 2001-2016 University of Cambridge.
 # See the file NOTICE for conditions of use and distribution.
 
 # Perl script to generate statistics from one or more Exim log files.
@@ -757,7 +757,7 @@ sub volume_rounded {
   }
   else {
     # We don't want any rounding to be done.
-    # and we don't need broken formated output which on one hand avoids numbers from
+    # and we don't need broken formatted output which on one hand avoids numbers from
     # being interpreted as string by Spreadsheed Calculators, on the other hand
     # breaks if more than 4 digits! -> flexible length instead of fixed length
     # Format the return value at the output routine! -fh
@@ -871,10 +871,10 @@ $p;
 # Eg 3h20m5s => 12005
 #######################################################################
 sub unformat_time {
-  my($formated_time) = pop @_;
+  my($formatted_time) = pop @_;
   my $time = 0;
 
-  while ($formated_time =~ s/^(\d+)([wdhms]?)//) {
+  while ($formatted_time =~ s/^(\d+)([wdhms]?)//) {
     $time +=  $1 if ($2 eq '' || $2 eq 's');
     $time +=  $1 * 60 if ($2 eq 'm');
     $time +=  $1 * 60 * 60 if ($2 eq 'h');
@@ -3360,8 +3360,8 @@ sub parse_old_eximstat_reports {
         my $previous_seconds_on_queue = 0;
         if (/^\s*(Under|Over|)\s+(\d+[smhdw])\s+(\d+)/) {
           print STDERR "Parsing $_" if $debug;
-          my($modifier,$formated_time,$count) = ($1,$2,$3);
-          my $seconds = unformat_time($formated_time);
+          my($modifier,$formatted_time,$count) = ($1,$2,$3);
+          my $seconds = unformat_time($formatted_time);
           my $time_on_queue = ($seconds + $previous_seconds_on_queue) / 2;
           $previous_seconds_on_queue = $seconds;
           $time_on_queue = $seconds * 2 if ($modifier eq 'Over');
diff --git a/src/src/exipick.src b/src/src/exipick.src
index 4708ebb4a..bdeba95fc 100644
--- a/src/src/exipick.src
+++ b/src/src/exipick.src
@@ -1,7 +1,9 @@
 #!PERL_COMMAND
 
-# This variable should be set by the building process to Exim's spool directory.
-my $spool = 'SPOOL_DIRECTORY';
+# This variables should be set by the building process
+my $spool = 'SPOOL_DIRECTORY';	# may be overridden later
+my $exim  = 'BIN_DIRECTORY/exim';
+
 # Need to set this dynamically during build, but it's not used right now anyway.
 my $charset = 'ISO-8859-1';
 
@@ -111,7 +113,9 @@ $G::and             = $G::and;             # shut up -w
 $G::msg_ids         = {};                  # short circuit when crit is only MID
 $G::caseless        = $G::caseful ? 0 : 1; # nocase by default, case if both
 @G::recipients_crit = ();                  # holds per-recip criteria
-$spool              = $G::spool if ($G::spool);
+$spool              = defined $G::spool ? $G::spool
+		      : do { chomp($_ = `$exim -n -bP spool_directory`);
+		        $_ // $spool };
 my $input_dir       = $G::input_dir || ($G::finput ? "Finput" : "input");
 my $count_only      = 1 if ($G::mailq_bpc  || $G::qgrep_c);
 my $unsorted        = 1 if ($G::mailq_bpr  || $G::mailq_bpra ||
@@ -1427,7 +1431,8 @@ Same as '$shown_message_size eq <string>' (exiqgrep)
 
 =item --spool <path>
 
-Set the path to the exim spool to use.  This value will have the argument to --input or 'input' appended, or be ignored if --input is a full path.
+Set the path to the exim spool to use.  This value will have the argument to --input or 'input' appended, or be ignored if --input is a full path. If not specified, exipick uses the value from C<exim -bP spool_directory>, and if this fails, the  F<SPOOL_DIRECTORY>
+from build time (F<Local/Makefile>) is used.
 
 =item --show-rules
 
diff --git a/src/src/expand.c b/src/src/expand.c
index 624c3c4db..cfde23610 100644
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -207,6 +207,7 @@ static uschar *op_table_main[] = {
   US"base64d",
   US"domain",
   US"escape",
+  US"escape8bit",
   US"eval",
   US"eval10",
   US"expand",
@@ -233,6 +234,7 @@ static uschar *op_table_main[] = {
   US"s",
   US"sha1",
   US"sha256",
+  US"sha3",
   US"stat",
   US"str2b64",
   US"strlen",
@@ -251,6 +253,7 @@ enum {
   EOP_BASE64D,
   EOP_DOMAIN,
   EOP_ESCAPE,
+  EOP_ESCAPE8BIT,
   EOP_EVAL,
   EOP_EVAL10,
   EOP_EXPAND,
@@ -277,6 +280,7 @@ enum {
   EOP_S,
   EOP_SHA1,
   EOP_SHA256,
+  EOP_SHA3,
   EOP_STAT,
   EOP_STR2B64,
   EOP_STRLEN,
@@ -484,10 +488,6 @@ static var_entry var_table[] = {
   { "dcc_header",          vtype_stringptr,   &dcc_header },
   { "dcc_result",          vtype_stringptr,   &dcc_result },
 #endif
-#ifdef WITH_OLD_DEMIME
-  { "demime_errorlevel",   vtype_int,         &demime_errorlevel },
-  { "demime_reason",       vtype_stringptr,   &demime_reason },
-#endif
 #ifndef DISABLE_DKIM
   { "dkim_algo",           vtype_dkim,        (void *)DKIM_ALGO },
   { "dkim_bodylength",     vtype_dkim,        (void *)DKIM_BODYLENGTH },
@@ -536,9 +536,6 @@ static var_entry var_table[] = {
   { "exim_path",           vtype_stringptr,   &exim_path },
   { "exim_uid",            vtype_uid,         &exim_uid },
   { "exim_version",        vtype_stringptr,   &version_string },
-#ifdef WITH_OLD_DEMIME
-  { "found_extension",     vtype_stringptr,   &found_extension },
-#endif
   { "headers_added",       vtype_string_func, &fn_hdrs_added },
   { "home",                vtype_stringptr,   &deliver_home },
   { "host",                vtype_stringptr,   &deliver_host },
@@ -547,6 +544,7 @@ static var_entry var_table[] = {
   { "host_lookup_deferred",vtype_int,         &host_lookup_deferred },
   { "host_lookup_failed",  vtype_int,         &host_lookup_failed },
   { "host_port",           vtype_int,         &deliver_host_port },
+  { "initial_cwd",         vtype_stringptr,   &initial_cwd },
   { "inode",               vtype_ino,         &deliver_inode },
   { "interface_address",   vtype_stringptr,   &interface_address },
   { "interface_port",      vtype_int,         &interface_port },
@@ -635,6 +633,7 @@ static var_entry var_table[] = {
   { "prvscheck_result",    vtype_stringptr,   &prvscheck_result },
   { "qualify_domain",      vtype_stringptr,   &qualify_domain_sender },
   { "qualify_recipient",   vtype_stringptr,   &qualify_domain_recipient },
+  { "queue_name",          vtype_stringptr,   &queue_name },
   { "rcpt_count",          vtype_int,         &rcpt_count },
   { "rcpt_defer_count",    vtype_int,         &rcpt_defer_count },
   { "rcpt_fail_count",     vtype_int,         &rcpt_fail_count },
@@ -1080,6 +1079,8 @@ return s;
 
 Returns:  a pointer to the character after the last digit
 */
+/*XXX consider expanding to int_eximarith_t.  But the test for
+"overbig numbers" in 0002 still needs to overflow it. */
 
 static uschar *
 read_number(int *n, uschar *s)
@@ -1680,9 +1681,8 @@ if (!enable_dollar_recipients) return NULL; else
   uschar * s = store_get(size);
   for (i = 0; i < recipients_count; i++)
     {
-    if (i != 0) s = string_cat(s, &size, &ptr, US", ", 2);
-    s = string_cat(s, &size, &ptr, recipients_list[i].address,
-      Ustrlen(recipients_list[i].address));
+    if (i != 0) s = string_catn(s, &size, &ptr, US", ", 2);
+    s = string_cat(s, &size, &ptr, recipients_list[i].address);
     }
   s[ptr] = 0;     /* string_cat() leaves room */
   return s;
@@ -1856,7 +1856,9 @@ switch (vp->type)
 	    start_offset = SPOOL_DATA_START_OFFSET;
 	  }
 	}
-      lseek(deliver_datafile, start_offset, SEEK_SET);
+      if (lseek(deliver_datafile, start_offset, SEEK_SET) < 0)
+	log_write(0, LOG_MAIN|LOG_PANIC_DIE, "deliver_datafile lseek: %s",
+	  strerror(errno));
       len = read(deliver_datafile, body, len);
       if (len > 0)
 	{
@@ -2001,12 +2003,17 @@ for (i = 0; i < n; i++)
   {
   if (*s != '{')
     {
-    if (i < m) return 1;
+    if (i < m)
+      {
+      expand_string_message = string_sprintf("Not enough arguments for '%s' "
+	"(min is %d)", name, m);
+      return 1;
+      }
     sub[i] = NULL;
     break;
     }
-  sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, resetok);
-  if (sub[i] == NULL) return 3;
+  if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, resetok)))
+    return 3;
   if (*s++ != '}') return 1;
   while (isspace(*s)) s++;
   }
@@ -2014,10 +2021,11 @@ if (check_end && *s++ != '}')
   {
   if (s[-1] == '{')
     {
-    expand_string_message = string_sprintf("Too many arguments for \"%s\" "
+    expand_string_message = string_sprintf("Too many arguments for '%s' "
       "(max is %d)", name, n);
     return 2;
     }
+  expand_string_message = string_sprintf("missing '}' after '%s'", name);
   return 1;
   }
 
@@ -2060,7 +2068,7 @@ Load args from sub array to globals, and call acl_check().
 Sub array will be corrupted on return.
 
 Returns:       OK         access is granted by an ACCEPT verb
-               DISCARD    access is granted by a DISCARD verb
+               DISCARD    access is (apparently) granted by a DISCARD verb
 	       FAIL       access is denied
 	       FAIL_DROP  access is denied; drop the connection
 	       DEFER      can't tell at the moment
@@ -2375,7 +2383,7 @@ switch(cond_type)
       case 3: return NULL;
       }
 
-    *resetok = FALSE;
+    *resetok = FALSE;	/* eval_acl() might allocate; do not reclaim */
     if (yield != NULL) switch(eval_acl(sub, nelem(sub), &user_msg))
 	{
 	case OK:
@@ -2384,7 +2392,7 @@ switch(cond_type)
           lookup_value = NULL;
 	  if (user_msg)
 	    {
-            lookup_value = string_cat(NULL, &size, &ptr, user_msg, Ustrlen(user_msg));
+            lookup_value = string_cat(NULL, &size, &ptr, user_msg);
             lookup_value[ptr] = '\0';
 	    }
 	  *yield = cond == testfor;
@@ -2392,6 +2400,7 @@ switch(cond_type)
 
 	case DEFER:
           expand_string_forcedfail = TRUE;
+	  /*FALLTHROUGH*/
 	default:
           expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
 	  return NULL;
@@ -2509,7 +2518,6 @@ switch(cond_type)
     checking for them individually. */
 
     if (!isalpha(name[0]) && yield != NULL)
-      {
       if (sub[i][0] == 0)
         {
         num[i] = 0;
@@ -2521,7 +2529,6 @@ switch(cond_type)
         num[i] = expanded_string_integer(sub[i], FALSE);
         if (expand_string_message != NULL) return NULL;
         }
-      }
     }
 
   /* Result not required */
@@ -2689,7 +2696,7 @@ switch(cond_type)
       uschar digest[16];
 
       md5_start(&base);
-      md5_end(&base, (uschar *)sub[0], Ustrlen(sub[0]), digest);
+      md5_end(&base, sub[0], Ustrlen(sub[0]), digest);
 
       /* If the length that we are comparing against is 24, the MD5 digest
       is expressed as a base64 string. This is the way LDAP does it. However,
@@ -2698,7 +2705,7 @@ switch(cond_type)
 
       if (sublen == 24)
         {
-        uschar *coded = b64encode((uschar *)digest, 16);
+        uschar *coded = b64encode(digest, 16);
         DEBUG(D_auth) debug_printf("crypteq: using MD5+B64 hashing\n"
           "  subject=%s\n  crypted=%s\n", coded, sub[1]+5);
         tempcond = (Ustrcmp(coded, sub[1]+5) == 0);
@@ -2724,11 +2731,11 @@ switch(cond_type)
     else if (strncmpic(sub[1], US"{sha1}", 6) == 0)
       {
       int sublen = Ustrlen(sub[1]+6);
-      sha1 base;
+      hctx h;
       uschar digest[20];
 
-      sha1_start(&base);
-      sha1_end(&base, (uschar *)sub[0], Ustrlen(sub[0]), digest);
+      sha1_start(&h);
+      sha1_end(&h, sub[0], Ustrlen(sub[0]), digest);
 
       /* If the length that we are comparing against is 28, assume the SHA1
       digest is expressed as a base64 string. If the length is 40, assume a
@@ -2736,7 +2743,7 @@ switch(cond_type)
 
       if (sublen == 28)
         {
-        uschar *coded = b64encode((uschar *)digest, 20);
+        uschar *coded = b64encode(digest, 20);
         DEBUG(D_auth) debug_printf("crypteq: using SHA1+B64 hashing\n"
           "  subject=%s\n  crypted=%s\n", coded, sub[1]+6);
         tempcond = (Ustrcmp(coded, sub[1]+6) == 0);
@@ -3043,6 +3050,8 @@ switch(cond_type)
        "value \"%s\"", t);
       return NULL;
       }
+    DEBUG(D_expand) debug_printf("%s: condition evaluated to %s\n", ourname,
+        boolvalue? "true":"false");
     if (yield != NULL) *yield = (boolvalue == testfor);
     return s;
     }
@@ -3174,6 +3183,7 @@ process_yesno(BOOL skipping, BOOL yes, uschar *save_lookup, const uschar **sptr,
 int rc = 0;
 const uschar *s = *sptr;    /* Local value */
 uschar *sub1, *sub2;
+const uschar * errwhere;
 
 /* If there are no following strings, we substitute the contents of $value for
 lookups and for extractions in the success case. For the ${if item, the string
@@ -3183,24 +3193,28 @@ items. */
 while (isspace(*s)) s++;
 if (*s == '}')
   {
-  if (type[0] == 'i')
-    {
-    if (yes) *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, US"true", 4);
-    }
-  else
-    {
-    if (yes && lookup_value)
-      *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, lookup_value,
-        Ustrlen(lookup_value));
-    lookup_value = save_lookup;
-    }
+  if (!skipping)
+    if (type[0] == 'i')
+      {
+      if (yes) *yieldptr = string_catn(*yieldptr, sizeptr, ptrptr, US"true", 4);
+      }
+    else
+      {
+      if (yes && lookup_value)
+	*yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, lookup_value);
+      lookup_value = save_lookup;
+      }
   s++;
   goto RETURN;
   }
 
 /* The first following string must be braced. */
 
-if (*s++ != '{') goto FAILED_CURLY;
+if (*s++ != '{')
+  {
+  errwhere = US"'yes' part did not start with '{'";
+  goto FAILED_CURLY;
+  }
 
 /* Expand the first substring. Forced failures are noticed only if we actually
 want this string. Set skipping in the call in the fail case (this will always
@@ -3209,12 +3223,16 @@ be the case if we were already skipping). */
 sub1 = expand_string_internal(s, TRUE, &s, !yes, TRUE, resetok);
 if (sub1 == NULL && (yes || !expand_string_forcedfail)) goto FAILED;
 expand_string_forcedfail = FALSE;
-if (*s++ != '}') goto FAILED_CURLY;
+if (*s++ != '}')
+  {
+  errwhere = US"'yes' part did not end with '}'";
+  goto FAILED_CURLY;
+  }
 
 /* If we want the first string, add it to the output */
 
 if (yes)
-  *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, sub1, Ustrlen(sub1));
+  *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, sub1);
 
 /* If this is called from a lookup/env or a (cert)extract, we want to restore
 $value to what it was at the start of the item, so that it has this value
@@ -3235,12 +3253,16 @@ if (*s == '{')
   sub2 = expand_string_internal(s+1, TRUE, &s, yes || skipping, TRUE, resetok);
   if (sub2 == NULL && (!yes || !expand_string_forcedfail)) goto FAILED;
   expand_string_forcedfail = FALSE;
-  if (*s++ != '}') goto FAILED_CURLY;
+  if (*s++ != '}')
+    {
+    errwhere = US"'no' part did not start with '{'";
+    goto FAILED_CURLY;
+    }
 
   /* If we want the second string, add it to the output */
 
   if (!yes)
-    *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, sub2, Ustrlen(sub2));
+    *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, sub2);
   }
 
 /* If there is no second string, but the word "fail" is present when the use of
@@ -3258,7 +3280,11 @@ else if (*s != '}')
     if (!yes && !skipping)
       {
       while (isspace(*s)) s++;
-      if (*s++ != '}') goto FAILED_CURLY;
+      if (*s++ != '}')
+        {
+	errwhere = US"did not close with '}' after forcedfail";
+	goto FAILED_CURLY;
+	}
       expand_string_message =
         string_sprintf("\"%s\" failed and \"fail\" requested", type);
       expand_string_forcedfail = TRUE;
@@ -3276,23 +3302,30 @@ else if (*s != '}')
 /* All we have to do now is to check on the final closing brace. */
 
 while (isspace(*s)) s++;
-if (*s++ == '}') goto RETURN;
-
-/* Get here if there is a bracketing failure */
-
-FAILED_CURLY:
-rc++;
-
-/* Get here for other failures */
-
-FAILED:
-rc++;
+if (*s++ != '}')
+  {
+  errwhere = US"did not close with '}'";
+  goto FAILED_CURLY;
+  }
 
-/* Update the input pointer value before returning */
 
 RETURN:
+/* Update the input pointer value before returning */
 *sptr = s;
 return rc;
+
+FAILED_CURLY:
+  /* Get here if there is a bracketing failure */
+  expand_string_message = string_sprintf(
+    "curly-bracket problem in conditional yes/no parsing: %s\n"
+    " remaining string is '%s'", errwhere, --s);
+  rc = 2;
+  goto RETURN;
+
+FAILED:
+  /* Get here for other failures */
+  rc = 1;
+  goto RETURN;
 }
 
 
@@ -3318,7 +3351,7 @@ chash_start(int type, void *base)
 if (type == HMAC_MD5)
   md5_start((md5 *)base);
 else
-  sha1_start((sha1 *)base);
+  sha1_start((hctx *)base);
 }
 
 static void
@@ -3327,7 +3360,7 @@ chash_mid(int type, void *base, uschar *string)
 if (type == HMAC_MD5)
   md5_mid((md5 *)base, string);
 else
-  sha1_mid((sha1 *)base, string);
+  sha1_mid((hctx *)base, string);
 }
 
 static void
@@ -3336,7 +3369,7 @@ chash_end(int type, void *base, uschar *string, int length, uschar *digest)
 if (type == HMAC_MD5)
   md5_end((md5 *)base, string, length, digest);
 else
-  sha1_end((sha1 *)base, string, length, digest);
+  sha1_end((hctx *)base, string, length, digest);
 }
 
 
@@ -3395,8 +3428,7 @@ prvs_hmac_sha1(uschar *address, uschar *key, uschar *key_num, uschar *daystamp)
 {
 uschar *hash_source, *p;
 int size = 0,offset = 0,i;
-sha1 sha1_base;
-void *use_base = &sha1_base;
+hctx h;
 uschar innerhash[20];
 uschar finalhash[20];
 uschar innerkey[64];
@@ -3409,9 +3441,9 @@ if (key_num == NULL)
 if (Ustrlen(key) > 64)
   return NULL;
 
-hash_source = string_cat(NULL,&size,&offset,key_num,1);
-string_cat(hash_source,&size,&offset,daystamp,3);
-string_cat(hash_source,&size,&offset,address,Ustrlen(address));
+hash_source = string_catn(NULL, &size, &offset, key_num, 1);
+hash_source = string_catn(hash_source, &size, &offset, daystamp, 3);
+hash_source = string_cat(hash_source, &size, &offset, address);
 hash_source[offset] = '\0';
 
 DEBUG(D_expand) debug_printf("prvs: hash source is '%s'\n", hash_source);
@@ -3425,13 +3457,13 @@ for (i = 0; i < Ustrlen(key); i++)
   outerkey[i] ^= key[i];
   }
 
-chash_start(HMAC_SHA1, use_base);
-chash_mid(HMAC_SHA1, use_base, innerkey);
-chash_end(HMAC_SHA1, use_base, hash_source, offset, innerhash);
+chash_start(HMAC_SHA1, &h);
+chash_mid(HMAC_SHA1, &h, innerkey);
+chash_end(HMAC_SHA1, &h, hash_source, offset, innerhash);
 
-chash_start(HMAC_SHA1, use_base);
-chash_mid(HMAC_SHA1, use_base, outerkey);
-chash_end(HMAC_SHA1, use_base, innerhash, 20, finalhash);
+chash_start(HMAC_SHA1, &h);
+chash_mid(HMAC_SHA1, &h, outerkey);
+chash_end(HMAC_SHA1, &h, innerhash, 20, finalhash);
 
 p = finalhash_hex;
 for (i = 0; i < 3; i++)
@@ -3468,16 +3500,15 @@ Returns:       new value of string pointer
 static uschar *
 cat_file(FILE *f, uschar *yield, int *sizep, int *ptrp, uschar *eol)
 {
-int eollen = eol ? Ustrlen(eol) : 0;
 uschar buffer[1024];
 
 while (Ufgets(buffer, sizeof(buffer), f))
   {
   int len = Ustrlen(buffer);
   if (eol && buffer[len-1] == '\n') len--;
-  yield = string_cat(yield, sizep, ptrp, buffer, len);
-  if (buffer[len] != 0)
-    yield = string_cat(yield, sizep, ptrp, eol, eollen);
+  yield = string_catn(yield, sizep, ptrp, buffer, len);
+  if (eol && buffer[len])
+    yield = string_cat(yield, sizep, ptrp, eol);
   }
 
 if (yield) yield[*ptrp] = 0;
@@ -3654,13 +3685,20 @@ eval_op_sum(uschar **sptr, BOOL decimal, uschar **error)
 {
 uschar *s = *sptr;
 int_eximarith_t x = eval_op_mult(&s, decimal, error);
-if (*error == NULL)
+if (!*error)
   {
   while (*s == '+' || *s == '-')
     {
     int op = *s++;
     int_eximarith_t y = eval_op_mult(&s, decimal, error);
-    if (*error != NULL) break;
+    if (*error) break;
+    if (  (x >=   EXIM_ARITH_MAX/2  && x >=   EXIM_ARITH_MAX/2)
+       || (x <= -(EXIM_ARITH_MAX/2) && y <= -(EXIM_ARITH_MAX/2)))
+      {			/* over-conservative check */
+      *error = op == '+'
+	? US"overflow in sum" : US"overflow in difference";
+      break;
+      }
     if (op == '+') x += y; else x -= y;
     }
   }
@@ -3824,13 +3862,16 @@ expand_string_internal(const uschar *string, BOOL ket_ends, const uschar **left,
 {
 int ptr = 0;
 int size = Ustrlen(string)+ 64;
-int item_type;
 uschar *yield = store_get(size);
+int item_type;
 const uschar *s = string;
 uschar *save_expand_nstring[EXPAND_MAXN+1];
 int save_expand_nlength[EXPAND_MAXN+1];
 BOOL resetok = TRUE;
 
+DEBUG(D_expand)
+  debug_printf("%s: %s\n", skipping ? "   scanning" : "considering", string);
+
 expand_string_forcedfail = FALSE;
 expand_string_message = US"";
 
@@ -3856,7 +3897,7 @@ while (*s != 0)
       {
       const uschar * t = s + 2;
       for (s = t; *s != 0; s++) if (*s == '\\' && s[1] == 'N') break;
-      yield = string_cat(yield, &size, &ptr, t, s - t);
+      yield = string_catn(yield, &size, &ptr, t, s - t);
       if (*s != 0) s += 2;
       }
 
@@ -3865,7 +3906,7 @@ while (*s != 0)
       uschar ch[1];
       ch[0] = string_interpret_escape(&s);
       s++;
-      yield = string_cat(yield, &size, &ptr, ch, 1);
+      yield = string_catn(yield, &size, &ptr, ch, 1);
       }
 
     continue;
@@ -3880,7 +3921,7 @@ while (*s != 0)
 
   if (*s != '$' || !honour_dollar)
     {
-    yield = string_cat(yield, &size, &ptr, s++, 1);
+    yield = string_catn(yield, &size, &ptr, s++, 1);
     continue;
     }
 
@@ -3958,7 +3999,7 @@ while (*s != 0)
       size = newsize;
       ptr = len;
       }
-    else yield = string_cat(yield, &size, &ptr, value, len);
+    else yield = string_catn(yield, &size, &ptr, value, len);
 
     continue;
     }
@@ -3968,7 +4009,7 @@ while (*s != 0)
     int n;
     s = read_cnumber(&n, s);
     if (n >= 0 && n <= expand_nmax)
-      yield = string_cat(yield, &size, &ptr, expand_nstring[n],
+      yield = string_catn(yield, &size, &ptr, expand_nstring[n],
         expand_nlength[n]);
     continue;
     }
@@ -3994,7 +4035,7 @@ while (*s != 0)
       goto EXPAND_FAILED;
       }
     if (n >= 0 && n <= expand_nmax)
-      yield = string_cat(yield, &size, &ptr, expand_nstring[n],
+      yield = string_catn(yield, &size, &ptr, expand_nstring[n],
         expand_nlength[n]);
     continue;
     }
@@ -4046,11 +4087,12 @@ while (*s != 0)
 	  DEBUG(D_expand)
 	    debug_printf("acl expansion yield: %s\n", user_msg);
 	  if (user_msg)
-            yield = string_cat(yield, &size, &ptr, user_msg, Ustrlen(user_msg));
+            yield = string_cat(yield, &size, &ptr, user_msg);
 	  continue;
 
 	case DEFER:
           expand_string_forcedfail = TRUE;
+	  /*FALLTHROUGH*/
 	default:
           expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
 	  goto EXPAND_FAILED;
@@ -4070,12 +4112,13 @@ while (*s != 0)
         save_expand_strings(save_expand_nstring, save_expand_nlength);
 
       while (isspace(*s)) s++;
-      next_s = eval_condition(s, &resetok, skipping? NULL : &cond);
+      next_s = eval_condition(s, &resetok, skipping ? NULL : &cond);
       if (next_s == NULL) goto EXPAND_FAILED;  /* message already set */
 
       DEBUG(D_expand)
-        debug_printf("condition: %.*s\n   result: %s\n", (int)(next_s - s), s,
-          cond? "true" : "false");
+        debug_printf("  condition: %.*s\n     result: %s\n",
+	  (int)(next_s - s), s,
+          cond ? "true" : "false");
 
       s = next_s;
 
@@ -4133,11 +4176,13 @@ while (*s != 0)
 	goto EXPAND_FAILED;
 	}
 
-      if (!(encoded = imap_utf7_encode(sub_arg[0], headers_charset,
-			  sub_arg[1][0], sub_arg[2], &expand_string_message)))
-	goto EXPAND_FAILED;
       if (!skipping)
-	yield = string_cat(yield, &size, &ptr, encoded, Ustrlen(encoded));
+	{
+	if (!(encoded = imap_utf7_encode(sub_arg[0], headers_charset,
+			    sub_arg[1][0], sub_arg[2], &expand_string_message)))
+	  goto EXPAND_FAILED;
+	yield = string_cat(yield, &size, &ptr, encoded);
+	}
       continue;
       }
 #endif
@@ -4173,8 +4218,12 @@ while (*s != 0)
       if (*s == '{')					/*}*/
         {
         key = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
-        if (key == NULL) goto EXPAND_FAILED;		/*{*/
-        if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+        if (!key) goto EXPAND_FAILED;			/*{{*/
+        if (*s++ != '}')
+	  {
+	  expand_string_message = US"missing '}' after lookup key";
+	  goto EXPAND_FAILED_CURLY;
+	  }
         while (isspace(*s)) s++;
         }
       else key = NULL;
@@ -4237,10 +4286,18 @@ while (*s != 0)
       queries that also require a file name (e.g. sqlite), the file name comes
       first. */
 
-      if (*s != '{') goto EXPAND_FAILED_CURLY;
+      if (*s != '{')
+        {
+	expand_string_message = US"missing '{' for lookup file-or-query arg";
+	goto EXPAND_FAILED_CURLY;
+	}
       filename = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
       if (filename == NULL) goto EXPAND_FAILED;
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '}')
+        {
+	expand_string_message = US"missing '}' closing lookup file-or-query arg";
+	goto EXPAND_FAILED_CURLY;
+	}
       while (isspace(*s)) s++;
 
       /* If this isn't a single-key+file lookup, re-arrange the variables
@@ -4248,15 +4305,13 @@ while (*s != 0)
       there is just a "key", and no file name. For the special query-style +
       file types, the query (i.e. "key") starts with a file name. */
 
-      if (key == NULL)
+      if (!key)
         {
         while (isspace(*filename)) filename++;
         key = filename;
 
         if (mac_islookup(stype, lookup_querystyle))
-          {
           filename = NULL;
-          }
         else
           {
           if (*filename != '/')
@@ -4466,14 +4521,14 @@ while (*s != 0)
       /* Now separate the domain from the local part */
       *domain++ = '\0';
 
-      yield = string_cat(yield,&size,&ptr,US"prvs=",5);
-      string_cat(yield,&size,&ptr,(sub_arg[2] != NULL) ? sub_arg[2] : US"0", 1);
-      string_cat(yield,&size,&ptr,prvs_daystamp(7),3);
-      string_cat(yield,&size,&ptr,p,6);
-      string_cat(yield,&size,&ptr,US"=",1);
-      string_cat(yield,&size,&ptr,sub_arg[0],Ustrlen(sub_arg[0]));
-      string_cat(yield,&size,&ptr,US"@",1);
-      string_cat(yield,&size,&ptr,domain,Ustrlen(domain));
+      yield = string_catn(yield, &size, &ptr, US"prvs=", 5);
+      yield = string_catn(yield, &size, &ptr, sub_arg[2] ? sub_arg[2] : US"0", 1);
+      yield = string_catn(yield, &size, &ptr, prvs_daystamp(7), 3);
+      yield = string_catn(yield, &size, &ptr, p, 6);
+      yield = string_catn(yield, &size, &ptr, US"=", 1);
+      yield = string_cat (yield, &size, &ptr, sub_arg[0]);
+      yield = string_catn(yield, &size, &ptr, US"@", 1);
+      yield = string_cat (yield, &size, &ptr, domain);
 
       continue;
       }
@@ -4527,9 +4582,9 @@ while (*s != 0)
         DEBUG(D_expand) debug_printf("prvscheck domain: %s\n", domain);
 
         /* Set up expansion variables */
-        prvscheck_address = string_cat(NULL, &mysize, &myptr, local_part, Ustrlen(local_part));
-        string_cat(prvscheck_address,&mysize,&myptr,US"@",1);
-        string_cat(prvscheck_address,&mysize,&myptr,domain,Ustrlen(domain));
+        prvscheck_address = string_cat (NULL, &mysize, &myptr, local_part);
+        prvscheck_address = string_catn(prvscheck_address, &mysize, &myptr, US"@", 1);
+        prvscheck_address = string_cat (prvscheck_address, &mysize, &myptr, domain);
         prvscheck_address[myptr] = '\0';
         prvscheck_keynum = string_copy(key_num);
 
@@ -4595,10 +4650,8 @@ while (*s != 0)
           case 3: goto EXPAND_FAILED;
           }
 
-        if (sub_arg[0] == NULL || *sub_arg[0] == '\0')
-          yield = string_cat(yield,&size,&ptr,prvscheck_address,Ustrlen(prvscheck_address));
-        else
-          yield = string_cat(yield,&size,&ptr,sub_arg[0],Ustrlen(sub_arg[0]));
+	yield = string_cat(yield, &size, &ptr,
+	  !sub_arg[0] || !*sub_arg[0] ? prvscheck_address : sub_arg[0]);
 
         /* Reset the "internal" variables afterwards, because they are in
         dynamic store that will be reclaimed if the expansion succeeded. */
@@ -4607,7 +4660,6 @@ while (*s != 0)
         prvscheck_keynum = NULL;
         }
       else
-        {
         /* Does not look like a prvs encoded address, return the empty string.
            We need to make sure all subs are expanded first, so as to skip over
            the entire item. */
@@ -4618,7 +4670,6 @@ while (*s != 0)
           case 2:
           case 3: goto EXPAND_FAILED;
           }
-        }
 
       continue;
       }
@@ -4845,10 +4896,20 @@ while (*s != 0)
         {
         if (expand_string_internal(s+1, TRUE, &s, TRUE, TRUE, &resetok) == NULL)
           goto EXPAND_FAILED;
-        if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+        if (*s++ != '}')
+	  {
+	  expand_string_message = US"missing '}' closing failstring for readsocket";
+	  goto EXPAND_FAILED_CURLY;
+	  }
         while (isspace(*s)) s++;
         }
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+
+    readsock_done:
+      if (*s++ != '}')
+        {
+	expand_string_message = US"missing '}' closing readsocket";
+	goto EXPAND_FAILED_CURLY;
+	}
       continue;
 
       /* Come here on failure to create socket, connect socket, write to the
@@ -4858,13 +4919,16 @@ while (*s != 0)
       SOCK_FAIL:
       if (*s != '{') goto EXPAND_FAILED;
       DEBUG(D_any) debug_printf("%s\n", expand_string_message);
-      arg = expand_string_internal(s+1, TRUE, &s, FALSE, TRUE, &resetok);
-      if (arg == NULL) goto EXPAND_FAILED;
-      yield = string_cat(yield, &size, &ptr, arg, Ustrlen(arg));
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (!(arg = expand_string_internal(s+1, TRUE, &s, FALSE, TRUE, &resetok)))
+        goto EXPAND_FAILED;
+      yield = string_cat(yield, &size, &ptr, arg);
+      if (*s++ != '}')
+        {
+	expand_string_message = US"missing '}' closing failstring for readsocket";
+	goto EXPAND_FAILED_CURLY;
+	}
       while (isspace(*s)) s++;
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
-      continue;
+      goto readsock_done;
       }
 
     /* Handle "run" to execute a program. */
@@ -4885,16 +4949,25 @@ while (*s != 0)
         }
 
       while (isspace(*s)) s++;
-      if (*s != '{') goto EXPAND_FAILED_CURLY;
+      if (*s != '{')
+        {
+	expand_string_message = US"missing '{' for command arg of run";
+	goto EXPAND_FAILED_CURLY;
+	}
       arg = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
       if (arg == NULL) goto EXPAND_FAILED;
       while (isspace(*s)) s++;
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '}')
+        {
+	expand_string_message = US"missing '}' closing command arg of run";
+	goto EXPAND_FAILED_CURLY;
+	}
 
       if (skipping)   /* Just pretend it worked when we're skipping */
-        {
+	{
         runrc = 0;
-        }
+	lookup_value = NULL;
+	}
       else
         {
         if (!transport_set_up_command(&argv,    /* anchor for arg list */
@@ -4936,9 +5009,9 @@ while (*s != 0)
         return code for serious disasters. Simple non-zero returns are passed on.
         */
 
-        if (sigalrm_seen == TRUE || (runrc = child_close(pid, 30)) < 0)
+        if (sigalrm_seen || (runrc = child_close(pid, 30)) < 0)
           {
-          if (sigalrm_seen == TRUE || runrc == -256)
+          if (sigalrm_seen || runrc == -256)
             {
             expand_string_message = string_sprintf("command timed out");
             killpg(pid, SIGKILL);       /* Kill the whole process group */
@@ -4991,7 +5064,7 @@ while (*s != 0)
         case 3: goto EXPAND_FAILED;
         }
 
-      yield = string_cat(yield, &size, &ptr, sub[0], Ustrlen(sub[0]));
+      yield = string_cat(yield, &size, &ptr, sub[0]);
       o2m = Ustrlen(sub[2]) - 1;
 
       if (o2m >= 0) for (; oldptr < ptr; oldptr++)
@@ -5068,7 +5141,7 @@ while (*s != 0)
           extract_substr(sub[2], val[0], val[1], &len);
 
       if (ret == NULL) goto EXPAND_FAILED;
-      yield = string_cat(yield, &size, &ptr, ret, len);
+      yield = string_catn(yield, &size, &ptr, ret, len);
       continue;
       }
 
@@ -5086,7 +5159,7 @@ while (*s != 0)
       {
       uschar *sub[3];
       md5 md5_base;
-      sha1 sha1_base;
+      hctx sha1_ctx;
       void *use_base;
       int type, i;
       int hashlen;      /* Number of octets for the hash algorithm's output */
@@ -5120,7 +5193,7 @@ while (*s != 0)
 	else if (Ustrcmp(sub[0], "sha1") == 0)
 	  {
 	  type = HMAC_SHA1;
-	  use_base = &sha1_base;
+	  use_base = &sha1_ctx;
 	  hashlen = 20;
 	  hashblocklen = 64;
 	  }
@@ -5175,16 +5248,14 @@ while (*s != 0)
 	  *p++ = hex_digits[finalhash[i] & 0x0f];
 	  }
 
-	DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%.*s)=%.*s\n",
-	  sub[0], (int)keylen, keyptr, Ustrlen(sub[2]), sub[2], hashlen*2,
-	  finalhash_hex);
+	DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%s)=%.*s\n",
+	  sub[0], (int)keylen, keyptr, sub[2], hashlen*2, finalhash_hex);
 
-	yield = string_cat(yield, &size, &ptr, finalhash_hex, hashlen*2);
+	yield = string_catn(yield, &size, &ptr, finalhash_hex, hashlen*2);
 	}
+      continue;
       }
 
-    continue;
-
     /* Handle global substitution for "sg" - like Perl's s/xxx/yyy/g operator.
     We have to save the numerical variables and restore them afterwards. */
 
@@ -5251,7 +5322,7 @@ while (*s != 0)
             emptyopt = 0;
             continue;
             }
-          yield = string_cat(yield, &size, &ptr, subject+moffset, slen-moffset);
+          yield = string_catn(yield, &size, &ptr, subject+moffset, slen-moffset);
           break;
           }
 
@@ -5268,11 +5339,11 @@ while (*s != 0)
 
         /* Copy the characters before the match, plus the expanded insertion. */
 
-        yield = string_cat(yield, &size, &ptr, subject + moffset,
+        yield = string_catn(yield, &size, &ptr, subject + moffset,
           ovector[0] - moffset);
         insert = expand_string(sub[2]);
         if (insert == NULL) goto EXPAND_FAILED;
-        yield = string_cat(yield, &size, &ptr, insert, Ustrlen(insert));
+        yield = string_cat(yield, &size, &ptr, insert);
 
         moffset = ovector[1];
         moffsetextra = 0;
@@ -5305,7 +5376,7 @@ while (*s != 0)
     case EITEM_EXTRACT:
       {
       int i;
-      int j = 2;
+      int j;
       int field_number = 1;
       BOOL field_number_set = FALSE;
       uschar *save_lookup_value = lookup_value;
@@ -5313,16 +5384,51 @@ while (*s != 0)
       int save_expand_nmax =
         save_expand_strings(save_expand_nstring, save_expand_nlength);
 
-      /* Read the arguments */
+      /* While skipping we cannot rely on the data for expansions being
+      available (eg. $item) hence cannot decide on numeric vs. keyed.
+      Read a maximum of 5 arguments (inclding the yes/no) */
 
-      for (i = 0; i < j; i++)
+      if (skipping)
+	{
+        while (isspace(*s)) s++;
+        for (j = 5; j > 0 && *s == '{'; j--)
+	  {
+          if (!expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok))
+	    goto EXPAND_FAILED;					/*{*/
+          if (*s++ != '}')
+	    {
+	    expand_string_message = US"missing '{' for arg of extract";
+	    goto EXPAND_FAILED_CURLY;
+	    }
+	  while (isspace(*s)) s++;
+	  }
+	if (  Ustrncmp(s, "fail", 4) == 0
+	   && (s[4] == '}' || s[4] == ' ' || s[4] == '\t' || !s[4])
+	   )
+	  {
+	  s += 4;
+	  while (isspace(*s)) s++;
+	  }
+	if (*s != '}')
+	  {
+	  expand_string_message = US"missing '}' closing extract";
+	  goto EXPAND_FAILED_CURLY;
+	  }
+	}
+
+      else for (i = 0, j = 2; i < j; i++) /* Read the proper number of arguments */
         {
         while (isspace(*s)) s++;
         if (*s == '{') 						/*}*/
           {
           sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
           if (sub[i] == NULL) goto EXPAND_FAILED;		/*{*/
-          if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+          if (*s++ != '}')
+	    {
+	    expand_string_message = string_sprintf(
+	      "missing '}' closing arg %d of extract", i+1);
+	    goto EXPAND_FAILED_CURLY;
+	    }
 
           /* After removal of leading and trailing white space, the first
           argument must not be empty; if it consists entirely of digits
@@ -5342,31 +5448,33 @@ while (*s != 0)
             while (len > 0 && isspace(p[len-1])) len--;
             p[len] = 0;
 
-            if (!skipping)
+	    if (*p == 0)
 	      {
-	      if (*p == 0)
-		{
-		expand_string_message = US"first argument of \"extract\" must "
-		  "not be empty";
-		goto EXPAND_FAILED;
-		}
+	      expand_string_message = US"first argument of \"extract\" must "
+		"not be empty";
+	      goto EXPAND_FAILED;
+	      }
 
-	      if (*p == '-')
-		{
-		field_number = -1;
-		p++;
-		}
-	      while (*p != 0 && isdigit(*p)) x = x * 10 + *p++ - '0';
-	      if (*p == 0)
-		{
-		field_number *= x;
-		j = 3;               /* Need 3 args */
-		field_number_set = TRUE;
-		}
+	    if (*p == '-')
+	      {
+	      field_number = -1;
+	      p++;
+	      }
+	    while (*p != 0 && isdigit(*p)) x = x * 10 + *p++ - '0';
+	    if (*p == 0)
+	      {
+	      field_number *= x;
+	      j = 3;               /* Need 3 args */
+	      field_number_set = TRUE;
 	      }
             }
           }
-        else goto EXPAND_FAILED_CURLY;
+        else
+	  {
+	  expand_string_message = string_sprintf(
+	    "missing '{' for arg %d of extract", i+1);
+	  goto EXPAND_FAILED_CURLY;
+	  }
         }
 
       /* Extract either the numbered or the keyed substring into $value. If
@@ -5419,11 +5527,20 @@ while (*s != 0)
         {
         while (isspace(*s)) s++;
         if (*s != '{')					/*}*/
+	  {
+	  expand_string_message = string_sprintf(
+	    "missing '{' for arg %d of listextract", i+1);
 	  goto EXPAND_FAILED_CURLY;
+	  }
 
 	sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
 	if (!sub[i])     goto EXPAND_FAILED;		/*{*/
-	if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+	if (*s++ != '}')
+	  {
+	  expand_string_message = string_sprintf(
+	    "missing '}' closing arg %d of listextract", i+1);
+	  goto EXPAND_FAILED_CURLY;
+	  }
 
 	/* After removal of leading and trailing white space, the first
 	argument must be numeric and nonempty. */
@@ -5506,10 +5623,17 @@ while (*s != 0)
       /* Read the field argument */
       while (isspace(*s)) s++;
       if (*s != '{')					/*}*/
+	{
+	expand_string_message = US"missing '{' for field arg of certextract";
 	goto EXPAND_FAILED_CURLY;
+	}
       sub[0] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
       if (!sub[0])     goto EXPAND_FAILED;		/*{*/
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '}')
+        {
+	expand_string_message = US"missing '}' closing field arg of certextract";
+	goto EXPAND_FAILED_CURLY;
+	}
       /* strip spaces fore & aft */
       {
       int len;
@@ -5526,7 +5650,10 @@ while (*s != 0)
       /* inspect the cert argument */
       while (isspace(*s)) s++;
       if (*s != '{')					/*}*/
+	{
+	expand_string_message = US"missing '{' for cert variable arg of certextract";
 	goto EXPAND_FAILED_CURLY;
+	}
       if (*++s != '$')
         {
 	expand_string_message = US"second argument of \"certextract\" must "
@@ -5535,7 +5662,11 @@ while (*s != 0)
 	}
       sub[1] = expand_string_internal(s+1, TRUE, &s, skipping, FALSE, &resetok);
       if (!sub[1])     goto EXPAND_FAILED;		/*{*/
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '}')
+        {
+	expand_string_message = US"missing '}' closing cert variable arg of certextract";
+	goto EXPAND_FAILED_CURLY;
+	}
 
       if (skipping)
 	lookup_value = NULL;
@@ -5579,25 +5710,48 @@ while (*s != 0)
       uschar *save_lookup_value = lookup_value;
 
       while (isspace(*s)) s++;
-      if (*s++ != '{') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '{')
+        {
+	expand_string_message =
+	  string_sprintf("missing '{' for first arg of %s", name);
+	goto EXPAND_FAILED_CURLY;
+	}
 
       list = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
       if (list == NULL) goto EXPAND_FAILED;
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '}')
+        {
+	expand_string_message =
+	  string_sprintf("missing '}' closing first arg of %s", name);
+	goto EXPAND_FAILED_CURLY;
+	}
 
       if (item_type == EITEM_REDUCE)
         {
 	uschar * t;
         while (isspace(*s)) s++;
-        if (*s++ != '{') goto EXPAND_FAILED_CURLY;
+        if (*s++ != '{')
+	  {
+	  expand_string_message = US"missing '{' for second arg of reduce";
+	  goto EXPAND_FAILED_CURLY;
+	  }
         t = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
         if (!t) goto EXPAND_FAILED;
         lookup_value = t;
-        if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+        if (*s++ != '}')
+	  {
+	  expand_string_message = US"missing '}' closing second arg of reduce";
+	  goto EXPAND_FAILED_CURLY;
+	  }
         }
 
       while (isspace(*s)) s++;
-      if (*s++ != '{') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '{')
+        {
+	expand_string_message =
+	  string_sprintf("missing '{' for last arg of %s", name);
+	goto EXPAND_FAILED_CURLY;
+	}
 
       expr = s;
 
@@ -5695,7 +5849,7 @@ while (*s != 0)
         separator character, or is an empty string. */
 
         if (ptr != save_ptr && (temp[0] == *outsep || temp[0] == 0))
-          yield = string_cat(yield, &size, &ptr, US" ", 1);
+          yield = string_catn(yield, &size, &ptr, US" ", 1);
 
         /* Add the string in "temp" to the output list that we are building,
         This is done in chunks by searching for the separator character. */
@@ -5703,21 +5857,22 @@ while (*s != 0)
         for (;;)
           {
           size_t seglen = Ustrcspn(temp, outsep);
-            yield = string_cat(yield, &size, &ptr, temp, seglen + 1);
+
+	  yield = string_catn(yield, &size, &ptr, temp, seglen + 1);
 
           /* If we got to the end of the string we output one character
           too many; backup and end the loop. Otherwise arrange to double the
           separator. */
 
           if (temp[seglen] == '\0') { ptr--; break; }
-          yield = string_cat(yield, &size, &ptr, outsep, 1);
+          yield = string_catn(yield, &size, &ptr, outsep, 1);
           temp += seglen + 1;
           }
 
         /* Output a separator after the string: we will remove the redundant
         final one at the end. */
 
-        yield = string_cat(yield, &size, &ptr, outsep, 1);
+        yield = string_catn(yield, &size, &ptr, outsep, 1);
         }   /* End of iteration over the list loop */
 
       /* REDUCE has generated no output above: output the final value of
@@ -5725,8 +5880,7 @@ while (*s != 0)
 
       if (item_type == EITEM_REDUCE)
         {
-        yield = string_cat(yield, &size, &ptr, lookup_value,
-          Ustrlen(lookup_value));
+        yield = string_cat(yield, &size, &ptr, lookup_value);
         lookup_value = save_lookup_value;  /* Restore $value */
         }
 
@@ -5752,28 +5906,52 @@ while (*s != 0)
       uschar *save_iterate_item = iterate_item;
 
       while (isspace(*s)) s++;
-      if (*s++ != '{') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '{')
+        {
+        expand_string_message = US"missing '{' for list arg of sort";
+	goto EXPAND_FAILED_CURLY;
+	}
 
       srclist = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
       if (!srclist) goto EXPAND_FAILED;
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '}')
+        {
+        expand_string_message = US"missing '}' closing list arg of sort";
+	goto EXPAND_FAILED_CURLY;
+	}
 
       while (isspace(*s)) s++;
-      if (*s++ != '{') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '{')
+        {
+        expand_string_message = US"missing '{' for comparator arg of sort";
+	goto EXPAND_FAILED_CURLY;
+	}
 
       cmp = expand_string_internal(s, TRUE, &s, skipping, FALSE, &resetok);
       if (!cmp) goto EXPAND_FAILED;
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '}')
+        {
+        expand_string_message = US"missing '}' closing comparator arg of sort";
+	goto EXPAND_FAILED_CURLY;
+	}
 
       while (isspace(*s)) s++;
-      if (*s++ != '{') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '{')
+        {
+        expand_string_message = US"missing '{' for extractor arg of sort";
+	goto EXPAND_FAILED_CURLY;
+	}
 
       xtract = s;
       tmp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok);
       if (!tmp) goto EXPAND_FAILED;
       xtract = string_copyn(xtract, s - xtract);
 
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '}')
+        {
+        expand_string_message = US"missing '}' closing extractor arg of sort";
+	goto EXPAND_FAILED_CURLY;
+	}
 							/*{*/
       if (*s++ != '}')
         {						/*{*/
@@ -5869,7 +6047,7 @@ while (*s != 0)
 	}
 
       if (dstlist)
-	yield = string_cat(yield, &size, &ptr, dstlist, Ustrlen(dstlist));
+	yield = string_cat(yield, &size, &ptr, dstlist);
 
       /* Restore preserved $item */
       iterate_item = save_iterate_item;
@@ -5967,7 +6145,7 @@ while (*s != 0)
       if(status == OK)
         {
         if (result == NULL) result = US"";
-        yield = string_cat(yield, &size, &ptr, result, Ustrlen(result));
+        yield = string_cat(yield, &size, &ptr, result);
         continue;
         }
       else
@@ -5993,7 +6171,11 @@ while (*s != 0)
 
       key = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
       if (!key) goto EXPAND_FAILED;			/*{*/
-      if (*s++ != '}') goto EXPAND_FAILED_CURLY;
+      if (*s++ != '}')
+        {
+        expand_string_message = US"missing '{' for name arg of env";
+	goto EXPAND_FAILED_CURLY;
+	}
 
       lookup_value = US getenv(CS key);
 
@@ -6057,7 +6239,12 @@ while (*s != 0)
 	  sub = expand_string_internal(s+2, TRUE, &s1, skipping,
 		  FALSE, &resetok);
 	  if (!sub)       goto EXPAND_FAILED;		/*{*/
-	  if (*s1 != '}') goto EXPAND_FAILED_CURLY;
+	  if (*s1 != '}')
+	    {
+	    expand_string_message =
+	      string_sprintf("missing '}' closing cert arg of %s", name);
+	    goto EXPAND_FAILED_CURLY;
+	    }
 	  if ((vp = find_var_ent(sub)) && vp->type == vtype_cert)
 	    {
 	    s = s1+1;
@@ -6100,9 +6287,9 @@ while (*s != 0)
           goto EXPAND_FAILED;
           }
 	for ( ; n; n >>= 5)
-	  s = string_cat(s, &sz, &i, &base32_chars[n & 0x1f], 1);
+	  s = string_catn(s, &sz, &i, &base32_chars[n & 0x1f], 1);
 
-	while (i > 0) yield = string_cat(yield, &size, &ptr, &s[--i], 1);
+	while (i > 0) yield = string_catn(yield, &size, &ptr, &s[--i], 1);
 	continue;
 	}
 
@@ -6123,7 +6310,7 @@ while (*s != 0)
           n = n * 32 + (t - base32_chars);
           }
         s = string_sprintf("%ld", n);
-        yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+        yield = string_cat(yield, &size, &ptr, s);
         continue;
         }
 
@@ -6138,7 +6325,7 @@ while (*s != 0)
           goto EXPAND_FAILED;
           }
         t = string_base62(n);
-        yield = string_cat(yield, &size, &ptr, t, Ustrlen(t));
+        yield = string_cat(yield, &size, &ptr, t);
         continue;
         }
 
@@ -6162,7 +6349,7 @@ while (*s != 0)
           n = n * BASE_62 + (t - base62_chars);
           }
         (void)sprintf(CS buf, "%ld", n);
-        yield = string_cat(yield, &size, &ptr, buf, Ustrlen(buf));
+        yield = string_cat(yield, &size, &ptr, buf);
         continue;
         }
 
@@ -6176,7 +6363,7 @@ while (*s != 0)
               expand_string_message);
           goto EXPAND_FAILED;
           }
-        yield = string_cat(yield, &size, &ptr, expanded, Ustrlen(expanded));
+        yield = string_cat(yield, &size, &ptr, expanded);
         continue;
         }
 
@@ -6185,7 +6372,7 @@ while (*s != 0)
         int count = 0;
         uschar *t = sub - 1;
         while (*(++t) != 0) { *t = tolower(*t); count++; }
-        yield = string_cat(yield, &size, &ptr, sub, count);
+        yield = string_catn(yield, &size, &ptr, sub, count);
         continue;
         }
 
@@ -6194,7 +6381,7 @@ while (*s != 0)
         int count = 0;
         uschar *t = sub - 1;
         while (*(++t) != 0) { *t = toupper(*t); count++; }
-        yield = string_cat(yield, &size, &ptr, sub, count);
+        yield = string_catn(yield, &size, &ptr, sub, count);
         continue;
         }
 
@@ -6203,7 +6390,7 @@ while (*s != 0)
 	if (vp && *(void **)vp->value)
 	  {
 	  uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
-	  yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp));
+	  yield = string_cat(yield, &size, &ptr, cp);
 	  }
 	else
 #endif
@@ -6215,7 +6402,7 @@ while (*s != 0)
 	  md5_start(&base);
 	  md5_end(&base, sub, Ustrlen(sub), digest);
 	  for(j = 0; j < 16; j++) sprintf(st+2*j, "%02x", digest[j]);
-	  yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
+	  yield = string_cat(yield, &size, &ptr, US st);
 	  }
         continue;
 
@@ -6224,34 +6411,83 @@ while (*s != 0)
 	if (vp && *(void **)vp->value)
 	  {
 	  uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
-	  yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp));
+	  yield = string_cat(yield, &size, &ptr, cp);
 	  }
 	else
 #endif
 	  {
-	  sha1 base;
+	  hctx h;
 	  uschar digest[20];
 	  int j;
 	  char st[41];
-	  sha1_start(&base);
-	  sha1_end(&base, sub, Ustrlen(sub), digest);
+	  sha1_start(&h);
+	  sha1_end(&h, sub, Ustrlen(sub), digest);
 	  for(j = 0; j < 20; j++) sprintf(st+2*j, "%02X", digest[j]);
-	  yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
+	  yield = string_catn(yield, &size, &ptr, US st, 40);
 	  }
         continue;
 
       case EOP_SHA256:
-#ifdef SUPPORT_TLS
+#ifdef EXIM_HAVE_SHA2
 	if (vp && *(void **)vp->value)
 	  {
 	  uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
-	  yield = string_cat(yield, &size, &ptr, cp, (int)Ustrlen(cp));
+	  yield = string_cat(yield, &size, &ptr, cp);
 	  }
 	else
+	  {
+	  hctx h;
+	  blob b;
+	  char st[3];
+
+	  exim_sha_init(&h, HASH_SHA256);
+	  exim_sha_update(&h, sub, Ustrlen(sub));
+	  exim_sha_finish(&h, &b);
+	  while (b.len-- > 0)
+	    {
+	    sprintf(st, "%02X", *b.data++);
+	    yield = string_catn(yield, &size, &ptr, US st, 2);
+	    }
+	  }
+#else
+	  expand_string_message = US"sha256 only supported with TLS";
 #endif
-	  expand_string_message = US"sha256 only supported for certificates";
         continue;
 
+      case EOP_SHA3:
+#ifdef EXIM_HAVE_SHA3
+	{
+	hctx h;
+	blob b;
+	char st[3];
+	hashmethod m = !arg ? HASH_SHA3_256
+	  : Ustrcmp(arg, "224") == 0 ? HASH_SHA3_224
+	  : Ustrcmp(arg, "256") == 0 ? HASH_SHA3_256
+	  : Ustrcmp(arg, "384") == 0 ? HASH_SHA3_384
+	  : Ustrcmp(arg, "512") == 0 ? HASH_SHA3_512
+	  : HASH_BADTYPE;
+
+	if (m == HASH_BADTYPE)
+	  {
+	  expand_string_message = US"unrecognised sha3 variant";
+	  goto EXPAND_FAILED;
+	  }
+
+	exim_sha_init(&h, m);
+	exim_sha_update(&h, sub, Ustrlen(sub));
+	exim_sha_finish(&h, &b);
+	while (b.len-- > 0)
+	  {
+	  sprintf(st, "%02X", *b.data++);
+	  yield = string_catn(yield, &size, &ptr, US st, 2);
+	  }
+	}
+        continue;
+#else
+	expand_string_message = US"sha3 only supported with GnuTLS 3.5.0 +";
+	goto EXPAND_FAILED;
+#endif
+
       /* Convert hex encoding to base64 encoding */
 
       case EOP_HEX2B64:
@@ -6296,7 +6532,7 @@ while (*s != 0)
           }
 
         enc = b64encode(sub, out - sub);
-        yield = string_cat(yield, &size, &ptr, enc, Ustrlen(enc));
+        yield = string_cat(yield, &size, &ptr, enc);
         continue;
         }
 
@@ -6308,10 +6544,10 @@ while (*s != 0)
         while (*(++t) != 0)
           {
           if (*t < 0x21 || 0x7E < *t)
-            yield = string_cat(yield, &size, &ptr,
+            yield = string_catn(yield, &size, &ptr,
 	      string_sprintf("\\x%02x", *t), 4);
 	  else
-	    yield = string_cat(yield, &size, &ptr, t, 1);
+	    yield = string_catn(yield, &size, &ptr, t, 1);
           }
 	continue;
 	}
@@ -6327,7 +6563,7 @@ while (*s != 0)
 
 	while (string_nextinlist(CUSS &sub, &sep, buffer, sizeof(buffer)) != NULL) cnt++;
 	cp = string_sprintf("%d", cnt);
-        yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp));
+        yield = string_cat(yield, &size, &ptr, cp);
         continue;
         }
 
@@ -6381,7 +6617,7 @@ while (*s != 0)
 	  {
 	  uschar * buf = US" : ";
 	  if (needsep)
-	    yield = string_cat(yield, &size, &ptr, buf, 3);
+	    yield = string_catn(yield, &size, &ptr, buf, 3);
 	  else
 	    needsep = TRUE;
 
@@ -6397,21 +6633,21 @@ while (*s != 0)
 	    tok[0] = sep; tok[1] = ':'; tok[2] = 0;
 	    while ((cp= strpbrk((const char *)item, tok)))
 	      {
-              yield = string_cat(yield, &size, &ptr, item, cp-(char *)item);
+              yield = string_catn(yield, &size, &ptr, item, cp-(char *)item);
 	      if (*cp++ == ':')	/* colon in a non-colon-sep list item, needs doubling */
 	        {
-                yield = string_cat(yield, &size, &ptr, US"::", 2);
+                yield = string_catn(yield, &size, &ptr, US"::", 2);
 	        item = (uschar *)cp;
 		}
 	      else		/* sep in item; should already be doubled; emit once */
 	        {
-                yield = string_cat(yield, &size, &ptr, (uschar *)tok, 1);
+                yield = string_catn(yield, &size, &ptr, (uschar *)tok, 1);
 		if (*cp == sep) cp++;
 	        item = (uschar *)cp;
 		}
 	      }
 	    }
-          yield = string_cat(yield, &size, &ptr, item, Ustrlen(item));
+          yield = string_cat(yield, &size, &ptr, item);
 	  }
         continue;
 	}
@@ -6459,7 +6695,7 @@ while (*s != 0)
 
         /* Convert to masked textual format and add to output. */
 
-        yield = string_cat(yield, &size, &ptr, buffer,
+        yield = string_catn(yield, &size, &ptr, buffer,
           host_nmtoa(count, binary, mask, buffer, '.'));
         continue;
         }
@@ -6489,7 +6725,7 @@ while (*s != 0)
 	    goto EXPAND_FAILED;
 	  }
 
-	yield = string_cat(yield, &size, &ptr, buffer,
+	yield = string_catn(yield, &size, &ptr, buffer,
 		  c == EOP_IPV6NORM
 		    ? ipv6_nmtoa(binary, buffer)
 		    : host_nmtoa(4, binary, -1, buffer, ':')
@@ -6510,12 +6746,12 @@ while (*s != 0)
           if (c != EOP_DOMAIN)
             {
             if (c == EOP_LOCAL_PART && domain != 0) end = start + domain - 1;
-            yield = string_cat(yield, &size, &ptr, sub+start, end-start);
+            yield = string_catn(yield, &size, &ptr, sub+start, end-start);
             }
           else if (domain != 0)
             {
             domain += start;
-            yield = string_cat(yield, &size, &ptr, sub+domain, end-domain);
+            yield = string_catn(yield, &size, &ptr, sub+domain, end-domain);
             }
           }
         continue;
@@ -6550,25 +6786,25 @@ while (*s != 0)
           if (address != NULL)
             {
             if (ptr != save_ptr && address[0] == *outsep)
-              yield = string_cat(yield, &size, &ptr, US" ", 1);
+              yield = string_catn(yield, &size, &ptr, US" ", 1);
 
             for (;;)
               {
               size_t seglen = Ustrcspn(address, outsep);
-              yield = string_cat(yield, &size, &ptr, address, seglen + 1);
+              yield = string_catn(yield, &size, &ptr, address, seglen + 1);
 
               /* If we got to the end of the string we output one character
               too many. */
 
               if (address[seglen] == '\0') { ptr--; break; }
-              yield = string_cat(yield, &size, &ptr, outsep, 1);
+              yield = string_catn(yield, &size, &ptr, outsep, 1);
               address += seglen + 1;
               }
 
             /* Output a separator after the string: we will remove the
             redundant final one at the end. */
 
-            yield = string_cat(yield, &size, &ptr, outsep, 1);
+            yield = string_catn(yield, &size, &ptr, outsep, 1);
             }
 
           if (saveend == '\0') break;
@@ -6615,24 +6851,24 @@ while (*s != 0)
 
         if (needs_quote)
           {
-          yield = string_cat(yield, &size, &ptr, US"\"", 1);
+          yield = string_catn(yield, &size, &ptr, US"\"", 1);
           t = sub - 1;
           while (*(++t) != 0)
             {
             if (*t == '\n')
-              yield = string_cat(yield, &size, &ptr, US"\\n", 2);
+              yield = string_catn(yield, &size, &ptr, US"\\n", 2);
             else if (*t == '\r')
-              yield = string_cat(yield, &size, &ptr, US"\\r", 2);
+              yield = string_catn(yield, &size, &ptr, US"\\r", 2);
             else
               {
               if (*t == '\\' || *t == '"')
-                yield = string_cat(yield, &size, &ptr, US"\\", 1);
-              yield = string_cat(yield, &size, &ptr, t, 1);
+                yield = string_catn(yield, &size, &ptr, US"\\", 1);
+              yield = string_catn(yield, &size, &ptr, t, 1);
               }
             }
-          yield = string_cat(yield, &size, &ptr, US"\"", 1);
+          yield = string_catn(yield, &size, &ptr, US"\"", 1);
           }
-        else yield = string_cat(yield, &size, &ptr, sub, Ustrlen(sub));
+        else yield = string_cat(yield, &size, &ptr, sub);
         continue;
         }
 
@@ -6664,7 +6900,7 @@ while (*s != 0)
           goto EXPAND_FAILED;
           }
 
-        yield = string_cat(yield, &size, &ptr, sub, Ustrlen(sub));
+        yield = string_cat(yield, &size, &ptr, sub);
         continue;
         }
 
@@ -6677,8 +6913,8 @@ while (*s != 0)
         while (*(++t) != 0)
           {
           if (!isalnum(*t))
-            yield = string_cat(yield, &size, &ptr, US"\\", 1);
-          yield = string_cat(yield, &size, &ptr, t, 1);
+            yield = string_catn(yield, &size, &ptr, US"\\", 1);
+          yield = string_catn(yield, &size, &ptr, t, 1);
           }
         continue;
         }
@@ -6691,7 +6927,7 @@ while (*s != 0)
         uschar buffer[2048];
 	const uschar *string = parse_quote_2047(sub, Ustrlen(sub), headers_charset,
           buffer, sizeof(buffer), FALSE);
-        yield = string_cat(yield, &size, &ptr, string, Ustrlen(string));
+        yield = string_cat(yield, &size, &ptr, string);
         continue;
         }
 
@@ -6708,7 +6944,7 @@ while (*s != 0)
           expand_string_message = error;
           goto EXPAND_FAILED;
           }
-        yield = string_cat(yield, &size, &ptr, decoded, len);
+        yield = string_catn(yield, &size, &ptr, decoded, len);
         continue;
         }
 
@@ -6724,7 +6960,7 @@ while (*s != 0)
           GETUTF8INC(c, sub);
           if (c > 255) c = '_';
           buff[0] = c;
-          yield = string_cat(yield, &size, &ptr, buff, 1);
+          yield = string_catn(yield, &size, &ptr, buff, 1);
           }
         continue;
         }
@@ -6759,7 +6995,7 @@ while (*s != 0)
 		  complete = -1;	/* error (RFC3629 limit) */
 		else
 		  {		/* finished; output utf-8 sequence */
-		  yield = string_cat(yield, &size, &ptr, seq_buff, seq_len);
+		  yield = string_catn(yield, &size, &ptr, seq_buff, seq_len);
 		  index = 0;
 		  }
 	      }
@@ -6768,7 +7004,7 @@ while (*s != 0)
 	    {
 	    if((c & 0x80) == 0)	/* 1-byte sequence, US-ASCII, keep it */
 	      {
-	      yield = string_cat(yield, &size, &ptr, &c, 1);
+	      yield = string_catn(yield, &size, &ptr, &c, 1);
 	      continue;
 	      }
 	    if((c & 0xe0) == 0xc0)		/* 2-byte sequence */
@@ -6801,11 +7037,11 @@ while (*s != 0)
 	  if (complete != 0)
 	    {
 	    bytes_left = index = 0;
-	    yield = string_cat(yield, &size, &ptr, UTF8_REPLACEMENT_CHAR, 1);
+	    yield = string_catn(yield, &size, &ptr, UTF8_REPLACEMENT_CHAR, 1);
 	    }
 	  if ((complete == 1) && ((c & 0x80) == 0))
 			/* ASCII character follows incomplete sequence */
-	      yield = string_cat(yield, &size, &ptr, &c, 1);
+	      yield = string_catn(yield, &size, &ptr, &c, 1);
 	  }
         continue;
         }
@@ -6822,7 +7058,7 @@ while (*s != 0)
 	    string_printing(sub), error);
 	  goto EXPAND_FAILED;
 	  }
-	yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+	yield = string_cat(yield, &size, &ptr, s);
         continue;
 	}
 
@@ -6837,7 +7073,7 @@ while (*s != 0)
 	    string_printing(sub), error);
 	  goto EXPAND_FAILED;
 	  }
-	yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+	yield = string_cat(yield, &size, &ptr, s);
         continue;
 	}
 
@@ -6852,7 +7088,7 @@ while (*s != 0)
 	    string_printing(sub), error);
 	  goto EXPAND_FAILED;
 	  }
-	yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+	yield = string_cat(yield, &size, &ptr, s);
 	DEBUG(D_expand) debug_printf("yield: '%s'\n", yield);
         continue;
 	}
@@ -6868,7 +7104,7 @@ while (*s != 0)
 	    string_printing(sub), error);
 	  goto EXPAND_FAILED;
 	  }
-	yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+	yield = string_cat(yield, &size, &ptr, s);
         continue;
 	}
 #endif	/* EXPERIMENTAL_INTERNATIONAL */
@@ -6877,11 +7113,23 @@ while (*s != 0)
 
       case EOP_ESCAPE:
         {
-        const uschar *t = string_printing(sub);
-        yield = string_cat(yield, &size, &ptr, t, Ustrlen(t));
+        const uschar * t = string_printing(sub);
+        yield = string_cat(yield, &size, &ptr, t);
         continue;
         }
 
+      case EOP_ESCAPE8BIT:
+	{
+	const uschar * s = sub;
+	uschar c;
+
+	for (s = sub; (c = *s); s++)
+	  yield = c < 127 && c != '\\'
+	    ? string_catn(yield, &size, &ptr, s, 1)
+	    : string_catn(yield, &size, &ptr, string_sprintf("\\%03o", c), 4);
+	continue;
+	}
+
       /* Handle numeric expression evaluation */
 
       case EOP_EVAL:
@@ -6898,7 +7146,7 @@ while (*s != 0)
           goto EXPAND_FAILED;
           }
         sprintf(CS var_buffer, PR_EXIM_ARITH, n);
-        yield = string_cat(yield, &size, &ptr, var_buffer, Ustrlen(var_buffer));
+        yield = string_cat(yield, &size, &ptr, var_buffer);
         continue;
         }
 
@@ -6914,7 +7162,7 @@ while (*s != 0)
           goto EXPAND_FAILED;
           }
         sprintf(CS var_buffer, "%d", n);
-        yield = string_cat(yield, &size, &ptr, var_buffer, Ustrlen(var_buffer));
+        yield = string_cat(yield, &size, &ptr, var_buffer);
         continue;
         }
 
@@ -6929,7 +7177,7 @@ while (*s != 0)
           goto EXPAND_FAILED;
           }
         t = readconf_printtime(n);
-        yield = string_cat(yield, &size, &ptr, t, Ustrlen(t));
+        yield = string_cat(yield, &size, &ptr, t);
         continue;
         }
 
@@ -6945,7 +7193,7 @@ while (*s != 0)
 #else
 	uschar * s = b64encode(sub, Ustrlen(sub));
 #endif
-	yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+	yield = string_cat(yield, &size, &ptr, s);
 	continue;
 	}
 
@@ -6959,7 +7207,7 @@ while (*s != 0)
             "well-formed for \"%s\" operator", sub, name);
           goto EXPAND_FAILED;
           }
-        yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+        yield = string_cat(yield, &size, &ptr, s);
         continue;
         }
 
@@ -6969,7 +7217,7 @@ while (*s != 0)
         {
         uschar buff[24];
         (void)sprintf(CS buff, "%d", Ustrlen(sub));
-        yield = string_cat(yield, &size, &ptr, buff, Ustrlen(buff));
+        yield = string_cat(yield, &size, &ptr, buff);
         continue;
         }
 
@@ -7060,7 +7308,7 @@ while (*s != 0)
              extract_substr(sub, value1, value2, &len);
 
         if (ret == NULL) goto EXPAND_FAILED;
-        yield = string_cat(yield, &size, &ptr, ret, len);
+        yield = string_catn(yield, &size, &ptr, ret, len);
         continue;
         }
 
@@ -7115,7 +7363,7 @@ while (*s != 0)
           (long)st.st_dev, (long)st.st_nlink, (long)st.st_uid,
           (long)st.st_gid, st.st_size, (long)st.st_atime,
           (long)st.st_mtime, (long)st.st_ctime);
-        yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+        yield = string_cat(yield, &size, &ptr, s);
         continue;
         }
 
@@ -7130,7 +7378,7 @@ while (*s != 0)
         if (expand_string_message != NULL)
           goto EXPAND_FAILED;
         s = string_sprintf("%d", vaguely_random_number((int)max));
-        yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+        yield = string_cat(yield, &size, &ptr, s);
         continue;
         }
 
@@ -7149,7 +7397,7 @@ while (*s != 0)
           goto EXPAND_FAILED;
           }
         invert_address(reversed, sub);
-        yield = string_cat(yield, &size, &ptr, reversed, Ustrlen(reversed));
+        yield = string_cat(yield, &size, &ptr, reversed);
         continue;
         }
 
@@ -7179,8 +7427,7 @@ while (*s != 0)
       yield = NULL;
       size = 0;
       }
-    value = find_variable(name, FALSE, skipping, &newsize);
-    if (value == NULL)
+    if (!(value = find_variable(name, FALSE, skipping, &newsize)))
       {
       expand_string_message =
         string_sprintf("unknown variable in \"${%s}\"", name);
@@ -7188,13 +7435,14 @@ while (*s != 0)
       goto EXPAND_FAILED;
       }
     len = Ustrlen(value);
-    if (yield == NULL && newsize != 0)
+    if (!yield && newsize)
       {
       yield = value;
       size = newsize;
       ptr = len;
       }
-    else yield = string_cat(yield, &size, &ptr, value, len);
+    else
+      yield = string_catn(yield, &size, &ptr, value, len);
     continue;
     }
 
@@ -7235,9 +7483,9 @@ else if (resetok_p) *resetok_p = FALSE;
 
 DEBUG(D_expand)
   {
-  debug_printf("expanding: %.*s\n   result: %s\n", (int)(s - string), string,
+  debug_printf("  expanding: %.*s\n     result: %s\n", (int)(s - string), string,
     yield);
-  if (skipping) debug_printf("skipping: result is not used\n");
+  if (skipping) debug_printf("   skipping: result is not used\n");
   }
 return yield;
 
@@ -7246,10 +7494,12 @@ to update the pointer to the terminator, for cases of nested calls with "fail".
 */
 
 EXPAND_FAILED_CURLY:
-expand_string_message = malformed_header?
-  US"missing or misplaced { or } - could be header name not terminated by colon"
-  :
-  US"missing or misplaced { or }";
+if (malformed_header)
+  expand_string_message =
+    US"missing or misplaced { or } - could be header name not terminated by colon";
+
+else if (!expand_string_message || !*expand_string_message)
+  expand_string_message = US"missing or misplaced { or }";
 
 /* At one point, Exim reset the store to yield (if yield was not NULL), but
 that is a bad idea, because expand_string_message is in dynamic store. */
@@ -7500,6 +7750,29 @@ return OK;
 
 
 
+/* Avoid potentially exposing a password in a string about to be logged */
+
+uschar *
+expand_hide_passwords(uschar * s)
+{
+return (  (  Ustrstr(s, "failed to expand") != NULL
+	  || Ustrstr(s, "expansion of ")    != NULL
+	  ) 
+       && (  Ustrstr(s, "mysql")   != NULL
+	  || Ustrstr(s, "pgsql")   != NULL
+	  || Ustrstr(s, "redis")   != NULL
+	  || Ustrstr(s, "sqlite")  != NULL
+	  || Ustrstr(s, "ldap:")   != NULL
+	  || Ustrstr(s, "ldaps:")  != NULL
+	  || Ustrstr(s, "ldapi:")  != NULL
+	  || Ustrstr(s, "ldapdn:") != NULL
+	  || Ustrstr(s, "ldapm:")  != NULL
+       )  ) 
+  ? US"Temporary internal error" : s;
+}
+
+
+
 
 /*************************************************
 **************************************************
diff --git a/src/src/filter.c b/src/src/filter.c
index bba1a520e..59ab3192f 100644
--- a/src/src/filter.c
+++ b/src/src/filter.c
@@ -519,14 +519,14 @@ for (;;)
         string_item *aa;
         uschar *saveptr = ptr;
         ptr = nextword(ptr, buffer, sizeof(buffer), TRUE);
-        if (*error_pointer != NULL) break;
+        if (*error_pointer) break;
         if (Ustrcmp(buffer, "alias") != 0)
           {
           ptr = saveptr;
           break;
           }
         ptr = nextitem(ptr, buffer, sizeof(buffer), TRUE);
-        if (*error_pointer != NULL) break;
+        if (*error_pointer) break;
         aa = store_get(sizeof(string_item));
         aa->text = string_copy(buffer);
         aa->next = c->left.a;
@@ -540,7 +540,7 @@ for (;;)
     else if (Ustrcmp(buffer, "foranyaddress") == 0)
       {
       ptr = nextitem(ptr, buffer, sizeof(buffer), TRUE);
-      if (*error_pointer != NULL) break;
+      if (*error_pointer) break;
       if (*ptr != '(')
         {
         *error_pointer = string_sprintf("\"(\" expected after \"foranyaddress\" "
@@ -552,18 +552,13 @@ for (;;)
       c->left.u = string_copy(buffer);
 
       ptr = read_condition(nextsigchar(ptr+1, TRUE), &(c->right.c), FALSE);
-      if (*error_pointer != NULL) break;
+      if (*error_pointer) break;
       if (*ptr != ')')
         {
         *error_pointer = string_sprintf("expected \")\" in line %d of "
           "filter file", line_number);
         break;
         }
-      if (!testfor)
-        {
-        c->testfor = !c->testfor;
-        testfor = TRUE;
-        }
       ptr = nextsigchar(ptr+1, TRUE);
       }
 
@@ -577,7 +572,7 @@ for (;;)
 
       c->left.u = string_copy(buffer);
       ptr = nextword(ptr, buffer, sizeof(buffer), TRUE);
-      if (*error_pointer != NULL) break;
+      if (*error_pointer) break;
 
       /* Handle "does|is [not]", preserving the pointer after "is" in
       case it isn't that, but the form "is <string>". */
@@ -588,13 +583,13 @@ for (;;)
         if (buffer[0] == 'I') { c->type = cond_IS; isptr = ptr; }
 
         ptr = nextword(ptr, buffer, sizeof(buffer), TRUE);
-        if (*error_pointer != NULL) break;
+        if (*error_pointer) break;
         if (strcmpic(buffer, US"not") == 0)
           {
           c->testfor = !c->testfor;
-          if (isptr != NULL) isptr = ptr;
+          if (isptr) isptr = ptr;
           ptr = nextword(ptr, buffer, sizeof(buffer), TRUE);
-          if (*error_pointer != NULL) break;
+          if (*error_pointer) break;
           }
         }
 
@@ -612,22 +607,19 @@ for (;;)
 
       if (i >= cond_word_count)
         {
-        if (isptr != NULL)
-          {
-          ptr = isptr;
-          }
-        else
+        if (!isptr)
           {
           *error_pointer = string_sprintf("unrecognized condition word \"%s\" "
             "near line %d of filter file", buffer, line_number);
           break;
           }
+        ptr = isptr;
         }
 
       /* Get the RH argument. */
 
       ptr = nextitem(ptr, buffer, sizeof(buffer), TRUE);
-      if (*error_pointer != NULL) break;
+      if (*error_pointer) break;
       c->right.u = string_copy(buffer);
       }
     }
@@ -664,7 +656,7 @@ for (;;)
     {
     uschar *saveptr = ptr;
     ptr = nextword(ptr, buffer, sizeof(buffer), FALSE);
-    if (*error_pointer != NULL) break;
+    if (*error_pointer) break;
 
     /* "Then" terminates a toplevel condition; otherwise a closing bracket
     has been omitted. Put a string terminator at the start of "then" so
@@ -673,7 +665,7 @@ for (;;)
     if (Ustrcmp(buffer, "then") == 0)
       {
       if (toplevel) *saveptr = 0;
-        else *error_pointer = string_sprintf("missing \")\" at end of "
+      else *error_pointer = string_sprintf("missing \")\" at end of "
           "condition near line %d of filter file", line_number);
       break;
       }
@@ -707,21 +699,21 @@ for (;;)
       condition_block *orc = store_get(sizeof(condition_block));
       condition_block *or_parent = NULL;
 
-      if (current_parent != NULL)
+      if (current_parent)
         {
-        while (current_parent->parent != NULL &&
+        while (current_parent->parent &&
                current_parent->parent->type == cond_and)
           current_parent = current_parent->parent;
 
         /* If the parent has a parent, it must be an "or" parent. */
 
-        if (current_parent->parent != NULL)
+        if (current_parent->parent)
           or_parent = current_parent->parent;
         }
 
       orc->parent = or_parent;
-      if (or_parent == NULL) *cond = orc; else
-        or_parent->right.c = orc;
+      if (!or_parent) *cond = orc;
+      else or_parent->right.c = orc;
       orc->type = cond_or;
       orc->testfor = TRUE;
       orc->left.c = (current_parent == NULL)? c : current_parent;
@@ -2281,17 +2273,16 @@ while (commands != NULL)
 
         if (recipient != NULL)
           {
-          log_addr = string_cat(log_addr, &size, &ptr,
-            (log_addr == NULL)? US">" : US",", 1);
-          log_addr = string_cat(log_addr, &size, &ptr, recipient,
-            Ustrlen(recipient));
+          log_addr = string_catn(log_addr, &size, &ptr,
+            log_addr ? US"," : US">", 1);
+          log_addr = string_cat(log_addr, &size, &ptr, recipient);
           }
 
         /* Check size */
 
         if (ptr > 256)
           {
-          log_addr = string_cat(log_addr, &size, &ptr, US", ...", 5);
+          log_addr = string_catn(log_addr, &size, &ptr, US", ...", 5);
           break;
           }
 
diff --git a/src/src/functions.h b/src/src/functions.h
index 4cee9bf8b..cc4e22b2e 100644
--- a/src/src/functions.h
+++ b/src/src/functions.h
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -56,6 +56,7 @@ extern int     tls_feof(void);
 extern int     tls_ferror(void);
 extern void    tls_free_cert(void **);
 extern int     tls_getc(void);
+extern void    tls_get_cache(void);
 extern int     tls_import_cert(const uschar *, void **);
 extern int     tls_read(BOOL, uschar *, size_t);
 extern int     tls_server_start(const uschar *);
@@ -71,7 +72,7 @@ extern uschar * tls_field_from_dn(uschar *, const uschar *);
 extern BOOL    tls_is_name_for_cert(const uschar *, void *);
 
 # ifdef EXPERIMENTAL_DANE
-extern int     tlsa_lookup(const host_item *, dns_answer *, BOOL, BOOL *);
+extern int     tlsa_lookup(const host_item *, dns_answer *, BOOL);
 # endif
 
 #endif	/*SUPPORT_TLS*/
@@ -100,6 +101,7 @@ extern int     auth_xtextdecode(uschar *, uschar **);
 
 extern uschar *b64encode(uschar *, int);
 extern int     b64decode(uschar *, uschar **);
+extern int     bdat_getc(void);
 extern void    bits_clear(unsigned int *, size_t, int *);
 extern void    bits_set(unsigned int *, size_t, int *);
 
@@ -108,6 +110,7 @@ extern int     check_host(void *, const uschar *, const uschar **, uschar **);
 extern uschar **child_exec_exim(int, BOOL, int *, BOOL, int, ...);
 extern pid_t   child_open_uid(const uschar **, const uschar **, int,
 		 uid_t *, gid_t *, int *, int *, uschar *, BOOL);
+extern BOOL    cleanup_environment(void);
 extern uschar *cutthrough_finaldot(void);
 extern BOOL    cutthrough_flush_send(void);
 extern BOOL    cutthrough_headers_send(void);
@@ -122,6 +125,7 @@ extern int     dcc_process(uschar **);
 #endif
 
 extern void    debug_logging_activate(uschar *, uschar *);
+extern void    debug_logging_stop(void);
 extern void    debug_print_argv(const uschar **);
 extern void    debug_print_ids(uschar *);
 extern void    debug_print_string(uschar *);
@@ -140,14 +144,10 @@ extern void    deliver_succeeded(address_item *);
 
 extern uschar *deliver_get_sender_address (uschar *id);
 
-#ifdef WITH_OLD_DEMIME
-extern int     demime(uschar **);
-#endif
 extern BOOL    directory_make(const uschar *, const uschar *, int, BOOL);
 #ifndef DISABLE_DKIM
-extern BOOL    dkim_transport_write_message(address_item *, int, int,
-                   int, uschar *, uschar *, uschar *, uschar *, rewrite_rule *,
-                   int, uschar *, uschar *, uschar *, uschar *, uschar *, uschar *);
+extern BOOL    dkim_transport_write_message(int, transport_ctx *,
+		  struct ob_dkim *);
 #endif
 extern dns_address *dns_address_from_rr(dns_answer *, dns_record *);
 extern int     dns_basic_lookup(dns_answer *, const uschar *, int);
@@ -158,7 +158,7 @@ extern BOOL    dns_is_secure(const dns_answer *);
 extern int     dns_lookup(dns_answer *, const uschar *, int, const uschar **);
 extern void    dns_pattern_init(void);
 extern int     dns_special_lookup(dns_answer *, const uschar *, int, const uschar **);
-extern dns_record *dns_next_rr(dns_answer *, dns_scan *, int);
+extern dns_record *dns_next_rr(const dns_answer *, dns_scan *, int);
 extern uschar *dns_text_type(int);
 extern void    dscp_list_to_stream(FILE *);
 extern BOOL    dscp_lookup(const uschar *, int, int *, int *, int *);
@@ -170,6 +170,7 @@ extern uschar *event_raise(uschar *, const uschar *, uschar *);
 extern void    msg_event_raise(const uschar *, const address_item *);
 #endif
 extern uschar  ehlo_response(uschar *, size_t, uschar);
+extern const uschar * exim_errstr(int);
 extern void    exim_exit(int);
 extern void    exim_nullstd(void);
 extern void    exim_setugid(uid_t, gid_t, BOOL, uschar *);
@@ -181,6 +182,7 @@ extern int     exp_bool(address_item *addr,
 extern BOOL    expand_check_condition(uschar *, uschar *, uschar *);
 extern uschar *expand_string(uschar *);	/* public, cannot make const */
 extern const uschar *expand_cstring(const uschar *); /* ... so use this one */
+extern uschar *expand_hide_passwords(uschar * );
 extern uschar *expand_string_copy(const uschar *);
 extern int_eximarith_t expand_string_integer(uschar *, BOOL);
 extern void    modify_variable(uschar *, void *);
@@ -204,7 +206,7 @@ extern void    host_build_hostlist(host_item **, const uschar *, BOOL);
 extern ip_address_item *host_build_ifacelist(const uschar *, uschar *);
 extern void    host_build_log_info(void);
 extern void    host_build_sender_fullhost(void);
-extern BOOL    host_find_byname(host_item *, const uschar *, int,
+extern int     host_find_byname(host_item *, const uschar *, int,
 				const uschar **, BOOL);
 extern int     host_find_bydns(host_item *, const uschar *, int, uschar *, uschar *,
                  uschar *, const dnssec_domains *, const uschar **, BOOL *);
@@ -224,7 +226,7 @@ extern uschar *imap_utf7_encode(uschar *, const uschar *,
 extern void    invert_address(uschar *, uschar *);
 extern int     ip_addr(void *, int, const uschar *, int);
 extern int     ip_bind(int, int, uschar *, int);
-extern int     ip_connect(int, int, const uschar *, int, int);
+extern int     ip_connect(int, int, const uschar *, int, int, BOOL);
 extern int     ip_connectedsocket(int, const uschar *, int, int,
                  int, host_item *, uschar **);
 extern int     ip_get_address_family(int);
@@ -243,6 +245,8 @@ extern int     log_create(uschar *);
 extern int     log_create_as_exim(uschar *);
 extern void    log_close_all(void);
 
+extern macro_item * macro_create(const uschar *, const uschar *, BOOL, BOOL);
+extern void    mainlog_close(void);
 #ifdef WITH_CONTENT_SCAN
 extern int     malware(const uschar *, int);
 extern int     malware_in_file(uschar *);
@@ -280,7 +284,7 @@ extern BOOL    moan_to_sender(int, error_block *, header_line *, FILE *, BOOL);
 extern void    moan_write_from(FILE *);
 extern FILE   *modefopen(const uschar *, const char *, mode_t);
 
-extern void   open_cutthrough_connection( address_item * addr );
+extern int     open_cutthrough_connection( address_item * addr );
 
 extern uschar *parse_extract_address(uschar *, uschar **, int *, int *, int *,
                  BOOL);
@@ -312,7 +316,10 @@ extern BOOL    readconf_depends(driver_instance *, uschar *);
 extern void    readconf_driver_init(uschar *, driver_instance **,
                  driver_info *, int, void *, int, optionlist *, int);
 extern uschar *readconf_find_option(void *);
-extern void    readconf_main(void);
+extern void    readconf_main(BOOL);
+extern void    readconf_options_from_list(optionlist *, unsigned, uschar *);
+extern void    readconf_options_routers(void);
+extern void    readconf_options_transports(void);
 extern void    readconf_print(uschar *, uschar *, BOOL);
 extern uschar *readconf_printtime(int);
 extern uschar *readconf_readname(uschar *, int, uschar *);
@@ -370,9 +377,9 @@ extern int     search_findtype_partial(const uschar *, int *, const uschar **, i
 extern void   *search_open(uschar *, int, int, uid_t *, gid_t *);
 extern void    search_tidyup(void);
 extern void    set_process_info(const char *, ...) PRINTF_FUNCTION(1,2);
-extern void    sha1_end(sha1 *, const uschar *, int, uschar *);
-extern void    sha1_mid(sha1 *, const uschar *);
-extern void    sha1_start(sha1 *);
+extern void    sha1_end(hctx *, const uschar *, int, uschar *);
+extern void    sha1_mid(hctx *, const uschar *);
+extern void    sha1_start(hctx *);
 extern int     sieve_interpret(uschar *, int, uschar *, uschar *, uschar *,
                  uschar *, address_item **, uschar **);
 extern void    sigalrm_handler(int);
@@ -389,6 +396,7 @@ extern BOOL    smtp_get_interface(uschar *, int, address_item *,
                  uschar **, uschar *);
 extern BOOL    smtp_get_port(uschar *, address_item *, int *, uschar *);
 extern int     smtp_getc(void);
+extern void    smtp_get_cache(void);
 extern int     smtp_handle_acl_fail(int, int, uschar *, uschar *);
 extern void    smtp_log_no_mail(void);
 extern void    smtp_message_code(uschar **, int *, uschar **, uschar **, BOOL);
@@ -406,7 +414,10 @@ extern int     spam(const uschar **);
 extern FILE   *spool_mbox(unsigned long *, const uschar *);
 #endif
 extern BOOL    spool_move_message(uschar *, uschar *, uschar *, uschar *);
-extern BOOL    spool_open_datafile(uschar *);
+extern uschar *spool_dname(const uschar *, uschar *);
+extern uschar *spool_fname(const uschar *, const uschar *, const uschar *, const uschar *);
+extern uschar *spool_sname(const uschar *, uschar *);
+extern int     spool_open_datafile(uschar *);
 extern int     spool_open_temp(uschar *);
 extern int     spool_read_header(uschar *, BOOL, BOOL);
 extern int     spool_write_header(uschar *, int, uschar **);
@@ -418,7 +429,9 @@ extern uschar *string_append(uschar *, int *, int *, int, ...);
 extern uschar *string_append_listele(uschar *, uschar, const uschar *);
 extern uschar *string_append_listele_n(uschar *, uschar, const uschar *, unsigned);
 extern uschar *string_base62(unsigned long int);
-extern uschar *string_cat(uschar *, int *, int *, const uschar *, int);
+extern uschar *string_cat(uschar *, int *, int *, const uschar *);
+extern uschar *string_catn(uschar *, int *, int *, const uschar *, int);
+extern int     string_compare_by_pointer(const void *, const void *);
 extern uschar *string_copy_dnsdomain(uschar *);
 extern uschar *string_copy_malloc(const uschar *);
 extern uschar *string_copylc(const uschar *);
@@ -431,7 +444,6 @@ extern int     string_is_ip_address(const uschar *, int *);
 #ifdef SUPPORT_I18N
 extern BOOL    string_is_utf8(const uschar *);
 #endif
-extern uschar *string_log_address(address_item *, BOOL, BOOL);
 extern uschar *string_nextinlist(const uschar **, int *, uschar *, int);
 extern uschar *string_open_failed(int, const char *, ...) PRINTF_FUNCTION(2,3);
 extern const uschar *string_printing2(const uschar *, BOOL);
@@ -463,10 +475,9 @@ extern BOOL    transport_set_up_command(const uschar ***, uschar *,
 extern void    transport_update_waiting(host_item *, uschar *);
 extern BOOL    transport_write_block(int, uschar *, int);
 extern BOOL    transport_write_string(int, const char *, ...);
-extern BOOL    transport_headers_send(address_item *, int, uschar *, uschar *,
-                 BOOL (*)(int, uschar *, int, BOOL), BOOL, rewrite_rule *, int);
-extern BOOL    transport_write_message(address_item *, int, int, int, uschar *,
-                 uschar *, uschar *, uschar *, rewrite_rule *, int);
+extern BOOL    transport_headers_send(int, transport_ctx *,
+                 BOOL (*)(int, transport_ctx *, uschar *, int));
+extern BOOL    transport_write_message(int, transport_ctx *, int);
 extern void    tree_add_duplicate(uschar *, address_item *);
 extern void    tree_add_nonrecipient(uschar *);
 extern void    tree_add_unusable(host_item *);
diff --git a/src/src/globals.c b/src/src/globals.c
index adf87380e..b862015a2 100644
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* All the global variables are defined together in this one module, so
@@ -35,7 +35,7 @@ optionlist optionlist_auths[] = {
                  (void *)(offsetof(auth_instance, set_id)) }
 };
 
-int     optionlist_auths_size = sizeof(optionlist_auths)/sizeof(optionlist);
+int     optionlist_auths_size = nelem(optionlist_auths);
 
 /* An empty host aliases list. */
 
@@ -138,15 +138,11 @@ tls_support tls_out = {
 uschar *dsn_envid              = NULL;
 int     dsn_ret                = 0;
 const pcre  *regex_DSN         = NULL;
-BOOL    smtp_use_dsn           = FALSE;
 uschar *dsn_advertise_hosts    = NULL;
 
 #ifdef SUPPORT_TLS
 BOOL    gnutls_compat_mode     = FALSE;
 BOOL    gnutls_allow_auto_pkcs11 = FALSE;
-uschar *gnutls_require_mac     = NULL;
-uschar *gnutls_require_kx      = NULL;
-uschar *gnutls_require_proto   = NULL;
 uschar *openssl_options        = NULL;
 const pcre *regex_STARTTLS     = NULL;
 uschar *tls_advertise_hosts    = US"*";
@@ -161,7 +157,6 @@ uschar *tls_eccurve            = US"prime256v1";
 # ifndef DISABLE_OCSP
 uschar *tls_ocsp_file          = NULL;
 # endif
-BOOL    tls_offered            = FALSE;
 uschar *tls_privatekey         = NULL;
 BOOL    tls_remember_esmtp     = FALSE;
 uschar *tls_require_ciphers    = NULL;
@@ -188,7 +183,10 @@ incoming TCP/IP. The defaults use stdin. We never need these for any
 stand-alone tests. */
 
 #ifndef STAND_ALONE
+int (*lwr_receive_getc)(void)  = stdin_getc;
+int (*lwr_receive_ungetc)(int) = stdin_ungetc;
 int (*receive_getc)(void)      = stdin_getc;
+void (*receive_get_cache)(void)= NULL;
 int (*receive_ungetc)(int)     = stdin_ungetc;
 int (*receive_feof)(void)      = stdin_feof;
 int (*receive_ferror)(void)    = stdin_ferror;
@@ -322,6 +320,7 @@ uschar *acl_wherecodes[]       = { US"550",     /* RCPT */
 BOOL    active_local_from_check = FALSE;
 BOOL    active_local_sender_retain = FALSE;
 BOOL    accept_8bitmime        = TRUE; /* deliberately not RFC compliant */
+uschar *add_environment        = NULL;
 address_item  *addr_duplicate  = NULL;
 
 address_item address_defaults = {
@@ -489,14 +488,22 @@ int     callout_cache_positive_expire = 24*60*60;
 int     callout_cache_negative_expire = 2*60*60;
 uschar *callout_random_local_part = US"$primary_hostname-$tod_epoch-testing";
 uschar *check_dns_names_pattern= US"(?i)^(?>(?(1)\\.|())[^\\W](?>[a-z0-9/_-]*[^\\W])?)+(\\.?)$";
-int     check_log_inodes       = 0;
-int     check_log_space        = 0;
+int     check_log_inodes       = 100;
+int     check_log_space        = 10*1024;	/* 10K Kbyte == 10MB */
 BOOL    check_rfc2047_length   = TRUE;
-int     check_spool_inodes     = 0;
-int     check_spool_space      = 0;
-uschar	*client_authenticator  = NULL;
-uschar	*client_authenticated_id = NULL;
-uschar	*client_authenticated_sender = NULL;
+int     check_spool_inodes     = 100;
+int     check_spool_space      = 10*1024;	/* 10K Kbyte == 10MB */
+
+uschar *chunking_advertise_hosts = US"*";
+unsigned chunking_datasize     = 0;
+unsigned chunking_data_left    = 0;
+BOOL    chunking_offered       = FALSE;
+chunking_state_t chunking_state= CHUNKING_NOT_OFFERED;
+const pcre *regex_CHUNKING     = NULL;
+
+uschar *client_authenticator   = NULL;
+uschar *client_authenticated_id = NULL;
+uschar *client_authenticated_sender = NULL;
 int     clmacro_count          = 0;
 uschar *clmacros[MAX_CLMACROS];
 BOOL    config_changed         = FALSE;
@@ -505,6 +512,8 @@ uschar *config_filename        = NULL;
 int     config_lineno          = 0;
 #ifdef CONFIGURE_GROUP
 gid_t   config_gid             = CONFIGURE_GROUP;
+#else
+gid_t   config_gid             = 0;
 #endif
 uschar *config_main_filelist   = US CONFIGURE_FILE
                          "\0<-----------Space to patch configure_filename->";
@@ -513,6 +522,8 @@ uschar *config_main_directory  = NULL;
 
 #ifdef CONFIGURE_OWNER
 uid_t   config_uid             = CONFIGURE_OWNER;
+#else
+uid_t   config_uid             = 0;
 #endif
 
 int     connection_max_messages= -1;
@@ -525,6 +536,7 @@ uschar *continue_transport     = NULL;
 uschar *csa_status             = NULL;
 cut_t   cutthrough = {
   FALSE,				/* delivery: when to attempt */
+  FALSE,				/* on defer: spool locally */
   -1,					/* fd: open connection */
   0,					/* nrcpt: number of addresses */
 };
@@ -625,11 +637,6 @@ uschar *deliver_selectstring   = NULL;
 BOOL    deliver_selectstring_regex = FALSE;
 uschar *deliver_selectstring_sender = NULL;
 BOOL    deliver_selectstring_sender_regex = FALSE;
-#ifdef WITH_OLD_DEMIME
-int     demime_errorlevel      = 0;
-int     demime_ok              = 0;
-uschar *demime_reason          = NULL;
-#endif
 BOOL    disable_callout_flush  = FALSE;
 BOOL    disable_delay_flush    = FALSE;
 #ifdef ENABLE_DISABLE_FSYNC
@@ -728,9 +735,6 @@ uschar *filter_test_sfile      = NULL;
 uschar *filter_test_ufile      = NULL;
 uschar *filter_thisaddress     = NULL;
 int     finduser_retries       = 0;
-#ifdef WITH_OLD_DEMIME
-uschar *found_extension        = NULL;
-#endif
 uid_t   fixed_never_users[]    = { FIXED_NEVER_USERS };
 uschar *freeze_tell            = NULL;
 uschar *freeze_tell_config     = NULL;
@@ -797,6 +801,7 @@ BOOL    ignore_fromline_local  = FALSE;
 uschar *ignore_fromline_hosts  = NULL;
 BOOL    inetd_wait_mode        = FALSE;
 int     inetd_wait_timeout     = -1;
+uschar *initial_cwd            = NULL;
 uschar *interface_address      = NULL;
 int     interface_port         = -1;
 BOOL    is_inetd               = FALSE;
@@ -804,6 +809,8 @@ uschar *iterate_item           = NULL;
 
 int     journal_fd             = -1;
 
+uschar *keep_environment       = NULL;
+
 int     keep_malformed         = 4*24*60*60;    /* 4 days */
 
 uschar *eldap_dn               = NULL;
@@ -868,6 +875,7 @@ bit_table log_options[]        = { /* must be in alphabetical order */
   BIT_TABLE(L, deliver_time),
   BIT_TABLE(L, delivery_size),
   BIT_TABLE(L, dnslist_defer),
+  BIT_TABLE(L, dnssec),
   BIT_TABLE(L, etrn),
   BIT_TABLE(L, host_lookup_failed),
   BIT_TABLE(L, ident_timeout),
@@ -921,6 +929,8 @@ int     lookup_open_max        = 25;
 uschar *lookup_value           = NULL;
 
 macro_item  *macros            = NULL;
+macro_item  *mlast             = NULL;
+BOOL    macros_builtin_created = FALSE;
 uschar *mailstore_basename     = NULL;
 #ifdef WITH_CONTENT_SCAN
 uschar *malware_name           = NULL;  /* Virus Name */
@@ -980,6 +990,9 @@ BOOL    no_mbox_unspool        = FALSE;
 #endif
 BOOL    no_multiline_responses = FALSE;
 
+const int on                   = 1;	/* for setsockopt */
+const int off                  = 0;
+
 uid_t   original_euid;
 gid_t   originator_gid;
 uschar *originator_login       = NULL;
@@ -1024,6 +1037,7 @@ BOOL    queue_2stage           = FALSE;
 uschar *queue_domains          = NULL;
 int     queue_interval         = -1;
 BOOL    queue_list_requires_admin = TRUE;
+uschar *queue_name             = US"";
 BOOL    queue_only             = FALSE;
 uschar *queue_only_file        = NULL;
 int     queue_only_load        = -1;
@@ -1034,7 +1048,7 @@ BOOL    queue_run_first_delivery = FALSE;
 BOOL    queue_run_force        = FALSE;
 BOOL    queue_run_in_order     = FALSE;
 BOOL    queue_run_local        = FALSE;
-int     queue_run_max          = 5;
+uschar *queue_run_max          = US"5";
 pid_t   queue_run_pid          = (pid_t)0;
 int     queue_run_pipe         = -1;
 BOOL    queue_running          = FALSE;
@@ -1316,8 +1330,8 @@ int     smtp_rlr_base          = 0;
 double  smtp_rlr_factor        = 0.0;
 int     smtp_rlr_limit         = 0;
 int     smtp_rlr_threshold     = INT_MAX;
-BOOL    smtp_use_pipelining    = FALSE;
-BOOL    smtp_use_size          = FALSE;
+unsigned smtp_peer_options     = 0;
+unsigned smtp_peer_options_wrap= 0;
 #ifdef SUPPORT_I18N
 uschar *smtputf8_advertise_hosts = US"*";	/* overridden under test-harness */
 #endif
@@ -1370,6 +1384,7 @@ BOOL    suppress_local_fixups_default = FALSE;
 BOOL    synchronous_delivery   = FALSE;
 BOOL    syslog_duplication     = TRUE;
 int     syslog_facility        = LOG_MAIL;
+BOOL    syslog_pid             = TRUE;
 uschar *syslog_processname     = US"exim";
 BOOL    syslog_timestamp       = TRUE;
 uschar *system_filter          = NULL;
@@ -1503,8 +1518,8 @@ uschar *uucp_from_sender       = US"$1";
 
 uschar *verify_mode	       = NULL;
 uschar *version_copyright      =
- US"Copyright (c) University of Cambridge, 1995 - 2015\n"
-   "(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2015";
+ US"Copyright (c) University of Cambridge, 1995 - 2016\n"
+   "(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2016";
 uschar *version_date           = US"?";
 uschar *version_cnumber        = US"????";
 uschar *version_string         = US"?";
diff --git a/src/src/globals.h b/src/src/globals.h
index 7f6537a9a..b3747a84a 100644
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Almost all the global variables are defined together in this one header, so
@@ -108,9 +108,6 @@ extern tls_support tls_out;
 #ifdef SUPPORT_TLS
 extern BOOL    gnutls_compat_mode;     /* Less security, more compatibility */
 extern BOOL    gnutls_allow_auto_pkcs11; /* Let GnuTLS autoload PKCS11 modules */
-extern uschar *gnutls_require_mac;     /* So some can be avoided */
-extern uschar *gnutls_require_kx;      /* So some can be avoided */
-extern uschar *gnutls_require_proto;   /* So some can be avoided */
 extern uschar *openssl_options;        /* OpenSSL compatibility options */
 extern const pcre *regex_STARTTLS;     /* For recognizing STARTTLS settings */
 extern uschar *tls_certificate;        /* Certificate file */
@@ -122,7 +119,6 @@ extern uschar *tls_eccurve;            /* EC curve */
 # ifndef DISABLE_OCSP
 extern uschar *tls_ocsp_file;          /* OCSP stapling proof file */
 # endif
-extern BOOL    tls_offered;            /* Server offered TLS */
 extern uschar *tls_privatekey;         /* Private key file */
 extern BOOL    tls_remember_esmtp;     /* For YAEB */
 extern uschar *tls_require_ciphers;    /* So some can be avoided */
@@ -135,13 +131,15 @@ extern uschar *tls_advertise_hosts;    /* host for which TLS is advertised */
 extern uschar  *dsn_envid;             /* DSN envid string */
 extern int      dsn_ret;               /* DSN ret type*/
 extern const pcre  *regex_DSN;         /* For recognizing DSN settings */
-extern BOOL     smtp_use_dsn;          /* Global for passed connections */
 extern uschar  *dsn_advertise_hosts;   /* host for which TLS is advertised */
 
 /* Input-reading functions for messages, so we can use special ones for
 incoming TCP/IP. */
 
+extern int (*lwr_receive_getc)(void);
+extern int (*lwr_receive_ungetc)(int);
 extern int (*receive_getc)(void);
+extern void (*receive_get_cache)(void);
 extern int (*receive_ungetc)(int);
 extern int (*receive_feof)(void);
 extern int (*receive_ferror)(void);
@@ -157,6 +155,7 @@ extern const uschar **address_expansions[ADDRESS_EXPANSIONS_COUNT];
 /* General global variables */
 
 extern BOOL    accept_8bitmime;        /* Allow *BITMIME incoming */
+extern uschar *add_environment;        /* List of environment variables to add */
 extern header_line *acl_added_headers; /* Headers added by an ACL */
 extern tree_node *acl_anchor;          /* Tree of named ACLs */
 extern uschar *acl_arg[9];             /* Argument to ACL call */
@@ -193,7 +192,7 @@ extern uschar *acl_smtp_starttls;      /* ACL run for STARTTLS */
 extern uschar *acl_smtp_vrfy;          /* ACL run for VRFY */
 extern BOOL    acl_temp_details;       /* TRUE to give details for 4xx error */
 extern tree_node *acl_var_c;           /* ACL connection variables */
-extern tree_node *acl_var_m;           /* ACL messsage variables */
+extern tree_node *acl_var_m;           /* ACL message variables */
 extern uschar *acl_verify_message;     /* User message for verify failure */
 extern string_item *acl_warn_logged;   /* Logged lines */
 extern uschar *acl_wherecodes[];       /* Response codes for ACL fails */
@@ -269,6 +268,11 @@ extern int     check_log_space;        /* Minimum for message acceptance */
 extern BOOL    check_rfc2047_length;   /* Check RFC 2047 encoded string length */
 extern int     check_spool_inodes;     /* Minimum for message acceptance */
 extern int     check_spool_space;      /* Minimum for message acceptance */
+extern uschar *chunking_advertise_hosts;    /* RFC 3030 CHUNKING */
+extern unsigned chunking_datasize;
+extern unsigned chunking_data_left;
+extern BOOL    chunking_offered;
+extern chunking_state_t chunking_state;
 extern uschar *client_authenticator;        /* Authenticator name used for smtp delivery */
 extern uschar *client_authenticated_id;     /* "login" name used for SMTP AUTH */
 extern uschar *client_authenticated_sender; /* AUTH option to SMTP MAIL FROM (not yet used) */
@@ -278,16 +282,12 @@ extern int     connection_max_messages;/* Max down one SMTP connection */
 extern BOOL    config_changed;         /* True if -C used */
 extern FILE   *config_file;            /* Configuration file */
 extern uschar *config_filename;        /* Configuration file name */
-#ifdef CONFIGURE_GROUP
 extern gid_t   config_gid;             /* Additional group owner */
-#endif
 extern int     config_lineno;          /* Line number */
 extern uschar *config_main_filelist;   /* List of possible config files */
 extern uschar *config_main_filename;   /* File name actually used */
 extern uschar *config_main_directory;  /* Directory where the main config file was found */
-#ifdef CONFIGURE_OWNER
 extern uid_t   config_uid;             /* Additional owner */
-#endif
 extern uschar *continue_hostname;      /* Host for continued delivery */
 extern uschar *continue_host_address;  /* IP address for ditto */
 extern BOOL    continue_more;          /* Flag more addresses waiting */
@@ -297,7 +297,8 @@ extern uschar *continue_transport;     /* Transport for continued delivery */
 extern uschar *csa_status;             /* Client SMTP Authorization result */
 
 typedef struct {
-  BOOL         delivery;               /* When to attempt */
+  unsigned     delivery:1;             /* When to attempt */
+  unsigned     defer_pass:1;           /* Pass 4xx to caller rather than spoolling */
   int          fd;                     /* Open connection */
   int          nrcpt;                  /* Count of addresses */
   uschar *     interface;              /* (address of) */
@@ -362,11 +363,6 @@ extern uschar *deliver_selectstring;   /* For selecting by recipient */
 extern BOOL    deliver_selectstring_regex; /* String is regex */
 extern uschar *deliver_selectstring_sender; /* For selecting by sender */
 extern BOOL    deliver_selectstring_sender_regex; /* String is regex */
-#ifdef WITH_OLD_DEMIME
-extern int     demime_errorlevel;      /* Severity of MIME error */
-extern int     demime_ok;              /* Nonzero if message has been demimed */
-extern uschar *demime_reason;          /* Reason for broken MIME container */
-#endif
 extern BOOL    disable_callout_flush;  /* Don't flush before callouts */
 extern BOOL    disable_delay_flush;    /* Don't flush before "delay" in ACL */
 #ifdef ENABLE_DISABLE_FSYNC
@@ -426,7 +422,7 @@ extern BOOL    drop_cr;                /* For broken local MUAs */
 extern uschar *dsn_from;               /* From: string for DSNs */
 
 extern BOOL    enable_dollar_recipients; /* Make $recipients available */
-extern int     envelope_to_remove;     /* Remove envelope_to_headers */
+extern BOOL    envelope_to_remove;     /* Remove envelope_to_headers */
 extern int     errno_quota;            /* Quota errno in this OS */
 extern int     error_handling;         /* Error handling style */
 extern uschar *errors_copy;            /* For taking copies of errors */
@@ -465,9 +461,6 @@ extern uschar *filter_test_ufile;      /* User filter test file */
 extern uschar *filter_thisaddress;     /* For address looping */
 extern int     finduser_retries;       /* Retry count for getpwnam() */
 extern uid_t   fixed_never_users[];    /* Can't be overridden */
-#ifdef WITH_OLD_DEMIME
-extern uschar *found_extension;        /* demime acl condition: file extension found */
-#endif
 extern uschar *freeze_tell;            /* Message on (some) freezings */
 extern uschar *freeze_tell_config;     /* The configured setting */
 extern uschar *fudged_queue_times;     /* For use in test harness */
@@ -512,11 +505,13 @@ extern BOOL    ignore_fromline_local;  /* Local SMTP ignore fromline */
 extern uschar *ignore_fromline_hosts;  /* Hosts permitted to send "From " */
 extern BOOL    inetd_wait_mode;        /* Whether running in inetd wait mode */
 extern int     inetd_wait_timeout;     /* Timeout for inetd wait mode */
+extern uschar *initial_cwd;            /* The directory we where in at startup */
 extern BOOL    is_inetd;               /* True for inetd calls */
 extern uschar *iterate_item;           /* Item from iterate list */
 
 extern int     journal_fd;             /* Fd for journal file */
 
+extern uschar *keep_environment;       /* Whitelist for environment variables */
 extern int     keep_malformed;         /* Time to keep malformed messages */
 
 extern uschar *eldap_dn;               /* Where LDAP DNs are left */
@@ -555,6 +550,8 @@ extern int     lookup_open_max;        /* Max lookup files to cache */
 extern uschar *lookup_value;           /* Value looked up from file */
 
 extern macro_item *macros;             /* Configuration macros */
+extern macro_item *mlast;              /* Last item in macro list */
+extern BOOL    macros_builtin_created; /* Flag for lazy-create */
 extern uschar *mailstore_basename;     /* For mailstore deliveries */
 #ifdef WITH_CONTENT_SCAN
 extern uschar *malware_name;           /* Name of virus or malware ("W32/Klez-H") */
@@ -614,6 +611,9 @@ extern BOOL    no_mbox_unspool;        /* don't unlink files in /scan directory
 #endif
 extern BOOL    no_multiline_responses; /* For broken clients */
 
+extern const int on;                   /* For setsockopt */
+extern const int off;
+
 extern optionlist optionlist_auths[];      /* These option lists are made */
 extern int     optionlist_auths_size;      /* global so that readconf can */
 extern optionlist optionlist_routers[];    /* see them for printing out   */
@@ -674,6 +674,7 @@ extern BOOL    queue_running;          /* TRUE for queue running process and */
 extern pid_t   queue_run_pid;          /* PID of the queue running process or 0 */
 extern int     queue_run_pipe;         /* Pipe for synchronizing */
 extern int     queue_interval;         /* Queue running interval */
+extern uschar *queue_name;             /* Name of queue, if nondefault spooling */
 extern BOOL    queue_only;             /* TRUE to disable immediate delivery */
 extern int     queue_only_load;        /* Max load before auto-queue */
 extern BOOL    queue_only_load_latch;  /* Latch queue_only_load TRUE */
@@ -681,7 +682,7 @@ extern uschar *queue_only_file;        /* Queue if file exists/not-exists */
 extern BOOL    queue_only_override;    /* Allow override from command line */
 extern BOOL    queue_only_policy;      /* ACL or local_scan wants queue_only */
 extern BOOL    queue_run_in_order;     /* As opposed to random */
-extern int     queue_run_max;          /* Max queue runners */
+extern uschar *queue_run_max;          /* Max queue runners */
 extern BOOL    queue_smtp;             /* Disable all immediate STMP (-odqs)*/
 extern uschar *queue_smtp_domains;     /* Ditto, for these domains */
 
@@ -714,10 +715,11 @@ extern uschar *recipient_verify_failure; /* What went wrong */
 extern BOOL    recipients_discarded;   /* By an ACL */
 extern int     recipients_list_max;    /* Maximum number fitting in list */
 extern int     recipients_max;         /* Max permitted */
-extern int     recipients_max_reject;  /* If TRUE, reject whole message */
+extern BOOL    recipients_max_reject;  /* If TRUE, reject whole message */
 extern const pcre *regex_AUTH;         /* For recognizing AUTH settings */
 extern const pcre  *regex_check_dns_names; /* For DNS name checking */
 extern const pcre  *regex_From;        /* For recognizing "From_" lines */
+extern const pcre  *regex_CHUNKING;    /* For recognizing CHUNKING (RFC 3030) */
 extern const pcre  *regex_IGNOREQUOTA; /* For recognizing IGNOREQUOTA (LMTP) */
 extern const pcre  *regex_PIPELINING;  /* For recognizing PIPELINING */
 extern const pcre  *regex_SIZE;        /* For recognizing SIZE settings */
@@ -836,8 +838,8 @@ extern int     smtp_rlr_base;          /* Base interval for RCPT rate limit */
 extern double  smtp_rlr_factor;        /* Factor for RCPT rate limit */
 extern int     smtp_rlr_limit;         /* Max delay */
 extern int     smtp_rlr_threshold;     /* Threshold for RCPT rate limit */
-extern BOOL    smtp_use_pipelining;    /* Global for passed connections */
-extern BOOL    smtp_use_size;          /* Global for passed connections */
+extern unsigned smtp_peer_options;     /* Global flags for passed connections */
+extern unsigned smtp_peer_options_wrap; /* stacked version hidden by TLS */
 #ifdef SUPPORT_I18N
 extern uschar *smtputf8_advertise_hosts; /* ingress control */
 #endif
@@ -888,6 +890,7 @@ extern BOOL    suppress_local_fixups_default; /* former is reset to this; overri
 extern BOOL    synchronous_delivery;   /* TRUE if -odi is set */
 extern BOOL    syslog_duplication;     /* FALSE => no duplicate logging */
 extern int     syslog_facility;        /* As defined by Syslog.h */
+extern BOOL    syslog_pid;             /* TRUE if PID on syslogs */
 extern uschar *syslog_processname;     /* 'ident' param to openlog() */
 extern BOOL    syslog_timestamp;       /* TRUE if time on syslogs */
 extern uschar *system_filter;          /* Name of system filter file */
diff --git a/src/src/hash.c b/src/src/hash.c
new file mode 100644
index 000000000..c2be85d17
--- /dev/null
+++ b/src/src/hash.c
@@ -0,0 +1,803 @@
+/*
+ *  Exim - an Internet mail transport agent
+ *
+ *  Copyright (C) 2016  Exim maintainers
+ *  Copyright (c) University of Cambridge 1995 - 2016
+ *
+ *  Hash interface functions
+ */
+
+#ifndef STAND_ALONE
+# include "exim.h"
+
+#else
+
+/* For stand-alone testing, we need to have the structure defined, and
+to be able to do I/O */
+
+# include <stdio.h>
+# include <stdlib.h>
+typedef unsigned char uschar;
+typedef struct sha1 {
+  unsigned int H[5];
+  unsigned int length;
+  }
+sha1;
+#endif	/*STAND_ALONE*/
+
+
+
+/******************************************************************************/
+#ifdef SHA_OPENSSL
+
+void
+exim_sha_init(hctx * h, hashmethod m)
+{
+switch (h->method = m)
+  {
+  case HASH_SHA1:   h->hashlen = 20; SHA1_Init  (&h->u.sha1); break;
+  case HASH_SHA256: h->hashlen = 32; SHA256_Init(&h->u.sha2); break;
+  default:	    h->hashlen = 0; break;
+  }
+}
+
+
+void
+exim_sha_update(hctx * h, const uschar * data, int len)
+{
+switch (h->method)
+  {
+  case HASH_SHA1:   SHA1_Update  (&h->u.sha1, data, len); break;
+  case HASH_SHA256: SHA256_Update(&h->u.sha2, data, len); break;
+  }
+}
+
+
+void
+exim_sha_finish(hctx * h, blob * b)
+{
+b->data = store_get(b->len = h->hashlen);
+switch (h->method)
+  {
+  case HASH_SHA1:   SHA1_Final  (b->data, &h->u.sha1); break;
+  case HASH_SHA256: SHA256_Final(b->data, &h->u.sha2); break;
+  }
+}
+
+
+
+#elif defined(SHA_GNUTLS)
+/******************************************************************************/
+
+void
+exim_sha_init(hctx * h, hashmethod m)
+{
+switch (h->method = m)
+  {
+  case HASH_SHA1:     h->hashlen = 20; gnutls_hash_init(&h->sha, GNUTLS_DIG_SHA1); break;
+  case HASH_SHA256:   h->hashlen = 32; gnutls_hash_init(&h->sha, GNUTLS_DIG_SHA256); break;
+#ifdef EXIM_HAVE_SHA3
+  case HASH_SHA3_256: h->hashlen = 32; gnutls_hash_init(&h->sha, GNUTLS_DIG_SHA3_256); break;
+#endif
+  default: h->hashlen = 0; break;
+  }
+}
+
+
+void
+exim_sha_update(hctx * h, const uschar * data, int len)
+{
+gnutls_hash(h->sha, data, len);
+}
+
+
+void
+exim_sha_finish(hctx * h, blob * b)
+{
+b->data = store_get(b->len = h->hashlen);
+gnutls_hash_output(h->sha, b->data);
+}
+
+
+
+#elif defined(SHA_GCRYPT)
+/******************************************************************************/
+
+void
+exim_sha_init(hctx * h, hashmethod m)
+{
+switch (h->method = m)
+  {
+  case HASH_SHA1:   h->hashlen = 20; gcry_md_open(&h->sha, GCRY_MD_SHA1, 0); break;
+  case HASH_SHA256: h->hashlen = 32; gcry_md_open(&h->sha, GCRY_MD_SHA256, 0); break;
+  default:	    h->hashlen = 0; break;
+  }
+}
+
+
+void
+exim_sha_update(hctx * h, const uschar * data, int len)
+{
+gcry_md_write(h->sha, data, len);
+}
+
+
+void
+exim_sha_finish(hctx * h, blob * b)
+{
+b->data = store_get(b->len = h->hashlen);
+memcpy(b->data, gcry_md_read(h->sha, 0), h->hashlen);
+}
+
+
+
+
+#elif defined(SHA_POLARSSL)
+/******************************************************************************/
+
+void
+exim_sha_init(hctx * h, hashmethod m)
+{
+switch (h->method = m)
+  {
+  case HASH_SHA1:   h->hashlen = 20; sha1_starts(&h->u.sha1);    break;
+  case HASH_SHA256: h->hashlen = 32; sha2_starts(&h->u.sha2, 0); break;
+  default:	    h->hashlen = 0; break;
+  }
+}
+
+
+void
+exim_sha_update(hctx * h, const uschar * data, int len)
+{
+switch (h->method)
+  {
+  case HASH_SHA1:   sha1_update(h->u.sha1, US data, len); break;
+  case HASH_SHA256: sha2_update(h->u.sha2, US data, len); break;
+  }
+}
+
+
+void
+exim_sha_finish(hctx * h, blob * b)
+{
+b->data = store_get(b->len = h->hashlen);
+switch (h->method)
+  {
+  case HASH_SHA1:   sha1_finish(h->u.sha1, b->data); break;
+  case HASH_SHA256: sha2_finish(h->u.sha2, b->data); break;
+  }
+}
+
+
+
+
+#elif defined(SHA_NATIVE)
+/******************************************************************************/
+/* Only sha-1 supported */
+
+/*************************************************
+*        Start off a new SHA-1 computation.      *
+*************************************************/
+
+/*
+Argument:  pointer to sha1 storage structure
+Returns:   nothing
+*/
+
+static void
+native_sha1_start(sha1 *base)
+{
+base->H[0] = 0x67452301;
+base->H[1] = 0xefcdab89;
+base->H[2] = 0x98badcfe;
+base->H[3] = 0x10325476;
+base->H[4] = 0xc3d2e1f0;
+base->length = 0;
+}
+
+
+
+/*************************************************
+*       Process another 64-byte block            *
+*************************************************/
+
+/* This function implements central part of the algorithm
+
+Arguments:
+  base       pointer to sha1 storage structure
+  text       pointer to next 64 bytes of subject text
+
+Returns:     nothing
+*/
+
+static void
+native_sha1_mid(sha1 *base, const uschar *text)
+{
+int i;
+uint A, B, C, D, E;
+uint W[80];
+
+base->length += 64;
+
+for (i = 0; i < 16; i++)
+  {
+  W[i] = ((uint)text[0] << 24) | (text[1] << 16) | (text[2] << 8) | text[3];
+  text += 4;
+  }
+
+for (i = 16; i < 80; i++)
+  {
+  register unsigned int x = W[i-3] ^ W[i-8] ^ W[i-14] ^ W[i-16];
+  W[i] = (x << 1) | (x >> 31);
+  }
+
+A = base->H[0];
+B = base->H[1];
+C = base->H[2];
+D = base->H[3];
+E = base->H[4];
+
+for (i = 0; i < 20; i++)
+  {
+  unsigned int T;
+  T = ((A << 5) | (A >> 27)) + ((B & C) | ((~B) & D)) + E + W[i] + 0x5a827999;
+  E = D;
+  D = C;
+  C = (B << 30) | (B >> 2);
+  B = A;
+  A = T;
+  }
+
+for (i = 20; i < 40; i++)
+  {
+  unsigned int T;
+  T = ((A << 5) | (A >> 27)) + (B ^ C ^ D) + E + W[i] + 0x6ed9eba1;
+  E = D;
+  D = C;
+  C = (B << 30) | (B >> 2);
+  B = A;
+  A = T;
+  }
+
+for (i = 40; i < 60; i++)
+  {
+  unsigned int T;
+  T = ((A << 5) | (A >> 27)) + ((B & C) | (B & D) | (C & D)) + E + W[i] +
+    0x8f1bbcdc;
+  E = D;
+  D = C;
+  C = (B << 30) | (B >> 2);
+  B = A;
+  A = T;
+  }
+
+for (i = 60; i < 80; i++)
+  {
+  unsigned int T;
+  T = ((A << 5) | (A >> 27)) + (B ^ C ^ D) + E + W[i] + 0xca62c1d6;
+  E = D;
+  D = C;
+  C = (B << 30) | (B >> 2);
+  B = A;
+  A = T;
+  }
+
+base->H[0] += A;
+base->H[1] += B;
+base->H[2] += C;
+base->H[3] += D;
+base->H[4] += E;
+}
+
+
+
+
+/*************************************************
+*     Process the final text string              *
+*************************************************/
+
+/* The string may be of any length. It is padded out according to the rules
+for computing SHA-1 digests. The final result is then converted to text form
+and returned.
+
+Arguments:
+  base      pointer to the sha1 storage structure
+  text      pointer to the final text vector
+  length    length of the final text vector
+  digest    points to 16 bytes in which to place the result
+
+Returns:    nothing
+*/
+
+static void
+native_sha1_end(sha1 *base, const uschar *text, int length, uschar *digest)
+{
+int i;
+uschar work[64];
+
+/* Process in chunks of 64 until we have less than 64 bytes left. */
+
+while (length >= 64)
+  {
+  native_sha1_mid(base, text);
+  text += 64;
+  length -= 64;
+  }
+
+/* If the remaining string contains more than 55 bytes, we must pad it
+out to 64, process it, and then set up the final chunk as 56 bytes of
+padding. If it has less than 56 bytes, we pad it out to 56 bytes as the
+final chunk. */
+
+memcpy(work, text, length);
+work[length] = 0x80;
+
+if (length > 55)
+  {
+  memset(work+length+1, 0, 63-length);
+  native_sha1_mid(base, work);
+  base->length -= 64;
+  memset(work, 0, 56);
+  }
+else
+  {
+  memset(work+length+1, 0, 55-length);
+  }
+
+/* The final 8 bytes of the final chunk are a 64-bit representation of the
+length of the input string *bits*, before padding, high order word first, and
+high order bytes first in each word. This implementation is designed for short
+strings, and so operates with a single int counter only. */
+
+length += base->length;   /* Total length in bytes */
+length <<= 3;             /* Total length in bits */
+
+work[63] = length         & 0xff;
+work[62] = (length >>  8) & 0xff;
+work[61] = (length >> 16) & 0xff;
+work[60] = (length >> 24) & 0xff;
+
+memset(work+56, 0, 4);
+
+/* Process the final 64-byte chunk */
+
+native_sha1_mid(base, work);
+
+/* Pass back the result, high-order byte first in each word. */
+
+for (i = 0; i < 5; i++)
+  {
+  register int x = base->H[i];
+  *digest++ = (x >> 24) & 0xff;
+  *digest++ = (x >> 16) & 0xff;
+  *digest++ = (x >>  8) & 0xff;
+  *digest++ =  x        & 0xff;
+  }
+}
+
+
+
+
+
+
+# ifdef notdef
+void
+exim_sha_init(hctx * h, hashmethod m)
+{
+h->hashlen = 20;
+native_sha1_start(&h->sha1);
+}
+
+
+void
+exim_sha_update(hctx * h, const uschar * data, int len)
+{
+native_sha1_mid(&h->sha1, US data);	/* implicit size always 64 */
+}
+
+
+void
+exim_sha_finish(hctx * h, blob * b)
+{
+b->data = store_get(b->len = h->hashlen);
+
+native_sha1_end(&h->sha1, NULL, 0, b->data);
+}
+# endif
+
+
+#endif
+/******************************************************************************/
+
+/* Common to all library versions */
+int
+exim_sha_hashlen(hctx * h)
+{
+return h->method == HASH_SHA1 ? 20
+     : h->method == HASH_SHA256 ? 32
+     : 0;
+}
+
+
+/******************************************************************************/
+/******************************************************************************/
+/******************************************************************************/
+/******************************************************************************/
+/* Original sha-1 interface used by crypteq{shal1},
+${sha1:} ${hmac:} and ${prvs:} */
+
+#ifdef SHA_NATIVE
+
+void
+sha1_start(hctx * h)
+{
+native_sha1_start(&h->sha1);
+}
+
+void
+sha1_mid(hctx * h, const uschar * data)
+{
+native_sha1_mid(&h->sha1, data);
+}
+
+void
+sha1_end(hctx * h, const uschar * data, int len, uschar *digest)
+{
+native_sha1_end(&h->sha1, data, len, digest);
+}
+
+#else
+
+void
+sha1_start(hctx * h)
+{
+exim_sha_init(h, HASH_SHA1);
+}
+
+void
+sha1_mid(hctx * h, const uschar * data)
+{
+exim_sha_update(h, data, 64);
+}
+
+void
+sha1_end(hctx * h, const uschar * data, int len, uschar *digest)
+{
+blob b;
+exim_sha_update(h, data, len);
+exim_sha_finish(h, &b);
+memcpy(digest, b.data, 20);
+}
+
+#endif
+
+
+
+
+
+
+/*************************************************
+**************************************************
+*             Stand-alone test program           *
+**************************************************
+*************************************************/
+
+# ifdef STAND_ALONE
+
+/* Test values. The first 128 may contain binary zeros and have increasing
+length. */
+
+static uschar *tests[] = {
+  "",
+  "\x24",
+  "\x70\xf0",
+  "\x0e\x1e\xf0",
+  "\x08\x38\x78\x8f",
+  "\x10\x3e\x08\xfc\x0f",
+  "\xe7\xc7\x1e\x07\xef\x03",
+  "\xe0\xfb\x71\xf8\xf9\xc1\xfc",
+  "\xff\x7c\x60\x3c\x1f\x80\xe2\x07",
+  "\xf0\x3f\xc8\x60\x81\xfe\x01\xf8\x7f",
+  "\x9f\xc7\xf8\x1f\xc1\xe3\xc7\xc7\x3f\x00",
+  "\x00\x7f\xbf\xdf\xc0\xfe\x02\x7e\x00\xf8\x7f",
+  "\x01\x01\xc0\x1e\x03\xf8\x30\x08\x0f\xf3\xf9\xff",
+  "\xc4\x03\xfc\x0f\xf8\x01\xc0\x0f\xf0\x06\x10\x41\xff",
+  "\xff\x07\x80\x47\xfc\x1f\xc0\x60\x30\x1f\xe0\x3c\x03\xff",
+  "\x80\x3f\x84\x3e\xff\xc0\x3f\x0f\x00\x7f\xc0\x1f\xe7\xfc\x00",
+  "\xff\xe0\x7f\x01\x81\x81\xff\x81\xff\x00\x3e\x00\x20\x7f\x80\x0f",
+  "\x00\x3e\x00\x70\x1f\xe0\x0f\xfa\xff\xc8\x3f\xf3\xfe\x00\xff\x80\xff",
+  "\x7f\xef\xc0\x1e\x7c\xff\xe0\x1f\xfe\x00\x1f\xf0\x08\xff\xc0\x7f\xf0\x00",
+  "\xe0\x0f\x80\x07\x0c\x01\xff\xe0\x03\xf0\x2f\xf8\x3f\xef\x00\x78\x01\xfe\x00",
+  "\xe7\x00\x10\x00\xf8\x18\x0f\xf0\xff\x00\xff\x80\x3f\xc3\xfe\xf0\x0f\xfc\x01\xff",
+  "\x00\x1f\xf8\x0f\xfc\x00\xfc\x00\xff\x87\xc0\x0f\x80\x7b\xff\x00\x0f\x02\x01\xff\xc0",
+  "\x00\x0f\xf0\x03\xc7\xf8\x3e\x03\xff\x80\x03\xff\x80\x07\xff\x0f\xff\x1f\x83\xff\x80\x1f",
+  "\xff\xc0\x1f\x80\x3f\x9f\xf8\x78\x3e\x7f\xf8\x00\x3e\x20\x04\x3f\x80\x7f\xfc\x00\x1f\xfe\x00",
+  "\x3f\x07\x80\xe0\x07\xe0\x00\xfc\x7f\xc0\xc0\x0f\x8f\xf0\x80\x0e\x0e\x03\xff\xbf\xfc\x01\xff\xe0",
+  "\xff\xfc\x11\xfc\xe0\x0e\x1f\xff\x87\x80\x1f\xe0\xff\xfd\xff\xc0\x03\xff\xc0\x0f\x00\x07\xf0\x01\xff",
+  "\xf0\x07\xc1\xfe\x00\xf8\x01\xe7\x80\xff\x80\x3f\x1f\x7f\x8c\x00\x1c\x00\x0f\xf8\x07\xfc\x00\xff\xfc\x00",
+  "\x00\x0f\xf8\x3f\xc0\x60\x00\x7f\xf8\xff\x00\x03\xf0\x3c\x07\xc0\x7f\xe0\x3f\xf8\x01\x00\x7e\x03\xff\xc0\x00",
+  "\x00\x0f\xf8\x03\x00\x1f\xff\x00\x0f\xfe\x00\x3f\x00\x03\xff\xe0\x07\xc0\xff\x00\x3c\x7f\xf0\x01\xff\xf8\x3f\xff",
+  "\x00\x01\xe0\xe0\x1f\xfe\x00\x03\xfc\x00\x0f\xff\xe0\x0f\xff\x00\x0e\x00\x7f\xfc\x0f\xfe\x00\x78\x00\x3f\xff\x00\xff",
+  "\x80\x41\xff\xc3\xfe\x00\x1e\x00\x0f\xff\xe0\xff\x80\x0f\xe0\x00\x7f\xf7\xff\x01\xfe\x01\xff\xdf\xff\x00\x01\xff\xe0\x00",
+  "\xf8\x07\x00\xff\xc0\x7f\xbe\x00\x0f\xff\x00\x03\xe3\xf0\xff\xf0\x00\x1f\x81\xff\x80\x0f\xff\x80\x20\x03\xf0\x03\x80\xff\xfc",
+  "\x00\x38\x20\x00\x7f\xf0\x01\xff\xfe\xcf\xfe\x07\xff\xc0\x00\x7f\xf8\x1f\x00\x00\xc0\x00\xc0\x0f\xff\x3e\x0f\xc0\x0f\xff\x80\x00",
+  "\x1f\xf8\x07\xff\xf8\x03\xe0\x01\xff\xfc\x3f\xf8\x00\x38\x1f\x00\x3f\xdc\x01\xc0\x04\xff\xff\x00\x0f\xfc\x08\x02\x00\x01\xf0\x3f\xff",
+  "\x80\x07\x86\x00\x03\xff\xe0\x00\x3f\xf8\x00\x0f\x80\x0f\xf8\x0f\xff\xe0\x00\x1f\x80\x00\x7f\xf8\xc0\x0f\xff\xf0\x7c\x04\x07\xff\x00\x00",
+  "\x01\xff\x00\x18\x3e\x0f\x00\x07\xff\xc0\x00\xf0\x1f\xfe\x07\x80\x60\x0f\xf8\x00\x3f\xfe\x38\x1f\xc0\x00\x3f\x81\xff\xfc\x1f\xe0\x00\x3f\xff",
+  "\xf0\x3f\xff\xc0\x00\x7f\xf0\x00\x3f\xff\x0f\xe0\x07\x0f\xfc\x7e\x03\xff\xf0\xfc\x0f\x9f\xc0\x3f\xff\xcf\xff\x00\x00\xff\xc0\x00\xe7\x01\xff\xf8",
+  "\x00\x01\xff\x80\x20\x00\x7f\xe0\x00\x7e\x07\xff\xf8\xc7\xf8\xff\xf0\x0f\xfe\x00\x00\xe0\x0f\xe0\x00\x1f\xff\x87\xff\x00\x01\xf0\x00\x7f\xc1\xff\xff",
+  "\x00\x00\x7f\xff\xc0\x01\xfe\x7e\x01\xff\xfe\xff\xf0\x7f\xff\xcf\xf8\x07\xfe\x00\x0f\xff\xc0\x07\xff\xfc\x00\x3e\x00\x07\xfc\x00\x7f\xc0\x07\x80\x0f\xff",
+  "\xff\xff\x03\xff\x07\xf8\xff\xff\x80\x00\x7f\xfe\xff\xfe\x00\x03\xff\xf8\x1f\xff\x3f\xf8\x1f\xff\x00\x1f\xff\x0f\xc0\x7f\xf0\x01\xff\xe0\x00\x1f\xff\x00\x00",
+  "\xff\xff\x00\x00\xff\xfc\x00\x03\x0f\xff\xf0\x01\xf8\x00\x0f\xe1\xff\xff\x03\xe0\x3f\x1f\xff\x80\x00\x7c\x00\x01\xff\xc0\x01\x7f\xfe\x00\x0e\x07\xff\xe0\xff\xff",
+  "\xc0\x00\x3f\xfe\x03\xfc\x0c\x00\x04\x01\xff\xe1\xe0\x03\xff\xe0\x30\x01\xff\x00\x00\x3c\x1e\x01\x80\x01\xff\x00\x40\x3f\xfe\x00\x3f\xff\x80\x7c\x01\xff\x80\x00\x7f",
+  "\x3f\xa0\x00\x0f\xff\x81\xff\xc0\x0f\xf0\x7f\xf8\x00\x0f\xc0\x00\x7f\xe0\x01\xe0\x00\x04\xff\x00\x1f\xfe\x00\x01\xff\x80\x07\xff\xfe\x00\x3f\xff\xc0\x03\xff\x80\x00\x3f",
+  "\xf0\x1f\xff\x01\xff\x80\xff\xc0\x80\x07\xf0\x00\x03\xff\x80\x00\x18\x01\xff\xfc\x00\xff\xfc\x03\xff\xff\x00\x7f\xc0\x03\xff\xc7\xff\xc0\x03\xf0\xff\x80\x00\x3f\xfe\x00\x00",
+  "\x07\xf1\xbf\xff\xe0\x00\x78\x00\x07\xe0\x00\x80\x03\xf0\x3f\xf7\x00\x00\x38\x00\xfe\x00\xf8\x0f\xfe\x00\x00\x80\x3f\xff\xc1\xff\xfc\x00\xff\xff\x8f\xf0\x00\x1f\xff\xf0\x0f\xff",
+  "\x00\x1c\x00\x07\xff\xfc\x00\x5e\x3f\xff\x00\x00\x3c\xff\xff\xc0\x3f\xff\x81\xe0\x70\x00\x1f\xfc\x00\x03\xff\x00\x00\x7f\xff\xc0\x1f\x8c\x0f\xff\xf0\xff\x80\x07\xe0\x10\x01\xff\xff",
+  "\xc0\x00\x07\xff\x80\x7f\xff\x80\x01\x80\x3f\xff\xcf\xc0\xfe\x00\xff\xc0\x1f\xfc\x01\xff\xf8\x00\xff\xfe\x0f\xff\xf0\x06\x00\x00\xc0\x3f\xff\x80\x78\xff\xfc\x00\x0f\xff\xf0\x00\x0f\xff",
+  "\xff\xe0\x07\xff\xf8\x00\x7f\xf0\x1f\xff\x80\x01\xff\xf8\x1f\xf8\x01\x03\xff\xe0\x00\x03\xe0\x78\x0f\xff\x00\x0f\xfc\x1f\xf8\x00\x0f\xff\xe0\x1f\x00\x07\xff\xfc\x00\x1f\x03\xff\xf7\xff\xff",
+  "\xc0\xf8\x00\x03\xfe\x00\x3f\xff\xf0\x00\x03\xfc\x0f\xff\x80\x00\xe3\xff\xf8\x3f\xfe\x00\x00\x73\xe0\xff\xfc\x07\xff\xc3\xff\xfe\x03\x00\x00\x70\x00\x03\xff\xf8\x0f\xff\xe0\x00\x1f\xff\xf8\x00",
+  "\xff\xf0\x0f\xc7\xff\xfc\x00\x3f\xfe\x00\x00\x3f\xff\x80\x3f\x80\x00\x3f\xff\xc0\x00\x70\x01\xff\xc1\x80\x03\xff\xff\x80\x00\x61\xff\xfe\x03\xfd\x80\x3f\xff\xe0\x01\xc1\xff\xff\x80\x00\x0f\xfe\x00",
+  "\xff\xfc\x00\x03\xff\xf0\x0f\xf8\x00\x07\xdf\x8f\xff\xf8\x00\x01\xff\xfe\x00\x80\x00\xff\x80\x1f\xf0\x00\x01\x1c\x00\x00\x3f\xf8\x00\x3f\xff\xef\xff\xfe\x01\xc3\x80\x80\x01\xff\xff\xc0\x00\x07\xff\xff",
+  "\xff\xff\xc0\x01\xff\xc1\xff\xff\x87\xff\xff\x00\x3f\x00\x00\x1f\xfc\x00\x01\xff\x80\x1f\xc0\x1f\xff\x00\x00\xff\x80\x1f\xff\xf8\x7f\xf8\x3f\xff\xc1\xff\xff\xe0\x01\xc0\x3f\xf7\xff\xfe\xfc\x00\x00\x3f\xff",
+  "\x00\xff\x81\xff\xe0\x03\xf8\x0e\x00\x00\xff\xf8\x1f\xff\xfe\x00\x00\xff\x80\x00\x07\xff\xf8\x01\xff\xe0\x00\x0f\xf0\x01\xfe\x00\x3f\xf0\x7f\xe0\x00\x7f\xff\xe0\x1f\xff\xfc\x01\xff\xe0\x01\x80\x00\x07\xff\xff",
+  "\x00\x0f\xff\xf0\x00\x00\xe0\x0f\xf8\x00\x00\xff\xff\x80\x03\xff\xe1\xff\xff\x3f\xf8\x0f\xff\xc7\xe0\x00\x1f\xff\x00\x3f\xfe\x0f\xff\xf0\x03\x00\xc0\x00\x1f\xff\xfc\x3f\xff\xe0\x3f\xff\xf8\x1f\xf0\x00\x1f\xff\xc0",
+  "\x01\x80\x00\x1f\x01\xff\xff\x83\x00\x01\xfc\x00\x7f\xe0\x0e\x7f\xfe\x00\x00\x38\x00\xff\x00\x00\x3f\xff\x83\x83\xff\xc0\x00\x7f\xff\x80\x1f\xff\xf0\x1f\xff\xfc\x00\x03\x7f\xff\x81\xc0\x00\x07\xff\x83\xff\xff\x00\x00",
+  "\xff\x80\x0d\xff\xe0\x03\xff\xf0\x00\xff\xfc\x00\xf0\x01\xf8\x07\xff\xf8\x0f\x80\x0f\xff\xff\x00\xff\xff\x87\xff\xe1\xff\xfc\x67\x8c\x7f\xfe\x00\x03\xff\x3f\xfc\x07\x01\xff\xff\xe0\x00\x01\xff\xff\xc0\x0c\x40\x0f\xff\xff",
+  "\x00\x00\x1f\xff\xfe\x00\x1f\x00\x00\x1f\xff\xff\x07\xff\xff\xc0\x07\xff\xe0\x00\x02\x00\x00\xff\x00\x78\x00\x00\xe0\x00\x08\x00\x1f\xff\xff\x00\x03\xf8\x1f\x00\x00\x0f\xff\xc0\x00\x01\xff\xff\xe1\xf8\x00\x00\x3f\x80\x0f\xff",
+  "\x00\x0f\xf8\x00\xfc\x00\x03\xff\xff\x00\x00\x3f\xf0\x01\xff\xff\xe0\x7f\xf8\x00\xf8\x0f\xff\xff\x80\x00\x0f\xff\xfc\x0f\xff\xe0\x00\x00\xff\xc3\xff\xf0\x07\xff\xff\x00\x38\xf8\x00\x20\x1f\xfe\x3f\xfe\x00\xfe\x00\x7f\xff\xc0\x00",
+  "\x00\x3f\x00\xe0\x00\x0f\xff\xfc\x7f\xff\xfc\x00\x00\x7e\x00\x00\xff\xfe\x1f\xf0\x00\x1f\xf0\x00\x1f\xff\x87\xf0\x00\x3f\xc0\x0f\xff\x87\xff\x00\x3f\x81\xff\xff\xf7\xff\xe0\xff\xe0\x3f\x9f\xff\x00\x07\x00\x7f\xfc\x03\xff\xf0\x00\x00",
+  "\xe0\x3f\xff\xf0\xff\x80\x3e\x00\x03\xff\xe0\x00\x0f\xfc\x00\x07\xff\xf8\x00\x00\x7f\x80\x00\x0f\xf8\x01\xff\x7f\xff\xf0\x00\x3f\xff\xfe\x7f\xff\xe0\x00\xff\xc3\xff\xff\x00\x00\xf0\x00\x00\x7f\xff\x00\x3f\xff\xf0\x00\x01\xc0\x03\xff\xff",
+  "\x00\x03\xc0\x01\xff\xdf\xfd\xff\x9f\xfe\x1f\xff\xff\x00\x3f\xff\xfe\x00\x00\x7f\xcf\xff\xf0\x1f\xff\xfe\x07\xf0\x00\xff\xff\xe0\x00\x01\x00\x07\xff\x80\x1f\xe0\x00\x00\xff\xfe\x03\xff\xff\x80\x03\xf0\x0f\xff\xfe\x00\x00\x1f\xff\xf8\x00\x00",
+  "\x00\x1f\xff\xfb\xff\xfe\x00\x07\xff\xf0\x00\x00\xff\xff\x00\x00\x0f\xf3\xff\xfe\x00\x78\x00\x00\x3e\x00\x00\x3f\xff\xf8\x00\x1f\xff\xff\x80\x00\x03\xff\xff\x00\x07\xff\xee\x00\x1f\xfc\x00\x78\x00\x00\x1f\xff\x07\xff\xfe\x03\xff\xff\xe0\x00\x00",
+  "\x00\x7f\xff\xfe\x00\x00\x3f\xfc\x03\xff\xfc\x1f\xff\xf0\x7f\xd8\x03\xf0\x00\xfd\xfc\x38\x00\x08\x00\x10\x00\xe0\x06\x00\x7f\xfe\x00\x00\x0f\xff\x80\x00\x3f\x03\xff\xfe\xff\xff\xf9\xff\xf8\x00\x07\xff\xfc\x01\xff\xc0\x00\x03\xff\xff\xe0\x03\xff\xff",
+  "\xff\xf0\x0f\xff\xff\x00\x06\x00\xff\xff\xf0\x07\xff\xe0\x04\x00\x03\x00\x00\x03\xf0\xff\xff\x00\x03\xff\xfb\xff\xc3\xff\xf0\x07\xff\xff\xc7\x00\x7f\x80\x00\x03\xff\xf8\x00\x1f\xe1\xff\xf8\x63\xfc\x00\x3f\xc0\x9f\xff\xf8\x00\x00\x7f\xff\x1f\xff\xfc\x00",
+  "\x00\x3f\xff\xfc\x00\x0f\xc7\x80\x00\x02\x00\x1e\x00\x00\x60\x7f\x03\xfe\x00\x00\x1f\xff\x80\x1f\xf8\x00\x00\xff\xff\x80\x00\x03\xff\xc0\x00\x7f\xff\xc0\x7f\xe0\x03\xfc\x00\xff\xf7\xff\xff\x00\x00\x1f\xf0\x00\x03\xff\xff\xe1\xff\xff\x80\x0f\xf8\x00\x00\x1f",
+  "\x00\x01\xfe\x00\x03\x83\xf3\xff\xff\x80\x07\xff\xfc\x3f\xff\xfc\x03\xff\x80\x00\x06\x00\x00\x78\x00\x07\xff\xff\x80\x07\xfc\x01\xf8\x00\x07\xff\xff\xc0\x00\x38\x00\x07\xff\xfe\x3f\xff\xf8\x3f\xff\xcf\x3f\xfc\x00\x7f\xff\x00\x1f\xff\x80\x00\x30\x03\xff\xff\x00",
+  "\xf8\x00\x38\x00\x00\x3e\x3f\x00\x00\x3f\xff\xf0\x02\x00\x00\x0f\xff\xff\x80\x80\x03\xff\xc0\x00\x04\x00\x0f\xc0\x3f\xff\xfe\x00\x00\x3f\xff\xfe\x00\x3f\xff\xf8\x00\x30\x00\x7b\xff\x00\x00\x03\xff\xfc\x3f\xe1\xff\x80\x00\x70\x1f\xff\xc0\x07\xfc\x00\x1f\xff\xf0\x00",
+  "\x00\x03\xf8\x18\x00\x00\x70\x3f\xff\xf8\x00\x00\xff\xcf\xff\xff\xc0\x03\xff\xfe\x00\x10\x00\x00\xfe\x03\xff\xf8\x00\x00\x7e\x00\x00\x7f\x8f\xff\xc0\x00\x00\x7f\xff\xe0\x00\x3c\x07\xc0\x00\x00\x7f\xff\x01\xff\xf8\x01\xff\x80\x00\x0f\xff\xf9\xe0\x00\x3f\xff\xe0\x00\x00",
+  "\xff\xfe\x00\x3f\xc0\x1f\xff\xf0\x7f\xf8\x00\x01\xff\xf8\x1f\xff\xfe\x00\x00\xff\xff\xf8\x00\x7f\xff\x80\x3f\xff\xff\x00\x7f\xff\xf8\x00\x0c\x00\x00\x0f\xfe\x7e\x00\x3f\xe0\x18\x7f\xfe\x00\x00\x38\x00\x00\x3f\xff\xfe\x00\x00\x03\xfc\xff\xe1\xfe\x1f\xff\xfe\x00\x00\x07\xff",
+  "\x00\x00\x07\xff\xfe\x00\x00\x07\xfe\x00\x00\x3f\xe0\x00\x7f\xff\xc0\x00\x00\x7f\xff\xfc\x00\xfe\x00\x03\xff\xe0\x00\x1f\x0f\xfc\x00\x1f\xff\x80\x00\x07\xff\xff\xf0\x00\xff\xff\xf0\x00\x00\x1f\xff\xf8\x01\xff\xe0\x1f\xff\xff\x00\x1f\x80\x07\xf0\x00\x01\xff\xf8\x00\x01\xff\xff",
+  "\x00\x00\x3f\xff\xff\x03\xfe\x00\x00\x07\xc0\x00\x00\x7f\xfc\x0f\xf0\x00\x00\x1f\xff\xfe\x00\x00\x07\xc0\x00\x00\xff\xfe\x00\x00\x3f\xff\xfc\x01\xff\x7f\xfc\x00\x1f\xf8\x00\x1f\xff\x07\xff\xff\xe0\x00\x7f\xff\xfc\x01\xff\xff\xf0\x00\x01\xff\xf8\x00\x1e\x00\x00\x7f\xfc\x00\x3f\xff",
+  "\xfe\x3f\xff\x83\xff\xfe\x00\x07\xff\xff\xf0\x00\x3e\x00\x00\xff\xff\xfc\x00\x40\x3f\xfe\x00\x00\x03\xf0\x00\x00\x70\x3f\xf8\x0f\xff\xff\xe0\x1f\x80\x00\x03\xc3\xff\xff\xf0\x00\x01\xff\xf0\x0f\x80\x00\x0f\xe0\xff\xff\xfe\xf0\x00\x01\xff\xc0\x00\x00\x7f\xf0\x00\x00\x7f\xfe\xe0\x00\x00",
+  "\x00\x00\x03\xff\xf0\x01\xfc\x00\x00\xff\xff\x00\x00\x7f\xff\xff\x80\x07\xff\x8f\xff\x80\x00\x0f\xff\xf0\x00\x00\x3c\x00\x03\xc0\xff\xff\xfe\x01\xff\xff\x80\x0c\x7f\xff\xf8\x00\x00\x1f\xf0\x00\x00\x7f\x80\x00\x00\x80\x00\x00\xff\xff\xf0\x1f\xff\xe0\x00\xff\xff\xfe\x1f\xff\x1f\xc0\x00\x00",
+  "\xff\xff\xfe\x07\xff\xc0\x00\x06\x3f\x9f\xf0\x07\xff\xf0\x3f\xfe\x1f\xff\xff\x81\xff\xff\xc0\x00\x02\x00\xfe\x00\x04\x00\x07\x00\x00\x01\xff\xff\xfe\x00\x00\x07\xff\xfe\x00\x1f\xfe\x00\x00\xff\xff\xe0\x07\xf8\x00\xff\xff\xfc\x00\x3f\xf3\xff\xff\xc0\x00\x7f\xff\xe0\x00\x0f\xff\xfc\x07\xff\xff",
+  "\xff\xf0\x00\x00\x7e\x00\x1e\x03\xff\xff\x00\x00\x73\xff\xf0\x00\x00\x0f\xff\xdf\xff\xff\xdf\xfc\x00\x07\xfe\x07\xff\xfe\x00\x00\x1f\xdf\xef\xff\xf0\x3f\xff\xfc\x00\x00\x07\xff\xff\xf0\x00\x00\x7f\xe0\x07\xff\x80\x00\x00\x7f\xe0\x03\xff\xff\xf9\xff\xe0\x00\x00\x3f\xe3\xff\xff\xfc\x00\x00\x03\xff",
+  "\x00\x03\xff\x00\x00\x3f\xff\x80\x01\xf0\x00\x0f\xfe\x00\x00\x06\x00\x03\xff\xff\xfc\x03\xff\xff\xf7\x80\x00\x00\x7f\xc0\x0f\xff\xe3\xfe\x0f\x00\x00\x7f\xff\x00\x7f\xf8\x00\x00\xff\xff\xee\x00\x7e\x01\xc0\x00\x1f\xe0\x00\x07\xff\xff\xf8\x00\x00\xe1\xff\xfc\x3f\xe7\xff\xff\xf8\x3f\xff\xfc\x00\x1f\xff",
+  "\x00\x00\x0f\xff\xf8\x00\x00\xff\xff\xfc\x00\x1f\xe0\x07\xff\xff\x00\x01\xff\xdf\xff\x80\x00\x3f\xff\xfc\x00\x00\x0f\xfc\x07\xff\x00\x00\xff\x80\x00\x03\xff\xff\xf0\x00\x07\xff\xff\xf0\x00\xff\xfe\x1f\xff\xff\xe0\x3f\xff\xfe\x00\x00\x60\x00\x00\xff\xff\x7f\xff\xf0\x00\x03\xff\xff\xc0\x07\x00\x01\xff\xff",
+  "\x00\x00\x20\x7f\xfe\x0f\x83\xff\xff\x80\x03\xff\x00\x00\x00\xff\xff\xe0\x00\x1f\xff\xff\xe0\x00\x3f\xfe\x7f\xff\xf0\x00\x1f\xff\xff\xe0\x00\x00\xff\xff\x87\xff\xc0\x00\x17\xfd\xff\x9f\xff\xfb\xff\xff\xe0\x00\x03\xe0\x00\x07\xff\x9f\xff\xff\x80\x00\x7f\xff\xff\x00\x01\xff\xff\xc0\xff\xff\xc0\x10\x00\x00\x1f",
+  "\x00\x00\x07\xff\xc0\x00\xff\xe0\x00\x07\xff\x80\x03\x80\x00\x0f\xf8\x00\x00\x7f\xff\xfe\x00\x00\x18\x00\xff\xf0\x20\x01\xff\xfe\x00\x00\x60\x0f\xf0\xe0\x03\xff\xfe\x00\x3e\x1f\xff\xfc\x00\x03\xff\x80\x00\x00\xff\xf8\x00\x01\x00\x00\x0f\xf3\xff\xfc\x00\x03\xff\xff\xe1\xff\xff\xc1\xf0\x00\x00\xff\xff\xff\x00\x00",
+  "\xff\xff\xf0\x00\x00\x07\xff\xfc\x00\x7f\x87\xff\xff\x00\x00\x00\x7f\xff\xc0\x7f\xff\x80\x00\x03\xf0\xff\x3f\xff\x80\x30\x07\xff\xff\x1f\x8e\x00\x7f\xff\xff\xc0\x01\xff\xfc\x07\xf8\x00\x00\x7f\xff\xfc\x00\x3f\xf0\x00\xf8\x00\x00\x07\xff\x00\x00\x0e\x00\x0f\xff\x80\x00\x7f\xc0\x01\xff\x8f\xf8\x00\x07\x01\xff\xff\xff",
+  "\xff\x80\x3f\xff\x3f\xfe\x00\x00\xff\xff\xff\x9f\xff\xf8\x3f\xff\xf8\x00\x00\x0f\xf8\x00\x00\x03\xfe\x00\x7f\xff\xff\x00\x0f\xff\x01\xff\xf0\x0f\xff\xe0\x20\x7f\xff\xfc\xff\x01\xf8\x00\x07\xff\xe0\x00\x7f\xf8\x00\x0f\xff\x80\x00\x00\x7f\xe0\x00\x3f\xf8\x01\xfe\x00\x07\xff\xf0\x00\x00\x7f\xff\xff\xc0\x00\x01\xff\xff\xff",
+  "\x00\x7f\xff\xe0\x00\x01\xff\xff\xf8\x00\x00\x3f\xff\xfc\x00\x7f\xfe\x00\x00\x03\xff\xff\xf0\x03\xff\xe0\x00\x7f\x80\x00\x0f\xff\x3f\xf8\x00\x00\x7f\xff\xff\x00\x07\x80\x1f\x83\xf8\x00\x00\x0f\xfe\x3f\xff\xc0\x3f\xff\xfe\x1f\xe0\x00\x07\xc0\x03\xff\xf0\x0f\xc0\x00\x03\xff\xff\x80\x00\x00\x7f\x80\x00\x00\xff\xff\x80\x00\x00",
+  "\xfe\x00\x00\x20\x00\x04\x00\x0f\xff\xff\xc0\x01\xff\xf8\x3f\xc0\x00\x00\xff\xff\xc0\x00\xff\xff\xff\x80\x00\x3f\xf8\x00\x7f\xff\xfe\x7f\xf8\x00\x7f\xff\x80\x07\xff\xc0\x00\x0f\xff\xf8\x00\x7f\xff\xc0\x00\xff\xff\xc0\x3f\xff\xff\xe0\x0f\xff\xff\xe0\xe0\x1f\xff\x80\x00\x00\x7f\xff\xc0\x71\xff\xff\xfc\x00\x01\xff\xff\xf8\x00\x00",
+  "\xff\xff\xe0\x00\x0f\xff\xf0\x00\x00\x3f\xff\xff\xc0\x00\xff\xff\x00\x00\x0f\xff\xff\xe0\x00\x01\xff\x00\x00\x1f\xff\xe0\x3f\xfc\x00\x03\xe0\x1f\xf0\x1f\xf8\x00\x00\x3f\xff\xff\xc0\x0f\xfe\x00\x00\x20\x00\x00\xff\xfc\x00\x0f\xff\xfe\x3f\xff\xff\x00\xff\xf0\x00\x00\x80\x00\x1f\x03\xe0\x01\xff\xfa\x00\x3f\xe0\x00\x00\x70\x00\x00\x0f",
+  "\xfd\xff\xc0\x00\x20\x01\xfe\x00\x3f\xf8\x00\x03\xff\x00\x00\x03\xf8\xff\xcf\xc3\xff\xff\xfc\x00\x03\xff\xff\xfc\x00\x00\x78\x3f\xff\xf0\x01\xff\xe0\x0f\xff\xff\x00\x00\x07\xff\xff\xfc\xff\xff\xf8\x00\x01\xff\x80\x00\x07\xff\xff\xfc\x00\x00\x1c\x00\x01\xff\xff\x07\xf8\x00\x00\x1f\xff\xff\xf0\x00\x01\xfe\x00\x7f\xff\xf0\x1f\xfc\x00\x00",
+  "\x00\x00\x00\x3f\xff\x00\x00\x07\xff\xff\xfc\x00\x00\x01\xe0\x0f\xff\x83\xfc\x01\xff\xff\xf0\x0f\xff\x00\x00\x00\x3f\xff\xff\xc0\x1f\xff\xff\xe0\x00\x20\x00\x00\x3f\xff\xff\x00\x00\xff\xfc\x03\xff\xff\xf0\x00\x1f\xff\xfc\x00\x00\x03\xff\xff\xc0\x7f\x80\x00\xff\xff\xff\x00\x0f\x0f\xff\xff\xe0\x00\x00\xff\xf8\x00\x00\xff\xfe\x00\x00\x0f\xff",
+  "\xff\xfe\x03\x80\x00\x03\xff\xff\xc0\x3f\xff\xff\x00\x03\xff\xff\xf8\x00\x00\x01\xff\xff\xcf\xfc\x00\x00\xe0\xef\xf8\x00\x0f\xff\xe3\xf8\x00\x3f\xff\xff\x80\x3f\xbf\xfe\x00\x00\xff\xfc\x00\x00\x01\xff\x00\x00\xcf\xc0\x01\xfc\x00\x00\x7f\xff\xff\xc0\x00\x10\x7f\xff\xfc\xfe\x00\x00\x07\xc0\xff\xff\xff\x8f\xff\x00\x00\x1f\x9e\x00\x00\x01\xff\xff",
+  "\x00\x7f\xff\xe0\x00\x01\xff\xff\xc3\xff\x80\x01\x03\xfc\x00\x00\x00\xfc\x01\xff\xff\xf8\x7f\xe7\xf0\x00\x00\x7f\xc0\x3f\xff\xff\xc0\x00\x00\x1f\xff\x80\x00\x01\xff\xe0\x00\x00\x70\x00\x00\x1c\x7f\xff\xf8\x1f\xfc\x00\x00\x07\xef\xe0\xff\xff\xc1\xff\xfc\x00\x00\x01\xff\xff\xff\xa0\x07\xff\x00\x1e\x00\x1f\xfc\x00\x00\x38\x00\x18\xc0\x00\x00\x7f\xff",
+  "\x00\x0f\xff\xf8\x00\x00\x07\xff\x00\xfc\x00\x00\x03\xff\xfc\x00\x07\xff\xff\xe0\x00\x00\xff\xfc\x0f\xff\x00\x00\x0f\xff\xfe\x0f\x80\x07\xff\x03\xff\xff\xf9\xff\xfe\x00\x00\x03\xf8\x00\x00\x07\xe0\x00\x00\xc0\x00\x1f\xff\xf0\x7f\xff\xff\xc0\x07\xff\xff\xfc\x00\x00\x3f\xff\xff\xe0\x00\x00\x1f\xff\xf8\x1f\xfe\x00\x00\x3f\xff\xff\xe0\x3f\x06\x00\x00\x00",
+  "\xff\xf0\x00\x08\x00\x0f\xef\xff\xff\xfc\x00\x00\x7f\xff\xf0\x00\x7f\xff\xf8\x00\xff\xff\x81\xff\xff\xe0\xff\xff\xff\x00\x00\x00\x80\x00\x03\xff\x80\x3f\xff\xfc\x00\x00\x1f\xff\xc0\x0f\xff\xfe\x00\x00\x00\x73\xf0\x1f\xfe\x00\xff\xc0\x3f\xff\x00\x3f\xff\x83\xff\xfe\x01\xff\xff\xf7\xff\xff\x80\x00\x00\x3f\x00\x00\x1f\xe3\xff\xff\xf0\x00\x0f\xff\xf0\x00\x00",
+  "\x00\x00\x7f\xfc\x00\x7f\xe0\x00\x0f\xff\xe0\x01\xf8\x00\x3f\xff\x00\x00\x78\x00\x7f\xe0\x00\x00\x1f\x00\x07\xff\xff\xf8\xf9\xf0\x01\xff\xf8\x07\xc0\x0f\xff\xf8\x00\x07\xf8\x7f\xfe\x00\x00\x0f\xff\xe3\xf0\x00\x07\xff\xff\xfc\x03\x1c\x00\x00\x7f\xe0\x00\xff\xff\xfc\x00\x00\x0f\xf3\xff\xe0\x00\x00\x0f\xff\xf9\x00\x00\x10\x00\x3f\xff\xfc\xf8\x7f\xff\x00\x00\x00",
+  "\x00\x03\xff\xff\xc0\x7f\xff\xff\xc0\x00\x03\xff\xff\xff\x00\x00\x0f\xff\xf0\x1f\xff\xf0\x00\x07\xff\xff\xef\xff\x81\xf7\xff\xfe\x00\x07\xff\xf0\x00\x00\x1f\xff\xc0\x0f\x80\x00\x0f\xff\xfc\x00\x00\xff\xff\xff\xc0\x03\xff\xe3\xff\xff\xfe\x00\x1f\xff\xff\x00\x00\xff\xff\xff\x0f\xff\xf1\xf8\x00\x00\x01\xff\xff\xff\x80\x1f\xff\xfe\x00\x08\x00\x00\x7f\xff\xff\x80\x00",
+  "\x1f\xe0\x00\x7c\x1f\xc0\x07\xff\xc0\x07\xff\xff\xfe\x00\x3c\x00\x00\x00\xff\xff\x80\x00\x07\xff\xff\x00\x1f\xf8\xff\xc0\x00\xff\x81\xff\x01\xff\xfe\x00\x78\x7f\xff\xf0\x00\x01\x80\x00\x00\x1f\xff\x00\x00\x1f\xff\xf0\x00\x1f\xff\xff\xe0\x00\x3c\x00\x00\x1f\xff\xff\x80\x03\xff\xe0\x01\xff\xff\xf9\xff\xf8\x00\x00\x7c\x00\x00\xfe\x00\x00\xff\xff\xff\x00\x00\x0f\xff\xff",
+  "\xfc\x00\x01\xff\x00\x00\x0c\x00\xff\xff\xe3\xff\xff\xf0\x80\x0e\x0e\x00\x00\x0f\xfe\x00\x03\xff\xc0\x00\x00\x7f\xff\xff\xe0\xc0\x00\x00\x07\xe0\xff\xff\x03\x9f\xff\xff\xc1\xc0\x00\x03\xff\xff\xc3\xff\xff\xfc\xff\xff\xc0\x00\x01\xfc\x00\x0f\xfc\x00\x00\x00\x7f\xff\xff\x03\xff\xff\xfc\x0f\xff\xfe\x00\x00\x03\x80\x3f\xff\xff\x00\x00\xff\xff\xf8\x00\x03\xff\xff\x80\x00\x00",
+  "\xff\xff\x80\xff\xff\xf8\x00\x00\xfc\x00\x03\xff\xf8\x00\x0f\xff\xff\x00\x03\x00\x00\x00\x7f\xff\xf0\x00\x3f\xff\xf0\x00\x01\xfc\x01\x00\x03\xff\x80\x1f\xff\xe3\xff\xff\xf8\x00\x1f\xff\xff\xf8\x01\xff\xdf\xff\xfb\xff\xc0\x00\x00\x3f\xff\xf8\x00\x00\x80\xc7\xff\xff\xf8\x0f\xff\x00\x60\x1f\xff\xe0\x00\x01\xff\xff\xfe\x0f\xff\xff\xfc\x00\x00\x00\xf0\x06\x03\xff\xff\xfe\x00\x00",
+  "\xff\x00\x0f\xff\xfc\x00\x0f\xff\xff\xfc\x07\xff\xfc\x00\x00\xf0\x00\x00\x80\x00\x7f\xfe\x00\x00\x0f\xff\xff\xfc\x3f\x00\xff\xff\xff\x00\x1f\xff\xff\xf0\x00\x1f\xff\xff\xe0\x00\x1f\xff\xff\xc3\xff\x00\x00\x01\xff\xff\xf0\x00\x00\x0f\xff\xe0\x07\xfc\x00\x00\x00\xfe\x00\x07\xff\xff\xf8\x00\x00\x3f\x00\x00\x0f\x80\x00\x3f\xff\xc0\x00\x11\xff\xef\x00\x07\x00\x7f\xff\xfc\x00\x00\x00",
+  "\xfe\x00\x00\x7f\xf7\xff\xff\x00\x00\x0f\xff\xff\xe0\x01\xff\xe0\x00\x00\x03\xff\xe0\x00\xff\xfe\x00\x01\xff\xf7\xff\xf8\x00\x0f\xff\x00\x00\x00\x38\x00\x07\xff\xf8\x07\xff\xfc\x00\x1f\xff\xff\x0f\xc1\xff\xff\xc0\x00\xff\xff\x0f\xff\xf0\x01\xff\xf8\x00\x01\xff\xff\x80\x00\x00\x0f\xf8\x00\x3f\xff\xfe\x3f\xff\xff\xf0\x00\x00\x38\x0f\xc3\xff\xff\xff\x1f\xff\xc0\x3f\xff\xff\xe0\x00\x00",
+  "\xff\xff\xf0\x00\x7f\xc0\x07\xff\xff\x81\xff\xc0\x00\x01\xff\xff\xff\xc0\x00\x00\x1f\xff\xfe\x03\xc0\x00\x0f\xff\xff\xfc\x00\x03\xff\xff\xff\x83\xff\xc0\x00\x07\xf0\x00\x00\x1f\x80\x00\x00\x3f\xff\xff\xe7\xff\x00\x07\xff\xff\xfc\x00\x00\x1f\xff\xf8\x00\x03\xf0\x00\xff\xfc\x00\x1f\xff\xff\xe0\x03\xff\xf0\x00\x01\xff\xff\xff\x80\x00\x00\x0f\xff\xff\xf8\x10\x00\x1e\x03\xff\xff\xff\x80\x00",
+  "\x00\x01\xff\xfe\x00\x00\x00\x7f\xff\xff\xf0\x00\x00\x1f\xff\x80\x07\xff\xff\xff\x80\x00\x01\xff\xfc\x03\xff\xff\x9f\xff\xfe\x00\x08\x00\x00\x06\x00\x00\x00\x81\xff\xff\xc0\x00\x07\xf8\x00\xff\xff\xff\x00\x00\x00\xff\xff\xf8\x00\x3f\xff\xff\xf8\x3f\xf8\x00\x00\x00\x7f\xff\xc0\x7f\xff\xff\xc0\xff\xff\xfe\x00\x00\x01\xff\xf8\x00\x00\x03\xff\xc1\xff\xf0\x00\x00\x03\x07\xf8\x01\xff\xfe\x00\x00",
+  "\xf8\x00\x00\x01\xff\xff\x80\x00\x0f\xff\xff\x8f\xff\x00\x1f\xff\x0f\xff\xc0\x00\x00\xff\xff\xfc\x00\x0f\xff\xf0\x00\x70\x00\x00\x3f\xff\xc0\x00\x00\x7c\x00\x00\x7e\x00\x0f\xfc\x00\x00\x00\xff\xff\x80\x00\x00\x0f\xff\xff\xfc\x38\x00\x00\x03\xf0\x00\x31\xf0\x1f\xff\xff\xc0\x07\xff\xff\xe0\x1f\xff\xff\xf3\xfe\x00\x00\x00\xff\xff\xc0\x00\x1f\xe7\xff\xe1\xff\xff\xdf\x00\x00\x00\x1f\xff\x00\x00\x00",
+  "\x3f\xff\xff\xf8\x00\x00\x00\x60\x00\x0f\xff\xff\xe0\x07\xff\xff\xff\x00\x00\x3f\xff\xff\xf0\x1f\xff\xff\x80\x00\x70\x00\x00\x01\x00\x00\x00\x3f\xff\xfe\x00\x00\x00\x1f\xf8\xfc\xc0\x0f\xff\xf8\x00\x3f\xff\xc0\xff\xff\x80\x00\x03\xff\xff\xf8\x00\x3f\xff\xfc\x00\x00\x0f\x81\xff\xc0\x03\xff\xc0\x3f\xff\xff\x80\x03\xff\xfe\x00\xff\xff\xfe\x00\x00\x1c\x00\x00\x00\x3f\xff\xff\xf8\x00\x7f\xff\xc0\x00\x00",
+  "\x00\x00\x00\x0f\xff\xfe\x0f\xff\xff\x87\xff\xff\xff\x00\x80\x00\x0f\xff\xc0\x00\x03\xf0\x1f\xf7\xe0\x00\x00\x70\x00\x01\xff\xff\xff\x80\x01\xfe\x07\xf0\x00\x01\xff\xfc\x00\x00\x04\x00\x01\xff\xfe\x07\xff\xff\xfe\x00\x07\xc0\x00\x00\xff\xff\xff\x87\xf0\x03\xff\xfc\x00\x00\x1f\xf8\x00\x01\xff\xff\xc0\x00\x00\x3f\xff\xc0\x00\x00\x7f\x8f\xff\xf8\x00\x00\x00\x7f\xff\xe0\x06\x0e\x00\x00\x0f\xff\xff\x80\x00",
+  "\x03\xff\xff\xfd\xe0\x00\x00\x1f\xff\xf8\x01\xff\xff\xfb\xff\xff\xe0\x01\xf0\xf0\x00\x00\xff\xff\xff\x80\x00\x00\x7f\xff\xff\xe0\x1f\xff\xff\xf0\x01\x80\xff\xff\xff\xe0\x00\x00\x7f\xff\xf0\xff\xff\xc0\x00\x00\x07\xfe\x00\x00\x00\x1e\x00\x1f\xff\xff\xe0\x1f\xff\xe0\x01\xff\xc0\x00\x3f\xff\xe0\x00\x00\x0f\xf0\x00\xff\xff\x7f\xc0\x1f\xf8\x3f\xff\xff\xc0\x00\x00\x7f\xff\xe0\xff\xfc\x00\x00\xff\x0f\xff\xff\xff",
+  "\x07\xff\xfc\x03\xff\xff\xff\xdf\xff\xff\x87\xff\x18\x00\x03\x80\x01\xff\x00\x00\x00\x1f\xff\x00\x00\x3f\xff\xff\xc0\x1f\xe0\x3f\xff\xff\xfc\x00\x00\x01\xff\xf8\x00\x00\x3f\xff\xff\xf8\x00\x00\x07\xe0\x00\x07\xff\xf9\xff\xe0\x00\x3f\xe0\x00\x7f\xef\xf0\x00\x07\x81\xff\xfc\x00\x00\x00\xff\xe0\x00\x30\x00\x00\x00\xff\xff\xf0\x00\x00\x03\xff\xfc\x7f\x07\xf8\x03\xff\xff\xff\x00\x3f\xfc\x00\x00\x01\xff\xc0\x00\x00",
+  "\x00\x7f\xfc\x00\x00\x03\xff\xf8\x00\x00\x61\xfe\x7f\xff\xfe\x00\x00\x1f\xff\xfc\x3f\xff\x80\x01\xff\xff\xff\xe0\x00\xff\xff\xff\x80\x1f\xf8\x00\x7f\xff\xff\xf8\x00\x00\x07\xff\xff\xe0\x00\x00\x07\xff\xff\xff\x80\x00\xff\x80\x0f\xff\xff\xfc\x00\x00\x7f\xff\xfe\x00\x00\x00\x30\x00\x00\x7f\x80\x00\x07\xff\xff\xf0\x00\x00\x03\xff\xc0\x0f\xff\xff\x80\x3f\xff\x80\x03\xff\xff\xfe\x03\xff\xff\xff\x7f\xfc\x1f\xf0\x00\x00",
+  "\x1f\xf0\x00\x00\x7f\xff\xfe\x02\x00\x00\x03\xff\xff\xff\xd8\x07\xff\xff\xe0\x01\xff\xff\x80\x00\x00\x07\xc0\x00\x0f\xff\xc0\x7f\xf0\x00\x07\xff\xff\x80\x00\x07\xf0\x00\x00\x7f\xfc\x03\xff\xff\xff\xc0\x00\x01\xff\xff\xf9\xff\xfe\x00\x00\x1f\xff\xc0\x00\x00\x03\xfe\x3f\xff\xff\x00\x07\xfe\x00\x00\x03\xc0\x00\x3f\xf8\x00\x10\x03\xfc\x00\x0f\xff\xc0\x00\x7f\xff\xe0\x00\xff\xf0\x00\x00\x7f\xff\xe0\x00\x00\x0f\xff\xff\xff",
+  "\xff\xff\xff\xf8\x00\x00\x60\x00\x00\x00\xff\xff\xfc\x03\xff\xfc\x00\x00\x3c\x00\x3f\xe0\x7f\xf8\x00\x07\xff\xf8\x0f\xf8\x00\x00\x7f\xff\xff\xfc\x00\x7f\xc2\x00\x03\xff\xff\xfe\x00\x01\xff\xff\xff\xf0\x03\xff\xff\xf0\x18\x07\xc0\x00\x0f\xff\xc0\x00\x00\x7f\xff\xff\x87\xe0\x00\x00\x07\x00\x1f\x80\x04\x07\xff\xe0\x00\x00\x1f\xff\x81\xff\x80\x00\x03\xff\xfc\x00\x00\x07\xff\xff\xff\xc0\x00\x00\x1f\x80\x01\xff\xff\x00\x00\x00",
+  "\x00\x0f\xfc\x1f\xf8\x00\x0f\xff\xff\xf8\x07\xff\xf1\xfc\x00\x1f\xff\xff\xf0\x00\x0f\xff\xdf\xff\xff\xff\x00\x00\x03\xff\xff\xff\x00\x01\xff\xff\xff\xc0\x10\x0f\xf0\x00\x00\x00\xfc\x00\x1f\x00\x07\x00\x01\xf0\x00\x00\x1f\xe0\x00\x00\x30\x7c\x3f\xff\xe0\x00\xff\xfc\x07\xff\xfc\x00\x3f\xff\xff\xf8\xff\xff\xc1\xfc\x1f\xff\xff\xf8\x00\x01\xff\xfc\x00\x00\x0f\xff\xff\xff\x00\x00\xff\xf8\x0c\x00\x00\x07\xff\xff\x00\x00\x00\x7f\xff",
+  "\xff\xff\x80\xff\xff\x00\x00\x00\x7f\xff\xff\x00\x1f\xfc\x00\x06\x00\x0f\xf8\x00\x00\x01\x80\x00\x00\x7f\xff\xff\xe0\x3f\xff\xff\xfc\x00\x60\x00\x00\x00\xfe\x00\x00\x07\xff\xff\xf0\x7f\xff\xff\xf8\x00\x00\x80\x00\x00\x0f\xff\xff\xff\xbf\xff\xff\xc0\x07\xff\xfe\x00\x00\x1c\x00\x1f\xfc\x07\x00\x01\xff\xff\x00\x00\x00\x80\x00\x1f\xff\x03\x80\x00\x00\x3f\xff\xff\xf8\x00\x07\xff\xff\xff\x80\x00\x1f\xff\xff\xe0\x1f\xff\xff\xc0\x00\x00",
+  "\xff\xff\xff\xf8\x00\x00\x00\x7e\x00\x00\x00\x1f\xff\x80\x07\xff\xff\xff\x80\x00\x00\x0f\xff\xff\xc3\xff\xf0\x00\x00\x04\x7f\xc0\x7f\xf0\x00\x3f\xff\x80\x00\x7f\xe0\x00\x03\xff\xc0\x00\x07\xff\x00\x00\x0f\xff\x80\x00\x00\x07\x80\x00\x00\x0f\xff\xff\xff\x01\xff\xff\xff\xc0\x03\xc0\x00\x00\x03\xff\xff\xe0\x00\x0f\xff\xff\xc0\x00\x03\xff\xfe\x00\x03\xff\xf8\x00\x00\x0f\xff\xff\xc0\x01\xff\xe0\x00\x00\xff\xff\xfc\x00\x00\x1f\xff\xff\xff",
+  "\xff\xf0\x00\x3f\xfc\x00\x00\xff\xff\xff\xe0\x1f\xc3\xfe\x00\x07\xff\xf8\x00\x0f\xf0\x01\xff\xff\xf0\x00\x00\xff\xc0\x0f\xff\xff\x80\x00\x00\xff\xff\xf3\xff\x80\x00\x00\x80\x08\x38\x00\x00\x0f\xff\xf0\x00\x1f\xff\xff\xfc\x00\x0f\x80\x00\x70\x00\x00\x31\xff\xff\xfe\x3f\xff\xf8\x00\x00\x00\x3c\x3f\xf0\x0f\xff\xff\x00\x03\xff\xfb\xff\xff\xff\x00\x0f\xff\xff\xfe\x00\x00\x00\xf0\x00\x00\x00\xff\xff\xfc\x00\x7f\xff\xf0\x00\x01\xff\xff\xfe\x00",
+  "\xff\xff\xf0\x0f\xf8\x3f\xff\xff\xe0\x00\x03\xff\xfe\x00\x00\x3f\xff\x80\xff\xff\xff\x00\x00\x00\xff\xff\xf8\xff\xff\xf0\x00\x0f\xf1\xff\xff\x00\x00\x00\x0f\xff\xfc\x00\x00\x00\x1f\xf0\x00\x00\x1f\xf0\x03\xff\xff\xff\xe1\xff\xe0\x00\x00\x1f\xff\xc1\xfe\x00\x00\x07\xff\xfc\x00\x00\x00\x1f\xfe\x3f\xc0\x00\x00\x01\xff\xfc\x00\x00\x1f\xff\xff\x0f\xe0\x00\x01\xfc\x00\xfe\x00\x00\x00\x7f\xe0\x00\x1f\xff\xff\xe0\x7f\x00\x0f\xf0\x00\xff\xfe\x00\x00",
+  "\x00\x7f\xff\xc0\x07\xff\xff\xff\x80\x07\xff\xff\xfe\x00\x00\x00\x7e\x00\x00\x00\x0f\xff\x80\x1f\xff\xfe\x07\xff\xff\xf0\x03\xc7\xff\xff\xfe\x00\x00\x00\x7f\xfe\x00\x00\x1f\xff\xfe\x00\x00\x00\xff\xfc\x00\x1f\xff\xc0\x00\x00\x3f\xff\x00\x1e\x00\x00\x03\xff\xff\xff\x80\x00\x00\x7f\xff\xf8\x03\xff\xfc\x00\x01\xff\xff\xfe\x00\x0f\xff\x02\x00\x07\xff\xff\xfe\x00\x00\x00\xfe\x01\xff\xff\xf7\xff\xff\x19\xff\xff\x00\x00\x07\xff\xc1\xff\x00\x00\x07\xff",
+  "\x00\x00\x00\x40\x00\x00\x07\xff\xff\xf8\x1f\xff\xff\xc0\x00\x3e\xff\xff\xf0\x00\x00\x00\x7f\xff\xfe\x00\x00\x00\xff\x80\x00\x00\x3f\xf1\xff\xff\xff\xe0\x00\x00\x01\xff\xff\xff\x00\x00\x1f\xff\xf8\x00\x07\xff\xff\xf8\x00\x1f\xff\xc1\xff\xff\xff\xe0\x01\xff\xff\xff\xe0\x00\x00\x07\xff\xff\xff\xcf\xff\xe0\x00\x3f\xe0\xff\xff\xc0\x00\x07\xff\xff\xe0\x01\xff\xfc\x3f\x00\x01\xff\xff\xfe\x00\x01\xff\x0f\xff\xff\xfc\x00\x00\x01\xff\xff\x80\x00\x00\x0f\xff",
+  "\xff\xff\xf0\xff\xff\xff\xc0\x03\x80\x00\x01\x00\x00\x03\xff\xff\xff\xf1\xff\xff\xff\xe0\x07\xfc\x00\x00\x03\xff\xf0\x00\x00\x00\x7e\x00\x00\x00\x07\x00\x3f\xff\xfc\x00\x0f\xc7\xff\xff\x00\x00\x07\xff\xff\xc0\x00\x00\x03\xff\xfc\x00\x00\xff\xe0\x00\x00\x00\x7f\xf0\x00\x00\xff\xff\xff\xfd\xff\x00\xff\xe0\xff\xff\xe0\x07\xff\xff\xf8\x7f\xff\xfe\x18\x00\x00\x01\xf0\x00\x1f\xff\xfe\x01\xc0\x01\xff\xff\xff\xf8\x00\x01\xfe\xff\xff\xff\x80\x00\x00\x07\xff\xff",
+  "\xff\xff\xf0\x00\x1f\xff\xff\x00\x00\x3f\xff\xf0\x00\xff\xff\x00\x07\xff\xff\xf8\x03\xff\xff\xe7\xff\xff\xff\x81\x00\x00\x01\xff\x00\x00\x3f\xff\xff\xf8\x00\x00\x00\xf0\x07\xff\xc0\x0f\xf0\x00\x3f\xff\xc0\x00\x7f\xf8\x00\xff\xfc\x00\x00\x1f\xff\x80\x1f\xfc\x00\x00\x01\xff\xff\x00\x00\x7f\xff\xff\xfe\x00\x00\x0f\xff\x80\x00\x00\x0f\xff\xff\xfc\x00\x00\x00\xff\xff\xfc\x00\x0f\xff\x80\x00\x3f\xff\xfe\x00\x00\x3f\xe0\x0f\xff\xff\x00\x00\x01\xff\xf0\x00\x00\x00",
+  "\xff\xc0\x00\x00\x03\xff\xff\xfc\x00\xff\xff\xfc\x00\x00\x00\x7f\xff\xff\x00\x00\x00\x1f\xe0\x00\x0f\xff\xc0\xf0\x00\x00\x7f\xff\xff\xe0\x00\x20\x1f\xff\xff\xff\x00\x00\x00\x1f\x80\x00\x00\x07\xff\xf1\xff\xff\xff\xc0\x00\x00\x1f\xff\xff\xf0\x00\x3f\xff\xf8\x00\x3f\xff\xff\xfe\x01\xff\xff\xfe\x7f\x9e\x00\x1f\xff\xfc\x00\x7f\xe0\x7f\xff\xff\xe0\x00\x7f\xff\xfe\x00\x00\x01\xff\xff\xff\xf8\x01\xff\xc0\x03\x00\x0f\xff\xf8\x00\x00\x0f\xf0\x0f\xff\x00\x00\x00\x0f\xff",
+  "\x00\x03\xff\xff\xff\xcf\xff\xf8\x7f\x8f\xff\xff\xfc\x01\xff\xff\xfc\x00\x00\x1f\xff\xff\xff\x80\x00\x00\x01\xff\xff\xe1\xff\xf0\x00\x00\x00\xff\xff\xff\xf8\x03\x80\x00\x3f\x80\x00\x0f\xff\xff\xff\xc0\x00\x00\x02\x7f\xff\xf8\x03\xff\xc0\x00\x00\x3f\xff\x80\x00\x00\x01\xff\xff\xe0\x00\x00\x03\x80\x00\x00\xff\xe0\x7f\xff\xff\xfc\x00\x00\x01\xff\xff\xfc\x00\x00\x00\xff\xff\x80\x00\x07\xfe\x00\x00\x07\xff\xf0\x00\x00\x1f\x80\x00\x00\x3e\x1f\xff\xff\xff\x9f\xff\xff\xff",
+  "\xff\xff\xfe\x00\x03\xff\xff\xff\x80\x01\xff\xff\xff\xa0\x3f\xff\xf8\x00\x7f\x03\xff\xff\xc0\x00\x0f\xff\xc3\xff\xf8\x00\x03\xff\xff\xff\xc0\x7f\xf0\x1f\xe0\x0f\xff\xff\xc0\x00\x1f\xfe\x0f\xff\xff\xe0\x00\x07\xff\xff\xfc\x00\x00\xfc\x00\x3f\xff\xff\xf0\x00\x00\x00\x3f\xfc\x00\x00\x00\x0f\xff\xc4\x00\x00\xff\xc0\x00\x03\xff\xff\xff\x80\x00\x03\xfc\x0f\xff\xff\xf0\x00\x00\x03\xff\xff\xc0\x07\xff\xff\xf8\x0c\x3f\xff\xf0\x00\x1f\xff\x80\x00\x00\x01\xff\xfe\x00\x00\x3f\xff",
+  "\x00\x00\x00\x1f\xff\xc3\xff\xff\x80\x00\x00\x3f\xff\xff\xfe\x00\x00\x00\x0f\xe0\x00\x7f\xff\xe0\x0f\xfe\x00\xff\xff\xff\xe0\x03\xff\xf8\x00\x00\x00\x3f\xe0\x00\x00\x01\xff\xff\xe7\xff\xff\xff\xe0\x00\x00\x07\xff\xff\xc0\x00\x1f\xe0\x00\x00\x01\xff\xff\x00\x00\x03\xff\xff\xff\xe0\x00\x00\x1f\xe0\x03\xff\xff\x00\x00\x00\x07\xff\xf0\x3f\x80\x00\x00\x0f\xff\xff\xfe\x00\x00\xff\xff\xff\x00\x00\x3f\xff\xff\x80\x0f\xff\xfe\x01\xff\xff\xff\xf8\x3f\xff\xff\xc0\x00\x00\xff\xff\xff",
+  "\xff\xff\xff\x80\x00\xff\xff\xff\xf0\x00\x00\x1f\x00\x3f\xff\xfe\x0f\xf0\x1c\x00\xff\xff\xe0\x00\x0f\xc0\x1f\xff\xc0\x00\x00\x01\xff\x80\xf7\xff\xf8\x00\x00\x3f\xff\xc0\x00\x00\x01\xff\xf0\x00\x03\xe3\xfc\x00\x07\xf8\x00\x00\x3f\xff\xff\xfe\x00\x00\x1f\x00\x00\x00\x18\x00\x3f\xff\xff\xf8\x0f\xe0\x00\x00\x00\x60\x00\x07\xff\xff\xfe\x00\x60\xff\xff\xff\xf8\x00\x00\x3f\xff\x80\x00\x00\x3f\xff\xff\xf0\x00\x00\x0f\xf0\x00\xff\xff\xf1\xff\x00\x3f\xff\xff\xff\x01\xff\xe0\x00\x00\x00",
+  "\xff\xff\xff\xfc\x00\x00\x00\xff\xff\xf0\x01\xff\xff\xf8\x00\x00\xff\xff\xff\xe7\xff\xf8\x01\xf8\x7f\xff\xff\x80\x00\x3f\xff\xfc\x00\x00\x01\xff\xff\xe0\x00\x3f\xc0\x00\x00\x7f\xff\xff\x00\x00\x0f\xff\xff\xff\xc0\x00\x0f\xff\xf1\xff\xff\xff\xf8\x00\x0f\xff\xff\xfc\x00\x00\x07\xff\xff\xff\x80\xff\xff\xf8\x07\xf0\x00\x00\x00\x1f\xff\xff\xff\xc0\x00\xff\xff\xff\xc0\x00\x0e\xff\xff\xff\xc0\x00\x00\x03\xff\xf8\x00\x00\x03\xff\x80\x00\x00\x00\xe0\x00\x00\x0f\xf8\x00\x00\x3f\xff\xff\xff",
+  "\x3f\x00\x03\xc0\x1f\x00\x00\x00\x0f\xf0\x00\x07\xff\xff\xef\x00\xfe\x00\x7f\xfe\x00\x00\x3f\xf0\x00\x3f\xc0\x00\x00\x07\xfc\x00\x00\x03\xff\xff\xff\x0f\xff\xff\xff\xc0\x07\xf8\x00\x00\xf8\x00\x00\x3f\x9f\xff\xff\xfc\x00\x00\x3f\xff\xc0\x00\x03\xff\xff\xc0\x00\x00\xff\xfc\x00\x1f\xff\xe0\x00\x00\x07\xff\xe0\x07\x00\x00\x00\x7f\xff\xfe\x00\x00\x00\xff\xff\xfe\x00\x00\x0f\xfc\x00\x07\xff\xf0\x00\x00\x00\x7f\x80\x03\xcf\xff\x80\x00\x01\xff\xff\xe0\x3c\x00\x00\x3f\xff\xff\xff\x80\x00\x00",
+  "\x30\x00\x00\x00\xff\xf8\x00\x00\xff\xfc\x00\x3f\xff\xff\x80\x00\x00\x0f\xcf\xff\xcf\xff\xff\xc0\xff\xff\xff\x80\x00\x00\x01\xff\xff\xff\xf0\x00\x00\x00\x1f\xff\x00\x03\xff\xfc\x00\x00\x00\x07\xff\x80\x00\x7f\xff\xff\xfe\x0f\xff\xc0\x00\x00\x00\x7f\xf0\xbf\xff\xff\xe0\x00\x00\xff\xf8\x00\x00\x01\xff\xff\xf8\x00\x00\x3e\x00\x00\x07\xff\xe0\x00\x00\x00\x80\x00\x03\x80\x01\xff\xff\xff\xf8\x60\x00\x00\x00\xff\xf0\x00\x1f\xff\xff\xc7\xff\xf0\x40\xff\xff\xfe\x00\x00\x07\xff\xdf\xff\x80\x00\x00",
+  "\xff\xff\xff\x83\xff\xf8\x1f\xff\x1f\xff\xff\x80\x0f\xff\xff\xe0\x00\x00\x00\x3f\xff\xff\xc0\xf8\x00\x00\x78\x00\x1c\x00\x00\x00\x1f\xe0\x00\x00\x00\xff\xff\xe0\x3f\xff\xff\xfe\x00\x00\x03\xff\xff\xfe\x00\x00\x00\x1f\xff\xfc\x00\x7f\xff\x00\x00\x00\x1f\xff\xff\x00\x02\x00\x00\x3f\xff\xfc\x00\x00\x00\xff\xf0\x1f\xfe\xff\xff\xc0\x01\xff\xff\xff\xf0\x00\x00\x00\xff\xff\xfe\x00\x00\x00\x0f\xff\xc0\x00\x00\x7f\x7f\xc0\x00\x00\x01\xff\xff\xfe\x0f\xff\xff\xff\xc0\x00\x0f\x80\x00\x00\x3f\xff\xff\xff",
+  "\xff\xff\xff\xfe\x00\x00\x00\xff\xf8\x0f\xff\xff\xf0\x00\x00\x07\xff\xff\xfb\xff\xc0\x00\x07\xfc\x07\xe0\x00\x00\x01\xff\xff\xe0\x00\x7f\xff\xff\xf8\x00\x00\x3f\xff\xf8\x00\x00\x00\x0f\xff\xff\x00\x00\x0f\xc0\x00\x00\x3f\xff\xf0\x00\x00\x01\xff\xff\xfe\x1f\xff\xf8\x00\x00\x20\x00\x00\x00\x3f\xff\xbf\xff\x9f\xff\xff\xfc\x3f\xff\xff\xf0\x00\x00\x07\x80\x00\x00\xff\xff\xe7\xff\xff\xff\xf0\x00\x00\x3f\xff\xff\xff\x00\x00\x07\xff\xff\xe0\xff\xff\xff\xe0\x01\xff\xff\xff\xf8\x00\x00\x00\x7f\xff\xff\xff",
+  "\x00\x00\x00\x1f\xff\xc0\x00\x0f\xff\xc0\x00\x00\x1f\xff\xc0\x00\x1f\xc0\x00\x00\x03\xff\x80\x00\x00\x07\xff\xff\xff\xc0\x00\x00\x00\x80\x00\x3f\xfc\x00\xc0\x00\x0f\xff\xff\x00\x00\x06\x00\x3f\xfc\x1e\x00\x1f\xff\xff\xf0\x00\x3e\x0f\xff\xff\xf0\x00\x00\x3f\xff\xf0\x00\x00\x00\x1f\xff\xc0\x00\x00\xff\xff\xff\xf8\x00\xe0\x00\x00\xff\xff\xff\xfe\x00\x00\x0f\xff\xff\xfe\x3f\xff\xff\xfc\x07\xfe\x00\x00\x00\xc0\x00\x7f\xff\xff\xfe\x00\xff\xff\xff\xfc\x07\xff\xff\xe0\x00\x3f\xe3\xff\xff\xc0\x00\x00\x3f\xff",
+  "\x00\x00\x00\x0f\xff\xc0\x00\x0f\xf8\x00\x00\x00\xff\xfc\x00\x00\x0f\xff\xff\xfe\x00\x00\x00\x03\xff\x00\xff\xfc\x07\xff\xf0\x1f\xff\xfe\x0f\xff\xff\xfd\xff\xff\xff\xf0\x1f\xff\xf0\x00\x07\xf8\xff\xf8\x00\x00\x00\xff\xff\xc0\x3f\xff\xff\xff\x80\x00\x00\x0f\xff\xff\xff\x00\x00\x03\xff\xff\xf0\x00\x07\xff\xff\x00\x00\x3f\xff\xf0\x01\xff\xff\xc0\x01\xff\xff\xff\x00\x3f\xff\xf8\x1f\xff\xff\xfe\x1f\xff\xff\xff\xc0\x00\x00\x7f\xe0\x00\x07\xff\xff\xfe\x00\x00\x00\x03\xe0\x07\xff\xc0\x03\xfc\x00\x07\xff\xff\xff",
+  "\xff\xff\xff\x00\x00\x03\xc0\x00\x00\x01\xff\xff\xf8\x00\x00\x00\x0f\xff\xff\xff\x00\x00\x0f\x00\x00\xff\xff\xf8\x80\x00\xf8\x00\x0f\xc0\x00\x00\x00\xe0\x00\x00\x00\xff\xff\xff\xf8\x0f\xff\xff\xfe\x00\x00\x18\x00\x00\x7f\xff\xff\xff\x00\x00\x03\xff\xff\xff\x00\x7f\xff\xff\xfc\x00\x03\xc0\x00\x00\x0f\xff\xff\xff\xf0\x00\x07\xff\xff\x80\x01\xff\xff\xff\xe0\x00\x0f\xff\xfe\x07\xff\xff\xf8\x00\xff\xff\xff\xc0\x00\x00\x03\xe0\x00\x07\xff\xf0\x0f\xff\xf0\x00\x00\xff\xff\xf8\x7f\xc0\x03\xc0\x3f\xff\xe0\x00\x00\x00",
+
+  /* These are zero-terminated strings */
+
+  "abc",
+  "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
+};
+
+static uschar *hashes[] = {
+  "DA39A3EE5E6B4B0D3255BFEF95601890AFD80709",
+  "3CDF2936DA2FC556BFA533AB1EB59CE710AC80E5",
+  "19C1E2048FA7393CFBF2D310AD8209EC11D996E5",
+  "CA775D8C80FAA6F87FA62BECA6CA6089D63B56E5",
+  "71AC973D0E4B50AE9E5043FF4D615381120A25A0",
+  "A6B5B9F854CFB76701C3BDDBF374B3094EA49CBA",
+  "D87A0EE74E4B9AD72E6847C87BDEEB3D07844380",
+  "1976B8DD509FE66BF09C9A8D33534D4EF4F63BFD",
+  "5A78F439B6DB845BB8A558E4CEB106CD7B7FF783",
+  "F871BCE62436C1E280357416695EE2EF9B83695C",
+  "62B243D1B780E1D31CF1BA2DE3F01C72AEEA0E47",
+  "1698994A273404848E56E7FDA4457B5900DE1342",
+  "056F4CDC02791DA7ED1EB2303314F7667518DEEF",
+  "9FE2DA967BD8441EEA1C32DF68DDAA9DC1FC8E4B",
+  "73A31777B4ACE9384EFA8BBEAD45C51A71ABA6DD",
+  "3F9D7C4E2384EDDABFF5DD8A31E23DE3D03F42AC",
+  "4814908F72B93FFD011135BEE347DE9A08DA838F",
+  "0978374B67A412A3102C5AA0B10E1A6596FC68EB",
+  "44AD6CB618BD935460D46D3F921D87B99AB91C1E",
+  "02DC989AF265B09CF8485640842128DCF95E9F39",
+  "67507B8D497B35D6E99FC01976D73F54AECA75CF",
+  "1EAE0373C1317CB60C36A42A867B716039D441F5",
+  "9C3834589E5BFFAC9F50950E0199B3EC2620BEC8",
+  "209F7ABC7F3B878EE46CDF3A1FBB9C21C3474F32",
+  "05FC054B00D97753A9B3E2DA8FBBA3EE808CEF22",
+  "0C4980EA3A46C757DFBFC5BAA38AC6C8E72DDCE7",
+  "96A460D2972D276928B69864445BEA353BDCFFD2",
+  "F3EF04D8FA8C6FA9850F394A4554C080956FA64B",
+  "F2A31D875D1D7B30874D416C4D2EA6BAF0FFBAFE",
+  "F4942D3B9E9588DCFDC6312A84DF75D05F111C20",
+  "310207DF35B014E4676D30806FA34424813734DD",
+  "4DA1955B2FA7C7E74E3F47D7360CE530BBF57CA3",
+  "74C4BC5B26FB4A08602D40CCEC6C6161B6C11478",
+  "0B103CE297338DFC7395F7715EE47539B556DDB6",
+  "EFC72D99E3D2311CE14190C0B726BDC68F4B0821",
+  "660EDAC0A8F4CE33DA0D8DBAE597650E97687250",
+  "FE0A55A988B3B93946A63EB36B23785A5E6EFC3E",
+  "0CBDF2A5781C59F907513147A0DE3CC774B54BF3",
+  "663E40FEE5A44BFCB1C99EA5935A6B5BC9F583B0",
+  "00162134256952DD9AE6B51EFB159B35C3C138C7",
+  "CEB88E4736E354416E2010FC1061B3B53B81664B",
+  "A6A2C4B6BCC41DDC67278F3DF4D8D0B9DD7784EF",
+  "C23D083CD8820B57800A869F5F261D45E02DC55D",
+  "E8AC31927B78DDEC41A31CA7A44EB7177165E7AB",
+  "E864EC5DBAB0F9FF6984AB6AD43A8C9B81CC9F9C",
+  "CFED6269069417A84D6DE2347220F4B858BCD530",
+  "D9217BFB46C96348722C3783D29D4B1A3FEDA38C",
+  "DEC24E5554F79697218D317315FA986229CE3350",
+  "83A099DF7071437BA5495A5B0BFBFEFE1C0EF7F3",
+  "AA3198E30891A83E33CE3BFA0587D86A197D4F80",
+  "9B6ACBEB4989CBEE7015C7D515A75672FFDE3442",
+  "B021EB08A436B02658EAA7BA3C88D49F1219C035",
+  "CAE36DAB8AEA29F62E0855D9CB3CD8E7D39094B1",
+  "02DE8BA699F3C1B0CB5AD89A01F2346E630459D7",
+  "88021458847DD39B4495368F7254941859FAD44B",
+  "91A165295C666FE85C2ADBC5A10329DAF0CB81A0",
+  "4B31312EAF8B506811151A9DBD162961F7548C4B",
+  "3FE70971B20558F7E9BAC303ED2BC14BDE659A62",
+  "93FB769D5BF49D6C563685954E2AECC024DC02D6",
+  "BC8827C3E614D515E83DEA503989DEA4FDA6EA13",
+  "E83868DBE4A389AB48E61CFC4ED894F32AE112AC",
+  "55C95459CDE4B33791B4B2BCAAF840930AF3F3BD",
+  "36BB0E2BA438A3E03214D9ED2B28A4D5C578FCAA",
+  "3ACBF874199763EBA20F3789DFC59572ACA4CF33",
+  "86BE037C4D509C9202020767D860DAB039CADACE",
+  "51B57D7080A87394EEC3EB2E0B242E553F2827C9",
+  "1EFBFA78866315CE6A71E457F3A750A38FACAB41",
+  "57D6CB41AEEC20236F365B3A490C61D0CFA39611",
+  "C532CB64B4BA826372BCCF2B4B5793D5B88BB715",
+  "15833B5631032663E783686A209C6A2B47A1080E",
+  "D04F2043C96E10CD83B574B1E1C217052CD4A6B2",
+  "E8882627C64DB743F7DB8B4413DD033FC63BEB20",
+  "CD2D32286B8867BC124A0AF2236FC74BE3622199",
+  "019B70D745375091ED5C7B218445EC986D0F5A82",
+  "E5FF5FEC1DADBAED02BF2DAD4026BE6A96B3F2AF",
+  "6F4E23B3F2E2C068D13921FE4E5E053FFED4E146",
+  "25E179602A575C915067566FBA6DA930E97F8678",
+  "67DED0E68E235C8A523E051E86108EEB757EFBFD",
+  "AF78536EA83C822796745556D62A3EE82C7BE098",
+  "64D7AC52E47834BE72455F6C64325F9C358B610D",
+  "9D4866BAA3639C13E541F250FFA3D8BC157A491F",
+  "2E258811961D3EB876F30E7019241A01F9517BEC",
+  "8E0EBC487146F83BC9077A1630E0FB3AB3C89E63",
+  "CE8953741FFF3425D2311FBBF4AB481B669DEF70",
+  "789D1D2DAB52086BD90C0E137E2515ED9C6B59B5",
+  "B76CE7472700DD68D6328B7AA8437FB051D15745",
+  "F218669B596C5FFB0B1C14BD03C467FC873230A0",
+  "1FF3BDBE0D504CB0CDFAB17E6C37ABA6B3CFFDED",
+  "2F3CBACBB14405A4652ED52793C1814FD8C4FCE0",
+  "982C8AB6CE164F481915AF59AAED9FFF2A391752",
+  "5CD92012D488A07ECE0E47901D0E083B6BD93E3F",
+  "69603FEC02920851D4B3B8782E07B92BB2963009",
+  "3E90F76437B1EA44CF98A08D83EA24CECF6E6191",
+  "34C09F107C42D990EB4881D4BF2DDDCAB01563AE",
+  "474BE0E5892EB2382109BFC5E3C8249A9283B03D",
+  "A04B4F75051786682483252438F6A75BF4705EC6",
+  "BE88A6716083EB50ED9416719D6A247661299383",
+  "C67E38717FEE1A5F65EC6C7C7C42AFC00CD37F04",
+  "959AC4082388E19E9BE5DE571C047EF10C174A8D",
+  "BAA7AA7B7753FA0ABDC4A541842B5D238D949F0A",
+  "351394DCEBC08155D100FCD488578E6AE71D0E9C",
+  "AB8BE94C5AF60D9477EF1252D604E58E27B2A9EE",
+  "3429EC74A695FDD3228F152564952308AFE0680A",
+  "907FA46C029BC67EAA8E4F46E3C2A232F85BD122",
+  "2644C87D1FBBBC0FC8D65F64BCA2492DA15BAAE4",
+  "110A3EEB408756E2E81ABAF4C5DCD4D4C6AFCF6D",
+  "CD4FDC35FAC7E1ADB5DE40F47F256EF74D584959",
+  "8E6E273208AC256F9ECCF296F3F5A37BC8A0F9F7",
+  "FE0606100BDBC268DB39B503E0FDFE3766185828",
+  "6C63C3E58047BCDB35A17F74EEBA4E9B14420809",
+  "BCC2BD305F0BCDA8CF2D478EF9FE080486CB265F",
+  "CE5223FD3DD920A3B666481D5625B16457DCB5E8",
+  "948886776E42E4F5FAE1B2D0C906AC3759E3F8B0",
+  "4C12A51FCFE242F832E3D7329304B11B75161EFB",
+  "C54BDD2050504D92F551D378AD5FC72C9ED03932",
+  "8F53E8FA79EA09FD1B682AF5ED1515ECA965604C",
+  "2D7E17F6294524CE78B33EAB72CDD08E5FF6E313",
+  "64582B4B57F782C9302BFE7D07F74AA176627A3A",
+  "6D88795B71D3E386BBD1EB830FB9F161BA98869F",
+  "86AD34A6463F12CEE6DE9596ABA72F0DF1397FD1",
+  "7EB46685A57C0D466152DC339C8122548C757ED1",
+  "E7A98FB0692684054407CC221ABC60C199D6F52A",
+  "34DF1306662206FD0A5FC2969A4BEEC4EB0197F7",
+  "56CF7EBF08D10F0CB9FE7EE3B63A5C3A02BCB450",
+  "3BAE5CB8226642088DA760A6F78B0CF8EDDEA9F1",
+  "6475DF681E061FA506672C27CBABFA9AA6DDFF62",
+  "79D81991FA4E4957C8062753439DBFD47BBB277D",
+  "BAE224477B20302E881F5249F52EC6C34DA8ECEF",
+  "EDE4DEB4293CFE4138C2C056B7C46FF821CC0ACC",
+
+  "A9993E364706816ABA3E25717850C26C9CD0D89D",
+  "84983E441C3BD26EBAAE4AA1F95129E5E54670F1"
+};
+
+static uschar *atest = "34AA973CD4C4DAA4F61EEB2BDBAD27316534016F";
+
+int main(void)
+{
+sha1 base;
+int j;
+int i = 0x01020304;
+uschar *ctest = (uschar *)(&i);
+uschar buffer[256];
+uschar digest[20];
+uschar s[41];
+printf("Checking sha1: %s-endian\n\n", (ctest[0] == 0x04)? "little" : "big");
+
+for (i = 0; i < sizeof(tests)/sizeof(uschar *); i ++)
+  {
+  printf("%d.\nShould be: %s\n", i, hashes[i]);
+  native_sha1_start(&base);
+  native_sha1_end(&base, tests[i], (i <= 128)? i : strlen(tests[i]), digest);
+  for (j = 0; j < 20; j++) sprintf(s+2*j, "%02X", digest[j]);
+  printf("Computed:  %s\n", s);
+  if (strcmp(s, hashes[i]) != 0) printf("*** No match ***\n");
+  printf("\n");
+  }
+
+/* 1 000 000 repetitions of "a" */
+
+ctest = malloc(1000000);
+memset(ctest, 'a', 1000000);
+
+printf("1 000 000 repetitions of 'a'\n");
+printf("Should be: %s\n", atest);
+native_sha1_start(&base);
+native_sha1_end(&base, ctest, 1000000, digest);
+for (j = 0; j < 20; j++) sprintf(s+2*j, "%02X", digest[j]);
+printf("Computed:  %s\n", s);
+if (strcmp(s, atest) != 0) printf("*** No match ***\n");
+
+}
+# endif	/*STAND_ALONE*/
+
+/* End of File */
diff --git a/src/src/hash.h b/src/src/hash.h
new file mode 100644
index 000000000..9e91f1aad
--- /dev/null
+++ b/src/src/hash.h
@@ -0,0 +1,76 @@
+/*
+ *  Exim - an Internet mail transport agent
+ *
+ *  Copyright (C) 2016  Exim maintainers
+ *
+ *  Hash interface functions
+ */
+
+#include "exim.h"
+
+#if !defined(HASH_H)	/* entire file */
+#define HASH_H
+
+#include "sha_ver.h"
+#include "blob.h"
+
+#ifdef SHA_OPENSSL
+# include <openssl/sha.h>
+#elif defined SHA_GNUTLS
+# include <gnutls/crypto.h>
+#elif defined(SHA_GCRYPT)
+# include <gcrypt.h>
+#elif defined(SHA_POLARSSL)
+# include "pdkim/pdkim.h"		/*XXX ugly */
+# include "pdkim/polarssl/sha1.h"
+# include "pdkim/polarssl/sha2.h"
+#endif
+
+
+/* Hash context for the exim_sha_* routines */
+
+typedef enum hashmethod {
+  HASH_BADTYPE,
+  HASH_SHA1,
+  HASH_SHA256,
+  HASH_SHA3_224,
+  HASH_SHA3_256,
+  HASH_SHA3_384,
+  HASH_SHA3_512,
+} hashmethod;
+
+typedef struct {
+  hashmethod	method;
+  int		hashlen;
+
+#ifdef SHA_OPENSSL
+  union {
+    SHA_CTX      sha1;       /* SHA1 block                                */
+    SHA256_CTX   sha2;       /* SHA256 block                              */
+  } u;
+
+#elif defined(SHA_GNUTLS)
+  gnutls_hash_hd_t sha;      /* Either SHA1 or SHA256 block               */
+
+#elif defined(SHA_GCRYPT)
+  gcry_md_hd_t sha;          /* Either SHA1 or SHA256 block               */
+
+#elif defined(SHA_POLARSSL)
+  union {
+    sha1_context sha1;       /* SHA1 block                                */
+    sha2_context sha2;       /* SHA256 block                              */
+  } u;
+
+#elif defined(SHA_NATIVE)
+  sha1 sha1;
+#endif
+
+} hctx;
+
+extern void     exim_sha_init(hctx *, hashmethod);
+extern void     exim_sha_update(hctx *, const uschar *a, int);
+extern void     exim_sha_finish(hctx *, blob *);
+extern int      exim_sha_hashlen(hctx *);
+
+#endif
+/* End of File */
diff --git a/src/src/header.c b/src/src/header.c
index 8136c69fe..dad1638cb 100644
--- a/src/src/header.c
+++ b/src/src/header.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2009 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -450,10 +450,11 @@ for (s = strings; s != NULL; s = s->next)
 
 va_start(ap, count);
 for (i = 0; i < count; i++)
-  {
   if (one_pattern_match(name, slen, has_addresses, va_arg(ap, uschar *)))
+    {
+    va_end(ap);
     return cond;
-  }
+    }
 va_end(ap);
 
 return !cond;
diff --git a/src/src/host.c b/src/src/host.c
index 90ba852d8..25dab2bb8 100644
--- a/src/src/host.c
+++ b/src/src/host.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for finding hosts, either by gethostbyname(), gethostbyaddr(), or
@@ -257,7 +257,7 @@ else
       count++;
 
   yield = store_get(sizeof(struct hostent));
-  alist = store_get((count + 1) * sizeof(char **));
+  alist = store_get((count + 1) * sizeof(char *));
   adds  = store_get(count *alen);
 
   yield->h_name = CS name;
@@ -597,12 +597,12 @@ if (sender_host_name == NULL)
   sender_fullhost = (sender_helo_name == NULL)? address :
     string_sprintf("(%s) %s", sender_helo_name, address);
 
-  sender_rcvhost = string_cat(NULL, &size, &ptr, address, adlen);
+  sender_rcvhost = string_catn(NULL, &size, &ptr, address, adlen);
 
   if (sender_ident != NULL || show_helo || portptr != NULL)
     {
     int firstptr;
-    sender_rcvhost = string_cat(sender_rcvhost, &size, &ptr, US" (", 2);
+    sender_rcvhost = string_catn(sender_rcvhost, &size, &ptr, US" (", 2);
     firstptr = ptr;
 
     if (portptr != NULL)
@@ -617,7 +617,7 @@ if (sender_host_name == NULL)
       sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2,
         (firstptr == ptr)? US"ident=" : US" ident=", sender_ident);
 
-    sender_rcvhost = string_cat(sender_rcvhost, &size, &ptr, US")", 1);
+    sender_rcvhost = string_catn(sender_rcvhost, &size, &ptr, US")", 1);
     }
 
   sender_rcvhost[ptr] = 0;   /* string_cat() always leaves room */
@@ -1067,7 +1067,7 @@ if (Ustrchr(address, ':') != NULL)
 /* Handle IPv4 address */
 
 (void)sscanf(CS address, "%d.%d.%d.%d", x, x+1, x+2, x+3);
-bin[v4offset] = (x[0] << 24) + (x[1] << 16) + (x[2] << 8) + x[3];
+bin[v4offset] = ((uint)x[0] << 24) + (x[1] << 16) + (x[2] << 8) + x[3];
 return v4offset+1;
 }
 
@@ -1098,7 +1098,7 @@ for (i = 0; i < count; i++)
   if (mask == 0) wordmask = 0;
   else if (mask < 32)
     {
-    wordmask = (-1) << (32 - mask);
+    wordmask = (uint)(-1) << (32 - mask);
     mask = 0;
     }
   else
@@ -1321,7 +1321,7 @@ for (i = 0; i < size; i++)
   if (mlen == 0) mask = 0;
   else if (mlen < 32)
     {
-    mask = (-1) << (32 - mlen);
+    mask = (uint)(-1) << (32 - mlen);
     mlen = 0;
     }
   else
@@ -1521,7 +1521,7 @@ int len;
 uschar *s, *t;
 struct hostent *hosts;
 struct in_addr addr;
-unsigned long time_msec;
+unsigned long time_msec = 0;	/* init to quieten dumb static analysis */
 
 if (slow_lookup_log) time_msec = get_time_in_ms();
 
@@ -2777,17 +2777,15 @@ host which is not the primary hostname. */
 last = NULL;    /* Indicates that not even the first item is filled yet */
 
 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
-     rr != NULL;
-     rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
+     rr;
+     rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == ind_type)
   {
   int precedence;
   int weight = 0;        /* For SRV records */
   int port = PORT_NONE;
-  uschar *s;             /* MUST be unsigned for GETSHORT */
+  const uschar * s = rr->data;	/* MUST be unsigned for GETSHORT */
   uschar data[256];
 
-  if (rr->type != ind_type) continue;
-  s = rr->data;
   GETSHORT(precedence, s);      /* Pointer s is advanced */
 
   /* For MX records, we use a random "weight" which causes multiple records of
@@ -2920,6 +2918,12 @@ for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
   NEXT_MX_RR: continue;
   }
 
+if (!last)	/* No rr of correct type; give up */
+  {
+  yield = HOST_FIND_FAILED;
+  goto out;
+  }
+
 /* If the list of hosts was obtained from SRV records, there are two things to
 do. First, if there is only one host, and it's name is ".", it means there is
 no SMTP service at this domain. Otherwise, we have to sort the hosts of equal
@@ -2946,7 +2950,7 @@ if (ind_type == T_SRV)
       debug_printf("  %s P=%d W=%d\n", h->name, h->mx, h->sort_key % 1000);
     }
 
-  for (pptr = &host, h = host; h != last; pptr = &(h->next), h = h->next)
+  for (pptr = &host, h = host; h != last; pptr = &h->next, h = h->next)
     {
     int sum = 0;
     host_item *hh;
@@ -3051,7 +3055,8 @@ dns_init(FALSE, FALSE,       /* Disable qualify_single and search_parents */
 
 for (h = host; h != last->next; h = h->next)
   {
-  if (h->address != NULL) continue;  /* Inserted by a multihomed host */
+  if (h->address) continue;  /* Inserted by a multihomed host */
+
   rc = set_address_from_dns(h, &last, ignore_target_hosts, allow_mx_to_ip,
     NULL, dnssec_request, dnssec_require);
   if (rc != HOST_FOUND)
@@ -3063,7 +3068,7 @@ for (h = host; h != last->next; h = h->next)
       h->why = hwhy_deferred;
       }
     else
-      h->why = (rc == HOST_IGNORED)? hwhy_ignored : hwhy_failed;
+      h->why = rc == HOST_IGNORED ? hwhy_ignored : hwhy_failed;
     }
   }
 
diff --git a/src/src/imap_utf7.c b/src/src/imap_utf7.c
index dcccaeef8..0c3d5a20d 100644
--- a/src/src/imap_utf7.c
+++ b/src/src/imap_utf7.c
@@ -165,13 +165,12 @@ while (slen > 0)
     else
       {
       *error = string_sprintf("imapfolder: illegal character '%c'", s[1]);
-      if (yield) store_reset(yield);
       return NULL;
       }
 
     if (outptr > outbuf + sizeof(outbuf) - 3)
       {
-      yield = string_cat(yield, &size, &ptr, outbuf, outptr - outbuf);
+      yield = string_catn(yield, &size, &ptr, outbuf, outptr - outbuf);
       outptr = outbuf;
       }
 
@@ -197,7 +196,7 @@ if (base64mode)
 iconv_close(icd);
 #endif
 
-yield = string_cat(yield, &size, &ptr, outbuf, outptr - outbuf);
+yield = string_catn(yield, &size, &ptr, outbuf, outptr - outbuf);
 if (yield[ptr-1] == '.')
   ptr--;
 yield[ptr] = '\0';
diff --git a/src/src/ip.c b/src/src/ip.c
index 4960e3b29..c275b1f00 100644
--- a/src/src/ip.c
+++ b/src/src/ip.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for doing things with sockets. With the advent of IPv6 this has
@@ -175,12 +175,14 @@ Arguments:
   address     the remote address, in text form
   port        the remote port
   timeout     a timeout (zero for indefinite timeout)
+  fastopen    TRUE iff TCP_FASTOPEN can be used
 
 Returns:      0 on success; -1 on failure, with errno set
 */
 
 int
-ip_connect(int sock, int af, const uschar *address, int port, int timeout)
+ip_connect(int sock, int af, const uschar *address, int port, int timeout,
+  BOOL fastopen)
 {
 struct sockaddr_in s_in4;
 struct sockaddr *s_ptr;
@@ -218,9 +220,34 @@ IPv6 support. */
 /* If no connection timeout is set, just call connect() without setting a
 timer, thereby allowing the inbuilt OS timeout to operate. */
 
+callout_address = string_sprintf("[%s]:%d", address, port);
 sigalrm_seen = FALSE;
 if (timeout > 0) alarm(timeout);
-rc = connect(sock, s_ptr, s_len);
+
+#if defined(TCP_FASTOPEN) && defined(MSG_FASTOPEN)
+/* TCP Fast Open, if the system has a cookie from a previous call to
+this peer, can send data in the SYN packet.  The peer can send data
+before it gets our ACK of its SYN,ACK - the latter is useful for
+the SMTP banner.  Is there any usage where the former might be?
+We might extend the ip_connect() args for data if so.  For now,
+connect in FASTOPEN mode but with zero data.
+*/
+
+if (fastopen)
+  {
+  if (  (rc = sendto(sock, NULL, 0, MSG_FASTOPEN, s_ptr, s_len)) < 0
+     && errno == EOPNOTSUPP
+     )
+    {
+    DEBUG(D_transport)
+      debug_printf("Tried TCP Fast Open but apparently not enabled by sysctl\n");
+    rc = connect(sock, s_ptr, s_len);
+    }
+  }
+else
+#endif
+  rc = connect(sock, s_ptr, s_len);
+
 save_errno = errno;
 alarm(0);
 
@@ -238,10 +265,7 @@ if (running_in_test_harness  && save_errno == ECONNREFUSED && timeout == 999999)
 /* Success */
 
 if (rc >= 0)
-  {
-  callout_address = string_sprintf("[%s]:%d", address, port);
   return 0;
-  }
 
 /* A failure whose error code is "Interrupted system call" is in fact
 an externally applied timeout if the signal handler has been run. */
@@ -293,7 +317,6 @@ if (hostname[0] == '[' &&
     hostname[namelen - 1] == ']')
   {
   uschar * host = string_copyn(hostname+1, namelen-2);
-debug_printf("%s: 1\n", __FUNCTION__);
   if (string_is_ip_address(host, NULL) == 0)
     {
     *errstr = string_sprintf("malformed IP address \"%s\"", hostname);
@@ -305,16 +328,12 @@ debug_printf("%s: 1\n", __FUNCTION__);
 /* Otherwise check for an unadorned IP address */
 
 else if (string_is_ip_address(hostname, NULL) != 0)
-  {
-debug_printf("%s: 2\n", __FUNCTION__);
   shost.name = shost.address = string_copyn(hostname, namelen);
-  }
 
 /* Otherwise lookup IP address(es) from the name */
 
 else
   {
-debug_printf("%s: 3\n", __FUNCTION__);
   shost.name = string_copyn(hostname, namelen);
   if (host_find_byname(&shost, NULL, HOST_FIND_QUALIFY_SINGLE,
       NULL, FALSE) != HOST_FOUND)
@@ -328,7 +347,6 @@ debug_printf("%s: 3\n", __FUNCTION__);
 
 for (h = &shost; h; h = h->next)
   {
-debug_printf("%s: 4 '%s'\n", __FUNCTION__, h->address);
   fd = Ustrchr(h->address, ':') != 0
     ? fd6 < 0 ? (fd6 = ip_socket(type, af = AF_INET6)) : fd6
     : fd4 < 0 ? (fd4 = ip_socket(type, af = AF_INET )) : fd4;
@@ -340,7 +358,7 @@ debug_printf("%s: 4 '%s'\n", __FUNCTION__, h->address);
     }
 
   for(port = portlo; port <= porthi; port++)
-    if (ip_connect(fd, af, h->address, port, timeout) == 0)
+    if (ip_connect(fd, af, h->address, port, timeout, type == SOCK_STREAM) == 0)
       {
       if (fd != fd6) close(fd6);
       if (fd != fd4) close(fd4);
@@ -397,6 +415,7 @@ if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) < 0)
   return -1;
   }
 
+callout_address = string_copy(path);
 server.sun_family = AF_UNIX;
 Ustrncpy(server.sun_path, path, sizeof(server.sun_path)-1);
 server.sun_path[sizeof(server.sun_path)-1] = '\0';
@@ -408,7 +427,6 @@ if (connect(sock, (struct sockaddr *) &server, sizeof(server)) < 0)
 		path, strerror(err));
   return -1;
   }
-callout_address = string_copy(path);
 return sock;
 }
 
diff --git a/src/src/log.c b/src/src/log.c
index 558c000d7..52570ac13 100644
--- a/src/src/log.c
+++ b/src/src/log.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for writing log files. The code for maintaining datestamped
@@ -47,8 +47,80 @@ static BOOL   path_inspected = FALSE;
 static int    logging_mode = LOG_MODE_FILE;
 static uschar *file_path = US"";
 
-
-
+static size_t pid_position[2];
+
+
+/* These should be kept in-step with the private delivery error
+number definitions in macros.h */
+
+static const uschar * exim_errstrings[] = {
+  US"",
+  US"unknown error",
+  US"user slash",
+  US"exist race",
+  US"not regular",
+  US"not directory",
+  US"bad ugid",
+  US"bad mode",
+  US"inode changed",
+  US"lock failed",
+  US"bad address2",
+  US"forbid pipe",
+  US"forbid file",
+  US"forbid reply",
+  US"missing pipe",
+  US"missing file",
+  US"missing reply",
+  US"bad redirect",
+  US"smtp closed",
+  US"smtp format",
+  US"spool format",
+  US"not absolute",
+  US"Exim-imposed quota",
+  US"held",
+  US"Delivery filter process failure",
+  US"Delivery add/remove header failure",
+  US"Delivery write incomplete error",
+  US"Some expansion failed",
+  US"Failed to get gid",
+  US"Failed to get uid",
+  US"Unset or non-existent transport",
+  US"MBX length mismatch",
+  US"Lookup failed routing or in smtp tpt",
+  US"Can't match format in appendfile",
+  US"Creation outside home in appendfile",
+  US"Can't check a list; lookup defer",
+  US"DNS lookup defer",
+  US"Failed to start TLS session",
+  US"Mandatory TLS session not started",
+  US"Failed to chown a file",
+  US"Failed to create a pipe",
+  US"When verifying",
+  US"When required by client",
+  US"Used internally in smtp transport",
+  US"RCPT gave 4xx error",
+  US"MAIL gave 4xx error",
+  US"DATA gave 4xx error",
+  US"Negotiation failed for proxy configured host",
+  US"Authenticator 'other' failure",
+  US"target not supporting SMTPUTF8",
+  US"",
+
+  US"Not time for routing",
+  US"Not time for local delivery",
+  US"Not time for any remote host",
+  US"Local-only delivery",
+  US"Domain in queue_domains",
+  US"Transport concurrency limit",
+};
+
+
+/************************************************/
+const uschar *
+exim_errstr(int err)
+{
+return err < 0 ? exim_errstrings[-err] : CUS strerror(err);
+}
 
 /*************************************************
 *              Write to syslog                   *
@@ -62,7 +134,7 @@ can get here if there is a failure to open the panic log.)
 
 Arguments:
   priority       syslog priority
-  s              the string to be written
+  s              the string to be written, the string may be modified!
 
 Returns:         nothing
 */
@@ -76,6 +148,8 @@ int linecount = 0;
 if (running_in_test_harness) return;
 
 if (!syslog_timestamp) s += log_timezone? 26 : 20;
+if (!syslog_pid && LOGGING(pid))
+    memmove(s + pid_position[0], s + pid_position[1], pid_position[1] - pid_position[0]);
 
 len = Ustrlen(s);
 
@@ -182,7 +256,11 @@ Returns:       a file descriptor, or < 0 on failure (errno set)
 int
 log_create(uschar *name)
 {
-int fd = Uopen(name, O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
+int fd = Uopen(name,
+#ifdef O_CLOEXEC
+	O_CLOEXEC |
+#endif
+	O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
 
 /* If creation failed, attempt to build a log directory in case that is the
 problem. */
@@ -196,7 +274,11 @@ if (fd < 0 && errno == ENOENT)
   DEBUG(D_any) debug_printf("%s log directory %s\n",
     created? "created" : "failed to create", name);
   *lastslash = '/';
-  if (created) fd = Uopen(name, O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
+  if (created) fd = Uopen(name,
+#ifdef O_CLOEXEC
+			O_CLOEXEC |
+#endif
+		       	O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
   }
 
 return fd;
@@ -246,7 +328,11 @@ if (pid == 0)
 /* If we created a subprocess, wait for it. If it succeeded, try the open. */
 
 while (pid > 0 && waitpid(pid, &status, 0) != pid);
-if (status == 0) fd = Uopen(name, O_APPEND|O_WRONLY, LOG_MODE);
+if (status == 0) fd = Uopen(name,
+#ifdef O_CLOEXEC
+			O_CLOEXEC |
+#endif
+		       	O_APPEND|O_WRONLY, LOG_MODE);
 
 /* If we failed to create a subprocess, we are in a bad way. We return
 with fd still < 0, and errno set, letting the caller handle the error. */
@@ -368,11 +454,17 @@ if (!ok)
 /* We now have the file name. Try to open an existing file. After a successful
 open, arrange for automatic closure on exec(), and then return. */
 
-*fd = Uopen(buffer, O_APPEND|O_WRONLY, LOG_MODE);
+*fd = Uopen(buffer,
+#ifdef O_CLOEXEC
+		O_CLOEXEC |
+#endif
+	       	O_APPEND|O_WRONLY, LOG_MODE);
 
 if (*fd >= 0)
   {
+#ifndef O_CLOEXEC
   (void)fcntl(*fd, F_SETFD, fcntl(*fd, F_GETFD) | FD_CLOEXEC);
+#endif
   return;
   }
 
@@ -399,7 +491,9 @@ else if (euid == root_uid) *fd = log_create_as_exim(buffer);
 
 if (*fd >= 0)
   {
+#ifndef O_CLOEXEC
   (void)fcntl(*fd, F_SETFD, fcntl(*fd, F_GETFD) | FD_CLOEXEC);
+#endif
   return;
   }
 
@@ -420,12 +514,9 @@ log. If possible, save a copy of the original line that was being logged. If we
 are recursing (can't open the panic log either), the pointer will already be
 set. */
 
-if (panic_save_buffer == NULL)
-  {
-  panic_save_buffer = (uschar *)malloc(LOG_BUFFER_SIZE);
-  if (panic_save_buffer != NULL)
+if (!panic_save_buffer)
+  if ((panic_save_buffer = US malloc(LOG_BUFFER_SIZE)))
     memcpy(panic_save_buffer, log_buffer, LOG_BUFFER_SIZE);
-  }
 
 log_write(0, LOG_PANIC_DIE, "Cannot open %s log file \"%s\": %s: "
   "euid=%d egid=%d", log_names[type], buffer, strerror(errno), euid, getegid());
@@ -433,6 +524,13 @@ log_write(0, LOG_PANIC_DIE, "Cannot open %s log file \"%s\": %s: "
 }
 
 
+static void
+unlink_log(int type)
+{
+if (type == lt_debug) unlink(CS debuglog_name);
+}
+
+
 
 /*************************************************
 *     Add configuration file info to log line    *
@@ -498,12 +596,9 @@ log_write_failed(uschar *name, int length, int rc)
 {
 int save_errno = errno;
 
-if (panic_save_buffer == NULL)
-  {
-  panic_save_buffer = (uschar *)malloc(LOG_BUFFER_SIZE);
-  if (panic_save_buffer != NULL)
+if (!panic_save_buffer)
+  if ((panic_save_buffer = US malloc(LOG_BUFFER_SIZE)))
     memcpy(panic_save_buffer, log_buffer, LOG_BUFFER_SIZE);
-  }
 
 log_write(0, LOG_PANIC_DIE, "failed to write to %s: length=%d result=%d "
   "errno=%d (%s)", name, length, rc, save_errno,
@@ -572,6 +667,14 @@ while ((t = string_nextinlist(&tt, &sep, log_buffer, LOG_BUFFER_SIZE)))
 }
 
 
+void
+mainlog_close(void)
+{
+if (mainlogfd < 0) return;
+(void)close(mainlogfd);
+mainlogfd = -1;
+mainlog_inode = 0;
+}
 
 /*************************************************
 *            Write message to log file           *
@@ -659,15 +762,12 @@ if (panic_recurseflag)
 /* Ensure we have a buffer (see comment above); this should never be obeyed
 when running Exim proper, only when running utilities. */
 
-if (log_buffer == NULL)
-  {
-  log_buffer = (uschar *)malloc(LOG_BUFFER_SIZE);
-  if (log_buffer == NULL)
+if (!log_buffer)
+  if (!(log_buffer = US malloc(LOG_BUFFER_SIZE)))
     {
     fprintf(stderr, "exim: failed to get store for log buffer\n");
     exim_exit(EXIT_FAILURE);
     }
-  }
 
 /* If we haven't already done so, inspect the setting of log_file_path to
 determine whether to log to files and/or to syslog. Bits in logging_mode
@@ -809,7 +909,9 @@ while(*ptr) ptr++;
 if (LOGGING(pid))
   {
   sprintf(CS ptr, "[%d] ", (int)getpid());
+  if (!syslog_pid) pid_position[0] = ptr - log_buffer;	/* remember begin … */
   while (*ptr) ptr++;
+  if (!syslog_pid) pid_position[1] = ptr - log_buffer;	/*  … and end+1 of the PID */
   }
 
 if (really_exim && message_id[0] != 0)
@@ -883,14 +985,14 @@ been opened, but we don't want to keep on writing to it for too long after it
 has been renamed. Therefore, do a stat() and see if the inode has changed, and
 if so, re-open. */
 
-if ((flags & LOG_MAIN) != 0 &&
-    (selector == 0 || (selector & log_selector[0]) != 0))
+if (  flags & LOG_MAIN
+   && (!selector ||  selector & log_selector[0]))
   {
-  if ((logging_mode & LOG_MODE_SYSLOG) != 0 &&
-      (syslog_duplication || (flags & (LOG_REJECT|LOG_PANIC)) == 0))
+  if (  logging_mode & LOG_MODE_SYSLOG
+     && (syslog_duplication || !(flags & (LOG_REJECT|LOG_PANIC))))
     write_syslog(LOG_INFO, log_buffer);
 
-  if ((logging_mode & LOG_MODE_FILE) != 0)
+  if (logging_mode & LOG_MODE_FILE)
     {
     struct stat statbuf;
 
@@ -916,14 +1018,8 @@ if ((flags & LOG_MAIN) != 0 &&
     happening. */
 
     if (mainlogfd >= 0)
-      {
       if (Ustat(mainlog_name, &statbuf) < 0 || statbuf.st_ino != mainlog_inode)
-        {
-        (void)close(mainlogfd);
-        mainlogfd = -1;
-        mainlog_inode = 0;
-        }
-      }
+	mainlog_close();
 
     /* If the log is closed, open it. Then write the line. */
 
@@ -1325,7 +1421,7 @@ int fd = -1;
 if (debug_file)
   {
   debug_printf("DEBUGGING ACTIVATED FROM WITHIN CONFIG.\n"
-      "DEBUG: Tag=\"%s\" Opts=\"%s\"\n", tag_name, opts ? opts : US"");
+      "DEBUG: Tag=\"%s\" opts=\"%s\"\n", tag_name, opts ? opts : US"");
   return;
   }
 
@@ -1356,4 +1452,16 @@ else
 }
 
 
+void
+debug_logging_stop(void)
+{
+if (!debug_file || !debuglog_name[0]) return;
+
+debug_selector = 0;
+fclose(debug_file);
+debug_file = NULL;
+unlink_log(lt_debug);
+}
+
+
 /* End of log.c */
diff --git a/src/src/lookups/Makefile b/src/src/lookups/Makefile
index 6ba0cb169..7c9700690 100644
--- a/src/src/lookups/Makefile
+++ b/src/src/lookups/Makefile
@@ -34,6 +34,7 @@ dnsdb.o:         $(PHDRS) dnsdb.c
 dsearch.o:       $(PHDRS) dsearch.c
 ibase.o:         $(PHDRS) ibase.c
 ldap.o:          $(PHDRS) ldap.c
+lmdb.o:          $(PHDRS) lmdb.c
 lsearch.o:       $(PHDRS) lsearch.c
 mysql.o:         $(PHDRS) mysql.c
 nis.o:           $(PHDRS) nis.c
@@ -53,6 +54,7 @@ dnsdb.so:         $(PHDRS) dnsdb.c
 dsearch.so:       $(PHDRS) dsearch.c
 ibase.so:         $(PHDRS) ibase.c
 ldap.so:          $(PHDRS) ldap.c
+lmdb.so:          $(PHDRS) lmdb.c
 lsearch.so:       $(PHDRS) lsearch.c
 mysql.so:         $(PHDRS) mysql.c
 nis.so:           $(PHDRS) nis.c
diff --git a/src/src/lookups/cdb.c b/src/src/lookups/cdb.c
index ba925dc12..3a9078a4e 100644
--- a/src/src/lookups/cdb.c
+++ b/src/src/lookups/cdb.c
@@ -94,7 +94,7 @@ typedef unsigned int uint32;
  * Internal function to make hash value */
 
 static uint32
-cdb_hash(uschar *buf, unsigned int len)
+cdb_hash(const uschar *buf, unsigned int len)
 {
   uint32 h;
 
@@ -281,135 +281,171 @@ cdb_find(void *handle,
         uschar **errmsg,
         uint *do_cache)
 {
-  struct cdb_state * cdbp = handle;
-  uint32 item_key_len,
-    item_dat_len,
-    key_hash,
-    item_hash,
-    item_posn,
-    cur_offset,
-    end_offset,
-    hash_offset_entry,
-    hash_offset,
-    hash_offlen,
-    hash_slotnm;
-  int loop;
-
-  /* Keep picky compilers happy */
-  do_cache = do_cache;
-
-  key_hash = cdb_hash((uschar *)keystring, key_len);
-
-  hash_offset_entry = CDB_HASH_ENTRY * (key_hash & CDB_HASH_MASK);
-  hash_offset = cdb_unpack(cdbp->cdb_offsets + hash_offset_entry);
-  hash_offlen = cdb_unpack(cdbp->cdb_offsets + hash_offset_entry + 4);
-
-  /* If the offset length is zero this key cannot be in the file */
-  if (hash_offlen == 0) {
-    return FAIL;
-  }
-  hash_slotnm = (key_hash >> 8) % hash_offlen;
-
-  /* check to ensure that the file is not corrupt
-   * if the hash_offset + (hash_offlen * CDB_HASH_ENTRY) is longer
-   * than the file, then we have problems.... */
-  if ((hash_offset + (hash_offlen * CDB_HASH_ENTRY)) > cdbp->filelen) {
-    *errmsg = string_sprintf("cdb: corrupt cdb file %s (too short)",
-                            filename);
-    DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
-    return DEFER;
+struct cdb_state * cdbp = handle;
+uint32 item_key_len,
+item_dat_len,
+key_hash,
+item_hash,
+item_posn,
+cur_offset,
+end_offset,
+hash_offset_entry,
+hash_offset,
+hash_offlen,
+hash_slotnm;
+int loop;
+
+/* Keep picky compilers happy */
+do_cache = do_cache;
+
+key_hash = cdb_hash(keystring, key_len);
+
+hash_offset_entry = CDB_HASH_ENTRY * (key_hash & CDB_HASH_MASK);
+hash_offset = cdb_unpack(cdbp->cdb_offsets + hash_offset_entry);
+hash_offlen = cdb_unpack(cdbp->cdb_offsets + hash_offset_entry + 4);
+
+/* If the offset length is zero this key cannot be in the file */
+
+if (hash_offlen == 0)
+  return FAIL;
+
+hash_slotnm = (key_hash >> 8) % hash_offlen;
+
+/* check to ensure that the file is not corrupt
+ * if the hash_offset + (hash_offlen * CDB_HASH_ENTRY) is longer
+ * than the file, then we have problems.... */
+
+if ((hash_offset + (hash_offlen * CDB_HASH_ENTRY)) > cdbp->filelen)
+  {
+  *errmsg = string_sprintf("cdb: corrupt cdb file %s (too short)",
+		      filename);
+  DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
+  return DEFER;
   }
 
-  cur_offset = hash_offset + (hash_slotnm * CDB_HASH_ENTRY);
-  end_offset = hash_offset + (hash_offlen * CDB_HASH_ENTRY);
-  /* if we are allowed to we use mmap here.... */
+cur_offset = hash_offset + (hash_slotnm * CDB_HASH_ENTRY);
+end_offset = hash_offset + (hash_offlen * CDB_HASH_ENTRY);
+
+/* if we are allowed to we use mmap here.... */
+
 #ifdef HAVE_MMAP
-  /* make sure the mmap was OK */
-  if (cdbp->cdb_map != NULL) {
-    uschar * cur_pos = cur_offset + cdbp->cdb_map;
-    uschar * end_pos = end_offset + cdbp->cdb_map;
-    for (loop = 0; (loop < hash_offlen); ++loop) {
-      item_hash = cdb_unpack(cur_pos);
-      cur_pos += 4;
-      item_posn = cdb_unpack(cur_pos);
-      cur_pos += 4;
-      /* if the position is zero then we have a definite miss */
-      if (item_posn == 0)
-       return FAIL;
-
-      if (item_hash == key_hash) {
-       /* matching hash value */
-       uschar * item_ptr = cdbp->cdb_map + item_posn;
-       item_key_len = cdb_unpack(item_ptr);
-       item_ptr += 4;
-       item_dat_len = cdb_unpack(item_ptr);
-       item_ptr += 4;
-       /* check key length matches */
-       if (item_key_len == key_len) {
-         /* finally check if key matches */
-         if (Ustrncmp(keystring, item_ptr, key_len) == 0) {
-           /* we have a match....
-            * make item_ptr point to data */
-           item_ptr += item_key_len;
-           /* ... and the returned result */
-           *result = store_get(item_dat_len + 1);
-           memcpy(*result, item_ptr, item_dat_len);
-           (*result)[item_dat_len] = 0;
-           return OK;
-         }
-       }
-      }
-      /* handle warp round of table */
-      if (cur_pos == end_pos)
-       cur_pos = cdbp->cdb_map + hash_offset;
-    }
-    /* looks like we failed... */
-    return FAIL;
-  }
-#endif /* HAVE_MMAP */
-  for (loop = 0; (loop < hash_offlen); ++loop) {
-    uschar packbuf[8];
-    if (lseek(cdbp->fileno, (off_t) cur_offset,SEEK_SET) == -1) return DEFER;
-    if (cdb_bread(cdbp->fileno, packbuf,8) == -1) return DEFER;
-    item_hash = cdb_unpack(packbuf);
-    item_posn = cdb_unpack(packbuf + 4);
+/* make sure the mmap was OK */
+if (cdbp->cdb_map != NULL)
+  {
+  uschar * cur_pos = cur_offset + cdbp->cdb_map;
+  uschar * end_pos = end_offset + cdbp->cdb_map;
+
+  for (loop = 0; (loop < hash_offlen); ++loop)
+    {
+    item_hash = cdb_unpack(cur_pos);
+    cur_pos += 4;
+    item_posn = cdb_unpack(cur_pos);
+    cur_pos += 4;
+
     /* if the position is zero then we have a definite miss */
+
     if (item_posn == 0)
       return FAIL;
 
-    if (item_hash == key_hash) {
-      /* matching hash value */
-      if (lseek(cdbp->fileno, (off_t) item_posn, SEEK_SET) == -1) return DEFER;
-      if (cdb_bread(cdbp->fileno, packbuf, 8) == -1) return DEFER;
-      item_key_len = cdb_unpack(packbuf);
+    if (item_hash == key_hash)
+      {					/* matching hash value */
+      uschar * item_ptr = cdbp->cdb_map + item_posn;
+
+      item_key_len = cdb_unpack(item_ptr);
+      item_ptr += 4;
+      item_dat_len = cdb_unpack(item_ptr);
+      item_ptr += 4;
+
       /* check key length matches */
-      if (item_key_len == key_len) {
-       /* finally check if key matches */
-       uschar * item_key = store_get(key_len);
-       if (cdb_bread(cdbp->fileno, item_key, key_len) == -1) return DEFER;
-       if (Ustrncmp(keystring, item_key, key_len) == 0) {
-         /* Reclaim some store */
-         store_reset(item_key);
-         /* matches - get data length */
-         item_dat_len = cdb_unpack(packbuf + 4);
-         /* then we build a new result string */
-         *result = store_get(item_dat_len + 1);
-         if (cdb_bread(cdbp->fileno, *result, item_dat_len) == -1)
-           return DEFER;
-         (*result)[item_dat_len] = 0;
-         return OK;
-       }
+
+      if (item_key_len == key_len)
+	{
+	 /* finally check if key matches */
+	 if (Ustrncmp(keystring, item_ptr, key_len) == 0)
+	   {
+	   /* we have a match....  * make item_ptr point to data */
+
+	   item_ptr += item_key_len;
+
+	   /* ... and the returned result */
+
+	   *result = store_get(item_dat_len + 1);
+	   memcpy(*result, item_ptr, item_dat_len);
+	   (*result)[item_dat_len] = 0;
+	   return OK;
+	   }
+	}
+      }
+    /* handle warp round of table */
+    if (cur_pos == end_pos)
+    cur_pos = cdbp->cdb_map + hash_offset;
+    }
+  /* looks like we failed... */
+  return FAIL;
+  }
+
+#endif /* HAVE_MMAP */
+
+for (loop = 0; (loop < hash_offlen); ++loop)
+  {
+  uschar packbuf[8];
+
+  if (lseek(cdbp->fileno, (off_t) cur_offset,SEEK_SET) == -1) return DEFER;
+  if (cdb_bread(cdbp->fileno, packbuf,8) == -1) return DEFER;
+
+  item_hash = cdb_unpack(packbuf);
+  item_posn = cdb_unpack(packbuf + 4);
+
+  /* if the position is zero then we have a definite miss */
+
+  if (item_posn == 0)
+    return FAIL;
+
+  if (item_hash == key_hash)
+    {						/* matching hash value */
+    if (lseek(cdbp->fileno, (off_t) item_posn, SEEK_SET) == -1) return DEFER;
+    if (cdb_bread(cdbp->fileno, packbuf, 8) == -1) return DEFER;
+
+    item_key_len = cdb_unpack(packbuf);
+
+    /* check key length matches */
+
+    if (item_key_len == key_len)
+      {					/* finally check if key matches */
+      uschar * item_key = store_get(key_len);
+
+      if (cdb_bread(cdbp->fileno, item_key, key_len) == -1) return DEFER;
+      if (Ustrncmp(keystring, item_key, key_len) == 0) {
+
        /* Reclaim some store */
        store_reset(item_key);
+
+       /* matches - get data length */
+       item_dat_len = cdb_unpack(packbuf + 4);
+
+       /* then we build a new result string.  We know we have enough
+       memory so disable Coverity errors about the tainted item_dat_ken */
+
+       *result = store_get(item_dat_len + 1);
+       /* coverity[tainted_data] */
+       if (cdb_bread(cdbp->fileno, *result, item_dat_len) == -1)
+	 return DEFER;
+
+       /* coverity[tainted_data] */
+       (*result)[item_dat_len] = 0;
+       return OK;
+      }
+      /* Reclaim some store */
+      store_reset(item_key);
       }
     }
-    cur_offset += 8;
+  cur_offset += 8;
 
-    /* handle warp round of table */
-    if (cur_offset == end_offset)
-      cur_offset = hash_offset;
+  /* handle warp round of table */
+  if (cur_offset == end_offset)
+  cur_offset = hash_offset;
   }
-  return FAIL;
+return FAIL;
 }
 
 
diff --git a/src/src/lookups/dnsdb.c b/src/src/lookups/dnsdb.c
index 70e6c8c63..da3495beb 100644
--- a/src/src/lookups/dnsdb.c
+++ b/src/src/lookups/dnsdb.c
@@ -396,9 +396,8 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
         dns_address *da;
         for (da = dns_address_from_rr(&dnsa, rr); da; da = da->next)
           {
-          if (ptr != 0) yield = string_cat(yield, &size, &ptr, outsep, 1);
-          yield = string_cat(yield, &size, &ptr, da->address,
-            Ustrlen(da->address));
+          if (ptr != 0) yield = string_catn(yield, &size, &ptr, outsep, 1);
+          yield = string_cat(yield, &size, &ptr, da->address);
           }
         continue;
         }
@@ -406,14 +405,14 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
       /* Other kinds of record just have one piece of data each, but there may be
       several of them, of course. */
 
-      if (ptr != 0) yield = string_cat(yield, &size, &ptr, outsep, 1);
+      if (ptr != 0) yield = string_catn(yield, &size, &ptr, outsep, 1);
 
       if (type == T_TXT || type == T_SPF)
         {
         if (outsep2 == NULL)
           {
           /* output only the first item of data */
-          yield = string_cat(yield, &size, &ptr, (uschar *)(rr->data+1),
+          yield = string_catn(yield, &size, &ptr, (uschar *)(rr->data+1),
             (rr->data)[0]);
           }
         else
@@ -424,9 +423,9 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
             {
             uschar chunk_len = (rr->data)[data_offset++];
             if (outsep2[0] != '\0' && data_offset != 1)
-              yield = string_cat(yield, &size, &ptr, outsep2, 1);
-            yield = string_cat(yield, &size, &ptr,
-                             (uschar *)((rr->data)+data_offset), chunk_len);
+              yield = string_catn(yield, &size, &ptr, outsep2, 1);
+            yield = string_catn(yield, &size, &ptr,
+                             US ((rr->data)+data_offset), chunk_len);
             data_offset += chunk_len;
             }
           }
@@ -452,7 +451,7 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
              i++)
           sp += sprintf(CS sp, "%02x", (unsigned char)p[i]);
 
-        yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+        yield = string_cat(yield, &size, &ptr, s);
         }
       else   /* T_CNAME, T_CSA, T_MX, T_MXH, T_NS, T_PTR, T_SOA, T_SRV */
         {
@@ -470,7 +469,7 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
 	  case T_MX:
 	    GETSHORT(priority, p);
 	    sprintf(CS s, "%d%c", priority, *outsep2);
-	    yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+	    yield = string_cat(yield, &size, &ptr, s);
 	    break;
 
 	  case T_SRV:
@@ -479,7 +478,7 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
 	    GETSHORT(port, p);
 	    sprintf(CS s, "%d%c%d%c%d%c", priority, *outsep2,
 			      weight, *outsep2, port, *outsep2);
-	    yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+	    yield = string_cat(yield, &size, &ptr, s);
 	    break;
 
 	  case T_CSA:
@@ -508,7 +507,7 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
 	      }
 
 	    s[1] = ' ';
-	    yield = string_cat(yield, &size, &ptr, s, 2);
+	    yield = string_catn(yield, &size, &ptr, s, 2);
 	    break;
 
 	  default:
@@ -529,14 +528,14 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
             "domain=%s", dns_text_type(type), domain);
           break;
           }
-        else yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+        else yield = string_cat(yield, &size, &ptr, s);
 
 	if (type == T_SOA && outsep2 != NULL)
 	  {
 	  unsigned long serial, refresh, retry, expire, minimum;
 
 	  p += rc;
-	  yield = string_cat(yield, &size, &ptr, outsep2, 1);
+	  yield = string_catn(yield, &size, &ptr, outsep2, 1);
 
 	  rc = dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
 	    (DN_EXPAND_ARG4_TYPE)s, sizeof(s));
@@ -546,7 +545,7 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
 	      "domain=%s", dns_text_type(type), domain);
 	    break;
 	    }
-	  else yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+	  else yield = string_cat(yield, &size, &ptr, s);
 
 	  p += rc;
 	  GETLONG(serial, p); GETLONG(refresh, p);
@@ -554,7 +553,7 @@ while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
 	  sprintf(CS s, "%c%lu%c%lu%c%lu%c%lu%c%lu",
 	    *outsep2, serial, *outsep2, refresh,
 	    *outsep2, retry,  *outsep2, expire,  *outsep2, minimum);
-	  yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+	  yield = string_cat(yield, &size, &ptr, s);
 	  }
         }
       }    /* Loop for list of returned records */
diff --git a/src/src/lookups/ibase.c b/src/src/lookups/ibase.c
index 10c962019..6405a6448 100644
--- a/src/src/lookups/ibase.c
+++ b/src/src/lookups/ibase.c
@@ -353,14 +353,14 @@ has the password removed. This copy is also used for debugging output. */
         }
 
         if (result != NULL)
-            result = string_cat(result, &ssize, &offset, US "\n", 1);
+            result = string_catn(result, &ssize, &offset, US "\n", 1);
 
         /* Find the number of fields returned. If this is one, we don't add field
            names to the data. Otherwise we do. */
         if (out_sqlda->sqld == 1) {
             if (out_sqlda->sqlvar[0].sqlind == NULL || *out_sqlda->sqlvar[0].sqlind != -1)     /* NULL value yields nothing */
                 result =
-                    string_cat(result, &ssize, &offset, US buffer,
+                    string_catn(result, &ssize, &offset, US buffer,
                                fetch_field(buffer, sizeof(buffer),
                                            &out_sqlda->sqlvar[0]));
         }
@@ -374,19 +374,19 @@ has the password removed. This copy is also used for debugging output. */
                     string_cat(result, &ssize, &offset,
                                US out_sqlda->sqlvar[i].aliasname,
                                out_sqlda->sqlvar[i].aliasname_length);
-                result = string_cat(result, &ssize, &offset, US "=", 1);
+                result = string_catn(result, &ssize, &offset, US "=", 1);
 
                 /* Quote the value if it contains spaces or is empty */
 
                 if (*out_sqlda->sqlvar[i].sqlind == -1) {       /* NULL value */
                     result =
-                        string_cat(result, &ssize, &offset, US "\"\"", 2);
+                        string_catn(result, &ssize, &offset, US "\"\"", 2);
                 }
 
                 else if (buffer[0] == 0 || Ustrchr(buffer, ' ') != NULL) {
                     int j;
                     result =
-                        string_cat(result, &ssize, &offset, US "\"", 1);
+                        string_catn(result, &ssize, &offset, US "\"", 1);
                     for (j = 0; j < len; j++) {
                         if (buffer[j] == '\"' || buffer[j] == '\\')
                             result =
@@ -397,13 +397,12 @@ has the password removed. This copy is also used for debugging output. */
                                        US buffer + j, 1);
                     }
                     result =
-                        string_cat(result, &ssize, &offset, US "\"", 1);
+                        string_catn(result, &ssize, &offset, US "\"", 1);
                 } else {
                     result =
-                        string_cat(result, &ssize, &offset, US buffer,
-                                   len);
+                        string_catn(result, &ssize, &offset, US buffer, len);
                 }
-                result = string_cat(result, &ssize, &offset, US " ", 1);
+                result = string_catn(result, &ssize, &offset, US " ", 1);
             }
     }
 
diff --git a/src/src/lookups/ldap.c b/src/src/lookups/ldap.c
index fe67e7f0a..3db787cce 100644
--- a/src/src/lookups/ldap.c
+++ b/src/src/lookups/ldap.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Many thanks to Stuart Lynne for contributing the original code for this
@@ -734,7 +734,7 @@ while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
 
     /* Results for multiple entries values are separated by newlines. */
 
-    if (data != NULL) data = string_cat(data, &size, &ptr, US"\n", 1);
+    if (data != NULL) data = string_catn(data, &size, &ptr, US"\n", 1);
 
     /* Get the DN from the last result. */
 
@@ -762,7 +762,7 @@ while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
       {                                  /* condition, because of the else */
       if (new_dn != NULL)                /* below, that's for the first only */
         {
-        data = string_cat(data, &size, &ptr, new_dn, Ustrlen(new_dn));
+        data = string_cat(data, &size, &ptr, new_dn);
         data[ptr] = 0;
         attribute_found = TRUE;
         }
@@ -796,11 +796,11 @@ while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
           if (attrs_requested != 1)
             {
             if (insert_space)
-              data = string_cat(data, &size, &ptr, US" ", 1);
+              data = string_catn(data, &size, &ptr, US" ", 1);
             else
               insert_space = TRUE;
-            data = string_cat(data, &size, &ptr, attr, Ustrlen(attr));
-            data = string_cat(data, &size, &ptr, US"=\"", 2);
+            data = string_cat(data, &size, &ptr, attr);
+            data = string_catn(data, &size, &ptr, US"=\"", 2);
             }
 
           while (*values != NULL)
@@ -818,7 +818,7 @@ while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
             attribute and append only every non first value. */
 
             if (data && valuecount > 1)
-              data = string_cat(data, &size, &ptr, US",", 1);
+              data = string_catn(data, &size, &ptr, US",", 1);
 
             /* For multiple attributes, the data is in quotes. We must escape
             internal quotes, backslashes, newlines, and must double commas. */
@@ -829,14 +829,14 @@ while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
               for (j = 0; j < len; j++)
                 {
                 if (value[j] == '\n')
-                  data = string_cat(data, &size, &ptr, US"\\n", 2);
+                  data = string_catn(data, &size, &ptr, US"\\n", 2);
                 else if (value[j] == ',')
-                  data = string_cat(data, &size, &ptr, US",,", 2);
+                  data = string_catn(data, &size, &ptr, US",,", 2);
                 else
                   {
                   if (value[j] == '\"' || value[j] == '\\')
-                    data = string_cat(data, &size, &ptr, US"\\", 1);
-                  data = string_cat(data, &size, &ptr, value+j, 1);
+                    data = string_catn(data, &size, &ptr, US"\\", 1);
+                  data = string_catn(data, &size, &ptr, value+j, 1);
                   }
                 }
               }
@@ -847,12 +847,10 @@ while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
 	      {
 	      int j;
 	      for (j = 0; j < len; j++)
-	        {
 	        if (value[j] == ',')
-	          data = string_cat(data, &size, &ptr, US",,", 2);
+	          data = string_catn(data, &size, &ptr, US",,", 2);
 	        else
-	          data = string_cat(data, &size, &ptr, value+j, 1);
-	        }
+	          data = string_catn(data, &size, &ptr, value+j, 1);
 	      }
 
 
@@ -865,7 +863,7 @@ while ((rc = ldap_result(lcp->ld, msgid, 0, timeoutptr, &result)) ==
           /* Closing quote at the end of the data for a named attribute. */
 
           if (attrs_requested != 1)
-            data = string_cat(data, &size, &ptr, US"\"", 1);
+            data = string_catn(data, &size, &ptr, US"\"", 1);
 
           /* Free the values */
 
diff --git a/src/src/lookups/lf_quote.c b/src/src/lookups/lf_quote.c
index 60c0a760c..2a76756e9 100644
--- a/src/src/lookups/lf_quote.c
+++ b/src/src/lookups/lf_quote.c
@@ -37,7 +37,11 @@ result = string_append(result, asize, aoffset, 2, name, US"=");
 
 /* NULL is handled as an empty string */
 
-if (value == NULL) value = US"";
+if (!value)
+  {
+  value = US"";
+  vlength = 0;
+  }
 
 /* Quote the value if it is empty, contains white space, or starts with a quote
 character. */
@@ -45,21 +49,19 @@ character. */
 if (value[0] == 0 || Ustrpbrk(value, " \t\n\r") != NULL || value[0] == '\"')
   {
   int j;
-  result = string_cat(result, asize, aoffset, US"\"", 1);
+  result = string_catn(result, asize, aoffset, US"\"", 1);
   for (j = 0; j < vlength; j++)
     {
     if (value[j] == '\"' || value[j] == '\\')
-      result = string_cat(result, asize, aoffset, US"\\", 1);
-    result = string_cat(result, asize, aoffset, US value+j, 1);
+      result = string_catn(result, asize, aoffset, US"\\", 1);
+    result = string_catn(result, asize, aoffset, US value+j, 1);
     }
-  result = string_cat(result, asize, aoffset, US"\"", 1);
+  result = string_catn(result, asize, aoffset, US"\"", 1);
   }
 else
-  {
-  result = string_cat(result, asize, aoffset, US value, vlength);
-  }
+  result = string_catn(result, asize, aoffset, US value, vlength);
 
-return string_cat(result, asize, aoffset, US" ", 1);
+return string_catn(result, asize, aoffset, US" ", 1);
 }
 
 /* End of lf_quote.c */
diff --git a/src/src/lookups/lmdb.c b/src/src/lookups/lmdb.c
new file mode 100644
index 000000000..8b0ffd2dd
--- /dev/null
+++ b/src/src/lookups/lmdb.c
@@ -0,0 +1,160 @@
+/*************************************************
+*     Exim - an Internet mail transport agent    *
+*************************************************/
+
+/* Copyright (c) University of Cambridge 2016 */
+/* See the file NOTICE for conditions of use and distribution. */
+
+#include "../exim.h"
+
+#ifdef EXPERIMENTAL_LMDB
+
+#include <lmdb.h>
+
+typedef struct lmdbstrct
+{
+MDB_txn *txn;
+MDB_dbi db_dbi;
+} Lmdbstrct;
+
+
+/*************************************************
+*              Open entry point                  *
+*************************************************/
+
+static void *
+lmdb_open(uschar * filename, uschar ** errmsg)
+{
+MDB_env * db_env = NULL;
+Lmdbstrct * lmdb_p;
+int ret, save_errno;
+const uschar * errstr;
+
+lmdb_p = store_get(sizeof(Lmdbstrct));
+lmdb_p->txn = NULL;
+
+if ((ret = mdb_env_create(&db_env)))
+  {
+  errstr = US"create environment";
+  goto bad;
+  }
+
+if ((ret = mdb_env_open(db_env, CS filename, MDB_NOSUBDIR|MDB_RDONLY, 0660)))
+  {
+  errstr = US"open environment";
+  goto bad;
+  }
+
+if ((ret = mdb_txn_begin(db_env, NULL, MDB_RDONLY, &lmdb_p->txn)))
+  {
+  errstr = US"start transaction";
+  goto bad;
+  }
+
+if ((ret = mdb_open(lmdb_p->txn, NULL, 0, &lmdb_p->db_dbi)))
+  {
+  errstr = US"open database";
+  goto bad;
+  }
+
+return lmdb_p;
+
+bad:
+  save_errno = errno;
+  if (lmdb_p->txn) mdb_txn_abort(lmdb_p->txn);
+  if (db_env) mdb_env_close(db_env);
+  *errmsg = string_sprintf("LMDB: Unable to %s: %s", errstr,  mdb_strerror(ret));
+  errno = save_errno;
+  return NULL;
+}
+
+
+/*************************************************
+*              Find entry point                  *
+*************************************************/
+
+static int
+lmdb_find(void * handle, uschar * filename,
+    const uschar * keystring, int length, uschar ** result, uschar ** errmsg,
+    uint * do_cache)
+{
+int ret;
+MDB_val dbkey, data;
+Lmdbstrct * lmdb_p = handle;
+
+dbkey.mv_data = CS keystring;
+dbkey.mv_size = length;
+
+DEBUG(D_lookup) debug_printf("LMDB: lookup key: %s\n", (char *)keystring);
+
+if ((ret = mdb_get(lmdb_p->txn, lmdb_p->db_dbi, &dbkey, &data)) == 0)
+  {
+  *result = string_copyn(US data.mv_data, data.mv_size);
+  DEBUG(D_lookup) debug_printf("LMDB: lookup result: %s\n", *result);
+  return OK;
+  }
+else if (ret == MDB_NOTFOUND)
+  {
+  *errmsg = US"LMDB: lookup, no data found";
+  DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
+  return FAIL;
+  }
+else
+  {
+  *errmsg = string_sprintf("LMDB: lookup error: %s", mdb_strerror(ret));
+  DEBUG(D_lookup) debug_printf("%s\n", *errmsg);
+  return DEFER;
+  }
+}
+
+
+/*************************************************
+*              Close entry point                 *
+*************************************************/
+
+static void
+lmdb_close(void * handle)
+{
+Lmdbstrct * lmdb_p = handle;
+MDB_env * db_env = mdb_txn_env(lmdb_p->txn);
+mdb_txn_abort(lmdb_p->txn);
+mdb_env_close(db_env);
+}
+
+
+/*************************************************
+*         Version reporting entry point          *
+*************************************************/
+
+#include "../version.h"
+
+void
+lmdb_version_report(FILE * f)
+{
+fprintf(f, "Library version: LMDB: Compile: %d.%d.%d\n",
+    MDB_VERSION_MAJOR, MDB_VERSION_MINOR, MDB_VERSION_PATCH);
+#ifdef DYNLOOKUP
+fprintf(f, "                        Exim version %s\n", EXIM_VERSION_STR);
+#endif
+}
+
+static lookup_info lmdb_lookup_info = {
+  US"lmdb",                     /* lookup name */
+  lookup_absfile,               /* query-style lookup */
+  lmdb_open,                    /* open function */
+  NULL,                         /* no check function */
+  lmdb_find,                    /* find function */
+  lmdb_close,                   /* close function */
+  NULL,                         /* tidy function */
+  NULL,                         /* quoting function */
+  lmdb_version_report           /* version reporting */
+};
+
+#ifdef DYNLOOKUP
+# define lmdb_lookup_module_info _lookup_module_info
+#endif /* DYNLOOKUP */
+
+static lookup_info *_lookup_list[] = { &lmdb_lookup_info };
+lookup_module_info lmdb_lookup_module_info = { LOOKUP_MODULE_INFO_MAGIC, _lookup_list, 1 };
+
+#endif /* EXPERIMENTAL_LMDB */
diff --git a/src/src/lookups/lsearch.c b/src/src/lookups/lsearch.c
index eb70a45fa..6101d00ac 100644
--- a/src/src/lookups/lsearch.c
+++ b/src/src/lookups/lsearch.c
@@ -258,7 +258,7 @@ for (last_was_eol = TRUE;
   ptr = 0;
   yield = store_get(size);
   if (*s != 0)
-    yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+    yield = string_cat(yield, &size, &ptr, s);
 
   /* Now handle continuations */
 
@@ -294,7 +294,7 @@ for (last_was_eol = TRUE;
 
     /* Join a physical or logical line continuation onto the result string. */
 
-    yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+    yield = string_cat(yield, &size, &ptr, s);
     }
 
   yield[ptr] = 0;
diff --git a/src/src/lookups/mysql.c b/src/src/lookups/mysql.c
index 68b04dcc8..632541a61 100644
--- a/src/src/lookups/mysql.c
+++ b/src/src/lookups/mysql.c
@@ -266,12 +266,12 @@ while ((mysql_row_data = mysql_fetch_row(mysql_result)) != NULL)
   unsigned long *lengths = mysql_fetch_lengths(mysql_result);
 
   if (result != NULL)
-      result = string_cat(result, &ssize, &offset, US"\n", 1);
+      result = string_catn(result, &ssize, &offset, US"\n", 1);
 
   if (num_fields == 1)
     {
     if (mysql_row_data[0] != NULL)    /* NULL value yields nothing */
-      result = string_cat(result, &ssize, &offset, US mysql_row_data[0],
+      result = string_catn(result, &ssize, &offset, US mysql_row_data[0],
         lengths[0]);
     }
 
diff --git a/src/src/lookups/nisplus.c b/src/src/lookups/nisplus.c
index 00f30193c..ff632a1ca 100644
--- a/src/src/lookups/nisplus.c
+++ b/src/src/lookups/nisplus.c
@@ -156,27 +156,26 @@ for (i = 0; i < eo->en_cols.en_cols_len; i++)
 
   if (field_name == NULL)
     {
-    yield = string_cat(yield, &ssize, &offset,US  tc->tc_name,
-      Ustrlen(tc->tc_name));
-    yield = string_cat(yield, &ssize, &offset, US"=", 1);
+    yield = string_cat(yield, &ssize, &offset,US  tc->tc_name);
+    yield = string_catn(yield, &ssize, &offset, US"=", 1);
 
     /* Quote the value if it contains spaces or is empty */
 
     if (value[0] == 0 || Ustrchr(value, ' ') != NULL)
       {
       int j;
-      yield = string_cat(yield, &ssize, &offset, US"\"", 1);
+      yield = string_catn(yield, &ssize, &offset, US"\"", 1);
       for (j = 0; j < len; j++)
         {
         if (value[j] == '\"' || value[j] == '\\')
-          yield = string_cat(yield, &ssize, &offset, US"\\", 1);
-        yield = string_cat(yield, &ssize, &offset, value+j, 1);
+          yield = string_catn(yield, &ssize, &offset, US"\\", 1);
+        yield = string_catn(yield, &ssize, &offset, value+j, 1);
         }
-      yield = string_cat(yield, &ssize, &offset, US"\"", 1);
+      yield = string_catn(yield, &ssize, &offset, US"\"", 1);
       }
-    else yield = string_cat(yield, &ssize, &offset, value, len);
+    else yield = string_catn(yield, &ssize, &offset, value, len);
 
-    yield = string_cat(yield, &ssize, &offset, US" ", 1);
+    yield = string_catn(yield, &ssize, &offset, US" ", 1);
     }
 
   /* When the specified field is found, grab its data and finish */
diff --git a/src/src/lookups/oracle.c b/src/src/lookups/oracle.c
index 33d223436..d3fba5e4c 100644
--- a/src/src/lookups/oracle.c
+++ b/src/src/lookups/oracle.c
@@ -400,12 +400,12 @@ while (cda->rc != NO_DATA_FOUND)  /* Loop for each row */
   ofetch(cda);
   if(cda->rc == NO_DATA_FOUND) break;
 
-  if (result != NULL) result = string_cat(result, &ssize, &offset, "\n", 1);
+  if (result) result = string_catn(result, &ssize, &offset, "\n", 1);
 
   /* Single field - just add on the data */
 
   if (num_fields == 1)
-    result = string_cat(result, &ssize, &offset, def[0].buf, def[0].col_retlen);
+    result = string_catn(result, &ssize, &offset, def[0].buf, def[0].col_retlen);
 
   /* Multiple fields - precede by file name, removing {lead,trail}ing WS */
 
@@ -417,8 +417,8 @@ while (cda->rc != NO_DATA_FOUND)  /* Loop for each row */
     while (*s != 0 && isspace(*s)) s++;
     slen = Ustrlen(s);
     while (slen > 0 && isspace(s[slen-1])) slen--;
-    result = string_cat(result, &ssize, &offset, s, slen);
-    result = string_cat(result, &ssize, &offset, US"=", 1);
+    result = string_catn(result, &ssize, &offset, s, slen);
+    result = string_catn(result, &ssize, &offset, US"=", 1);
 
     /* int and float type wont ever need escaping. Otherwise, quote the value
     if it contains spaces or is empty. */
@@ -427,30 +427,30 @@ while (cda->rc != NO_DATA_FOUND)  /* Loop for each row */
        (def[i].buf[0] == 0 || strchr(def[i].buf, ' ') != NULL))
       {
       int j;
-      result = string_cat(result, &ssize, &offset, "\"", 1);
+      result = string_catn(result, &ssize, &offset, "\"", 1);
       for (j = 0; j < def[i].col_retlen; j++)
         {
         if (def[i].buf[j] == '\"' || def[i].buf[j] == '\\')
-          result = string_cat(result, &ssize, &offset, "\\", 1);
-        result = string_cat(result, &ssize, &offset, def[i].buf+j, 1);
+          result = string_catn(result, &ssize, &offset, "\\", 1);
+        result = string_catn(result, &ssize, &offset, def[i].buf+j, 1);
         }
-      result = string_cat(result, &ssize, &offset, "\"", 1);
+      result = string_catn(result, &ssize, &offset, "\"", 1);
       }
 
     else switch(desc[i].dbtype)
       {
       case INT_TYPE:
       sprintf(CS tmp, "%d", def[i].int_buf);
-      result = string_cat(result, &ssize, &offset, tmp, Ustrlen(tmp));
+      result = string_cat(result, &ssize, &offset, tmp);
       break;
 
       case FLOAT_TYPE:
       sprintf(CS tmp, "%f", def[i].flt_buf);
-      result = string_cat(result, &ssize, &offset, tmp, Ustrlen(tmp));
+      result = string_cat(result, &ssize, &offset, tmp);
       break;
 
       case STRING_TYPE:
-      result = string_cat(result, &ssize, &offset, def[i].buf,
+      result = string_catn(result, &ssize, &offset, def[i].buf,
         def[i].col_retlen);
       break;
 
@@ -461,7 +461,7 @@ while (cda->rc != NO_DATA_FOUND)  /* Loop for each row */
       goto ORACLE_EXIT;
       }
 
-    result = string_cat(result, &ssize, &offset, " ", 1);
+    result = string_catn(result, &ssize, &offset, " ", 1);
     }
   }
 
diff --git a/src/src/lookups/pgsql.c b/src/src/lookups/pgsql.c
index 01c5375bc..735f85554 100644
--- a/src/src/lookups/pgsql.c
+++ b/src/src/lookups/pgsql.c
@@ -125,11 +125,11 @@ PGconn *pg_conn = NULL;
 PGresult *pg_result = NULL;
 
 int i;
+uschar *result = NULL;
 int ssize = 0;
 int offset = 0;
 int yield = DEFER;
 unsigned int num_fields, num_tuples;
-uschar *result = NULL;
 pgsql_connection *cn;
 uschar *server_copy = NULL;
 uschar *sdata[3];
@@ -327,11 +327,11 @@ row, we insert '\n' between them. */
 for (i = 0; i < num_tuples; i++)
   {
   if (result != NULL)
-    result = string_cat(result, &ssize, &offset, US"\n", 1);
+    result = string_catn(result, &ssize, &offset, US"\n", 1);
 
    if (num_fields == 1)
     {
-    result = string_cat(result, &ssize, &offset,
+    result = string_catn(result, &ssize, &offset,
       US PQgetvalue(pg_result, i, 0), PQgetlength(pg_result, i, 0));
     }
 
diff --git a/src/src/lookups/redis.c b/src/src/lookups/redis.c
index 854d4162a..df4cf0ca6 100644
--- a/src/src/lookups/redis.c
+++ b/src/src/lookups/redis.c
@@ -219,7 +219,7 @@ if(sdata[1])
     {
     for (argv[i] = NULL, siz = ptr = 0; (c = *s) && !isspace(c); s++)
       if (c != '\\' || *++s)		/* backslash protects next char */
-	argv[i] = string_cat(argv[i], &siz, &ptr, s, 1);
+	argv[i] = string_catn(argv[i], &siz, &ptr, s, 1);
     *(argv[i]+ptr) = '\0';
     DEBUG(D_lookup) debug_printf("REDIS: argv[%d] '%s'\n", i, argv[i]);
     while (isspace(*s)) s++;
@@ -256,12 +256,12 @@ switch (redis_reply->type)
 
   case REDIS_REPLY_INTEGER:
     ttmp = (redis_reply->integer != 0) ? US"true" : US"false";
-    result = string_cat(result, &ssize, &offset, US ttmp, Ustrlen(ttmp));
+    result = string_cat(result, &ssize, &offset, US ttmp);
     break;
 
   case REDIS_REPLY_STRING:
   case REDIS_REPLY_STATUS:
-    result = string_cat(result, &ssize, &offset,
+    result = string_catn(result, &ssize, &offset,
 			US redis_reply->str, redis_reply->len);
     break;
 
@@ -275,16 +275,16 @@ switch (redis_reply->type)
       entry = redis_reply->element[i];
 
       if (result)
-	result = string_cat(result, &ssize, &offset, US"\n", 1);
+	result = string_catn(result, &ssize, &offset, US"\n", 1);
 
       switch (entry->type)
 	{
 	case REDIS_REPLY_INTEGER:
 	  tmp = string_sprintf("%d", entry->integer);
-	  result = string_cat(result, &ssize, &offset, US tmp, Ustrlen(tmp));
+	  result = string_cat(result, &ssize, &offset, US tmp);
 	  break;
 	case REDIS_REPLY_STRING:
-	  result = string_cat(result, &ssize, &offset,
+	  result = string_catn(result, &ssize, &offset,
 			      US entry->str, entry->len);
 	  break;
 	case REDIS_REPLY_ARRAY:
@@ -293,17 +293,16 @@ switch (redis_reply->type)
 	    tentry = entry->element[j];
 
 	    if (result)
-	      result = string_cat(result, &ssize, &offset, US"\n", 1);
+	      result = string_catn(result, &ssize, &offset, US"\n", 1);
 
 	    switch (tentry->type)
 	      {
 	      case REDIS_REPLY_INTEGER:
 		ttmp = string_sprintf("%d", tentry->integer);
-		result = string_cat(result, &ssize, &offset,
-				    US ttmp, Ustrlen(ttmp));
+		result = string_cat(result, &ssize, &offset, US ttmp);
 		break;
 	      case REDIS_REPLY_STRING:
-		result = string_cat(result, &ssize, &offset,
+		result = string_catn(result, &ssize, &offset,
 				    US tentry->str, tentry->len);
 		break;
 	      case REDIS_REPLY_ARRAY:
diff --git a/src/src/lookups/spf.c b/src/src/lookups/spf.c
index 2671fc9c4..ad56a2a8d 100644
--- a/src/src/lookups/spf.c
+++ b/src/src/lookups/spf.c
@@ -13,6 +13,7 @@
  * as published by the Free Software Foundation; either version 2
  * of the License, or (at your option) any later version.
  *
+ * Copyright (c) The Exim Maintainers 2016
  */
 
 #include "../exim.h"
@@ -51,7 +52,7 @@ spf_close(void *handle)
 }
 
 static int
-spf_find(void *handle, uschar *filename, uschar *keystring, int key_len,
+spf_find(void *handle, uschar *filename, const uschar *keystring, int key_len,
              uschar **result, uschar **errmsg, uint *do_cache)
 {
   SPF_server_t *spf_server = handle;
diff --git a/src/src/lookups/sqlite.c b/src/src/lookups/sqlite.c
index e2330f920..6e7b015bc 100644
--- a/src/src/lookups/sqlite.c
+++ b/src/src/lookups/sqlite.c
@@ -55,7 +55,7 @@ int i;
 /* For second and subsequent results, insert \n */
 
 if (res->string != NULL)
-  res->string = string_cat(res->string, &res->size, &res->len, US"\n", 1);
+  res->string = string_catn(res->string, &res->size, &res->len, US"\n", 1);
 
 if (argc > 1)
   {
diff --git a/src/src/macros.h b/src/src/macros.h
index 645799d99..1b7cf4abf 100644
--- a/src/src/macros.h
+++ b/src/src/macros.h
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -15,6 +15,11 @@ a string as a text string. This is sometimes useful for debugging output. */
 /* Number of elements of an array */
 #define nelem(arr) (sizeof(arr) / sizeof(*arr))
 
+/* Maximum of two items */
+#ifndef MAX
+# define MAX(a,b) ((a) > (b) ? (a) : (b))
+#endif
+
 
 /* When running in the test harness, the load average is fudged. */
 
@@ -320,6 +325,13 @@ for having to swallow the rest of an SMTP message is whether the value is
 #define END_NOTENDED   3    /* Message reading not yet ended */
 #define END_SIZE       4    /* Reading ended because message too big */
 #define END_WERROR     5    /* Write error while reading the message */
+#define END_PROTOCOL   6    /* Protocol error in CHUNKING sequence */
+
+/* result codes for bdat_getc() (which can also return EOF) */
+
+#define EOD (-2)
+#define ERR (-3)
+
 
 /* Bit masks for debug and log selectors */
 
@@ -446,15 +458,19 @@ enum {
   LOG_BIT(smtp_protocol_error),
   LOG_BIT(smtp_syntax_error),
 
-  Li_acl_warn_skipped = BITWORDSIZE,
+  Li_8bitmime = BITWORDSIZE,
+  Li_acl_warn_skipped,
   Li_arguments,
   Li_deliver_time,
   Li_delivery_size,
+  Li_dnssec,
   Li_ident_timeout,
   Li_incoming_interface,
   Li_incoming_port,
+  Li_outgoing_interface,
   Li_outgoing_port,
   Li_pid,
+  Li_proxy,
   Li_queue_time,
   Li_queue_time_overall,
   Li_received_sender,
@@ -464,6 +480,7 @@ enum {
   Li_sender_on_delivery,
   Li_sender_verify_fail,
   Li_smtp_confirmation,
+  Li_smtp_mailauth,
   Li_smtp_no_mail,
   Li_subject,
   Li_tls_certificate_verified,
@@ -471,18 +488,15 @@ enum {
   Li_tls_peerdn,
   Li_tls_sni,
   Li_unknown_in_list,
-  Li_8bitmime,
-  Li_smtp_mailauth,
-  Li_proxy,
-  Li_outgoing_interface,
 
-  log_selector_size = BITWORD(Li_outgoing_interface) + 1
+  log_selector_size = BITWORD(Li_unknown_in_list) + 1
 };
 
 #define LOGGING(opt) BIT_TEST(log_selector, log_selector_size, Li_##opt)
 
 /* Private error numbers for delivery failures, set negative so as not
-to conflict with system errno values. */
+to conflict with system errno values.  Take care to maintain the string
+table exim_errstrings[] in log.c */
 
 #define ERRNO_UNKNOWNERROR    (-1)
 #define ERRNO_USERSLASH       (-2)
@@ -547,6 +561,8 @@ to conflict with system errno values. */
 #define ERRNO_QUEUE_DOMAIN   (-55)   /* Domain in queue_domains */
 #define ERRNO_TRETRY         (-56)   /* Transport concurrency limit */
 
+
+
 /* Special actions to take after failure or deferment. */
 
 enum {
@@ -783,7 +799,8 @@ most recent SMTP commands. Must be kept in step with the list of names in
 smtp_in.c that is used for creating the smtp_no_mail logging action. SCH_NONE
 is "empty". */
 
-enum { SCH_NONE, SCH_AUTH, SCH_DATA, SCH_EHLO, SCH_ETRN, SCH_EXPN, SCH_HELO,
+enum { SCH_NONE, SCH_AUTH, SCH_DATA, SCH_BDAT,
+       SCH_EHLO, SCH_ETRN, SCH_EXPN, SCH_HELO,
        SCH_HELP, SCH_MAIL, SCH_NOOP, SCH_QUIT, SCH_RCPT, SCH_RSET, SCH_STARTTLS,
        SCH_VRFY };
 
@@ -833,6 +850,7 @@ enum {
 #define topt_no_headers         0x020  /* Omit headers */
 #define topt_no_body            0x040  /* Omit body */
 #define topt_escape_headers     0x080  /* Apply escape check to headers */
+#define topt_use_bdat		0x100  /* prepend chunks with RFC3030 BDAT header */
 
 /* Flags for recipient_block, used in DSN support */
 
@@ -948,6 +966,7 @@ enum { FILTER_UNSET, FILTER_FORWARD, FILTER_EXIM, FILTER_SIEVE };
 #define PEER_OFFERED_DSN	BIT(4)
 #define PEER_OFFERED_PIPE	BIT(5)
 #define PEER_OFFERED_SIZE	BIT(6)
+#define PEER_OFFERED_CHUNKING	BIT(7)
 
 
 /* End of macros.h */
diff --git a/src/src/malware.c b/src/src/malware.c
index 9dd241b8c..b36bf0d64 100644
--- a/src/src/malware.c
+++ b/src/src/malware.c
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015 */
-/* License: GPL */
+/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
+ * License: GPL
+ * Copyright (c) The Exim Maintainers 2016
+ */
 
 /* Code for calling virus (malware) scanners. Called from acl.c. */
 
@@ -106,7 +108,7 @@ BOOL malware_ok = FALSE;
 the scan directory normally for that case, but look into rigging up the
 needed header variables if not already set on the command-line? */
 extern int spool_mbox_ok;
-extern uschar spooled_message_id[17];
+extern uschar spooled_message_id[MESSAGE_ID_LENGTH+1];
 
 
 
@@ -628,7 +630,7 @@ if (!malware_ok)
 	    sock);
 	  }
 
-	if (!(drweb_fbuf = (uschar *) malloc (fsize_uint)))
+	if (!(drweb_fbuf = US malloc(fsize_uint)))
 	  {
 	  (void)close(drweb_fd);
 	  return m_errlog_defer_3(scanent, NULL,
@@ -657,7 +659,6 @@ if (!malware_ok)
 	    "unable to send file body to socket (%s)", scanner_options),
 	    sock);
 	  }
-	(void)close(drweb_fd);
 	}
       else
 	{
@@ -1002,7 +1003,9 @@ if (!malware_ok)
 	      kav_re = kav_re_inf;
 	      }
 
-	    /* read report, linewise */
+	    /* read report, linewise.  Using size from stream to read amount of data
+	    from same stream is safe enough. */
+	    /* coverity[tainted_data] */
 	    while (kav_reportlen > 0)
 	      {
 	      if ((bread = recv_line(sock, tmpbuf, sizeof(tmpbuf), tmo)) < 0)
@@ -1304,11 +1307,8 @@ if (!malware_ok)
 	  /* parse options */
 	  /*XXX should these options be common over scanner types? */
 	  if (clamd_option(cd, sublist, &subsep) != OK)
-	    {
 	    return m_errlog_defer(scanent, NULL,
 	      string_sprintf("bad option '%s'", scanner_options));
-	    continue;
-	    }
 
 	  cv[num_servers++] = cd;
 	  if (num_servers >= MAX_CLAMD_SERVERS)
@@ -1488,7 +1488,7 @@ if (!malware_ok)
 	  }
 	lseek(clam_fd, 0, SEEK_SET);
 
-	if (!(clamav_fbuf = (uschar *) malloc (fsize_uint)))
+	if (!(clamav_fbuf = US malloc(fsize_uint)))
 	  {
 	  CLOSE_SOCKDATA; (void)close(clam_fd);
 	  return m_errlog_defer_3(scanent, NULL,
@@ -1949,15 +1949,15 @@ Returns:      Exim message processing code (OK, FAIL, DEFER, ...)
 int
 malware(const uschar * malware_re, int timeout)
 {
-  uschar * scan_filename;
-  int ret;
+uschar * scan_filename;
+int ret;
 
-  scan_filename = string_sprintf("%s/scan/%s/%s.eml",
-		    spool_directory, message_id, message_id);
-  ret = malware_internal(malware_re, scan_filename, timeout, FALSE);
-  if (ret == DEFER) av_failed = TRUE;
+scan_filename = string_sprintf("%s/scan/%s/%s.eml",
+		  spool_directory, message_id, message_id);
+ret = malware_internal(malware_re, scan_filename, timeout, FALSE);
+if (ret == DEFER) av_failed = TRUE;
 
-  return ret;
+return ret;
 }
 
 
@@ -1979,32 +1979,35 @@ Returns:        Exim message processing code (OK, FAIL, DEFER, ...)
 int
 malware_in_file(uschar *eml_filename)
 {
-  uschar message_id_buf[64];
-  int ret;
-
-  /* spool_mbox() assumes various parameters exist, when creating
-  the relevant directory and the email within */
-  (void) string_format(message_id_buf, sizeof(message_id_buf),
-      "dummy-%d", vaguely_random_number(INT_MAX));
-  message_id = message_id_buf;
-  sender_address = US"malware-sender@example.net";
-  return_path = US"";
-  recipients_list = NULL;
-  receive_add_recipient(US"malware-victim@example.net", -1);
-  enable_dollar_recipients = TRUE;
-
-  ret = malware_internal(US"*", eml_filename, 0,  TRUE);
-
-  Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
-  spool_mbox_ok = 1;
-  /* don't set no_mbox_unspool; at present, there's no way for it to become
-  set, but if that changes, then it should apply to these tests too */
-  unspool_mbox();
-
-  /* silence static analysis tools */
-  message_id = NULL;
-
-  return ret;
+uschar message_id_buf[64];
+int ret;
+
+/* spool_mbox() assumes various parameters exist, when creating
+the relevant directory and the email within */
+
+(void) string_format(message_id_buf, sizeof(message_id_buf),
+    "dummy-%d", vaguely_random_number(INT_MAX));
+message_id = message_id_buf;
+sender_address = US"malware-sender@example.net";
+return_path = US"";
+recipients_list = NULL;
+receive_add_recipient(US"malware-victim@example.net", -1);
+enable_dollar_recipients = TRUE;
+
+ret = malware_internal(US"*", eml_filename, 0,  TRUE);
+
+Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
+spool_mbox_ok = 1;
+
+/* don't set no_mbox_unspool; at present, there's no way for it to become
+set, but if that changes, then it should apply to these tests too */
+
+unspool_mbox();
+
+/* silence static analysis tools */
+message_id = NULL;
+
+return ret;
 }
 
 
diff --git a/src/src/mime.c b/src/src/mime.c
index 7b1fa387d..5ed15b081 100644
--- a/src/src/mime.c
+++ b/src/src/mime.c
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004, 2015 */
-/* License: GPL */
+/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004, 2015
+ * License: GPL
+ * Copyright (c) The Exim Maintainers 2016
+ */
 
 #include "exim.h"
 #ifdef WITH_CONTENT_SCAN	/* entire file */
@@ -12,7 +14,16 @@
 
 FILE *mime_stream = NULL;
 uschar *mime_current_boundary = NULL;
-static int mime_header_list_size = sizeof(mime_header_list)/sizeof(mime_header);
+
+static mime_header mime_header_list[] = {
+  { US"content-type:",              13, &mime_content_type },
+  { US"content-disposition:",       20, &mime_content_disposition },
+  { US"content-transfer-encoding:", 26, &mime_content_transfer_encoding },
+  { US"content-id:",                11, &mime_content_id },
+  { US"content-description:",       20, &mime_content_description }
+};
+
+static int mime_header_list_size = nelem(mime_header_list);
 
 static mime_parameter mime_parameter_list[] = {
   { US"name=",     5, &mime_filename },
@@ -177,21 +188,17 @@ return size;
 }
 
 
+/*
+ * Return open filehandle for combo of path and file.
+ * Side-effect: set mime_decoded_filename, to copy in allocated mem
+ */
 static FILE *
 mime_get_decode_file(uschar *pname, uschar *fname)
 {
-FILE *f = NULL;
-uschar *filename;
-
-filename = (uschar *)malloc(2048);
-
 if (pname && fname)
-  {
-  (void)string_format(filename, 2048, "%s/%s", pname, fname);
-  f = modefopen(filename,"wb+",SPOOL_MODE);
-  }
+  mime_decoded_filename = string_sprintf("%s/%s", pname, fname);
 else if (!pname)
-  f = modefopen(fname,"wb+",SPOOL_MODE);
+  mime_decoded_filename = string_copy(fname);
 else if (!fname)
   {
   int file_nr = 0;
@@ -201,21 +208,15 @@ else if (!fname)
   do
     {
     struct stat mystat;
-    (void)string_format(filename, 2048,
-      "%s/%s-%05u", pname, message_id, file_nr++);
+    mime_decoded_filename = string_sprintf("%s/%s-%05u", pname, message_id, file_nr++);
     /* security break */
     if (file_nr >= 1024)
       break;
-    result = stat(CS filename, &mystat);
+    result = stat(CS mime_decoded_filename, &mystat);
     } while(result != -1);
-
-  f = modefopen(filename, "wb+", SPOOL_MODE);
   }
 
-/* set expansion variable */
-mime_decoded_filename = filename;
-
-return f;
+return modefopen(mime_decoded_filename, "wb+", SPOOL_MODE);
 }
 
 
@@ -232,11 +233,9 @@ long f_pos = 0;
 ssize_t size_counter = 0;
 ssize_t (*decode_function)(FILE*, FILE*, uschar*);
 
-if (mime_stream == NULL)
+if (!mime_stream || (f_pos = ftell(mime_stream)) < 0)
   return FAIL;
 
-f_pos = ftell(mime_stream);
-
 /* build default decode path (will exist since MBOX must be spooled up) */
 (void)string_format(decode_path,1024,"%s/scan/%s",spool_directory,message_id);
 
@@ -246,7 +245,7 @@ if ((option = string_nextinlist(&list, &sep,
 				sizeof(option_buffer))) != NULL)
   {
   /* parse 1st option */
-  if ( (Ustrcmp(option,"false") == 0) || (Ustrcmp(option,"0") == 0) )
+  if ((Ustrcmp(option,"false") == 0) || (Ustrcmp(option,"0") == 0))
     /* explicitly no decoding */
     return FAIL;
 
@@ -295,7 +294,8 @@ decode_function =
 size_counter = decode_function(mime_stream, decode_file, mime_current_boundary);
 
 clearerr(mime_stream);
-fseek(mime_stream, f_pos, SEEK_SET);
+if (fseek(mime_stream, f_pos, SEEK_SET))
+  return DEFER;
 
 if (fclose(decode_file) != 0 || size_counter < 0)
   return DEFER;
@@ -453,11 +453,11 @@ while (*s && *s != ';')		/* ; terminates */
     {
     s++;			/* skip opening " */
     while (*s && *s != '"')	/* " protects ; */
-      val = string_cat(val, &size, &ptr, s++, 1);
+      val = string_catn(val, &size, &ptr, s++, 1);
     if (*s) s++;		/* skip closing " */
     }
   else
-    val = string_cat(val, &size, &ptr, s++, 1);
+    val = string_catn(val, &size, &ptr, s++, 1);
 if (val) val[ptr] = '\0';
 *sp = s;
 return val;
@@ -484,24 +484,24 @@ static uschar *
 rfc2231_to_2047(const uschar * fname, const uschar * charset, int * len)
 {
 int size = 0, ptr = 0;
-uschar * val = string_cat(NULL, &size, &ptr, US"=?", 2);
+uschar * val = string_catn(NULL, &size, &ptr, US"=?", 2);
 uschar c;
 
 if (charset)
-  val = string_cat(val, &size, &ptr, charset, Ustrlen(charset));
-val = string_cat(val, &size, &ptr, US"?Q?", 3);
+  val = string_cat(val, &size, &ptr, charset);
+val = string_catn(val, &size, &ptr, US"?Q?", 3);
 
 while ((c = *fname))
   if (c == '%' && isxdigit(fname[1]) && isxdigit(fname[2]))
     {
-    val = string_cat(val, &size, &ptr, US"=", 1);
-    val = string_cat(val, &size, &ptr, ++fname, 2);
+    val = string_catn(val, &size, &ptr, US"=", 1);
+    val = string_catn(val, &size, &ptr, ++fname, 2);
     fname += 2;
     }
   else
-    val = string_cat(val, &size, &ptr, fname++, 1);
+    val = string_catn(val, &size, &ptr, fname++, 1);
 
-val = string_cat(val, &size, &ptr, US"?=", 2);
+val = string_catn(val, &size, &ptr, US"?=", 2);
 val[*len = ptr] = '\0';
 return val;
 }
@@ -799,7 +799,7 @@ while(1)
     if (!mime_decoded_filename)		/* decoding failed */
       {
       log_write(0, LOG_MAIN,
-	   "mime_regex acl condition warning - could not decode RFC822 MIME part to file.");
+	   "MIME acl condition warning - could not decode RFC822 MIME part to file.");
       rc = DEFER;
       goto out;
       }
diff --git a/src/src/mime.h b/src/src/mime.h
index 5c030ebca..5fd4392d5 100644
--- a/src/src/mime.h
+++ b/src/src/mime.h
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004, 2015 */
-/* License: GPL */
+/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004, 2015
+ * License: GPL
+ * Copyright (c) The Exim Maintainers 2016
+ */
 
 #ifdef WITH_CONTENT_SCAN
 
@@ -27,16 +29,6 @@ typedef struct mime_header {
   uschar ** value;
 } mime_header;
 
-static mime_header mime_header_list[] = {
-  { US"content-type:",              13, &mime_content_type },
-  { US"content-disposition:",       20, &mime_content_disposition },
-  { US"content-transfer-encoding:", 26, &mime_content_transfer_encoding },
-  { US"content-id:",                11, &mime_content_id },
-  { US"content-description:",       20, &mime_content_description }
-};
-
-
-
 
 typedef struct mime_parameter {
   uschar *  name;
diff --git a/src/src/moan.c b/src/src/moan.c
index 7d1a2c681..6d922a5a4 100644
--- a/src/src/moan.c
+++ b/src/src/moan.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for sending messages to sender or to mailmaster. */
@@ -279,14 +279,12 @@ if (bounce_return_message)
 
   if (bounce_return_body && message_file)
     {
-    int ch;
-    enum {midline, beginline, haddot} state = beginline;
     BOOL enddot = dot_ends && message_file == stdin;
     uschar * buf = store_get(bounce_return_linesize_limit+2);
 
     if (firstline) fprintf(f, "%s", CS firstline);
 
-    while (fgets(buf, bounce_return_linesize_limit+2, message_file))
+    while (fgets(CS buf, bounce_return_linesize_limit+2, message_file))
       {
       int len;
 
@@ -306,11 +304,11 @@ if (bounce_return_message)
       if (size_limit > 0 && len > size_limit - written)
 	{
 	buf[size_limit - written] = '\0';
-	fputs(buf, f);
+	fputs(CS buf, f);
 	break;
 	}
 
-      fputs(buf, f);
+      fputs(CS buf, f);
       }
     }
 #ifdef EXPERIMENTAL_DMARC
diff --git a/src/src/mytypes.h b/src/src/mytypes.h
index 4d367a95b..b288a32cb 100644
--- a/src/src/mytypes.h
+++ b/src/src/mytypes.h
@@ -14,15 +14,15 @@ local_scan.h includes it and exim.h includes them both (to get this earlier). */
 #define MYTYPES_H
 
 #ifndef FALSE
-#define FALSE         0
+# define FALSE         0
 #endif
 
 #ifndef TRUE
-#define TRUE          1
+# define TRUE          1
 #endif
 
 #ifndef TRUE_UNSET
-#define TRUE_UNSET    2
+# define TRUE_UNSET    2
 #endif
 
 
@@ -30,17 +30,17 @@ local_scan.h includes it and exim.h includes them both (to get this earlier). */
 the arguments of printf-like functions. This is done by a macro. */
 
 #if defined(__GNUC__) || defined(__clang__)
-#define PRINTF_FUNCTION(A,B)  __attribute__((format(printf,A,B)))
-#define ARG_UNUSED  __attribute__((__unused__))
+# define PRINTF_FUNCTION(A,B)  __attribute__((format(printf,A,B)))
+# define ARG_UNUSED  __attribute__((__unused__))
 #else
-#define PRINTF_FUNCTION(A,B)
-#define ARG_UNUSED  /**/
+# define PRINTF_FUNCTION(A,B)
+# define ARG_UNUSED  /**/
 #endif
 
 #ifdef WANT_DEEPER_PRINTF_CHECKS
-#define ALMOST_PRINTF(A, B) PRINTF_FUNCTION(A, B)
+# define ALMOST_PRINTF(A, B) PRINTF_FUNCTION(A, B)
 #else
-#define ALMOST_PRINTF(A, B)
+# define ALMOST_PRINTF(A, B)
 #endif
 
 
@@ -49,7 +49,7 @@ the standard header files, so we use "uschar". Solaris has u_char in
 sys/types.h. This is just a typing convenience, of course. */
 
 typedef unsigned char uschar;
-typedef int BOOL;
+typedef unsigned BOOL;
 /* We also have SIGNAL_BOOL, which requires signal.h be included, so is defined
 elsewhere */
 
diff --git a/src/src/os.c b/src/src/os.c
index ee754f9f2..47af038f7 100644
--- a/src/src/os.c
+++ b/src/src/os.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2014 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 #ifdef STAND_ALONE
@@ -833,9 +833,57 @@ os_get_dns_resolver_res(void)
 
 #endif /* OS_GET_DNS_RESOLVER_RES */
 
+/* ----------------------------------------------------------------------- */
+
+/***********************************************************
+*                 unsetenv()                               *
+***********************************************************/
+
+/* Most modern systems define int unsetenv(const char*),
+* some don't. */
+
+#if !defined(OS_UNSETENV)
+int
+os_unsetenv(const unsigned char * name)
+{
+return unsetenv((char *)name);
+}
+#endif
 
 /* ----------------------------------------------------------------------- */
 
+/***********************************************************
+*               getcwd()                                   *
+***********************************************************/
+
+/* Glibc allows getcwd(NULL, 0) to do auto-allocation. Some systems
+do auto-allocation, but need the size of the buffer, and others
+may not even do this. If the OS supports getcwd(NULL, 0) we'll use
+this, for all other systems we provide our own getcwd() */
+
+#if !defined(OS_GETCWD)
+unsigned char *
+os_getcwd(unsigned char * buffer, size_t size)
+{
+return (unsigned char *) getcwd((char *)buffer, size);
+}
+#else
+#ifndef PATH_MAX
+# define PATH_MAX 4096
+#endif
+unsigned char *
+os_getcwd(unsigned char * buffer, size_t size)
+{
+char * b = (char *)buffer;
+
+if (!size) size = PATH_MAX;
+if (!b && !(b = malloc(size))) return NULL;
+if (!(b = getcwd(b, size))) return NULL;
+return realloc(b, strlen(b) + 1);
+}
+#endif
+
+/* ----------------------------------------------------------------------- */
 
 
 
diff --git a/src/src/osfunctions.h b/src/src/osfunctions.h
index 552712744..4e6e9a91c 100644
--- a/src/src/osfunctions.h
+++ b/src/src/osfunctions.h
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2009 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Prototypes for os-specific functions. For utilities, we don't need the one
@@ -32,5 +32,11 @@ extern const char   *os_strexit(int);     /* char to match os_strsignal */
 #ifndef os_strsignal
 extern const char   *os_strsignal(int);   /* char to match strsignal in some OS */
 #endif
+#ifndef os_unsetenv
+extern int           os_unsetenv(const uschar *);
+#endif
+#ifndef os_getcwd
+extern uschar       *os_getcwd(uschar *, size_t);
+#endif
 
 /* End of osfunctions.h */
diff --git a/src/src/parse.c b/src/src/parse.c
index d3f382b96..3d942fd95 100644
--- a/src/src/parse.c
+++ b/src/src/parse.c
@@ -1425,7 +1425,7 @@ for (;;)
 
     /* Check file name if required */
 
-    if (directory != NULL)
+    if (directory)
       {
       int len = Ustrlen(directory);
       uschar *p = filename + len;
@@ -1437,16 +1437,53 @@ for (;;)
         return FF_ERROR;
         }
 
+#ifdef EXIM_HAVE_OPENAT
+      /* It is necessary to check that every component inside the directory
+      is NOT a symbolic link, in order to keep the file inside the directory.
+      This is mighty tedious. We open the directory and openat every component,
+      with a flag that fails symlinks. */
+
+      {
+      int fd = open(CS directory, O_RDONLY);
+      if (fd < 0)
+	{
+	*error = string_sprintf("failed to open directory %s", directory);
+	return FF_ERROR;
+	}
+      while (*p)
+	{
+	uschar temp;
+	int fd2;
+	uschar * q = p;
+
+	while (*++p && *p != '/') ;
+	temp = *p;
+	*p = '\0';
+
+	fd2 = openat(fd, CS q, O_RDONLY|O_NOFOLLOW);
+	close(fd);
+	*p = temp;
+	if (fd2 < 0)
+	  {
+          *error = string_sprintf("failed to open %s (component of included "
+            "file); could be symbolic link", filename);
+	  return FF_ERROR;
+	  }
+	fd = fd2;
+	}
+      f = fdopen(fd, "rb");
+      }
+#else
       /* It is necessary to check that every component inside the directory
       is NOT a symbolic link, in order to keep the file inside the directory.
       This is mighty tedious. It is also not totally foolproof in that it
       leaves the possibility of a race attack, but I don't know how to do
       any better. */
 
-      while (*p != 0)
+      while (*p)
         {
         int temp;
-        while (*(++p) != 0 && *p != '/');
+        while (*++p && *p != '/');
         temp = *p;
         *p = 0;
         if (Ulstat(filename, &statbuf) != 0)
@@ -1466,11 +1503,16 @@ for (;;)
           return FF_ERROR;
           }
         }
+#endif
       }
 
-    /* Open and stat the file */
+#ifdef EXIM_HAVE_OPENAT
+    else
+#endif
+      /* Open and stat the file */
+      f = Ufopen(filename, "rb");
 
-    if ((f = Ufopen(filename, "rb")) == NULL)
+    if (!f)
       {
       *error = string_open_failed(errno, "included file %s", filename);
       return FF_INCLUDEFAIL;
@@ -1486,7 +1528,7 @@ for (;;)
 
     /* If directory was checked, double check that we opened a regular file */
 
-    if (directory != NULL && (statbuf.st_mode & S_IFMT) != S_IFREG)
+    if (directory && (statbuf.st_mode & S_IFMT) != S_IFREG)
       {
       *error = string_sprintf("included file %s is not a regular file in "
         "the %s directory", filename, directory);
@@ -1518,10 +1560,9 @@ for (;;)
       error, incoming_domain, directory, syntax_errors);
     if (frc != FF_DELIVERED && frc != FF_NOTDELIVERED) return frc;
 
-    if (addr != NULL)
+    if (addr)
       {
-      last = addr;
-      while (last->next != NULL) { count++; last = last->next; }
+      for (last = addr; last->next; last = last->next) count++;
       last->next = *anchor;
       *anchor = addr;
       count++;
diff --git a/src/src/pdkim/Makefile b/src/src/pdkim/Makefile
index c72a9426b..c298568ea 100644
--- a/src/src/pdkim/Makefile
+++ b/src/src/pdkim/Makefile
@@ -1,6 +1,6 @@
 # Make file for building the pdkim library.
 
-OBJ = pdkim.o hash.o rsa.o
+OBJ = pdkim.o rsa.o
 
 pdkim.a:         $(OBJ)
 		 @$(RM_COMMAND) -f pdkim.a
@@ -12,8 +12,7 @@ pdkim.a:         $(OBJ)
 .c.o:;           @echo "$(CC) $*.c"
 		 $(FE)$(CC) -c $(CFLAGS) $(INCLUDE) -I. $*.c
 
-pdkim.o:            $(HDRS) crypt_ver.h hash.h blob.h pdkim.h pdkim.c
-hash.o:             $(HDRS) crypt_ver.h hash.h blob.h pdkim.h hash.c
-rsa.o:              $(HDRS) crypt_ver.h rsa.h blob.h rsa.c
+pdkim.o: $(HDRS) crypt_ver.h pdkim.h pdkim.c
+rsa.o:   $(HDRS) crypt_ver.h rsa.h rsa.c
 
 # End
diff --git a/src/src/pdkim/blob.h b/src/src/pdkim/blob.h
deleted file mode 100644
index e1481c9f4..000000000
--- a/src/src/pdkim/blob.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- *  PDKIM - a RFC4871 (DKIM) implementation
- *
- *  Copyright (C) 2016  Exim maintainers
- *
- *  RSA signing/verification interface
- */
-
-#ifndef BLOB_H	/* entire file */
-#define BLOB_H
-
-typedef struct {
-  uschar * data;
-  size_t   len;
-} blob;
-
-#endif
diff --git a/src/src/pdkim/crypt_ver.h b/src/src/pdkim/crypt_ver.h
index 2a9dde952..cd2171c82 100644
--- a/src/src/pdkim/crypt_ver.h
+++ b/src/src/pdkim/crypt_ver.h
@@ -8,25 +8,19 @@
 /* RSA and SHA routine selection for PDKIM */
 
 #include "../exim.h"
+#include "../sha_ver.h"
 
 
 #ifdef USE_GNUTLS
 # include <gnutls/gnutls.h>
 
-# if GNUTLS_VERSION_NUMBER > 0x020c00
+# if GNUTLS_VERSION_NUMBER >= 0x30000
 #  define RSA_GNUTLS
 # else
 #  define RSA_GCRYPT
 # endif
 
-# if GNUTLS_VERSION_NUMBER >= 0x020a00
-#  define SHA_GNUTLS
-# else
-#  define SHA_GCRYPT
-# endif
-
 #else
 # define RSA_OPENSSL
-# define SHA_OPENSSL
 #endif
 
diff --git a/src/src/pdkim/hash.c b/src/src/pdkim/hash.c
deleted file mode 100644
index 0751683e4..000000000
--- a/src/src/pdkim/hash.c
+++ /dev/null
@@ -1,181 +0,0 @@
-/*
- *  PDKIM - a RFC4871 (DKIM) implementation
- *
- *  Copyright (C) 2016  Exim maintainers
- *
- *  Hash interface functions
- */
-
-#include "../exim.h"
-
-#ifndef DISABLE_DKIM	/* entire file */
-
-#ifndef SUPPORT_TLS
-# error Need SUPPORT_TLS for DKIM
-#endif
-
-#include "crypt_ver.h"
-
-#ifdef RSA_OPENSSL
-# include <openssl/rsa.h>
-# include <openssl/ssl.h>
-# include <openssl/err.h>
-#elif defined(RSA_GNUTLS)
-# include <gnutls/gnutls.h>
-# include <gnutls/x509.h>
-# ifdef RSA_VERIFY_GNUTLS
-#  include <gnutls/abstract.h>
-# endif
-#endif
-
-#ifdef SHA_GNUTLS
-# include <gnutls/crypto.h>
-#endif
-
-#include "hash.h"
-
-
-/******************************************************************************/
-#ifdef SHA_OPENSSL
-
-void
-exim_sha_init(hctx * h, BOOL sha1)
-{
-h->sha1 = sha1;
-h->hashlen = sha1 ? 20 : 32;
-if (h->sha1)
-  SHA1_Init  (&h->u.sha1);
-else
-  SHA256_Init(&h->u.sha2);
-}
-
-
-void
-exim_sha_update(hctx * h, const char * data, int len)
-{
-if (h->sha1)
-  SHA1_Update  (&h->u.sha1, data, len);
-else
-  SHA256_Update(&h->u.sha2, data, len);
-}
-
-
-void
-exim_sha_finish(hctx * h, blob * b)
-{
-b->data = store_get(b->len = h->hashlen);
-
-if (h->sha1)
-  SHA1_Final  (b->data, &h->u.sha1);
-else
-  SHA256_Final(b->data, &h->u.sha2);
-}
-
-
-
-#elif defined(SHA_GNUTLS)
-/******************************************************************************/
-
-void
-exim_sha_init(hctx * h, BOOL sha1)
-{
-h->sha1 = sha1;
-h->hashlen = sha1 ? 20 : 32;
-gnutls_hash_init(&h->sha, sha1 ? GNUTLS_DIG_SHA1 : GNUTLS_DIG_SHA256);
-}
-
-
-void
-exim_sha_update(hctx * h, const char * data, int len)
-{
-gnutls_hash(h->sha, data, len);
-}
-
-
-void
-exim_sha_finish(hctx * h, blob * b)
-{
-b->data = store_get(b->len = h->hashlen);
-gnutls_hash_output(h->sha, b->data);
-}
-
-
-
-#elif defined(SHA_GCRYPT)
-/******************************************************************************/
-
-void
-exim_sha_init(hctx * h, BOOL sha1)
-{
-h->sha1 = sha1;
-h->hashlen = sha1 ? 20 : 32;
-gcry_md_open(&h->sha, sha1 ? GCRY_MD_SHA1 : GCRY_MD_SHA256, 0);
-}
-
-
-void
-exim_sha_update(hctx * h, const char * data, int len)
-{
-gcry_md_write(h->sha, data, len);
-}
-
-
-void
-exim_sha_finish(hctx * h, blob * b)
-{
-b->data = store_get(b->len = h->hashlen);
-memcpy(b->data, gcry_md_read(h->sha, 0), h->hashlen);
-}
-
-
-
-
-#elif defined(SHA_POLARSSL)
-/******************************************************************************/
-
-void
-exim_sha_init(hctx * h, BOOL sha1)
-{
-h->sha1 = sha1;
-h->hashlen = sha1 ? 20 : 32;
-if (h->sha1)
-  sha1_starts(&h->u.sha1);
-else
-  sha2_starts(&h->u.sha2, 0);
-}
-
-
-void
-exim_sha_update(hctx * h, const char * data, int len)
-{
-if (h->sha1)
-  sha1_update(h->u.sha1, US data, len);
-else
-  sha2_update(h->u.sha2, US data, len);
-}
-
-
-void
-exim_sha_finish(hctx * h, blob * b)
-{
-b->data = store_get(b->len = h->hashlen);
-
-if (h->sha1)
-  sha1_finish(h->u.sha1, b->data);
-else
-  sha2_finish(h->u.sha2, b->data);
-}
-
-#endif
-/******************************************************************************/
-
-/* Common to all library versions */
-int
-exim_sha_hashlen(hctx * h)
-{
-return h->sha1 ? 20 : 32;
-}
-
-
-#endif	/*DISABLE_DKIM*/
-/* End of File */
diff --git a/src/src/pdkim/hash.h b/src/src/pdkim/hash.h
deleted file mode 100644
index afd7ea6a6..000000000
--- a/src/src/pdkim/hash.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- *  PDKIM - a RFC4871 (DKIM) implementation
- *
- *  Copyright (C) 2016  Exim maintainers
- *
- *  Hash interface functions
- */
-
-#include "../exim.h"
-
-#if !defined(DISABLE_DKIM) && !defined(PDKIM_HASH_H)	/* entire file */
-#define PDKIM_HASH_H
-
-#ifndef SUPPORT_TLS
-# error Need SUPPORT_TLS for DKIM
-#endif
-
-#include "crypt_ver.h"
-#include "blob.h"
-
-#ifdef RSA_OPENSSL
-# include <openssl/rsa.h>
-# include <openssl/ssl.h>
-# include <openssl/err.h>
-#elif defined(RSA_GNUTLS)
-# include <gnutls/gnutls.h>
-# include <gnutls/x509.h>
-#endif
-
-#ifdef SHA_GNUTLS
-# include <gnutls/crypto.h>
-#elif defined(SHA_GCRYPT)
-# include <gcrypt.h>
-#elif defined(SHA_POLARSSL)
-# include "pdkim.h"
-# include "polarssl/sha1.h"
-# include "polarssl/sha2.h"
-#endif
-
-/* Hash context */
-typedef struct {
-  int sha1;
-  int hashlen;
-
-#ifdef SHA_OPENSSL
-  union {
-    SHA_CTX      sha1;       /* SHA1 block                                */
-    SHA256_CTX   sha2;       /* SHA256 block                              */
-  } u;
-
-#elif defined(SHA_GNUTLS)
-  gnutls_hash_hd_t sha;      /* Either SHA1 or SHA256 block               */
-
-#elif defined(SHA_GCRYPT)
-  gcry_md_hd_t sha;          /* Either SHA1 or SHA256 block               */
-
-#elif defined(SHA_POLARSSL)
-  union {
-    sha1_context sha1;       /* SHA1 block                                */
-    sha2_context sha2;       /* SHA256 block                              */
-  } u;
-#endif
-
-} hctx;
-
-#if defined(SHA_OPENSSL)
-# include "pdkim.h"
-#elif defined(SHA_GCRYPT)
-# include "pdkim.h"
-#endif
-
-
-extern void     exim_sha_init(hctx *, BOOL);
-extern void     exim_sha_update(hctx *, const char *a, int);
-extern void     exim_sha_finish(hctx *, blob *);
-extern int      exim_sha_hashlen(hctx *);
-
-#endif	/*DISABLE_DKIM*/
-/* End of File */
diff --git a/src/src/pdkim/pdkim.c b/src/src/pdkim/pdkim.c
index 64b158184..7bfcdf4aa 100644
--- a/src/src/pdkim/pdkim.c
+++ b/src/src/pdkim/pdkim.c
@@ -45,7 +45,7 @@
 #include "rsa.h"
 
 #define PDKIM_SIGNATURE_VERSION     "1"
-#define PDKIM_PUB_RECORD_VERSION    "DKIM1"
+#define PDKIM_PUB_RECORD_VERSION    US "DKIM1"
 
 #define PDKIM_MAX_HEADER_LEN        65536
 #define PDKIM_MAX_HEADERS           512
@@ -62,58 +62,51 @@
 
 /* -------------------------------------------------------------------------- */
 struct pdkim_stringlist {
-  char *value;
-  int  tag;
-  void *next;
-};
-
-#define PDKIM_STR_ALLOC_FRAG 256
-struct pdkim_str {
-  char         *str;
-  unsigned int  len;
-  unsigned int  allocated;
+  uschar * value;
+  int      tag;
+  void *   next;
 };
 
 /* -------------------------------------------------------------------------- */
 /* A bunch of list constants */
-const char *pdkim_querymethods[] = {
-  "dns/txt",
+const uschar * pdkim_querymethods[] = {
+  US"dns/txt",
   NULL
 };
-const char *pdkim_algos[] = {
-  "rsa-sha256",
-  "rsa-sha1",
+const uschar * pdkim_algos[] = {
+  US"rsa-sha256",
+  US"rsa-sha1",
   NULL
 };
-const char *pdkim_canons[] = {
-  "simple",
-  "relaxed",
+const uschar * pdkim_canons[] = {
+  US"simple",
+  US"relaxed",
   NULL
 };
-const char *pdkim_hashes[] = {
-  "sha256",
-  "sha1",
+const uschar * pdkim_hashes[] = {
+  US"sha256",
+  US"sha1",
   NULL
 };
-const char *pdkim_keytypes[] = {
-  "rsa",
+const uschar * pdkim_keytypes[] = {
+  US"rsa",
   NULL
 };
 
 typedef struct pdkim_combined_canon_entry {
-  const char *str;
+  const uschar * str;
   int canon_headers;
   int canon_body;
 } pdkim_combined_canon_entry;
 
 pdkim_combined_canon_entry pdkim_combined_canons[] = {
-  { "simple/simple",    PDKIM_CANON_SIMPLE,   PDKIM_CANON_SIMPLE },
-  { "simple/relaxed",   PDKIM_CANON_SIMPLE,   PDKIM_CANON_RELAXED },
-  { "relaxed/simple",   PDKIM_CANON_RELAXED,  PDKIM_CANON_SIMPLE },
-  { "relaxed/relaxed",  PDKIM_CANON_RELAXED,  PDKIM_CANON_RELAXED },
-  { "simple",           PDKIM_CANON_SIMPLE,   PDKIM_CANON_SIMPLE },
-  { "relaxed",          PDKIM_CANON_RELAXED,  PDKIM_CANON_SIMPLE },
-  { NULL,               0,                    0 }
+  { US"simple/simple",    PDKIM_CANON_SIMPLE,   PDKIM_CANON_SIMPLE },
+  { US"simple/relaxed",   PDKIM_CANON_SIMPLE,   PDKIM_CANON_RELAXED },
+  { US"relaxed/simple",   PDKIM_CANON_RELAXED,  PDKIM_CANON_SIMPLE },
+  { US"relaxed/relaxed",  PDKIM_CANON_RELAXED,  PDKIM_CANON_RELAXED },
+  { US"simple",           PDKIM_CANON_SIMPLE,   PDKIM_CANON_SIMPLE },
+  { US"relaxed",          PDKIM_CANON_RELAXED,  PDKIM_CANON_SIMPLE },
+  { NULL,                 0,                    0 }
 };
 
 
@@ -122,26 +115,47 @@ pdkim_combined_canon_entry pdkim_combined_canons[] = {
 const char *
 pdkim_verify_status_str(int status)
 {
-  switch(status) {
-    case PDKIM_VERIFY_NONE:    return "PDKIM_VERIFY_NONE";
-    case PDKIM_VERIFY_INVALID: return "PDKIM_VERIFY_INVALID";
-    case PDKIM_VERIFY_FAIL:    return "PDKIM_VERIFY_FAIL";
-    case PDKIM_VERIFY_PASS:    return "PDKIM_VERIFY_PASS";
-    default:                   return "PDKIM_VERIFY_UNKNOWN";
+switch(status)
+  {
+  case PDKIM_VERIFY_NONE:    return "PDKIM_VERIFY_NONE";
+  case PDKIM_VERIFY_INVALID: return "PDKIM_VERIFY_INVALID";
+  case PDKIM_VERIFY_FAIL:    return "PDKIM_VERIFY_FAIL";
+  case PDKIM_VERIFY_PASS:    return "PDKIM_VERIFY_PASS";
+  default:                   return "PDKIM_VERIFY_UNKNOWN";
   }
 }
 
 const char *
 pdkim_verify_ext_status_str(int ext_status)
 {
-  switch(ext_status) {
-    case PDKIM_VERIFY_FAIL_BODY: return "PDKIM_VERIFY_FAIL_BODY";
-    case PDKIM_VERIFY_FAIL_MESSAGE: return "PDKIM_VERIFY_FAIL_MESSAGE";
-    case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE: return "PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE";
-    case PDKIM_VERIFY_INVALID_BUFFER_SIZE: return "PDKIM_VERIFY_INVALID_BUFFER_SIZE";
-    case PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD: return "PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD";
-    case PDKIM_VERIFY_INVALID_PUBKEY_IMPORT: return "PDKIM_VERIFY_INVALID_PUBKEY_IMPORT";
-    default: return "PDKIM_VERIFY_UNKNOWN";
+switch(ext_status)
+  {
+  case PDKIM_VERIFY_FAIL_BODY: return "PDKIM_VERIFY_FAIL_BODY";
+  case PDKIM_VERIFY_FAIL_MESSAGE: return "PDKIM_VERIFY_FAIL_MESSAGE";
+  case PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE: return "PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE";
+  case PDKIM_VERIFY_INVALID_BUFFER_SIZE: return "PDKIM_VERIFY_INVALID_BUFFER_SIZE";
+  case PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD: return "PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD";
+  case PDKIM_VERIFY_INVALID_PUBKEY_IMPORT: return "PDKIM_VERIFY_INVALID_PUBKEY_IMPORT";
+  case PDKIM_VERIFY_INVALID_SIGNATURE_ERROR: return "PDKIM_VERIFY_INVALID_SIGNATURE_ERROR";
+  case PDKIM_VERIFY_INVALID_DKIM_VERSION: return "PDKIM_VERIFY_INVALID_DKIM_VERSION";
+  default: return "PDKIM_VERIFY_UNKNOWN";
+  }
+}
+
+const char *
+pdkim_errstr(int status)
+{
+switch(status)
+  {
+  case PDKIM_OK:		return "OK";
+  case PDKIM_FAIL:		return "FAIL";
+  case PDKIM_ERR_RSA_PRIVKEY:	return "RSA_PRIVKEY";
+  case PDKIM_ERR_RSA_SIGNING:	return "RSA SIGNING";
+  case PDKIM_ERR_LONG_LINE:	return "RSA_LONG_LINE";
+  case PDKIM_ERR_BUFFER_TOO_SMALL:	return "BUFFER_TOO_SMALL";
+  case PDKIM_SIGN_PRIVKEY_WRAP:	return "PRIVKEY_WRAP";
+  case PDKIM_SIGN_PRIVKEY_B64D:	return "PRIVKEY_B64D";
+  default: return "(unknown)";
   }
 }
 
@@ -149,14 +163,12 @@ pdkim_verify_ext_status_str(int ext_status)
 /* -------------------------------------------------------------------------- */
 /* Print debugging functions */
 static void
-pdkim_quoteprint(const char *data, int len)
+pdkim_quoteprint(const uschar *data, int len)
 {
 int i;
-const unsigned char *p = (const unsigned char *)data;
-
 for (i = 0; i < len; i++)
   {
-  const int c = p[i];
+  const int c = data[i];
   switch (c)
     {
     case ' ' : debug_printf("{SP}"); break;
@@ -177,210 +189,52 @@ debug_printf("\n");
 }
 
 static void
-pdkim_hexprint(const char *data, int len)
+pdkim_hexprint(const uschar *data, int len)
 {
 int i;
-const unsigned char *p = (const unsigned char *)data;
-
-for (i = 0 ; i < len; i++)
-  debug_printf("%02x", p[i]);
+for (i = 0 ; i < len; i++) debug_printf("%02x", data[i]);
 debug_printf("\n");
 }
 
 
 
-/* SSS probably want to keep the "stringlist" notion */
-
 static pdkim_stringlist *
-pdkim_prepend_stringlist(pdkim_stringlist *base, char *str)
+pdkim_prepend_stringlist(pdkim_stringlist * base, const uschar * str)
 {
-pdkim_stringlist *new_entry = malloc(sizeof(pdkim_stringlist));
+pdkim_stringlist * new_entry = store_get(sizeof(pdkim_stringlist));
 
-if (!new_entry) return NULL;
 memset(new_entry, 0, sizeof(pdkim_stringlist));
-if (!(new_entry->value = strdup(str))) return NULL;
-if (base)
-  {
-  pdkim_stringlist *last = base;
-  while (last->next != NULL) { last = last->next; }
-  last->next = new_entry;
-  return base;
-  }
-else
-  return new_entry;
-}
-
-
-/* -------------------------------------------------------------------------- */
-/* A small "growing string" implementation to escape malloc/realloc hell */
-/* String package: should be replaced by Exim standard ones */
-/* SSS Ustrcpy */
-
-static pdkim_str *
-pdkim_strnew (const char *cstr)
-{
-unsigned int len = cstr ? strlen(cstr) : 0;
-pdkim_str *p = malloc(sizeof(pdkim_str));
-
-if (!p) return NULL;
-memset(p, 0, sizeof(pdkim_str));
-if (!(p->str = malloc(len+1)))
-  {
-  free(p);
-  return NULL;
-  }
-p->allocated = len+1;
-p->len = len;
-if (cstr)
-  strcpy(p->str, cstr);
-else
-  p->str[p->len] = '\0';
-return p;
-}
-
-
-/*SSS Ustrncat */
-
-static char *
-pdkim_strncat(pdkim_str *str, const char *data, int len)
-{
-if ((str->allocated - str->len) < (len+1))
-  {
-  /* Extend the buffer */
-  int num_frags = ((len+1)/PDKIM_STR_ALLOC_FRAG)+1;
-  char *n = realloc(str->str,
-		    (str->allocated+(num_frags*PDKIM_STR_ALLOC_FRAG)));
-  if (n == NULL) return NULL;
-  str->str = n;
-  str->allocated += (num_frags*PDKIM_STR_ALLOC_FRAG);
-  }
-strncpy(&(str->str[str->len]), data, len);
-str->len += len;
-str->str[str->len] = '\0';
-return str->str;
-}
-
-
-/* SSS Ustrcat */
-
-static char *
-pdkim_strcat(pdkim_str *str, const char *cstr)
-{
-return pdkim_strncat(str, cstr, strlen(cstr));
+new_entry->value = string_copy(str);
+if (base) new_entry->next = base;
+return new_entry;
 }
 
 
 
 /* Trim whitespace fore & aft */
 
-static char *
-pdkim_strtrim(pdkim_str *str)
+static void
+pdkim_strtrim(uschar * str)
 {
-char *p = str->str;
-char *q = str->str;
+uschar * p = str;
+uschar * q = str;
 while (*p == '\t' || *p == ' ') p++;		/* skip whitespace */
 while (*p) {*q = *p; q++; p++;}			/* dump the leading whitespace */
 *q = '\0';
-while (q != str->str && ( (*q == '\0') || (*q == '\t') || (*q == ' ') ) )
+while (q != str && ( (*q == '\0') || (*q == '\t') || (*q == ' ') ) )
   {						/* dump trailing whitespace */
   *q = '\0';
   q--;
   }
-str->len = strlen(str->str);
-return str->str;
-}
-
-
-
-static char *
-pdkim_strclear(pdkim_str *str)
-{
-str->str[0] = '\0';
-str->len = 0;
-return str->str;
-}
-
-
-
-static void
-pdkim_strfree(pdkim_str *str)
-{
-if (!str) return;
-if (str->str) free(str->str);
-free(str);
 }
 
 
-static void
-pdkim_stringlist_free(pdkim_stringlist * e)
-{
-while(e)
-  {
-  pdkim_stringlist * c = e;
-  if (e->value) free(e->value);
-  e = e->next;
-  free(c);
-  }
-}
-
-
-
-/* -------------------------------------------------------------------------- */
-
-static void
-pdkim_free_pubkey(pdkim_pubkey *pub)
-{
-if (pub)
-  {
-  if (pub->version    ) free(pub->version);
-  if (pub->granularity) free(pub->granularity);
-  if (pub->hashes     ) free(pub->hashes);
-  if (pub->keytype    ) free(pub->keytype);
-  if (pub->srvtype    ) free(pub->srvtype);
-  if (pub->notes      ) free(pub->notes);
-  free(pub);
-  }
-}
-
-
-/* -------------------------------------------------------------------------- */
-
-static void
-pdkim_free_sig(pdkim_signature *sig)
-{
-if (sig)
-  {
-  pdkim_signature *next = (pdkim_signature *)sig->next;
-
-  pdkim_stringlist_free(sig->headers);
-  if (sig->selector        ) free(sig->selector);
-  if (sig->domain          ) free(sig->domain);
-  if (sig->identity        ) free(sig->identity);
-  if (sig->copiedheaders   ) free(sig->copiedheaders);
-  if (sig->rsa_privkey     ) free(sig->rsa_privkey);
-  if (sig->sign_headers    ) free(sig->sign_headers);
-  if (sig->signature_header) free(sig->signature_header);
-
-  if (sig->pubkey) pdkim_free_pubkey(sig->pubkey);
-
-  free(sig);
-  if (next) pdkim_free_sig(next);
-  }
-}
-
 
 /* -------------------------------------------------------------------------- */
 
 DLLEXPORT void
 pdkim_free_ctx(pdkim_ctx *ctx)
 {
-if (ctx)
-  {
-  pdkim_stringlist_free(ctx->headers);
-  pdkim_free_sig(ctx->sig);
-  pdkim_strfree(ctx->cur_header);
-  free(ctx);
-  }
 }
 
 
@@ -391,81 +245,59 @@ if (ctx)
 /*XXX might be safer done using a pdkim_stringlist for "tick" */
 
 static int
-header_name_match(const char * header, char * tick)
+header_name_match(const uschar * header, uschar * tick)
 {
-char *hname;
-char *lcopy;
-char *p;
-char *q;
-int rc = PDKIM_FAIL;
-
-/* Get header name */
-char *hcolon = strchr(header, ':');
+uschar * hname;
+uschar * lcopy;
+uschar * p;
+uschar * q;
+uschar * hcolon = Ustrchr(header, ':');		/* Get header name */
 
-if (!hcolon) return rc; /* This isn't a header */
+if (!hcolon)
+  return PDKIM_FAIL; /* This isn't a header */
 
-if (!(hname = malloc((hcolon-header)+1)))
-  return PDKIM_ERR_OOM;
-memset(hname, 0, (hcolon-header)+1);
-strncpy(hname, header, (hcolon-header));
+/* if we had strncmpic() we wouldn't need this copy */
+hname = string_copyn(header, hcolon-header);
 
 /* Copy tick-off list locally, so we can punch zeroes into it */
-if (!(lcopy = strdup(tick)))
-  {
-  free(hname);
-  return PDKIM_ERR_OOM;
-  }
-p = lcopy;
-q = strchr(p, ':');
-while (q)
+p = lcopy = string_copy(tick);
+
+for (q = Ustrchr(p, ':'); q; q = Ustrchr(p, ':'))
   {
   *q = '\0';
-
-  if (strcasecmp(p, hname) == 0)
-    {
-    rc = PDKIM_OK;
-    /* Invalidate header name instance in tick-off list */
-    tick[p-lcopy] = '_';
-    goto BAIL;
-    }
+  if (strcmpic(p, hname) == 0)
+    goto found;
 
   p = q+1;
-  q = strchr(p, ':');
   }
 
-if (strcasecmp(p, hname) == 0)
-  {
-  rc = PDKIM_OK;
+if (strcmpic(p, hname) == 0)
+  goto found;
+
+return PDKIM_FAIL;
+
+found:
   /* Invalidate header name instance in tick-off list */
   tick[p-lcopy] = '_';
-  }
-
-BAIL:
-free(hname);
-free(lcopy);
-return rc;
+  return PDKIM_OK;
 }
 
 
 /* -------------------------------------------------------------------------- */
-/* Performs "relaxed" canonicalization of a header. The returned pointer needs
-   to be free()d. */
+/* Performs "relaxed" canonicalization of a header. */
 
-static char *
-pdkim_relax_header (char *header, int crlf)
+static uschar *
+pdkim_relax_header(const uschar * header, int crlf)
 {
 BOOL past_field_name = FALSE;
 BOOL seen_wsp = FALSE;
-char *p;
-char *q;
-char *relaxed = malloc(strlen(header)+3);
+const uschar * p;
+uschar * relaxed = store_get(Ustrlen(header)+3);
+uschar * q = relaxed;
 
-if (!relaxed) return NULL;
-
-q = relaxed;
-for (p = header; *p != '\0'; p++)
+for (p = header; *p; p++)
   {
-  int c = *p;
+  uschar c = *p;
   /* Ignore CR & LF */
   if (c == '\r' || c == '\n')
     continue;
@@ -492,9 +324,9 @@ for (p = header; *p != '\0'; p++)
   }
 
 if (q > relaxed && q[-1] == ' ') q--; /* Squash eventual trailing SP */
-*q = '\0';
 
-if (crlf) strcat(relaxed, "\r\n");
+if (crlf) { *q++ = '\r'; *q++ = '\n'; }
+*q = '\0';
 return relaxed;
 }
 
@@ -502,10 +334,10 @@ return relaxed;
 /* -------------------------------------------------------------------------- */
 #define PDKIM_QP_ERROR_DECODE -1
 
-static char *
-pdkim_decode_qp_char(char *qp_p, int *c)
+static uschar *
+pdkim_decode_qp_char(uschar *qp_p, int *c)
 {
-char *initial_pos = qp_p;
+uschar *initial_pos = qp_p;
 
 /* Advance one char */
 qp_p++;
@@ -527,19 +359,17 @@ return initial_pos;
 
 /* -------------------------------------------------------------------------- */
 
-static char *
-pdkim_decode_qp(char *str)
+static uschar *
+pdkim_decode_qp(uschar * str)
 {
 int nchar = 0;
-char *q;
-char *p = str;
-char *n = malloc(strlen(p)+1);
-
-if (!n) return NULL;
+uschar * q;
+uschar * p = str;
+uschar * n = store_get(Ustrlen(str)+1);
 
 *n = '\0';
 q = n;
-while (*p != '\0')
+while (*p)
   {
   if (*p == '=')
     {
@@ -565,24 +395,15 @@ static void
 pdkim_decode_base64(uschar *str, blob * b)
 {
 int dlen;
-char *res;
 dlen = b64decode(str, &b->data);
 if (dlen < 0) b->data = NULL;
 b->len = dlen;
 }
 
-/* -------------------------------------------------------------------------- */
-
-static char *
+static uschar *
 pdkim_encode_base64(blob * b)
 {
-char * ret;
-int old_pool = store_pool;
-
-store_pool = POOL_PERM;
-ret = CS b64encode(b->data, b->len);
-store_pool = old_pool;
-return ret;
+return b64encode(b->data, b->len);
 }
 
 
@@ -592,35 +413,26 @@ return ret;
 #define PDKIM_HDR_VALUE 2
 
 static pdkim_signature *
-pdkim_parse_sig_header(pdkim_ctx *ctx, char *raw_hdr)
+pdkim_parse_sig_header(pdkim_ctx *ctx, uschar * raw_hdr)
 {
 pdkim_signature *sig ;
-char *p, *q;
-pdkim_str *cur_tag = NULL;
-pdkim_str *cur_val = NULL;
+uschar *p, *q;
+uschar * cur_tag = NULL; int ts = 0, tl = 0;
+uschar * cur_val = NULL; int vs = 0, vl = 0;
 BOOL past_hname = FALSE;
 BOOL in_b_val = FALSE;
 int where = PDKIM_HDR_LIMBO;
 int i;
-int old_pool = store_pool;
-
-/* There is a store-reset between header & body reception
-so cannot use the main pool. Any allocs done by Exim
-memory-handling must use the perm pool. */
-
-store_pool = POOL_PERM;
 
-if (!(sig = malloc(sizeof(pdkim_signature)))) return NULL;
+sig = store_get(sizeof(pdkim_signature));
 memset(sig, 0, sizeof(pdkim_signature));
 sig->bodylength = -1;
 
-if (!(sig->rawsig_no_b_val = malloc(strlen(raw_hdr)+1)))
-  {
-  free(sig);
-  return NULL;
-  }
+/* Set so invalid/missing data error display is accurate */
+sig->algo = -1;
+sig->version = 0;
 
-q = sig->rawsig_no_b_val;
+q = sig->rawsig_no_b_val = store_get(Ustrlen(raw_hdr)+1);
 
 for (p = raw_hdr; ; p++)
   {
@@ -648,17 +460,15 @@ for (p = raw_hdr; ; p++)
 
   if (where == PDKIM_HDR_TAG)
     {
-    if (!cur_tag)
-      cur_tag = pdkim_strnew(NULL);
-
     if (c >= 'a' && c <= 'z')
-      pdkim_strncat(cur_tag, p, 1);
+      cur_tag = string_catn(cur_tag, &ts, &tl, p, 1);
 
     if (c == '=')
       {
-      if (strcmp(cur_tag->str, "b") == 0)
+      cur_tag[tl] = '\0';
+      if (Ustrcmp(cur_tag, "b") == 0)
         {
-	*q = '='; q++;
+	*q++ = '=';
 	in_b_val = TRUE;
 	}
       where = PDKIM_HDR_VALUE;
@@ -668,37 +478,35 @@ for (p = raw_hdr; ; p++)
 
   if (where == PDKIM_HDR_VALUE)
     {
-    if (!cur_val)
-      cur_val = pdkim_strnew(NULL);
-
     if (c == '\r' || c == '\n' || c == ' ' || c == '\t')
       goto NEXT_CHAR;
 
     if (c == ';' || c == '\0')
       {
-      if (cur_tag->len > 0)
+      if (tl && vl)
         {
+	cur_val[vl] = '\0';
 	pdkim_strtrim(cur_val);
 
-	DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag->str, cur_val->str);
+	DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag, cur_val);
 
-	switch (cur_tag->str[0])
+	switch (*cur_tag)
 	  {
 	  case 'b':
-	    if (cur_tag->str[1] == 'h')
-	      pdkim_decode_base64(US cur_val->str, &sig->bodyhash);
+	    if (cur_tag[1] == 'h')
+	      pdkim_decode_base64(cur_val, &sig->bodyhash);
 	    else
-	      pdkim_decode_base64(US cur_val->str, &sig->sigdata);
+	      pdkim_decode_base64(cur_val, &sig->sigdata);
 	    break;
 	  case 'v':
 	      /* We only support version 1, and that is currently the
 		 only version there is. */
-	    if (strcmp(cur_val->str, PDKIM_SIGNATURE_VERSION) == 0)
-	      sig->version = 1;
+	    sig->version =
+	      Ustrcmp(cur_val, PDKIM_SIGNATURE_VERSION) == 0 ? 1 : -1;
 	    break;
 	  case 'a':
 	    for (i = 0; pdkim_algos[i]; i++)
-	      if (strcmp(cur_val->str, pdkim_algos[i]) == 0)
+	      if (Ustrcmp(cur_val, pdkim_algos[i]) == 0)
 	        {
 		sig->algo = i;
 		break;
@@ -706,7 +514,7 @@ for (p = raw_hdr; ; p++)
 	    break;
 	  case 'c':
 	    for (i = 0; pdkim_combined_canons[i].str; i++)
-	      if (strcmp(cur_val->str, pdkim_combined_canons[i].str) == 0)
+	      if (Ustrcmp(cur_val, pdkim_combined_canons[i].str) == 0)
 	        {
 		sig->canon_headers = pdkim_combined_canons[i].canon_headers;
 		sig->canon_body    = pdkim_combined_canons[i].canon_body;
@@ -715,40 +523,40 @@ for (p = raw_hdr; ; p++)
 	    break;
 	  case 'q':
 	    for (i = 0; pdkim_querymethods[i]; i++)
-	      if (strcmp(cur_val->str, pdkim_querymethods[i]) == 0)
+	      if (Ustrcmp(cur_val, pdkim_querymethods[i]) == 0)
 	        {
 		sig->querymethod = i;
 		break;
 		}
 	    break;
 	  case 's':
-	    sig->selector = strdup(cur_val->str); break;
+	    sig->selector = string_copy(cur_val); break;
 	  case 'd':
-	    sig->domain = strdup(cur_val->str); break;
+	    sig->domain = string_copy(cur_val); break;
 	  case 'i':
-	    sig->identity = pdkim_decode_qp(cur_val->str); break;
+	    sig->identity = pdkim_decode_qp(cur_val); break;
 	  case 't':
-	    sig->created = strtoul(cur_val->str, NULL, 10); break;
+	    sig->created = strtoul(CS cur_val, NULL, 10); break;
 	  case 'x':
-	    sig->expires = strtoul(cur_val->str, NULL, 10); break;
+	    sig->expires = strtoul(CS cur_val, NULL, 10); break;
 	  case 'l':
-	    sig->bodylength = strtol(cur_val->str, NULL, 10); break;
+	    sig->bodylength = strtol(CS cur_val, NULL, 10); break;
 	  case 'h':
-	    sig->headernames = string_copy(cur_val->str); break;
+	    sig->headernames = string_copy(cur_val); break;
 	  case 'z':
-	    sig->copiedheaders = pdkim_decode_qp(cur_val->str); break;
+	    sig->copiedheaders = pdkim_decode_qp(cur_val); break;
 	  default:
 	    DEBUG(D_acl) debug_printf(" Unknown tag encountered\n");
 	    break;
 	  }
 	}
-      pdkim_strclear(cur_tag);
-      pdkim_strclear(cur_val);
+      tl = 0;
+      vl = 0;
       in_b_val = FALSE;
       where = PDKIM_HDR_LIMBO;
       }
     else
-      pdkim_strncat(cur_val, p, 1);
+      cur_val = string_catn(cur_val, &vs, &vl, p, 1);
     }
 
 NEXT_CHAR:
@@ -759,36 +567,23 @@ NEXT_CHAR:
     *q++ = c;
   }
 
-store_pool = old_pool;
-
-/* Make sure the most important bits are there. */
-if (!(sig->domain      && (*(sig->domain)      != '\0') &&
-      sig->selector    && (*(sig->selector)    != '\0') &&
-      sig->headernames && (*(sig->headernames) != '\0') &&
-      sig->version))
-  {
-  pdkim_free_sig(sig);
-  return NULL;
-  }
-
 *q = '\0';
 /* Chomp raw header. The final newline must not be added to the signature. */
-q--;
-while (q > sig->rawsig_no_b_val  && (*q == '\r' || *q == '\n'))
-  *q = '\0'; q--;	/*XXX questionable code layout; possible bug */
+while (--q > sig->rawsig_no_b_val  && (*q == '\r' || *q == '\n'))
+  *q = '\0';
 
 DEBUG(D_acl)
   {
   debug_printf(
 	  "PDKIM >> Raw signature w/o b= tag value >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
-  pdkim_quoteprint(sig->rawsig_no_b_val, strlen(sig->rawsig_no_b_val));
+  pdkim_quoteprint(US sig->rawsig_no_b_val, Ustrlen(sig->rawsig_no_b_val));
   debug_printf(
-	  "PDKIM >> Sig size: %4d bits\n", sig->sigdata.len*8);
+	  "PDKIM >> Sig size: %4u bits\n", (unsigned) sig->sigdata.len*8);
   debug_printf(
 	  "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
   }
 
-exim_sha_init(&sig->body_hash, sig->algo == PDKIM_ALGO_RSA_SHA1);
+exim_sha_init(&sig->body_hash, sig->algo == PDKIM_ALGO_RSA_SHA1 ? HASH_SHA1 : HASH_SHA256);
 return sig;
 }
 
@@ -796,15 +591,15 @@ return sig;
 /* -------------------------------------------------------------------------- */
 
 static pdkim_pubkey *
-pdkim_parse_pubkey_record(pdkim_ctx *ctx, char *raw_record)
+pdkim_parse_pubkey_record(pdkim_ctx *ctx, const uschar *raw_record)
 {
 pdkim_pubkey *pub;
-char *p;
-pdkim_str *cur_tag = NULL;
-pdkim_str *cur_val = NULL;
+const uschar *p;
+uschar * cur_tag = NULL; int ts = 0, tl = 0;
+uschar * cur_val = NULL; int vs = 0, vl = 0;
 int where = PDKIM_HDR_LIMBO;
 
-if (!(pub = malloc(sizeof(pdkim_pubkey)))) return NULL;
+pub = store_get(sizeof(pdkim_pubkey));
 memset(pub, 0, sizeof(pdkim_pubkey));
 
 for (p = raw_record; ; p++)
@@ -826,14 +621,12 @@ for (p = raw_record; ; p++)
 
   if (where == PDKIM_HDR_TAG)
     {
-    if (!cur_tag)
-      cur_tag = pdkim_strnew(NULL);
-
     if (c >= 'a' && c <= 'z')
-      pdkim_strncat(cur_tag, p, 1);
+      cur_tag = string_catn(cur_tag, &ts, &tl, p, 1);
 
     if (c == '=')
       {
+      cur_tag[tl] = '\0';
       where = PDKIM_HDR_VALUE;
       goto NEXT_CHAR;
       }
@@ -841,20 +634,15 @@ for (p = raw_record; ; p++)
 
   if (where == PDKIM_HDR_VALUE)
     {
-    if (!cur_val)
-      cur_val = pdkim_strnew(NULL);
-
-    if (c == '\r' || c == '\n')
-      goto NEXT_CHAR;
-
     if (c == ';' || c == '\0')
       {
-      if (cur_tag->len > 0)
+      if (tl && vl)
         {
+	cur_val[vl] = '\0';
 	pdkim_strtrim(cur_val);
-	DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag->str, cur_val->str);
+	DEBUG(D_acl) debug_printf(" %s=%s\n", cur_tag, cur_val);
 
-	switch (cur_tag->str[0])
+	switch (cur_tag[0])
 	  {
 	  case 'v':
 	    /* This tag isn't evaluated because:
@@ -863,33 +651,32 @@ for (p = raw_record; ; p++)
 	       - Other versions are currently not specified.      */
 	    break;
 	  case 'h':
-	    pub->hashes = strdup(cur_val->str); break;
+	  case 'k':
+	    pub->hashes = string_copy(cur_val); break;
 	  case 'g':
-	    pub->granularity = strdup(cur_val->str); break;
+	    pub->granularity = string_copy(cur_val); break;
 	  case 'n':
-	    pub->notes = pdkim_decode_qp(cur_val->str); break;
+	    pub->notes = pdkim_decode_qp(cur_val); break;
 	  case 'p':
-	    pdkim_decode_base64(US cur_val->str, &pub->key);
+	    pdkim_decode_base64(US cur_val, &pub->key);
             break;
-	  case 'k':
-	    pub->hashes = strdup(cur_val->str); break;
 	  case 's':
-	    pub->srvtype = strdup(cur_val->str); break;
+	    pub->srvtype = string_copy(cur_val); break;
 	  case 't':
-	    if (strchr(cur_val->str, 'y') != NULL) pub->testing = 1;
-	    if (strchr(cur_val->str, 's') != NULL) pub->no_subdomaining = 1;
+	    if (Ustrchr(cur_val, 'y') != NULL) pub->testing = 1;
+	    if (Ustrchr(cur_val, 's') != NULL) pub->no_subdomaining = 1;
 	    break;
 	  default:
 	    DEBUG(D_acl) debug_printf(" Unknown tag encountered\n");
 	    break;
 	  }
 	}
-      pdkim_strclear(cur_tag);
-      pdkim_strclear(cur_val);
+      tl = 0;
+      vl = 0;
       where = PDKIM_HDR_LIMBO;
       }
     else
-      pdkim_strncat(cur_val, p, 1);
+      cur_val = string_catn(cur_val, &vs, &vl, p, 1);
     }
 
 NEXT_CHAR:
@@ -897,16 +684,15 @@ NEXT_CHAR:
   }
 
 /* Set fallback defaults */
-if (!pub->version    ) pub->version     = strdup(PDKIM_PUB_RECORD_VERSION);
-if (!pub->granularity) pub->granularity = strdup("*");
-if (!pub->keytype    ) pub->keytype     = strdup("rsa");
-if (!pub->srvtype    ) pub->srvtype     = strdup("*");
+if (!pub->version    ) pub->version     = string_copy(PDKIM_PUB_RECORD_VERSION);
+if (!pub->granularity) pub->granularity = string_copy(US"*");
+if (!pub->keytype    ) pub->keytype     = string_copy(US"rsa");
+if (!pub->srvtype    ) pub->srvtype     = string_copy(US"*");
 
 /* p= is required */
 if (pub->key.data)
   return pub;
 
-pdkim_free_pubkey(pub);
 return NULL;
 }
 
@@ -918,15 +704,15 @@ pdkim_update_bodyhash(pdkim_ctx *ctx, const char *data, int len)
 {
 pdkim_signature *sig = ctx->sig;
 /* Cache relaxed version of data */
-char *relaxed_data = NULL;
-int   relaxed_len  = 0;
+uschar *relaxed_data = NULL;
+int     relaxed_len  = 0;
 
 /* Traverse all signatures, updating their hashes. */
 while (sig)
   {
   /* Defaults to simple canon (no further treatment necessary) */
-  const char *canon_data = data;
-  int         canon_len = len;
+  const uschar *canon_data = CUS data;
+  int           canon_len = len;
 
   if (sig->canon_body == PDKIM_CANON_RELAXED)
     {
@@ -937,8 +723,12 @@ while (sig)
       const char *p;
       int q = 0;
 
-      if (!(relaxed_data = malloc(len+1)))
-	return PDKIM_ERR_OOM;
+      /* We want to be able to free this else we allocate
+      for the entire message which could be many MB. Since
+      we don't know what allocations the SHA routines might
+      do, not safe to use store_get()/store_reset(). */
+
+      relaxed_data = store_malloc(len+1);
 
       for (p = data; *p; p++)
         {
@@ -974,7 +764,7 @@ while (sig)
 
   if (canon_len > 0)
     {
-    exim_sha_update(&sig->body_hash, canon_data, canon_len);
+    exim_sha_update(&sig->body_hash, CUS canon_data, canon_len);
     sig->signed_body_bytes += canon_len;
     DEBUG(D_acl) pdkim_quoteprint(canon_data, canon_len);
     }
@@ -982,14 +772,14 @@ while (sig)
   sig = sig->next;
   }
 
-if (relaxed_data) free(relaxed_data);
+if (relaxed_data) store_free(relaxed_data);
 return PDKIM_OK;
 }
 
 
 /* -------------------------------------------------------------------------- */
 
-static int
+static void
 pdkim_finish_bodyhash(pdkim_ctx *ctx)
 {
 pdkim_signature *sig;
@@ -1006,11 +796,11 @@ for (sig = ctx->sig; sig; sig = sig->next)
     debug_printf("PDKIM [%s] Body bytes hashed: %lu\n"
 		 "PDKIM [%s] bh  computed: ",
 		sig->domain, sig->signed_body_bytes, sig->domain);
-    pdkim_hexprint(CS bh.data, bh.len);
+    pdkim_hexprint(CUS bh.data, bh.len);
     }
 
   /* SIGNING -------------------------------------------------------------- */
-  if (ctx->mode == PDKIM_MODE_SIGN)
+  if (ctx->flags & PDKIM_MODE_SIGN)
     {
     sig->bodyhash = bh;
 
@@ -1042,14 +832,36 @@ for (sig = ctx->sig; sig; sig = sig->next)
       }
     }
   }
+}
+
+
+
+static int
+pdkim_body_complete(pdkim_ctx * ctx)
+{
+pdkim_signature * sig = ctx->sig;	/*XXX assumes only one sig */
+
+/* In simple body mode, if any empty lines were buffered,
+replace with one. rfc 4871 3.4.3 */
+/*XXX checking the signed-body-bytes is a gross hack; I think
+it indicates that all linebreaks should be buffered, including
+the one terminating a text line */
+
+if (  sig && sig->canon_body == PDKIM_CANON_SIMPLE
+   && sig->signed_body_bytes == 0
+   && ctx->num_buffered_crlf > 0
+   )
+  pdkim_update_bodyhash(ctx, "\r\n", 2);
 
+ctx->flags |= PDKIM_SEEN_EOD;
+ctx->linebuf_offset = 0;
 return PDKIM_OK;
 }
 
 
 
 /* -------------------------------------------------------------------------- */
-/* Callback from pdkim_feed below for processing complete body lines */
+/* Call from pdkim_feed below for processing complete body lines */
 
 static int
 pdkim_bodyline_complete(pdkim_ctx *ctx)
@@ -1059,33 +871,23 @@ int   n = ctx->linebuf_offset;
 pdkim_signature *sig = ctx->sig;	/*XXX assumes only one sig */
 
 /* Ignore extra data if we've seen the end-of-data marker */
-if (ctx->seen_eod) goto BAIL;
+if (ctx->flags & PDKIM_SEEN_EOD) goto BAIL;
 
 /* We've always got one extra byte to stuff a zero ... */
 ctx->linebuf[ctx->linebuf_offset] = '\0';
 
 /* Terminate on EOD marker */
-if (memcmp(p, ".\r\n", 3) == 0)
+if (ctx->flags & PDKIM_DOT_TERM)
   {
-  /* In simple body mode, if any empty lines were buffered,
-  replace with one. rfc 4871 3.4.3 */
-  /*XXX checking the signed-body-bytes is a gross hack; I think
-  it indicates that all linebreaks should be buffered, including
-  the one terminating a text line */
-  if (  sig && sig->canon_body == PDKIM_CANON_SIMPLE
-     && sig->signed_body_bytes == 0
-     && ctx->num_buffered_crlf > 0
-     )
-    pdkim_update_bodyhash(ctx, "\r\n", 2);
+  if ( memcmp(p, ".\r\n", 3) == 0)
+    return pdkim_body_complete(ctx);
 
-  ctx->seen_eod = TRUE;
-  goto BAIL;
-  }
-/* Unstuff dots */
-if (memcmp(p, "..", 2) == 0)
-  {
-  p++;
-  n--;
+  /* Unstuff dots */
+  if (memcmp(p, "..", 2) == 0)
+    {
+    p++;
+    n--;
+    }
   }
 
 /* Empty lines need to be buffered until we find a non-empty line */
@@ -1136,42 +938,33 @@ static int
 pdkim_header_complete(pdkim_ctx *ctx)
 {
 /* Special case: The last header can have an extra \r appended */
-if ( (ctx->cur_header->len > 1) &&
-     (ctx->cur_header->str[(ctx->cur_header->len)-1] == '\r') )
-  {
-  ctx->cur_header->str[(ctx->cur_header->len)-1] = '\0';
-  ctx->cur_header->len--;
-  }
+if ( (ctx->cur_header_len > 1) &&
+     (ctx->cur_header[(ctx->cur_header_len)-1] == '\r') )
+  --ctx->cur_header_len;
+ctx->cur_header[ctx->cur_header_len] = '\0';
 
 ctx->num_headers++;
 if (ctx->num_headers > PDKIM_MAX_HEADERS) goto BAIL;
 
 /* SIGNING -------------------------------------------------------------- */
-if (ctx->mode == PDKIM_MODE_SIGN)
+if (ctx->flags & PDKIM_MODE_SIGN)
   {
   pdkim_signature *sig;
 
   for (sig = ctx->sig; sig; sig = sig->next)			/* Traverse all signatures */
-    if (header_name_match(ctx->cur_header->str,
-			  sig->sign_headers) == PDKIM_OK)
-      {
-      pdkim_stringlist *list;
 
-      /* Add header to the signed headers list (in reverse order) */
-      if (!(list = pdkim_prepend_stringlist(sig->headers,
-				    ctx->cur_header->str)))
-	return PDKIM_ERR_OOM;
-      sig->headers = list;
-      }
+    /* Add header to the signed headers list (in reverse order) */
+    sig->headers = pdkim_prepend_stringlist(sig->headers,
+				  ctx->cur_header);
   }
 
 /* VERIFICATION ----------------------------------------------------------- */
 /* DKIM-Signature: headers are added to the verification list */
-if (ctx->mode == PDKIM_MODE_VERIFY)
+else
   {
-  if (strncasecmp(ctx->cur_header->str,
+  if (strncasecmp(CCS ctx->cur_header,
 		  DKIM_SIGNATURE_HEADERNAME,
-		  strlen(DKIM_SIGNATURE_HEADERNAME)) == 0)
+		  Ustrlen(DKIM_SIGNATURE_HEADERNAME)) == 0)
     {
     pdkim_signature *new_sig;
 
@@ -1179,7 +972,7 @@ if (ctx->mode == PDKIM_MODE_VERIFY)
     DEBUG(D_acl) debug_printf(
 	"PDKIM >> Found sig, trying to parse >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
 
-    if ((new_sig = pdkim_parse_sig_header(ctx, ctx->cur_header->str)))
+    if ((new_sig = pdkim_parse_sig_header(ctx, ctx->cur_header)))
       {
       pdkim_signature *last_sig = ctx->sig;
       if (!last_sig)
@@ -1198,17 +991,12 @@ if (ctx->mode == PDKIM_MODE_VERIFY)
 
   /* every other header is stored for signature verification */
   else
-    {
-    pdkim_stringlist *list;
-
-    if (!(list = pdkim_prepend_stringlist(ctx->headers, ctx->cur_header->str)))
-      return PDKIM_ERR_OOM;
-    ctx->headers = list;
-    }
+    ctx->headers = pdkim_prepend_stringlist(ctx->headers, ctx->cur_header);
   }
 
 BAIL:
-pdkim_strclear(ctx->cur_header); /* Re-use existing pdkim_str */
+*ctx->cur_header = '\0';
+ctx->cur_header_len = 0;	/* leave buffer for reuse */
 return PDKIM_OK;
 }
 
@@ -1218,15 +1006,19 @@ return PDKIM_OK;
 #define HEADER_BUFFER_FRAG_SIZE 256
 
 DLLEXPORT int
-pdkim_feed (pdkim_ctx *ctx, char *data, int len)
+pdkim_feed(pdkim_ctx *ctx, char *data, int len)
 {
 int p;
 
-for (p = 0; p<len; p++)
+/* Alternate EOD signal, used in non-dotstuffing mode */
+if (!data)
+  pdkim_body_complete(ctx);
+
+else for (p = 0; p<len; p++)
   {
-  char c = data[p];
+  uschar c = data[p];
 
-  if (ctx->past_headers)
+  if (ctx->flags & PDKIM_PAST_HDRS)
     {
     /* Processing body byte */
     ctx->linebuf[ctx->linebuf_offset++] = c;
@@ -1245,51 +1037,61 @@ for (p = 0; p<len; p++)
       {
       if (c == '\n')
         {
-	if (ctx->seen_lf)
+	if (ctx->flags & PDKIM_SEEN_LF)
 	  {
 	  int rc = pdkim_header_complete(ctx); /* Seen last header line */
 	  if (rc != PDKIM_OK) return rc;
 
-	  ctx->past_headers = TRUE;
-	  ctx->seen_lf = 0;
+	  ctx->flags = ctx->flags & ~PDKIM_SEEN_LF | PDKIM_PAST_HDRS;
 	  DEBUG(D_acl) debug_printf(
 	      "PDKIM >> Body data for hash, canonicalized >>>>>>>>>>>>>>>>>>>>>>\n");
 	  continue;
 	  }
 	else
-	  ctx->seen_lf = TRUE;
+	  ctx->flags |= PDKIM_SEEN_LF;
 	}
-      else if (ctx->seen_lf)
+      else if (ctx->flags & PDKIM_SEEN_LF)
         {
 	if (!(c == '\t' || c == ' '))
 	  {
 	  int rc = pdkim_header_complete(ctx); /* End of header */
 	  if (rc != PDKIM_OK) return rc;
 	  }
-	ctx->seen_lf = FALSE;
+	ctx->flags &= ~PDKIM_SEEN_LF;
 	}
       }
 
-    if (!ctx->cur_header)
-      if (!(ctx->cur_header = pdkim_strnew(NULL)))
-	return PDKIM_ERR_OOM;
-
-    if (ctx->cur_header->len < PDKIM_MAX_HEADER_LEN)
-      if (!pdkim_strncat(ctx->cur_header, &data[p], 1))
-	return PDKIM_ERR_OOM;
+    if (ctx->cur_header_len < PDKIM_MAX_HEADER_LEN)
+      ctx->cur_header = string_catn(ctx->cur_header, &ctx->cur_header_size,
+				  &ctx->cur_header_len, CUS &data[p], 1);
     }
   }
 return PDKIM_OK;
 }
 
+
+
+/* Extend a grwong header with a continuation-linebreak */
+static uschar *
+pdkim_hdr_cont(uschar * str, int * size, int * ptr, int * col)
+{
+*col = 1;
+return string_catn(str, size, ptr, US"\r\n\t", 3);
+}
+
+
+
 /*
  * RFC 5322 specifies that header line length SHOULD be no more than 78
  * lets make it so!
  *  pdkim_headcat
- * returns char*
+ *
+ * returns uschar * (not nul-terminated)
  *
  * col: this int holds and receives column number (octets since last '\n')
  * str: partial string to append to
+ * size: current buffer size for str
+ * ptr: current tail-pointer for str
  * pad: padding, split line or space after before or after eg: ";"
  * intro: - must join to payload eg "h=", usually the tag name
  * payload: eg base64 data - long data can be split arbitrarily.
@@ -1303,40 +1105,36 @@ return PDKIM_OK;
  * names longer than 78, or bogus col. Input is assumed to be free of line breaks.
  */
 
-static char *
-pdkim_headcat(int *col, pdkim_str *str, const char * pad,
-  const char *intro, const char *payload)
+static uschar *
+pdkim_headcat(int * col, uschar * str, int * size, int * ptr,
+  const uschar * pad, const uschar * intro, const uschar * payload)
 {
 size_t l;
 
 if (pad)
   {
-  l = strlen(pad);
+  l = Ustrlen(pad);
   if (*col + l > 78)
-    {
-    pdkim_strcat(str, "\r\n\t");
-    *col = 1;
-    }
-  pdkim_strncat(str, pad, l);
+    str = pdkim_hdr_cont(str, size, ptr, col);
+  str = string_catn(str, size, ptr, pad, l);
   *col += l;
   }
 
-l = (pad?1:0) + (intro?strlen(intro):0);
+l = (pad?1:0) + (intro?Ustrlen(intro):0);
 
 if (*col + l > 78)
   { /*can't fit intro - start a new line to make room.*/
-  pdkim_strcat(str, "\r\n\t");
-  *col = 1;
-  l = intro?strlen(intro):0;
+  str = pdkim_hdr_cont(str, size, ptr, col);
+  l = intro?Ustrlen(intro):0;
   }
 
-l += payload ? strlen(payload):0 ;
+l += payload ? Ustrlen(payload):0 ;
 
 while (l>77)
   { /* this fragment will not fit on a single line */
   if (pad)
     {
-    pdkim_strcat(str, " ");
+    str = string_catn(str, size, ptr, US" ", 1);
     *col += 1;
     pad = NULL; /* only want this once */
     l--;
@@ -1344,9 +1142,9 @@ while (l>77)
 
   if (intro)
     {
-    size_t sl = strlen(intro);
+    size_t sl = Ustrlen(intro);
 
-    pdkim_strncat(str, intro, sl);
+    str = string_catn(str, size, ptr, intro, sl);
     *col += sl;
     l -= sl;
     intro = NULL; /* only want this once */
@@ -1354,39 +1152,37 @@ while (l>77)
 
   if (payload)
     {
-    size_t sl = strlen(payload);
+    size_t sl = Ustrlen(payload);
     size_t chomp = *col+sl < 77 ? sl : 78-*col;
 
-    pdkim_strncat(str, payload, chomp);
+    str = string_catn(str, size, ptr, payload, chomp);
     *col += chomp;
     payload += chomp;
     l -= chomp-1;
     }
 
   /* the while precondition tells us it didn't fit. */
-  pdkim_strcat(str, "\r\n\t");
-  *col = 1;
+  str = pdkim_hdr_cont(str, size, ptr, col);
   }
 
 if (*col + l > 78)
   {
-  pdkim_strcat(str, "\r\n\t");
-  *col = 1;
+  str = pdkim_hdr_cont(str, size, ptr, col);
   pad = NULL;
   }
 
 if (pad)
   {
-  pdkim_strcat(str, " ");
+  str = string_catn(str, size, ptr, US" ", 1);
   *col += 1;
   pad = NULL;
   }
 
 if (intro)
   {
-  size_t sl = strlen(intro);
+  size_t sl = Ustrlen(intro);
 
-  pdkim_strncat(str, intro, sl);
+  str = string_catn(str, size, ptr, intro, sl);
   *col += sl;
   l -= sl;
   intro = NULL;
@@ -1394,137 +1190,116 @@ if (intro)
 
 if (payload)
   {
-  size_t sl = strlen(payload);
+  size_t sl = Ustrlen(payload);
 
-  pdkim_strncat(str, payload, sl);
+  str = string_catn(str, size, ptr, payload, sl);
   *col += sl;
   }
 
-return str->str;
+return str;
 }
 
 
 /* -------------------------------------------------------------------------- */
 
-static char *
+static uschar *
 pdkim_create_header(pdkim_signature *sig, BOOL final)
 {
-char *rc = NULL;
-char *base64_bh = NULL;
-char *base64_b  = NULL;
+uschar * base64_bh;
+uschar * base64_b;
 int col = 0;
-pdkim_str *hdr;
-pdkim_str *canon_all;
-
-if (!(hdr = pdkim_strnew("DKIM-Signature: v="PDKIM_SIGNATURE_VERSION)))
-  return NULL;
+uschar * hdr;       int hdr_size = 0, hdr_len = 0;
+uschar * canon_all; int can_size = 0, can_len = 0;
 
-if (!(canon_all = pdkim_strnew(pdkim_canons[sig->canon_headers])))
-  goto BAIL;
-
-if (!(base64_bh = pdkim_encode_base64(&sig->bodyhash)))
-  goto BAIL;
+canon_all = string_cat (NULL, &can_size, &can_len,
+		      pdkim_canons[sig->canon_headers]);
+canon_all = string_catn(canon_all, &can_size, &can_len, US"/", 1);
+canon_all = string_cat (canon_all, &can_size, &can_len,
+		      pdkim_canons[sig->canon_body]);
+canon_all[can_len] = '\0';
 
-col = strlen(hdr->str);
+hdr = string_cat(NULL, &hdr_size, &hdr_len,
+		      US"DKIM-Signature: v="PDKIM_SIGNATURE_VERSION);
+col = hdr_len;
 
 /* Required and static bits */
-if (  pdkim_headcat(&col, hdr, ";", "a=", pdkim_algos[sig->algo])
-   && pdkim_headcat(&col, hdr, ";", "q=", pdkim_querymethods[sig->querymethod])
-   && pdkim_strcat(canon_all, "/")
-   && pdkim_strcat(canon_all, pdkim_canons[sig->canon_body])
-   && pdkim_headcat(&col, hdr, ";", "c=", canon_all->str)
-   && pdkim_headcat(&col, hdr, ";", "d=", sig->domain)
-   && pdkim_headcat(&col, hdr, ";", "s=", sig->selector)
-   )
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"a=",
+		    pdkim_algos[sig->algo]);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"q=",
+		    pdkim_querymethods[sig->querymethod]);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"c=",
+		    canon_all);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"d=",
+		    sig->domain);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"s=",
+		    sig->selector);
+
+/* list of header names can be split between items. */
   {
-  /* list of header names can be split between items. */
-    {
-    char *n = CS string_copy(sig->headernames);
-    char *f = n;
-    char *i = "h=";
-    char *s = ";";
+  uschar * n = string_copy(sig->headernames);
+  uschar * i = US"h=";
+  uschar * s = US";";
 
-    if (!n) goto BAIL;
-    while (*n)
-      {
-      char *c = strchr(n, ':');
+  while (*n)
+    {
+    uschar * c = Ustrchr(n, ':');
 
-      if (c) *c ='\0';
+    if (c) *c ='\0';
 
-      if (!i)
-	if (!pdkim_headcat(&col, hdr, NULL, NULL, ":"))
-	  goto BAIL;
+    if (!i)
+      hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, NULL, NULL, US":");
 
-      if (!pdkim_headcat(&col, hdr, s, i, n))
-	goto BAIL;
+    hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, s, i, n);
 
-      if (!c)
-        break;
+    if (!c)
+      break;
 
-      n = c+1;
-      s = NULL;
-      i = NULL;
-      }
+    n = c+1;
+    s = NULL;
+    i = NULL;
     }
+  }
 
-  if(!pdkim_headcat(&col, hdr, ";", "bh=", base64_bh))
-    goto BAIL;
-
-  /* Optional bits */
-  if (sig->identity)
-    if(!pdkim_headcat(&col, hdr, ";", "i=", sig->identity))
-      goto BAIL;
+base64_bh = pdkim_encode_base64(&sig->bodyhash);
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"bh=", base64_bh);
 
-  if (sig->created > 0)
-    {
-    char minibuf[20];
+/* Optional bits */
+if (sig->identity)
+  hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"i=", sig->identity);
 
-    snprintf(minibuf, 20, "%lu", sig->created);
-    if(!pdkim_headcat(&col, hdr, ";", "t=", minibuf))
-      goto BAIL;
-    }
-
-  if (sig->expires > 0)
-    {
-    char minibuf[20];
+if (sig->created > 0)
+  {
+  uschar minibuf[20];
 
-    snprintf(minibuf, 20, "%lu", sig->expires);
-    if(!pdkim_headcat(&col, hdr, ";", "x=", minibuf))
-      goto BAIL;
-    }
+  snprintf(CS minibuf, sizeof(minibuf), "%lu", sig->created);
+  hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"t=", minibuf);
+}
 
-  if (sig->bodylength >= 0)
-    {
-    char minibuf[20];
+if (sig->expires > 0)
+  {
+  uschar minibuf[20];
 
-    snprintf(minibuf, 20, "%lu", sig->bodylength);
-    if(!pdkim_headcat(&col, hdr, ";", "l=", minibuf))
-      goto BAIL;
-    }
+  snprintf(CS minibuf, sizeof(minibuf), "%lu", sig->expires);
+  hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"x=", minibuf);
+  }
 
-  /* Preliminary or final version? */
-  if (final)
-    {
-    if (!(base64_b = pdkim_encode_base64(&sig->sigdata)))
-      goto BAIL;
-    if (!pdkim_headcat(&col, hdr, ";", "b=", base64_b))
-      goto BAIL;
-    }
-  else 
-    if(!pdkim_headcat(&col, hdr, ";", "b=", ""))
-      goto BAIL;
+if (sig->bodylength >= 0)
+  {
+  uschar minibuf[20];
 
-  /* add trailing semicolon: I'm not sure if this is actually needed */
-  if (!pdkim_headcat(&col, hdr, NULL, ";", ""))
-    goto BAIL;
+  snprintf(CS minibuf, sizeof(minibuf), "%lu", sig->bodylength);
+  hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"l=", minibuf);
   }
 
-rc = strdup(hdr->str);
+/* Preliminary or final version? */
+base64_b = final ? pdkim_encode_base64(&sig->sigdata) : US"";
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, US";", US"b=", base64_b);
 
-BAIL:
-pdkim_strfree(hdr);
-if (canon_all) pdkim_strfree(canon_all);
-return rc;
+/* add trailing semicolon: I'm not sure if this is actually needed */
+hdr = pdkim_headcat(&col, hdr, &hdr_size, &hdr_len, NULL, US";", US"");
+
+hdr[hdr_len] = '\0';
+return hdr;
 }
 
 
@@ -1534,12 +1309,11 @@ DLLEXPORT int
 pdkim_feed_finish(pdkim_ctx *ctx, pdkim_signature **return_signatures)
 {
 pdkim_signature *sig = ctx->sig;
-pdkim_str *headernames = NULL;             /* Collected signed header names */
 
 /* Check if we must still flush a (partial) header. If that is the
    case, the message has no body, and we must compute a body hash
    out of '<CR><LF>' */
-if (ctx->cur_header && ctx->cur_header->len)
+if (ctx->cur_header && ctx->cur_header_len)
   {
   int rc = pdkim_header_complete(ctx);
   if (rc != PDKIM_OK) return rc;
@@ -1550,20 +1324,13 @@ else
       "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
 
 /* Build (and/or evaluate) body hash */
-if (pdkim_finish_bodyhash(ctx) != PDKIM_OK)
-  return PDKIM_ERR_OOM;
-
-/* SIGNING -------------------------------------------------------------- */
-if (ctx->mode == PDKIM_MODE_SIGN)
-  if (!(headernames = pdkim_strnew(NULL)))
-    return PDKIM_ERR_OOM;
-/* ---------------------------------------------------------------------- */
+pdkim_finish_bodyhash(ctx);
 
 while (sig)
   {
   BOOL is_sha1 = sig->algo == PDKIM_ALGO_RSA_SHA1;
   hctx hhash_ctx;
-  char * sig_hdr;
+  uschar * sig_hdr = US"";
   blob hhash;
   blob hdata;
   int hdata_alloc = 0;
@@ -1571,7 +1338,7 @@ while (sig)
   hdata.data = NULL;
   hdata.len = 0;
 
-  exim_sha_init(&hhash_ctx, is_sha1);
+  exim_sha_init(&hhash_ctx, is_sha1 ? HASH_SHA1 : HASH_SHA256);
 
   DEBUG(D_acl) debug_printf(
       "PDKIM >> Hashed header data, canonicalized, in sequence >>>>>>>>>>>>>>\n");
@@ -1582,48 +1349,54 @@ while (sig)
      Then append to that list any remaining header names for which there was no
      header to sign. */
 
-  if (ctx->mode == PDKIM_MODE_SIGN)
+  if (ctx->flags & PDKIM_MODE_SIGN)
     {
+    uschar * headernames = NULL;	/* Collected signed header names */
+    int hs = 0, hl = 0;
     pdkim_stringlist *p;
     const uschar * l;
     uschar * s;
     int sep = 0;
 
     for (p = sig->headers; p; p = p->next)
-      {
-      uschar * rh;
-      /* Collect header names (Note: colon presence is guaranteed here) */
-      uschar * q = Ustrchr(p->value, ':');
+      if (header_name_match(p->value, sig->sign_headers) == PDKIM_OK)
+	{
+	uschar * rh;
+	/* Collect header names (Note: colon presence is guaranteed here) */
+	uschar * q = Ustrchr(p->value, ':');
 
-      if (!(pdkim_strncat(headernames, p->value,
-			(q - US p->value) + (p->next ? 1 : 0))))
-	return PDKIM_ERR_OOM;
+	headernames = string_catn(headernames, &hs, &hl,
+			p->value, (q - US p->value) + (p->next ? 1 : 0));
 
-      rh = sig->canon_headers == PDKIM_CANON_RELAXED
-	? US pdkim_relax_header(p->value, 1) /* cook header for relaxed canon */
-	: string_copy(p->value);             /* just copy it for simple canon */
-      if (!rh)
-	return PDKIM_ERR_OOM;
+	rh = sig->canon_headers == PDKIM_CANON_RELAXED
+	  ? pdkim_relax_header(p->value, 1) /* cook header for relaxed canon */
+	  : string_copy(CUS p->value);      /* just copy it for simple canon */
 
-      /* Feed header to the hash algorithm */
-      exim_sha_update(&hhash_ctx, rh, strlen(rh));
+	/* Feed header to the hash algorithm */
+	exim_sha_update(&hhash_ctx, CUS rh, Ustrlen(rh));
 
-      /* Remember headers block for signing (when the library cannot do incremental)  */
-      (void) exim_rsa_data_append(&hdata, &hdata_alloc, rh);
+	/* Remember headers block for signing (when the library cannot do incremental)  */
+	(void) exim_rsa_data_append(&hdata, &hdata_alloc, rh);
 
-      DEBUG(D_acl) pdkim_quoteprint(rh, Ustrlen(rh));
-      }
+	DEBUG(D_acl) pdkim_quoteprint(rh, Ustrlen(rh));
+	}
 
-    l = US sig->sign_headers;
+    l = sig->sign_headers;
     while((s = string_nextinlist(&l, &sep, NULL, 0)))
       if (*s != '_')
-	{
-	if (headernames->len > 0)
-	  if (!(pdkim_strncat(headernames, ":", 1)))
-	    return PDKIM_ERR_OOM;
-	if (!(pdkim_strncat(headernames, CS s, Ustrlen(s))))
-	  return PDKIM_ERR_OOM;
+	{			/*SSS string_append_listele() */
+	if (hl > 0 && headernames[hl-1] != ':')
+	  headernames = string_catn(headernames, &hs, &hl, US":", 1);
+
+	headernames = string_cat(headernames, &hs, &hl, s);
 	}
+    headernames[hl] = '\0';
+
+    /* Copy headernames to signature struct */
+    sig->headernames = headernames;
+
+    /* Create signature header with b= omitted */
+    sig_hdr = pdkim_create_header(sig, FALSE);
     }
 
   /* VERIFICATION ----------------------------------------------------------- */
@@ -1631,91 +1404,69 @@ while (sig)
      add the headers to the hash in that order. */
   else
     {
-    uschar * b = string_copy(sig->headernames);
-    uschar * p = b;
+    uschar * p = sig->headernames;
     uschar * q;
     pdkim_stringlist * hdrs;
 
-    if (!b) return PDKIM_ERR_OOM;
-
-    /* clear tags */
-    for (hdrs = ctx->headers; hdrs; hdrs = hdrs->next)
-      hdrs->tag = 0;
-
-    while(1)
+    if (p)
       {
-      if ((q = Ustrchr(p, ':')))
-	*q = '\0';
-
+      /* clear tags */
       for (hdrs = ctx->headers; hdrs; hdrs = hdrs->next)
-	if (  hdrs->tag == 0
-	   && strncasecmp(hdrs->value, CS p, Ustrlen(p)) == 0
-	   && (hdrs->value)[Ustrlen(p)] == ':'
-	   )
-	  {
-	  uschar * rh = sig->canon_headers == PDKIM_CANON_RELAXED
-	    ? US pdkim_relax_header(hdrs->value, 1) /* cook header for relaxed canon */
-	    : string_copy(hdrs->value);             /* just copy it for simple canon */
-	  if (!rh)
-	    return PDKIM_ERR_OOM;
-
-	  /* Feed header to the hash algorithm */
-	  exim_sha_update(&hhash_ctx, rh, strlen(rh));
-
-	  DEBUG(D_acl) pdkim_quoteprint(rh, Ustrlen(rh));
-	  hdrs->tag = 1;
-	  break;
-	  }
+	hdrs->tag = 0;
 
-      if (!q) break;
-      p = q+1;
+      p = string_copy(p);
+      while(1)
+	{
+	if ((q = Ustrchr(p, ':')))
+	  *q = '\0';
+
+  /*XXX walk the list of headers in same order as received. */
+	for (hdrs = ctx->headers; hdrs; hdrs = hdrs->next)
+	  if (  hdrs->tag == 0
+	     && strncasecmp(CCS hdrs->value, CCS p, Ustrlen(p)) == 0
+	     && (hdrs->value)[Ustrlen(p)] == ':'
+	     )
+	    {
+	    /* cook header for relaxed canon, or just copy it for simple  */
+
+	    uschar * rh = sig->canon_headers == PDKIM_CANON_RELAXED
+	      ? pdkim_relax_header(hdrs->value, 1)
+	      : string_copy(CUS hdrs->value);
+
+	    /* Feed header to the hash algorithm */
+	    exim_sha_update(&hhash_ctx, CUS rh, Ustrlen(rh));
+
+	    DEBUG(D_acl) pdkim_quoteprint(rh, Ustrlen(rh));
+	    hdrs->tag = 1;
+	    break;
+	    }
+
+	if (!q) break;
+	p = q+1;
+	}
+
+      sig_hdr = string_copy(sig->rawsig_no_b_val);
       }
     }
 
   DEBUG(D_acl) debug_printf(
 	    "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
 
-  /* SIGNING ---------------------------------------------------------------- */
-  if (ctx->mode == PDKIM_MODE_SIGN)
-    {
-    /* Copy headernames to signature struct */
-    sig->headernames = string_copy(US headernames->str);
-    pdkim_strfree(headernames);
-
-    /* Create signature header with b= omitted */
-    sig_hdr = pdkim_create_header(sig, FALSE);
-    }
-
-  /* VERIFICATION ----------------------------------------------------------- */
-  else
-    sig_hdr = strdup(sig->rawsig_no_b_val);
-  /* ------------------------------------------------------------------------ */
-
-  if (!sig_hdr)
-    return PDKIM_ERR_OOM;
-
   /* Relax header if necessary */
   if (sig->canon_headers == PDKIM_CANON_RELAXED)
-    {
-    char *relaxed_hdr = pdkim_relax_header(sig_hdr, 0);
-
-    free(sig_hdr);
-    if (!relaxed_hdr)
-      return PDKIM_ERR_OOM;
-    sig_hdr = relaxed_hdr;
-    }
+    sig_hdr = pdkim_relax_header(sig_hdr, 0);
 
   DEBUG(D_acl)
     {
     debug_printf(
 	    "PDKIM >> Signed DKIM-Signature header, canonicalized >>>>>>>>>>>>>>>>>\n");
-    pdkim_quoteprint(sig_hdr, strlen(sig_hdr));
+    pdkim_quoteprint(CUS sig_hdr, Ustrlen(sig_hdr));
     debug_printf(
 	    "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
     }
 
   /* Finalize header hash */
-  exim_sha_update(&hhash_ctx, sig_hdr, strlen(sig_hdr));
+  exim_sha_update(&hhash_ctx, CUS sig_hdr, Ustrlen(sig_hdr));
   exim_sha_finish(&hhash_ctx, &hhash);
 
   DEBUG(D_acl)
@@ -1725,19 +1476,17 @@ while (sig)
     }
 
   /* Remember headers block for signing (when the library cannot do incremental)  */
-  if (ctx->mode == PDKIM_MODE_SIGN)
-    (void) exim_rsa_data_append(&hdata, &hdata_alloc, sig_hdr);
-
-  free(sig_hdr);
+  if (ctx->flags & PDKIM_MODE_SIGN)
+    (void) exim_rsa_data_append(&hdata, &hdata_alloc, US sig_hdr);
 
   /* SIGNING ---------------------------------------------------------------- */
-  if (ctx->mode == PDKIM_MODE_SIGN)
+  if (ctx->flags & PDKIM_MODE_SIGN)
     {
     es_ctx sctx;
     const uschar * errstr;
 
     /* Import private key */
-    if ((errstr = exim_rsa_signing_init(sig->rsa_privkey, &sctx)))
+    if ((errstr = exim_rsa_signing_init(US sig->rsa_privkey, &sctx)))
       {
       DEBUG(D_acl) debug_printf("signing_init: %s\n", errstr);
       return PDKIM_ERR_RSA_PRIVKEY;
@@ -1763,8 +1512,7 @@ while (sig)
       pdkim_hexprint(sig->sigdata.data, sig->sigdata.len);
       }
 
-    if (!(sig->signature_header = pdkim_create_header(sig, TRUE)))
-      return PDKIM_ERR_OOM;
+    sig->signature_header = pdkim_create_header(sig, TRUE);
     }
 
   /* VERIFICATION ----------------------------------------------------------- */
@@ -1773,32 +1521,48 @@ while (sig)
     ev_ctx vctx;
     const uschar * errstr;
 
-    char *dns_txt_name, *dns_txt_reply;
-
-    /* Fetch public key for signing domain, from DNS */
-
-    if (!(dns_txt_name  = malloc(PDKIM_DNS_TXT_MAX_NAMELEN)))
-      return PDKIM_ERR_OOM;
-
-    if (!(dns_txt_reply = malloc(PDKIM_DNS_TXT_MAX_RECLEN)))
+    uschar *dns_txt_name, *dns_txt_reply;
+
+    /* Make sure we have all required signature tags */
+    if (!(  sig->domain        && *sig->domain
+	 && sig->selector      && *sig->selector
+	 && sig->headernames   && *sig->headernames
+	 && sig->bodyhash.data
+	 && sig->sigdata.data
+	 && sig->algo > -1
+	 && sig->version
+       ) )
       {
-      free(dns_txt_name);
-      return PDKIM_ERR_OOM;
-      }
+      sig->verify_status     = PDKIM_VERIFY_INVALID;
+      sig->verify_ext_status = PDKIM_VERIFY_INVALID_SIGNATURE_ERROR;
 
-    memset(dns_txt_reply, 0, PDKIM_DNS_TXT_MAX_RECLEN);
-    memset(dns_txt_name , 0, PDKIM_DNS_TXT_MAX_NAMELEN);
+      DEBUG(D_acl) debug_printf(
+	  " Error in DKIM-Signature header: tags missing or invalid\n"
+	  "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
+      goto NEXT_VERIFY;
+      }
 
-    if (snprintf(dns_txt_name, PDKIM_DNS_TXT_MAX_NAMELEN,
-		 "%s._domainkey.%s.",
-		 sig->selector, sig->domain) >= PDKIM_DNS_TXT_MAX_NAMELEN)
+    /* Make sure sig uses supported DKIM version (only v1) */
+    if (sig->version != 1)
       {
-      sig->verify_status =      PDKIM_VERIFY_INVALID;
-      sig->verify_ext_status =  PDKIM_VERIFY_INVALID_BUFFER_SIZE;
+      sig->verify_status     = PDKIM_VERIFY_INVALID;
+      sig->verify_ext_status = PDKIM_VERIFY_INVALID_DKIM_VERSION;
+
+      DEBUG(D_acl) debug_printf(
+          " Error in DKIM-Signature header: unsupported DKIM version\n"
+          "PDKIM <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
       goto NEXT_VERIFY;
       }
 
-    if (  ctx->dns_txt_callback(dns_txt_name, dns_txt_reply) != PDKIM_OK 
+    /* Fetch public key for signing domain, from DNS */
+
+    dns_txt_name = string_sprintf("%s._domainkey.%s.",
+				 sig->selector, sig->domain);
+
+    dns_txt_reply = store_get(PDKIM_DNS_TXT_MAX_RECLEN);
+    memset(dns_txt_reply, 0, PDKIM_DNS_TXT_MAX_RECLEN);
+
+    if (  ctx->dns_txt_callback(CS dns_txt_name, CS dns_txt_reply) != PDKIM_OK 
        || dns_txt_reply[0] == '\0')
       {
       sig->verify_status =      PDKIM_VERIFY_INVALID;
@@ -1811,10 +1575,10 @@ while (sig)
       debug_printf(
           "PDKIM >> Parsing public key record >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"
           " Raw record: ");
-      pdkim_quoteprint(dns_txt_reply, strlen(dns_txt_reply));
+      pdkim_quoteprint(CUS dns_txt_reply, Ustrlen(dns_txt_reply));
       }
 
-    if (!(sig->pubkey = pdkim_parse_pubkey_record(ctx, dns_txt_reply)))
+    if (!(sig->pubkey = pdkim_parse_pubkey_record(ctx, CUS dns_txt_reply)))
       {
       sig->verify_status =      PDKIM_VERIFY_INVALID;
       sig->verify_ext_status =  PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD;
@@ -1863,9 +1627,6 @@ NEXT_VERIFY:
       else
 	debug_printf("\n");
       }
-
-    free(dns_txt_name);
-    free(dns_txt_reply);
     }
 
   sig = sig->next;
@@ -1882,21 +1643,15 @@ return PDKIM_OK;
 /* -------------------------------------------------------------------------- */
 
 DLLEXPORT pdkim_ctx *
-pdkim_init_verify(int(*dns_txt_callback)(char *, char *))
+pdkim_init_verify(int(*dns_txt_callback)(char *, char *), BOOL dot_stuffing)
 {
-pdkim_ctx *ctx = malloc(sizeof(pdkim_ctx));
+pdkim_ctx * ctx;
 
-if (!ctx)
-  return NULL;
+ctx = store_get(sizeof(pdkim_ctx));
 memset(ctx, 0, sizeof(pdkim_ctx));
 
-if (!(ctx->linebuf = malloc(PDKIM_MAX_BODY_LINE_LEN)))
-  {
-  free(ctx);
-  return NULL;
-  }
-
-ctx->mode = PDKIM_MODE_VERIFY;
+if (dot_stuffing) ctx->flags = PDKIM_DOT_TERM;
+ctx->linebuf = store_get(PDKIM_MAX_BODY_LINE_LEN);
 ctx->dns_txt_callback = dns_txt_callback;
 
 return ctx;
@@ -1906,7 +1661,8 @@ return ctx;
 /* -------------------------------------------------------------------------- */
 
 DLLEXPORT pdkim_ctx *
-pdkim_init_sign(char *domain, char *selector, char *rsa_privkey, int algo)
+pdkim_init_sign(char *domain, char *selector, char *rsa_privkey, int algo,
+  BOOL dot_stuffed)
 {
 pdkim_ctx *ctx;
 pdkim_signature *sig;
@@ -1914,43 +1670,25 @@ pdkim_signature *sig;
 if (!domain || !selector || !rsa_privkey)
   return NULL;
 
-if (!(ctx = malloc(sizeof(pdkim_ctx))))
-  return NULL;
+ctx = store_get(sizeof(pdkim_ctx));
 memset(ctx, 0, sizeof(pdkim_ctx));
 
-if (!(ctx->linebuf = malloc(PDKIM_MAX_BODY_LINE_LEN)))
-  {
-  free(ctx);
-  return NULL;
-  }
+ctx->flags = dot_stuffed ? PDKIM_MODE_SIGN | PDKIM_DOT_TERM : PDKIM_MODE_SIGN;
+ctx->linebuf = store_get(PDKIM_MAX_BODY_LINE_LEN);
 
-if (!(sig = malloc(sizeof(pdkim_signature))))
-  {
-  free(ctx->linebuf);
-  free(ctx);
-  return NULL;
-  }
+sig = store_get(sizeof(pdkim_signature));
 memset(sig, 0, sizeof(pdkim_signature));
 
 sig->bodylength = -1;
-
-ctx->mode = PDKIM_MODE_SIGN;
 ctx->sig = sig;
 
-sig->domain = strdup(domain);
-sig->selector = strdup(selector);
-sig->rsa_privkey = strdup(rsa_privkey);
+sig->domain = string_copy(US domain);
+sig->selector = string_copy(US selector);
+sig->rsa_privkey = string_copy(US rsa_privkey);
 sig->algo = algo;
 
-if (!sig->domain || !sig->selector || !sig->rsa_privkey)
-  goto BAIL;
-
-exim_sha_init(&sig->body_hash, algo == PDKIM_ALGO_RSA_SHA1);
+exim_sha_init(&sig->body_hash, algo == PDKIM_ALGO_RSA_SHA1 ? HASH_SHA1 : HASH_SHA256);
 return ctx;
-
-BAIL:
-  pdkim_free_ctx(ctx);
-  return NULL;
 }
 
 
@@ -1969,12 +1707,10 @@ pdkim_set_optional(pdkim_ctx *ctx,
 pdkim_signature * sig = ctx->sig;
 
 if (identity)
-  if (!(sig->identity = strdup(identity)))
-    return PDKIM_ERR_OOM;
+  sig->identity = string_copy(US identity);
 
-if (!(sig->sign_headers = strdup(sign_headers
-	? sign_headers : PDKIM_DEFAULT_SIGN_HEADERS)))
-  return PDKIM_ERR_OOM;
+sig->sign_headers = string_copy(sign_headers
+	? US sign_headers : US PDKIM_DEFAULT_SIGN_HEADERS);
 
 sig->canon_headers = canon_headers;
 sig->canon_body = canon_body;
diff --git a/src/src/pdkim/pdkim.h b/src/src/pdkim/pdkim.h
index 4de0a7ad6..536e5af69 100644
--- a/src/src/pdkim/pdkim.h
+++ b/src/src/pdkim/pdkim.h
@@ -2,6 +2,7 @@
  *  PDKIM - a RFC4871 (DKIM) implementation
  *
  *  Copyright (C) 2009 - 2012  Tom Kistner <tom@duncanthrax.net>
+ *  Copyright (c) Jeremy Harris 2016
  *
  *  http://duncanthrax.net/pdkim/
  *
@@ -22,8 +23,8 @@
 #ifndef PDKIM_H
 #define PDKIM_H
 
-#include "blob.h"
-#include "hash.h"
+#include "../blob.h"
+#include "../hash.h"
 
 /* -------------------------------------------------------------------------- */
 /* Length of the preallocated buffer for the "answer" from the dns/txt
@@ -34,7 +35,6 @@
 /* Function success / error codes */
 #define PDKIM_OK                      0
 #define PDKIM_FAIL                   -1
-#define PDKIM_ERR_OOM              -100
 #define PDKIM_ERR_RSA_PRIVKEY      -101
 #define PDKIM_ERR_RSA_SIGNING      -102
 #define PDKIM_ERR_LONG_LINE        -103
@@ -49,12 +49,14 @@
 #define PDKIM_VERIFY_FAIL      2
 #define PDKIM_VERIFY_PASS      3
 
-#define PDKIM_VERIFY_FAIL_BODY                  1
-#define PDKIM_VERIFY_FAIL_MESSAGE               2
-#define PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE 3
-#define PDKIM_VERIFY_INVALID_BUFFER_SIZE        4
-#define PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD   5
-#define PDKIM_VERIFY_INVALID_PUBKEY_IMPORT      6
+#define PDKIM_VERIFY_FAIL_BODY                    1
+#define PDKIM_VERIFY_FAIL_MESSAGE                 2
+#define PDKIM_VERIFY_INVALID_PUBKEY_UNAVAILABLE   3
+#define PDKIM_VERIFY_INVALID_BUFFER_SIZE          4
+#define PDKIM_VERIFY_INVALID_PUBKEY_DNSRECORD     5
+#define PDKIM_VERIFY_INVALID_PUBKEY_IMPORT        6
+#define PDKIM_VERIFY_INVALID_SIGNATURE_ERROR      7
+#define PDKIM_VERIFY_INVALID_DKIM_VERSION         8
 
 /* -------------------------------------------------------------------------- */
 /* Some parameter values */
@@ -95,13 +97,13 @@ typedef struct sha2_context sha2_context;
 /* -------------------------------------------------------------------------- */
 /* Public key as (usually) fetched from DNS */
 typedef struct pdkim_pubkey {
-  char *version;                  /* v=  */
-  char *granularity;              /* g=  */
+  uschar *version;                /* v=  */
+  uschar *granularity;            /* g=  */
 
-  char *hashes;                   /* h=  */
-  char *keytype;                  /* k=  */
-  char *srvtype;                  /* s=  */
-  char *notes;                    /* n=  */
+  uschar *hashes;                 /* h=  */
+  uschar *keytype;                /* k=  */
+  uschar *srvtype;                /* s=  */
+  uschar *notes;                  /* n=  */
 
   blob  key;                      /* p=  */
 
@@ -135,13 +137,13 @@ typedef struct pdkim_signature {
   int querymethod;
 
   /* (s=) The selector string as given in the signature */
-  char *selector;
+  uschar *selector;
 
   /* (d=) The domain as given in the signature */
-  char *domain;
+  uschar *domain;
 
   /* (i=) The identity as given in the signature */
-  char *identity;
+  uschar *identity;
 
   /* (t=) Timestamp of signature creation */
   unsigned long created;
@@ -158,7 +160,7 @@ typedef struct pdkim_signature {
   uschar *headernames;
 
   /* (z=) */
-  char *copiedheaders;
+  uschar *copiedheaders;
 
   /* (b=) Raw signature data, along with its length in bytes */
   blob sigdata;
@@ -170,7 +172,7 @@ typedef struct pdkim_signature {
      Ready for insertion into the message. Note: Folded using CRLFTB,
      but final line terminator is NOT included. Note2: This buffer is
      free()d when you call pdkim_free_ctx(). */
-  char *signature_header;
+  uschar *signature_header;
 
   /* The main verification status. Verification only. One of:
 
@@ -235,20 +237,22 @@ typedef struct pdkim_signature {
   unsigned long signed_body_bytes; /* How many body bytes we hashed     */
   pdkim_stringlist *headers; /* Raw headers included in the sig         */
   /* Signing specific ------------------------------------------------- */
-  char *rsa_privkey;     /* Private RSA key                             */
-  char *sign_headers;    /* To-be-signed header names                   */
-  char *rawsig_no_b_val; /* Original signature header w/o b= tag value. */
+  uschar * rsa_privkey;     /* Private RSA key                             */
+  uschar * sign_headers;    /* To-be-signed header names                   */
+  uschar * rawsig_no_b_val; /* Original signature header w/o b= tag value. */
 } pdkim_signature;
 
 
 /* -------------------------------------------------------------------------- */
 /* Context to keep state between all operations. */
-#define PDKIM_MODE_SIGN     0
-#define PDKIM_MODE_VERIFY   1
 typedef struct pdkim_ctx {
 
-  /* PDKIM_MODE_VERIFY or PDKIM_MODE_SIGN */
-  int mode;
+#define PDKIM_MODE_SIGN   BIT(0)	/* if unset, mode==verify */
+#define PDKIM_DOT_TERM	  BIT(1)	/* dot termination and unstuffing */
+#define PDKIM_SEEN_LF	  BIT(2)
+#define PDKIM_SEEN_EOD	  BIT(3)
+#define PDKIM_PAST_HDRS	  BIT(4)
+  unsigned   flags;
 
   /* One (signing) or several chained (verification) signatures */
   pdkim_signature *sig;
@@ -257,12 +261,11 @@ typedef struct pdkim_ctx {
   int(*dns_txt_callback)(char *, char *);
 
   /* Coder's little helpers */
-  pdkim_str *cur_header;
+  uschar    *cur_header;
+  int        cur_header_size;
+  int        cur_header_len;
   char      *linebuf;
   int        linebuf_offset;
-  BOOL       seen_lf;
-  BOOL       seen_eod;
-  BOOL       past_headers;
   int        num_buffered_crlf;
   int        num_headers;
   pdkim_stringlist *headers; /* Raw headers for verification         */
@@ -281,10 +284,10 @@ extern "C" {
 void	   pdkim_init         (void);
 
 DLLEXPORT
-pdkim_ctx *pdkim_init_sign    (char *, char *, char *, int);
+pdkim_ctx *pdkim_init_sign    (char *, char *, char *, int, BOOL);
 
 DLLEXPORT
-pdkim_ctx *pdkim_init_verify  (int(*)(char *, char *));
+pdkim_ctx *pdkim_init_verify  (int(*)(char *, char *), BOOL);
 
 DLLEXPORT
 int        pdkim_set_optional (pdkim_ctx *, char *, char *,int, int,
@@ -300,6 +303,9 @@ int        pdkim_feed_finish  (pdkim_ctx *, pdkim_signature **);
 DLLEXPORT
 void       pdkim_free_ctx     (pdkim_ctx *);
 
+
+const char *	pdkim_errstr(int);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/src/pdkim/pdkim_hash.h b/src/src/pdkim/pdkim_hash.h
new file mode 100644
index 000000000..143cd19df
--- /dev/null
+++ b/src/src/pdkim/pdkim_hash.h
@@ -0,0 +1,38 @@
+/*
+ *  PDKIM - a RFC4871 (DKIM) implementation
+ *
+ *  Copyright (C) 2016  Exim maintainers
+ *
+ *  Hash interface functions
+ */
+
+#include "../exim.h"
+
+#if !defined(HASH_H)	/* entire file */
+#define HASH_H
+
+#ifndef SUPPORT_TLS
+# error Need SUPPORT_TLS for DKIM
+#endif
+
+#include "crypt_ver.h"
+#include "../blob.h"
+#include "../hash.h"
+
+#ifdef RSA_OPENSSL
+# include <openssl/rsa.h>
+# include <openssl/ssl.h>
+# include <openssl/err.h>
+#elif defined(RSA_GNUTLS)
+# include <gnutls/gnutls.h>
+# include <gnutls/x509.h>
+#endif
+
+#if defined(SHA_OPENSSL)
+# include "pdkim.h"
+#elif defined(SHA_GCRYPT)
+# include "pdkim.h"
+#endif
+
+#endif
+/* End of File */
diff --git a/src/src/pdkim/rsa.c b/src/src/pdkim/rsa.c
index c5d4c2efa..aeb016ce5 100644
--- a/src/src/pdkim/rsa.c
+++ b/src/src/pdkim/rsa.c
@@ -586,7 +586,7 @@ if (!(sign_ctx->rsa = d2i_RSAPrivateKey(NULL, CUSS &p, len)))
   char ssl_errstring[256];
   ERR_load_crypto_strings();	/*XXX move to a startup routine */
   ERR_error_string(ERR_get_error(), ssl_errstring);
-  return string_copy(ssl_errstring);
+  return string_copy(US ssl_errstring);
   }
 
 return NULL;
@@ -620,7 +620,7 @@ if (RSA_sign(is_sha1 ? NID_sha1 : NID_sha256,
   char ssl_errstring[256];
   ERR_load_crypto_strings();	/*XXX move to a startup routine */
   ERR_error_string(ERR_get_error(), ssl_errstring);
-  ret = string_copy(ssl_errstring);
+  ret = string_copy(US ssl_errstring);
   }
 
 RSA_free(sign_ctx->rsa);
@@ -643,7 +643,7 @@ if (!(verify_ctx->rsa = d2i_RSA_PUBKEY(NULL, &p, (long) pubkey_der->len)))
   char ssl_errstring[256];
   ERR_load_crypto_strings();	/*XXX move to a startup routine */
   ERR_error_string(ERR_get_error(), ssl_errstring);
-  ret = string_copy(ssl_errstring);
+  ret = string_copy(CUS ssl_errstring);
   }
 return ret;
 }
@@ -666,7 +666,7 @@ if (RSA_verify(is_sha1 ? NID_sha1 : NID_sha256,
   char ssl_errstring[256];
   ERR_load_crypto_strings();	/*XXX move to a startup routine */
   ERR_error_string(ERR_get_error(), ssl_errstring);
-  ret = string_copy(ssl_errstring);
+  ret = string_copy(US ssl_errstring);
   }
 return ret;
 }
diff --git a/src/src/pdkim/rsa.h b/src/src/pdkim/rsa.h
index 32631fdac..6018eba64 100644
--- a/src/src/pdkim/rsa.h
+++ b/src/src/pdkim/rsa.h
@@ -25,7 +25,7 @@
 #  include <libtasn1.h>
 #endif
 
-#include "blob.h"
+#include "../blob.h"
 
 
 #ifdef RSA_OPENSSL
diff --git a/src/src/perl.c b/src/src/perl.c
index fbe9ee842..92218a6ef 100644
--- a/src/src/perl.c
+++ b/src/src/perl.c
@@ -186,7 +186,7 @@ call_perl_cat(uschar *yield, int *sizep, int *ptrp, uschar **errstrp,
     return NULL;
     }
   str = US SvPV(sv, len);
-  yield = string_cat(yield, sizep, ptrp, str, (int)len);
+  yield = string_catn(yield, sizep, ptrp, str, (int)len);
   FREETMPS;
   LEAVE;
 
diff --git a/src/src/queue.c b/src/src/queue.c
index bf62aea88..e7ae019d2 100644
--- a/src/src/queue.c
+++ b/src/src/queue.c
@@ -12,6 +12,45 @@
 
 
 
+/* Routines with knowlege of spool layout */
+
+#ifndef COMPILE_UTILITY
+static void
+spool_pname_buf(uschar * buf, int len)
+{
+snprintf(CS buf, len, "%s/%s/input", spool_directory, queue_name);
+}
+
+uschar *
+spool_dname(const uschar * purpose, uschar * subdir)
+{
+return string_sprintf("%s/%s/%s/%s",
+	spool_directory, queue_name, purpose, subdir);
+}
+#endif
+
+uschar *
+spool_sname(const uschar * purpose, uschar * subdir)
+{
+return string_sprintf("%s%s%s%s%s",
+		    queue_name, *queue_name ? "/" : "",
+		    purpose,
+		    *subdir ? "/" : "", subdir);
+}
+
+uschar *
+spool_fname(const uschar * purpose, const uschar * subdir, const uschar * fname,
+       	const uschar * suffix)
+{
+return string_sprintf("%s/%s/%s/%s/%s%s",
+	spool_directory, queue_name, purpose, subdir, fname, suffix);
+}
+
+
+
+
+#ifndef COMPILE_UTILITY
+
 /* The number of nodes to use for the bottom-up merge sort when a list of queue
 items is to be ordered. The code for this sort was contributed as a patch by
 Michael Haardt. */
@@ -40,8 +79,7 @@ merge_queue_lists(queue_filename *a, queue_filename *b)
 queue_filename *first = NULL;
 queue_filename **append = &first;
 
-while (a != NULL && b != NULL)
-  {
+while (a && b)
   if (Ustrcmp(a->text, b->text) < 0)
     {
     *append = a;
@@ -54,9 +92,8 @@ while (a != NULL && b != NULL)
     append= &b->next;
     b = b->next;
     }
-  }
 
-*append=((a != NULL)? a : b);
+*append = a ? a : b;
 return first;
 }
 
@@ -125,8 +162,11 @@ according to the bits of the flags variable. Get a collection of bits from the
 current time. Use the bottom 16 and just keep re-using them if necessary. When
 not randomizing, initialize the sublists for the bottom-up merge sort. */
 
-if (randomize) resetflags = time(NULL) & 0xFFFF;
-  else for (i = 0; i < LOG2_MAXNODES; i++) root[i] = NULL;
+if (randomize)
+  resetflags = time(NULL) & 0xFFFF;
+else
+   for (i = 0; i < LOG2_MAXNODES; i++)
+     root[i] = NULL;
 
 /* If processing the full queue, or just the top-level, start at the base
 directory, and initialize the first subdirectory name (as none). Otherwise,
@@ -138,11 +178,13 @@ if (subdiroffset <= 0)
   subdirs[0] = 0;
   *subcount = 0;
   }
-else i = subdiroffset;
+else
+  i = subdiroffset;
 
 /* Set up prototype for the directory name. */
 
-sprintf(CS buffer, "%s/input", spool_directory);
+spool_pname_buf(buffer, sizeof(buffer));
+buffer[sizeof(buffer) - 3] = 0;
 subptr = Ustrlen(buffer);
 buffer[subptr+2] = 0;               /* terminator for lengthened name */
 
@@ -161,12 +203,13 @@ for (; i <= *subcount; i++)
     buffer[subptr+1] = subdirchar;
     }
 
-  dd = opendir(CS buffer);
-  if (dd == NULL) continue;
+  DEBUG(D_queue_run) debug_printf("looking in %s\n", buffer);
+  if (!(dd = opendir(CS buffer)))
+    continue;
 
   /* Now scan the directory. */
 
-  while ((ent = readdir(dd)) != NULL)
+  while ((ent = readdir(dd)))
     {
     uschar *name = US ent->d_name;
     int len = Ustrlen(name);
@@ -202,15 +245,15 @@ for (; i <= *subcount; i++)
       to store the number with each item. */
 
       if (randomize)
-        {
-        if (yield == NULL)
+        if (!yield)
           {
           next->next = NULL;
           yield = last = next;
           }
         else
           {
-          if (flags == 0) flags = resetflags;
+          if (flags == 0)
+	    flags = resetflags;
           if ((flags & 1) == 0)
             {
             next->next = yield;
@@ -224,7 +267,6 @@ for (; i <= *subcount; i++)
             }
           flags = flags >> 1;
           }
-        }
 
       /* Otherwise do a bottom-up merge sort based on the name. */
 
@@ -233,8 +275,7 @@ for (; i <= *subcount; i++)
         int j;
         next->next = NULL;
         for (j = 0; j < LOG2_MAXNODES; j++)
-          {
-          if (root[j] != NULL)
+          if (root[j])
             {
             next = merge_queue_lists(next, root[j]);
             root[j] = (j == LOG2_MAXNODES - 1)? next : NULL;
@@ -244,7 +285,6 @@ for (; i <= *subcount; i++)
             root[j] = next;
             break;
             }
-          }
         }
       }
     }
@@ -264,9 +304,11 @@ for (; i <= *subcount; i++)
     {
     if (!split_spool_directory && count <= 2)
       {
+      uschar subdir[2];
+
       rmdir(CS buffer);
-      sprintf(CS big_buffer, "%s/msglog/%c", spool_directory, subdirchar);
-      rmdir(CS big_buffer);
+      subdir[0] = subdirchar; subdir[1] = 0;
+      rmdir(CS spool_dname(US"msglog", subdir));
       }
     if (subdiroffset > 0) break;    /* Single sub-directory */
     }
@@ -274,10 +316,8 @@ for (; i <= *subcount; i++)
   /* If we have just scanned the base directory, and subdiroffset is 0,
   we do not want to continue scanning the sub-directories. */
 
-  else
-    {
-    if (subdiroffset == 0) break;
-    }
+  else if (subdiroffset == 0)
+    break;
   }    /* Loop for multiple subdirectories */
 
 /* When using a bottom-up merge sort, do the final merging of the sublists.
@@ -389,7 +429,11 @@ if (!recurse)
     }
 
   log_detail = string_copy(big_buffer);
-  log_write(L_queue_run, LOG_MAIN, "Start queue run: %s", log_detail);
+  if (*queue_name)
+    log_write(L_queue_run, LOG_MAIN, "Start '%s' queue run: %s",
+      queue_name, log_detail);
+  else
+    log_write(L_queue_run, LOG_MAIN, "Start queue run: %s", log_detail);
   }
 
 /* If deliver_selectstring is a regex, compile it. */
@@ -434,7 +478,7 @@ for (i  = (queue_run_in_order? -1 : 0);
     }
 
   for (f = queue_get_spool_list(i, subdirs, &subcount, !queue_run_in_order);
-       f != NULL;
+       f;
        f = f->next)
     {
     pid_t pid;
@@ -447,9 +491,7 @@ for (i  = (queue_run_in_order? -1 : 0);
     check that the load average is low enough to permit deliveries. */
 
     if (!queue_run_force && deliver_queue_load_max >= 0)
-      {
-      load_average = os_getloadavg();
-      if (load_average > deliver_queue_load_max)
+      if ((load_average = os_getloadavg()) > deliver_queue_load_max)
         {
         log_write(L_queue_run, LOG_MAIN, "Abandon queue run: %s (load %.2f, max %.2f)",
           log_detail,
@@ -459,26 +501,22 @@ for (i  = (queue_run_in_order? -1 : 0);
         break;
         }
       else
-        {
         DEBUG(D_load) debug_printf("load average = %.2f max = %.2f\n",
           (double)load_average/1000.0,
           (double)deliver_queue_load_max/1000.0);
-        }
-      }
 
     /* Skip this message unless it's within the ID limits */
 
-    if (stop_id != NULL && Ustrncmp(f->text, stop_id, MESSAGE_ID_LENGTH) > 0)
+    if (stop_id && Ustrncmp(f->text, stop_id, MESSAGE_ID_LENGTH) > 0)
       continue;
-    if (start_id != NULL && Ustrncmp(f->text, start_id, MESSAGE_ID_LENGTH) < 0)
+    if (start_id && Ustrncmp(f->text, start_id, MESSAGE_ID_LENGTH) < 0)
       continue;
 
     /* Check that the message still exists */
 
     message_subdir[0] = f->dir_uschar;
-    sprintf(CS buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-      f->text);
-    if (Ustat(buffer, &statbuf) < 0) continue;
+    if (Ustat(spool_fname(US"input", message_subdir, f->text, US""), &statbuf) < 0)
+      continue;
 
     /* There are some tests that require the reading of the header file. Ensure
     the store used is scavenged afterwards so that this process doesn't keep
@@ -486,7 +524,7 @@ for (i  = (queue_run_in_order? -1 : 0);
     delivering, but it's cheaper than forking a delivery process for each
     message when many are not going to be delivered. */
 
-    if (deliver_selectstring != NULL || deliver_selectstring_sender != NULL ||
+    if (deliver_selectstring || deliver_selectstring_sender ||
         queue_run_first_delivery)
       {
       BOOL wanted = TRUE;
@@ -519,19 +557,20 @@ for (i  = (queue_run_in_order? -1 : 0);
         wanted = FALSE;
         }
 
-      /* Check for a matching address if deliver_selectstring[_sender} is set.
+      /* Check for a matching address if deliver_selectstring[_sender] is set.
       If so, we do a fully delivery - don't want to omit other addresses since
       their routing might trigger re-writing etc. */
 
       /* Sender matching */
 
-      else if (deliver_selectstring_sender != NULL &&
-              !(deliver_selectstring_sender_regex?
-                (pcre_exec(selectstring_regex_sender, NULL, CS sender_address,
-                  Ustrlen(sender_address), 0, PCRE_EOPT, NULL, 0) >= 0)
-                :
-                (strstric(sender_address, deliver_selectstring_sender, FALSE)
-                  != NULL)))
+      else if (  deliver_selectstring_sender
+	      && !(deliver_selectstring_sender_regex
+		  ? (pcre_exec(selectstring_regex_sender, NULL,
+		      CS sender_address, Ustrlen(sender_address), 0, PCRE_EOPT,
+		      NULL, 0) >= 0)
+		  : (strstric(sender_address, deliver_selectstring_sender, FALSE)
+		      != NULL)
+	      )   )
         {
         DEBUG(D_queue_run) debug_printf("%s: sender address did not match %s\n",
           f->text, deliver_selectstring_sender);
@@ -540,19 +579,19 @@ for (i  = (queue_run_in_order? -1 : 0);
 
       /* Recipient matching */
 
-      else if (deliver_selectstring != NULL)
+      else if (deliver_selectstring)
         {
         int i;
         for (i = 0; i < recipients_count; i++)
           {
           uschar *address = recipients_list[i].address;
-          if ((deliver_selectstring_regex?
-               (pcre_exec(selectstring_regex, NULL, CS address,
-                 Ustrlen(address), 0, PCRE_EOPT, NULL, 0) >= 0)
-               :
-               (strstric(address, deliver_selectstring, FALSE) != NULL))
-              &&
-              tree_search(tree_nonrecipients, address) == NULL)
+          if (  (deliver_selectstring_regex
+		? (pcre_exec(selectstring_regex, NULL, CS address,
+		     Ustrlen(address), 0, PCRE_EOPT, NULL, 0) >= 0)
+                : (strstric(address, deliver_selectstring, FALSE) != NULL)
+		)
+             && tree_search(tree_nonrecipients, address) == NULL
+	     )
             break;
           }
 
@@ -581,10 +620,8 @@ for (i  = (queue_run_in_order? -1 : 0);
     pretty cheap. */
 
     if (pipe(pfd) < 0)
-      {
       log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to create pipe in queue "
         "runner process %d: %s", queue_run_pid, strerror(errno));
-      }
     queue_run_pipe = pfd[pipe_write];  /* To ensure it gets passed on. */
 
     /* Make sure it isn't stdin. This seems unlikely, but just to be on the
@@ -638,11 +675,9 @@ for (i  = (queue_run_in_order? -1 : 0);
     /* If the process crashed, tell somebody */
 
     else if ((status & 0x00ff) != 0)
-      {
       log_write(0, LOG_MAIN|LOG_PANIC,
         "queue run: process %d crashed with signal %d while delivering %s",
         (int)pid, status & 0x00ff, f->text);
-      }
 
     /* Before continuing, wait till the pipe gets closed at the far end. This
     tells us that any children created by the delivery to re-use any SMTP
@@ -650,8 +685,9 @@ for (i  = (queue_run_in_order? -1 : 0);
     the mere fact that read() unblocks is enough. */
 
     set_process_info("running queue: waiting for children of %d", pid);
-    if (read(pfd[pipe_read], buffer, sizeof(buffer)) > 0)
-      log_write(0, LOG_MAIN|LOG_PANIC, "queue run: unexpected data on pipe");
+    if ((status = read(pfd[pipe_read], buffer, sizeof(buffer))) != 0)
+      log_write(0, LOG_MAIN|LOG_PANIC, "queue run: %s on pipe",
+		status > 0 ? "unexpected data" : "error");
     (void)close(pfd[pipe_read]);
     set_process_info("running queue");
 
@@ -672,18 +708,15 @@ for (i  = (queue_run_in_order? -1 : 0);
 
   if (i == 0 && subcount > 1 && !queue_run_in_order)
     {
-    int j;
+    int j, r;
     for (j = 1; j <= subcount; j++)
-      {
-      int r = random_number(100);
-      if (r >= 50)
+      if ((r = random_number(100)) >= 50)
         {
         int k = (r % subcount) + 1;
         int x = subdirs[j];
         subdirs[j] = subdirs[k];
         subdirs[k] = x;
         }
-      }
     }
   }                                    /* End loop for multiple directories */
 
@@ -698,7 +731,12 @@ if (queue_2stage)
 
 /* At top level, log the end of the run. */
 
-if (!recurse) log_write(L_queue_run, LOG_MAIN, "End queue run: %s", log_detail);
+if (!recurse)
+  if (*queue_name)
+    log_write(L_queue_run, LOG_MAIN, "End '%s' queue run: %s",
+      queue_name, log_detail);
+  else
+    log_write(L_queue_run, LOG_MAIN, "End queue run: %s", log_detail);
 }
 
 
@@ -841,17 +879,16 @@ for (; f != NULL; f = f->next)
     int ptr;
     FILE *jread;
     struct stat statbuf;
+    uschar * fname = spool_fname(US"input", message_subdir, f->text, US"");
 
-    sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-      f->text);
-    ptr = Ustrlen(big_buffer)-1;
-    big_buffer[ptr] = 'D';
+    ptr = Ustrlen(fname)-1;
+    fname[ptr] = 'D';
 
     /* Add the data size to the header size; don't count the file name
     at the start of the data file, but add one for the notional blank line
     that precedes the data. */
 
-    if (Ustat(big_buffer, &statbuf) == 0)
+    if (Ustat(fname, &statbuf) == 0)
       size = message_size + statbuf.st_size - SPOOL_DATA_START_OFFSET + 1;
     i = (now - received_time)/60;  /* minutes on queue */
     if (i > 90)
@@ -863,8 +900,8 @@ for (; f != NULL; f = f->next)
 
     /* Collect delivered addresses from any J file */
 
-    big_buffer[ptr] = 'J';
-    jread = Ufopen(big_buffer, "rb");
+    fname[ptr] = 'J';
+    jread = Ufopen(fname, "rb");
     if (jread != NULL)
       {
       while (Ufgets(big_buffer, big_buffer_size, jread) != NULL)
@@ -892,9 +929,9 @@ for (; f != NULL; f = f->next)
     if (save_errno == ERRNO_SPOOLFORMAT)
       {
       struct stat statbuf;
-      sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-        f->text);
-      if (Ustat(big_buffer, &statbuf) == 0)
+      uschar * fname = spool_fname(US"input", message_subdir, f->text, US"");
+
+      if (Ustat(fname, &statbuf) == 0)
         printf("*** spool format error: size=" OFF_T_FMT " ***",
           statbuf.st_size);
       else printf("*** spool format error ***");
@@ -959,7 +996,7 @@ struct passwd *pw;
 uschar *doing = NULL;
 uschar *username;
 uschar *errmsg;
-uschar spoolname[256];
+uschar spoolname[32];
 
 /* Set the global message_id variable, used when re-writing spool files. This
 also causes message ids to be added to log messages. */
@@ -1004,12 +1041,13 @@ if (action >= MSG_SHOW_BODY)
 
   for (i = 0; i < 2; i++)
     {
-    message_subdir[0] = (split_spool_directory == (i == 0))? id[5] : 0;
-    sprintf(CS spoolname, "%s/%s/%s/%s%s", spool_directory, subdirectory,
-      message_subdir, id, suffix);
-    fd = Uopen(spoolname, O_RDONLY, 0);
-    if (fd >= 0) break;
-    if (i == 0) continue;
+    message_subdir[0] = split_spool_directory == (i == 0) ? id[5] : 0;
+    if ((fd = Uopen(spool_fname(subdirectory, message_subdir, id, suffix),
+		    O_RDONLY, 0)) >= 0)
+      break;
+    if (i == 0)
+      continue;
+
     printf("Failed to open %s file for %s%s: %s\n", subdirectory, id, suffix,
       strerror(errno));
     if (action == MSG_SHOW_LOG && !message_logs)
@@ -1030,8 +1068,7 @@ other process is working on this message. If the file does not exist, continue
 only if the action is remove and the user is an admin user, to allow for
 tidying up broken states. */
 
-if (!spool_open_datafile(id))
-  {
+if ((deliver_datafile = spool_open_datafile(id)) < 0)
   if (errno == ENOENT)
     {
     yield = FALSE;
@@ -1046,7 +1083,6 @@ if (!spool_open_datafile(id))
         strerror(errno));
     return FALSE;
     }
-  }
 
 /* Read the spool header file for the message. Again, continue after an
 error only in the case of deleting by an administrator. Setting the third
@@ -1099,7 +1135,7 @@ switch(action)
   case MSG_SHOW_COPY:
   deliver_in_buffer = store_malloc(DELIVER_IN_BUFFER_SIZE);
   deliver_out_buffer = store_malloc(DELIVER_OUT_BUFFER_SIZE);
-  transport_write_message(NULL, 1, 0, 0, NULL, NULL, NULL, NULL, NULL, 0);
+  transport_write_message(1, NULL, 0);
   break;
 
 
@@ -1159,49 +1195,70 @@ switch(action)
   operation, just run everything twice. */
 
   case MSG_REMOVE:
-  message_subdir[0] = id[5];
-  for (j = 0; j < 2; message_subdir[0] = 0, j++)
     {
-    sprintf(CS spoolname, "%s/msglog/%s/%s", spool_directory, message_subdir, id);
-    if (Uunlink(spoolname) < 0)
-      {
-      if (errno != ENOENT)
-        {
-        yield = FALSE;
-        printf("Error while removing %s: %s\n", spoolname,
-          strerror(errno));
-        }
-      }
-    else removed = TRUE;
+    uschar suffix[3];
 
-    for (i = 0; i < 3; i++)
+    suffix[0] = '-';
+    suffix[2] = 0;
+    message_subdir[0] = id[5];
+
+    for (j = 0; j < 2; message_subdir[0] = 0, j++)
       {
-      sprintf(CS spoolname, "%s/input/%s/%s-%c", spool_directory, message_subdir,
-        id, "DHJ"[i]);
-      if (Uunlink(spoolname) < 0)
-        {
-        if (errno != ENOENT)
-          {
-          yield = FALSE;
-          printf("Error while removing %s: %s\n", spoolname,
-            strerror(errno));
-          }
-        }
-      else removed = TRUE;
+      uschar * fname = spool_fname(US"msglog", message_subdir, id, US"");
+
+      DEBUG(D_any) debug_printf(" removing %s", fname);
+      if (Uunlink(fname) < 0)
+	{
+	if (errno != ENOENT)
+	  {
+	  yield = FALSE;
+	  printf("Error while removing %s: %s\n", fname, strerror(errno));
+	  }
+	else DEBUG(D_any) debug_printf(" (no file)\n");
+	}
+      else
+	{
+	removed = TRUE;
+	DEBUG(D_any) debug_printf(" (ok)\n");
+	}
+
+      for (i = 0; i < 3; i++)
+	{
+	uschar * fname;
+
+	suffix[1] = (US"DHJ")[i];
+	fname = spool_fname(US"input", message_subdir, id, suffix);
+
+	DEBUG(D_any) debug_printf(" removing %s", fname);
+	if (Uunlink(fname) < 0)
+	  {
+	  if (errno != ENOENT)
+	    {
+	    yield = FALSE;
+	    printf("Error while removing %s: %s\n", fname, strerror(errno));
+	    }
+	  else DEBUG(D_any) debug_printf(" (no file)\n");
+	  }
+	else
+	  {
+	  removed = TRUE;
+	  DEBUG(D_any) debug_printf(" (done)\n");
+	  }
+	}
       }
-    }
 
-  /* In the common case, the datafile is open (and locked), so give the
-  obvious message. Otherwise be more specific. */
+    /* In the common case, the datafile is open (and locked), so give the
+    obvious message. Otherwise be more specific. */
 
-  if (deliver_datafile >= 0) printf("has been removed\n");
-    else printf("has been removed or did not exist\n");
-  if (removed)
-    {
-    log_write(0, LOG_MAIN, "removed by %s", username);
-    log_write(0, LOG_MAIN, "Completed");
+    if (deliver_datafile >= 0) printf("has been removed\n");
+      else printf("has been removed or did not exist\n");
+    if (removed)
+      {
+      log_write(0, LOG_MAIN, "removed by %s", username);
+      log_write(0, LOG_MAIN, "Completed");
+      }
+    break;
     }
-  break;
 
 
   case MSG_MARK_ALL_DELIVERED:
@@ -1311,7 +1368,6 @@ switch(action)
     }
 
   if (yield)
-    {
     if (spool_write_header(id, SW_MODIFYING, &errmsg) >= 0)
       printf("has been modified\n");
     else
@@ -1319,7 +1375,6 @@ switch(action)
       yield = FALSE;
       printf("- while %s: %s\n", doing, errmsg);
       }
-    }
 
   break;
   }
@@ -1327,8 +1382,11 @@ switch(action)
 /* Closing the datafile releases the lock and permits other processes
 to operate on the message (if it still exists). */
 
-(void)close(deliver_datafile);
-deliver_datafile = -1;
+if (deliver_datafile >= 0)
+  {
+  (void)close(deliver_datafile);
+  deliver_datafile = -1;
+  }
 return yield;
 }
 
@@ -1380,4 +1438,6 @@ while ((ss = string_nextinlist(&s, &sep, buffer, sizeof(buffer))) != NULL)
   }
 }
 
+#endif /*!COMPILE_UTILITY*/
+
 /* End of queue.c */
diff --git a/src/src/rda.c b/src/src/rda.c
index 2afd6dc8a..5df361e31 100644
--- a/src/src/rda.c
+++ b/src/src/rda.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* This module contains code for extracting addresses from a forwarding list
@@ -474,11 +474,12 @@ rda_read_string(int fd, uschar **sp)
 int len;
 
 if (read(fd, &len, sizeof(int)) != sizeof(int)) return FALSE;
-if (len == 0) *sp = NULL; else
-  {
-  *sp = store_get(len);
-  if (read(fd, *sp, len) != len) return FALSE;
-  }
+if (len == 0)
+  *sp = NULL;
+else
+  /* We know we have enough memory so disable the error on "len" */
+  /* coverity[tainted_data] */
+  if (read(fd, *sp = store_get(len), len) != len) return FALSE;
 return TRUE;
 }
 
@@ -911,7 +912,7 @@ if (yield == FF_DELIVERED || yield == FF_NOTDELIVERED ||
 
     if (i > 0)
       {
-      addr->pipe_expandn = store_get((i+1) * sizeof(uschar **));
+      addr->pipe_expandn = store_get((i+1) * sizeof(uschar *));
       addr->pipe_expandn[i] = NULL;
       while (--i >= 0) addr->pipe_expandn[i] = expandn[i];
       }
diff --git a/src/src/readconf.c b/src/src/readconf.c
index 2dfc9af8e..27a834b3f 100644
--- a/src/src/readconf.c
+++ b/src/src/readconf.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for reading the configuration file, and for displaying
@@ -11,10 +11,14 @@ implementation of the conditional .ifdef etc. */
 
 #include "exim.h"
 
+extern char **environ;
+
 static void fn_smtp_receive_timeout(const uschar * name, const uschar * str);
 static void save_config_line(const uschar* line);
 static void save_config_position(const uschar *file, int line);
-static void print_config(BOOL admin);
+static void print_config(BOOL admin, BOOL terse);
+static void readconf_options_auths(void);
+
 
 #define CSTATE_STACK_SIZE 10
 
@@ -178,6 +182,7 @@ static optionlist optionlist_config[] = {
   { "acl_smtp_starttls",        opt_stringptr,   &acl_smtp_starttls },
 #endif
   { "acl_smtp_vrfy",            opt_stringptr,   &acl_smtp_vrfy },
+  { "add_environment",          opt_stringptr,   &add_environment },
   { "admin_groups",             opt_gidlist,     &admin_groups },
   { "allow_domain_literals",    opt_bool,        &allow_domain_literals },
   { "allow_mx_to_ip",           opt_bool,        &allow_mx_to_ip },
@@ -208,6 +213,7 @@ static optionlist optionlist_config[] = {
   { "check_rfc2047_length",     opt_bool,        &check_rfc2047_length },
   { "check_spool_inodes",       opt_int,         &check_spool_inodes },
   { "check_spool_space",        opt_Kint,        &check_spool_space },
+  { "chunking_advertise_hosts", opt_stringptr,	 &chunking_advertise_hosts },
   { "daemon_smtp_port",         opt_stringptr|opt_hidden, &daemon_smtp_port },
   { "daemon_smtp_ports",        opt_stringptr,   &daemon_smtp_port },
   { "daemon_startup_retries",   opt_int,         &daemon_startup_retries },
@@ -267,11 +273,6 @@ static optionlist optionlist_config[] = {
 #ifdef SUPPORT_TLS
   { "gnutls_allow_auto_pkcs11", opt_bool,        &gnutls_allow_auto_pkcs11 },
   { "gnutls_compat_mode",       opt_bool,        &gnutls_compat_mode },
-  /* These three gnutls_require_* options stopped working in Exim 4.80 */
-  /* From 4.83 we log a warning; a future relase will remove them */
-  { "gnutls_require_kx",        opt_stringptr,   &gnutls_require_kx },
-  { "gnutls_require_mac",       opt_stringptr,   &gnutls_require_mac },
-  { "gnutls_require_protocols", opt_stringptr,   &gnutls_require_proto },
 #endif
   { "header_line_maxsize",      opt_int,         &header_line_maxsize },
   { "header_maxsize",           opt_int,         &header_maxsize },
@@ -296,6 +297,7 @@ static optionlist optionlist_config[] = {
   { "ignore_bounce_errors_after", opt_time,      &ignore_bounce_errors_after },
   { "ignore_fromline_hosts",    opt_stringptr,   &ignore_fromline_hosts },
   { "ignore_fromline_local",    opt_bool,        &ignore_fromline_local },
+  { "keep_environment",         opt_stringptr,   &keep_environment },
   { "keep_malformed",           opt_time,        &keep_malformed },
 #ifdef LOOKUP_LDAP
   { "ldap_ca_cert_dir",         opt_stringptr,   &eldap_ca_cert_dir },
@@ -369,7 +371,7 @@ static optionlist optionlist_config[] = {
   { "queue_only_load_latch",    opt_bool,        &queue_only_load_latch },
   { "queue_only_override",      opt_bool,        &queue_only_override },
   { "queue_run_in_order",       opt_bool,        &queue_run_in_order },
-  { "queue_run_max",            opt_int,         &queue_run_max },
+  { "queue_run_max",            opt_stringptr,   &queue_run_max },
   { "queue_smtp_domains",       opt_stringptr,   &queue_smtp_domains },
   { "receive_timeout",          opt_time,        &receive_timeout },
   { "received_header_text",     opt_stringptr,   &received_header_text },
@@ -443,6 +445,7 @@ static optionlist optionlist_config[] = {
   { "strip_trailing_dot",       opt_bool,        &strip_trailing_dot },
   { "syslog_duplication",       opt_bool,        &syslog_duplication },
   { "syslog_facility",          opt_stringptr,   &syslog_facility_str },
+  { "syslog_pid",               opt_bool,        &syslog_pid },
   { "syslog_processname",       opt_stringptr,   &syslog_processname },
   { "syslog_timestamp",         opt_bool,        &syslog_timestamp },
   { "system_filter",            opt_stringptr,   &system_filter },
@@ -487,8 +490,7 @@ static optionlist optionlist_config[] = {
   { "write_rejectlog",          opt_bool,        &write_rejectlog }
 };
 
-static int optionlist_config_size =
-  sizeof(optionlist_config)/sizeof(optionlist);
+static int optionlist_config_size = nelem(optionlist_config);
 
 
 
@@ -513,10 +515,10 @@ int i;
 router_instance *r;
 transport_instance *t;
 
-for (i = 0; i < optionlist_config_size; i++)
+for (i = 0; i < nelem(optionlist_config); i++)
   if (p == optionlist_config[i].value) return US optionlist_config[i].name;
 
-for (r = routers; r != NULL; r = r->next)
+for (r = routers; r; r = r->next)
   {
   router_info *ri = r->info;
   for (i = 0; i < *ri->options_count; i++)
@@ -527,7 +529,7 @@ for (r = routers; r != NULL; r = r->next)
     }
   }
 
-for (t = transports; t != NULL; t = t->next)
+for (t = transports; t; t = t->next)
   {
   transport_info *ti = t->info;
   for (i = 0; i < *ti->options_count; i++)
@@ -553,6 +555,45 @@ return US"";
 *       Deal with an assignment to a macro       *
 *************************************************/
 
+/* We have a new definition. The macro_item structure includes a final vector
+called "name" which is one byte long. Thus, adding "namelen" gives us enough
+room to store the "name" string.
+If a builtin macro we place at head of list, else tail.  This lets us lazy-create
+builtins. */
+
+macro_item *
+macro_create(const uschar * name, const uschar * val,
+  BOOL command_line, BOOL builtin)
+{
+unsigned namelen = Ustrlen(name);
+macro_item * m = store_get(sizeof(macro_item) + namelen);
+
+/* fprintf(stderr, "%s: '%s' '%s'\n", __FUNCTION__, name, val) */
+if (!macros)
+  {
+  macros = m;
+  mlast = m;
+  m->next = NULL;
+  }
+else if (builtin)
+  {
+  m->next = macros;
+  macros = m;
+  }
+else
+  {
+  mlast->next = m;
+  mlast = m;
+  m->next = NULL;
+  }
+m->command_line = command_line;
+m->namelen = namelen;
+m->replacement = string_copy(val);
+Ustrcpy(m->name, name);
+return m;
+}
+
+
 /* This function is called when a line that starts with an upper case letter is
 encountered. The argument "line" should contain a complete logical line, and
 start with the first letter of the macro name. The macro name and the
@@ -572,7 +613,6 @@ uschar name[64];
 int namelen = 0;
 BOOL redef = FALSE;
 macro_item *m;
-macro_item *mlast = NULL;
 
 while (isalnum(*s) || *s == '_')
   {
@@ -598,13 +638,13 @@ while (isspace(*s)) s++;
 just skip this definition. It's an error to attempt to redefine a macro without
 redef set to TRUE, or to redefine a macro when it hasn't been defined earlier.
 It is also an error to define a macro whose name begins with the name of a
-previously defined macro. Note: it is documented that the other way round
-works. */
+previously defined macro.  This is the requirement that make using a tree
+for macros hard; we must check all macros for the substring.  Perhaps a
+sorted list, and a bsearch, would work?
+Note: it is documented that the other way round works. */
 
-for (m = macros; m != NULL; m = m->next)
+for (m = macros; m; m = m->next)
   {
-  int len = Ustrlen(m->name);
-
   if (Ustrcmp(m->name, name) == 0)
     {
     if (!m->command_line && !redef)
@@ -613,7 +653,7 @@ for (m = macros; m != NULL; m = m->next)
     break;
     }
 
-  if (len < namelen && Ustrstr(name, m->name) != NULL)
+  if (m->namelen < namelen && Ustrstr(name, m->name) != NULL)
     log_write(0, LOG_CONFIG|LOG_PANIC_DIE, "\"%s\" cannot be defined as "
       "a macro because previously defined macro \"%s\" is a substring",
       name, m->name);
@@ -621,49 +661,240 @@ for (m = macros; m != NULL; m = m->next)
   /* We cannot have this test, because it is documented that a substring
   macro is permitted (there is even an example).
   *
-  * if (len > namelen && Ustrstr(m->name, name) != NULL)
+  * if (m->namelen > namelen && Ustrstr(m->name, name) != NULL)
   *   log_write(0, LOG_CONFIG|LOG_PANIC_DIE, "\"%s\" cannot be defined as "
   *     "a macro because it is a substring of previously defined macro \"%s\"",
   *     name, m->name);
   */
-
-  mlast = m;
   }
 
 /* Check for an overriding command-line definition. */
 
-if (m != NULL && m->command_line) return;
+if (m && m->command_line) return;
 
 /* Redefinition must refer to an existing macro. */
 
 if (redef)
-  {
-  if (m == NULL)
+  if (m)
+    m->replacement = string_copy(s);
+  else
     log_write(0, LOG_CONFIG|LOG_PANIC_DIE, "can't redefine an undefined macro "
       "\"%s\"", name);
-  }
-
-/* We have a new definition. The macro_item structure includes a final vector
-called "name" which is one byte long. Thus, adding "namelen" gives us enough
-room to store the "name" string. */
 
+/* We have a new definition. */
 else
-  {
-  m = store_get(sizeof(macro_item) + namelen);
-  if (macros == NULL) macros = m; else mlast->next = m;
-  Ustrncpy(m->name, name, namelen);
-  m->name[namelen] = 0;
-  m->next = NULL;
-  m->command_line = FALSE;
-  }
+  (void) macro_create(name, s, FALSE, FALSE);
+}
+
+
+
+
+
+/*************************************************/
+/* Create compile-time feature macros */
+static void
+readconf_features(void)
+{
+/* Probably we could work out a static initialiser for wherever
+macros are stored, but this will do for now. Some names are awkward
+due to conflicts with other common macros. */
+
+#ifdef SUPPORT_CRYPTEQ
+  macro_create(US"_HAVE_CRYPTEQ", US"y", FALSE, TRUE);
+#endif
+#if HAVE_ICONV
+  macro_create(US"_HAVE_ICONV", US"y", FALSE, TRUE);
+#endif
+#if HAVE_IPV6
+  macro_create(US"_HAVE_IPV6", US"y", FALSE, TRUE);
+#endif
+#ifdef HAVE_SETCLASSRESOURCES
+  macro_create(US"_HAVE_SETCLASSRESOURCES", US"y", FALSE, TRUE);
+#endif
+#ifdef SUPPORT_PAM
+  macro_create(US"_HAVE_PAM", US"y", FALSE, TRUE);
+#endif
+#ifdef EXIM_PERL
+  macro_create(US"_HAVE_PERL", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPAND_DLFUNC
+  macro_create(US"_HAVE_DLFUNC", US"y", FALSE, TRUE);
+#endif
+#ifdef USE_TCP_WRAPPERS
+  macro_create(US"_HAVE_TCPWRAPPERS", US"y", FALSE, TRUE);
+#endif
+#ifdef SUPPORT_TLS
+  macro_create(US"_HAVE_TLS", US"y", FALSE, TRUE);
+# ifdef USE_GNUTLS
+  macro_create(US"_HAVE_GNUTLS", US"y", FALSE, TRUE);
+# else
+  macro_create(US"_HAVE_OPENSSL", US"y", FALSE, TRUE);
+# endif
+#endif
+#ifdef SUPPORT_TRANSLATE_IP_ADDRESS
+  macro_create(US"_HAVE_TRANSLATE_IP_ADDRESS", US"y", FALSE, TRUE);
+#endif
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+  macro_create(US"_HAVE_MOVE_FROZEN_MESSAGES", US"y", FALSE, TRUE);
+#endif
+#ifdef WITH_CONTENT_SCAN
+  macro_create(US"_HAVE_CONTENT_SCANNING", US"y", FALSE, TRUE);
+#endif
+#ifndef DISABLE_DKIM
+  macro_create(US"_HAVE_DKIM", US"y", FALSE, TRUE);
+#endif
+#ifndef DISABLE_DNSSEC
+  macro_create(US"_HAVE_DNSSEC", US"y", FALSE, TRUE);
+#endif
+#ifndef DISABLE_EVENT
+  macro_create(US"_HAVE_EVENT", US"y", FALSE, TRUE);
+#endif
+#ifdef SUPPORT_I18N
+  macro_create(US"_HAVE_I18N", US"y", FALSE, TRUE);
+#endif
+#ifndef DISABLE_OCSP
+  macro_create(US"_HAVE_OCSP", US"y", FALSE, TRUE);
+#endif
+#ifndef DISABLE_PRDR
+  macro_create(US"_HAVE_PRDR", US"y", FALSE, TRUE);
+#endif
+#ifdef SUPPORT_PROXY
+  macro_create(US"_HAVE_PROXY", US"y", FALSE, TRUE);
+#endif
+#ifdef SUPPORT_SOCKS
+  macro_create(US"_HAVE_SOCKS", US"y", FALSE, TRUE);
+#endif
+#ifdef TCP_FASTOPEN
+  macro_create(US"_HAVE_TCP_FASTOPEN", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPERIMENTAL_LMDB
+  macro_create(US"_HAVE_LMDB", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPERIMENTAL_SPF
+  macro_create(US"_HAVE_SPF", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPERIMENTAL_SRS
+  macro_create(US"_HAVE_SRS", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPERIMENTAL_BRIGHTMAIL
+  macro_create(US"_HAVE_BRIGHTMAIL", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPERIMENTAL_DANE
+  macro_create(US"_HAVE_DANE", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPERIMENTAL_DCC
+  macro_create(US"_HAVE_DCC", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPERIMENTAL_DMARC
+  macro_create(US"_HAVE_DMARC", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPERIMENTAL_DSN_INFO
+  macro_create(US"_HAVE_DSN_INFO", US"y", FALSE, TRUE);
+#endif
+
+#ifdef LOOKUP_LSEARCH
+  macro_create(US"_HAVE_LKUP_LSEARCH", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_CDB
+  macro_create(US"_HAVE_LKUP_CDB", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_DBM
+  macro_create(US"_HAVE_LKUP_DBM", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_DNSDB
+  macro_create(US"_HAVE_LKUP_DNSDB", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_DSEARCH
+  macro_create(US"_HAVE_LKUP_DSEARCH", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_IBASE
+  macro_create(US"_HAVE_LKUP_IBASE", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_LDAP
+  macro_create(US"_HAVE_LKUP_LDAP", US"y", FALSE, TRUE);
+#endif
+#ifdef EXPERIMENTAL_LMDB
+  macro_create(US"_HAVE_LKUP_LMDB", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_MYSQL
+  macro_create(US"_HAVE_LKUP_MYSQL", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_NIS
+  macro_create(US"_HAVE_LKUP_NIS", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_NISPLUS
+  macro_create(US"_HAVE_LKUP_NISPLUS", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_ORACLE
+  macro_create(US"_HAVE_LKUP_ORACLE", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_PASSWD
+  macro_create(US"_HAVE_LKUP_PASSWD", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_PGSQL
+  macro_create(US"_HAVE_LKUP_PGSQL", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_REDIS
+  macro_create(US"_HAVE_LKUP_REDIS", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_SQLITE
+  macro_create(US"_HAVE_LKUP_SQLITE", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_TESTDB
+  macro_create(US"_HAVE_LKUP_TESTDB", US"y", FALSE, TRUE);
+#endif
+#ifdef LOOKUP_WHOSON
+  macro_create(US"_HAVE_LKUP_WHOSON", US"y", FALSE, TRUE);
+#endif
+
+#ifdef TRANSPORT_APPENDFILE
+# ifdef SUPPORT_MAILDIR
+  macro_create(US"_HAVE_TPT_APPEND_MAILDR", US"y", FALSE, TRUE);
+# endif
+# ifdef SUPPORT_MAILSTORE
+  macro_create(US"_HAVE_TPT_APPEND_MAILSTORE", US"y", FALSE, TRUE);
+# endif
+# ifdef SUPPORT_MBX
+  macro_create(US"_HAVE_TPT_APPEND_MBX", US"y", FALSE, TRUE);
+# endif
+#endif
+}
 
-/* Set the value of the new or redefined macro */
 
-m->replacement = string_copy(s);
+void
+readconf_options_from_list(optionlist * opts, unsigned nopt, uschar * group)
+{
+int i;
+const uschar * s;
+
+/* The 'previously-defined-substring' rule for macros in config file
+lines is done so for these builtin macros: we know that the table
+we source from is in strict alpha order, hence the builtins portion
+of the macros list is in reverse-alpha (we prepend them) - so longer
+macros that have substrings are always discovered first during
+expansion. */
+
+for (i = 0; i < nopt; i++)  if (*(s = opts[i].name) && *s != '*')
+  macro_create(string_sprintf("_OPT_%T_%T", group, s), US"y", FALSE, TRUE);
 }
 
 
+static void
+readconf_options(void)
+{
+readconf_options_from_list(optionlist_config, nelem(optionlist_config), US"MAIN");
+readconf_options_routers();
+readconf_options_transports();
+readconf_options_auths();
+}
 
+static void
+macros_create_builtin(void)
+{
+readconf_features();
+readconf_options();
+macros_builtin_created = TRUE;
+}
 
 
 /*************************************************
@@ -775,11 +1006,28 @@ for (;;)
     if (*s != '=') s = ss;          /* Not a macro definition */
     }
 
+  /* If the builtin macros are not yet defined, and the line contains an
+  underscrore followed by an one of the three possible chars used by
+  builtins, create them. */
+
+  if (!macros_builtin_created)
+    {
+    const uschar * t, * p;
+    uschar c;
+    for (t = s; (p = CUstrchr(t, '_')); t = p+1)
+      if (c = p[1], c == 'O' || c == 'D' || c == 'H')
+	{
+/* fprintf(stderr, "%s: builtins create triggered by '%s'\n", __FUNCTION__, s); */
+	macros_create_builtin();
+	break;
+	}
+    }
+
   /* For each defined macro, scan the line (from after XXX= if present),
   replacing all occurrences of the macro. */
 
   macro_found = FALSE;
-  for (m = macros; m != NULL; m = m->next)
+  for (m = macros; m; m = m->next)
     {
     uschar *p, *pp;
     uschar *t = s;
@@ -787,12 +1035,12 @@ for (;;)
     while ((p = Ustrstr(t, m->name)) != NULL)
       {
       int moveby;
-      int namelen = Ustrlen(m->name);
       int replen = Ustrlen(m->replacement);
 
+/* fprintf(stderr, "%s: matched '%s' in '%s'\n", __FUNCTION__, m->name, t) */
       /* Expand the buffer if necessary */
 
-      while (newlen - namelen + replen + 1 > big_buffer_size)
+      while (newlen - m->namelen + replen + 1 > big_buffer_size)
         {
         int newsize = big_buffer_size + BIG_BUFFER_SIZE;
         uschar *newbuffer = store_malloc(newsize);
@@ -810,9 +1058,8 @@ for (;;)
       copying in the replacement text. Don't rescan the replacement for this
       same macro. */
 
-      pp = p + namelen;
-      moveby = replen - namelen;
-      if (moveby != 0)
+      pp = p + m->namelen;
+      if ((moveby = replen - m->namelen) != 0)
         {
         memmove(p + replen, pp, (big_buffer + newlen) - pp + 1);
         newlen += moveby;
@@ -931,10 +1178,10 @@ for (;;)
     save->filename = config_filename;
     save->lineno = config_lineno;
 
-    config_file = Ufopen(ss, "rb");
-    if (config_file == NULL)
+    if (!(config_file = Ufopen(ss, "rb")))
       log_write(0, LOG_PANIC_DIE|LOG_CONFIG_IN, "failed to open included "
         "configuration file %s", ss);
+
     config_filename = string_copy(ss);
     config_lineno = 0;
     continue;
@@ -1162,9 +1409,10 @@ while (last > first)
   {
   int middle = (first + last)/2;
   int c = Ustrcmp(name, ol[middle].name);
+
   if (c == 0) return ol + middle;
-    else if (c > 0) first = middle + 1;
-      else last = middle;
+  else if (c > 0) first = middle + 1;
+  else last = middle;
   }
 return NULL;
 }
@@ -1461,7 +1709,6 @@ int intbase = 0;
 uschar *inttype = US"";
 uschar *sptr;
 uschar *s = buffer;
-uschar *saved_condition, *strtemp;
 uschar **str_target;
 uschar name[64];
 uschar name2[64];
@@ -1508,9 +1755,7 @@ if (Ustrncmp(name, "not_", 4) == 0)
 /* Search the list for the given name. A non-existent name, or an option that
 is set twice, is a disaster. */
 
-ol = find_option(name + offset, oltop, last);
-
-if (ol == NULL)
+if (!(ol = find_option(name + offset, oltop, last)))
   {
   if (unknown_txt == NULL) return FALSE;
   log_write(0, LOG_PANIC_DIE|LOG_CONFIG_IN, CS unknown_txt, name);
@@ -1598,19 +1843,18 @@ switch (type)
     control block and flags word. */
 
     case opt_stringptr:
-    if (data_block == NULL)
-      str_target = (uschar **)(ol->value);
-    else
-      str_target = (uschar **)((uschar *)data_block + (long int)(ol->value));
+    str_target = data_block ? USS (US data_block + (long int)(ol->value))
+			    : USS (ol->value);
     if (ol->type & opt_rep_con)
       {
+      uschar * saved_condition;
       /* We already have a condition, we're conducting a crude hack to let
       multiple condition rules be chained together, despite storing them in
       text form. */
-      saved_condition = *str_target;
-      strtemp = string_sprintf("${if and{{bool_lax{%s}}{bool_lax{%s}}}}",
-          saved_condition, sptr);
-      *str_target = string_copy_malloc(strtemp);
+      *str_target = string_copy_malloc( (saved_condition = *str_target)
+	? string_sprintf("${if and{{bool_lax{%s}}{bool_lax{%s}}}}",
+	    saved_condition, sptr)
+	: sptr);
       /* TODO(pdp): there is a memory leak here and just below
       when we set 3 or more conditions; I still don't
       understand the store mechanism enough to know
@@ -1646,10 +1890,10 @@ switch (type)
     break;
 
     case opt_rewrite:
-    if (data_block == NULL)
-      *((uschar **)(ol->value)) = sptr;
+    if (data_block)
+      *USS (US data_block + (long int)(ol->value)) = sptr;
     else
-      *((uschar **)((uschar *)data_block + (long int)(ol->value))) = sptr;
+      *USS (ol->value) = sptr;
     freesptr = FALSE;
     if (type == opt_rewrite)
       {
@@ -1984,7 +2228,7 @@ switch (type)
   inttype = US"octal ";
 
   /*  Integer: a simple(ish) case; allow octal and hex formats, and
-  suffixes K and M. The different types affect output, not input. */
+  suffixes K, M and G. The different types affect output, not input. */
 
   case opt_mkint:
   case opt_int:
@@ -2000,7 +2244,6 @@ switch (type)
         inttype, name);
 
     if (errno != ERANGE)
-      {
       if (tolower(*endptr) == 'k')
         {
         if (lvalue > INT_MAX/1024 || lvalue < INT_MIN/1024) errno = ERANGE;
@@ -2014,7 +2257,13 @@ switch (type)
         else lvalue *= 1024*1024;
         endptr++;
         }
-      }
+      else if (tolower(*endptr) == 'g')
+        {
+        if (lvalue > INT_MAX/(1024*1024*1024) || lvalue < INT_MIN/(1024*1024*1024))
+          errno = ERANGE;
+        else lvalue *= 1024*1024*1024;
+        endptr++;
+        }
 
     if (errno == ERANGE || lvalue > INT_MAX || lvalue < INT_MIN)
       log_write(0, LOG_PANIC_DIE|LOG_CONFIG_IN,
@@ -2033,8 +2282,9 @@ switch (type)
     *((int *)((uschar *)data_block + (long int)(ol->value))) = value;
   break;
 
-  /*  Integer held in K: again, allow octal and hex formats, and suffixes K and
-  M. */
+  /*  Integer held in K: again, allow octal and hex formats, and suffixes K, M
+  and G. */
+  /*XXX consider moving to int_eximarith_t (but mind the overflow test 0415) */
 
   case opt_Kint:
     {
@@ -2047,22 +2297,26 @@ switch (type)
         inttype, name);
 
     if (errno != ERANGE)
-      {
-      if (tolower(*endptr) == 'm')
+      if (tolower(*endptr) == 'g')
         {
-        if (value > INT_MAX/1024 || value < INT_MIN/1024) errno = ERANGE;
-          else value *= 1024;
+        if (value > INT_MAX/(1024*1024) || value < INT_MIN/(1024*1024))
+	  errno = ERANGE;
+	else
+	  value *= 1024*1024;
         endptr++;
         }
-      else if (tolower(*endptr) == 'k')
+      else if (tolower(*endptr) == 'm')
         {
+        if (value > INT_MAX/1024 || value < INT_MIN/1024)
+	  errno = ERANGE;
+	else
+	  value *= 1024;
         endptr++;
         }
+      else if (tolower(*endptr) == 'k')
+        endptr++;
       else
-        {
         value = (value + 512)/1024;
-        }
-      }
 
     if (errno == ERANGE) log_write(0, LOG_PANIC_DIE|LOG_CONFIG_IN,
       "absolute value of integer \"%s\" is too large (overflow)", s);
@@ -2093,6 +2347,11 @@ switch (type)
   if (value < 0) log_write(0, LOG_PANIC_DIE|LOG_CONFIG_IN,
     "integer \"%s\" is too large (overflow)", s);
 
+  /* We get a coverity error here for using count, as it derived
+  from the tainted buffer pointed to by s, as parsed by sscanf().
+  By the definition of sscanf we must be aceessing between start
+  and end of s (assuming it is nul-terminated...) so ignore the error.  */
+  /* coverity[tainted_data] */
   if (s[count] == '.')
     {
     int d = 100;
@@ -2550,6 +2809,7 @@ second argument is NULL. There are some special values:
   +name              print a named list item
   local_scan         print the local_scan options
   config             print the configuration as it is parsed
+  environment        print the used execution environment
 
 If the second argument is not NULL, it must be one of "router", "transport",
 "authenticator" or "macro" in which case the first argument identifies the
@@ -2606,8 +2866,8 @@ if (type == NULL)
     return;
     }
 
-  if ( Ustrcmp(name, "configure_file") == 0
-     ||Ustrcmp(name, "config_file") == 0)
+  if (  Ustrcmp(name, "configure_file") == 0
+     || Ustrcmp(name, "config_file") == 0)
     {
     printf("%s\n", CS config_main_filename);
     return;
@@ -2616,11 +2876,11 @@ if (type == NULL)
   if (Ustrcmp(name, "all") == 0)
     {
     for (ol = optionlist_config;
-         ol < optionlist_config + optionlist_config_size; ol++)
+         ol < optionlist_config + nelem(optionlist_config); ol++)
       {
       if ((ol->type & opt_hidden) == 0)
         print_ol(ol, US ol->name, NULL,
-            optionlist_config, optionlist_config_size,
+            optionlist_config, nelem(optionlist_config),
             no_labels);
       }
     return;
@@ -2643,7 +2903,7 @@ if (type == NULL)
 
   if (Ustrcmp(name, "config") == 0)
     {
-    print_config(admin_user);
+    print_config(admin_user, no_labels);
     return;
     }
 
@@ -2698,10 +2958,28 @@ if (type == NULL)
     names_only = TRUE;
     }
 
+  else if (Ustrcmp(name, "environment") == 0)
+    {
+    if (environ)
+      {
+      uschar ** p;
+      for (p = USS environ; *p; p++) ;
+      qsort(environ, p - USS environ, sizeof(*p), string_compare_by_pointer);
+
+      for (p = USS environ; *p; p++)
+        {
+	uschar * q;
+        if (no_labels && (q = Ustrchr(*p, '='))) *q  = '\0';
+        puts(CS *p);
+        }
+      }
+    return;
+    }
+
   else
     {
-    print_ol(find_option(name, optionlist_config, optionlist_config_size),
-      name, NULL, optionlist_config, optionlist_config_size, no_labels);
+    print_ol(find_option(name, optionlist_config, nelem(optionlist_config)),
+      name, NULL, optionlist_config, nelem(optionlist_config), no_labels);
     return;
     }
   }
@@ -2740,19 +3018,18 @@ else if (Ustrcmp(type, "macro") == 0)
     fprintf(stderr, "exim: permission denied\n");
     exit(EXIT_FAILURE);
     }
-  for (m = macros; m != NULL; m = m->next)
-    {
-    if (name == NULL || Ustrcmp(name, m->name) == 0)
+  if (!macros_builtin_created) macros_create_builtin();
+  for (m = macros; m; m = m->next)
+    if (!name || Ustrcmp(name, m->name) == 0)
       {
       if (names_only)
         printf("%s\n", CS m->name);
       else
         printf("%s=%s\n", CS m->name, CS m->replacement);
-      if (name != NULL)
+      if (name)
         return;
       }
-    }
-  if (name != NULL)
+  if (name)
     printf("%s %s not found\n", type, name);
   return;
   }
@@ -2923,7 +3200,7 @@ Returns:  bool for "okay"; false will cause caller to immediately exit.
 
 #ifdef SUPPORT_TLS
 static BOOL
-tls_dropprivs_validate_require_cipher(void)
+tls_dropprivs_validate_require_cipher(BOOL nowarn)
 {
 const uschar *errmsg;
 pid_t pid;
@@ -2937,9 +3214,9 @@ if (  !tls_advertise_hosts
    || Ustrcmp(tls_advertise_hosts, ":") == 0
    )
   return TRUE;
-else if (!tls_certificate)
-  log_write(0, LOG_MAIN|LOG_PANIC,
-    "Warning: No server certificate defined; TLS connections will fail.\n"
+else if (!nowarn && !tls_certificate)
+  log_write(0, LOG_MAIN,
+    "Warning: No server certificate defined; will use a selfsigned one.\n"
     " Suggested action: either install a certificate or change tls_advertise_hosts option");
 
 oldsignal = signal(SIGCHLD, SIG_DFL);
@@ -3011,7 +3288,7 @@ systems. Therefore they are available only when requested by compile-time
 options. */
 
 void
-readconf_main(void)
+readconf_main(BOOL nowarn)
 {
 int sep = 0;
 struct stat statbuf;
@@ -3020,9 +3297,9 @@ const uschar *list = config_main_filelist;
 
 /* Loop through the possible file names */
 
-while((filename = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
-       != NULL)
+while((filename = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
   {
+
   /* Cut out all the fancy processing unless specifically wanted */
 
   #if defined(CONFIGURE_FILE_USE_NODE) || defined(CONFIGURE_FILE_USE_EUID)
@@ -3076,6 +3353,15 @@ while((filename = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
   if (config_file != NULL || errno != ENOENT) break;
   }
 
+/* Now, once we found and opened our configuration file, we change the directory
+to a safe place. Later we change to $spool_directory. */
+
+if (Uchdir("/") < 0)
+  {
+  perror("exim: chdir `/': ");
+  exit(EXIT_FAILURE);
+  }
+
 /* On success, save the name for verification; config_filename is used when
 logging configuration errors (it changes for .included files) whereas
 config_main_filename is the name shown by -bP. Failure to open a configuration
@@ -3439,7 +3725,7 @@ if ((tls_verify_hosts != NULL || tls_try_verify_hosts != NULL) &&
 
 /* This also checks that the library linkage is working and we can call
 routines in it, so call even if tls_require_ciphers is unset */
-if (!tls_dropprivs_validate_require_cipher())
+if (!tls_dropprivs_validate_require_cipher(nowarn))
   exit(1);
 
 /* Magic number: at time of writing, 1024 has been the long-standing value
@@ -3462,12 +3748,12 @@ if (openssl_options != NULL)
       "openssl_options parse error: %s", openssl_options);
 # endif
   }
-
-if (gnutls_require_kx || gnutls_require_mac || gnutls_require_proto)
-  log_write(0, LOG_MAIN, "WARNING: main options"
-      " gnutls_require_kx, gnutls_require_mac and gnutls_require_protocols"
-      " are obsolete\n");
 #endif	/*SUPPORT_TLS*/
+
+if (!nowarn && !keep_environment && environ && *environ)
+  log_write(0, LOG_MAIN,
+      "Warning: purging the environment.\n"
+      " Suggested action: use keep_environment.");
 }
 
 
@@ -3580,9 +3866,9 @@ while ((buffer = get_config_line()) != NULL)
 
   if (isupper(*name) && *s == '=')
     {
-    if (d != NULL)
+    if (d)
       {
-      if (d->driver_name == NULL)
+      if (!d->driver_name)
         log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
           "no driver defined for %s \"%s\"", class, d->name);
       (d->info->init)(d);
@@ -3602,9 +3888,9 @@ while ((buffer = get_config_line()) != NULL)
 
     /* Finish off initializing the previous driver. */
 
-    if (d != NULL)
+    if (d)
       {
-      if (d->driver_name == NULL)
+      if (!d->driver_name)
         log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
           "no driver defined for %s \"%s\"", class, d->name);
       (d->info->init)(d);
@@ -3612,7 +3898,7 @@ while ((buffer = get_config_line()) != NULL)
 
     /* Check that we haven't already got a driver of this name */
 
-    for (d = *anchor; d != NULL; d = d->next)
+    for (d = *anchor; d; d = d->next)
       if (Ustrcmp(name, d->name) == 0)
         log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
           "there are two %ss called \"%s\"", class, name);
@@ -3623,7 +3909,7 @@ while ((buffer = get_config_line()) != NULL)
     d = store_get(instance_size);
     memcpy(d, instance_default, instance_size);
     *p = d;
-    p = &(d->next);
+    p = &d->next;
     d->name = string_copy(name);
 
     /* Clear out the "set" bits in the generic options */
@@ -3641,8 +3927,8 @@ while ((buffer = get_config_line()) != NULL)
   /* Not the start of a new driver. Give an error if we have not set up a
   current driver yet. */
 
-  if (d == NULL) log_write(0, LOG_PANIC_DIE|LOG_CONFIG_IN,
-    "%s name missing", class);
+  if (!d)
+    log_write(0, LOG_PANIC_DIE|LOG_CONFIG_IN, "%s name missing", class);
 
   /* First look to see if this is a generic option; if it is "driver",
   initialize the driver. If is it not a generic option, we can look for a
@@ -3651,7 +3937,7 @@ while ((buffer = get_config_line()) != NULL)
   if (readconf_handle_option(buffer, driver_optionlist,
         driver_optionlist_count, d, NULL))
     {
-    if (d->info == NULL && d->driver_name != NULL)
+    if (!d->info && d->driver_name)
       init_driver(d, drivers_available, size_of_info, class);
     }
 
@@ -3659,11 +3945,9 @@ while ((buffer = get_config_line()) != NULL)
   live therein. A flag with each option indicates if it is in the public
   block. */
 
-  else if (d->info != NULL)
-    {
+  else if (d->info)
     readconf_handle_option(buffer, d->info->options,
       *(d->info->options_count), d, US"option \"%s\" unknown");
-    }
 
   /* The option is not generic and the driver name has not yet been given. */
 
@@ -3673,9 +3957,9 @@ while ((buffer = get_config_line()) != NULL)
 
 /* Run the initialization function for the final driver. */
 
-if (d != NULL)
+if (d)
   {
-  if (d->driver_name == NULL)
+  if (!d->driver_name)
     log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
       "no driver defined for %s \"%s\"", class, d->name);
   (d->info->init)(d);
@@ -4015,6 +4299,21 @@ while ((p = get_config_line()))
 *         Initialize authenticators              *
 *************************************************/
 
+static void
+readconf_options_auths(void)
+{
+struct auth_info * ai;
+
+readconf_options_from_list(optionlist_auths, optionlist_auths_size, US"AU");
+
+for (ai = auths_available; ai->driver_name[0]; ai++)
+  {
+  macro_create(string_sprintf("_DRVR_AUTH_%T", ai->driver_name), US"y", FALSE, TRUE);
+  readconf_options_from_list(ai->options, (unsigned)*ai->options_count, ai->driver_name);
+  }
+}
+
+
 /* Read the authenticators section of the configuration file.
 
 Arguments:   none
@@ -4025,6 +4324,7 @@ static void
 auths_init(void)
 {
 auth_instance *au, *bu;
+
 readconf_driver_init(US"authenticator",
   (driver_instance **)(&auths),      /* chain anchor */
   (driver_info *)auths_available,    /* available drivers */
@@ -4034,22 +4334,19 @@ readconf_driver_init(US"authenticator",
   optionlist_auths,                  /* generic options */
   optionlist_auths_size);
 
-for (au = auths; au != NULL; au = au->next)
+for (au = auths; au; au = au->next)
   {
-  if (au->public_name == NULL)
+  if (!au->public_name)
     log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "no public name specified for "
       "the %s authenticator", au->name);
-  for (bu = au->next; bu != NULL; bu = bu->next)
-    {
+
+  for (bu = au->next; bu; bu = bu->next)
     if (strcmpic(au->public_name, bu->public_name) == 0)
-      {
       if ((au->client && bu->client) || (au->server && bu->server))
         log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "two %s authenticators "
           "(%s and %s) have the same public name (%s)",
-          (au->client)? US"client" : US"server", au->name, bu->name,
+          au->client ? US"client" : US"server", au->name, bu->name,
           au->public_name);
-      }
-    }
   }
 }
 
@@ -4269,10 +4566,10 @@ current = next;
 /* List the parsed config lines, care about nice formatting and
 hide the <hide> values unless we're the admin user */
 void
-print_config(BOOL admin)
+print_config(BOOL admin, BOOL terse)
 {
 config_line_item *i;
-const int TS = 2;
+const int TS = terse ? 0 : 2;
 int indent = 0;
 
 for (i = config_lines; i; i = i->next)
@@ -4312,7 +4609,7 @@ for (i = config_lines; i; i = i->next)
   /* begin lines are left aligned */
   else if (Ustrncmp(current, "begin", 5) == 0 && isspace(current[5]))
     {
-    puts("");
+    if (!terse) puts("");
     puts(CCS current);
     indent = TS;
     }
@@ -4320,7 +4617,8 @@ for (i = config_lines; i; i = i->next)
   /* router/acl/transport block names */
   else if (current[Ustrlen(current)-1] == ':' && !Ustrchr(current, '='))
     {
-    printf("\n%*s%s\n", TS, "", current);
+    if (!terse) puts("");
+    printf("%*s%s\n", TS, "", current);
     indent = 2 * TS;
     }
 
diff --git a/src/src/receive.c b/src/src/receive.c
index a479e12cd..e53587619 100644
--- a/src/src/receive.c
+++ b/src/src/receive.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Code for receiving a message and setting up spool files. */
@@ -23,7 +23,7 @@ extern int dcc_ok;
 
 static FILE   *data_file = NULL;
 static int     data_fd = -1;
-static uschar  spool_name[256];
+static uschar *spool_name = US"";
 
 
 
@@ -124,6 +124,7 @@ receive_statvfs(BOOL isspool, int *inodeptr)
 {
 #ifdef HAVE_STATFS
 struct STATVFS statbuf;
+struct stat dummy;
 uschar *path;
 uschar *name;
 uschar buffer[1024];
@@ -180,12 +181,18 @@ else
 memset(&statbuf, 0, sizeof(statbuf));
 
 if (STATVFS(CS path, &statbuf) != 0)
-  {
-  log_write(0, LOG_MAIN|LOG_PANIC, "cannot accept message: failed to stat "
-    "%s directory %s: %s", name, spool_directory, strerror(errno));
-  smtp_closedown(US"spool or log directory problem");
-  exim_exit(EXIT_FAILURE);
-  }
+  if (stat(CS path, &dummy) == -1 && errno == ENOENT)
+    {				/* Can happen on first run after installation */
+    *inodeptr = -1;
+    return -1;
+    }
+  else
+    {
+    log_write(0, LOG_MAIN|LOG_PANIC, "cannot accept message: failed to stat "
+      "%s directory %s: %s", name, path, strerror(errno));
+    smtp_closedown(US"spool or log directory problem");
+    exim_exit(EXIT_FAILURE);
+    }
 
 *inodeptr = (statbuf.F_FILES > 0)? statbuf.F_FAVAIL : -1;
 
@@ -193,9 +200,9 @@ if (STATVFS(CS path, &statbuf) != 0)
 
 return (int)(((double)statbuf.F_BAVAIL * (double)statbuf.F_FRSIZE)/1024.0);
 
+#else
 /* Unable to find partition sizes in this environment. */
 
-#else
 *inodeptr = -1;
 return -1;
 #endif
@@ -682,7 +689,8 @@ while ((ch = (receive_getc)()) != EOF)
     case 1:                         /* After written "\n" */
     if (ch == '.') { ch_state = 3; continue; }
     if (ch == '\r') { ch_state = 2; continue; }
-    if (ch != '\n') ch_state = 0; else linelength = -1;
+    if (ch == '\n') { body_linecount++; linelength = -1; }
+    else ch_state = 0;
     break;
 
     case 2:
@@ -776,7 +784,7 @@ read_message_data_smtp(FILE *fout)
 {
 int ch_state = 0;
 int ch;
-register int linelength = 0;
+int linelength = 0;
 
 while ((ch = (receive_getc)()) != EOF)
   {
@@ -866,7 +874,7 @@ while ((ch = (receive_getc)()) != EOF)
 
   message_size++;
   linelength++;
-  if (fout != NULL)
+  if (fout)
     {
     if (fputc(ch, fout) == EOF) return END_WERROR;
     if (message_size > thismessage_size_limit) return END_SIZE;
@@ -875,7 +883,7 @@ while ((ch = (receive_getc)()) != EOF)
     (void) cutthrough_put_nl();
   else
     {
-    uschar c= ch;
+    uschar c = ch;
     (void) cutthrough_puts(&c, 1);
     }
   }
@@ -889,6 +897,63 @@ return END_EOF;
 
 
 
+/* Variant of the above read_message_data_smtp() specialised for RFC 3030
+CHUNKING.  We assume that the incoming has proper CRLF, so only have to scan
+for and strip CR.  On the downside there are more protocol reasons to stop.
+
+Arguments:
+  fout      a FILE to which to write the message; NULL if skipping
+
+Returns:    One of the END_xxx values indicating why it stopped reading
+*/
+
+static int
+read_message_bdat_smtp(FILE *fout)
+{
+int ch;
+int linelength = 0;
+
+for (;;) switch (ch = bdat_getc())
+  {
+  case EOF: return END_EOF;
+  case EOD: return END_DOT;
+  case ERR: return END_PROTOCOL;
+
+  case '\r':
+    body_linecount++;
+    if (linelength > max_received_linelength)
+      max_received_linelength = linelength;
+    linelength = -1;
+    break;
+
+  case 0:
+    body_zerocount++;
+    /*FALLTHROUGH*/
+  default:
+    message_size++;
+    linelength++;
+    if (fout)
+      {
+      if (fputc(ch, fout) == EOF) return END_WERROR;
+      if (message_size > thismessage_size_limit) return END_SIZE;
+      }
+#ifdef notyet
+    if(ch == '\n')
+      (void) cutthrough_put_nl();
+    else
+      {
+      uschar c = ch;
+      (void) cutthrough_puts(&c, 1);
+      }
+#endif
+    break;
+  }
+/*NOTREACHED*/
+}
+
+
+
+
 /*************************************************
 *             Swallow SMTP message               *
 *************************************************/
@@ -905,6 +970,7 @@ Returns:     nothing
 void
 receive_swallow_smtp(void)
 {
+/*XXX CHUNKING: not enough.  read chunks until RSET? */
 if (message_ended >= END_NOTENDED)
   message_ended = read_message_data_smtp(NULL);
 }
@@ -927,6 +993,7 @@ handle_lost_connection(uschar *s)
 {
 log_write(L_lost_incoming_connection | L_smtp_connection, LOG_MAIN,
   "%s lost while reading message data%s", smtp_get_connection_info(), s);
+smtp_notquit_exit(US"connection-lost", NULL, NULL);
 return US"421 Lost incoming connection";
 }
 
@@ -961,10 +1028,12 @@ if (error_handling == ERRORS_SENDER)
   error_block eblock;
   eblock.next = NULL;
   eblock.text1 = text1;
+  eblock.text2 = US"";
   if (!moan_to_sender(errcode, &eblock, hptr, f, FALSE))
     error_rc = EXIT_FAILURE;
   }
-else fprintf(stderr, "exim: %s%s\n", text2, text1);  /* Sic */
+else
+  fprintf(stderr, "exim: %s%s\n", text2, text1);  /* Sic */
 (void)fclose(f);
 exim_exit(error_rc);
 }
@@ -1121,16 +1190,17 @@ Returns:      the extended string
 */
 
 static uschar *
-add_host_info_for_log(uschar *s, int *sizeptr, int *ptrptr)
+add_host_info_for_log(uschar * s, int * sizeptr, int * ptrptr)
 {
-if (sender_fullhost != NULL)
+if (sender_fullhost)
   {
+  if (LOGGING(dnssec) && sender_host_dnssec)	/*XXX sender_helo_dnssec? */
+    s = string_cat(s, sizeptr, ptrptr, US" DS");
   s = string_append(s, sizeptr, ptrptr, 2, US" H=", sender_fullhost);
   if (LOGGING(incoming_interface) && interface_address != NULL)
     {
-    uschar *ss = string_sprintf(" I=[%s]:%d", interface_address,
-      interface_port);
-    s = string_cat(s, sizeptr, ptrptr, ss, Ustrlen(ss));
+    s = string_cat(s, sizeptr, ptrptr,
+      string_sprintf(" I=[%s]:%d", interface_address, interface_port));
     }
   }
 if (sender_ident != NULL)
@@ -1290,7 +1360,7 @@ else if (rc != OK)
   if (  smtp_input
      && smtp_handle_acl_fail(ACL_WHERE_MIME, rc, user_msg, log_msg) != 0)
     {
-    *smtp_yield_ptr = FALSE;    /* No more messsages after dropped connection */
+    *smtp_yield_ptr = FALSE;    /* No more messages after dropped connection */
     *smtp_reply_ptr = US"";     /* Indicate reply already sent */
     }
   message_id[0] = 0;            /* Indicate no message accepted */
@@ -1316,7 +1386,7 @@ if (recipients_count == 1) received_for = recipients_list[0].address;
 received = expand_string(received_header_text);
 received_for = NULL;
 
-if (received == NULL)
+if (!received)
   {
   if(spool_name[0] != 0)
     Uunlink(spool_name);           /* Lose the data file */
@@ -1540,7 +1610,7 @@ yet, initialize the size and warning count, and deal with no size limit. */
 message_id[0] = 0;
 data_file = NULL;
 data_fd = -1;
-spool_name[0] = 0;
+spool_name = US"";
 message_size = 0;
 warning_count = 0;
 received_count = 1;            /* For the one we will add */
@@ -1553,8 +1623,10 @@ message_linecount = body_linecount = body_zerocount =
   max_received_linelength = 0;
 
 #ifndef DISABLE_DKIM
-/* Call into DKIM to set up the context. */
-if (smtp_input && !smtp_batched_input && !dkim_disable_verify) dkim_exim_verify_init();
+/* Call into DKIM to set up the context.  In CHUNKING mode
+we clear the dot-stuffing flag */
+if (smtp_input && !smtp_batched_input && !dkim_disable_verify)
+  dkim_exim_verify_init(chunking_state <= CHUNKING_OFFERED);
 #endif
 
 #ifdef EXPERIMENTAL_DMARC
@@ -2469,7 +2541,7 @@ it will fit. */
 to be the least significant base-62 digit of the time of arrival. Otherwise
 ensure that it is an empty string. */
 
-message_subdir[0] = split_spool_directory? message_id[5] : 0;
+message_subdir[0] = split_spool_directory ? message_id[5] : 0;
 
 /* Now that we have the message-id, if there is no message-id: header, generate
 one, but only for local (without suppress_local_fixups) or submission mode
@@ -2828,6 +2900,14 @@ if (filter_test != FTEST_NONE)
   return message_ended == END_DOT;
   }
 
+/*XXX CHUNKING: need to cancel cutthrough under BDAT, for now.  In future,
+think more if it could be handled.  Cannot do onward CHUNKING unless
+inbound is, but inbound chunking ought to be ok with outbound plain.
+Could we do onward CHUNKING given inbound CHUNKING?
+*/
+if (chunking_state > CHUNKING_OFFERED)
+  cancel_cutthrough_connection("chunking active");
+
 /* Cutthrough delivery:
 We have to create the Received header now rather than at the end of reception,
 so the timestamp behaviour is a change to the normal case.
@@ -2858,20 +2938,18 @@ if (cutthrough.fd >= 0)
 
 /* Open a new spool file for the data portion of the message. We need
 to access it both via a file descriptor and a stream. Try to make the
-directory if it isn't there. Note re use of sprintf: spool_directory
-is checked on input to be < 200 characters long. */
+directory if it isn't there. */
+
+spool_name = spool_fname(US"input", message_subdir, message_id, US"-D");
+DEBUG(D_receive) debug_printf("Data file name: %s\n", spool_name);
 
-sprintf(CS spool_name, "%s/input/%s/%s-D", spool_directory, message_subdir,
-  message_id);
-data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
-if (data_fd < 0)
+if ((data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE)) < 0)
   {
   if (errno == ENOENT)
     {
-    uschar temp[16];
-    sprintf(CS temp, "input/%s", message_subdir);
-    if (message_subdir[0] == 0) temp[5] = 0;
-    (void)directory_make(spool_directory, temp, INPUT_DIRECTORY_MODE, TRUE);
+    (void) directory_make(spool_directory,
+		        spool_sname(US"input", message_subdir),
+			INPUT_DIRECTORY_MODE, TRUE);
     data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
     }
   if (data_fd < 0)
@@ -2927,7 +3005,9 @@ if (!ferror(data_file) && !(receive_feof)() && message_ended != END_DOT)
   {
   if (smtp_input)
     {
-    message_ended = read_message_data_smtp(data_file);
+    message_ended = chunking_state > CHUNKING_OFFERED
+      ? read_message_bdat_smtp(data_file)
+      : read_message_data_smtp(data_file);
     receive_linecount++;                /* The terminating "." line */
     }
   else message_ended = read_message_data(data_file);
@@ -2935,51 +3015,64 @@ if (!ferror(data_file) && !(receive_feof)() && message_ended != END_DOT)
   receive_linecount += body_linecount;  /* For BSMTP errors mainly */
   message_linecount += body_linecount;
 
-  /* Handle premature termination of SMTP */
-
-  if (smtp_input && message_ended == END_EOF)
+  switch (message_ended)
     {
-    Uunlink(spool_name);                     /* Lose data file when closed */
-    cancel_cutthrough_connection("sender closed connection");
-    message_id[0] = 0;                       /* Indicate no message accepted */
-    smtp_reply = handle_lost_connection(US"");
-    smtp_yield = FALSE;
-    goto TIDYUP;                             /* Skip to end of function */
-    }
+    /* Handle premature termination of SMTP */
 
-  /* Handle message that is too big. Don't use host_or_ident() in the log
-  message; we want to see the ident value even for non-remote messages. */
+    case END_EOF:
+      if (smtp_input)
+	{
+	Uunlink(spool_name);                 /* Lose data file when closed */
+	cancel_cutthrough_connection("sender closed connection");
+	message_id[0] = 0;                   /* Indicate no message accepted */
+	smtp_reply = handle_lost_connection(US"");
+	smtp_yield = FALSE;
+	goto TIDYUP;                         /* Skip to end of function */
+	}
+      break;
 
-  if (message_ended == END_SIZE)
-    {
-    Uunlink(spool_name);                /* Lose the data file when closed */
-    cancel_cutthrough_connection("mail too big");
-    if (smtp_input) receive_swallow_smtp();  /* Swallow incoming SMTP */
+    /* Handle message that is too big. Don't use host_or_ident() in the log
+    message; we want to see the ident value even for non-remote messages. */
 
-    log_write(L_size_reject, LOG_MAIN|LOG_REJECT, "rejected from <%s>%s%s%s%s: "
-      "message too big: read=%d max=%d",
-      sender_address,
-      (sender_fullhost == NULL)? "" : " H=",
-      (sender_fullhost == NULL)? US"" : sender_fullhost,
-      (sender_ident == NULL)? "" : " U=",
-      (sender_ident == NULL)? US"" : sender_ident,
-      message_size,
-      thismessage_size_limit);
+    case END_SIZE:
+      Uunlink(spool_name);                /* Lose the data file when closed */
+      cancel_cutthrough_connection("mail too big");
+      if (smtp_input) receive_swallow_smtp();  /* Swallow incoming SMTP */
 
-    if (smtp_input)
-      {
-      smtp_reply = US"552 Message size exceeds maximum permitted";
-      message_id[0] = 0;               /* Indicate no message accepted */
-      goto TIDYUP;                     /* Skip to end of function */
-      }
-    else
-      {
-      fseek(data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
-      give_local_error(ERRMESS_TOOBIG,
-        string_sprintf("message too big (max=%d)", thismessage_size_limit),
-        US"message rejected: ", error_rc, data_file, header_list);
-      /* Does not return */
-      }
+      log_write(L_size_reject, LOG_MAIN|LOG_REJECT, "rejected from <%s>%s%s%s%s: "
+	"message too big: read=%d max=%d",
+	sender_address,
+	(sender_fullhost == NULL)? "" : " H=",
+	(sender_fullhost == NULL)? US"" : sender_fullhost,
+	(sender_ident == NULL)? "" : " U=",
+	(sender_ident == NULL)? US"" : sender_ident,
+	message_size,
+	thismessage_size_limit);
+
+      if (smtp_input)
+	{
+	smtp_reply = US"552 Message size exceeds maximum permitted";
+	message_id[0] = 0;               /* Indicate no message accepted */
+	goto TIDYUP;                     /* Skip to end of function */
+	}
+      else
+	{
+	fseek(data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
+	give_local_error(ERRMESS_TOOBIG,
+	  string_sprintf("message too big (max=%d)", thismessage_size_limit),
+	  US"message rejected: ", error_rc, data_file, header_list);
+	/* Does not return */
+	}
+      break;
+
+    /* Handle bad BDAT protocol sequence */
+
+    case END_PROTOCOL:
+      Uunlink(spool_name);		/* Lose the data file when closed */
+      cancel_cutthrough_connection("sender protocol error");
+      smtp_reply = US"";		/* Response already sent */
+      message_id[0] = 0;		/* Indicate no message accepted */
+      goto TIDYUP;			/* Skip to end of function */
     }
   }
 
@@ -3162,9 +3255,8 @@ user_msg = NULL;
 enable_dollar_recipients = TRUE;
 
 if (recipients_count == 0)
-  {
-  blackholed_by = recipients_discarded? US"MAIL ACL" : US"RCPT ACL";
-  }
+  blackholed_by = recipients_discarded ? US"MAIL ACL" : US"RCPT ACL";
+
 else
   {
   /* Handle interactive SMTP messages */
@@ -3180,18 +3272,15 @@ else
       dkim_exim_verify_finish();
 
       /* Check if we must run the DKIM ACL */
-      if ((acl_smtp_dkim != NULL) &&
-          (dkim_verify_signers != NULL) &&
-          (dkim_verify_signers[0] != '\0'))
+      if (acl_smtp_dkim && dkim_verify_signers && *dkim_verify_signers)
         {
         uschar *dkim_verify_signers_expanded =
           expand_string(dkim_verify_signers);
-        if (dkim_verify_signers_expanded == NULL)
-          {
+        if (!dkim_verify_signers_expanded)
           log_write(0, LOG_MAIN|LOG_PANIC,
             "expansion of dkim_verify_signers option failed: %s",
             expand_string_message);
-          }
+
         else
           {
           int sep = 0;
@@ -3200,28 +3289,23 @@ else
           uschar *seen_items = NULL;
           int     seen_items_size = 0;
           int     seen_items_offset = 0;
-          uschar itembuf[256];
           /* Default to OK when no items are present */
           rc = OK;
-          while ((item = string_nextinlist(&ptr, &sep,
-                                           itembuf,
-                                           sizeof(itembuf))))
+          while ((item = string_nextinlist(&ptr, &sep, NULL, 0)))
             {
             /* Prevent running ACL for an empty item */
-            if (!item || (item[0] == '\0')) continue;
+            if (!item || !*item) continue;
 
             /* Only run ACL once for each domain or identity,
 	    no matter how often it appears in the expanded list. */
             if (seen_items)
               {
               uschar *seen_item = NULL;
-              uschar seen_item_buf[256];
               const uschar *seen_items_list = seen_items;
               BOOL seen_this_item = FALSE;
 
               while ((seen_item = string_nextinlist(&seen_items_list, &sep,
-                                                    seen_item_buf,
-                                                    sizeof(seen_item_buf))))
+                                                    NULL, 0)))
 		if (Ustrcmp(seen_item,item) == 0)
 		  {
 		  seen_this_item = TRUE;
@@ -3273,7 +3357,7 @@ else
             {
             Uunlink(spool_name);
             if (smtp_handle_acl_fail(ACL_WHERE_DKIM, rc, user_msg, log_msg) != 0)
-              smtp_yield = FALSE;    /* No more messsages after dropped connection */
+              smtp_yield = FALSE;    /* No more messages after dropped connection */
             smtp_reply = US"";       /* Indicate reply already sent */
             message_id[0] = 0;       /* Indicate no message accepted */
             goto TIDYUP;             /* Skip to end of function */
@@ -3391,7 +3475,7 @@ else
 	dcc_ok = 0;
 #endif
         if (smtp_handle_acl_fail(ACL_WHERE_DATA, rc, user_msg, log_msg) != 0)
-          smtp_yield = FALSE;    /* No more messsages after dropped connection */
+          smtp_yield = FALSE;    /* No more messages after dropped connection */
         smtp_reply = US"";       /* Indicate reply already sent */
         message_id[0] = 0;       /* Indicate no message accepted */
         goto TIDYUP;             /* Skip to end of function */
@@ -3647,11 +3731,11 @@ signal(SIGINT, SIG_IGN);
 deliver_firsttime = TRUE;
 
 #ifdef EXPERIMENTAL_BRIGHTMAIL
-if (bmi_run == 1) {
-  /* rewind data file */
+if (bmi_run == 1)
+  { /* rewind data file */
   lseek(data_fd, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
   bmi_verdicts = bmi_process_message(header_list, data_fd);
-};
+  }
 #endif
 
 /* Update the timstamp in our Received: header to account for any time taken by
@@ -3689,7 +3773,6 @@ if (host_checking || blackholed_by != NULL)
 /* Write the -H file */
 
 else
-  {
   if ((msg_size = spool_write_header(message_id, SW_RECEIVING, &errmsg)) < 0)
     {
     log_write(0, LOG_MAIN, "Message abandoned: %s", errmsg);
@@ -3709,7 +3792,6 @@ else
       /* Does not return */
       }
     }
-  }
 
 
 /* The message has now been successfully received. */
@@ -3748,9 +3830,10 @@ size = 256;
 sptr = 0;
 s = store_get(size);
 
-s = string_append(s, &size, &sptr, 2, US"<= ",
-  (sender_address[0] == 0)? US"<>" : sender_address);
-if (message_reference != NULL)
+s = string_append(s, &size, &sptr, 2,
+  fake_response == FAIL ? US"(= " : US"<= ",
+  sender_address[0] == 0 ? US"<>" : sender_address);
+if (message_reference)
   s = string_append(s, &size, &sptr, 2, US" R=", message_reference);
 
 s = add_host_info_for_log(s, &size, &sptr);
@@ -3760,7 +3843,7 @@ if (LOGGING(tls_cipher) && tls_in.cipher)
   s = string_append(s, &size, &sptr, 2, US" X=", tls_in.cipher);
 if (LOGGING(tls_certificate_verified) && tls_in.cipher)
   s = string_append(s, &size, &sptr, 2, US" CV=",
-    tls_in.certificate_verified? "yes":"no");
+    tls_in.certificate_verified ? "yes":"no");
 if (LOGGING(tls_peerdn) && tls_in.peerdn)
   s = string_append(s, &size, &sptr, 3, US" DN=\"",
     string_printing(tls_in.peerdn), US"\"");
@@ -3772,17 +3855,17 @@ if (LOGGING(tls_sni) && tls_in.sni)
 if (sender_host_authenticated)
   {
   s = string_append(s, &size, &sptr, 2, US" A=", sender_host_authenticated);
-  if (authenticated_id != NULL)
+  if (authenticated_id)
     {
     s = string_append(s, &size, &sptr, 2, US":", authenticated_id);
-    if (LOGGING(smtp_mailauth) && authenticated_sender != NULL)
+    if (LOGGING(smtp_mailauth) && authenticated_sender)
       s = string_append(s, &size, &sptr, 2, US":", authenticated_sender);
     }
   }
 
 #ifndef DISABLE_PRDR
 if (prdr_requested)
-  s = string_append(s, &size, &sptr, 1, US" PRDR");
+  s = string_catn(s, &size, &sptr, US" PRDR", 5);
 #endif
 
 #ifdef SUPPORT_PROXY
@@ -3790,6 +3873,9 @@ if (proxy_session && LOGGING(proxy))
   s = string_append(s, &size, &sptr, 2, US" PRX=", proxy_local_address);
 #endif
 
+if (chunking_state > CHUNKING_OFFERED)
+  s = string_catn(s, &size, &sptr, US" K", 2);
+
 sprintf(CS big_buffer, "%d", msg_size);
 s = string_append(s, &size, &sptr, 2, US" S=", big_buffer);
 
@@ -3803,12 +3889,15 @@ if (LOGGING(8bitmime))
   s = string_append(s, &size, &sptr, 2, US" M8S=", big_buffer);
   }
 
+if (*queue_name)
+  s = string_append(s, &size, &sptr, 2, US" Q=", queue_name);
+
 /* If an addr-spec in a message-id contains a quoted string, it can contain
 any characters except " \ and CR and so in particular it can contain NL!
 Therefore, make sure we use a printing-characters only version for the log.
 Also, allow for domain literals in the message id. */
 
-if (msgid_header != NULL)
+if (msgid_header)
   {
   uschar *old_id;
   BOOL save_allow_domain_literals = allow_domain_literals;
@@ -3857,16 +3946,15 @@ if (message_logs && blackholed_by == NULL)
   {
   int fd;
 
-  sprintf(CS spool_name, "%s/msglog/%s/%s", spool_directory, message_subdir,
-    message_id);
-  fd = Uopen(spool_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE);
-
-  if (fd < 0 && errno == ENOENT)
+  spool_name = spool_fname(US"msglog", message_subdir, message_id, US"");
+  
+  if (  (fd = Uopen(spool_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) < 0
+     && errno == ENOENT
+     )
     {
-    uschar temp[16];
-    sprintf(CS temp, "msglog/%s", message_subdir);
-    if (message_subdir[0] == 0) temp[6] = 0;
-    (void)directory_make(spool_directory, temp, MSGLOG_DIRECTORY_MODE, TRUE);
+    (void)directory_make(spool_directory,
+			spool_sname(US"msglog", message_subdir),
+			MSGLOG_DIRECTORY_MODE, TRUE);
     fd = Uopen(spool_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE);
     }
 
@@ -3892,7 +3980,9 @@ if (message_logs && blackholed_by == NULL)
       if (deliver_freeze) fprintf(message_log, "%s frozen by %s\n", now,
         frozen_by);
       if (queue_only_policy) fprintf(message_log,
-        "%s no immediate delivery: queued by %s\n", now, queued_by);
+        "%s no immediate delivery: queued%s%s by %s\n", now,
+        *queue_name ? " in " : "", *queue_name ? CS queue_name : "",
+	queued_by);
       (void)fclose(message_log);
       }
     }
@@ -3937,31 +4027,23 @@ if (smtp_input && sender_host_address != NULL && !sender_host_notsocket &&
     int c = (receive_getc)();
     if (c != EOF) (receive_ungetc)(c); else
       {
-      uschar *msg = US"SMTP connection lost after final dot";
+      smtp_notquit_exit(US"connection-lost", NULL, NULL);
       smtp_reply = US"";    /* No attempt to send a response */
       smtp_yield = FALSE;   /* Nothing more on this connection */
 
       /* Re-use the log line workspace */
 
       sptr = 0;
-      s = string_cat(s, &size, &sptr, msg, Ustrlen(msg));
+      s = string_cat(s, &size, &sptr, US"SMTP connection lost after final dot");
       s = add_host_info_for_log(s, &size, &sptr);
       s[sptr] = 0;
       log_write(0, LOG_MAIN, "%s", s);
 
       /* Delete the files for this aborted message. */
 
-      sprintf(CS spool_name, "%s/input/%s/%s-D", spool_directory,
-        message_subdir, message_id);
-      Uunlink(spool_name);
-
-      sprintf(CS spool_name, "%s/input/%s/%s-H", spool_directory,
-        message_subdir, message_id);
-      Uunlink(spool_name);
-
-      sprintf(CS spool_name, "%s/msglog/%s/%s", spool_directory,
-        message_subdir, message_id);
-      Uunlink(spool_name);
+      Uunlink(spool_fname(US"input", message_subdir, message_id, US"-D"));
+      Uunlink(spool_fname(US"input", message_subdir, message_id, US"-H"));
+      Uunlink(spool_fname(US"msglog", message_subdir, message_id, US""));
 
       goto TIDYUP;
       }
@@ -3977,7 +4059,8 @@ for this message. */
    Send dot onward.  If accepted, wipe the spooled files, log as delivered and accept
    the sender's dot (below).
    If rejected: copy response to sender, wipe the spooled files, log approriately.
-   If temp-reject: accept to sender, keep the spooled files.
+   If temp-reject: normally accept to sender, keep the spooled file - unless defer=pass
+   in which case pass temp-reject back to initiator and dump the files.
 
    Having the normal spool files lets us do data-filtering, and store/forward on temp-reject.
 
@@ -3985,7 +4068,7 @@ for this message. */
 */
 if(cutthrough.fd >= 0)
   {
-  uschar * msg= cutthrough_finaldot();	/* Ask the target system to accept the messsage */
+  uschar * msg= cutthrough_finaldot();	/* Ask the target system to accept the message */
 					/* Logging was done in finaldot() */
   switch(msg[0])
     {
@@ -3993,13 +4076,17 @@ if(cutthrough.fd >= 0)
       cutthrough_done = ACCEPTED;
       break;					/* message_id needed for SMTP accept below */
 
+    case '4':	/* Temp-reject. Keep spoolfiles and accept, unless defer-pass mode.
+      		... for which, pass back the exact error */
+      if (cutthrough.defer_pass) smtp_reply = string_copy_malloc(msg);
+      /*FALLTRHOUGH*/
+
     default:	/* Unknown response, or error.  Treat as temp-reject.         */
-    case '4':	/* Temp-reject. Keep spoolfiles and accept. */
       cutthrough_done = TMP_REJ;		/* Avoid the usual immediate delivery attempt */
       break;					/* message_id needed for SMTP accept below */
 
     case '5':	/* Perm-reject.  Do the same to the source.  Dump any spoolfiles */
-      smtp_reply= msg;		/* Pass on the exact error */
+      smtp_reply = string_copy_malloc(msg);		/* Pass on the exact error */
       cutthrough_done = PERM_REJ;
       break;
     }
@@ -4020,7 +4107,9 @@ if(!smtp_reply)
 
   if (deliver_freeze) log_write(0, LOG_MAIN, "frozen by %s", frozen_by);
   if (queue_only_policy) log_write(L_delay_delivery, LOG_MAIN,
-    "no immediate delivery: queued by %s", queued_by);
+    "no immediate delivery: queued%s%s by %s",
+    *queue_name ? " in " : "", *queue_name ? CS queue_name : "",       
+    queued_by);
   }
 receive_call_bombout = FALSE;
 
@@ -4076,15 +4165,15 @@ if (smtp_input)
 
   if (!smtp_batched_input)
     {
-    if (smtp_reply == NULL)
+    if (!smtp_reply)
       {
       if (fake_response != OK)
-        smtp_respond((fake_response == DEFER)? US"450" : US"550", 3, TRUE,
-          fake_response_text);
+        smtp_respond(fake_response == DEFER ? US"450" : US"550",
+	  3, TRUE, fake_response_text);
 
       /* An OK response is required; use "message" text if present. */
 
-      else if (user_msg != NULL)
+      else if (user_msg)
         {
         uschar *code = US"250";
         int len = 3;
@@ -4094,8 +4183,15 @@ if (smtp_input)
 
       /* Default OK response */
 
+      else if (chunking_state > CHUNKING_OFFERED)
+	{
+        smtp_printf("250- %u byte chunk, total %d\r\n250 OK id=%s\r\n",
+	    chunking_datasize, message_size+message_linecount, message_id);
+	chunking_state = CHUNKING_OFFERED;
+	}
       else
         smtp_printf("250 OK id=%s\r\n", message_id);
+
       if (host_checking)
         fprintf(stdout,
           "\n**** SMTP testing: that is not a real message id!\n\n");
@@ -4104,39 +4200,45 @@ if (smtp_input)
     /* smtp_reply is set non-empty */
 
     else if (smtp_reply[0] != 0)
-      {
       if (fake_response != OK && (smtp_reply[0] == '2'))
         smtp_respond((fake_response == DEFER)? US"450" : US"550", 3, TRUE,
           fake_response_text);
       else
         smtp_printf("%.1024s\r\n", smtp_reply);
-      }
 
     switch (cutthrough_done)
       {
-      case ACCEPTED: log_write(0, LOG_MAIN, "Completed");/* Delivery was done */
-      case PERM_REJ: {					/* Delete spool files */
-	      sprintf(CS spool_name, "%s/input/%s/%s-D", spool_directory,
-	        message_subdir, message_id);
-	      Uunlink(spool_name);
-	      sprintf(CS spool_name, "%s/input/%s/%s-H", spool_directory,
-	        message_subdir, message_id);
-	      Uunlink(spool_name);
-	      sprintf(CS spool_name, "%s/msglog/%s/%s", spool_directory,
-	        message_subdir, message_id);
-	      Uunlink(spool_name);
-	      }
-      case TMP_REJ: message_id[0] = 0;	  /* Prevent a delivery from starting */
-      default:break;
+      case ACCEPTED:
+	log_write(0, LOG_MAIN, "Completed");/* Delivery was done */
+      case PERM_REJ:
+							 /* Delete spool files */
+	Uunlink(spool_fname(US"input", message_subdir, message_id, US"-D"));
+	Uunlink(spool_fname(US"input", message_subdir, message_id, US"-H"));
+	Uunlink(spool_fname(US"msglog", message_subdir, message_id, US""));
+	message_id[0] = 0;	  /* Prevent a delivery from starting */
+	break;
+
+      case TMP_REJ:
+	if (cutthrough.defer_pass)
+	  {
+	  Uunlink(spool_fname(US"input", message_subdir, message_id, US"-D"));
+	  Uunlink(spool_fname(US"input", message_subdir, message_id, US"-H"));
+	  Uunlink(spool_fname(US"msglog", message_subdir, message_id, US""));
+	  }
+	message_id[0] = 0;	  /* Prevent a delivery from starting */
+      default:
+	break;
       }
     cutthrough.delivery = FALSE;
+    cutthrough.defer_pass = FALSE;
     }
 
   /* For batched SMTP, generate an error message on failure, and do
   nothing on success. The function moan_smtp_batch() does not return -
   it exits from the program with a non-zero return code. */
 
-  else if (smtp_reply != NULL) moan_smtp_batch(NULL, "%s", smtp_reply);
+  else if (smtp_reply)
+    moan_smtp_batch(NULL, "%s", smtp_reply);
   }
 
 
@@ -4145,7 +4247,7 @@ file has already been unlinked, and the header file was never written to disk.
 We must now indicate that nothing was received, to prevent a delivery from
 starting. */
 
-if (blackholed_by != NULL)
+if (blackholed_by)
   {
   const uschar *detail = local_scan_data
     ? string_printing(local_scan_data)
diff --git a/src/src/regex.c b/src/src/regex.c
index 3852ad8c5..9274f9095 100644
--- a/src/src/regex.c
+++ b/src/src/regex.c
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003-2015 */
-/* License: GPL */
+/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003-2015
+ * License: GPL
+ * Copyright (c) The Exim Maintainers 2016
+ */
 
 /* Code for matching regular expressions against headers and body.
  Called from acl.c. */
@@ -112,7 +114,12 @@ if (!mime_stream)				/* We are in the DATA ACL */
   }
 else
   {
-  f_pos = ftell(mime_stream);
+  if ((f_pos = ftell(mime_stream)) < 0)
+    {
+    log_write(0, LOG_MAIN|LOG_PANIC,
+	   "regex acl condition: mime_stream: %s", strerror(errno));
+    return DEFER;
+    }
   mbox_file = mime_stream;
   }
 
@@ -141,7 +148,12 @@ if (!mime_stream)
 else
   {
   clearerr(mime_stream);
-  fseek(mime_stream, f_pos, SEEK_SET);
+  if (fseek(mime_stream, f_pos, SEEK_SET) == -1)
+    {
+    log_write(0, LOG_MAIN|LOG_PANIC,
+	   "regex acl condition: mime_stream: %s", strerror(errno));
+    clearerr(mime_stream);
+    }
   }
 
 return ret;
diff --git a/src/src/retry.c b/src/src/retry.c
index 0099b6e6a..364591bd0 100644
--- a/src/src/retry.c
+++ b/src/src/retry.c
@@ -536,12 +536,12 @@ for (i = 0; i < 3; i++)
   {
   address_item *endaddr, *addr;
   address_item *last_first = NULL;
-  address_item **paddr = (i==0)? addr_succeed :
-    (i==1)? addr_failed : addr_defer;
+  address_item **paddr = i==0 ? addr_succeed :
+    i==1 ? addr_failed : addr_defer;
   address_item **saved_paddr = NULL;
 
-  DEBUG(D_retry) debug_printf("%s addresses:\n", (i == 0)? "Succeeded" :
-    (i == 1)? "Failed" : "Deferred");
+  DEBUG(D_retry) debug_printf("%s addresses:\n",
+    i == 0 ? "Succeeded" : i == 1 ? "Failed" : "Deferred");
 
   /* Loop for each address on the chain. For deferred addresses, the whole
   address times out unless one of its retry addresses has a retry rule that
@@ -553,22 +553,22 @@ for (i = 0; i < 3; i++)
   retry items for any parent addresses - these are typically "delete" items,
   because the parent must have succeeded in order to generate the child. */
 
-  while ((endaddr = *paddr) != NULL)
+  while ((endaddr = *paddr))
     {
     BOOL timed_out = FALSE;
     retry_item *rti;
 
-    for (addr = endaddr; addr != NULL; addr = addr->parent)
+    for (addr = endaddr; addr; addr = addr->parent)
       {
       int update_count = 0;
       int timedout_count = 0;
 
-      DEBUG(D_retry) debug_printf("%s%s\n", addr->address, (addr->retries == NULL)?
-        ": no retry items" : "");
+      DEBUG(D_retry) debug_printf(" %s%s\n", addr->address,
+       	addr->retries ? "" : ": no retry items");
 
       /* Loop for each retry item. */
 
-      for (rti = addr->retries; rti != NULL; rti = rti->next)
+      for (rti = addr->retries; rti; rti = rti->next)
         {
         uschar *message;
         int message_length, message_space, failing_interval, next_try;
@@ -582,10 +582,10 @@ for (i = 0; i < 3; i++)
         opening if no addresses have retry items - common when none have yet
         reached their retry next try time. */
 
-        if (dbm_file == NULL)
+        if (!dbm_file)
           dbm_file = dbfn_open(US"retry", O_RDWR, &dbblock, TRUE);
 
-        if (dbm_file == NULL)
+        if (!dbm_file)
           {
           DEBUG(D_deliver|D_retry|D_hints_lookup)
             debug_printf("retry database not available for updating\n");
@@ -600,13 +600,13 @@ for (i = 0; i < 3; i++)
         but the address gets delivered to the second one. This optimization
         doesn't succeed in cleaning out all the dead entries, but it helps. */
 
-        if (*addr_defer == NULL && (rti->flags & rf_message) != 0)
+        if (!*addr_defer  &&  rti->flags & rf_message)
           rti->flags |= rf_delete;
 
         /* Handle the case of a request to delete the retry info for this
         destination. */
 
-        if ((rti->flags & rf_delete) != 0)
+        if (rti->flags & rf_delete)
           {
           (void)dbfn_delete(dbm_file, rti->key);
           DEBUG(D_retry)
@@ -626,21 +626,21 @@ for (i = 0; i < 3; i++)
         information is found, we can't generate a retry time, so there is
         no point updating the database. This retry item is timed out. */
 
-        if ((retry = retry_find_config(rti->key + 2,
-             ((rti->flags & rf_host) != 0)? addr->domain : NULL,
-             rti->basic_errno, rti->more_errno)) == NULL)
+        if (!(retry = retry_find_config(rti->key + 2,
+             rti->flags & rf_host ? addr->domain : NULL,
+             rti->basic_errno, rti->more_errno)))
           {
           DEBUG(D_retry) debug_printf("No configured retry item for %s%s%s\n",
             rti->key,
-            ((rti->flags & rf_host) != 0)? US" or " : US"",
-            ((rti->flags & rf_host) != 0)? addr->domain : US"");
+            rti->flags & rf_host ? US" or " : US"",
+            rti->flags & rf_host ? addr->domain : US"");
           if (addr == endaddr) timedout_count++;
           continue;
           }
 
         DEBUG(D_retry)
           {
-          if ((rti->flags & rf_host) != 0)
+          if (rti->flags & rf_host)
             debug_printf("retry for %s (%s) = %s %d %d\n", rti->key,
               addr->domain, retry->pattern, retry->basic_errno,
               retry->more_errno);
@@ -653,9 +653,11 @@ for (i = 0; i < 3; i++)
         records have a maximum data length, we enforce a limit. There isn't
         much point in keeping a huge message here, anyway. */
 
-        message = (rti->basic_errno > 0)? US strerror(rti->basic_errno) :
-          (rti->message == NULL)?
-          US"unknown error" : US string_printing(rti->message);
+        message = rti->basic_errno > 0
+	  ? US strerror(rti->basic_errno)
+	  : rti->message
+	  ? US string_printing(rti->message)
+	  : US"unknown error";
         message_length = Ustrlen(message);
         if (message_length > 150) message_length = 150;
 
@@ -663,11 +665,11 @@ for (i = 0; i < 3; i++)
         Ignore an old one if it is too old since it was last updated. */
 
         retry_record = dbfn_read(dbm_file, rti->key);
-        if (retry_record != NULL &&
-            now - retry_record->time_stamp > retry_data_expire)
+        if (  retry_record
+	   && now - retry_record->time_stamp > retry_data_expire)
           retry_record = NULL;
 
-        if (retry_record == NULL)
+        if (!retry_record)
           {
           retry_record = store_get(sizeof(dbdata_retry) + message_length);
           message_space = message_length;
@@ -691,7 +693,7 @@ for (i = 0; i < 3; i++)
         successful delivery will reset the first_failed time, and this can lead
         to a failing message being retried too often. */
 
-        if ((rti->flags & rf_host) == 0 && message_age > failing_interval)
+        if (!(rti->flags & rf_host) && message_age > failing_interval)
           failing_interval = message_age;
 
         /* Search for the current retry rule. The cutoff time of the
@@ -702,7 +704,7 @@ for (i = 0; i < 3; i++)
         always times out, but we can't compute a retry time. */
 
         final_rule = NULL;
-        for (rule = retry->rules; rule != NULL; rule = rule->next)
+        for (rule = retry->rules; rule; rule = rule->next)
           {
           if (failing_interval <= rule->timeout) break;
           final_rule = rule;
@@ -714,10 +716,8 @@ for (i = 0; i < 3; i++)
         flag is false (can be forced via fixdb from outside, but ensure it is
         consistent with the rules whenever we go through here). */
 
-        if (rule != NULL)
-          {
+        if (rule)
           retry_record->expired = FALSE;
-          }
 
         /* Otherwise, set the retry timeout expired, and set the final rule
         as the one from which to compute the next retry time. Subsequent
@@ -756,13 +756,14 @@ for (i = 0; i < 3; i++)
         this is a small bit of code, and it does no harm to leave it in place,
         just in case. */
 
-        if (received_time <= retry_record->first_failed &&
-            addr == endaddr && !retry_record->expired && rule != NULL)
+        if (  received_time <= retry_record->first_failed
+	   && addr == endaddr
+	   && !retry_record->expired
+	   && rule)
           {
           retry_rule *last_rule;
-          for (last_rule = rule;
-               last_rule->next != NULL;
-               last_rule = last_rule->next);
+          for (last_rule = rule; last_rule->next; last_rule = last_rule->next)
+	    ;
           if (now - received_time > last_rule->timeout)
             {
             DEBUG(D_retry) debug_printf("on queue longer than maximum retry\n");
@@ -778,9 +779,12 @@ for (i = 0; i < 3; i++)
         case set the next retry time to now, so that one delivery attempt
         happens for subsequent messages. */
 
-        if (rule == NULL) next_try = now; else
+        if (!rule)
+	  next_try = now;
+	else
           {
-          if (rule->rule == 'F') next_try = now + rule->p1;
+          if (rule->rule == 'F')
+	    next_try = now + rule->p1;
           else  /* rule = 'G' or 'H' */
             {
             int last_predicted_gap =
@@ -790,9 +794,7 @@ for (i = 0; i < 3; i++)
               last_predicted_gap : last_actual_gap;
             int next_gap = (lastgap * rule->p2)/1000;
             if (rule->rule == 'G')
-              {
               next_try = now + ((lastgap < rule->p1)? rule->p1 : next_gap);
-              }
             else  /* The 'H' rule */
               {
               next_try = now + rule->p1;
@@ -853,7 +855,6 @@ for (i = 0; i < 3; i++)
       time was not reached (or because of hosts_max_try). */
 
       if (update_count > 0 && update_count == timedout_count)
-        {
         if (!testflag(endaddr, af_retry_skipped))
           {
           DEBUG(D_retry) debug_printf("timed out: all retries expired\n");
@@ -864,7 +865,6 @@ for (i = 0; i < 3; i++)
           DEBUG(D_retry)
             debug_printf("timed out but some hosts were skipped\n");
           }
-        }
       }     /* Loop for an address and its parents */
 
     /* If this is a deferred address, and retry processing was requested by
@@ -880,7 +880,7 @@ for (i = 0; i < 3; i++)
 
     if (i == 2)   /* Handling defers */
       {
-      if (endaddr->retries != NULL && timed_out)
+      if (endaddr->retries && timed_out)
         {
         if (last_first == endaddr) paddr = saved_paddr;
         addr = *paddr;
@@ -928,7 +928,7 @@ for (i = 0; i < 3; i++)
 
 /* Close and unlock the database */
 
-if (dbm_file != NULL) dbfn_close(dbm_file);
+if (dbm_file) dbfn_close(dbm_file);
 
 DEBUG(D_retry) debug_printf("end of retry processing\n");
 }
diff --git a/src/src/rewrite.c b/src/src/rewrite.c
index ca7fb6a11..830d2bb8d 100644
--- a/src/src/rewrite.c
+++ b/src/src/rewrite.c
@@ -205,6 +205,9 @@ for (rule = rewrite_rules;
     {
     if (expand_string_forcedfail)
       { if ((rule->flags & rewrite_quit) != 0) break; else continue; }
+
+    expand_string_message = expand_hide_passwords(expand_string_message);
+
     log_write(0, LOG_MAIN|LOG_PANIC, "Expansion of %s failed while rewriting: "
       "%s", rule->replacement, expand_string_message);
     break;
diff --git a/src/src/rfc2047.c b/src/src/rfc2047.c
index 1a2e9c758..5c987e292 100644
--- a/src/src/rfc2047.c
+++ b/src/src/rfc2047.c
@@ -218,7 +218,7 @@ while (mimeword != NULL)
   #endif
 
   if (mimeword != string)
-    yield = string_cat(yield, &size, &ptr, string, mimeword - string);
+    yield = string_catn(yield, &size, &ptr, string, mimeword - string);
 
   /* Do a charset translation if required. This is supported only on hosts
   that have the iconv() function. Translation errors set error, but carry on,
@@ -305,7 +305,7 @@ while (mimeword != NULL)
 
     /* Add the new string onto the result */
 
-    yield = string_cat(yield, &size, &ptr, tptr, tlen);
+    yield = string_catn(yield, &size, &ptr, tptr, tlen);
     }
 
   #if HAVE_ICONV
@@ -328,7 +328,7 @@ while (mimeword != NULL)
 /* Copy the remaining characters of the string, zero-terminate it, and return
 the length as well if requested. */
 
-yield = string_cat(yield, &size, &ptr, string, Ustrlen(string));
+yield = string_cat(yield, &size, &ptr, string);
 yield[ptr] = 0;
 if (lenptr != NULL) *lenptr = ptr;
 if (sizeptr != NULL) *sizeptr = size;
diff --git a/src/src/route.c b/src/src/route.c
index b289b0f34..3ca1afbfb 100644
--- a/src/src/route.c
+++ b/src/src/route.c
@@ -143,6 +143,19 @@ optionlist optionlist_routers[] = {
 int optionlist_routers_size = sizeof(optionlist_routers)/sizeof(optionlist);
 
 
+void
+readconf_options_routers(void)
+{
+struct router_info * ri;
+
+readconf_options_from_list(optionlist_routers, nelem(optionlist_routers), US"RT");
+
+for (ri = routers_available; ri->driver_name[0]; ri++)
+  {
+  macro_create(string_sprintf("_DRVR_RTR_%T", ri->driver_name), US"y", FALSE, TRUE);
+  readconf_options_from_list(ri->options, (unsigned)*ri->options_count, ri->driver_name);
+  }
+}
 
 /*************************************************
 *          Set router pointer from name          *
@@ -979,7 +992,7 @@ if ((rc = check_files(r->require_files, perror)) != OK)
 
 if (r->condition)
   {
-  DEBUG(D_route) debug_printf("checking \"condition\"\n");
+  DEBUG(D_route) debug_printf("checking \"condition\" \"%.80s\"...\n", r->condition);
   if (!expand_check_condition(r->condition, r->name, US"router"))
     {
     if (search_find_defer)
@@ -1657,10 +1670,10 @@ for (r = addr->start_router ? addr->start_router : routers; r; r = nextr)
   set flag. */
 
   if (r->dsn_lasthop && !(addr->dsn_flags & rf_dsnlasthop))
-  {
+    {
     addr->dsn_flags |= rf_dsnlasthop;
     HDEBUG(D_route) debug_printf("DSN: last hop for %s\n", addr->address);
-  }
+    }
 
   HDEBUG(D_route) debug_printf("calling %s router\n", r->name);
 
@@ -1897,21 +1910,8 @@ if (unseen && r->next)
 /* Unset the address expansions, and return the final result. */
 
 ROUTE_EXIT:
-if (  yield == DEFER
-   && addr->message
-   && (  Ustrstr(addr->message, "failed to expand") != NULL
-      || Ustrstr(addr->message, "expansion of ") != NULL
-      )
-   && (  Ustrstr(addr->message, "mysql") != NULL
-      || Ustrstr(addr->message, "pgsql") != NULL
-      || Ustrstr(addr->message, "redis") != NULL
-      || Ustrstr(addr->message, "sqlite") != NULL
-      || Ustrstr(addr->message, "ldap:") != NULL
-      || Ustrstr(addr->message, "ldapdn:") != NULL
-      || Ustrstr(addr->message, "ldapm:") != NULL
-      )
-   )
-  addr->message = string_sprintf("Temporary internal error");
+if (yield == DEFER && addr->message)
+  addr->message = expand_hide_passwords(addr->message);
 
 deliver_set_expansions(NULL);
 router_name = NULL;
diff --git a/src/src/routers/dnslookup.c b/src/src/routers/dnslookup.c
index 83ba5f689..d2be40e0f 100644
--- a/src/src/routers/dnslookup.c
+++ b/src/src/routers/dnslookup.c
@@ -305,6 +305,22 @@ for (;;)
 
   if (rc != HOST_FIND_FAILED) break;
 
+  if (ob->fail_defer_domains)
+    switch(match_isinlist(fully_qualified_name,
+	  CUSS &ob->fail_defer_domains, 0,
+	  &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
+      {
+      case DEFER:
+	addr->message = US"lookup defer for fail_defer_domains option";
+	return DEFER;
+
+      case OK:
+	DEBUG(D_route) debug_printf("%s router: matched fail_defer_domains\n",
+	  rblock->name);
+	addr->message = US"missing MX, or all MXs point to missing A records,"
+	  " and defer requested";
+	return DEFER;
+      }
   /* Check to see if the failure is the result of MX records pointing to
   non-existent domains, and if so, set an appropriate error message; the case
   of an MX or SRV record pointing to "." is another special case that we can
@@ -335,22 +351,6 @@ for (;;)
           addr->message);
         }
       }
-    if (ob->fail_defer_domains)
-      {
-      switch(match_isinlist(fully_qualified_name,
-	    CUSS &ob->fail_defer_domains, 0,
-	    &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
-	{
-	case DEFER:
-	  addr->message = US"lookup defer for fail_defer_domains";
-	  return DEFER;
-
-	case OK:
-	  DEBUG(D_route) debug_printf("%s router: matched fail_defer_domains\n",
-	    rblock->name);
-	  return DEFER;
-	}
-      }
     return DECLINE;
     }
 
diff --git a/src/src/routers/iplookup.c b/src/src/routers/iplookup.c
index 310e4d66d..e6a35a7f3 100644
--- a/src/src/routers/iplookup.c
+++ b/src/src/routers/iplookup.c
@@ -191,7 +191,7 @@ being a host list. */
 
 listptr = ob->hosts;
 while ((hostname = string_nextinlist(&listptr, &sep, host_buffer,
-       sizeof(host_buffer))) != NULL)
+       sizeof(host_buffer))))
   {
   host_item *h;
 
@@ -214,19 +214,20 @@ while ((hostname = string_nextinlist(&listptr, &sep, host_buffer,
 
   /* Loop for possible multiple IP addresses for the given name. */
 
-  for (h = host; h != NULL; h = h->next)
+  for (h = host; h; h = h->next)
     {
     int host_af, query_socket;
 
     /* Skip any hosts for which we have no address */
 
-    if (h->address == NULL) continue;
+    if (!h->address) continue;
 
     /* Create a socket, for UDP or TCP, as configured. IPv6 addresses are
     detected by checking for a colon in the address. */
 
     host_af = (Ustrchr(h->address, ':') != NULL)? AF_INET6 : AF_INET;
-    query_socket = ip_socket((ob->protocol == ip_udp)? SOCK_DGRAM:SOCK_STREAM,
+
+    query_socket = ip_socket(ob->protocol == ip_udp ? SOCK_DGRAM:SOCK_STREAM,
       host_af);
     if (query_socket < 0)
       {
@@ -240,7 +241,8 @@ while ((hostname = string_nextinlist(&listptr, &sep, host_buffer,
     here only for TCP calls; for a UDP socket, "connect" always works (the
     router will timeout later on the read call). */
 
-    if (ip_connect(query_socket, host_af, h->address,ob->port, ob->timeout) < 0)
+    if (ip_connect(query_socket, host_af, h->address,ob->port, ob->timeout,
+			ob->protocol != ip_udp) < 0)
       {
       close(query_socket);
       DEBUG(D_route)
@@ -282,7 +284,7 @@ while ((hostname = string_nextinlist(&listptr, &sep, host_buffer,
   /* If h == NULL we have tried all the IP addresses and failed on all of them,
   so we must continue to try more host names. Otherwise we have succeeded. */
 
-  if (h != NULL) break;
+  if (h) break;
   }
 
 
diff --git a/src/src/routers/manualroute.c b/src/src/routers/manualroute.c
index 46177df43..95c69328d 100644
--- a/src/src/routers/manualroute.c
+++ b/src/src/routers/manualroute.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -415,7 +415,7 @@ if (hostlist[0] == 0)
   {
   if (verify != v_none) goto ROUTED;
   addr->message = string_sprintf("error in %s router: no host(s) specified "
-    "for domain %s", rblock->name, domain);
+    "for domain %s", rblock->name, addr->domain);
   log_write(0, LOG_MAIN, "%s", addr->message);
   return DEFER;
   }
diff --git a/src/src/routers/queryprogram.c b/src/src/routers/queryprogram.c
index 138062e16..bfcaefcfd 100644
--- a/src/src/routers/queryprogram.c
+++ b/src/src/routers/queryprogram.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 #include "../exim.h"
@@ -214,6 +214,7 @@ ugid.uid_set = ugid.gid_set = FALSE;
 /* Set up the propagated data block with the current address_data and the
 errors address and extra header stuff. */
 
+bzero(&addr_prop, sizeof(addr_prop));
 addr_prop.address_data = deliver_address_data;
 
 rc = rf_get_errors_address(addr, rblock, verify, &addr_prop.errors_address);
@@ -223,6 +224,10 @@ rc = rf_get_munge_headers(addr, rblock, &addr_prop.extra_headers,
   &addr_prop.remove_headers);
 if (rc != OK) return rc;
 
+#ifdef EXPERIMENTAL_SRS
+addr_prop.srs_sender = NULL;
+#endif
+
 /* Get the fixed or expanded uid under which the command is to run
 (initialization ensures that one or the other is set). */
 
diff --git a/src/src/routers/redirect.c b/src/src/routers/redirect.c
index 7bbaa82e4..8aad1d4ab 100644
--- a/src/src/routers/redirect.c
+++ b/src/src/routers/redirect.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -325,7 +325,7 @@ add_generated(router_instance *rblock, address_item **addr_new,
 redirect_router_options_block *ob =
   (redirect_router_options_block *)(rblock->options_block);
 
-while (generated != NULL)
+while (generated)
   {
   address_item *parent;
   address_item *next = generated;
@@ -347,7 +347,7 @@ while (generated != NULL)
 
   if (ob->one_time && !queue_2stage)
     {
-    for (parent = addr; parent->parent != NULL; parent = parent->parent);
+    for (parent = addr; parent->parent; parent = parent->parent) ;
     next->onetime_parent = parent->address;
     }
 
@@ -358,21 +358,16 @@ while (generated != NULL)
   unless the ancestor was routed by a case-sensitive router. */
 
   if (ob->check_ancestor)
-    {
-    for (parent = addr; parent != NULL; parent = parent->parent)
-      {
-      if (((parent->router != NULL && parent->router->caseful_local_part)?
-           Ustrcmp(next->address, parent->address)
-           :
-           strcmpic(next->address, parent->address)
+    for (parent = addr; parent; parent = parent->parent)
+      if ((parent->router && parent->router->caseful_local_part
+	   ? Ustrcmp(next->address, parent->address)
+           : strcmpic(next->address, parent->address)
           ) == 0)
         {
         DEBUG(D_route) debug_printf("generated parent replaced by child\n");
         next->address = string_copy(addr->address);
         break;
         }
-      }
-    }
 
   /* A user filter may, under some circumstances, set up an errors address.
   If so, we must take care to re-instate it when we copy in the propagated
@@ -553,6 +548,12 @@ addr_prop.remove_headers = NULL;
 #ifdef EXPERIMENTAL_SRS
 addr_prop.srs_sender = NULL;
 #endif
+#ifdef SUPPORT_I18N
+addr_prop.utf8_msg = FALSE;	/*XXX should we not copy this from the parent? */
+addr_prop.utf8_downcvt = FALSE;
+addr_prop.utf8_downcvt_maybe = FALSE;
+#endif
+
 
 /* When verifying and testing addresses, the "logwrite" command in filters
 must be bypassed. */
@@ -649,8 +650,8 @@ if (!ugid.gid_set && pw != NULL)
 //          eximsrs_db_set(FALSE, NULL);
 */
 
-        if(ob->srs_alias != NULL ? (usedomain = expand_string(ob->srs_alias)) == NULL : 1)
-          usedomain = deliver_domain;
+        if (!(usedomain = ob->srs_alias ? expand_string(ob->srs_alias) : NULL))
+          usedomain = string_copy(deliver_domain);
 
         if((n_srs = eximsrs_forward(&res, sender_address, usedomain)) == OK)
         {
diff --git a/src/src/routers/rf_functions.h b/src/src/routers/rf_functions.h
index 1344faadf..f310d5a42 100644
--- a/src/src/routers/rf_functions.h
+++ b/src/src/routers/rf_functions.h
@@ -14,7 +14,7 @@ extern void rf_add_generated(router_instance *, address_item **,
 extern void rf_change_domain(address_item *, const uschar *, BOOL, address_item **);
 extern uschar *rf_expand_data(address_item *, uschar *, int *);
 extern int  rf_get_errors_address(address_item *, router_instance *,
-              BOOL, uschar **);
+              int, uschar **);
 extern int  rf_get_munge_headers(address_item *, router_instance *,
               header_line **, uschar **);
 extern BOOL rf_get_transport(uschar *, transport_instance **,  address_item *,
diff --git a/src/src/setenv.c b/src/src/setenv.c
index 6da56d58d..ceeb8ef1c 100644
--- a/src/src/setenv.c
+++ b/src/src/setenv.c
@@ -2,15 +2,16 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Michael Haardt 2015 */
-/* Copyright (c) Jeremy Harris 2015 */
+/* Copyright (c) Michael Haardt 2015
+ * Copyright (c) Jeremy Harris 2015 - 2016
+ * Copyright (c) The Exim Maintainers 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* This module provides (un)setenv routines for those environments
-lacking them in libraries. */
+lacking them in libraries. It is #include'd by OS/os.c-foo files. */
 
 
-static int
+int
 setenv(const char * name, const char * val, int overwrite)
 {
 uschar * s;
@@ -20,7 +21,7 @@ if (overwrite || !getenv(name))
 return 0;
 }
 
-static int
+int
 unsetenv(const char *name)
 {
 size_t len;
@@ -34,6 +35,9 @@ if (!name)
   return -1;
   }
 
+if (!environ)
+  return 0;
+
 for (end = name; *end != '=' && *end; ) end++;
 len = end - name;
   
diff --git a/src/src/sha_ver.h b/src/src/sha_ver.h
new file mode 100644
index 000000000..387ac52c1
--- /dev/null
+++ b/src/src/sha_ver.h
@@ -0,0 +1,42 @@
+/*************************************************
+*     Exim - an Internet mail transport agent    *
+*************************************************/
+
+/* Copyright (c) Jeremy Harris 2016 */
+/* See the file NOTICE for conditions of use and distribution. */
+
+/* SHA routine selection */
+
+#include "exim.h"
+
+/* Please be aware that pulling in extra headers which are not in the system
+ * includes may require careful juggling of CFLAGS in
+ * scripts/Configure-Makefile -- that logic should be kept in sync with this.
+ * In particular, building with just something like USE_OPENSSL_PC=openssl
+ * and not massaging CFLAGS in Local/Makefile is fully supported.
+ */
+
+#ifdef SUPPORT_TLS
+
+# define EXIM_HAVE_SHA2
+
+# ifdef USE_GNUTLS
+#  include <gnutls/gnutls.h>
+
+#  if GNUTLS_VERSION_NUMBER >= 0x020a00
+#   define SHA_GNUTLS
+#   if GNUTLS_VERSION_NUMBER >= 0x030500
+#    define EXIM_HAVE_SHA3
+#   endif
+#  else
+#   define SHA_GCRYPT
+#  endif
+
+# else
+#  define SHA_OPENSSL
+# endif
+
+#else
+# define SHA_NATIVE
+#endif
+
diff --git a/src/src/sieve.c b/src/src/sieve.c
index 3d7e99b27..19bc5337b 100644
--- a/src/src/sieve.c
+++ b/src/src/sieve.c
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Michael Haardt 2003 - 2015 */
-/* See the file NOTICE for conditions of use and distribution. */
+/* Copyright (c) Michael Haardt 2003 - 2015
+ * Copyright (c) The Exim Maintainers 2016
+ * See the file NOTICE for conditions of use and distribution.
+ */
 
 /* This code was contributed by Michael Haardt. */
 
@@ -232,6 +234,9 @@ uschar *new = NULL;
 uschar ch;
 size_t line;
 
+/* Two passes: one to count output allocation size, second
+to do the encoding */
+
 for (pass=0; pass<=1; ++pass)
   {
   line=0;
@@ -245,54 +250,47 @@ for (pass=0; pass<=1; ++pass)
   for (start=src->character,end=start+src->length; start<end; ++start)
     {
     ch=*start;
-    if (line>=73)
+    if (line>=73)	/* line length limit */
       {
       if (pass==0)
         dst->length+=2;
       else
         {
-        *new++='=';
+        *new++='=';	/* line split */
         *new++='\n';
         }
       line=0;
       }
-    if
-      (
-      (ch>=33 && ch<=60)
-      || (ch>=62 && ch<=126)
-      ||
-        (
-        (ch==9 || ch==32)
-        && start+2<end
-        && (*(start+1)!='\r' || *(start+2)!='\n')
-        )
-      )
+    if (  (ch>='!' && ch<='<')
+       || (ch>='>' && ch<='~')
+       || (  (ch=='\t' || ch==' ')
+          && start+2<end
+          && (*(start+1)!='\r' || *(start+2)!='\n')	/* CRLF */
+          )
+       )
       {
       if (pass==0)
         ++dst->length;
       else
-        *new++=*start;
+        *new++=*start;	/* copy char */
       ++line;
       }
-    else if (ch=='\r' && start+1<end && *(start+1)=='\n')
+    else if (ch=='\r' && start+1<end && *(start+1)=='\n') /* CRLF */
       {
       if (pass==0)
-        {
         ++dst->length;
-        line=0;
-        }
       else
-        *new++='\n';
-        line=0;
-      ++start;
+        *new++='\n';					/* NL */
+      line=0;
+      ++start;	/* consume extra input char */
       }
     else
       {
       if (pass==0)
         dst->length+=3;
       else
-        {
-        sprintf(CS new,"=%02X",ch);
+        {		/* encoded char */
+        new += sprintf(CS new,"=%02X",ch);
         new+=3;
         }
       line+=3;
@@ -415,7 +413,8 @@ Returns
 static int parse_mailto_uri(struct Sieve *filter, const uschar *uri, string_item **recipient, struct String *header, struct String *subject, struct String *body)
 {
 const uschar *start;
-struct String to,hname,hvalue;
+struct String to, hname;
+struct String hvalue = {NULL, 0};
 int capacity;
 string_item *new;
 
@@ -424,6 +423,7 @@ if (Ustrncmp(uri,"mailto:",7))
   filter->errmsg=US "Unknown URI scheme";
   return 0;
   }
+
 uri+=7;
 if (*uri && *uri!='?')
   for (;;)
@@ -433,9 +433,9 @@ if (*uri && *uri!='?')
     if (uri>start)
       {
       capacity=0;
-      to.character=(uschar*)0;
+      to.character= NULL;
       to.length=0;
-      to.character=string_cat(to.character,&capacity,&to.length,start,uri-start);
+      to.character=string_catn(to.character, &capacity, &to.length, start, uri-start);
       to.character[to.length]='\0';
       if (uri_decode(&to)==-1)
         {
@@ -467,9 +467,9 @@ if (*uri=='?')
     if (uri>start)
       {
       capacity=0;
-      hname.character=(uschar*)0;
+      hname.character= NULL;
       hname.length=0;
-      hname.character=string_cat(hname.character,&capacity,&hname.length,start,uri-start);
+      hname.character = string_catn(hname.character, &capacity, &hname.length, start, uri-start);
       hname.character[hname.length]='\0';
       if (uri_decode(&hname)==-1)
         {
@@ -490,9 +490,9 @@ if (*uri=='?')
     if (uri>start)
       {
       capacity=0;
-      hvalue.character=(uschar*)0;
+      hvalue.character= NULL;
       hvalue.length=0;
-      hvalue.character=string_cat(hvalue.character,&capacity,&hvalue.length,start,uri-start);
+      hvalue.character=string_catn(hvalue.character,&capacity,&hvalue.length,start,uri-start);
       hvalue.character[hvalue.length]='\0';
       if (uri_decode(&hvalue)==-1)
         {
@@ -531,10 +531,10 @@ if (*uri=='?')
         {
         if (header->length==-1) header->length=0;
         capacity=header->length;
-        header->character=string_cat(header->character,&capacity,&header->length,hname.character,hname.length);
-        header->character=string_cat(header->character,&capacity,&header->length,CUS ": ",2);
-        header->character=string_cat(header->character,&capacity,&header->length,hvalue.character,hvalue.length);
-        header->character=string_cat(header->character,&capacity,&header->length,CUS "\n",1);
+        header->character=string_catn(header->character,&capacity,&header->length,hname.character,hname.length);
+        header->character=string_catn(header->character,&capacity,&header->length,CUS ": ",2);
+        header->character=string_catn(header->character,&capacity,&header->length,hvalue.character,hvalue.length);
+        header->character=string_catn(header->character,&capacity,&header->length,CUS "\n",1);
         header->character[header->length]='\0';
         }
       }
@@ -1008,24 +1008,24 @@ while (l)
     {
     case '\0':
       {
-      quoted=string_cat(quoted,&size,&ptr,CUS "\\0",2);
+      quoted=string_catn(quoted,&size,&ptr,CUS "\\0",2);
       break;
       }
     case '$':
     case '{':
     case '}':
       {
-      quoted=string_cat(quoted,&size,&ptr,CUS "\\",1);
+      quoted=string_catn(quoted,&size,&ptr,CUS "\\",1);
       }
     default:
       {
-      quoted=string_cat(quoted,&size,&ptr,h,1);
+      quoted=string_catn(quoted,&size,&ptr,h,1);
       }
     }
   ++h;
   --l;
   }
-quoted=string_cat(quoted,&size,&ptr,CUS "",1);
+quoted=string_catn(quoted,&size,&ptr,CUS "",1);
 return quoted;
 }
 
@@ -1489,7 +1489,7 @@ if (*filter->pc=='"') /* quoted string */
 
       ++filter->pc;
       /* that way, there will be at least one character allocated */
-      data->character=string_cat(data->character,&dataCapacity,&foo,CUS "",1);
+      data->character=string_catn(data->character,&dataCapacity,&foo,CUS "",1);
 #ifdef ENCODED_CHARACTER
       if (filter->require_encoded_character
           && string_decode(filter,data)==-1)
@@ -1499,7 +1499,7 @@ if (*filter->pc=='"') /* quoted string */
       }
     else if (*filter->pc=='\\' && *(filter->pc+1)) /* quoted character */
       {
-      data->character=string_cat(data->character,&dataCapacity,&data->length,filter->pc+1,1);
+      data->character=string_catn(data->character,&dataCapacity,&data->length,filter->pc+1,1);
       filter->pc+=2;
       }
     else /* regular character */
@@ -1509,11 +1509,11 @@ if (*filter->pc=='"') /* quoted string */
 #else
       if (*filter->pc=='\n')
         {
-        data->character=string_cat(data->character,&dataCapacity,&data->length,US"\r",1);
+        data->character=string_catn(data->character,&dataCapacity,&data->length,US"\r",1);
         ++filter->line;
         }
 #endif
-      data->character=string_cat(data->character,&dataCapacity,&data->length,filter->pc,1);
+      data->character=string_catn(data->character,&dataCapacity,&data->length,filter->pc,1);
       filter->pc++;
       }
     }
@@ -1555,7 +1555,7 @@ else if (Ustrncmp(filter->pc,CUS "text:",5)==0) /* multiline string */
     if (*filter->pc=='\n') /* end of line */
 #endif
       {
-      data->character=string_cat(data->character,&dataCapacity,&data->length,CUS "\r\n",2);
+      data->character=string_catn(data->character,&dataCapacity,&data->length,CUS "\r\n",2);
 #ifdef RFC_EOL
       filter->pc+=2;
 #else
@@ -1571,7 +1571,7 @@ else if (Ustrncmp(filter->pc,CUS "text:",5)==0) /* multiline string */
         int foo=data->length;
 
         /* that way, there will be at least one character allocated */
-        data->character=string_cat(data->character,&dataCapacity,&foo,CUS "",1);
+        data->character=string_catn(data->character,&dataCapacity,&foo,CUS "",1);
 #ifdef RFC_EOL
         filter->pc+=3;
 #else
@@ -1587,13 +1587,13 @@ else if (Ustrncmp(filter->pc,CUS "text:",5)==0) /* multiline string */
         }
       else if (*filter->pc=='.' && *(filter->pc+1)=='.') /* remove dot stuffing */
         {
-        data->character=string_cat(data->character,&dataCapacity,&data->length,CUS ".",1);
+        data->character=string_catn(data->character,&dataCapacity,&data->length,CUS ".",1);
         filter->pc+=2;
         }
       }
     else /* regular character */
       {
-      data->character=string_cat(data->character,&dataCapacity,&data->length,filter->pc,1);
+      data->character=string_catn(data->character,&dataCapacity,&data->length,filter->pc,1);
       filter->pc++;
       }
     }
@@ -1706,12 +1706,13 @@ Returns:      1                success
               -1               no string list found
 */
 
-static int parse_stringlist(struct Sieve *filter, struct String **data)
+static int
+parse_stringlist(struct Sieve *filter, struct String **data)
 {
 const uschar *orig=filter->pc;
-int dataCapacity=0;
-int dataLength=0;
-struct String *d=(struct String*)0;
+int dataCapacity = 0;
+int dataLength = 0;
+struct String *d = NULL;
 int m;
 
 if (*filter->pc=='[') /* string list */
@@ -1720,20 +1721,18 @@ if (*filter->pc=='[') /* string list */
   for (;;)
     {
     if (parse_white(filter)==-1) goto error;
-    if ((dataLength+1)>=dataCapacity) /* increase buffer */
+    if (dataLength+1 >= dataCapacity) /* increase buffer */
       {
       struct String *new;
       int newCapacity;          /* Don't amalgamate with next line; some compilers grumble */
-      newCapacity=dataCapacity?(dataCapacity*=2):(dataCapacity=4);
-      if ((new=(struct String*)store_get(sizeof(struct String)*newCapacity))==(struct String*)0)
-        {
-        filter->errmsg=CUstrerror(errno);
-        goto error;
-        }
+
+      dataCapacity = dataCapacity ? dataCapacity * 2 : 4;
+      new = store_get(sizeof(struct String) * dataCapacity);
+
       if (d) memcpy(new,d,sizeof(struct String)*dataLength);
-      d=new;
-      dataCapacity=newCapacity;
+      d = new;
       }
+
     m=parse_string(filter,&d[dataLength]);
     if (m==0)
       {
@@ -3299,10 +3298,10 @@ while (*filter->pc)
         capacity=0;
         if (handle.length==-1)
           {
-          if (subject.length!=-1) key.character=string_cat(key.character,&capacity,&key.length,subject.character,subject.length);
-          if (from.length!=-1) key.character=string_cat(key.character,&capacity,&key.length,from.character,from.length);
-          key.character=string_cat(key.character,&capacity,&key.length,reason_is_mime?US"1":US"0",1);
-          key.character=string_cat(key.character,&capacity,&key.length,reason.character,reason.length);
+          if (subject.length!=-1) key.character=string_catn(key.character,&capacity,&key.length,subject.character,subject.length);
+          if (from.length!=-1) key.character=string_catn(key.character,&capacity,&key.length,from.character,from.length);
+          key.character=string_catn(key.character,&capacity,&key.length,reason_is_mime?US"1":US"0",1);
+          key.character=string_catn(key.character,&capacity,&key.length,reason.character,reason.length);
           }
         else
           key=handle;
@@ -3317,8 +3316,8 @@ while (*filter->pc)
           {
           capacity=Ustrlen(filter->vacation_directory);
           start=capacity;
-          once=string_cat(filter->vacation_directory,&capacity,&start,US"/",1);
-          once=string_cat(once,&capacity,&start,hexdigest,33);
+          once=string_catn(filter->vacation_directory,&capacity,&start,US"/",1);
+          once=string_catn(once,&capacity,&start,hexdigest,33);
           once[start] = '\0';
 
           /* process subject */
@@ -3333,7 +3332,7 @@ while (*filter->pc)
               expand_header(&subject,&str_subject);
               capacity=6;
               start=6;
-              subject.character=string_cat(US"Auto: ",&capacity,&start,subject.character,subject.length);
+              subject.character=string_catn(US"Auto: ",&capacity,&start,subject.character,subject.length);
               subject.length=start;
               }
             else
@@ -3380,13 +3379,13 @@ while (*filter->pc)
               );
             capacity = 0;
             start = 0;
-            addr->reply->headers = string_cat(NULL,&capacity,&start,reason.character,mime_body-reason.character);
+            addr->reply->headers = string_catn(NULL,&capacity,&start,reason.character,mime_body-reason.character);
             addr->reply->headers[start] = '\0';
             capacity = 0;
             start = 0;
             if (mime_body+(sizeof(nlnl)-1)<reason_end) mime_body+=(sizeof(nlnl)-1);
             else mime_body=reason_end-1;
-            addr->reply->text = string_cat(NULL,&capacity,&start,mime_body,reason_end-mime_body);
+            addr->reply->text = string_catn(NULL,&capacity,&start,mime_body,reason_end-mime_body);
             addr->reply->text[start] = '\0';
             }
           else
diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c
index 0498ecb18..d7080168a 100644
--- a/src/src/smtp_in.c
+++ b/src/src/smtp_in.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for handling an incoming SMTP call. */
@@ -82,6 +82,15 @@ enum {
 
   MAIL_CMD, RCPT_CMD, RSET_CMD,
 
+  /* RFC3030 section 2: "After all MAIL and RCPT responses are collected and
+  processed the message is sent using a series of BDAT commands"
+  implies that BDAT should be synchronized.  However, we see Google, at least,
+  sending MAIL,RCPT,BDAT-LAST in a single packet, clearly not waiting for
+  processing of the RPCT response(s).  We shall do the same, and not require
+  synch for BDAT. */
+
+  BDAT_CMD,
+
   /* This is a dummy to identify the non-sync commands when not pipelining */
 
   NON_SYNC_CMD_NON_PIPELINING,
@@ -182,6 +191,7 @@ static smtp_cmd_list cmd_list[] = {
   { "mail from:", sizeof("mail from:")-1, MAIL_CMD, TRUE,  TRUE  },
   { "rcpt to:",   sizeof("rcpt to:")-1,   RCPT_CMD, TRUE,  TRUE  },
   { "data",       sizeof("data")-1,       DATA_CMD, FALSE, TRUE  },
+  { "bdat",       sizeof("bdat")-1,       BDAT_CMD, TRUE,  TRUE  },
   { "quit",       sizeof("quit")-1,       QUIT_CMD, FALSE, TRUE  },
   { "noop",       sizeof("noop")-1,       NOOP_CMD, TRUE,  FALSE },
   { "etrn",       sizeof("etrn")-1,       ETRN_CMD, TRUE,  FALSE },
@@ -205,9 +215,9 @@ It must be kept in step with the SCH_xxx enumerations. */
 
 static uschar *smtp_names[] =
   {
-  US"NONE", US"AUTH", US"DATA", US"EHLO", US"ETRN", US"EXPN", US"HELO",
-  US"HELP", US"MAIL", US"NOOP", US"QUIT", US"RCPT", US"RSET", US"STARTTLS",
-  US"VRFY" };
+  US"NONE", US"AUTH", US"DATA", US"BDAT", US"EHLO", US"ETRN", US"EXPN",
+  US"HELO", US"HELP", US"MAIL", US"NOOP", US"QUIT", US"RCPT", US"RSET",
+  US"STARTTLS", US"VRFY" };
 
 static uschar *protocols_local[] = {
   US"local-smtp",        /* HELO */
@@ -289,6 +299,13 @@ static int     smtp_had_eof;
 static int     smtp_had_error;
 
 
+/* forward declarations */
+int bdat_ungetc(int ch);
+static int smtp_read_command(BOOL check_sync);
+static int synprot_error(int type, int code, uschar *data, uschar *errmess);
+static void smtp_quit_handler(uschar **, uschar **);
+static void smtp_rset_handler(void);
+
 /*************************************************
 *          SMTP version of getc()                *
 *************************************************/
@@ -308,6 +325,7 @@ smtp_getc(void)
 if (smtp_inptr >= smtp_inend)
   {
   int rc, save_errno;
+  if (!smtp_out) return EOF;
   fflush(smtp_out);
   if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
   rc = read(fileno(smtp_in), smtp_inbuffer, in_buffer_size);
@@ -335,6 +353,145 @@ if (smtp_inptr >= smtp_inend)
 return *smtp_inptr++;
 }
 
+void
+smtp_get_cache(void)
+{
+#ifndef DISABLE_DKIM
+int n = smtp_inend - smtp_inptr;
+if (n > 0)
+  dkim_exim_verify_feed(smtp_inptr, n);
+#endif
+}
+
+
+/* Get a byte from the smtp input, in CHUNKING mode.  Handle ack of the
+previous BDAT chunk and getting new ones when we run out.  Uses the
+underlying smtp_getc or tls_getc both for that and for getting the
+(buffered) data byte.  EOD signals (an expected) no further data.
+ERR signals a protocol error, and EOF a closed input stream.
+
+Called from read_bdat_smtp() in receive.c for the message body, but also
+by the headers read loop in receive_msg(); manipulates chunking_state
+to handle the BDAT command/response.
+Placed here due to the correlation with the above smtp_getc(), which it wraps,
+and also by the need to do smtp command/response handling.
+
+Arguments:  none
+Returns:    the next character or ERR, EOD or EOF
+*/
+
+int
+bdat_getc(void)
+{
+uschar * user_msg = NULL;
+uschar * log_msg;
+
+for(;;)
+  {
+  if (chunking_data_left-- > 0)
+    return lwr_receive_getc();
+
+  receive_getc = lwr_receive_getc;
+  receive_ungetc = lwr_receive_ungetc;
+
+  /* If not the last, ack the received chunk.  The last response is delayed
+  until after the data ACL decides on it */
+
+  if (chunking_state == CHUNKING_LAST)
+    {
+#ifndef DISABLE_DKIM
+    dkim_exim_verify_feed(NULL, 0);	/* notify EOD */
+#endif
+    return EOD;
+    }
+
+  chunking_state = CHUNKING_OFFERED;
+  smtp_printf("250 %u byte chunk received\r\n", chunking_datasize);
+
+  /* Expect another BDAT cmd from input. RFC 3030 says nothing about
+  QUIT, RSET or NOOP but handling them seems obvious */
+
+next_cmd:
+  switch(smtp_read_command(TRUE))
+    {
+    default:
+      (void) synprot_error(L_smtp_protocol_error, 503, NULL,
+	US"only BDAT permissible after non-LAST BDAT");
+
+  repeat_until_rset:
+      switch(smtp_read_command(TRUE))
+	{
+	case QUIT_CMD:	smtp_quit_handler(&user_msg, &log_msg);	/*FALLTHROUGH */
+	case EOF_CMD:	return EOF;
+	case RSET_CMD:	smtp_rset_handler(); return ERR;
+	default:	if (synprot_error(L_smtp_protocol_error, 503, NULL,
+					  US"only RSET accepted now") > 0)
+			  return EOF;
+			goto repeat_until_rset;
+	}
+
+    case QUIT_CMD:
+      smtp_quit_handler(&user_msg, &log_msg);
+      /*FALLTHROUGH*/
+    case EOF_CMD:
+      return EOF;
+
+    case RSET_CMD:
+      smtp_rset_handler();
+      return ERR;
+
+    case NOOP_CMD:
+      HAD(SCH_NOOP);
+      smtp_printf("250 OK\r\n");
+      goto next_cmd;
+
+    case BDAT_CMD:
+      {
+      int n;
+
+      if (sscanf(CS smtp_cmd_data, "%u %n", &chunking_datasize, &n) < 1)
+	{
+	(void) synprot_error(L_smtp_protocol_error, 501, NULL,
+	  US"missing size for BDAT command");
+	return ERR;
+	}
+      chunking_state = strcmpic(smtp_cmd_data+n, US"LAST") == 0
+	? CHUNKING_LAST : CHUNKING_ACTIVE;
+      chunking_data_left = chunking_datasize;
+
+      if (chunking_datasize == 0)
+	if (chunking_state == CHUNKING_LAST)
+	  return EOD;
+	else
+	  {
+	  (void) synprot_error(L_smtp_protocol_error, 504, NULL,
+	    US"zero size for BDAT command");
+	  goto repeat_until_rset;
+	  }
+
+      receive_getc = bdat_getc;
+      receive_ungetc = bdat_ungetc;
+      break;	/* to top of main loop */
+      }
+    }
+  }
+}
+
+static void
+bdat_flush_data(void)
+{
+while (chunking_data_left-- > 0)
+  if (lwr_receive_getc() < 0)
+    break;
+
+receive_getc = lwr_receive_getc;
+receive_ungetc = lwr_receive_ungetc;
+
+if (chunking_state != CHUNKING_LAST)
+  chunking_state = CHUNKING_OFFERED;
+}
+
+
 
 
 /*************************************************
@@ -353,11 +510,18 @@ Returns:       the character
 int
 smtp_ungetc(int ch)
 {
-*(--smtp_inptr) = ch;
+*--smtp_inptr = ch;
 return ch;
 }
 
 
+int
+bdat_ungetc(int ch)
+{
+chunking_data_left++;
+return lwr_receive_ungetc(ch);
+}
+
 
 
 /*************************************************
@@ -597,10 +761,10 @@ Arguments: fd     - File descriptor for input
 Returns:   none
 */
 static void
-restore_socket_timeout(int fd, int get_ok, struct timeval tvtmp, socklen_t vslen)
+restore_socket_timeout(int fd, int get_ok, struct timeval * tvtmp, socklen_t vslen)
 {
 if (get_ok == 0)
-  setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tvtmp, vslen);
+  (void) setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, CS tvtmp, vslen);
 }
 
 /*************************************************
@@ -641,7 +805,7 @@ so exit with an error if do not find the exact required pieces. This
 includes an incorrect number of spaces separating args.
 
 Arguments: none
-Returns:   int
+Returns:   Boolean success
 */
 
 static BOOL
@@ -685,27 +849,23 @@ char tmpip6[INET6_ADDRSTRLEN];
 struct sockaddr_in6 tmpaddr6;
 
 int get_ok = 0;
-int size, ret, fd;
+int size, ret;
+int fd = fileno(smtp_in);
 const char v2sig[12] = "\x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A";
 uschar *iptype;  /* To display debug info */
 struct timeval tv;
-socklen_t vslen = 0;
 struct timeval tvtmp;
-
-vslen = sizeof(struct timeval);
-
-fd = fileno(smtp_in);
+socklen_t vslen = sizeof(struct timeval);
 
 /* Save current socket timeout values */
-get_ok = getsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tvtmp,
-                    &vslen);
+get_ok = getsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, CS &tvtmp, &vslen);
 
 /* Proxy Protocol host must send header within a short time
 (default 3 seconds) or it's considered invalid */
 tv.tv_sec  = PROXY_NEGOTIATION_TIMEOUT_SEC;
 tv.tv_usec = PROXY_NEGOTIATION_TIMEOUT_USEC;
-setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tv,
-           sizeof(struct timeval));
+if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, CS &tv, sizeof(tv)) < 0)
+  return FALSE;
 
 do
   {
@@ -716,10 +876,7 @@ do
   while (ret == -1 && errno == EINTR);
 
 if (ret == -1)
-  {
-  restore_socket_timeout(fd, get_ok, tvtmp, vslen);
-  return (errno == EAGAIN) ? 0 : ERRNO_PROXYFAIL;
-  }
+  goto proxyfail;
 
 if (ret >= 16 &&
     memcmp(&hdr.v2, v2sig, 12) == 0)
@@ -759,7 +916,7 @@ if (ret >= 16 &&
           if (!string_is_ip_address(US tmpip,NULL))
             {
             DEBUG(D_receive) debug_printf("Invalid %s source IP\n", iptype);
-            return ERRNO_PROXYFAIL;
+            goto proxyfail;
             }
           proxy_local_address = sender_host_address;
           sender_host_address = string_copy(US tmpip);
@@ -772,7 +929,7 @@ if (ret >= 16 &&
           if (!string_is_ip_address(US tmpip,NULL))
             {
             DEBUG(D_receive) debug_printf("Invalid %s dest port\n", iptype);
-            return ERRNO_PROXYFAIL;
+            goto proxyfail;
             }
           proxy_external_address = string_copy(US tmpip);
           tmpport              = ntohs(hdr.v2.addr.ip4.dst_port);
@@ -785,7 +942,7 @@ if (ret >= 16 &&
           if (!string_is_ip_address(US tmpip6,NULL))
             {
             DEBUG(D_receive) debug_printf("Invalid %s source IP\n", iptype);
-            return ERRNO_PROXYFAIL;
+            goto proxyfail;
             }
           proxy_local_address = sender_host_address;
           sender_host_address = string_copy(US tmpip6);
@@ -798,7 +955,7 @@ if (ret >= 16 &&
           if (!string_is_ip_address(US tmpip6,NULL))
             {
             DEBUG(D_receive) debug_printf("Invalid %s dest port\n", iptype);
-            return ERRNO_PROXYFAIL;
+            goto proxyfail;
             }
           proxy_external_address = string_copy(US tmpip6);
           tmpport              = ntohs(hdr.v2.addr.ip6.dst_port);
@@ -939,13 +1096,13 @@ else
   }
 
 proxyfail:
-restore_socket_timeout(fd, get_ok, tvtmp, vslen);
+restore_socket_timeout(fd, get_ok, &tvtmp, vslen);
 /* Don't flush any potential buffer contents. Any input should cause a
    synchronization failure */
 return FALSE;
 
 done:
-restore_socket_timeout(fd, get_ok, tvtmp, vslen);
+restore_socket_timeout(fd, get_ok, &tvtmp, vslen);
 DEBUG(D_receive)
   debug_printf("Valid %s sender from Proxy Protocol header\n", iptype);
 return proxy_session;
@@ -1180,26 +1337,23 @@ if (smtp_in == NULL || smtp_batched_input) return;
 receive_swallow_smtp();
 smtp_printf("421 %s\r\n", message);
 
-for (;;)
+for (;;) switch(smtp_read_command(FALSE))
   {
-  switch(smtp_read_command(FALSE))
-    {
-    case EOF_CMD:
-    return;
+  case EOF_CMD:
+  return;
 
-    case QUIT_CMD:
-    smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
-    mac_smtp_fflush();
-    return;
+  case QUIT_CMD:
+  smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
+  mac_smtp_fflush();
+  return;
 
-    case RSET_CMD:
-    smtp_printf("250 Reset OK\r\n");
-    break;
+  case RSET_CMD:
+  smtp_printf("250 Reset OK\r\n");
+  break;
 
-    default:
-    smtp_printf("421 %s\r\n", message);
-    break;
-    }
+  default:
+  smtp_printf("421 %s\r\n", message);
+  break;
   }
 }
 
@@ -1222,8 +1376,8 @@ Returns:     a string describing the connection
 uschar *
 smtp_get_connection_info(void)
 {
-uschar *hostname = (sender_fullhost == NULL)?
-  sender_host_address : sender_fullhost;
+const uschar * hostname = sender_fullhost
+  ? sender_fullhost : sender_host_address;
 
 if (host_checking)
   return string_sprintf("SMTP connection from %s", hostname);
@@ -1520,14 +1674,6 @@ sender_verified_list = NULL;        /* No senders verified */
 memset(sender_address_cache, 0, sizeof(sender_address_cache));
 memset(sender_domain_cache, 0, sizeof(sender_domain_cache));
 
-#ifndef DISABLE_PRDR
-prdr_requested = FALSE;
-#endif
-
-/* Reset the DSN flags */
-dsn_ret = 0;
-dsn_envid = NULL;
-
 authenticated_sender = NULL;
 #ifdef EXPERIMENTAL_BRIGHTMAIL
 bmi_run = 0;
@@ -1538,6 +1684,11 @@ dkim_signers = NULL;
 dkim_disable_verify = FALSE;
 dkim_collect_input = FALSE;
 #endif
+dsn_ret = 0;
+dsn_envid = NULL;
+#ifndef DISABLE_PRDR
+prdr_requested = FALSE;
+#endif
 #ifdef EXPERIMENTAL_SPF
 spf_header_comment = NULL;
 spf_received = NULL;
@@ -1729,16 +1880,15 @@ while (done <= 0)
     /* Apply SMTP rewrite, then extract address. Don't allow "<>" as a
     recipient address */
 
-    recipient = ((rewrite_existflags & rewrite_smtp) != 0)?
-      rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
-        global_rewrite_rules) : smtp_cmd_data;
+    recipient = rewrite_existflags & rewrite_smtp
+      ? rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
+		    global_rewrite_rules)
+      : smtp_cmd_data;
 
-    /* rfc821_domains = TRUE; << no longer needed */
     recipient = parse_extract_address(recipient, &errmess, &start, &end,
       &recipient_domain, FALSE);
-    /* rfc821_domains = FALSE; << no longer needed */
 
-    if (recipient == NULL)
+    if (!recipient)
       /* The function moan_smtp_batch() does not return. */
       moan_smtp_batch(smtp_cmd_buffer, "501 %s", errmess);
 
@@ -1890,10 +2040,10 @@ acl_var_c = NULL;
 
 /* Allow for trailing 0 in the command and data buffers. */
 
-smtp_cmd_buffer = (uschar *)malloc(2*smtp_cmd_buffer_size + 2);
-if (smtp_cmd_buffer == NULL)
+if (!(smtp_cmd_buffer = US malloc(2*smtp_cmd_buffer_size + 2)))
   log_write(0, LOG_MAIN|LOG_PANIC_DIE,
     "malloc() failed for SMTP command buffer");
+
 smtp_cmd_buffer[0] = 0;
 smtp_data_buffer = smtp_cmd_buffer + smtp_cmd_buffer_size + 1;
 
@@ -1902,7 +2052,7 @@ command line by a trusted caller. */
 
 if (smtp_batched_input)
   {
-  if (received_protocol == NULL) received_protocol = US"local-bsmtp";
+  if (!received_protocol) received_protocol = US"local-bsmtp";
   }
 
 /* For non-batched SMTP input, the protocol setting is forced here. It will be
@@ -1915,10 +2065,11 @@ else
 /* Set up the buffer for inputting using direct read() calls, and arrange to
 call the local functions instead of the standard C ones. */
 
-smtp_inbuffer = (uschar *)malloc(in_buffer_size);
-if (smtp_inbuffer == NULL)
+if (!(smtp_inbuffer = (uschar *)malloc(in_buffer_size)))
   log_write(0, LOG_MAIN|LOG_PANIC_DIE, "malloc() failed for SMTP input buffer");
+
 receive_getc = smtp_getc;
+receive_get_cache = smtp_get_cache;
 receive_ungetc = smtp_ungetc;
 receive_feof = smtp_feof;
 receive_ferror = smtp_ferror;
@@ -2315,8 +2466,7 @@ if (smtp_batched_input) return TRUE;
 proxy_session = FALSE;
 proxy_session_failed = FALSE;
 if (check_proxy_protocol_host())
-  {
-  if (setup_proxy_protocol_host() == FALSE)
+  if (!setup_proxy_protocol_host())
     {
     proxy_session_failed = TRUE;
     DEBUG(D_receive)
@@ -2328,20 +2478,18 @@ if (check_proxy_protocol_host())
     (void)host_name_lookup();
     host_build_sender_fullhost();
     }
-  }
 #endif
 
 /* Run the ACL if it exists */
 
 user_msg = NULL;
-if (acl_smtp_connect != NULL)
+if (acl_smtp_connect)
   {
   int rc;
-  rc = acl_check(ACL_WHERE_CONNECT, NULL, acl_smtp_connect, &user_msg,
-    &log_msg);
-  if (rc != OK)
+  if ((rc = acl_check(ACL_WHERE_CONNECT, NULL, acl_smtp_connect, &user_msg,
+		      &log_msg)) != OK)
     {
-    (void)smtp_handle_acl_fail(ACL_WHERE_CONNECT, rc, user_msg, log_msg);
+    (void) smtp_handle_acl_fail(ACL_WHERE_CONNECT, rc, user_msg, log_msg);
     return FALSE;
     }
   }
@@ -2353,10 +2501,9 @@ code = US"220";   /* Default status code */
 esc = US"";       /* Default extended status code */
 esclen = 0;       /* Length of esc */
 
-if (user_msg == NULL)
+if (!user_msg)
   {
-  s = expand_string(smtp_banner);
-  if (s == NULL)
+  if (!(s = expand_string(smtp_banner)))
     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Expansion of \"%s\" (smtp_banner) "
       "failed: %s", smtp_banner, expand_string_message);
   }
@@ -2395,20 +2542,20 @@ do       /* At least once, in case we have an empty string */
   {
   int len;
   uschar *linebreak = Ustrchr(p, '\n');
-  ss = string_cat(ss, &size, &ptr, code, 3);
+  ss = string_catn(ss, &size, &ptr, code, 3);
   if (linebreak == NULL)
     {
     len = Ustrlen(p);
-    ss = string_cat(ss, &size, &ptr, US" ", 1);
+    ss = string_catn(ss, &size, &ptr, US" ", 1);
     }
   else
     {
     len = linebreak - p;
-    ss = string_cat(ss, &size, &ptr, US"-", 1);
+    ss = string_catn(ss, &size, &ptr, US"-", 1);
     }
-  ss = string_cat(ss, &size, &ptr, esc, esclen);
-  ss = string_cat(ss, &size, &ptr, p, len);
-  ss = string_cat(ss, &size, &ptr, US"\r\n", 2);
+  ss = string_catn(ss, &size, &ptr, esc, esclen);
+  ss = string_catn(ss, &size, &ptr, p, len);
+  ss = string_catn(ss, &size, &ptr, US"\r\n", 2);
   p += len;
   if (linebreak != NULL) p++;
   }
@@ -2708,16 +2855,16 @@ uschar *lognl;
 uschar *sender_info = US"";
 uschar *what =
 #ifdef WITH_CONTENT_SCAN
-  (where == ACL_WHERE_MIME)? US"during MIME ACL checks" :
+  where == ACL_WHERE_MIME ? US"during MIME ACL checks" :
 #endif
-  (where == ACL_WHERE_PREDATA)? US"DATA" :
-  (where == ACL_WHERE_DATA)? US"after DATA" :
+  where == ACL_WHERE_PREDATA ? US"DATA" :
+  where == ACL_WHERE_DATA ? US"after DATA" :
 #ifndef DISABLE_PRDR
-  (where == ACL_WHERE_PRDR)? US"after DATA PRDR" :
+  where == ACL_WHERE_PRDR ? US"after DATA PRDR" :
 #endif
-  (smtp_cmd_data == NULL)?
-    string_sprintf("%s in \"connect\" ACL", acl_wherenames[where]) :
-    string_sprintf("%s %s", acl_wherenames[where], smtp_cmd_data);
+  smtp_cmd_data ?
+    string_sprintf("%s %s", acl_wherenames[where], smtp_cmd_data) :
+    string_sprintf("%s in \"connect\" ACL", acl_wherenames[where]);
 
 if (drop) rc = FAIL;
 
@@ -2794,16 +2941,16 @@ if (sender_verified_failed != NULL &&
 
 /* Sort out text for logging */
 
-log_msg = (log_msg == NULL)? US"" : string_sprintf(": %s", log_msg);
-lognl = Ustrchr(log_msg, '\n');
-if (lognl != NULL) *lognl = 0;
+log_msg = log_msg ? string_sprintf(": %s", log_msg) : US"";
+if ((lognl = Ustrchr(log_msg, '\n'))) *lognl = 0;
 
 /* Send permanent failure response to the command, but the code used isn't
 always a 5xx one - see comments at the start of this function. If the original
 rc was FAIL_DROP we drop the connection and yield 2. */
 
-if (rc == FAIL) smtp_respond(smtp_code, codelen, TRUE, (user_msg == NULL)?
-  US"Administrative prohibition" : user_msg);
+if (rc == FAIL)
+  smtp_respond(smtp_code, codelen, TRUE,
+    user_msg ? user_msg : US"Administrative prohibition");
 
 /* Send temporary failure response to the command. Don't give any details,
 unless acl_temp_details is set. This is TRUE for a callout defer, a "defer"
@@ -2814,21 +2961,19 @@ interactions between temp_details and return_error_details. One day it should
 be re-implemented in a tidier fashion. */
 
 else
-  {
-  if (acl_temp_details && user_msg != NULL)
+  if (acl_temp_details && user_msg)
     {
-    if (smtp_return_error_details &&
-        sender_verified_failed != NULL &&
-        sender_verified_failed->message != NULL)
-      {
+    if (  smtp_return_error_details
+       && sender_verified_failed
+       && sender_verified_failed->message
+       )
       smtp_respond(smtp_code, codelen, FALSE, sender_verified_failed->message);
-      }
+
     smtp_respond(smtp_code, codelen, TRUE, user_msg);
     }
   else
     smtp_respond(smtp_code, codelen, TRUE,
       US"Temporary local problem - please try later");
-  }
 
 /* Log the incident to the logs that are specified by log_reject_target
 (default main, reject). This can be empty to suppress logging of rejections. If
@@ -2838,14 +2983,19 @@ is closing if required and return 2.  */
 if (log_reject_target != 0)
   {
 #ifdef SUPPORT_TLS
-  uschar * s = s_tlslog(NULL, NULL, NULL);
-  if (!s) s = US"";
+  uschar * tls = s_tlslog(NULL, NULL, NULL);
+  if (!tls) tls = US"";
 #else
-  uschar * s = US"";
+  uschar * tls = US"";
 #endif
-  log_write(0, log_reject_target, "%s%s %s%srejected %s%s",
-    host_and_ident(TRUE), s,
-    sender_info, (rc == FAIL)? US"" : US"temporarily ", what, log_msg);
+  log_write(where == ACL_WHERE_CONNECT ? L_connection_reject : 0,
+    log_reject_target, "%s%s%s %s%srejected %s%s",
+    LOGGING(dnssec) && sender_host_dnssec ? US" DS" : US"",
+    host_and_ident(TRUE),
+    tls,
+    sender_info,
+    rc == FAIL ? US"" : US"temporarily ",
+    what, log_msg);
   }
 
 if (!drop) return 0;
@@ -2908,12 +3058,11 @@ smtp_exit_function_called = TRUE;
 
 /* Call the not-QUIT ACL, if there is one, unless no reason is given. */
 
-if (acl_smtp_notquit != NULL && reason != NULL)
+if (acl_smtp_notquit && reason)
   {
   smtp_notquit_reason = reason;
-  rc = acl_check(ACL_WHERE_NOTQUIT, NULL, acl_smtp_notquit, &user_msg,
-    &log_msg);
-  if (rc == ERROR)
+  if ((rc = acl_check(ACL_WHERE_NOTQUIT, NULL, acl_smtp_notquit, &user_msg,
+		      &log_msg)) == ERROR)
     log_write(0, LOG_MAIN|LOG_PANIC, "ACL for not-QUIT returned ERROR: %s",
       log_msg);
   }
@@ -2923,9 +3072,11 @@ responses are all internal, they should always fit in the buffer, but code a
 warning, just in case. Note that string_vformat() still leaves a complete
 string, even if it is incomplete. */
 
-if (code != NULL && defaultrespond != NULL)
+if (code && defaultrespond)
   {
-  if (user_msg == NULL)
+  if (user_msg)
+    smtp_respond(code, 3, TRUE, user_msg);
+  else
     {
     uschar buffer[128];
     va_list ap;
@@ -2935,8 +3086,6 @@ if (code != NULL && defaultrespond != NULL)
     smtp_printf("%s %s\r\n", code, buffer);
     va_end(ap);
     }
-  else
-    smtp_respond(code, 3, TRUE, user_msg);
   mac_smtp_fflush();
   }
 }
@@ -3212,6 +3361,68 @@ return rc;
 
 
 
+
+
+static int
+qualify_recipient(uschar ** recipient, uschar * smtp_cmd_data, uschar * tag)
+{
+int rd;
+if (allow_unqualified_recipient || strcmpic(*recipient, US"postmaster") == 0)
+  {
+  DEBUG(D_receive) debug_printf("unqualified address %s accepted\n",
+    *recipient);
+  rd = Ustrlen(recipient) + 1;
+  *recipient = rewrite_address_qualify(*recipient, TRUE);
+  return rd;
+  }
+smtp_printf("501 %s: recipient address must contain a domain\r\n",
+  smtp_cmd_data);
+log_write(L_smtp_syntax_error,
+  LOG_MAIN|LOG_REJECT, "unqualified %s rejected: <%s> %s%s",
+  tag, *recipient, host_and_ident(TRUE), host_lookup_msg);
+return 0;
+}
+
+
+
+
+static void
+smtp_quit_handler(uschar ** user_msgp, uschar ** log_msgp)
+{
+HAD(SCH_QUIT);
+incomplete_transaction_log(US"QUIT");
+if (acl_smtp_quit)
+  {
+  int rc = acl_check(ACL_WHERE_QUIT, NULL, acl_smtp_quit, user_msgp, log_msgp);
+  if (rc == ERROR)
+    log_write(0, LOG_MAIN|LOG_PANIC, "ACL for QUIT returned ERROR: %s",
+      *log_msgp);
+  }
+if (*user_msgp)
+  smtp_respond(US"221", 3, TRUE, *user_msgp);
+else
+  smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
+
+#ifdef SUPPORT_TLS
+tls_close(TRUE, TRUE);
+#endif
+
+log_write(L_smtp_connection, LOG_MAIN, "%s closed by QUIT",
+  smtp_get_connection_info());
+}
+
+
+static void
+smtp_rset_handler(void)
+{
+HAD(SCH_RSET);
+incomplete_transaction_log(US"RSET");
+smtp_printf("250 Reset OK\r\n");
+cmd_list[CMD_LIST_RSET].is_mail_cmd = FALSE;
+}
+
+
+
 /*************************************************
 *       Initialize for SMTP incoming message     *
 *************************************************/
@@ -3258,6 +3469,8 @@ for the host). Note: we do NOT reset AUTH at this point. */
 smtp_reset(reset_point);
 message_ended = END_NOTSTARTED;
 
+chunking_state = chunking_offered ? CHUNKING_OFFERED : CHUNKING_NOT_OFFERED;
+
 cmd_list[CMD_LIST_RSET].is_mail_cmd = TRUE;
 cmd_list[CMD_LIST_HELO].is_mail_cmd = TRUE;
 cmd_list[CMD_LIST_EHLO].is_mail_cmd = TRUE;
@@ -3323,14 +3536,20 @@ while (done <= 0)
 	smtp_cmd_data = NULL;
 
 	if (smtp_in_auth(au, &s, &ss) == OK)
-	  DEBUG(D_auth) debug_printf("tls auth succeeded\n");
+	  { DEBUG(D_auth) debug_printf("tls auth succeeded\n"); }
 	else
-	  DEBUG(D_auth) debug_printf("tls auth not succeeded\n");
+	  { DEBUG(D_auth) debug_printf("tls auth not succeeded\n"); }
 	break;
 	}
     }
 #endif
 
+#ifdef TCP_QUICKACK
+  if (smtp_in)		/* Avoid pure-ACKs while in cmd pingpong phase */
+    (void) setsockopt(fileno(smtp_in), IPPROTO_TCP, TCP_QUICKACK,
+	    US &off, sizeof(off));
+#endif
+
   switch(smtp_read_command(TRUE))
     {
     /* The AUTH command is not permitted to occur inside a transaction, and may
@@ -3593,10 +3812,9 @@ while (done <= 0)
 
       if (sender_host_address != NULL)
         {
-        s = string_cat(s, &size, &ptr, US" [", 2);
-        s = string_cat(s, &size, &ptr, sender_host_address,
-          Ustrlen(sender_host_address));
-        s = string_cat(s, &size, &ptr, US"]", 1);
+        s = string_catn(s, &size, &ptr, US" [", 2);
+        s = string_cat (s, &size, &ptr, sender_host_address);
+        s = string_catn(s, &size, &ptr, US"]", 1);
         }
       }
 
@@ -3620,7 +3838,7 @@ while (done <= 0)
       size = ptr + 1;
       }
 
-    s = string_cat(s, &size, &ptr, US"\r\n", 2);
+    s = string_catn(s, &size, &ptr, US"\r\n", 2);
 
     /* If we received EHLO, we must create a multiline response which includes
     the functions supported. */
@@ -3639,12 +3857,12 @@ while (done <= 0)
         {
         sprintf(CS big_buffer, "%.3s-SIZE %d\r\n", smtp_code,
           thismessage_size_limit);
-        s = string_cat(s, &size, &ptr, big_buffer, Ustrlen(big_buffer));
+        s = string_cat(s, &size, &ptr, big_buffer);
         }
       else
         {
-        s = string_cat(s, &size, &ptr, smtp_code, 3);
-        s = string_cat(s, &size, &ptr, US"-SIZE\r\n", 7);
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-SIZE\r\n", 7);
         }
 
       /* Exim does not do protocol conversion or data conversion. It is 8-bit
@@ -3656,15 +3874,15 @@ while (done <= 0)
 
       if (accept_8bitmime)
         {
-        s = string_cat(s, &size, &ptr, smtp_code, 3);
-        s = string_cat(s, &size, &ptr, US"-8BITMIME\r\n", 11);
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-8BITMIME\r\n", 11);
         }
 
       /* Advertise DSN support if configured to do so. */
       if (verify_check_host(&dsn_advertise_hosts) != FAIL)
         {
-        s = string_cat(s, &size, &ptr, smtp_code, 3);
-        s = string_cat(s, &size, &ptr, US"-DSN\r\n", 6);
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-DSN\r\n", 6);
         dsn_advertised = TRUE;
         }
 
@@ -3673,8 +3891,8 @@ while (done <= 0)
 
       if (acl_smtp_etrn != NULL)
         {
-        s = string_cat(s, &size, &ptr, smtp_code, 3);
-        s = string_cat(s, &size, &ptr, US"-ETRN\r\n", 7);
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-ETRN\r\n", 7);
         }
 
       /* Advertise EXPN if there's an ACL checking whether a host is
@@ -3682,8 +3900,8 @@ while (done <= 0)
 
       if (acl_smtp_expn != NULL)
         {
-        s = string_cat(s, &size, &ptr, smtp_code, 3);
-        s = string_cat(s, &size, &ptr, US"-EXPN\r\n", 7);
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-EXPN\r\n", 7);
         }
 
       /* Exim is quite happy with pipelining, so let the other end know that
@@ -3692,8 +3910,8 @@ while (done <= 0)
       if (pipelining_enable &&
           verify_check_host(&pipelining_advertise_hosts) == OK)
         {
-        s = string_cat(s, &size, &ptr, smtp_code, 3);
-        s = string_cat(s, &size, &ptr, US"-PIPELINING\r\n", 13);
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-PIPELINING\r\n", 13);
         sync_cmd_limit = NON_SYNC_CMD_PIPELINING;
         pipelining_advertised = TRUE;
         }
@@ -3726,24 +3944,33 @@ while (done <= 0)
 	    int saveptr;
 	    if (first)
 	      {
-	      s = string_cat(s, &size, &ptr, smtp_code, 3);
-	      s = string_cat(s, &size, &ptr, US"-AUTH", 5);
+	      s = string_catn(s, &size, &ptr, smtp_code, 3);
+	      s = string_catn(s, &size, &ptr, US"-AUTH", 5);
 	      first = FALSE;
 	      auth_advertised = TRUE;
 	      }
 	    saveptr = ptr;
-	    s = string_cat(s, &size, &ptr, US" ", 1);
-	    s = string_cat(s, &size, &ptr, au->public_name,
-	      Ustrlen(au->public_name));
+	    s = string_catn(s, &size, &ptr, US" ", 1);
+	    s = string_cat (s, &size, &ptr, au->public_name);
 	    while (++saveptr < ptr) s[saveptr] = toupper(s[saveptr]);
 	    au->advertised = TRUE;
 	    }
 	  else
 	    au->advertised = FALSE;
 
-	if (!first) s = string_cat(s, &size, &ptr, US"\r\n", 2);
+	if (!first) s = string_catn(s, &size, &ptr, US"\r\n", 2);
 	}
 
+      /* RFC 3030 CHUNKING */
+
+      if (verify_check_host(&chunking_advertise_hosts) != FAIL)
+        {
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-CHUNKING\r\n", 11);
+	chunking_offered = TRUE;
+	chunking_state = CHUNKING_OFFERED;
+        }
+
       /* Advertise TLS (Transport Level Security) aka SSL (Secure Socket Layer)
       if it has been included in the binary, and the host matches
       tls_advertise_hosts. We must *not* advertise if we are already in a
@@ -3753,8 +3980,8 @@ while (done <= 0)
       if (tls_in.active < 0 &&
           verify_check_host(&tls_advertise_hosts) != FAIL)
         {
-        s = string_cat(s, &size, &ptr, smtp_code, 3);
-        s = string_cat(s, &size, &ptr, US"-STARTTLS\r\n", 11);
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-STARTTLS\r\n", 11);
         tls_advertised = TRUE;
         }
 #endif
@@ -3763,8 +3990,8 @@ while (done <= 0)
       /* Per Recipient Data Response, draft by Eric A. Hall extending RFC */
       if (prdr_enable)
         {
-        s = string_cat(s, &size, &ptr, smtp_code, 3);
-        s = string_cat(s, &size, &ptr, US"-PRDR\r\n", 7);
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-PRDR\r\n", 7);
 	}
 #endif
 
@@ -3772,16 +3999,16 @@ while (done <= 0)
       if (  accept_8bitmime
          && verify_check_host(&smtputf8_advertise_hosts) != FAIL)
 	{
-        s = string_cat(s, &size, &ptr, smtp_code, 3);
-        s = string_cat(s, &size, &ptr, US"-SMTPUTF8\r\n", 11);
+        s = string_catn(s, &size, &ptr, smtp_code, 3);
+        s = string_catn(s, &size, &ptr, US"-SMTPUTF8\r\n", 11);
         smtputf8_advertised = TRUE;
 	}
 #endif
 
       /* Finish off the multiline reply with one that is always available. */
 
-      s = string_cat(s, &size, &ptr, smtp_code, 3);
-      s = string_cat(s, &size, &ptr, US" HELP\r\n", 7);
+      s = string_catn(s, &size, &ptr, smtp_code, 3);
+      s = string_catn(s, &size, &ptr, US" HELP\r\n", 7);
       }
 
     /* Terminate the string (for debug), write it, and note that HELO/EHLO
@@ -4100,13 +4327,11 @@ while (done <= 0)
 		    global_rewrite_rules)
       : smtp_cmd_data;
 
-    /* rfc821_domains = TRUE; << no longer needed */
     raw_sender =
       parse_extract_address(raw_sender, &errmess, &start, &end, &sender_domain,
         TRUE);
-    /* rfc821_domains = FALSE; << no longer needed */
 
-    if (raw_sender == NULL)
+    if (!raw_sender)
       {
       done = synprot_error(L_smtp_syntax_error, 501, smtp_cmd_data, errmess);
       break;
@@ -4351,16 +4576,13 @@ while (done <= 0)
     /* Apply SMTP rewriting then extract the working address. Don't allow "<>"
     as a recipient address */
 
-    recipient = ((rewrite_existflags & rewrite_smtp) != 0)?
-      rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
-        global_rewrite_rules) : smtp_cmd_data;
-
-    /* rfc821_domains = TRUE; << no longer needed */
-    recipient = parse_extract_address(recipient, &errmess, &start, &end,
-      &recipient_domain, FALSE);
-    /* rfc821_domains = FALSE; << no longer needed */
+    recipient = rewrite_existflags & rewrite_smtp
+      ? rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
+	  global_rewrite_rules)
+      : smtp_cmd_data;
 
-    if (recipient == NULL)
+    if (!(recipient = parse_extract_address(recipient, &errmess, &start, &end,
+      &recipient_domain, FALSE)))
       {
       done = synprot_error(L_smtp_syntax_error, 501, smtp_cmd_data, errmess);
       rcpt_fail_count++;
@@ -4379,27 +4601,12 @@ while (done <= 0)
     we must always qualify this address, regardless. */
 
     if (recipient_domain == 0)
-      {
-      if (allow_unqualified_recipient ||
-          strcmpic(recipient, US"postmaster") == 0)
-        {
-        DEBUG(D_receive) debug_printf("unqualified address %s accepted\n",
-          recipient);
-        recipient_domain = Ustrlen(recipient) + 1;
-        recipient = rewrite_address_qualify(recipient, TRUE);
-        }
-      else
+      if (!(recipient_domain = qualify_recipient(&recipient, smtp_cmd_data,
+				  US"recipient")))
         {
         rcpt_fail_count++;
-        smtp_printf("501 %s: recipient address must contain a domain\r\n",
-          smtp_cmd_data);
-        log_write(L_smtp_syntax_error,
-          LOG_MAIN|LOG_REJECT, "unqualified recipient rejected: "
-          "<%s> %s%s", recipient, host_and_ident(TRUE),
-          host_lookup_msg);
         break;
         }
-      }
 
     /* Check maximum allowed */
 
@@ -4446,20 +4653,22 @@ while (done <= 0)
     there may be a delay in this, re-check for a synchronization error
     afterwards, unless pipelining was advertised. */
 
-    if (recipients_discarded) rc = DISCARD; else
-      {
-      rc = acl_check(ACL_WHERE_RCPT, recipient, acl_smtp_rcpt, &user_msg,
-        &log_msg);
-      if (rc == OK && !pipelining_advertised && !check_sync())
+    if (recipients_discarded)
+      rc = DISCARD;
+    else
+      if (  (rc = acl_check(ACL_WHERE_RCPT, recipient, acl_smtp_rcpt, &user_msg,
+		    &log_msg)) == OK
+	 && !pipelining_advertised && !check_sync())
         goto SYNC_FAILURE;
-      }
 
     /* The ACL was happy */
 
     if (rc == OK)
       {
-      if (user_msg == NULL) smtp_printf("250 Accepted\r\n");
-        else smtp_user_msg(US"250", user_msg);
+      if (user_msg)
+        smtp_user_msg(US"250", user_msg);
+      else
+        smtp_printf("250 Accepted\r\n");
       receive_add_recipient(recipient, -1);
 
       /* Set the dsn flags in the recipients_list */
@@ -4475,8 +4684,10 @@ while (done <= 0)
 
     else if (rc == DISCARD)
       {
-      if (user_msg == NULL) smtp_printf("250 Accepted\r\n");
-        else smtp_user_msg(US"250", user_msg);
+      if (user_msg)
+        smtp_user_msg(US"250", user_msg);
+      else
+        smtp_printf("250 Accepted\r\n");
       rcpt_fail_count++;
       discarded = TRUE;
       log_write(0, LOG_MAIN|LOG_REJECT, "%s F=<%s> RCPT %s: "
@@ -4516,8 +4727,44 @@ while (done <= 0)
     (often indicating some kind of system error), it is helpful to include it
     with the DATA rejection (an idea suggested by Tony Finch). */
 
+    case BDAT_CMD:
+    HAD(SCH_BDAT);
+      {
+      int n;
+
+      if (chunking_state != CHUNKING_OFFERED)
+	{
+	done = synprot_error(L_smtp_protocol_error, 503, NULL,
+	  US"BDAT command used when CHUNKING not advertised");
+	break;
+	}
+
+      /* grab size, endmarker */
+
+      if (sscanf(CS smtp_cmd_data, "%u %n", &chunking_datasize, &n) < 1)
+	{
+	done = synprot_error(L_smtp_protocol_error, 501, NULL,
+	  US"missing size for BDAT command");
+	break;
+	}
+      chunking_state = strcmpic(smtp_cmd_data+n, US"LAST") == 0
+	? CHUNKING_LAST : CHUNKING_ACTIVE;
+      chunking_data_left = chunking_datasize;
+
+      lwr_receive_getc = receive_getc;
+      lwr_receive_ungetc = receive_ungetc;
+      receive_getc = bdat_getc;
+      receive_ungetc = bdat_ungetc;
+
+      DEBUG(D_any)
+        debug_printf("chunking state %d\n", (int)chunking_state);
+      goto DATA_BDAT;
+      }
+
     case DATA_CMD:
     HAD(SCH_DATA);
+
+    DATA_BDAT:		/* Common code for DATA and BDAT */
     if (!discarded && recipients_count <= 0)
       {
       if (rcpt_smtp_response_same && rcpt_smtp_response != NULL)
@@ -4532,10 +4779,16 @@ while (done <= 0)
         smtp_respond(code, 3, FALSE, rcpt_smtp_response);
         }
       if (pipelining_advertised && last_was_rcpt)
-        smtp_printf("503 Valid RCPT command must precede DATA\r\n");
+        smtp_printf("503 Valid RCPT command must precede %s\r\n",
+	  smtp_names[smtp_connection_had[smtp_ch_index-1]]);
       else
         done = synprot_error(L_smtp_protocol_error, 503, NULL,
-          US"valid RCPT command must precede DATA");
+	  smtp_connection_had[smtp_ch_index-1] == SCH_DATA
+	  ? US"valid RCPT command must precede DATA"
+	  : US"valid RCPT command must precede BDAT");
+
+      if (chunking_state > CHUNKING_OFFERED)
+	bdat_flush_data();
       break;
       }
 
@@ -4547,35 +4800,48 @@ while (done <= 0)
       break;
       }
 
-    /* If there is an ACL, re-check the synchronization afterwards, since the
-    ACL may have delayed.  To handle cutthrough delivery enforce a dummy call
-    to get the DATA command sent. */
-
-    if (acl_smtp_predata == NULL && cutthrough.fd < 0) rc = OK; else
+    if (chunking_state > CHUNKING_OFFERED)
+      rc = OK;			/* No predata ACL or go-ahead output for BDAT */
+    else
       {
-      uschar * acl= acl_smtp_predata ? acl_smtp_predata : US"accept";
-      enable_dollar_recipients = TRUE;
-      rc = acl_check(ACL_WHERE_PREDATA, NULL, acl, &user_msg,
-        &log_msg);
-      enable_dollar_recipients = FALSE;
-      if (rc == OK && !check_sync()) goto SYNC_FAILURE;
-      }
+      /* If there is an ACL, re-check the synchronization afterwards, since the
+      ACL may have delayed.  To handle cutthrough delivery enforce a dummy call
+      to get the DATA command sent. */
 
-    if (rc == OK)
-      {
-      uschar * code;
-      code = US"354";
-      if (user_msg == NULL)
-        smtp_printf("%s Enter message, ending with \".\" on a line by itself\r\n", code);
-      else smtp_user_msg(code, user_msg);
-      done = 3;
-      message_ended = END_NOTENDED;   /* Indicate in middle of data */
+      if (acl_smtp_predata == NULL && cutthrough.fd < 0)
+	rc = OK;
+      else
+	{
+	uschar * acl = acl_smtp_predata ? acl_smtp_predata : US"accept";
+	enable_dollar_recipients = TRUE;
+	rc = acl_check(ACL_WHERE_PREDATA, NULL, acl, &user_msg,
+	  &log_msg);
+	enable_dollar_recipients = FALSE;
+	if (rc == OK && !check_sync())
+	  goto SYNC_FAILURE;
+
+	if (rc != OK)
+	  {	/* Either the ACL failed the address, or it was deferred. */
+	  done = smtp_handle_acl_fail(ACL_WHERE_PREDATA, rc, user_msg, log_msg);
+	  break;
+	  }
+	}
+
+      if (user_msg)
+	smtp_user_msg(US"354", user_msg);
+      else
+	smtp_printf(
+	  "354 Enter message, ending with \".\" on a line by itself\r\n");
       }
 
-    /* Either the ACL failed the address, or it was deferred. */
+#ifdef TCP_QUICKACK
+    if (smtp_in)	/* all ACKs needed to ramp window up for bulk data */
+      (void) setsockopt(fileno(smtp_in), IPPROTO_TCP, TCP_QUICKACK,
+	      US &on, sizeof(on));
+#endif
+    done = 3;
+    message_ended = END_NOTENDED;   /* Indicate in middle of data */
 
-    else
-      done = smtp_handle_acl_fail(ACL_WHERE_PREDATA, rc, user_msg, log_msg);
     break;
 
 
@@ -4585,18 +4851,26 @@ while (done <= 0)
 
       HAD(SCH_VRFY);
 
-      if(!(address = parse_extract_address(smtp_cmd_data, &errmess, &start, &end,
-	    &recipient_domain, FALSE)))
+      if (!(address = parse_extract_address(smtp_cmd_data, &errmess,
+            &start, &end, &recipient_domain, FALSE)))
+	{
 	smtp_printf("501 %s\r\n", errmess);
+	break;
+	}
+
+      if (recipient_domain == 0)
+	if (!(recipient_domain = qualify_recipient(&address, smtp_cmd_data,
+				    US"verify")))
+	  break;
 
-      else if ((rc = acl_check(ACL_WHERE_VRFY, address, acl_smtp_vrfy,
+      if ((rc = acl_check(ACL_WHERE_VRFY, address, acl_smtp_vrfy,
 		    &user_msg, &log_msg)) != OK)
 	done = smtp_handle_acl_fail(ACL_WHERE_VRFY, rc, user_msg, log_msg);
       else
 	{
-	uschar *s = NULL;
+	uschar * s = NULL;
+	address_item * addr = deliver_make_addr(address, FALSE);
 
-	address_item *addr = deliver_make_addr(address, FALSE);
 	switch(verify_address(addr, NULL, vopt_is_recipient | vopt_qualify, -1,
 	       -1, -1, NULL, NULL, NULL))
 	  {
@@ -4686,7 +4960,7 @@ while (done <= 0)
     if (receive_smtp_buffered())
       {
       DEBUG(D_any)
-        debug_printf("Non-empty input buffer after STARTTLS; naive attack?");
+        debug_printf("Non-empty input buffer after STARTTLS; naive attack?\n");
       if (tls_in.active < 0)
         smtp_inend = smtp_inptr = smtp_inbuffer;
       /* and if TLS is already active, tls_server_start() should fail */
@@ -4753,45 +5027,39 @@ while (done <= 0)
     set, but we must still reject all incoming commands. */
 
     DEBUG(D_tls) debug_printf("TLS failed to start\n");
-    while (done <= 0)
+    while (done <= 0) switch(smtp_read_command(FALSE))
       {
-      switch(smtp_read_command(FALSE))
-        {
-        case EOF_CMD:
-        log_write(L_smtp_connection, LOG_MAIN, "%s closed by EOF",
-          smtp_get_connection_info());
-        smtp_notquit_exit(US"tls-failed", NULL, NULL);
-        done = 2;
-        break;
-
-        /* It is perhaps arguable as to which exit ACL should be called here,
-        but as it is probably a situation that almost never arises, it
-        probably doesn't matter. We choose to call the real QUIT ACL, which in
-        some sense is perhaps "right". */
+      case EOF_CMD:
+	log_write(L_smtp_connection, LOG_MAIN, "%s closed by EOF",
+	  smtp_get_connection_info());
+	smtp_notquit_exit(US"tls-failed", NULL, NULL);
+	done = 2;
+	break;
 
-        case QUIT_CMD:
-        user_msg = NULL;
-        if (acl_smtp_quit != NULL)
-          {
-          rc = acl_check(ACL_WHERE_QUIT, NULL, acl_smtp_quit, &user_msg,
-            &log_msg);
-          if (rc == ERROR)
-            log_write(0, LOG_MAIN|LOG_PANIC, "ACL for QUIT returned ERROR: %s",
-              log_msg);
-          }
-        if (user_msg == NULL)
-          smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
-        else
-          smtp_respond(US"221", 3, TRUE, user_msg);
-        log_write(L_smtp_connection, LOG_MAIN, "%s closed by QUIT",
-          smtp_get_connection_info());
-        done = 2;
-        break;
+      /* It is perhaps arguable as to which exit ACL should be called here,
+      but as it is probably a situation that almost never arises, it
+      probably doesn't matter. We choose to call the real QUIT ACL, which in
+      some sense is perhaps "right". */
+
+      case QUIT_CMD:
+	user_msg = NULL;
+	if (  acl_smtp_quit
+	   && ((rc = acl_check(ACL_WHERE_QUIT, NULL, acl_smtp_quit, &user_msg,
+			      &log_msg)) == ERROR))
+	    log_write(0, LOG_MAIN|LOG_PANIC, "ACL for QUIT returned ERROR: %s",
+	      log_msg);
+	if (user_msg)
+	  smtp_respond(US"221", 3, TRUE, user_msg);
+	else
+	  smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
+	log_write(L_smtp_connection, LOG_MAIN, "%s closed by QUIT",
+	  smtp_get_connection_info());
+	done = 2;
+	break;
 
-        default:
-        smtp_printf("554 Security failure\r\n");
-        break;
-        }
+      default:
+	smtp_printf("554 Security failure\r\n");
+	break;
       }
     tls_close(TRUE, TRUE);
     break;
@@ -4803,37 +5071,15 @@ while (done <= 0)
     message. */
 
     case QUIT_CMD:
-    HAD(SCH_QUIT);
-    incomplete_transaction_log(US"QUIT");
-    if (acl_smtp_quit != NULL)
-      {
-      rc = acl_check(ACL_WHERE_QUIT, NULL, acl_smtp_quit, &user_msg, &log_msg);
-      if (rc == ERROR)
-        log_write(0, LOG_MAIN|LOG_PANIC, "ACL for QUIT returned ERROR: %s",
-          log_msg);
-      }
-    if (user_msg == NULL)
-      smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
-    else
-      smtp_respond(US"221", 3, TRUE, user_msg);
-
-    #ifdef SUPPORT_TLS
-    tls_close(TRUE, TRUE);
-    #endif
-
+    smtp_quit_handler(&user_msg, &log_msg);
     done = 2;
-    log_write(L_smtp_connection, LOG_MAIN, "%s closed by QUIT",
-      smtp_get_connection_info());
     break;
 
 
     case RSET_CMD:
-    HAD(SCH_RSET);
-    incomplete_transaction_log(US"RSET");
+    smtp_rset_handler();
     smtp_reset(reset_point);
     toomany = FALSE;
-    smtp_printf("250 Reset OK\r\n");
-    cmd_list[CMD_LIST_RSET].is_mail_cmd = FALSE;
     break;
 
 
@@ -4860,7 +5106,7 @@ while (done <= 0)
           verify_check_host(&tls_advertise_hosts) != FAIL)
         Ustrcat(buffer, " STARTTLS");
       #endif
-      Ustrcat(buffer, " HELO EHLO MAIL RCPT DATA");
+      Ustrcat(buffer, " HELO EHLO MAIL RCPT DATA BDAT");
       Ustrcat(buffer, " NOOP QUIT RSET HELP");
       if (acl_smtp_etrn != NULL) Ustrcat(buffer, " ETRN");
       if (acl_smtp_expn != NULL) Ustrcat(buffer, " EXPN");
@@ -4950,8 +5196,10 @@ while (done <= 0)
         break;
         }
       etrn_command = US"exim -R";
-      argv = CUSS child_exec_exim(CEE_RETURN_ARGV, TRUE, NULL, TRUE, 2, US"-R",
-        smtp_cmd_data);
+      argv = CUSS child_exec_exim(CEE_RETURN_ARGV, TRUE, NULL, TRUE,
+        *queue_name ? 4 : 2,
+	US"-R", smtp_cmd_data,
+	US"-MCG", queue_name);
       }
 
     /* If we are host-testing, don't actually do anything. */
diff --git a/src/src/smtp_out.c b/src/src/smtp_out.c
index c55b29254..3154c9767 100644
--- a/src/src/smtp_out.c
+++ b/src/src/smtp_out.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* A number of functions for driving outgoing SMTP calls. */
@@ -41,10 +41,9 @@ const uschar * expint;
 uschar *iface;
 int sep = 0;
 
-if (istring == NULL) return TRUE;
+if (!istring) return TRUE;
 
-expint = expand_string(istring);
-if (expint == NULL)
+if (!(expint = expand_string(istring)))
   {
   if (expand_string_forcedfail) return TRUE;
   addr->transport_return = PANIC;
@@ -57,7 +56,7 @@ while (isspace(*expint)) expint++;
 if (*expint == 0) return TRUE;
 
 while ((iface = string_nextinlist(&expint, &sep, big_buffer,
-          big_buffer_size)) != NULL)
+          big_buffer_size)))
   {
   if (string_is_ip_address(iface, NULL) == 0)
     {
@@ -72,7 +71,7 @@ while ((iface = string_nextinlist(&expint, &sep, big_buffer,
     break;
   }
 
-if (iface != NULL) *interface = string_copy(iface);
+if (iface) *interface = string_copy(iface);
 return TRUE;
 }
 
@@ -152,8 +151,8 @@ int dscp_value;
 int dscp_level;
 int dscp_option;
 int sock;
-int on = 1;
 int save_errno = 0;
+BOOL fastopen = FALSE;
 
 #ifndef DISABLE_EVENT
 deliver_host_address = host->address;
@@ -165,7 +164,9 @@ if ((sock = ip_socket(SOCK_STREAM, host_af)) < 0) return -1;
 
 /* Set TCP_NODELAY; Exim does its own buffering. */
 
-setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, (uschar *)(&on), sizeof(on));
+if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, US &on, sizeof(on)))
+  HDEBUG(D_transport|D_acl|D_v)
+    debug_printf("failed to set NODELAY: %s ", strerror(errno));
 
 /* Set DSCP value, if we can. For now, if we fail to set the value, we don't
 bomb out, just log it and continue in default traffic class. */
@@ -184,6 +185,10 @@ if (dscp && dscp_lookup(dscp, host_af, &dscp_level, &dscp_option, &dscp_value))
     (void) setsockopt(sock, dscp_level, dscp_option, &dscp_value, sizeof(dscp_value));
   }
 
+#ifdef TCP_FASTOPEN
+if (verify_check_given_host (&ob->hosts_try_fastopen, host) == OK) fastopen = TRUE;
+#endif
+
 /* Bind to a specific interface if requested. Caller must ensure the interface
 is the same type (IPv4 or IPv6) as the outgoing address. */
 
@@ -198,7 +203,7 @@ if (interface && ip_bind(sock, host_af, interface, 0) < 0)
 /* Connect to the remote host, and add keepalive to the socket before returning
 it, if requested. */
 
-else if (ip_connect(sock, host_af, host->address, port, timeout) < 0)
+else if (ip_connect(sock, host_af, host->address, port, timeout, fastopen) < 0)
   save_errno = errno;
 
 /* Either bind() or connect() failed */
@@ -322,14 +327,16 @@ static BOOL
 flush_buffer(smtp_outblock *outblock)
 {
 int rc;
+int n = outblock->ptr - outblock->buffer;
 
+HDEBUG(D_transport|D_acl) debug_printf("cmd buf flush %d bytes\n", n);
 #ifdef SUPPORT_TLS
 if (tls_out.active == outblock->sock)
-  rc = tls_write(FALSE, outblock->buffer, outblock->ptr - outblock->buffer);
+  rc = tls_write(FALSE, outblock->buffer, n);
 else
 #endif
+  rc = send(outblock->sock, outblock->buffer, n, 0);
 
-rc = send(outblock->sock, outblock->buffer, outblock->ptr - outblock->buffer, 0);
 if (rc <= 0)
   {
   HDEBUG(D_transport|D_acl) debug_printf("send failed: %s\n", strerror(errno));
@@ -355,6 +362,7 @@ Arguments:
   noflush    if TRUE, save the command in the output buffer, for pipelining
   format     a format, starting with one of
              of HELO, MAIL FROM, RCPT TO, DATA, ".", or QUIT.
+	     If NULL, flush pipeline buffer only.
   ...        data for the format
 
 Returns:     0 if command added to pipelining buffer, with nothing transmitted
@@ -369,48 +377,51 @@ int count;
 int rc = 0;
 va_list ap;
 
-va_start(ap, format);
-if (!string_vformat(big_buffer, big_buffer_size, CS format, ap))
-  log_write(0, LOG_MAIN|LOG_PANIC_DIE, "overlong write_command in outgoing "
-    "SMTP");
-va_end(ap);
-count = Ustrlen(big_buffer);
-
-if (count > outblock->buffersize)
-  log_write(0, LOG_MAIN|LOG_PANIC_DIE, "overlong write_command in outgoing "
-    "SMTP");
-
-if (count > outblock->buffersize - (outblock->ptr - outblock->buffer))
+if (format)
   {
-  rc = outblock->cmd_count;                 /* flush resets */
-  if (!flush_buffer(outblock)) return -1;
-  }
+  va_start(ap, format);
+  if (!string_vformat(big_buffer, big_buffer_size, CS format, ap))
+    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "overlong write_command in outgoing "
+      "SMTP");
+  va_end(ap);
+  count = Ustrlen(big_buffer);
+
+  if (count > outblock->buffersize)
+    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "overlong write_command in outgoing "
+      "SMTP");
+
+  if (count > outblock->buffersize - (outblock->ptr - outblock->buffer))
+    {
+    rc = outblock->cmd_count;                 /* flush resets */
+    if (!flush_buffer(outblock)) return -1;
+    }
 
-Ustrncpy(CS outblock->ptr, big_buffer, count);
-outblock->ptr += count;
-outblock->cmd_count++;
-count -= 2;
-big_buffer[count] = 0;     /* remove \r\n for error message */
+  Ustrncpy(CS outblock->ptr, big_buffer, count);
+  outblock->ptr += count;
+  outblock->cmd_count++;
+  count -= 2;
+  big_buffer[count] = 0;     /* remove \r\n for error message */
 
-/* We want to hide the actual data sent in AUTH transactions from reflections
-and logs. While authenticating, a flag is set in the outblock to enable this.
-The AUTH command itself gets any data flattened. Other lines are flattened
-completely. */
+  /* We want to hide the actual data sent in AUTH transactions from reflections
+  and logs. While authenticating, a flag is set in the outblock to enable this.
+  The AUTH command itself gets any data flattened. Other lines are flattened
+  completely. */
 
-if (outblock->authenticating)
-  {
-  uschar *p = big_buffer;
-  if (Ustrncmp(big_buffer, "AUTH ", 5) == 0)
+  if (outblock->authenticating)
     {
-    p += 5;
-    while (isspace(*p)) p++;
-    while (!isspace(*p)) p++;
-    while (isspace(*p)) p++;
+    uschar *p = big_buffer;
+    if (Ustrncmp(big_buffer, "AUTH ", 5) == 0)
+      {
+      p += 5;
+      while (isspace(*p)) p++;
+      while (!isspace(*p)) p++;
+      while (isspace(*p)) p++;
+      }
+    while (*p != 0) *p++ = '*';
     }
-  while (*p != 0) *p++ = '*';
-  }
 
-HDEBUG(D_transport|D_acl|D_v) debug_printf("  SMTP>> %s\n", big_buffer);
+  HDEBUG(D_transport|D_acl|D_v) debug_printf("  SMTP>> %s\n", big_buffer);
+  }
 
 if (!noflush)
   {
@@ -525,7 +536,7 @@ Arguments:
   buffer    where to put the response
   size      the size of the buffer
   okdigit   the expected first digit of the response
-  timeout   the timeout to use
+  timeout   the timeout to use, in seconds
 
 Returns:    TRUE if a valid, non-error response was received; else FALSE
 */
diff --git a/src/src/spam.c b/src/src/spam.c
index 6a0ca3c20..93c0a540d 100644
--- a/src/src/spam.c
+++ b/src/src/spam.c
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015 */
-/* License: GPL */
+/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
+ * License: GPL
+ * Copyright (c) The Exim Maintainers 2016
+ */
 
 /* Code for calling spamassassin's spamd. Called from acl.c. */
 
@@ -139,7 +141,7 @@ long rnd, weights;
 unsigned pri;
 static BOOL srandomed = FALSE;
 
-/* seedup, if we have only 1 server */
+/* speedup, if we have only 1 server */
 if (num_servers == 1)
   return (spamds[0]->is_failed ? -1 : 0);
 
@@ -367,13 +369,6 @@ start = time(NULL);
     }
   }
 
-if (spamd_sock == -1)
-  {
-  log_write(0, LOG_MAIN|LOG_PANIC,
-      "programming fault, spamd_sock unexpectedly unset");
-  goto defer;
-  }
-
 (void)fcntl(spamd_sock, F_SETFL, O_NONBLOCK);
 /* now we are connected to spamd on spamd_sock */
 if (sd->is_rspamd)
@@ -499,7 +494,8 @@ if (ferror(mbox_file))
 (void)fclose(mbox_file);
 
 /* we're done sending, close socket for writing */
-shutdown(spamd_sock,SHUT_WR);
+if (!sd->is_rspamd)
+  shutdown(spamd_sock,SHUT_WR);
 
 /* read spamd response using what's left of the timeout.  */
 memset(spamd_buffer, 0, sizeof(spamd_buffer));
@@ -507,8 +503,9 @@ offset = 0;
 while ((i = ip_recv(spamd_sock,
 		   spamd_buffer + offset,
 		   sizeof(spamd_buffer) - offset - 1,
-		   sd->timeout - time(NULL) + start)) > 0 )
+		   sd->timeout - time(NULL) + start)) > 0)
   offset += i;
+spamd_buffer[offset] = '\0';	/* guard byte */
 
 /* error handling */
 if (i <= 0 && errno != 0)
@@ -525,10 +522,12 @@ if (i <= 0 && errno != 0)
 if (sd->is_rspamd)
   {				/* rspamd variant of reply */
   int r;
-  if ((r = sscanf(CS spamd_buffer,
+  if (  (r = sscanf(CS spamd_buffer,
 	  "RSPAMD/%7s 0 EX_OK\r\nMetric: default; %7s %lf / %lf / %lf\r\n%n",
 	  spamd_version, spamd_short_result, &spamd_score, &spamd_threshold,
-	  &spamd_reject_score, &spamd_report_offset)) != 5)
+	  &spamd_reject_score, &spamd_report_offset)) != 5
+     || spamd_report_offset >= offset		/* verify within buffer */
+     )
     {
     log_write(0, LOG_MAIN|LOG_PANIC,
 	      "%s cannot parse spamd %s, output: %d", loglabel, callout_address, r);
diff --git a/src/src/spf.c b/src/src/spf.c
index 7167f5778..9ab56af23 100644
--- a/src/src/spf.c
+++ b/src/src/spf.c
@@ -4,7 +4,9 @@
 
 /* Experimental SPF support.
    Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004 - 2014
-   License: GPL */
+   License: GPL
+   Copyright (c) The Exim Maintainers 2016
+*/
 
 /* Code for calling spf checks via libspf-alt. Called from acl.c. */
 
@@ -74,9 +76,9 @@ int spf_init(uschar *spf_helo_domain, uschar *spf_remote_addr) {
    context (if any), retrieves the result, sets up expansion
    strings and evaluates the condition outcome. */
 
-int spf_process(uschar **listptr, uschar *spf_envelope_sender, int action) {
+int spf_process(const uschar **listptr, uschar *spf_envelope_sender, int action) {
   int sep = 0;
-  uschar *list = *listptr;
+  const uschar *list = *listptr;
   uschar *spf_result_id;
   uschar spf_result_id_buffer[128];
   int rc = SPF_RESULT_PERMERROR;
diff --git a/src/src/spf.h b/src/src/spf.h
index 0ce5d007a..2a7c04094 100644
--- a/src/src/spf.h
+++ b/src/src/spf.h
@@ -4,13 +4,15 @@
 
 /* Experimental SPF support.
    Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004
-   License: GPL */
+   License: GPL
+   Copyright (c) The Exim Maintainers 2016
+*/
 
 #ifdef EXPERIMENTAL_SPF
 
 /* Yes, we do have ns_type. spf.h redefines it if we don't set this. Doh */
 #ifndef HAVE_NS_TYPE
-#define HAVE_NS_TYPE
+# define HAVE_NS_TYPE
 #endif
 #include <spf2/spf.h>
 
@@ -24,7 +26,7 @@ typedef struct spf_result_id {
 
 /* prototypes */
 int spf_init(uschar *,uschar *);
-int spf_process(uschar **, uschar *, int);
+int spf_process(const uschar **, uschar *, int);
 
 #define SPF_PROCESS_NORMAL  0
 #define SPF_PROCESS_GUESS   1
diff --git a/src/src/spool_in.c b/src/src/spool_in.c
index 59192ef30..e1d6e3422 100644
--- a/src/src/spool_in.c
+++ b/src/src/spool_in.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for reading spool files. When compiling for a utility (eximon),
@@ -25,19 +25,21 @@ fact it won't be written to. Just in case there's a major disaster (e.g.
 overwriting some other file descriptor with the value of this one), open it
 with append.
 
+As called by deliver_message() (at least) we are operating as root.
+
 Argument: the id of the message
-Returns:  TRUE if file successfully opened and locked
+Returns:  fd if file successfully opened and locked, else -1
 
-Side effect: deliver_datafile is set to the fd of the open file.
+Side effect: message_subdir is set for the (possibly split) spool directory
 */
 
-BOOL
+int
 spool_open_datafile(uschar *id)
 {
 int i;
 struct stat statbuf;
 flock_t lock_data;
-uschar spoolname[256];
+int fd;
 
 /* If split_spool_directory is set, first look for the file in the appropriate
 sub-directory of the input directory. If it is not found there, try the input
@@ -48,22 +50,33 @@ splitting state. */
 
 for (i = 0; i < 2; i++)
   {
+  uschar * fname;
   int save_errno;
-  message_subdir[0] = (split_spool_directory == (i == 0))? id[5] : 0;
-  sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir, id);
-  deliver_datafile = Uopen(spoolname, O_RDWR | O_APPEND, 0);
-  if (deliver_datafile >= 0) break;
+
+  message_subdir[0] = split_spool_directory == i ? '\0' : id[5];
+  fname = spool_fname(US"input", message_subdir, id, US"-D");
+  DEBUG(D_deliver) debug_printf("Trying spool file %s\n", fname);
+
+  if ((fd = Uopen(fname,
+#ifdef O_CLOEXEC
+		      O_CLOEXEC |
+#endif
+		      O_RDWR | O_APPEND, 0)) >= 0)
+    break;
   save_errno = errno;
   if (errno == ENOENT)
     {
     if (i == 0) continue;
     if (!queue_running)
-      log_write(0, LOG_MAIN, "Spool file %s-D not found", id);
+      log_write(0, LOG_MAIN, "Spool%s%s file %s-D not found",
+	*queue_name ? US" Q=" : US"",
+	*queue_name ? queue_name : US"",
+	id);
     }
-  else log_write(0, LOG_MAIN, "Spool error for %s: %s", spoolname,
-    strerror(errno));
+  else
+    log_write(0, LOG_MAIN, "Spool error for %s: %s", fname, strerror(errno));
   errno = save_errno;
-  return FALSE;
+  return -1;
   }
 
 /* File is open and message_subdir is set. Set the close-on-exec flag, and lock
@@ -74,35 +87,35 @@ an open file descriptor (at least, I think that's the Cygwin story). On real
 Unix systems it doesn't make any difference as long as Exim is consistent in
 what it locks. */
 
-(void)fcntl(deliver_datafile, F_SETFD, fcntl(deliver_datafile, F_GETFD) |
-  FD_CLOEXEC);
+#ifndef O_CLOEXEC
+(void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+#endif
 
 lock_data.l_type = F_WRLCK;
 lock_data.l_whence = SEEK_SET;
 lock_data.l_start = 0;
 lock_data.l_len = SPOOL_DATA_START_OFFSET;
 
-if (fcntl(deliver_datafile, F_SETLK, &lock_data) < 0)
+if (fcntl(fd, F_SETLK, &lock_data) < 0)
   {
   log_write(L_skip_delivery,
             LOG_MAIN,
             "Spool file is locked (another process is handling this message)");
-  (void)close(deliver_datafile);
-  deliver_datafile = -1;
+  (void)close(fd);
   errno = 0;
-  return FALSE;
+  return -1;
   }
 
 /* Get the size of the data; don't include the leading filename line
 in the count, but add one for the newline before the data. */
 
-if (fstat(deliver_datafile, &statbuf) == 0)
+if (fstat(fd, &statbuf) == 0)
   {
   message_body_size = statbuf.st_size - SPOOL_DATA_START_OFFSET;
   message_size = message_body_size + 1;
   }
 
-return TRUE;
+return fd;
 }
 #endif  /* COMPILE_UTILITY */
 
@@ -209,6 +222,8 @@ have been the cause of that incident, but in any case, this code must be robust
 against such an event, and if such a file is encountered, it must be treated as
 malformed.
 
+As called from deliver_message() (at least) we are running as root.
+
 Arguments:
   name          name of the header file, including the -H
   read_headers  TRUE if in-store header structures are to be built
@@ -318,12 +333,12 @@ and unsplit directories, as for the data file above. */
 for (n = 0; n < 2; n++)
   {
   if (!subdir_set)
-    message_subdir[0] = (split_spool_directory == (n == 0))? name[5] : 0;
-  sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-    name);
-  f = Ufopen(big_buffer, "rb");
-  if (f != NULL) break;
-  if (n != 0 || subdir_set || errno != ENOENT) return spool_read_notopen;
+    message_subdir[0] = split_spool_directory == (n == 0) ? name[5] : 0;
+
+  if ((f = Ufopen(spool_fname(US"input", message_subdir, name, US""), "rb")))
+    break;
+  if (n != 0 || subdir_set || errno != ENOENT)
+    return spool_read_notopen;
   }
 
 errno = 0;
@@ -470,19 +485,24 @@ for (;;)
 
     else if (Ustrncmp(p, "cl ", 3) == 0)
       {
-      int index, count;
-      uschar name[20];   /* Need plenty of space for %d format */
-      tree_node *node;
-      if (sscanf(CS big_buffer + 5, "%d %d", &index, &count) != 2)
+      unsigned index, count;
+      uschar name[20];   /* Need plenty of space for %u format */
+      tree_node * node;
+      if (  sscanf(CS big_buffer + 5, "%u %u", &index, &count) != 2
+	 || index >= 20
+	 || count > 16384	/* arbitrary limit on variable size */
+         )
         goto SPOOL_FORMAT_ERROR;
       if (index < 10)
-        (void) string_format(name, sizeof(name), "%c%d", 'c', index);
-      else if (index < 20) /* ignore out-of-range index */
-        (void) string_format(name, sizeof(name), "%c%d", 'm', index - 10);
+        (void) string_format(name, sizeof(name), "%c%u", 'c', index);
+      else
+        (void) string_format(name, sizeof(name), "%c%u", 'm', index - 10);
       node = acl_var_create(name);
       node->data.ptr = store_get(count + 1);
+      /* We sanity-checked the count, so disable the Coverity error */
+      /* coverity[tainted_data] */
       if (fread(node->data.ptr, 1, count+1, f) < count) goto SPOOL_READ_ERROR;
-      ((uschar*)node->data.ptr)[count] = 0;
+      (US node->data.ptr)[count] = '\0';
       }
     break;
 
@@ -511,7 +531,8 @@ for (;;)
     if (Ustrncmp(p, "rozen", 5) == 0)
       {
       deliver_freeze = TRUE;
-      sscanf(CS big_buffer+7, TIME_T_FMT, &deliver_frozen_at);
+      if (sscanf(CS big_buffer+7, TIME_T_FMT, &deliver_frozen_at) != 1)
+	goto SPOOL_READ_ERROR;
       }
     break;
 
@@ -651,10 +672,12 @@ DEBUG(D_deliver)
 #endif  /* COMPILE_UTILITY */
 
 /* After reading the tree, the next line has not yet been read into the
-buffer. It contains the count of recipients which follow on separate lines. */
+buffer. It contains the count of recipients which follow on separate lines.
+Apply an arbitrary sanity check.*/
 
 if (Ufgets(big_buffer, big_buffer_size, f) == NULL) goto SPOOL_READ_ERROR;
-if (sscanf(CS big_buffer, "%d", &rcount) != 1) goto SPOOL_FORMAT_ERROR;
+if (sscanf(CS big_buffer, "%d", &rcount) != 1 || rcount > 16384)
+  goto SPOOL_FORMAT_ERROR;
 
 #ifndef COMPILE_UTILITY
 DEBUG(D_deliver) debug_printf("recipients_count=%d\n", rcount);
@@ -663,6 +686,10 @@ DEBUG(D_deliver) debug_printf("recipients_count=%d\n", rcount);
 recipients_list_max = rcount;
 recipients_list = store_get(rcount * sizeof(recipient_item));
 
+/* We sanitised the count and know we have enough memory, so disable
+the Coverity error on recipients_count */
+/* coverity[tainted_data] */
+
 for (recipients_count = 0; recipients_count < rcount; recipients_count++)
   {
   int nn;
diff --git a/src/src/spool_mbox.c b/src/src/spool_mbox.c
index 126037574..b1de39e7d 100644
--- a/src/src/spool_mbox.c
+++ b/src/src/spool_mbox.c
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015 */
-/* License: GPL */
+/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
+ * License: GPL
+ * Copyright (c) The Exim Maintainers 2016
+ */
 
 /* Code for setting up a MBOX style spool file inside a /scan/<msgid>
 sub directory of exim's spool directory. */
@@ -11,17 +13,11 @@ sub directory of exim's spool directory. */
 #include "exim.h"
 #ifdef WITH_CONTENT_SCAN
 
-/* externals, we must reset them on unspooling */
-#ifdef WITH_OLD_DEMIME
-extern int demime_ok;
-extern struct file_extension *file_extensions;
-#endif
-
 extern int malware_ok;
 extern int spam_ok;
 
 int spool_mbox_ok = 0;
-uschar spooled_message_id[17];
+uschar spooled_message_id[MESSAGE_ID_LENGTH+1];
 
 /* returns a pointer to the FILE, and puts the size in bytes into mbox_file_size
  * normally, source_file_override is NULL */
@@ -117,17 +113,15 @@ if (!spool_mbox_ok)
     message_subdir[1] = '\0';
     for (i = 0; i < 2; i++)
       {
-      message_subdir[0] = (split_spool_directory == (i == 0))? message_id[5] : 0;
-      temp_string = string_sprintf("%s/input/%s/%s-D", spool_directory,
-	message_subdir, message_id);
-      data_file = Ufopen(temp_string, "rb");
-      if (data_file != NULL) break;
+      message_subdir[0] = split_spool_directory == (i == 0) ? message_id[5] : 0;
+      temp_string = spool_fname(US"input", message_subdir, message_id, US"-D");
+      if ((data_file = Ufopen(temp_string, "rb"))) break;
       }
     }
   else
     data_file = Ufopen(source_file_override, "rb");
 
-  if (data_file == NULL)
+  if (!data_file)
     {
     log_write(0, LOG_MAIN|LOG_PANIC, "Could not open datafile for message %s",
       message_id);
@@ -165,20 +159,20 @@ if (!spool_mbox_ok)
   (void)fclose(mbox_file);
   mbox_file = NULL;
 
-  Ustrcpy(spooled_message_id, message_id);
+  Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
+  spooled_message_id[sizeof(spooled_message_id)-1] = '\0';
   spool_mbox_ok = 1;
   }
 
 /* get the size of the mbox message and open [message_id].eml file for reading*/
-if (Ustat(mbox_path, &statbuf) != 0 ||
-    (yield = Ufopen(mbox_path,"rb")) == NULL)
-  {
+
+if (  !(yield = Ufopen(mbox_path,"rb"))
+   || fstat(fileno(yield), &statbuf) != 0
+   )
   log_write(0, LOG_MAIN|LOG_PANIC, "%s", string_open_failed(errno,
     "scan file %s", mbox_path));
-  goto OUT;
-  }
-
-*mbox_file_size = statbuf.st_size;
+else
+  *mbox_file_size = statbuf.st_size;
 
 OUT:
 if (data_file) (void)fclose(data_file);
@@ -190,20 +184,11 @@ return yield;
 
 
 
-/* remove mbox spool file, demimed files and temp directory */
 
+/* remove mbox spool file and temp directory */
 void
 unspool_mbox(void)
 {
-
-/* reset all exiscan state variables */
-#ifdef WITH_OLD_DEMIME
-demime_ok = 0;
-demime_errorlevel = 0;
-demime_reason = NULL;
-file_extensions = NULL;
-#endif
-
 spam_ok = 0;
 malware_ok = 0;
 
@@ -211,7 +196,6 @@ if (spool_mbox_ok && !no_mbox_unspool)
   {
   uschar *mbox_path;
   uschar *file_path;
-  int n;
   struct dirent *entry;
   DIR *tempdir;
 
@@ -229,11 +213,12 @@ if (spool_mbox_ok && !no_mbox_unspool)
   while((entry = readdir(tempdir)) != NULL)
     {
     uschar *name = US entry->d_name;
+    int dummy;
     if (Ustrcmp(name, US".") == 0 || Ustrcmp(name, US"..") == 0) continue;
 
     file_path = string_sprintf("%s/%s", mbox_path, name);
     debug_printf("unspool_mbox(): unlinking '%s'\n", file_path);
-    n = unlink(CS file_path);
+    dummy = unlink(CS file_path);
     }
 
   closedir(tempdir);
diff --git a/src/src/spool_out.c b/src/src/spool_out.c
index 8d0ee7c71..e49d89a09 100644
--- a/src/src/spool_out.c
+++ b/src/src/spool_out.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for writing spool files, and moving them about. */
@@ -17,7 +17,7 @@
 *************************************************/
 
 /* This function is called immediately after errors in writing the spool, with
-errno still set. It creates and error message, depending on the circumstances.
+errno still set. It creates an error message, depending on the circumstances.
 If errmsg is NULL, it logs the message and panic-dies. Otherwise errmsg is set
 to point to the message, and -1 is returned. This function makes the code of
 spool_write_header() a bit neater.
@@ -36,22 +36,21 @@ static int
 spool_write_error(int where, uschar **errmsg, uschar *s, uschar *temp_name,
   FILE *f)
 {
-uschar *msg = (where == SW_RECEIVING)?
-  string_sprintf("spool file %s error while receiving from %s: %s", s,
-    (sender_fullhost != NULL)? sender_fullhost : sender_ident,
-    strerror(errno))
-  :
-  string_sprintf("spool file %s error while %s: %s", s,
-    (where == SW_DELIVERING)? "delivering" : "modifying",
-    strerror(errno));
-
-if (temp_name != NULL) Uunlink(temp_name);
-if (f != NULL) (void)fclose(f);
-
-if (errmsg == NULL)
-  log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", msg);
-else
+uschar *msg = where == SW_RECEIVING
+  ? string_sprintf("spool file %s error while receiving from %s: %s", s,
+      sender_fullhost ? sender_fullhost : sender_ident,
+      strerror(errno))
+  : string_sprintf("spool file %s error while %s: %s", s,
+      where == SW_DELIVERING ? "delivering" : "modifying",
+      strerror(errno));
+
+if (temp_name) Uunlink(temp_name);
+if (f) (void)fclose(f);
+
+if (errmsg)
   *errmsg = msg;
+else
+  log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", msg);
 
 return -1;
 }
@@ -134,15 +133,16 @@ int size_correction;
 FILE *f;
 header_line *h;
 struct stat statbuf;
-uschar name[256];
-uschar temp_name[256];
+uschar * tname;
+uschar * fname;
+
+tname = spool_fname(US"input", message_subdir,
+		    string_sprintf("hdr.%d", (int)getpid()), US"");
 
-sprintf(CS temp_name, "%s/input/%s/hdr.%d", spool_directory, message_subdir,
-  (int)getpid());
-fd = spool_open_temp(temp_name);
-if (fd < 0) return spool_write_error(where, errmsg, US"open", NULL, NULL);
+if ((fd = spool_open_temp(tname)) < 0)
+  return spool_write_error(where, errmsg, US"open", NULL, NULL);
 f = fdopen(fd, "wb");
-DEBUG(D_receive|D_deliver) debug_printf("Writing spool header file\n");
+DEBUG(D_receive|D_deliver) debug_printf("Writing spool header file: %s\n", tname);
 
 /* We now have an open file to which the header data is to be written. Start
 with the file's leaf name, to make the file self-identifying. Continue with the
@@ -272,21 +272,25 @@ fprintf(f, "%d\n", recipients_count);
 for (i = 0; i < recipients_count; i++)
   {
   recipient_item *r = recipients_list + i;
-DEBUG(D_deliver) debug_printf("DSN: Flags :%d\n", r->dsn_flags);
+
+  DEBUG(D_deliver) debug_printf("DSN: Flags :%d\n", r->dsn_flags);
+
   if (r->pno < 0 && r->errors_to == NULL && r->dsn_flags == 0)
     fprintf(f, "%s\n", r->address);
   else
     {
-    uschar *errors_to = (r->errors_to == NULL)? US"" : r->errors_to;
+    uschar * errors_to = r->errors_to ? r->errors_to : US"";
     /* for DSN SUPPORT extend exim 4 spool in a compatible way by
-       adding new values upfront and add flag 0x02 */
-    uschar *orcpt = (r->orcpt == NULL)? US"" : r->orcpt;
-    fprintf(f, "%s %s %d,%d %s %d,%d#3\n", r->address, orcpt, Ustrlen(orcpt), r->dsn_flags,
-      errors_to, Ustrlen(errors_to), r->pno);
+    adding new values upfront and add flag 0x02 */
+    uschar * orcpt = r->orcpt ? r->orcpt : US"";
+
+    fprintf(f, "%s %s %d,%d %s %d,%d#3\n", r->address, orcpt, Ustrlen(orcpt),
+      r->dsn_flags, errors_to, Ustrlen(errors_to), r->pno);
     }
 
-      DEBUG(D_deliver) debug_printf("DSN: **** SPOOL_OUT - address: |%s| errorsto: |%s| orcpt: |%s| dsn_flags: %d\n",
-         r->address, r->errors_to, r->orcpt, r->dsn_flags);
+    DEBUG(D_deliver) debug_printf("DSN: **** SPOOL_OUT - "
+      "address: |%s| errorsto: |%s| orcpt: |%s| dsn_flags: %d\n",
+      r->address, r->errors_to, r->orcpt, r->dsn_flags);
   }
 
 /* Put a blank line before the headers */
@@ -297,7 +301,8 @@ fprintf(f, "\n");
 to get the actual size of the headers. */
 
 fflush(f);
-fstat(fd, &statbuf);
+if (fstat(fd, &statbuf))
+  return spool_write_error(where, errmsg, US"fstat", tname, f);
 size_correction = statbuf.st_size;
 
 /* Finally, write out the message's headers. To make it easier to read them
@@ -318,28 +323,30 @@ for (h = header_list; h != NULL; h = h->next)
 /* Flush and check for any errors while writing */
 
 if (fflush(f) != 0 || ferror(f))
-  return spool_write_error(where, errmsg, US"write", temp_name, f);
+  return spool_write_error(where, errmsg, US"write", tname, f);
 
 /* Force the file's contents to be written to disk. Note that fflush()
 just pushes it out of C, and fclose() doesn't guarantee to do the write
 either. That's just the way Unix works... */
 
 if (EXIMfsync(fileno(f)) < 0)
-  return spool_write_error(where, errmsg, US"sync", temp_name, f);
+  return spool_write_error(where, errmsg, US"sync", tname, f);
 
 /* Get the size of the file, and close it. */
 
-fstat(fd, &statbuf);
+if (fstat(fd, &statbuf) != 0)
+  return spool_write_error(where, errmsg, US"fstat", tname, NULL);
 if (fclose(f) != 0)
-  return spool_write_error(where, errmsg, US"close", temp_name, NULL);
+  return spool_write_error(where, errmsg, US"close", tname, NULL);
 
 /* Rename the file to its correct name, thereby replacing any previous
 incarnation. */
 
-sprintf(CS name, "%s/input/%s/%s-H", spool_directory, message_subdir, id);
+fname = spool_fname(US"input", message_subdir, id, US"-H");
+DEBUG(D_receive|D_deliver) debug_printf("Renaming spool header file: %s\n", fname);
 
-if (Urename(temp_name, name) < 0)
-  return spool_write_error(where, errmsg, US"rename", temp_name, NULL);
+if (Urename(tname, fname) < 0)
+  return spool_write_error(where, errmsg, US"rename", tname, NULL);
 
 /* Linux (and maybe other OS?) does not automatically sync a directory after
 an operation like rename. We therefore have to do it forcibly ourselves in
@@ -353,20 +360,20 @@ these cases. One hack on top of another... but that's life. */
 
 #ifdef NEED_SYNC_DIRECTORY
 
-sprintf(CS temp_name, "%s/input/%s/.", spool_directory, message_subdir);
+tname = spool_fname(US"input", message_subdir, US".", US"");
 
-#ifndef O_DIRECTORY
-#define O_DIRECTORY 0
-#endif
+# ifndef O_DIRECTORY
+#  define O_DIRECTORY 0
+# endif
 
-if ((fd = Uopen(temp_name, O_RDONLY|O_DIRECTORY, 0)) < 0)
-  return spool_write_error(where, errmsg, US"directory open", name, NULL);
+if ((fd = Uopen(tname, O_RDONLY|O_DIRECTORY, 0)) < 0)
+  return spool_write_error(where, errmsg, US"directory open", fname, NULL);
 
 if (EXIMfsync(fd) < 0 && errno != EINVAL)
-  return spool_write_error(where, errmsg, US"directory sync", name, NULL);
+  return spool_write_error(where, errmsg, US"directory sync", fname, NULL);
 
 if (close(fd) < 0)
-  return spool_write_error(where, errmsg, US"directory close", name, NULL);
+  return spool_write_error(where, errmsg, US"directory close", fname, NULL);
 
 #endif  /* NEED_SYNC_DIRECTORY */
 
@@ -407,13 +414,12 @@ static BOOL
 make_link(uschar *dir, uschar *subdir, uschar *id, uschar *suffix, uschar *from,
   uschar *to, BOOL noentok)
 {
-uschar f[256], t[256];
-sprintf(CS f, "%s/%s%s/%s/%s%s", spool_directory, from, dir, subdir, id, suffix);
-sprintf(CS t, "%s/%s%s/%s/%s%s", spool_directory, to, dir, subdir, id, suffix);
-if (Ulink(f, t) < 0 && (!noentok || errno != ENOENT))
+uschar * fname = spool_fname(string_sprintf("%s%s", from, dir), subdir, id, suffix);
+uschar * tname = spool_fname(string_sprintf("%s%s", to,   dir), subdir, id, suffix);
+if (Ulink(fname, tname) < 0 && (!noentok || errno != ENOENT))
   {
   log_write(0, LOG_MAIN|LOG_PANIC, "link(\"%s\", \"%s\") failed while moving "
-    "message: %s", f, t, strerror(errno));
+    "message: %s", fname, tname, strerror(errno));
   return FALSE;
   }
 return TRUE;
@@ -445,12 +451,11 @@ static BOOL
 break_link(uschar *dir, uschar *subdir, uschar *id, uschar *suffix, uschar *from,
   BOOL noentok)
 {
-uschar f[256];
-sprintf(CS f, "%s/%s%s/%s/%s%s", spool_directory, from, dir, subdir, id, suffix);
-if (Uunlink(f) < 0 && (!noentok || errno != ENOENT))
+uschar * fname = spool_fname(string_sprintf("%s%s", from, dir), subdir, id, suffix);
+if (Uunlink(fname) < 0 && (!noentok || errno != ENOENT))
   {
   log_write(0, LOG_MAIN|LOG_PANIC, "unlink(\"%s\") failed while moving "
-    "message: %s", f, strerror(errno));
+    "message: %s", fname, strerror(errno));
   return FALSE;
   }
 return TRUE;
@@ -482,17 +487,19 @@ spool_move_message(uschar *id, uschar *subdir, uschar *from, uschar *to)
 {
 /* Create any output directories that do not exist. */
 
-sprintf(CS big_buffer, "%sinput/%s", to, subdir);
-(void)directory_make(spool_directory, big_buffer, INPUT_DIRECTORY_MODE, TRUE);
-sprintf(CS big_buffer, "%smsglog/%s", to, subdir);
-(void)directory_make(spool_directory, big_buffer, INPUT_DIRECTORY_MODE, TRUE);
+(void) directory_make(spool_directory,
+  spool_sname(string_sprintf("%sinput", to), subdir),
+  INPUT_DIRECTORY_MODE, TRUE);
+(void) directory_make(spool_directory,
+  spool_sname(string_sprintf("%smsglog", to), subdir),
+  INPUT_DIRECTORY_MODE, TRUE);
 
 /* Move the message by first creating new hard links for all the files, and
 then removing the old links. When moving messages onto the main spool, the -H
 file should be set up last, because that's the one that tells Exim there is a
 message to be delivered, so we create its new link last and remove its old link
 first. Programs that look at the alternate directories should follow the same
-rule of waiting for a -H file before doing anything. When moving messsages off
+rule of waiting for a -H file before doing anything. When moving messages off
 the mail spool, the -D file should be open and locked at the time, thus keeping
 Exim's hands off. */
 
diff --git a/src/src/srs.c b/src/src/srs.c
index 0115c0b51..1ff391f65 100644
--- a/src/src/srs.c
+++ b/src/src/srs.c
@@ -4,6 +4,7 @@
 
 /* SRS - Sender rewriting scheme support
   (C)2004 Miles Wilton <miles@mirtol.com>
+  Copyright (c) The Exim Maintainers 2016
 
   SRS Support Version: 1.0a
 
@@ -25,7 +26,7 @@ uschar   *srs_db_reverse        = NULL;
 
 int eximsrs_init()
 {
-  uschar *list = srs_config;
+  const uschar *list = srs_config;
   uschar secret_buf[SRS_MAX_SECRET_LENGTH];
   uschar *secret = NULL;
   uschar sbuf[4];
diff --git a/src/src/std-crypto.c b/src/src/std-crypto.c
index 3f0fec897..8ccef122b 100644
--- a/src/src/std-crypto.c
+++ b/src/src/std-crypto.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Phil Pennock 2012
+/* Copyright (c) Phil Pennock 2012, 2016
  * But almost everything here is fixed published constants from RFCs, so also:
  * Copyright (C) The Internet Society (2003)
  * Copyright (C) The IETF Trust (2008)
@@ -459,6 +459,497 @@ static const char dh_ike_24_pem[] =
 "KM3GfrYYS1I9HbJGwy9jB4SQ8A741kfRSNR5VFFeIyfP75jFgmZLTA9sxBZZ\n"
 "-----END DH PARAMETERS-----\n";
 
+/* ------------------------------------------------------------------------- */
+/* RFC 7919 Published August 2016, so strength estimates date from then.
+
+A.1.  ffdhe2048
+
+   The 2048-bit group has registry value 256 and is calculated from the
+   following formula:
+
+   The modulus is:
+
+   p = 2^2048 - 2^1984 + {[2^1918 * e] + 560316 } * 2^64 - 1
+
+   The hexadecimal representation of p is:
+
+    FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
+    D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
+    7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
+    2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
+    984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
+    30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
+    B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
+    0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
+    9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
+    3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA
+    886B4238 61285C97 FFFFFFFF FFFFFFFF
+
+   The generator is: g = 2
+
+   The group size is: q = (p-1)/2
+
+   The hexadecimal representation of q is:
+
+    7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
+    EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
+    BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
+    9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
+    CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
+    98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
+    DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
+    8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
+    C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
+    9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
+    4435A11C 30942E4B FFFFFFFF FFFFFFFF
+
+   The estimated symmetric-equivalent strength of this group is 103
+   bits.
+*/
+static const char dh_ffdhe2048_pem[] =
+"-----BEGIN DH PARAMETERS-----\n"
+"MIH+AoH4DfhUWKK7Spqv3FYgJz088di5xYPOLTaVqeE2QRRkM/vMk53OJJs++X0v\n"
+"42NjDHXY9oGyAq7EYXrT3x7V1f1lYSQz9R9fBm7QhWNlVT3tGvO1VxNef1fJNZhP\n"
+"DHDg5ot34qaJ2vPv6HId8VihNq3nNTCsyk9IOnl6vAqxgrMk+2HRCKlLssjj+7lq\n"
+"2rdg1/RoHU9Co945TfSuVu3nY3K7GQsHp8juCm1wngL84c334uzANATNKDQvYZFy\n"
+"/pzphYP/jk8SMu7ygYPD/jsbTG+tczu1/LwuwiAFxY7xg30Wg7LG80omwbLv+ohr\n"
+"QjhhKFyX//////////8CAQI=\n"
+"-----END DH PARAMETERS-----\n";
+
+/*
+A.2.  ffdhe3072
+
+   The 3072-bit prime has registry value 257 and is calculated from the
+   following formula:
+
+   The modulus is:
+
+   p = 2^3072 - 2^3008 + {[2^2942 * e] + 2625351} * 2^64 - 1
+
+   The hexadecimal representation of p is:
+
+    FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
+    D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
+    7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
+    2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
+    984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
+    30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
+    B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
+    0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
+    9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
+    3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA
+    886B4238 611FCFDC DE355B3B 6519035B BC34F4DE F99C0238
+    61B46FC9 D6E6C907 7AD91D26 91F7F7EE 598CB0FA C186D91C
+    AEFE1309 85139270 B4130C93 BC437944 F4FD4452 E2D74DD3
+    64F2E21E 71F54BFF 5CAE82AB 9C9DF69E E86D2BC5 22363A0D
+    ABC52197 9B0DEADA 1DBF9A42 D5C4484E 0ABCD06B FA53DDEF
+    3C1B20EE 3FD59D7C 25E41D2B 66C62E37 FFFFFFFF FFFFFFFF
+
+   The generator is: g = 2
+
+   The group size is: q = (p-1)/2
+
+   The hexadecimal representation of q is:
+
+    7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
+    EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
+    BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
+    9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
+    CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
+    98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
+    DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
+    8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
+    C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
+    9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
+    4435A11C 308FE7EE 6F1AAD9D B28C81AD DE1A7A6F 7CCE011C
+    30DA37E4 EB736483 BD6C8E93 48FBFBF7 2CC6587D 60C36C8E
+    577F0984 C289C938 5A098649 DE21BCA2 7A7EA229 716BA6E9
+    B279710F 38FAA5FF AE574155 CE4EFB4F 743695E2 911B1D06
+    D5E290CB CD86F56D 0EDFCD21 6AE22427 055E6835 FD29EEF7
+    9E0D9077 1FEACEBE 12F20E95 B363171B FFFFFFFF FFFFFFFF
+
+   The estimated symmetric-equivalent strength of this group is 125
+   bits.
+*/
+static const char dh_ffdhe3072_pem[] =
+"-----BEGIN DH PARAMETERS-----\n"
+"MIIBiAKCAYEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz\n"
+"+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a\n"
+"87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7\n"
+"YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi\n"
+"7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD\n"
+"ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3\n"
+"7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32\n"
+"nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZsYu\n"
+"N///////////AgEC\n"
+"-----END DH PARAMETERS-----\n";
+
+/*
+A.3.  ffdhe4096
+
+   The 4096-bit group has registry value 258 and is calculated from the
+   following formula:
+
+   The modulus is:
+
+   p = 2^4096 - 2^4032 + {[2^3966 * e] + 5736041} * 2^64 - 1
+
+   The hexadecimal representation of p is:
+
+    FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
+    D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
+    7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
+    2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
+    984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
+    30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
+    B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
+    0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
+    9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
+    3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA
+    886B4238 611FCFDC DE355B3B 6519035B BC34F4DE F99C0238
+    61B46FC9 D6E6C907 7AD91D26 91F7F7EE 598CB0FA C186D91C
+    AEFE1309 85139270 B4130C93 BC437944 F4FD4452 E2D74DD3
+    64F2E21E 71F54BFF 5CAE82AB 9C9DF69E E86D2BC5 22363A0D
+    ABC52197 9B0DEADA 1DBF9A42 D5C4484E 0ABCD06B FA53DDEF
+    3C1B20EE 3FD59D7C 25E41D2B 669E1EF1 6E6F52C3 164DF4FB
+    7930E9E4 E58857B6 AC7D5F42 D69F6D18 7763CF1D 55034004
+    87F55BA5 7E31CC7A 7135C886 EFB4318A ED6A1E01 2D9E6832
+    A907600A 918130C4 6DC778F9 71AD0038 092999A3 33CB8B7A
+    1A1DB93D 7140003C 2A4ECEA9 F98D0ACC 0A8291CD CEC97DCF
+    8EC9B55A 7F88A46B 4DB5A851 F44182E1 C68A007E 5E655F6A
+    FFFFFFFF FFFFFFFF
+
+   The generator is: g = 2
+
+   The group size is: q = (p-1)/2
+
+   The hexadecimal representation of q is:
+
+    7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
+    EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
+    BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
+    9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
+    CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
+    98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
+    DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
+    8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
+    C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
+    9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
+    4435A11C 308FE7EE 6F1AAD9D B28C81AD DE1A7A6F 7CCE011C
+    30DA37E4 EB736483 BD6C8E93 48FBFBF7 2CC6587D 60C36C8E
+    577F0984 C289C938 5A098649 DE21BCA2 7A7EA229 716BA6E9
+    B279710F 38FAA5FF AE574155 CE4EFB4F 743695E2 911B1D06
+    D5E290CB CD86F56D 0EDFCD21 6AE22427 055E6835 FD29EEF7
+    9E0D9077 1FEACEBE 12F20E95 B34F0F78 B737A961 8B26FA7D
+    BC9874F2 72C42BDB 563EAFA1 6B4FB68C 3BB1E78E AA81A002
+    43FAADD2 BF18E63D 389AE443 77DA18C5 76B50F00 96CF3419
+    5483B005 48C09862 36E3BC7C B8D6801C 0494CCD1 99E5C5BD
+    0D0EDC9E B8A0001E 15276754 FCC68566 054148E6 E764BEE7
+    C764DAAD 3FC45235 A6DAD428 FA20C170 E345003F 2F32AFB5
+    7FFFFFFF FFFFFFFF
+
+   The estimated symmetric-equivalent strength of this group is 150
+   bits.
+*/
+static const char dh_ffdhe4096_pem[] =
+"-----BEGIN DH PARAMETERS-----\n"
+"MIICCAKCAgEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz\n"
+"+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a\n"
+"87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7\n"
+"YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi\n"
+"7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD\n"
+"ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3\n"
+"7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32\n"
+"nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e\n"
+"8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx\n"
+"iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K\n"
+"zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eZV9q//////////8CAQI=\n"
+"-----END DH PARAMETERS-----\n";
+
+/*
+A.4.  ffdhe6144
+
+   The 6144-bit group has registry value 259 and is calculated from the
+   following formula:
+
+   The modulus is:
+
+   p = 2^6144 - 2^6080 + {[2^6014 * e] + 15705020} * 2^64 - 1
+
+   The hexadecimal representation of p is:
+
+    FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
+    D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
+    7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
+    2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
+    984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
+    30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
+    B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
+    0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
+    9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
+    3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA
+    886B4238 611FCFDC DE355B3B 6519035B BC34F4DE F99C0238
+    61B46FC9 D6E6C907 7AD91D26 91F7F7EE 598CB0FA C186D91C
+    AEFE1309 85139270 B4130C93 BC437944 F4FD4452 E2D74DD3
+    64F2E21E 71F54BFF 5CAE82AB 9C9DF69E E86D2BC5 22363A0D
+    ABC52197 9B0DEADA 1DBF9A42 D5C4484E 0ABCD06B FA53DDEF
+    3C1B20EE 3FD59D7C 25E41D2B 669E1EF1 6E6F52C3 164DF4FB
+    7930E9E4 E58857B6 AC7D5F42 D69F6D18 7763CF1D 55034004
+    87F55BA5 7E31CC7A 7135C886 EFB4318A ED6A1E01 2D9E6832
+    A907600A 918130C4 6DC778F9 71AD0038 092999A3 33CB8B7A
+    1A1DB93D 7140003C 2A4ECEA9 F98D0ACC 0A8291CD CEC97DCF
+    8EC9B55A 7F88A46B 4DB5A851 F44182E1 C68A007E 5E0DD902
+    0BFD64B6 45036C7A 4E677D2C 38532A3A 23BA4442 CAF53EA6
+    3BB45432 9B7624C8 917BDD64 B1C0FD4C B38E8C33 4C701C3A
+    CDAD0657 FCCFEC71 9B1F5C3E 4E46041F 388147FB 4CFDB477
+    A52471F7 A9A96910 B855322E DB6340D8 A00EF092 350511E3
+    0ABEC1FF F9E3A26E 7FB29F8C 183023C3 587E38DA 0077D9B4
+    763E4E4B 94B2BBC1 94C6651E 77CAF992 EEAAC023 2A281BF6
+    B3A739C1 22611682 0AE8DB58 47A67CBE F9C9091B 462D538C
+    D72B0374 6AE77F5E 62292C31 1562A846 505DC82D B854338A
+    E49F5235 C95B9117 8CCF2DD5 CACEF403 EC9D1810 C6272B04
+    5B3B71F9 DC6B80D6 3FDD4A8E 9ADB1E69 62A69526 D43161C1
+    A41D570D 7938DAD4 A40E329C D0E40E65 FFFFFFFF FFFFFFFF
+
+   The generator is: g = 2
+
+   The group size is: q = (p-1)/2
+
+   The hexadecimal representation of q is:
+
+    7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
+    EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
+    BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
+    9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
+    CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
+    98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
+    DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
+    8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
+    C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
+    9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
+    4435A11C 308FE7EE 6F1AAD9D B28C81AD DE1A7A6F 7CCE011C
+    30DA37E4 EB736483 BD6C8E93 48FBFBF7 2CC6587D 60C36C8E
+    577F0984 C289C938 5A098649 DE21BCA2 7A7EA229 716BA6E9
+    B279710F 38FAA5FF AE574155 CE4EFB4F 743695E2 911B1D06
+    D5E290CB CD86F56D 0EDFCD21 6AE22427 055E6835 FD29EEF7
+    9E0D9077 1FEACEBE 12F20E95 B34F0F78 B737A961 8B26FA7D
+    BC9874F2 72C42BDB 563EAFA1 6B4FB68C 3BB1E78E AA81A002
+    43FAADD2 BF18E63D 389AE443 77DA18C5 76B50F00 96CF3419
+    5483B005 48C09862 36E3BC7C B8D6801C 0494CCD1 99E5C5BD
+    0D0EDC9E B8A0001E 15276754 FCC68566 054148E6 E764BEE7
+    C764DAAD 3FC45235 A6DAD428 FA20C170 E345003F 2F06EC81
+    05FEB25B 2281B63D 2733BE96 1C29951D 11DD2221 657A9F53
+    1DDA2A19 4DBB1264 48BDEEB2 58E07EA6 59C74619 A6380E1D
+    66D6832B FE67F638 CD8FAE1F 2723020F 9C40A3FD A67EDA3B
+    D29238FB D4D4B488 5C2A9917 6DB1A06C 50077849 1A8288F1
+    855F60FF FCF1D137 3FD94FC6 0C1811E1 AC3F1C6D 003BECDA
+    3B1F2725 CA595DE0 CA63328F 3BE57CC9 77556011 95140DFB
+    59D39CE0 91308B41 05746DAC 23D33E5F 7CE4848D A316A9C6
+    6B9581BA 3573BFAF 31149618 8AB15423 282EE416 DC2A19C5
+    724FA91A E4ADC88B C66796EA E5677A01 F64E8C08 63139582
+    2D9DB8FC EE35C06B 1FEEA547 4D6D8F34 B1534A93 6A18B0E0
+    D20EAB86 BC9C6D6A 5207194E 68720732 FFFFFFFF FFFFFFFF
+
+   The estimated symmetric-equivalent strength of this group is 175
+   bits.
+*/
+static const char dh_ffdhe6144_pem[] =
+"-----BEGIN DH PARAMETERS-----\n"
+"MIIDCAKCAwEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz\n"
+"+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a\n"
+"87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7\n"
+"YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi\n"
+"7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD\n"
+"ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3\n"
+"7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32\n"
+"nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e\n"
+"8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx\n"
+"iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K\n"
+"zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eDdkCC/1ktkUDbHpOZ30sOFMq\n"
+"OiO6RELK9T6mO7RUMpt2JMiRe91kscD9TLOOjDNMcBw6za0GV/zP7HGbH1w+TkYE\n"
+"HziBR/tM/bR3pSRx96mpaRC4VTIu22NA2KAO8JI1BRHjCr7B//njom5/sp+MGDAj\n"
+"w1h+ONoAd9m0dj5OS5Syu8GUxmUed8r5ku6qwCMqKBv2s6c5wSJhFoIK6NtYR6Z8\n"
+"vvnJCRtGLVOM1ysDdGrnf15iKSwxFWKoRlBdyC24VDOK5J9SNclbkReMzy3Vys70\n"
+"A+ydGBDGJysEWztx+dxrgNY/3UqOmtseaWKmlSbUMWHBpB1XDXk42tSkDjKc0OQO\n"
+"Zf//////////AgEC\n"
+"-----END DH PARAMETERS-----\n";
+
+/*
+A.5.  ffdhe8192
+
+   The 8192-bit group has registry value 260 and is calculated from the
+   following formula:
+
+   The modulus is:
+
+   p = 2^8192 - 2^8128 + {[2^8062 * e] + 10965728} * 2^64 - 1
+
+   The hexadecimal representation of p is:
+
+    FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
+    D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
+    7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
+    2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
+    984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
+    30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
+    B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
+    0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
+    9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
+    3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA
+    886B4238 611FCFDC DE355B3B 6519035B BC34F4DE F99C0238
+    61B46FC9 D6E6C907 7AD91D26 91F7F7EE 598CB0FA C186D91C
+    AEFE1309 85139270 B4130C93 BC437944 F4FD4452 E2D74DD3
+    64F2E21E 71F54BFF 5CAE82AB 9C9DF69E E86D2BC5 22363A0D
+    ABC52197 9B0DEADA 1DBF9A42 D5C4484E 0ABCD06B FA53DDEF
+    3C1B20EE 3FD59D7C 25E41D2B 669E1EF1 6E6F52C3 164DF4FB
+    7930E9E4 E58857B6 AC7D5F42 D69F6D18 7763CF1D 55034004
+    87F55BA5 7E31CC7A 7135C886 EFB4318A ED6A1E01 2D9E6832
+    A907600A 918130C4 6DC778F9 71AD0038 092999A3 33CB8B7A
+    1A1DB93D 7140003C 2A4ECEA9 F98D0ACC 0A8291CD CEC97DCF
+    8EC9B55A 7F88A46B 4DB5A851 F44182E1 C68A007E 5E0DD902
+    0BFD64B6 45036C7A 4E677D2C 38532A3A 23BA4442 CAF53EA6
+    3BB45432 9B7624C8 917BDD64 B1C0FD4C B38E8C33 4C701C3A
+    CDAD0657 FCCFEC71 9B1F5C3E 4E46041F 388147FB 4CFDB477
+    A52471F7 A9A96910 B855322E DB6340D8 A00EF092 350511E3
+    0ABEC1FF F9E3A26E 7FB29F8C 183023C3 587E38DA 0077D9B4
+    763E4E4B 94B2BBC1 94C6651E 77CAF992 EEAAC023 2A281BF6
+    B3A739C1 22611682 0AE8DB58 47A67CBE F9C9091B 462D538C
+    D72B0374 6AE77F5E 62292C31 1562A846 505DC82D B854338A
+    E49F5235 C95B9117 8CCF2DD5 CACEF403 EC9D1810 C6272B04
+    5B3B71F9 DC6B80D6 3FDD4A8E 9ADB1E69 62A69526 D43161C1
+    A41D570D 7938DAD4 A40E329C CFF46AAA 36AD004C F600C838
+    1E425A31 D951AE64 FDB23FCE C9509D43 687FEB69 EDD1CC5E
+    0B8CC3BD F64B10EF 86B63142 A3AB8829 555B2F74 7C932665
+    CB2C0F1C C01BD702 29388839 D2AF05E4 54504AC7 8B758282
+    2846C0BA 35C35F5C 59160CC0 46FD8251 541FC68C 9C86B022
+    BB709987 6A460E74 51A8A931 09703FEE 1C217E6C 3826E52C
+    51AA691E 0E423CFC 99E9E316 50C1217B 624816CD AD9A95F9
+    D5B80194 88D9C0A0 A1FE3075 A577E231 83F81D4A 3F2FA457
+    1EFC8CE0 BA8A4FE8 B6855DFE 72B0A66E DED2FBAB FBE58A30
+    FAFABE1C 5D71A87E 2F741EF8 C1FE86FE A6BBFDE5 30677F0D
+    97D11D49 F7A8443D 0822E506 A9F4614E 011E2A94 838FF88C
+    D68C8BB7 C5C6424C FFFFFFFF FFFFFFFF
+
+   The generator is: g = 2
+
+   The group size is: q = (p-1)/2
+
+   The hexadecimal representation of q is:
+
+    7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
+    EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
+    BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
+    9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
+    CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
+    98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
+    DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
+    8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
+    C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
+    9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
+    4435A11C 308FE7EE 6F1AAD9D B28C81AD DE1A7A6F 7CCE011C
+    30DA37E4 EB736483 BD6C8E93 48FBFBF7 2CC6587D 60C36C8E
+    577F0984 C289C938 5A098649 DE21BCA2 7A7EA229 716BA6E9
+    B279710F 38FAA5FF AE574155 CE4EFB4F 743695E2 911B1D06
+    D5E290CB CD86F56D 0EDFCD21 6AE22427 055E6835 FD29EEF7
+    9E0D9077 1FEACEBE 12F20E95 B34F0F78 B737A961 8B26FA7D
+    BC9874F2 72C42BDB 563EAFA1 6B4FB68C 3BB1E78E AA81A002
+    43FAADD2 BF18E63D 389AE443 77DA18C5 76B50F00 96CF3419
+    5483B005 48C09862 36E3BC7C B8D6801C 0494CCD1 99E5C5BD
+    0D0EDC9E B8A0001E 15276754 FCC68566 054148E6 E764BEE7
+    C764DAAD 3FC45235 A6DAD428 FA20C170 E345003F 2F06EC81
+    05FEB25B 2281B63D 2733BE96 1C29951D 11DD2221 657A9F53
+    1DDA2A19 4DBB1264 48BDEEB2 58E07EA6 59C74619 A6380E1D
+    66D6832B FE67F638 CD8FAE1F 2723020F 9C40A3FD A67EDA3B
+    D29238FB D4D4B488 5C2A9917 6DB1A06C 50077849 1A8288F1
+    855F60FF FCF1D137 3FD94FC6 0C1811E1 AC3F1C6D 003BECDA
+    3B1F2725 CA595DE0 CA63328F 3BE57CC9 77556011 95140DFB
+    59D39CE0 91308B41 05746DAC 23D33E5F 7CE4848D A316A9C6
+    6B9581BA 3573BFAF 31149618 8AB15423 282EE416 DC2A19C5
+    724FA91A E4ADC88B C66796EA E5677A01 F64E8C08 63139582
+    2D9DB8FC EE35C06B 1FEEA547 4D6D8F34 B1534A93 6A18B0E0
+    D20EAB86 BC9C6D6A 5207194E 67FA3555 1B568026 7B00641C
+    0F212D18 ECA8D732 7ED91FE7 64A84EA1 B43FF5B4 F6E8E62F
+    05C661DE FB258877 C35B18A1 51D5C414 AAAD97BA 3E499332
+    E596078E 600DEB81 149C441C E95782F2 2A282563 C5BAC141
+    1423605D 1AE1AFAE 2C8B0660 237EC128 AA0FE346 4E435811
+    5DB84CC3 B523073A 28D45498 84B81FF7 0E10BF36 1C137296
+    28D5348F 07211E7E 4CF4F18B 286090BD B1240B66 D6CD4AFC
+    EADC00CA 446CE050 50FF183A D2BBF118 C1FC0EA5 1F97D22B
+    8F7E4670 5D4527F4 5B42AEFF 39585337 6F697DD5 FDF2C518
+    7D7D5F0E 2EB8D43F 17BA0F7C 60FF437F 535DFEF2 9833BF86
+    CBE88EA4 FBD4221E 84117283 54FA30A7 008F154A 41C7FC46
+    6B4645DB E2E32126 7FFFFFFF FFFFFFFF
+
+   The estimated symmetric-equivalent strength of this group is 192
+   bits.
+*/
+static const char dh_ffdhe8192_pem[] =
+"-----BEGIN DH PARAMETERS-----\n"
+"MIIECAKCBAEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz\n"
+"+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a\n"
+"87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7\n"
+"YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi\n"
+"7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD\n"
+"ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3\n"
+"7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32\n"
+"nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e\n"
+"8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx\n"
+"iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K\n"
+"zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eDdkCC/1ktkUDbHpOZ30sOFMq\n"
+"OiO6RELK9T6mO7RUMpt2JMiRe91kscD9TLOOjDNMcBw6za0GV/zP7HGbH1w+TkYE\n"
+"HziBR/tM/bR3pSRx96mpaRC4VTIu22NA2KAO8JI1BRHjCr7B//njom5/sp+MGDAj\n"
+"w1h+ONoAd9m0dj5OS5Syu8GUxmUed8r5ku6qwCMqKBv2s6c5wSJhFoIK6NtYR6Z8\n"
+"vvnJCRtGLVOM1ysDdGrnf15iKSwxFWKoRlBdyC24VDOK5J9SNclbkReMzy3Vys70\n"
+"A+ydGBDGJysEWztx+dxrgNY/3UqOmtseaWKmlSbUMWHBpB1XDXk42tSkDjKcz/Rq\n"
+"qjatAEz2AMg4HkJaMdlRrmT9sj/OyVCdQ2h/62nt0cxeC4zDvfZLEO+GtjFCo6uI\n"
+"KVVbL3R8kyZlyywPHMAb1wIpOIg50q8F5FRQSseLdYKCKEbAujXDX1xZFgzARv2C\n"
+"UVQfxoychrAiu3CZh2pGDnRRqKkxCXA/7hwhfmw4JuUsUappHg5CPPyZ6eMWUMEh\n"
+"e2JIFs2tmpX51bgBlIjZwKCh/jB1pXfiMYP4HUo/L6RXHvyM4LqKT+i2hV3+crCm\n"
+"bt7S+6v75Yow+vq+HF1xqH4vdB74wf6G/qa7/eUwZ38Nl9EdSfeoRD0IIuUGqfRh\n"
+"TgEeKpSDj/iM1oyLt8XGQkz//////////wIBAg==\n"
+"-----END DH PARAMETERS-----\n";
+
+/* ========================================================================= */
+
+/*
+ * Generated by Phil as a non-standard option.
+ * openssl dhparam -2 2048
+ * No provenance to prove non-tampering available, beyond trusting that this
+ * developer generated this as stated above.
+ */
+
+/* MacOSX 10.10.5 invoking system OpenSSL 0.9.8zg */
+static const char dh_exim_20160529_1[] =
+"-----BEGIN DH PARAMETERS-----\n"
+"MIIBCAKCAQEA8ZMf89Gaye4bDEX1BXZ9+2edkXym9EK0GxmFilHEGpnhgLNmCk+H\n"
+"cCb+zn8Ed5bpCOmRuEv9N/VKPjSpno8jYiQbFgUL3vh8uKvQLJNTzDVDbpd3YO7E\n"
+"tiS0L0qWL57zIf8b3VZTMRsH4Orz2Rla61wVl6XpxE5WRfGqPS264Vvfew7xmCoi\n"
+"INaFzIU6zwk2WeD6K5asctYlQG/UtgY1nRFkQTebIOpm03a6/hw7F14l3yUZgXfv\n"
+"I3m4MFaWvxGcuZxddTijXw3VfjMdWvdH3Iz7IcqD32uEzK6Rgi/t4OVSw1kE2oDt\n"
+"cFThPUCWb7O4TVq9Xt2UZqZFNU6kUAkv2wIBAg==\n"
+"-----END DH PARAMETERS-----\n";
+
+/* MacOSX 10.10.5 invoking OpenSSL 1.0.2h installed from brew bottle */
+static const char dh_exim_20160529_2[] =
+"-----BEGIN DH PARAMETERS-----\n"
+"MIIBCAKCAQEAot84eqyfSb5l8GRCN2ioWP5T85Z/2lVX9A9r9JzwDfvliAAqm6Vp\n"
+"UcHdAfVt54kc8DsmLiHdDhxY1I/wo+DcBylfVx13cmkroAocowOD5dwQMYk6iXjV\n"
+"ys4heRJhYlAHgt8QZH8dA8c/HLs+rlAHhSUPnetsZmcoPE0LRsjigJsiVXasm+sl\n"
+"g/77u5FCkgSrFILcD9PLPto1ciIXp2y8cjXQDk+D9FH1HaSCXLCLkuHxhQXxjTYO\n"
+"C3Q53aNLkDJ4zpPt7Kc9NxQFBVlNc260IFDOHTWhgV2zpyG6oIzQoHSmmiLAAfcF\n"
+"HrG7I06uZBLjuNGGaM0eeuxHNhs2G2EduwIBAg==\n"
+"-----END DH PARAMETERS-----\n";
+
+/* Ubuntu 14.04.4 running on dual-core Atom D2500 with OneRNG entropy key */
+static const char dh_exim_20160529_3[] =
+"-----BEGIN DH PARAMETERS-----\n"
+"MIIBCAKCAQEAkbRYVoge2PtrmV1eKCKluSBFELgckuLSnkuH0TffqbmfoYM34lFu\n"
+"2vPM2LhnzKvEBQlIICOTzQD29kROacRfSKpsNINRXhXKUqI6sFXzUZu4Flk69XKG\n"
+"ZOSDYvWkI5pSn1amQ4Nnvn6s+uwn/f0ZDZDiKLW9TgntxJV4A2+yeymaeoGCbIXX\n"
+"5q8WgajFhAeut36RL93HBnXT1hT7Eja1Y81w9fOzQrwBuXhyfCkAdiMA/VCp0UD4\n"
+"0p7uf+okpckVnwD6WnUCHMij8nGlVblZELFYzNi0udtzIrSwlALbZXIeAqhbZXJO\n"
+"lCuYspJhzV0Vs0lDJwrxvNwtdg1ernVIowIBAg==\n"
+"-----END DH PARAMETERS-----\n";
 
 /* ========================================================================= */
 
@@ -470,7 +961,15 @@ struct dh_constant {
 /* KEEP SORTED ALPHABETICALLY;
  * duplicate PEM are okay, if we want aliases, but names must be alphabetical */
 static struct dh_constant dh_constants[] = {
-    { "default", dh_ike_23_pem },
+    { "default", dh_exim_20160529_3 },
+    { "exim.dev.20160529.1", dh_exim_20160529_1 },
+    { "exim.dev.20160529.2", dh_exim_20160529_2 },
+    { "exim.dev.20160529.3", dh_exim_20160529_3 },
+    { "ffdhe2048", dh_ffdhe2048_pem },
+    { "ffdhe3072", dh_ffdhe3072_pem },
+    { "ffdhe4096", dh_ffdhe4096_pem },
+    { "ffdhe6144", dh_ffdhe6144_pem },
+    { "ffdhe8192", dh_ffdhe8192_pem },
     { "ike1", dh_ike_1_pem },
     { "ike14", dh_ike_14_pem },
     { "ike15", dh_ike_15_pem },
diff --git a/src/src/store.c b/src/src/store.c
index e402835c7..b1a47799b 100644
--- a/src/src/store.c
+++ b/src/src/store.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Exim gets and frees all its store through these functions. In the original
@@ -354,7 +354,11 @@ the released memory. */
 
 newlength = bc + b->length - (char *)ptr;
 #ifndef COMPILE_UTILITY
-if (running_in_test_harness) memset(ptr, 0xF0, newlength);
+if (running_in_test_harness)
+  {
+  (void) VALGRIND_MAKE_MEM_DEFINED(ptr, newlength);
+  memset(ptr, 0xF0, newlength);
+  }
 #endif
 (void) VALGRIND_MAKE_MEM_NOACCESS(ptr, newlength);
 yield_length[store_pool] = newlength - (newlength % alignment);
@@ -493,9 +497,8 @@ store_malloc_3(int size, const char *filename, int linenumber)
 void *yield;
 
 if (size < 16) size = 16;
-yield = malloc((size_t)size);
 
-if (yield == NULL)
+if (!(yield = malloc((size_t)size)))
   log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to malloc %d bytes of memory: "
     "called from line %d of %s", size, linenumber, filename);
 
diff --git a/src/src/string.c b/src/src/string.c
index c0dfd04b6..be1a1d7a4 100644
--- a/src/src/string.c
+++ b/src/src/string.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Miscellaneous string-handling functions. Some are not required for
@@ -913,7 +913,7 @@ sep_is_special = iscntrl(sep);
 
 if (buffer != NULL)
   {
-  register int p = 0;
+  int p = 0;
   for (; *s != 0; s++)
     {
     if (*s == sep && (*(++s) != sep || sep_is_special)) break;
@@ -952,7 +952,7 @@ else
   for (;;)
     {
     for (ss = s + 1; *ss != 0 && *ss != sep; ss++);
-    buffer = string_cat(buffer, &size, &ptr, s, ss-s);
+    buffer = string_catn(buffer, &size, &ptr, s, ss-s);
     s = ss;
     if (*s == 0 || *(++s) != sep || sep_is_special) break;
     }
@@ -995,17 +995,17 @@ uschar * sp;
 
 if (list)
   {
-  new = string_cat(new, &sz, &off, list, Ustrlen(list));
-  new = string_cat(new, &sz, &off, &sep, 1);
+  new = string_cat (new, &sz, &off, list);
+  new = string_catn(new, &sz, &off, &sep, 1);
   }
 
 while((sp = Ustrchr(ele, sep)))
   {
-  new = string_cat(new, &sz, &off, ele, sp-ele+1);
-  new = string_cat(new, &sz, &off, &sep, 1);
+  new = string_catn(new, &sz, &off, ele, sp-ele+1);
+  new = string_catn(new, &sz, &off, &sep, 1);
   ele = sp+1;
   }
-new = string_cat(new, &sz, &off, ele, Ustrlen(ele));
+new = string_cat(new, &sz, &off, ele);
 new[off] = '\0';
 return new;
 }
@@ -1039,18 +1039,18 @@ const uschar * sp;
 
 if (list)
   {
-  new = string_cat(new, &sz, &off, list, Ustrlen(list));
-  new = string_cat(new, &sz, &off, &sep, 1);
+  new = string_cat (new, &sz, &off, list);
+  new = string_catn(new, &sz, &off, &sep, 1);
   }
 
 while((sp = Ustrnchr(ele, sep, &len)))
   {
-  new = string_cat(new, &sz, &off, ele, sp-ele+1);
-  new = string_cat(new, &sz, &off, &sep, 1);
+  new = string_catn(new, &sz, &off, ele, sp-ele+1);
+  new = string_catn(new, &sz, &off, &sep, 1);
   ele = sp+1;
   len--;
   }
-new = string_cat(new, &sz, &off, ele, len);
+new = string_catn(new, &sz, &off, ele, len);
 new[off] = '\0';
 return new;
 }
@@ -1078,7 +1078,7 @@ Arguments:
              characters, updated to the new offset
   s        points to characters to add
   count    count of characters to add; must not exceed the length of s, if s
-             is a C string
+             is a C string.  If -1 given, strlen(s) is used.
 
 If string is given as NULL, *size and *ptr should both be zero.
 
@@ -1086,10 +1086,12 @@ Returns:   pointer to the start of the string, changed if copied for expansion.
            Note that a NUL is not added, though space is left for one. This is
            because string_cat() is often called multiple times to build up a
            string - there's no point adding the NUL till the end.
+
 */
+/* coverity[+alloc] */
 
 uschar *
-string_cat(uschar *string, int *size, int *ptr, const uschar *s, int count)
+string_catn(uschar *string, int *size, int *ptr, const uschar *s, int count)
 {
 int p = *ptr;
 
@@ -1132,12 +1134,25 @@ if (p + count >= *size)
 
 /* Because we always specify the exact number of characters to copy, we can
 use memcpy(), which is likely to be more efficient than strncopy() because the
-latter has to check for zero bytes. */
+latter has to check for zero bytes.
+
+The Coverity annotation deals with the lack of correlated variable tracking;
+common use is a null string and zero size and pointer, on first use for a
+string being built. The "if" above then allocates, but Coverity assume that
+the "if" might not happen and whines for a null-deref done by the memcpy(). */
 
+/* coverity[deref_parm_field_in_call] : FALSE */
 memcpy(string + p, s, count);
 *ptr = p + count;
 return string;
 }
+
+
+uschar *
+string_cat(uschar *string, int *size, int *ptr, const uschar *s)
+{
+return string_catn(string, size, ptr, s, Ustrlen(s));
+}
 #endif  /* COMPILE_UTILITY */
 
 
@@ -1175,7 +1190,7 @@ va_start(ap, count);
 for (i = 0; i < count; i++)
   {
   uschar *t = va_arg(ap, uschar *);
-  string = string_cat(string, size, ptr, t, Ustrlen(t));
+  string = string_cat(string, size, ptr, t);
   }
 va_end(ap);
 
@@ -1197,10 +1212,10 @@ on whether the variable length list of data arguments are given explicitly or
 as a va_list item.
 
 The formats are the usual printf() ones, with some omissions (never used) and
-two additions for strings: %S forces lower case, and %#s or %#S prints nothing
-for a NULL string. Without the # "NULL" is printed (useful in debugging). There
-is also the addition of %D and %M, which insert the date in the form used for
-datestamped log files.
+three additions for strings: %S forces lower case, %T forces upper case, and
+%#s or %#S prints nothing for a NULL string. Without thr # "NULL" is printed
+(useful in debugging). There is also the addition of %D and %M, which insert
+the date in the form used for datestamped log files.
 
 Arguments:
   buffer       a buffer in which to put the formatted string
@@ -1413,6 +1428,7 @@ while (*fp != 0)
 
     case 's':
     case 'S':                   /* Forces *lower* case */
+    case 'T':                   /* Forces *upper* case */
     s = va_arg(ap, char *);
 
     if (s == NULL) s = null;
@@ -1460,6 +1476,8 @@ while (*fp != 0)
     sprintf(CS p, "%*.*s", width, precision, s);
     if (fp[-1] == 'S')
       while (*p) { *p = tolower(*p); p++; }
+    else if (fp[-1] == 'T')
+      while (*p) { *p = toupper(*p); p++; }
     else
       while (*p) p++;
     if (!yield) goto END_FORMAT;
@@ -1518,6 +1536,7 @@ specified messages. If it does, the message just gets truncated, and there
 doesn't seem much we can do about that. */
 
 (void)string_vformat(buffer+15, sizeof(buffer) - 15, format, ap);
+va_end(ap);
 
 return (eno == EACCES)?
   string_sprintf("%s: %s (euid=%ld egid=%ld)", buffer, strerror(eno),
@@ -1528,185 +1547,19 @@ return (eno == EACCES)?
 
 
 
-#ifndef COMPILE_UTILITY
-/*************************************************
-*        Generate local prt for logging          *
-*************************************************/
-
-/* This function is a subroutine for use in string_log_address() below.
-
-Arguments:
-  addr        the address being logged
-  yield       the current dynamic buffer pointer
-  sizeptr     points to current size
-  ptrptr      points to current insert pointer
-
-Returns:      the new value of the buffer pointer
-*/
-
-static uschar *
-string_get_localpart(address_item *addr, uschar *yield, int *sizeptr,
-  int *ptrptr)
-{
-uschar * s;
-
-s = addr->prefix;
-if (testflag(addr, af_include_affixes) && s)
-  {
-#ifdef SUPPORT_I18N
-  if (testflag(addr, af_utf8_downcvt))
-    s = string_localpart_utf8_to_alabel(s, NULL);
-#endif
-  yield = string_cat(yield, sizeptr, ptrptr, s, Ustrlen(s));
-  }
-
-s = addr->local_part;
-#ifdef SUPPORT_I18N
-if (testflag(addr, af_utf8_downcvt))
-  s = string_localpart_utf8_to_alabel(s, NULL);
-#endif
-yield = string_cat(yield, sizeptr, ptrptr, s, Ustrlen(s));
-
-s = addr->suffix;
-if (testflag(addr, af_include_affixes) && s)
-  {
-#ifdef SUPPORT_I18N
-  if (testflag(addr, af_utf8_downcvt))
-    s = string_localpart_utf8_to_alabel(s, NULL);
-#endif
-  yield = string_cat(yield, sizeptr, ptrptr, s, Ustrlen(s));
-  }
-
-return yield;
-}
-
-
-/*************************************************
-*          Generate log address list             *
-*************************************************/
-
-/* This function generates a list consisting of an address and its parents, for
-use in logging lines. For saved onetime aliased addresses, the onetime parent
-field is used. If the address was delivered by a transport with rcpt_include_
-affixes set, the af_include_affixes bit will be set in the address. In that
-case, we include the affixes here too.
 
-Arguments:
-  addr          bottom (ultimate) address
-  all_parents   if TRUE, include all parents
-  success       TRUE for successful delivery
 
-Returns:        a string in dynamic store
-*/
+#ifndef COMPILE_UTILITY
+/* qsort(3), currently used to sort the environment variables
+for -bP environment output, needs a function to compare two pointers to string
+pointers. Here it is. */
 
-uschar *
-string_log_address(address_item *addr, BOOL all_parents, BOOL success)
+int
+string_compare_by_pointer(const void *a, const void *b)
 {
-int size = 64;
-int ptr = 0;
-BOOL add_topaddr = TRUE;
-uschar *yield = store_get(size);
-address_item *topaddr;
-
-/* Find the ultimate parent */
-
-for (topaddr = addr; topaddr->parent != NULL; topaddr = topaddr->parent);
-
-/* We start with just the local part for pipe, file, and reply deliveries, and
-for successful local deliveries from routers that have the log_as_local flag
-set. File deliveries from filters can be specified as non-absolute paths in
-cases where the transport is goin to complete the path. If there is an error
-before this happens (expansion failure) the local part will not be updated, and
-so won't necessarily look like a path. Add extra text for this case. */
-
-if (testflag(addr, af_pfr) ||
-      (success &&
-       addr->router != NULL && addr->router->log_as_local &&
-       addr->transport != NULL && addr->transport->info->local))
-  {
-  if (testflag(addr, af_file) && addr->local_part[0] != '/')
-    yield = string_cat(yield, &size, &ptr, CUS"save ", 5);
-  yield = string_get_localpart(addr, yield, &size, &ptr);
-  }
-
-/* Other deliveries start with the full address. It we have split it into local
-part and domain, use those fields. Some early failures can happen before the
-splitting is done; in those cases use the original field. */
-
-else
-  {
-  if (addr->local_part != NULL)
-    {
-    const uschar * s;
-    yield = string_get_localpart(addr, yield, &size, &ptr);
-    yield = string_cat(yield, &size, &ptr, US"@", 1);
-    s = addr->domain;
-#ifdef SUPPORT_I18N
-    if (testflag(addr, af_utf8_downcvt))
-      s = string_localpart_utf8_to_alabel(s, NULL);
-#endif
-    yield = string_cat(yield, &size, &ptr, s, Ustrlen(s) );
-    }
-  else
-    {
-    yield = string_cat(yield, &size, &ptr, addr->address, Ustrlen(addr->address));
-    }
-  yield[ptr] = 0;
-
-  /* If the address we are going to print is the same as the top address,
-  and all parents are not being included, don't add on the top address. First
-  of all, do a caseless comparison; if this succeeds, do a caseful comparison
-  on the local parts. */
-
-  if (strcmpic(yield, topaddr->address) == 0 &&
-      Ustrncmp(yield, topaddr->address, Ustrchr(yield, '@') - yield) == 0 &&
-      addr->onetime_parent == NULL &&
-      (!all_parents || addr->parent == NULL || addr->parent == topaddr))
-    add_topaddr = FALSE;
-  }
-
-/* If all parents are requested, or this is a local pipe/file/reply, and
-there is at least one intermediate parent, show it in brackets, and continue
-with all of them if all are wanted. */
-
-if ((all_parents || testflag(addr, af_pfr)) &&
-    addr->parent != NULL &&
-    addr->parent != topaddr)
-  {
-  uschar *s = US" (";
-  address_item *addr2;
-  for (addr2 = addr->parent; addr2 != topaddr; addr2 = addr2->parent)
-    {
-    yield = string_cat(yield, &size, &ptr, s, 2);
-    yield = string_cat(yield, &size, &ptr, addr2->address, Ustrlen(addr2->address));
-    if (!all_parents) break;
-    s = US", ";
-    }
-  yield = string_cat(yield, &size, &ptr, US")", 1);
-  }
-
-/* Add the top address if it is required */
-
-if (add_topaddr)
-  {
-  yield = string_cat(yield, &size, &ptr, US" <", 2);
-
-  if (addr->onetime_parent == NULL)
-    yield = string_cat(yield, &size, &ptr, topaddr->address,
-      Ustrlen(topaddr->address));
-  else
-    yield = string_cat(yield, &size, &ptr, addr->onetime_parent,
-      Ustrlen(addr->onetime_parent));
-
-  yield = string_cat(yield, &size, &ptr, US">", 1);
-  }
-
-yield[ptr] = 0;  /* string_cat() leaves space */
-return yield;
+return Ustrcmp(* CUSS a, * CUSS b);
 }
-#endif  /* COMPILE_UTILITY */
-
-
+#endif /* COMPILE_UTILITY */
 
 
 
diff --git a/src/src/structs.h b/src/src/structs.h
index 78f5a8087..12d714f28 100644
--- a/src/src/structs.h
+++ b/src/src/structs.h
@@ -28,10 +28,11 @@ struct router_info;
 /* Structure for remembering macros for the configuration file */
 
 typedef struct macro_item {
-  struct  macro_item *next;
-  BOOL    command_line;
-  uschar *replacement;
-  uschar  name[1];
+  struct   macro_item *next;
+  BOOL     command_line;
+  unsigned namelen;
+  uschar * replacement;
+  uschar   name[1];
 } macro_item;
 
 /* Structure for bit tables for debugging and logging */
@@ -51,6 +52,11 @@ typedef struct ugid_block {
   BOOL    initgroups;
 } ugid_block;
 
+typedef enum {	CHUNKING_NOT_OFFERED = -1,
+		CHUNKING_OFFERED,
+		CHUNKING_ACTIVE,
+		CHUNKING_LAST} chunking_state_t;
+
 /* Structure for holding information about a host for use mainly by routers,
 but also used when checking lists of hosts and when transporting. Looking up
 host addresses is done using this structure. */
@@ -218,6 +224,40 @@ typedef struct transport_info {
 } transport_info;
 
 
+/* smtp transport datachunk callback */
+
+#define tc_reap_prev	BIT(0)	/* Flags: reap previous SMTP cmd responses */
+#define tc_chunk_last	BIT(1)	/* annotate chunk SMTP cmd as LAST */
+
+struct transport_context;
+typedef int (*tpt_chunk_cmd_cb)(int fd, struct transport_context * tctx,
+				unsigned len, unsigned flags);
+
+/* Structure for information about a delivery-in-progress */
+
+typedef struct transport_context {
+  transport_instance	* tblock;		/* transport */
+  struct address_item	* addr;
+  uschar		* check_string;		/* string replacement */
+  uschar		* escape_string;
+  int		  	  options;		/* output processing topt_* */
+
+  /* items below only used with option topt_use_bdat */
+  tpt_chunk_cmd_cb	  chunk_cb;		/* per-datachunk callback */
+  struct smtp_inblock	* inblock;
+  struct smtp_outblock	* outblock;
+  host_item		* host;
+  struct address_item	* first_addr;
+  struct address_item	**sync_addr;
+  BOOL			  pending_MAIL;
+  BOOL			  pending_BDAT;
+  BOOL			  good_RCPT;
+  BOOL			* completed_address;
+  int			  cmd_count;
+  uschar		* buffer;
+} transport_ctx;
+
+
 
 typedef struct {
   uschar *request;
@@ -506,12 +546,13 @@ typedef struct address_item_propagated {
 #ifndef DISABLE_PRDR
 # define af_prdr_used          0x08000000 /* delivery used SMTP PRDR */
 #endif
-#define af_force_command       0x10000000 /* force_command in pipe transport */
+#define af_chunking_used       0x10000000 /* delivery used SMTP CHUNKING */
+#define af_force_command       0x20000000 /* force_command in pipe transport */
 #ifdef EXPERIMENTAL_DANE
-# define af_dane_verified      0x20000000 /* TLS cert verify done with DANE */
+# define af_dane_verified      0x40000000 /* TLS cert verify done with DANE */
 #endif
 #ifdef SUPPORT_I18N
-# define af_utf8_downcvt       0x40000000 /* downconvert was done for delivery */
+# define af_utf8_downcvt       0x80000000 /* downconvert was done for delivery */
 #endif
 
 /* These flags must be propagated when a child is created */
@@ -690,11 +731,11 @@ typedef struct search_cache {
 uncompressed, but the data pointer is into the raw data. */
 
 typedef struct {
-  uschar  name[DNS_MAXNAME];      /* domain name */
-  int     type;                   /* record type */
-  unsigned short ttl;		  /* time-to-live, seconds */
-  int     size;                   /* size of data */
-  uschar *data;                   /* pointer to data */
+  uschar        name[DNS_MAXNAME];      /* domain name */
+  int           type;                   /* record type */
+  unsigned short ttl;		        /* time-to-live, seconds */
+  int           size;                   /* size of data */
+  const uschar *data;                   /* pointer to data */
 } dns_record;
 
 /* Structure for holding the result of a DNS query. */
@@ -708,9 +749,9 @@ typedef struct {
 block. */
 
 typedef struct {
-  int     rrcount;                /* count of RRs in the answer */
-  uschar *aptr;                   /* pointer in the answer while scanning */
-  dns_record srr;                 /* data from current record in scan */
+  int            rrcount;         /* count of RRs in the answer */
+  const uschar *aptr;             /* pointer in the answer while scanning */
+  dns_record     srr;             /* data from current record in scan */
 } dns_scan;
 
 /* Structure for holding a chain of IP addresses that are extracted from
@@ -826,4 +867,15 @@ typedef struct acl_block {
 /* smtp transport calc outbound_ip */
 typedef BOOL (*oicf) (uschar *message_id, void *data);
 
+/* DKIM information for transport */
+struct ob_dkim {
+  uschar *dkim_domain;
+  uschar *dkim_private_key;
+  uschar *dkim_selector;
+  uschar *dkim_canon;
+  uschar *dkim_sign_headers;
+  uschar *dkim_strict;
+  BOOL    dot_stuffed;
+};
+
 /* End of structs.h */
diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 601197475..10bfaca32 100644
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -42,6 +42,7 @@ require current GnuTLS, then we'll drop support for the ancient libraries).
 /* needed to disable PKCS11 autoload unless requested */
 #if GNUTLS_VERSION_NUMBER >= 0x020c00
 # include <gnutls/pkcs11.h>
+# define SUPPORT_PARAM_TO_PK_BITS
 #endif
 #if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
@@ -492,8 +493,7 @@ else if (Ustrcmp(exp_tls_dhparam, "none") == 0)
   }
 else if (exp_tls_dhparam[0] != '/')
   {
-  m.data = US std_dh_prime_named(exp_tls_dhparam);
-  if (m.data == NULL)
+  if (!(m.data = US std_dh_prime_named(exp_tls_dhparam)))
     return tls_error(US"No standard prime named", CS exp_tls_dhparam, NULL);
   m.size = Ustrlen(m.data);
   }
@@ -547,8 +547,7 @@ if (use_file_in_spool)
 /* Open the cache file for reading and if successful, read it and set up the
 parameters. */
 
-fd = Uopen(filename, O_RDONLY, 0);
-if (fd >= 0)
+if ((fd = Uopen(filename, O_RDONLY, 0)) >= 0)
   {
   struct stat statbuf;
   FILE *fp;
@@ -565,8 +564,7 @@ if (fd >= 0)
     (void)close(fd);
     return tls_error(US"TLS cache not a file", NULL, NULL);
     }
-  fp = fdopen(fd, "rb");
-  if (!fp)
+  if (!(fp = fdopen(fd, "rb")))
     {
     saved_errno = errno;
     (void)close(fd);
@@ -575,14 +573,12 @@ if (fd >= 0)
     }
 
   m.size = statbuf.st_size;
-  m.data = malloc(m.size);
-  if (m.data == NULL)
+  if (!(m.data = malloc(m.size)))
     {
     fclose(fp);
     return tls_error(US"malloc failed", strerror(errno), NULL);
     }
-  sz = fread(m.data, m.size, 1, fp);
-  if (!sz)
+  if (!(sz = fread(m.data, m.size, 1, fp)))
     {
     saved_errno = errno;
     fclose(fp);
@@ -626,8 +622,7 @@ if (rc < 0)
         CS filename, NULL);
 
   temp_fn = string_copy(US "%s.XXXXXXX");
-  fd = mkstemp(CS temp_fn); /* modifies temp_fn */
-  if (fd < 0)
+  if ((fd = mkstemp(CS temp_fn)) < 0)	/* modifies temp_fn */
     return tls_error(US"Unable to open temp file", strerror(errno), NULL);
   (void)fchown(fd, exim_uid, exim_gid);   /* Probably not necessary */
 
@@ -664,9 +659,9 @@ if (rc < 0)
   if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
     exim_gnutls_err_check(US"gnutls_dh_params_export_pkcs3(NULL) sizing");
   m.size = sz;
-  m.data = malloc(m.size);
-  if (m.data == NULL)
+  if (!(m.data = malloc(m.size)))
     return tls_error(US"memory allocation failed", strerror(errno), NULL);
+
   /* this will return a size 1 less than the allocation size above */
   rc = gnutls_dh_params_export_pkcs3(dh_server_params, GNUTLS_X509_FMT_PEM,
       m.data, &sz);
@@ -677,23 +672,19 @@ if (rc < 0)
     }
   m.size = sz; /* shrink by 1, probably */
 
-  sz = write_to_fd_buf(fd, m.data, (size_t) m.size);
-  if (sz != m.size)
+  if ((sz = write_to_fd_buf(fd, m.data, (size_t) m.size)) != m.size)
     {
     free(m.data);
     return tls_error(US"TLS cache write D-H params failed",
         strerror(errno), NULL);
     }
   free(m.data);
-  sz = write_to_fd_buf(fd, US"\n", 1);
-  if (sz != 1)
+  if ((sz = write_to_fd_buf(fd, US"\n", 1)) != 1)
     return tls_error(US"TLS cache write D-H params final newline failed",
         strerror(errno), NULL);
 
-  rc = close(fd);
-  if (rc)
-    return tls_error(US"TLS cache write close() failed",
-        strerror(errno), NULL);
+  if ((rc = close(fd)))
+    return tls_error(US"TLS cache write close() failed", strerror(errno), NULL);
 
   if (Urename(temp_fn, filename) < 0)
     return tls_error(string_sprintf("failed to rename \"%s\" as \"%s\"",
@@ -709,6 +700,74 @@ return OK;
 
 
 
+/* Create and install a selfsigned certificate, for use in server mode */
+
+static int
+tls_install_selfsign(exim_gnutls_state_st * state)
+{
+gnutls_x509_crt_t cert = NULL;
+time_t now;
+gnutls_x509_privkey_t pkey = NULL;
+const uschar * where;
+int rc;
+
+where = US"initialising pkey";
+if ((rc = gnutls_x509_privkey_init(&pkey))) goto err;
+
+where = US"initialising cert";
+if ((rc = gnutls_x509_crt_init(&cert))) goto err;
+
+where = US"generating pkey";
+if ((rc = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_RSA,
+#ifdef SUPPORT_PARAM_TO_PK_BITS
+	    gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA, GNUTLS_SEC_PARAM_LOW),
+#else
+	    1024,
+#endif
+	    0)))
+  goto err;
+
+where = US"configuring cert";
+now = 0;
+if (  (rc = gnutls_x509_crt_set_version(cert, 3))
+   || (rc = gnutls_x509_crt_set_serial(cert, &now, sizeof(now)))
+   || (rc = gnutls_x509_crt_set_activation_time(cert, now = time(NULL)))
+   || (rc = gnutls_x509_crt_set_expiration_time(cert, now + 60 * 60)) /* 1 hr */
+   || (rc = gnutls_x509_crt_set_key(cert, pkey))
+
+   || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
+	      GNUTLS_OID_X520_COUNTRY_NAME, 0, "UK", 2))
+   || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
+	      GNUTLS_OID_X520_ORGANIZATION_NAME, 0, "Exim Developers", 15))
+   || (rc = gnutls_x509_crt_set_dn_by_oid(cert,
+	      GNUTLS_OID_X520_COMMON_NAME, 0,
+	      smtp_active_hostname, Ustrlen(smtp_active_hostname)))
+   )
+  goto err;
+
+where = US"signing cert";
+if ((rc = gnutls_x509_crt_sign(cert, cert, pkey))) goto err;
+
+where = US"installing selfsign cert";
+					/* Since: 2.4.0 */
+if ((rc = gnutls_certificate_set_x509_key(state->x509_cred, &cert, 1, pkey)))
+  goto err;
+
+rc = OK;
+
+out:
+  if (cert) gnutls_x509_crt_deinit(cert);
+  if (pkey) gnutls_x509_privkey_deinit(pkey);
+  return rc;
+
+err:
+  rc = tls_error(where, gnutls_strerror(rc), NULL);
+  goto out;
+}
+
+
+
+
 /*************************************************
 *       Variables re-expanded post-SNI           *
 *************************************************/
@@ -741,7 +800,6 @@ int cert_count;
 
 /* We check for tls_sni *before* expansion. */
 if (!host)	/* server */
-  {
   if (!state->received_sni)
     {
     if (state->tls_certificate &&
@@ -762,7 +820,6 @@ if (!host)	/* server */
     saved_tls_verify_certificates = state->exp_tls_verify_certificates;
     saved_tls_crl = state->exp_tls_crl;
     }
-  }
 
 rc = gnutls_certificate_allocate_credentials(&state->x509_cred);
 exim_gnutls_err_check(US"gnutls_certificate_allocate_credentials");
@@ -779,14 +836,13 @@ if (!expand_check_tlsvar(tls_certificate))
 
 /* certificate is mandatory in server, optional in client */
 
-if ((state->exp_tls_certificate == NULL) ||
-    (*state->exp_tls_certificate == '\0'))
-  {
+if (  !state->exp_tls_certificate
+   || !*state->exp_tls_certificate
+   )
   if (!host)
-    return tls_error(US"no TLS server certificate is specified", NULL, NULL);
+    return tls_install_selfsign(state);
   else
     DEBUG(D_tls) debug_printf("TLS: no client certificate specified; okay\n");
-  }
 
 if (state->tls_privatekey && !expand_check_tlsvar(tls_privatekey))
   return DEFER;
@@ -806,9 +862,9 @@ if (state->exp_tls_certificate && *state->exp_tls_certificate)
       state->exp_tls_certificate, state->exp_tls_privatekey);
 
   if (state->received_sni)
-    {
-    if ((Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0) &&
-        (Ustrcmp(state->exp_tls_privatekey, saved_tls_privatekey) == 0))
+    if (  Ustrcmp(state->exp_tls_certificate, saved_tls_certificate) == 0
+       && Ustrcmp(state->exp_tls_privatekey,  saved_tls_privatekey)  == 0
+       )
       {
       DEBUG(D_tls) debug_printf("TLS SNI: cert and key unchanged\n");
       }
@@ -816,7 +872,6 @@ if (state->exp_tls_certificate && *state->exp_tls_certificate)
       {
       DEBUG(D_tls) debug_printf("TLS SNI: have a changed cert/key pair.\n");
       }
-    }
 
   rc = gnutls_certificate_set_x509_key_file(state->x509_cred,
       CS state->exp_tls_certificate, CS state->exp_tls_privatekey,
@@ -911,7 +966,7 @@ else
   but who knows if someone has some weird FIFO which always dumps some certs, or
   other weirdness.  The thing we really want to check is that it's not a
   directory, since while OpenSSL supports that, GnuTLS does not.
-  So s/!S_ISREG/S_ISDIR/ and change some messsaging ... */
+  So s/!S_ISREG/S_ISDIR/ and change some messaging ... */
   if (S_ISDIR(statbuf.st_mode))
     {
     DEBUG(D_tls)
@@ -1448,7 +1503,7 @@ else
     int sep = 0;
     const uschar * list = state->exp_tls_verify_cert_hostnames;
     uschar * name;
-    while (name = string_nextinlist(&list, &sep, NULL, 0))
+    while ((name = string_nextinlist(&list, &sep, NULL, 0)))
       if (gnutls_x509_crt_check_hostname(state->tlsp->peercert, CS name))
 	break;
     if (!name)
@@ -1761,24 +1816,33 @@ state->fd_out = fileno(smtp_out);
 sigalrm_seen = FALSE;
 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
 do
-  {
   rc = gnutls_handshake(state->session);
-  } while ((rc == GNUTLS_E_AGAIN) ||
-      (rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen));
+while (rc == GNUTLS_E_AGAIN ||  rc == GNUTLS_E_INTERRUPTED && !sigalrm_seen);
 alarm(0);
 
 if (rc != GNUTLS_E_SUCCESS)
   {
-  tls_error(US"gnutls_handshake",
-      sigalrm_seen ? "timed out" : gnutls_strerror(rc), NULL);
   /* It seems that, except in the case of a timeout, we have to close the
   connection right here; otherwise if the other end is running OpenSSL it hangs
   until the server times out. */
 
-  if (!sigalrm_seen)
+  if (sigalrm_seen)
+    {
+    tls_error(US"gnutls_handshake", "timed out", NULL);
+    gnutls_db_remove_session(state->session);
+    }
+  else
     {
+    tls_error(US"gnutls_handshake", gnutls_strerror(rc), NULL);
+    (void) gnutls_alert_send_appropriate(state->session, rc);
+    gnutls_deinit(state->session);
+    gnutls_certificate_free_credentials(state->x509_cred);
+    millisleep(500);
+    shutdown(state->fd_out, SHUT_WR);
+    for (rc = 1024; fgetc(smtp_in) != EOF && rc > 0; ) rc--;	/* drain skt */
     (void)fclose(smtp_out);
     (void)fclose(smtp_in);
+    smtp_out = smtp_in = NULL;
     }
 
   return FAIL;
@@ -1803,8 +1867,7 @@ if (  state->verify_requirement != VERIFY_NONE
 
 /* Figure out peer DN, and if authenticated, etc. */
 
-rc = peer_status(state);
-if (rc != OK) return rc;
+if ((rc = peer_status(state)) != OK) return rc;
 
 /* Sets various Exim expansion variables; always safe within server */
 
@@ -1816,6 +1879,7 @@ and initialize appropriately. */
 state->xfer_buffer = store_malloc(ssl_xfer_buffer_size);
 
 receive_getc = tls_getc;
+receive_get_cache = tls_get_cache;
 receive_ungetc = tls_ungetc;
 receive_feof = tls_feof;
 receive_ferror = tls_ferror;
@@ -1867,7 +1931,7 @@ tls_client_start(int fd, host_item *host,
     address_item *addr ARG_UNUSED,
     transport_instance *tb
 #ifdef EXPERIMENTAL_DANE
-    , dne_answer * unused_tlsa_dnsa
+    , dns_answer * unused_tlsa_dnsa
 #endif
     )
 {
@@ -1979,8 +2043,13 @@ do
 alarm(0);
 
 if (rc != GNUTLS_E_SUCCESS)
-  return tls_error(US"gnutls_handshake",
-      sigalrm_seen ? "timed out" : gnutls_strerror(rc), state->host);
+  if (sigalrm_seen)
+    {
+    gnutls_alert_send(state->session, GNUTLS_AL_FATAL, GNUTLS_A_USER_CANCELED);
+    return tls_error(US"gnutls_handshake", "timed out", state->host);
+    }
+  else
+    return tls_error(US"gnutls_handshake", gnutls_strerror(rc), state->host);
 
 DEBUG(D_tls) debug_printf("gnutls_handshake was successful\n");
 
@@ -2062,6 +2131,8 @@ if (shutdown)
   }
 
 gnutls_deinit(state->session);
+gnutls_certificate_free_credentials(state->x509_cred);
+
 
 state->tlsp->active = -1;
 memcpy(state, &exim_gnutls_state_init, sizeof(exim_gnutls_state_init));
@@ -2107,21 +2178,32 @@ if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
     ssl_xfer_buffer_size);
   alarm(0);
 
-  /* A zero-byte return appears to mean that the TLS session has been
+  /* Timeouts do not get this far; see command_timeout_handler().
+     A zero-byte return appears to mean that the TLS session has been
      closed down, not that the socket itself has been closed down. Revert to
      non-TLS handling. */
 
-  if (inbytes == 0)
+  if (sigalrm_seen)
+    {
+    DEBUG(D_tls) debug_printf("Got tls read timeout\n");
+    state->xfer_error = 1;
+    return EOF;
+    }
+
+  else if (inbytes == 0)
     {
     DEBUG(D_tls) debug_printf("Got TLS_EOF\n");
 
     receive_getc = smtp_getc;
+    receive_get_cache = smtp_get_cache;
     receive_ungetc = smtp_ungetc;
     receive_feof = smtp_feof;
     receive_ferror = smtp_ferror;
     receive_smtp_buffered = smtp_buffered;
 
     gnutls_deinit(state->session);
+    gnutls_certificate_free_credentials(state->x509_cred);
+
     state->session = NULL;
     state->tlsp->active = -1;
     state->tlsp->bits = 0;
@@ -2154,6 +2236,17 @@ if (state->xfer_buffer_lwm >= state->xfer_buffer_hwm)
 return state->xfer_buffer[state->xfer_buffer_lwm++];
 }
 
+void
+tls_get_cache()
+{
+#ifndef DISABLE_DKIM
+exim_gnutls_state_st * state = &state_server;
+int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
+if (n > 0)
+  dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
+#endif
+}
+
 
 
 
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 9e008e149..452452df2 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Portions Copyright (c) The OpenSSL Project 1999 */
@@ -41,6 +41,18 @@ functions from the OpenSSL library. */
 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
 # define EXIM_HAVE_OPENSSL_TLSEXT
 #endif
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L
+# define EXIM_HAVE_RSA_GENKEY_EX
+#endif
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+# define EXIM_HAVE_OCSP_RESP_COUNT
+#else
+# define EXIM_HAVE_EPHEM_RSA_KEX
+# define EXIM_HAVE_RAND_PSEUDO
+#endif
+#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
+# define EXIM_HAVE_SHA256
+#endif
 
 /*
  * X509_check_host provides sane certificate hostname checking, but was added
@@ -71,7 +83,9 @@ functions from the OpenSSL library. */
 #   define EXIM_HAVE_ECDH
 #  endif
 #  if OPENSSL_VERSION_NUMBER >= 0x10002000L
-#   define EXIM_HAVE_OPENSSL_ECDH_AUTO
+#   if OPENSSL_VERSION_NUMBER < 0x10100000L
+#    define EXIM_HAVE_OPENSSL_ECDH_AUTO
+#   endif
 #   define EXIM_HAVE_OPENSSL_EC_NIST2NID
 #  endif
 # endif
@@ -137,6 +151,7 @@ typedef struct tls_ext_ctx_cb {
   uschar *privatekey;
 #ifndef DISABLE_OCSP
   BOOL is_server;
+  STACK_OF(X509) *verify_stack;		/* chain for verifying the proof */
   union {
     struct {
       uschar        *file;
@@ -200,7 +215,7 @@ Returns:    OK/DEFER/FAIL
 */
 
 static int
-tls_error(uschar * prefix, const host_item * host, uschar *  msg)
+tls_error(uschar * prefix, const host_item * host, uschar * msg)
 {
 if (!msg)
   {
@@ -228,6 +243,7 @@ else
 
 
 
+#ifdef EXIM_HAVE_EPHEM_RSA_KEX
 /*************************************************
 *        Callback to generate RSA key            *
 *************************************************/
@@ -245,10 +261,22 @@ static RSA *
 rsa_callback(SSL *s, int export, int keylength)
 {
 RSA *rsa_key;
+#ifdef EXIM_HAVE_RSA_GENKEY_EX
+BIGNUM *bn = BN_new();
+#endif
+
 export = export;     /* Shut picky compilers up */
 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
-rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
-if (rsa_key == NULL)
+
+#ifdef EXIM_HAVE_RSA_GENKEY_EX
+if (  !BN_set_word(bn, (unsigned long)RSA_F4)
+   || !(rsa_key = RSA_new())
+   || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
+   )
+#else
+if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
+#endif
+
   {
   ERR_error_string(ERR_get_error(), ssl_errstring);
   log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
@@ -257,6 +285,7 @@ if (rsa_key == NULL)
   }
 return rsa_key;
 }
+#endif
 
 
 
@@ -398,6 +427,7 @@ else if (depth != 0)
     if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
                              cert))
       ERR_clear_error();
+    sk_X509_push(client_static_cbinfo->verify_stack, cert);
     }
 #endif
 #ifndef DISABLE_EVENT
@@ -751,7 +781,6 @@ return !rv;
 /*************************************************
 *       Load OCSP information into state         *
 *************************************************/
-
 /* Called to load the server OCSP response from the given file into memory, once
 caller has determined this is needed.  Checks validity.  Debugs a message
 if invalid.
@@ -768,12 +797,12 @@ Arguments:
 static void
 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
 {
-BIO *bio;
-OCSP_RESPONSE *resp;
-OCSP_BASICRESP *basic_response;
-OCSP_SINGLERESP *single_response;
-ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
-X509_STORE *store;
+BIO * bio;
+OCSP_RESPONSE * resp;
+OCSP_BASICRESP * basic_response;
+OCSP_SINGLERESP * single_response;
+ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
+STACK_OF(X509) * sk;
 unsigned long verify_flags;
 int status, reason, i;
 
@@ -784,8 +813,7 @@ if (cbinfo->u_ocsp.server.response)
   cbinfo->u_ocsp.server.response = NULL;
   }
 
-bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
-if (!bio)
+if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb")))
   {
   DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
       cbinfo->u_ocsp.server.file_expanded);
@@ -800,33 +828,54 @@ if (!resp)
   return;
   }
 
-status = OCSP_response_status(resp);
-if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
+if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
   {
   DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
       OCSP_response_status_str(status), status);
   goto bad;
   }
 
-basic_response = OCSP_response_get1_basic(resp);
-if (!basic_response)
+if (!(basic_response = OCSP_response_get1_basic(resp)))
   {
   DEBUG(D_tls)
     debug_printf("OCSP response parse error: unable to extract basic response.\n");
   goto bad;
   }
 
-store = SSL_CTX_get_cert_store(sctx);
+sk = cbinfo->verify_stack;
 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
 
 /* May need to expose ability to adjust those flags?
 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
 OCSP_TRUSTOTHER OCSP_NOINTERN */
 
-i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
-if (i <= 0)
+/* This does a full verify on the OCSP proof before we load it for serviing
+up; possibly overkill - just date-checks might be nice enough.
+
+OCSP_basic_verify takes a "store" arg, but does not
+use it for the chain verification, which is all we do
+when OCSP_NOVERIFY is set.  The content from the wire
+"basic_response" and a cert-stack "sk" are all that is used.
+
+We have a stack, loaded in setup_certs() if tls_verify_certificates
+was a file (not a directory, or "system").  It is unfortunate we
+cannot used the connection context store, as that would neatly
+handle the "system" case too, but there seems to be no library
+function for getting a stack from a store.
+[ In OpenSSL 1.1 - ?  X509_STORE_CTX_get0_chain(ctx) ? ]
+We do not free the stack since it could be needed a second time for
+SNI handling.
+
+Seperately we might try to replace using OCSP_basic_verify() - which seems to not
+be a public interface into the OpenSSL library (there's no manual entry) - 
+But what with?  We also use OCSP_basic_verify in the client stapling callback.
+And there we NEED it; we miust verify that status... unless the
+library does it for us anyway?  */
+
+if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
   {
-  DEBUG(D_tls) {
+  DEBUG(D_tls)
+    {
     ERR_error_string(ERR_get_error(), ssl_errstring);
     debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
     }
@@ -840,8 +889,8 @@ proves false, we need to extract a cert id from our issued cert
 right cert in the stack and then calls OCSP_single_get0_status()).
 
 I'm hoping to avoid reworking a bunch more of how we handle state here. */
-single_response = OCSP_resp_get0(basic_response, 0);
-if (!single_response)
+
+if (!(single_response = OCSP_resp_get0(basic_response, 0)))
   {
   DEBUG(D_tls)
     debug_printf("Unable to get first response from OCSP basic response.\n");
@@ -872,7 +921,7 @@ bad:
     {
     extern char ** environ;
     uschar ** p;
-    for (p = USS environ; *p != NULL; p++)
+    if (environ) for (p = USS environ; *p != NULL; p++)
       if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
 	{
 	DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
@@ -886,6 +935,73 @@ return;
 
 
 
+/* Create and install a selfsigned certificate, for use in server mode */
+
+static int
+tls_install_selfsign(SSL_CTX * sctx)
+{
+X509 * x509 = NULL;
+EVP_PKEY * pkey;
+RSA * rsa;
+X509_NAME * name;
+uschar * where;
+
+where = US"allocating pkey";
+if (!(pkey = EVP_PKEY_new()))
+  goto err;
+
+where = US"allocating cert";
+if (!(x509 = X509_new()))
+  goto err;
+
+where = US"generating pkey";
+		/* deprecated, use RSA_generate_key_ex() */
+if (!(rsa = RSA_generate_key(1024, RSA_F4, NULL, NULL)))
+  goto err;
+
+where = US"assiging pkey";
+if (!EVP_PKEY_assign_RSA(pkey, rsa))
+  goto err;
+
+X509_set_version(x509, 2);				/* N+1 - version 3 */
+ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
+X509_gmtime_adj(X509_get_notBefore(x509), 0);
+X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60);	/* 1 hour */
+X509_set_pubkey(x509, pkey);
+
+name = X509_get_subject_name(x509);
+X509_NAME_add_entry_by_txt(name, "C",
+			  MBSTRING_ASC, CUS "UK", -1, -1, 0);
+X509_NAME_add_entry_by_txt(name, "O",
+			  MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
+X509_NAME_add_entry_by_txt(name, "CN",
+			  MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
+X509_set_issuer_name(x509, name);
+
+where = US"signing cert";
+if (!X509_sign(x509, pkey, EVP_md5()))
+  goto err;
+
+where = US"installing selfsign cert";
+if (!SSL_CTX_use_certificate(sctx, x509))
+  goto err;
+
+where = US"installing selfsign key";
+if (!SSL_CTX_use_PrivateKey(sctx, pkey))
+  goto err;
+
+return OK;
+
+err:
+  (void) tls_error(where, NULL, NULL);
+  if (x509) X509_free(x509);
+  if (pkey) EVP_PKEY_free(pkey);
+  return DEFER;
+}
+
+
+
+
 /*************************************************
 *        Expand key and cert file specs          *
 *************************************************/
@@ -906,41 +1022,49 @@ tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
 {
 uschar *expanded;
 
-if (cbinfo->certificate == NULL)
-  return OK;
-
-if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
-    Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
-    Ustrstr(cbinfo->certificate, US"tls_out_sni")
-   )
-  reexpand_tls_files_for_sni = TRUE;
-
-if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
-  return DEFER;
-
-if (expanded != NULL)
+if (!cbinfo->certificate)
   {
-  DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
-  if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
-    return tls_error(string_sprintf(
-      "SSL_CTX_use_certificate_chain_file file=%s", expanded),
-        cbinfo->host, NULL);
+  if (cbinfo->host)			/* client */
+    return OK;
+  					/* server */
+  if (tls_install_selfsign(sctx) != OK)
+    return DEFER;
   }
+else
+  {
+  if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
+      Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
+      Ustrstr(cbinfo->certificate, US"tls_out_sni")
+     )
+    reexpand_tls_files_for_sni = TRUE;
 
-if (cbinfo->privatekey != NULL &&
-    !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
-  return DEFER;
+  if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
+    return DEFER;
+
+  if (expanded != NULL)
+    {
+    DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
+    if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
+      return tls_error(string_sprintf(
+	"SSL_CTX_use_certificate_chain_file file=%s", expanded),
+	  cbinfo->host, NULL);
+    }
 
-/* If expansion was forced to fail, key_expanded will be NULL. If the result
-of the expansion is an empty string, ignore it also, and assume the private
-key is in the same file as the certificate. */
+  if (cbinfo->privatekey != NULL &&
+      !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
+    return DEFER;
 
-if (expanded && *expanded)
-  {
-  DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
-  if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
-    return tls_error(string_sprintf(
-      "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
+  /* If expansion was forced to fail, key_expanded will be NULL. If the result
+  of the expansion is an empty string, ignore it also, and assume the private
+  key is in the same file as the certificate. */
+
+  if (expanded && *expanded)
+    {
+    DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
+    if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
+      return tls_error(string_sprintf(
+	"SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
+    }
   }
 
 #ifndef DISABLE_OCSP
@@ -958,9 +1082,7 @@ if (cbinfo->is_server && cbinfo->u_ocsp.server.file)
       DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
       }
     else
-      {
       ocsp_load_response(sctx, cbinfo, expanded);
-      }
     }
   }
 #endif
@@ -1047,8 +1169,9 @@ if (cbinfo->u_ocsp.server.file)
   }
 #endif
 
-rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
-if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
+if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
+		      verify_callback_server)) != OK)
+  return SSL_TLSEXT_ERR_NOACK;
 
 /* do this after setup_certs, because this can require the certs for verifying
 OCSP information. */
@@ -1176,7 +1299,7 @@ if(!(bs = OCSP_response_get1_basic(rsp)))
     /* Use the chain that verified the server cert to verify the stapled info */
     /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
 
-    if ((i = OCSP_basic_verify(bs, NULL,
+    if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
 	      cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
       {
       tls_out.ocsp = OCSP_FAILED;
@@ -1184,23 +1307,33 @@ if(!(bs = OCSP_response_get1_basic(rsp)))
 	log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
       BIO_printf(bp, "OCSP response verify failure\n");
       ERR_print_errors(bp);
-      i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
-      goto out;
+      goto failed;
       }
 
     BIO_printf(bp, "OCSP response well-formed and signed OK\n");
 
+    /*XXX So we have a good stapled OCSP status.  How do we know
+    it is for the cert of interest?  OpenSSL 1.1.0 has a routine
+    OCSP_resp_find_status() which matches on a cert id, which presumably
+    we should use. Making an id needs OCSP_cert_id_new(), which takes
+    issuerName, issuerKey, serialNumber.  Are they all in the cert?
+
+    For now, carry on blindly accepting the resp. */
+
       {
-      STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
       OCSP_SINGLERESP * single;
 
+#ifdef EXIM_HAVE_OCSP_RESP_COUNT
+      if (OCSP_resp_count(bs) != 1)
+#else
+      STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
       if (sk_OCSP_SINGLERESP_num(sresp) != 1)
+#endif
         {
 	tls_out.ocsp = OCSP_FAILED;
         log_write(0, LOG_MAIN, "OCSP stapling "
 	    "with multiple responses not handled");
-	i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
-        goto out;
+        goto failed;
         }
       single = OCSP_resp_get0(bs, 0);
       status = OCSP_single_get0_status(single, &reason, &rev,
@@ -1215,7 +1348,6 @@ if(!(bs = OCSP_response_get1_basic(rsp)))
       tls_out.ocsp = OCSP_FAILED;
       DEBUG(D_tls) ERR_print_errors(bp);
       log_write(0, LOG_MAIN, "Server OSCP dates invalid");
-      i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
       }
     else
       {
@@ -1226,24 +1358,24 @@ if(!(bs = OCSP_response_get1_basic(rsp)))
 	case V_OCSP_CERTSTATUS_GOOD:
 	  tls_out.ocsp = OCSP_VFIED;
 	  i = 1;
-	  break;
+	  goto good;
 	case V_OCSP_CERTSTATUS_REVOKED:
 	  tls_out.ocsp = OCSP_FAILED;
 	  log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
 	      reason != -1 ? "; reason: " : "",
 	      reason != -1 ? OCSP_crl_reason_str(reason) : "");
 	  DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
-	  i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
 	  break;
 	default:
 	  tls_out.ocsp = OCSP_FAILED;
 	  log_write(0, LOG_MAIN,
 	      "Server certificate status unknown, in OCSP stapling");
-	  i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
 	  break;
 	}
       }
-  out:
+  failed:
+    i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
+  good:
     BIO_free(bp);
   }
 
@@ -1290,6 +1422,7 @@ cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
 cbinfo->certificate = certificate;
 cbinfo->privatekey = privatekey;
 #ifndef DISABLE_OCSP
+cbinfo->verify_stack = NULL;
 if ((cbinfo->is_server = host==NULL))
   {
   cbinfo->u_ocsp.server.file = ocsp_file;
@@ -1309,7 +1442,7 @@ cbinfo->event_action = NULL;
 SSL_load_error_strings();          /* basic set up */
 OpenSSL_add_ssl_algorithms();
 
-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
+#ifdef EXIM_HAVE_SHA256
 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
 list of available digests. */
 EVP_add_digest(EVP_sha256());
@@ -1323,10 +1456,9 @@ when OpenSSL is built without SSLv2 support.
 By disabling with openssl_options, we can let admins re-enable with the
 existing knob. */
 
-*ctxp = SSL_CTX_new((host == NULL)?
-  SSLv23_server_method() : SSLv23_client_method());
+*ctxp = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method());
 
-if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
+if (!*ctxp) return tls_error(US"SSL_CTX_new", host, NULL);
 
 /* It turns out that we need to seed the random number generator this early in
 order to get the full complement of ciphers to work. It took me roughly a day
@@ -1392,11 +1524,20 @@ if (  !init_dh(*ctxp, dhparam, host)
 
 /* Set up certificate and key (and perhaps OCSP info) */
 
-rc = tls_expand_session_files(*ctxp, cbinfo);
-if (rc != OK) return rc;
+if ((rc = tls_expand_session_files(*ctxp, cbinfo)) != OK)
+  return rc;
+
+/* If we need to handle SNI or OCSP, do so */
 
-/* If we need to handle SNI, do so */
 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
+# ifndef DISABLE_OCSP
+  if (!(cbinfo->verify_stack = sk_X509_new_null()))
+    {
+    DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
+    return FAIL;
+    }
+# endif
+
 if (host == NULL)		/* server */
   {
 # ifndef DISABLE_OCSP
@@ -1432,9 +1573,10 @@ else			/* client */
 
 cbinfo->verify_cert_hostnames = NULL;
 
+#ifdef EXIM_HAVE_EPHEM_RSA_KEX
 /* Set up the RSA callback */
-
 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
+#endif
 
 /* Finally, set the timeout, and we are done */
 
@@ -1512,6 +1654,23 @@ else
 *        Set up for verifying certificates       *
 *************************************************/
 
+/* Load certs from file, return TRUE on success */
+
+static BOOL
+chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
+{
+BIO * bp;
+X509 * x;
+
+if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
+while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
+  sk_X509_push(verify_stack, x);
+BIO_free(bp);
+return TRUE;
+}
+
+
+
 /* Called by both client and server startup
 
 Arguments:
@@ -1559,12 +1718,29 @@ if (expcerts && *expcerts)
       if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
 	{ file = NULL; dir = expcerts; }
       else
-	{ file = expcerts; dir = NULL; }
+	{
+	file = expcerts; dir = NULL;
+#ifndef DISABLE_OCSP
+	/* In the server if we will be offering an OCSP proof, load chain from
+	file for verifying the OCSP proof at load time. */
+
+	if (  !host
+	   && statbuf.st_size > 0
+	   && server_static_cbinfo->u_ocsp.server.file
+	   && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
+	   )
+	  {
+	  log_write(0, LOG_MAIN|LOG_PANIC,
+	    "failed to load cert hain from %s", file);
+	  return DEFER;
+	  }
+#endif
+	}
 
       /* If a certificate file is empty, the next function fails with an
       unhelpful error message. If we skip it, we get the correct behaviour (no
       certificates are recognized, but the error message is still misleading (it
-      says no certificate was supplied.) But this is better. */
+      says no certificate was supplied).  But this is better. */
 
       if (  (!file || statbuf.st_size > 0)
          && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
@@ -1711,9 +1887,9 @@ were historically separated by underscores. So that I can use either form in my
 tests, and also for general convenience, we turn underscores into hyphens here.
 */
 
-if (expciphers != NULL)
+if (expciphers)
   {
-  uschar *s = expciphers;
+  uschar * s = expciphers;
   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
   if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
@@ -1747,7 +1923,7 @@ else if (verify_check_host(&tls_try_verify_hosts) == OK)
 
 /* Prepare for new connection */
 
-if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
+if (!(server_ssl = SSL_new(server_ctx))) return tls_error(US"SSL_new", NULL, NULL);
 
 /* Warning: we used to SSL_clear(ssl) here, it was removed.
  *
@@ -1831,6 +2007,7 @@ ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
 ssl_xfer_eof = ssl_xfer_error = 0;
 
 receive_getc = tls_getc;
+receive_get_cache = tls_get_cache;
 receive_ungetc = tls_ungetc;
 receive_feof = tls_feof;
 receive_ferror = tls_ferror;
@@ -1900,7 +2077,7 @@ for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
     ) if (rr->type == T_TLSA)
   {
-  uschar * p = rr->data;
+  const uschar * p = rr->data;
   uint8_t usage, selector, mtype;
   const char * mdname;
 
@@ -1924,8 +2101,8 @@ for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
   switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
     {
     default:
-    case 0:	/* action not taken */
       return tls_error(US"tlsa load", host, NULL);
+    case 0:	/* action not taken */
     case 1:	break;
     }
 
@@ -2082,8 +2259,7 @@ if (ob->tls_sni)
     DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
     SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
 #else
-    DEBUG(D_tls)
-      debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
+    log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
           tls_out.sni);
 #endif
     }
@@ -2202,6 +2378,7 @@ if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
     DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
 
     receive_getc = smtp_getc;
+    receive_get_cache = smtp_get_cache;
     receive_ungetc = smtp_ungetc;
     receive_feof = smtp_feof;
     receive_ferror = smtp_ferror;
@@ -2247,6 +2424,16 @@ if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
 }
 
+void
+tls_get_cache()
+{
+#ifndef DISABLE_DKIM
+int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
+if (n > 0)
+  dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
+#endif
+}
+
 
 
 /*************************************************
@@ -2328,27 +2515,28 @@ while (left > 0)
   switch (error)
     {
     case SSL_ERROR_SSL:
-    ERR_error_string(ERR_get_error(), ssl_errstring);
-    log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
-    return -1;
+      ERR_error_string(ERR_get_error(), ssl_errstring);
+      log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
+      return -1;
 
     case SSL_ERROR_NONE:
-    left -= outbytes;
-    buff += outbytes;
-    break;
+      left -= outbytes;
+      buff += outbytes;
+      break;
 
     case SSL_ERROR_ZERO_RETURN:
-    log_write(0, LOG_MAIN, "SSL channel closed on write");
-    return -1;
+      log_write(0, LOG_MAIN, "SSL channel closed on write");
+      return -1;
 
     case SSL_ERROR_SYSCALL:
-    log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
-      sender_fullhost ? sender_fullhost : US"<unknown>",
-      strerror(errno));
+      log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
+	sender_fullhost ? sender_fullhost : US"<unknown>",
+	strerror(errno));
+      return -1;
 
     default:
-    log_write(0, LOG_MAIN, "SSL_write error %d", error);
-    return -1;
+      log_write(0, LOG_MAIN, "SSL_write error %d", error);
+      return -1;
     }
   }
 return len;
@@ -2559,8 +2747,13 @@ i = (i + 7) / 8;
 if (i < needed_len)
   needed_len = i;
 
+#ifdef EXIM_HAVE_RAND_PSEUDO
 /* We do not care if crypto-strong */
 i = RAND_pseudo_bytes(smallbuf, needed_len);
+#else
+i = RAND_bytes(smallbuf, needed_len);
+#endif
+
 if (i < 0)
   {
   DEBUG(D_all)
@@ -2780,6 +2973,7 @@ for (s=option_spec; *s != '\0'; /**/)
   keep_c = *end;
   *end = '\0';
   item_parsed = tls_openssl_one_option_parse(s, &item);
+  *end = keep_c;
   if (!item_parsed)
     {
     DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
@@ -2791,7 +2985,6 @@ for (s=option_spec; *s != '\0'; /**/)
     result |= item;
   else
     result &= ~item;
-  *end = keep_c;
   s = end;
   }
 
diff --git a/src/src/tls.c b/src/src/tls.c
index 5958dfc1c..55295108c 100644
--- a/src/src/tls.c
+++ b/src/src/tls.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* This module provides TLS (aka SSL) support for Exim. The code for OpenSSL is
@@ -84,26 +84,23 @@ return TRUE;
 *        Timezone environment flipping           *
 *************************************************/
 
-#ifdef MISSING_UNSETENV_3
-# include "setenv.c"
-#endif
-
 static uschar *
 to_tz(uschar * tz)
 {
-  uschar * old = US getenv("TZ");
-  (void) setenv("TZ", CCS tz, 1);
-  tzset(); 
-  return old;
+uschar * old = US getenv("TZ");
+(void) setenv("TZ", CCS tz, 1);
+tzset();
+return old;
 }
+
 static void
 restore_tz(uschar * tz)
 {
-  if (tz)
-    (void) setenv("TZ", CCS tz, 1);
-  else
-    (void) unsetenv("TZ");
-  tzset(); 
+if (tz)
+  (void) setenv("TZ", CCS tz, 1);
+else
+  (void) os_unsetenv(US"TZ");
+tzset();
 }
 
 /*************************************************
diff --git a/src/src/tlscert-gnu.c b/src/src/tlscert-gnu.c
index 80b6fb142..296398ae9 100644
--- a/src/src/tlscert-gnu.c
+++ b/src/src/tlscert-gnu.c
@@ -142,12 +142,12 @@ uschar * cp = NULL;
 int ret;
 size_t siz = 0;
 
-if ((ret = gnutls_x509_crt_get_issuer_dn(cert, cp, &siz))
+if ((ret = gnutls_x509_crt_get_issuer_dn(cert, CS cp, &siz))
     != GNUTLS_E_SHORT_MEMORY_BUFFER)
   return g_err("gi0", __FUNCTION__, ret);
 
 cp = store_get(siz);
-if ((ret = gnutls_x509_crt_get_issuer_dn(cert, cp, &siz)) < 0)
+if ((ret = gnutls_x509_crt_get_issuer_dn(cert, CS cp, &siz)) < 0)
   return g_err("gi1", __FUNCTION__, ret);
 
 return mod ? tls_field_from_dn(cp, mod) : cp;
@@ -183,7 +183,7 @@ if ((ret = gnutls_x509_crt_get_serial((gnutls_x509_crt_t)cert,
   return g_err("gs0", __FUNCTION__, ret);
 
 for(dp = txt, sp = bin; sz; dp += 2, sp++, sz--)
-  sprintf(dp, "%.2x", *sp);
+  sprintf(CS dp, "%.2x", *sp);
 for(sp = txt; sp[0]=='0' && sp[1]; ) sp++;	/* leading zeroes */
 return string_copy(sp);
 }
@@ -197,16 +197,16 @@ uschar * cp3;
 size_t len = 0;
 int ret;
 
-if ((ret = gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, cp1, &len))
+if ((ret = gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, CS cp1, &len))
     != GNUTLS_E_SHORT_MEMORY_BUFFER)
   return g_err("gs0", __FUNCTION__, ret);
 
 cp1 = store_get(len*4+1);
-if (gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, cp1, &len) != 0)
+if (gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, CS cp1, &len) != 0)
   return g_err("gs1", __FUNCTION__, ret);
 
 for(cp3 = cp2 = cp1+len; cp1 < cp2; cp3 += 3, cp1++)
-  sprintf(cp3, "%.2x ", *cp1);
+  sprintf(CS cp3, "%.2x ", *cp1);
 cp3[-1]= '\0';
 
 return cp2;
@@ -217,7 +217,7 @@ tls_cert_signature_algorithm(void * cert, uschar * mod)
 {
 gnutls_sign_algorithm_t algo =
   gnutls_x509_crt_get_signature_algorithm((gnutls_x509_crt_t)cert);
-return algo < 0 ? NULL : string_copy(gnutls_sign_get_name(algo));
+return algo < 0 ? NULL : string_copy(US gnutls_sign_get_name(algo));
 }
 
 uschar *
@@ -227,12 +227,12 @@ uschar * cp = NULL;
 int ret;
 size_t siz = 0;
 
-if ((ret = gnutls_x509_crt_get_dn(cert, cp, &siz))
+if ((ret = gnutls_x509_crt_get_dn(cert, CS cp, &siz))
     != GNUTLS_E_SHORT_MEMORY_BUFFER)
   return g_err("gs0", __FUNCTION__, ret);
 
 cp = store_get(siz);
-if ((ret = gnutls_x509_crt_get_dn(cert, cp, &siz)) < 0)
+if ((ret = gnutls_x509_crt_get_dn(cert, CS cp, &siz)) < 0)
   return g_err("gs1", __FUNCTION__, ret);
 
 return mod ? tls_field_from_dn(cp, mod) : cp;
@@ -255,14 +255,14 @@ unsigned int crit;
 int ret;
 
 ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
-  oid, idx, cp1, &siz, &crit);
+  oid, idx, CS cp1, &siz, &crit);
 if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
   return g_err("ge0", __FUNCTION__, ret);
 
 cp1 = store_get(siz*4 + 1);
 
 ret = gnutls_x509_crt_get_extension_by_oid ((gnutls_x509_crt_t)cert,
-  oid, idx, cp1, &siz, &crit);
+  oid, idx, CS cp1, &siz, &crit);
 if (ret < 0)
   return g_err("ge1", __FUNCTION__, ret);
 
@@ -270,7 +270,7 @@ if (ret < 0)
 
 /* just dump for now */
 for(cp3 = cp2 = cp1+siz; cp1 < cp2; cp3 += 3, cp1++)
-  sprintf(cp3, "%.2x ", *cp1);
+  sprintf(CS cp3, "%.2x ", *cp1);
 cp3[-1]= '\0';
 
 return cp2;
@@ -458,7 +458,7 @@ if ((ret = gnutls_x509_crt_get_fingerprint(cert, algo, cp, &siz)) < 0)
   return g_err("gf1", __FUNCTION__, ret);
 
 for (cp3 = cp2 = cp+siz; cp < cp2; cp++, cp3+=2)
-  sprintf(cp3, "%02X",*cp);
+  sprintf(CS cp3, "%02X",*cp);
 return cp2;
 }
 
diff --git a/src/src/tlscert-openssl.c b/src/src/tlscert-openssl.c
index 4d45ad9f9..690f95081 100644
--- a/src/src/tlscert-openssl.c
+++ b/src/src/tlscert-openssl.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Jeremy Harris 2014 - 2015 */
+/* Copyright (c) Jeremy Harris 2014 - 2016 */
 
 /* This module provides TLS (aka SSL) support for Exim using the OpenSSL
 library. It is #included into the tls.c file when that library is used.
@@ -17,6 +17,10 @@ library. It is #included into the tls.c file when that library is used.
 #include <openssl/rand.h>
 #include <openssl/x509v3.h>
 
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+# define EXIM_HAVE_ASN1_MACROS
+#endif
+
 
 /*****************************************************
 *  Export/import a certificate, binary/printable
@@ -119,7 +123,7 @@ int len;
 if (!bp)
   return badalloc();
 len = ASN1_TIME_print(bp, asntime);
-len = len > 0 ? (int) BIO_get_mem_data(bp, &s) : 0;
+len = len > 0 ? (int) BIO_get_mem_data(bp, CSS &s) : 0;
 
 if (mod && Ustrcmp(mod, "raw") == 0)		/* native ASN */
   s = string_copyn(s, len);
@@ -137,7 +141,7 @@ else
   /*XXX %Z might be glibc-specific?  Solaris has it, at least*/
   /*XXX should we switch to POSIX locale for this? */
   tm.tm_isdst = 0;
-  if (!strptime(CCS s, "%b %e %T %Y %Z", &tm))
+  if (!len || !strptime(CCS s, "%b %e %T %Y %Z", &tm))
     expand_string_message = US"failed time conversion";
 
   else
@@ -314,9 +318,13 @@ uschar * cp3;
 
 if (!bp) return badalloc();
 
+#ifdef EXIM_HAVE_ASN1_MACROS
+ASN1_STRING_print(bp, adata);
+#else
 M_ASN1_OCTET_STRING_print(bp, adata);
-/* binary data, DER encoded */
+#endif
 
+/* binary data, DER encoded */
 /* just dump for now */
 len = BIO_get_mem_data(bp, &cp1);
 cp3 = cp2 = store_get(len*3+1);
diff --git a/src/src/transport.c b/src/src/transport.c
index 13f3c07fc..8381913fc 100644
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* General functions concerned with transportation, and generic options for all
@@ -108,10 +108,23 @@ optionlist optionlist_transports[] = {
                  (void *)offsetof(transport_instance, uid) }
 };
 
-int optionlist_transports_size =
-  sizeof(optionlist_transports)/sizeof(optionlist);
+int optionlist_transports_size = nelem(optionlist_transports);
 
 
+void
+readconf_options_transports(void)
+{
+struct transport_info * ti;
+
+readconf_options_from_list(optionlist_transports, nelem(optionlist_transports), US"TP");
+
+for (ti = transports_available; ti->driver_name[0]; ti++)
+  {
+  macro_create(string_sprintf("_DRVR_TPT_%T", ti->driver_name), US"y", FALSE, TRUE);
+  readconf_options_from_list(ti->options, (unsigned)*ti->options_count, ti->driver_name);
+  }
+} 
+
 /*************************************************
 *             Initialize transport list           *
 *************************************************/
@@ -139,14 +152,11 @@ readconf_driver_init(US"transport",
 /* Now scan the configured transports and check inconsistencies. A shadow
 transport is permitted only for local transports. */
 
-for (t = transports; t != NULL; t = t->next)
+for (t = transports; t; t = t->next)
   {
-  if (!t->info->local)
-    {
-    if (t->shadow != NULL)
-      log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
-        "shadow transport not allowed on non-local transport %s", t->name);
-    }
+  if (!t->info->local && t->shadow)
+    log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
+      "shadow transport not allowed on non-local transport %s", t->name);
 
   if (t->body_only && t->headers_only)
     log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
@@ -236,10 +246,12 @@ for (i = 0; i < 100; i++)
   else
     {
     alarm(local_timeout);
-    #ifdef SUPPORT_TLS
-    if (tls_out.active == fd) rc = tls_write(FALSE, block, len); else
-    #endif
-    rc = write(fd, block, len);
+#ifdef SUPPORT_TLS
+    if (tls_out.active == fd)
+      rc = tls_write(FALSE, block, len);
+    else
+#endif
+      rc = write(fd, block, len);
     save_errno = errno;
     local_timeout = alarm(0);
     if (sigalrm_seen)
@@ -357,7 +369,7 @@ Arguments:
   fd         file descript to write to
   chunk      pointer to data to write
   len        length of data to write
-  usr_crlf   TRUE if CR LF is wanted at the end of each line
+  tctx       transport context - processing to be done during output
 
 In addition, the static nl_xxx variables must be set as required.
 
@@ -365,11 +377,11 @@ Returns:     TRUE on success, FALSE on failure (with errno preserved)
 */
 
 static BOOL
-write_chunk(int fd, uschar *chunk, int len, BOOL use_crlf)
+write_chunk(int fd, transport_ctx * tctx, uschar *chunk, int len)
 {
 uschar *start = chunk;
 uschar *end = chunk + len;
-register uschar *ptr;
+uschar *ptr;
 int mlen = DELIVER_OUT_BUFFER_SIZE - nl_escape_length - 2;
 
 /* The assumption is made that the check string will never stretch over move
@@ -408,17 +420,30 @@ possible. */
 
 for (ptr = start; ptr < end; ptr++)
   {
-  register int ch;
+  int ch, len;
 
   /* Flush the buffer if it has reached the threshold - we want to leave enough
   room for the next uschar, plus a possible extra CR for an LF, plus the escape
   string. */
 
-  if (chunk_ptr - deliver_out_buffer > mlen)
+  if ((len = chunk_ptr - deliver_out_buffer) > mlen)
     {
-    if (!transport_write_block(fd, deliver_out_buffer,
-          chunk_ptr - deliver_out_buffer))
-      return FALSE;
+    DEBUG(D_transport) debug_printf("flushing headers buffer\n");
+
+    /* If CHUNKING, prefix with BDAT (size) NON-LAST.  Also, reap responses
+    from previous SMTP commands. */
+
+    if (tctx &&  tctx->options & topt_use_bdat  &&  tctx->chunk_cb)
+      {
+      if (  tctx->chunk_cb(fd, tctx, (unsigned)len, 0) != OK
+	 || !transport_write_block(fd, deliver_out_buffer, len)
+	 || tctx->chunk_cb(fd, tctx, 0, tc_reap_prev) != OK
+	 )
+	return FALSE;
+      }
+    else
+      if (!transport_write_block(fd, deliver_out_buffer, len))
+	return FALSE;
     chunk_ptr = deliver_out_buffer;
     }
 
@@ -428,7 +453,7 @@ for (ptr = start; ptr < end; ptr++)
 
     /* Insert CR before NL if required */
 
-    if (use_crlf) *chunk_ptr++ = '\r';
+    if (tctx  &&  tctx->options & topt_use_crlf) *chunk_ptr++ = '\r';
     *chunk_ptr++ = '\n';
     transport_newlines++;
 
@@ -545,14 +570,14 @@ Arguments:
   pdlist    address of anchor of the list of processed addresses
   first     TRUE if this is the first address; set it FALSE afterwards
   fd        the file descriptor to write to
-  use_crlf  to be passed on to write_chunk()
+  tctx      transport context - processing to be done during output
 
 Returns:    FALSE if writing failed
 */
 
 static BOOL
 write_env_to(address_item *p, struct aci **pplist, struct aci **pdlist,
-  BOOL *first, int fd, BOOL use_crlf)
+  BOOL *first, int fd, transport_ctx * tctx)
 {
 address_item *pp;
 struct aci *ppp;
@@ -560,8 +585,7 @@ struct aci *ppp;
 /* Do nothing if we have already handled this address. If not, remember it
 so that we don't handle it again. */
 
-for (ppp = *pdlist; ppp != NULL; ppp = ppp->next)
-  { if (p == ppp->ptr) return TRUE; }
+for (ppp = *pdlist; ppp; ppp = ppp->next) if (p == ppp->ptr) return TRUE;
 
 ppp = store_get(sizeof(struct aci));
 ppp->next = *pdlist;
@@ -573,19 +597,17 @@ ppp->ptr = p;
 for (pp = p;; pp = pp->parent)
   {
   address_item *dup;
-  for (dup = addr_duplicate; dup != NULL; dup = dup->next)
-    {
-    if (dup->dupof != pp) continue;   /* Not a dup of our address */
-    if (!write_env_to(dup, pplist, pdlist, first, fd, use_crlf)) return FALSE;
-    }
-  if (pp->parent == NULL) break;
+  for (dup = addr_duplicate; dup; dup = dup->next)
+    if (dup->dupof == pp)   /* a dup of our address */
+      if (!write_env_to(dup, pplist, pdlist, first, fd, tctx))
+	return FALSE;
+  if (!pp->parent) break;
   }
 
 /* Check to see if we have already output the progenitor. */
 
-for (ppp = *pplist; ppp != NULL; ppp = ppp->next)
-  { if (pp == ppp->ptr) break; }
-if (ppp != NULL) return TRUE;
+for (ppp = *pplist; ppp; ppp = ppp->next) if (pp == ppp->ptr) break;
+if (ppp) return TRUE;
 
 /* Remember what we have output, and output it. */
 
@@ -594,9 +616,9 @@ ppp->next = *pplist;
 *pplist = ppp;
 ppp->ptr = pp;
 
-if (!(*first) && !write_chunk(fd, US",\n ", 3, use_crlf)) return FALSE;
+if (!*first && !write_chunk(fd, tctx, US",\n ", 3)) return FALSE;
 *first = FALSE;
-return write_chunk(fd, pp->address, Ustrlen(pp->address), use_crlf);
+return write_chunk(fd, tctx, pp->address, Ustrlen(pp->address));
 }
 
 
@@ -611,19 +633,19 @@ Arguments:
   addr                  (chain of) addresses (for extra headers), or NULL;
                           only the first address is used
   fd                    file descriptor to write the message to
-  sendfn		function for output
-  use_crlf		turn NL into CR LF
-  rewrite_rules         chain of header rewriting rules
-  rewrite_existflags    flags for the rewriting rules
+  tctx                  transport context
+  sendfn		function for output (transport or verify)
 
 Returns:                TRUE on success; FALSE on failure.
 */
 BOOL
-transport_headers_send(address_item *addr, int fd, uschar *add_headers, uschar *remove_headers,
-  BOOL (*sendfn)(int fd, uschar * s, int len, BOOL use_crlf),
-  BOOL use_crlf, rewrite_rule *rewrite_rules, int rewrite_existflags)
+transport_headers_send(int fd, transport_ctx * tctx,
+  BOOL (*sendfn)(int fd, transport_ctx * tctx, uschar * s, int len))
 {
 header_line *h;
+const uschar *list;
+transport_instance * tblock = tctx ? tctx->tblock : NULL;
+address_item * addr = tctx ? tctx->addr : NULL;
 
 /* Then the message's headers. Don't write any that are flagged as "old";
 that means they were rewritten, or are a record of envelope rewriting, or
@@ -632,13 +654,12 @@ match any entries therein.  It is a colon-sep list; expand the items
 separately and squash any empty ones.
 Then check addr->prop.remove_headers too, provided that addr is not NULL. */
 
-for (h = header_list; h != NULL; h = h->next) if (h->type != htype_old)
+for (h = header_list; h; h = h->next) if (h->type != htype_old)
   {
   int i;
-  const uschar *list = remove_headers;
-
   BOOL include_header = TRUE;
 
+  list = tblock ? tblock->remove_headers : NULL;
   for (i = 0; i < 2; i++)    /* For remove_headers && addr->prop.remove_headers */
     {
     if (list)
@@ -655,15 +676,15 @@ for (h = header_list; h != NULL; h = h->next) if (h->type != htype_old)
 	    errno = ERRNO_CHHEADER_FAIL;
 	    return FALSE;
 	    }
-	len = Ustrlen(s);
+	len = s ? Ustrlen(s) : 0;
 	if (strncmpic(h->text, s, len) != 0) continue;
 	ss = h->text + len;
 	while (*ss == ' ' || *ss == '\t') ss++;
 	if (*ss == ':') break;
 	}
-      if (s != NULL) { include_header = FALSE; break; }
+      if (s) { include_header = FALSE; break; }
       }
-    if (addr != NULL) list = addr->prop.remove_headers;
+    if (addr) list = addr->prop.remove_headers;
     }
 
   /* If this header is to be output, try to rewrite it if there are rewriting
@@ -671,14 +692,15 @@ for (h = header_list; h != NULL; h = h->next) if (h->type != htype_old)
 
   if (include_header)
     {
-    if (rewrite_rules)
+    if (tblock && tblock->rewrite_rules)
       {
       void *reset_point = store_get(0);
       header_line *hh;
 
-      if ((hh = rewrite_header(h, NULL, NULL, rewrite_rules, rewrite_existflags, FALSE)))
+      if ((hh = rewrite_header(h, NULL, NULL, tblock->rewrite_rules,
+		  tblock->rewrite_existflags, FALSE)))
 	{
-	if (!sendfn(fd, hh->text, hh->slen, use_crlf)) return FALSE;
+	if (!sendfn(fd, tctx, hh->text, hh->slen)) return FALSE;
 	store_reset(reset_point);
 	continue;     /* With the next header line */
 	}
@@ -686,7 +708,7 @@ for (h = header_list; h != NULL; h = h->next) if (h->type != htype_old)
 
     /* Either no rewriting rules, or it didn't get rewritten */
 
-    if (!sendfn(fd, h->text, h->slen, use_crlf)) return FALSE;
+    if (!sendfn(fd, tctx, h->text, h->slen)) return FALSE;
     }
 
   /* Header removed */
@@ -714,20 +736,18 @@ if (addr)
   header_line *hprev = addr->prop.extra_headers;
   header_line *hnext;
   for (i = 0; i < 2; i++)
-    {
-    for (h = hprev, hprev = NULL; h != NULL; h = hnext)
+    for (h = hprev, hprev = NULL; h; h = hnext)
       {
       hnext = h->next;
       h->next = hprev;
       hprev = h;
       if (i == 1)
 	{
-	if (!sendfn(fd, h->text, h->slen, use_crlf)) return FALSE;
+	if (!sendfn(fd, tctx, h->text, h->slen)) return FALSE;
 	DEBUG(D_transport)
 	  debug_printf("added header line(s):\n%s---\n", h->text);
 	}
       }
-    }
   }
 
 /* If a string containing additional headers exists it is a newline-sep
@@ -737,24 +757,19 @@ up any other headers. An empty string or a forced expansion failure are
 noops. An added header string from a transport may not end with a newline;
 add one if it does not. */
 
-if (add_headers)
+if (tblock && (list = CUS tblock->add_headers))
   {
   int sep = '\n';
   uschar * s;
 
-  while ((s = string_nextinlist(CUSS &add_headers, &sep, NULL, 0)))
-    if (!(s = expand_string(s)))
-      {
-      if (!expand_string_forcedfail)
-	{ errno = ERRNO_CHHEADER_FAIL; return FALSE; }
-      }
-    else
+  while ((s = string_nextinlist(&list, &sep, NULL, 0)))
+    if ((s = expand_string(s)))
       {
       int len = Ustrlen(s);
       if (len > 0)
 	{
-	if (!sendfn(fd, s, len, use_crlf)) return FALSE;
-	if (s[len-1] != '\n' && !sendfn(fd, US"\n", 1, use_crlf))
+	if (!sendfn(fd, tctx, s, len)) return FALSE;
+	if (s[len-1] != '\n' && !sendfn(fd, tctx, US"\n", 1))
 	  return FALSE;
 	DEBUG(D_transport)
 	  {
@@ -764,11 +779,13 @@ if (add_headers)
 	  }
 	}
       }
+    else if (!expand_string_forcedfail)
+      { errno = ERRNO_CHHEADER_FAIL; return FALSE; }
   }
 
 /* Separate headers from body with a blank line */
 
-return sendfn(fd, US"\n", 1, use_crlf);
+return sendfn(fd, tctx, US"\n", 1);
 }
 
 
@@ -801,30 +818,32 @@ can include timeouts for certain transports, which are requested by setting
 transport_write_timeout non-zero.
 
 Arguments:
-  addr                  (chain of) addresses (for extra headers), or NULL;
-                          only the first address is used
   fd                    file descriptor to write the message to
-  options               bit-wise options:
-    add_return_path       if TRUE, add a "return-path" header
-    add_envelope_to       if TRUE, add a "envelope-to" header
-    add_delivery_date     if TRUE, add a "delivery-date" header
-    use_crlf              if TRUE, turn NL into CR LF
-    end_dot               if TRUE, send a terminating "." line at the end
-    no_headers            if TRUE, omit the headers
-    no_body               if TRUE, omit the body
-  size_limit            if > 0, this is a limit to the size of message written;
-                          it is used when returning messages to their senders,
-                          and is approximate rather than exact, owing to chunk
-                          buffering
-  add_headers           a string containing one or more headers to add; it is
-                          expanded, and must be in correct RFC 822 format as
-                          it is transmitted verbatim; NULL => no additions,
-                          and so does empty string or forced expansion fail
-  remove_headers        a colon-separated list of headers to remove, or NULL
-  check_string          a string to check for at the start of lines, or NULL
-  escape_string         a string to insert in front of any check string
-  rewrite_rules         chain of header rewriting rules
-  rewrite_existflags    flags for the rewriting rules
+  tctx
+    addr                (chain of) addresses (for extra headers), or NULL;
+                          only the first address is used
+    tblock          	optional transport instance block (NULL signifies NULL/0):
+      add_headers           a string containing one or more headers to add; it is
+                            expanded, and must be in correct RFC 822 format as
+                            it is transmitted verbatim; NULL => no additions,
+                            and so does empty string or forced expansion fail
+      remove_headers        a colon-separated list of headers to remove, or NULL
+      rewrite_rules         chain of header rewriting rules
+      rewrite_existflags    flags for the rewriting rules
+    options               bit-wise options:
+      add_return_path       if TRUE, add a "return-path" header
+      add_envelope_to       if TRUE, add a "envelope-to" header
+      add_delivery_date     if TRUE, add a "delivery-date" header
+      use_crlf              if TRUE, turn NL into CR LF
+      end_dot               if TRUE, send a terminating "." line at the end
+      no_headers            if TRUE, omit the headers
+      no_body               if TRUE, omit the body
+    check_string          a string to check for at the start of lines, or NULL
+    escape_string         a string to insert in front of any check string
+  size_limit              if > 0, this is a limit to the size of message written;
+                            it is used when returning messages to their senders,
+                            and is approximate rather than exact, owing to chunk
+                            buffering
 
 Returns:                TRUE on success; FALSE (with errno) on failure.
                         In addition, the global variable transport_count
@@ -832,13 +851,9 @@ Returns:                TRUE on success; FALSE (with errno) on failure.
 */
 
 static BOOL
-internal_transport_write_message(address_item *addr, int fd, int options,
-  int size_limit, uschar *add_headers, uschar *remove_headers, uschar *check_string,
-  uschar *escape_string, rewrite_rule *rewrite_rules, int rewrite_existflags)
+internal_transport_write_message(int fd, transport_ctx * tctx, int size_limit)
 {
-int written = 0;
 int len;
-BOOL use_crlf  = (options & topt_use_crlf)  != 0;
 
 /* Initialize pointer in output buffer. */
 
@@ -847,39 +862,41 @@ chunk_ptr = deliver_out_buffer;
 /* Set up the data for start-of-line data checking and escaping */
 
 nl_partial_match = -1;
-if (check_string != NULL && escape_string != NULL)
+if (tctx->check_string && tctx->escape_string)
   {
-  nl_check = check_string;
+  nl_check = tctx->check_string;
   nl_check_length = Ustrlen(nl_check);
-  nl_escape = escape_string;
+  nl_escape = tctx->escape_string;
   nl_escape_length = Ustrlen(nl_escape);
   }
-else nl_check_length = nl_escape_length = 0;
+else
+  nl_check_length = nl_escape_length = 0;
 
 /* Whether the escaping mechanism is applied to headers or not is controlled by
 an option (set for SMTP, not otherwise). Negate the length if not wanted till
 after the headers. */
 
-if ((options & topt_escape_headers) == 0) nl_check_length = -nl_check_length;
+if (!(tctx->options & topt_escape_headers))
+  nl_check_length = -nl_check_length;
 
 /* Write the headers if required, including any that have to be added. If there
 are header rewriting rules, apply them. */
 
-if ((options & topt_no_headers) == 0)
+if (!(tctx->options & topt_no_headers))
   {
   /* Add return-path: if requested. */
 
-  if ((options & topt_add_return_path) != 0)
+  if (tctx->options & topt_add_return_path)
     {
     uschar buffer[ADDRESS_MAXLENGTH + 20];
-    sprintf(CS buffer, "Return-path: <%.*s>\n", ADDRESS_MAXLENGTH,
+    int n = sprintf(CS buffer, "Return-path: <%.*s>\n", ADDRESS_MAXLENGTH,
       return_path);
-    if (!write_chunk(fd, buffer, Ustrlen(buffer), use_crlf)) return FALSE;
+    if (!write_chunk(fd, tctx, buffer, n)) return FALSE;
     }
 
   /* Add envelope-to: if requested */
 
-  if ((options & topt_add_envelope_to) != 0)
+  if (tctx->options & topt_add_envelope_to)
     {
     BOOL first = TRUE;
     address_item *p;
@@ -887,30 +904,29 @@ if ((options & topt_no_headers) == 0)
     struct aci *dlist = NULL;
     void *reset_point = store_get(0);
 
-    if (!write_chunk(fd, US"Envelope-to: ", 13, use_crlf)) return FALSE;
+    if (!write_chunk(fd, tctx, US"Envelope-to: ", 13)) return FALSE;
 
     /* Pick up from all the addresses. The plist and dlist variables are
     anchors for lists of addresses already handled; they have to be defined at
     this level becuase write_env_to() calls itself recursively. */
 
-    for (p = addr; p != NULL; p = p->next)
-      {
-      if (!write_env_to(p, &plist, &dlist, &first, fd, use_crlf)) return FALSE;
-      }
+    for (p = tctx->addr; p; p = p->next)
+      if (!write_env_to(p, &plist, &dlist, &first, fd, tctx))
+	return FALSE;
 
     /* Add a final newline and reset the store used for tracking duplicates */
 
-    if (!write_chunk(fd, US"\n", 1, use_crlf)) return FALSE;
+    if (!write_chunk(fd, tctx, US"\n", 1)) return FALSE;
     store_reset(reset_point);
     }
 
   /* Add delivery-date: if requested. */
 
-  if ((options & topt_add_delivery_date) != 0)
+  if (tctx->options & topt_add_delivery_date)
     {
     uschar buffer[100];
-    sprintf(CS buffer, "Delivery-date: %s\n", tod_stamp(tod_full));
-    if (!write_chunk(fd, buffer, Ustrlen(buffer), use_crlf)) return FALSE;
+    int n = sprintf(CS buffer, "Delivery-date: %s\n", tod_stamp(tod_full));
+    if (!write_chunk(fd, tctx, buffer, n)) return FALSE;
     }
 
   /* Then the message's headers. Don't write any that are flagged as "old";
@@ -918,35 +934,88 @@ if ((options & topt_no_headers) == 0)
   were removed (e.g. Bcc). If remove_headers is not null, skip any headers that
   match any entries therein. Then check addr->prop.remove_headers too, provided that
   addr is not NULL. */
-  if (!transport_headers_send(addr, fd, add_headers, remove_headers, &write_chunk,
-	use_crlf, rewrite_rules, rewrite_existflags))
+
+  if (!transport_headers_send(fd, tctx, &write_chunk))
     return FALSE;
   }
 
+/* When doing RFC3030 CHUNKING output, work out how much data would be in a
+last-BDAT, consisting of the current write_chunk() output buffer fill
+(optimally, all of the headers - but it does not matter if we already had to
+flush that buffer with non-last BDAT prependix) plus the amount of body data
+(as expanded for CRLF lines).  Then create and write BDAT(s), and ensure
+that further use of write_chunk() will not prepend BDATs.
+The first BDAT written will also first flush any outstanding MAIL and RCPT
+commands which were buffered thans to PIPELINING.
+Commands go out (using a send()) from a different buffer to data (using a
+write()).  They might not end up in the same TCP segment, which is
+suboptimal. */
+
+if (tctx->options & topt_use_bdat)
+  {
+  off_t fsize;
+  int hsize, size = 0;
+
+  if ((hsize = chunk_ptr - deliver_out_buffer) < 0)
+    hsize = 0;
+  if (!(tctx->options & topt_no_body))
+    {
+    if ((fsize = lseek(deliver_datafile, 0, SEEK_END)) < 0) return FALSE;
+    fsize -= SPOOL_DATA_START_OFFSET;
+    if (size_limit > 0  &&  fsize > size_limit)
+      fsize = size_limit;
+    size = hsize + fsize;
+    if (tctx->options & topt_use_crlf)
+      size += body_linecount;	/* account for CRLF-expansion */
+    }
+
+  /* If the message is large, emit first a non-LAST chunk with just the
+  headers, and reap the command responses.  This lets us error out early
+  on RCPT rejects rather than sending megabytes of data.  Include headers
+  on the assumption they are cheap enough and some clever implementations
+  might errorcheck them too, on-the-fly, and reject that chunk. */
+
+  if (size > DELIVER_OUT_BUFFER_SIZE && hsize > 0)
+    {
+    DEBUG(D_transport)
+      debug_printf("sending small initial BDAT; hssize=%d\n", hsize);
+    if (  tctx->chunk_cb(fd, tctx, hsize, 0) != OK
+       || !transport_write_block(fd, deliver_out_buffer, hsize)
+       || tctx->chunk_cb(fd, tctx, 0, tc_reap_prev) != OK
+       )
+      return FALSE;
+    chunk_ptr = deliver_out_buffer;
+    size -= hsize;
+    }
+
+  /* Emit a LAST datachunk command. */
+
+  if (tctx->chunk_cb(fd, tctx, size, tc_chunk_last) != OK)
+    return FALSE;
+
+  tctx->options &= ~topt_use_bdat;
+  }
+
 /* If the body is required, ensure that the data for check strings (formerly
 the "from hack") is enabled by negating the length if necessary. (It will be
 negative in cases where it isn't to apply to the headers). Then ensure the body
 is positioned at the start of its file (following the message id), then write
 it, applying the size limit if required. */
 
-if ((options & topt_no_body) == 0)
+if (!(tctx->options & topt_no_body))
   {
+  int size = size_limit;
+
   nl_check_length = abs(nl_check_length);
   nl_partial_match = 0;
-  lseek(deliver_datafile, SPOOL_DATA_START_OFFSET, SEEK_SET);
-  while ((len = read(deliver_datafile, deliver_in_buffer,
-           DELIVER_IN_BUFFER_SIZE)) > 0)
+  if (lseek(deliver_datafile, SPOOL_DATA_START_OFFSET, SEEK_SET) < 0)
+    return FALSE;
+  while (  (len = MAX(DELIVER_IN_BUFFER_SIZE, size)) > 0
+	&& (len = read(deliver_datafile, deliver_in_buffer, len)) > 0)
     {
-    if (!write_chunk(fd, deliver_in_buffer, len, use_crlf)) return FALSE;
-    if (size_limit > 0)
-      {
-      written += len;
-      if (written > size_limit)
-        {
-        len = 0;    /* Pretend EOF */
-        break;
-        }
-      }
+    if (!write_chunk(fd, tctx, deliver_in_buffer, len))
+      return FALSE;
+    size -= len;
     }
 
   /* A read error on the body will have left len == -1 and errno set. */
@@ -960,7 +1029,7 @@ nl_check_length = nl_escape_length = 0;
 
 /* If requested, add a terminating "." line (SMTP output). */
 
-if ((options & topt_end_dot) != 0 && !write_chunk(fd, US".\n", 2, use_crlf))
+if (tctx->options & topt_end_dot && !write_chunk(fd, tctx, US".\n", 2))
   return FALSE;
 
 /* Write out any remaining data in the buffer before returning. */
@@ -985,49 +1054,34 @@ return (len = chunk_ptr - deliver_out_buffer) <= 0 ||
    signing the file, send the signed message down the original fd (or TLS fd).
 
 Arguments:
-  as for internal_transport_write_message() above, with additional arguments:
-   uschar *dkim_private_key  DKIM: The private key to use (filename or
-				    plain data)
-   uschar *dkim_domain       DKIM: The domain to use
-   uschar *dkim_selector     DKIM: The selector to use.
-   uschar *dkim_canon        DKIM: The canonalization scheme to use,
-				    "simple" or "relaxed"
-   uschar *dkim_strict       DKIM: What to do if signing fails:
-				  1/true  => throw error
-				  0/false => send anyway
-   uschar *dkim_sign_headers DKIM: List of headers that should be included
-				    in signature generation
+  as for internal_transport_write_message() above, with additional arguments
+  for DKIM.
 
 Returns:       TRUE on success; FALSE (with errno) for any failure
 */
 
 BOOL
-dkim_transport_write_message(address_item *addr, int fd, int options,
-  int size_limit, uschar *add_headers, uschar *remove_headers,
-  uschar *check_string, uschar *escape_string, rewrite_rule *rewrite_rules,
-  int rewrite_existflags, uschar *dkim_private_key, uschar *dkim_domain,
-  uschar *dkim_selector, uschar *dkim_canon, uschar *dkim_strict, uschar *dkim_sign_headers
-  )
+dkim_transport_write_message(int out_fd, transport_ctx * tctx,
+  struct ob_dkim * dkim)
 {
 int dkim_fd;
 int save_errno = 0;
 BOOL rc;
-uschar dkim_spool_name[256];
-char sbuf[2048];
+uschar * dkim_spool_name;
 int sread = 0;
 int wwritten = 0;
 uschar *dkim_signature = NULL;
+int siglen = 0;
+off_t k_file_size;
+int options;
 
 /* If we can't sign, just call the original function. */
 
-if (!(dkim_private_key && dkim_domain && dkim_selector))
-  return transport_write_message(addr, fd, options,
-	    size_limit, add_headers, remove_headers,
-	    check_string, escape_string, rewrite_rules,
-	    rewrite_existflags);
+if (!(dkim->dkim_private_key && dkim->dkim_domain && dkim->dkim_selector))
+  return transport_write_message(out_fd, tctx, 0);
 
-(void)string_format(dkim_spool_name, 256, "%s/input/%s/%s-%d-K",
-	spool_directory, message_subdir, message_id, (int)getpid());
+dkim_spool_name = spool_fname(US"input", message_subdir, message_id,
+		    string_sprintf("-%d-K", (int)getpid()));
 
 if ((dkim_fd = Uopen(dkim_spool_name, O_RDWR|O_CREAT|O_TRUNC, SPOOL_MODE)) < 0)
   {
@@ -1037,12 +1091,13 @@ if ((dkim_fd = Uopen(dkim_spool_name, O_RDWR|O_CREAT|O_TRUNC, SPOOL_MODE)) < 0)
   goto CLEANUP;
   }
 
-/* Call original function to write the -K file */
+/* Call original function to write the -K file; does the CRLF expansion
+(but, in the CHUNKING case, not dot-stuffing and dot-termination). */
 
-rc = transport_write_message(addr, dkim_fd, options,
-  size_limit, add_headers, remove_headers,
-  check_string, escape_string, rewrite_rules,
-  rewrite_existflags);
+options = tctx->options;
+tctx->options &= ~topt_use_bdat;
+rc = transport_write_message(dkim_fd, tctx, 0);
+tctx->options = options;
 
 /* Save error state. We must clean up before returning. */
 if (!rc)
@@ -1051,80 +1106,73 @@ if (!rc)
   goto CLEANUP;
   }
 
-if (dkim_private_key && dkim_domain && dkim_selector)
+/* Rewind file and feed it to the goats^W DKIM lib */
+dkim->dot_stuffed = !!(options & topt_end_dot);
+lseek(dkim_fd, 0, SEEK_SET);
+if ((dkim_signature = dkim_exim_sign(dkim_fd, dkim)))
+  siglen = Ustrlen(dkim_signature);
+else if (dkim->dkim_strict)
   {
-  /* Rewind file and feed it to the goats^W DKIM lib */
-  lseek(dkim_fd, 0, SEEK_SET);
-  dkim_signature = dkim_exim_sign(dkim_fd,
-				  dkim_private_key,
-				  dkim_domain,
-				  dkim_selector,
-				  dkim_canon,
-				  dkim_sign_headers);
-  if (!dkim_signature)
-    {
-    if (dkim_strict)
+  uschar *dkim_strict_result = expand_string(dkim->dkim_strict);
+  if (dkim_strict_result)
+    if ( (strcmpic(dkim->dkim_strict,US"1") == 0) ||
+	 (strcmpic(dkim->dkim_strict,US"true") == 0) )
       {
-      uschar *dkim_strict_result = expand_string(dkim_strict);
-      if (dkim_strict_result)
-	if ( (strcmpic(dkim_strict,US"1") == 0) ||
-	     (strcmpic(dkim_strict,US"true") == 0) )
-	  {
-	  /* Set errno to something halfway meaningful */
-	  save_errno = EACCES;
-	  log_write(0, LOG_MAIN, "DKIM: message could not be signed,"
-	    " and dkim_strict is set. Deferring message delivery.");
-	  rc = FALSE;
-	  goto CLEANUP;
-	  }
+      /* Set errno to something halfway meaningful */
+      save_errno = EACCES;
+      log_write(0, LOG_MAIN, "DKIM: message could not be signed,"
+	" and dkim_strict is set. Deferring message delivery.");
+      rc = FALSE;
+      goto CLEANUP;
       }
-    }
-  else
-    {
-    int siglen = Ustrlen(dkim_signature);
-    while(siglen > 0)
-      {
-#ifdef SUPPORT_TLS
-      wwritten = tls_out.active == fd
-	? tls_write(FALSE, dkim_signature, siglen)
-	: write(fd, dkim_signature, siglen);
-#else
-      wwritten = write(fd, dkim_signature, siglen);
+  }
+
+#ifndef HAVE_LINUX_SENDFILE
+if (options & topt_use_bdat)
 #endif
-      if (wwritten == -1)
-        {
-	/* error, bail out */
-	save_errno = errno;
-	rc = FALSE;
-	goto CLEANUP;
-	}
-      siglen -= wwritten;
-      dkim_signature += wwritten;
-      }
+  k_file_size = lseek(dkim_fd, 0, SEEK_END); /* Fetch file size */
+
+if (options & topt_use_bdat)
+  {
+
+  /* On big messages output a precursor chunk to get any pipelined
+  MAIL & RCPT commands flushed, then reap the responses so we can
+  error out on RCPT rejects before sending megabytes. */
+
+  if (siglen + k_file_size > DELIVER_OUT_BUFFER_SIZE && siglen > 0)
+    {
+    if (  tctx->chunk_cb(out_fd, tctx, siglen, 0) != OK
+       || !transport_write_block(out_fd, dkim_signature, siglen)
+       || tctx->chunk_cb(out_fd, tctx, 0, tc_reap_prev) != OK
+       )
+      goto err;
+    siglen = 0;
     }
+
+  if (tctx->chunk_cb(out_fd, tctx, siglen + k_file_size, tc_chunk_last) != OK)
+    goto err;
   }
 
+if(siglen > 0 && !transport_write_block(out_fd, dkim_signature, siglen))
+  goto err;
+
 #ifdef HAVE_LINUX_SENDFILE
 /* We can use sendfile() to shove the file contents
    to the socket. However only if we don't use TLS,
    as then there's another layer of indirection
    before the data finally hits the socket. */
-if (tls_out.active != fd)
+if (tls_out.active != out_fd)
   {
-  off_t size = lseek(dkim_fd, 0, SEEK_END); /* Fetch file size */
   ssize_t copied = 0;
   off_t offset = 0;
 
   /* Rewind file */
   lseek(dkim_fd, 0, SEEK_SET);
 
-  while(copied >= 0 && offset < size)
-    copied = sendfile(fd, dkim_fd, &offset, size - offset);
+  while(copied >= 0 && offset < k_file_size)
+    copied = sendfile(out_fd, dkim_fd, &offset, k_file_size - offset);
   if (copied < 0)
-    {
-    save_errno = errno;
-    rc = FALSE;
-    }
+    goto err;
   }
 else
 
@@ -1135,27 +1183,22 @@ else
   lseek(dkim_fd, 0, SEEK_SET);
 
   /* Send file down the original fd */
-  while((sread = read(dkim_fd, sbuf, 2048)) > 0)
+  while((sread = read(dkim_fd, deliver_out_buffer, DELIVER_OUT_BUFFER_SIZE)) >0)
     {
-    char *p = sbuf;
+    uschar * p = deliver_out_buffer;
     /* write the chunk */
 
     while (sread)
       {
 #ifdef SUPPORT_TLS
-      wwritten = tls_out.active == fd
-	? tls_write(FALSE, US p, sread)
-	: write(fd, p, sread);
+      wwritten = tls_out.active == out_fd
+	? tls_write(FALSE, p, sread)
+	: write(out_fd, CS p, sread);
 #else
-      wwritten = write(fd, p, sread);
+      wwritten = write(out_fd, CS p, sread);
 #endif
       if (wwritten == -1)
-	{
-	/* error, bail out */
-	save_errno = errno;
-	rc = FALSE;
-	goto CLEANUP;
-	}
+	goto err;
       p += wwritten;
       sread -= wwritten;
       }
@@ -1169,11 +1212,16 @@ else
   }
 
 CLEANUP:
-/* unlink -K file */
-(void)close(dkim_fd);
-Uunlink(dkim_spool_name);
-errno = save_errno;
-return rc;
+  /* unlink -K file */
+  (void)close(dkim_fd);
+  Uunlink(dkim_spool_name);
+  errno = save_errno;
+  return rc;
+
+err:
+  save_errno = errno;
+  rc = FALSE;
+  goto CLEANUP;
 }
 
 #endif
@@ -1190,6 +1238,7 @@ set up a filtering process, fork another process to call the internal function
 to write to the filter, and in this process just suck from the filter and write
 down the given fd. At the end, tidy up the pipes and the processes.
 
+XXX
 Arguments:     as for internal_transport_write_message() above
 
 Returns:       TRUE on success; FALSE (with errno) for any failure
@@ -1197,16 +1246,15 @@ Returns:       TRUE on success; FALSE (with errno) for any failure
 */
 
 BOOL
-transport_write_message(address_item *addr, int fd, int options,
-  int size_limit, uschar *add_headers, uschar *remove_headers,
-  uschar *check_string, uschar *escape_string, rewrite_rule *rewrite_rules,
-  int rewrite_existflags)
+transport_write_message(int fd, transport_ctx * tctx, int size_limit)
 {
-BOOL use_crlf;
 BOOL last_filter_was_NL = TRUE;
 int rc, len, yield, fd_read, fd_write, save_errno;
-int pfd[2];
+int pfd[2] = {-1, -1};
 pid_t filter_pid, write_pid;
+static transport_ctx dummy_tctx = {0};
+
+if (!tctx) tctx = &dummy_tctx;
 
 transport_filter_timed_out = FALSE;
 
@@ -1217,22 +1265,19 @@ if (  !transport_filter_argv
    || !*transport_filter_argv
    || !**transport_filter_argv
    )
-  return internal_transport_write_message(addr, fd, options, size_limit,
-    add_headers, remove_headers, check_string, escape_string,
-    rewrite_rules, rewrite_existflags);
+  return internal_transport_write_message(fd, tctx, size_limit);
 
 /* Otherwise the message must be written to a filter process and read back
 before being written to the incoming fd. First set up the special processing to
 be done during the copying. */
 
-use_crlf  = (options & topt_use_crlf) != 0;
 nl_partial_match = -1;
 
-if (check_string != NULL && escape_string != NULL)
+if (tctx->check_string && tctx->escape_string)
   {
-  nl_check = check_string;
+  nl_check = tctx->check_string;
   nl_check_length = Ustrlen(nl_check);
-  nl_escape = escape_string;
+  nl_escape = tctx->escape_string;
   nl_escape_length = Ustrlen(nl_escape);
   }
 else nl_check_length = nl_escape_length = 0;
@@ -1249,14 +1294,17 @@ save_errno = 0;
 yield = FALSE;
 write_pid = (pid_t)(-1);
 
-(void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
-filter_pid = child_open(USS transport_filter_argv, NULL, 077,
- &fd_write, &fd_read, FALSE);
-(void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) & ~FD_CLOEXEC);
+  {
+  int bits = fcntl(fd, F_GETFD);
+  (void)fcntl(fd, F_SETFD, bits | FD_CLOEXEC);
+  filter_pid = child_open(USS transport_filter_argv, NULL, 077,
+   &fd_write, &fd_read, FALSE);
+  (void)fcntl(fd, F_SETFD, bits & ~FD_CLOEXEC);
+  }
 if (filter_pid < 0) goto TIDY_UP;      /* errno set */
 
 DEBUG(D_transport)
-  debug_printf("process %d running as transport filter: write=%d read=%d\n",
+  debug_printf("process %d running as transport filter: fd_write=%d fd_read=%d\n",
     (int)filter_pid, fd_write, fd_read);
 
 /* Fork subprocess to write the message to the filter, and return the result
@@ -1270,16 +1318,18 @@ if ((write_pid = fork()) == 0)
   (void)close(fd_read);
   (void)close(pfd[pipe_read]);
   nl_check_length = nl_escape_length = 0;
-  rc = internal_transport_write_message(addr, fd_write,
-    (options & ~(topt_use_crlf | topt_end_dot)),
-    size_limit, add_headers, remove_headers, NULL, NULL,
-    rewrite_rules, rewrite_existflags);
+
+  tctx->check_string = tctx->escape_string = NULL;
+  tctx->options &= ~(topt_use_crlf | topt_end_dot | topt_use_bdat);
+
+  rc = internal_transport_write_message(fd_write, tctx, size_limit);
+
   save_errno = errno;
   if (  write(pfd[pipe_write], (void *)&rc, sizeof(BOOL))
         != sizeof(BOOL)
      || write(pfd[pipe_write], (void *)&save_errno, sizeof(int))
         != sizeof(int)
-     || write(pfd[pipe_write], (void *)&(addr->more_errno), sizeof(int))
+     || write(pfd[pipe_write], (void *)&tctx->addr->more_errno, sizeof(int))
         != sizeof(int)
      )
     rc = FALSE;	/* compiler quietening */
@@ -1339,7 +1389,7 @@ for (;;)
 
   if (len > 0)
     {
-    if (!write_chunk(fd, deliver_in_buffer, len, use_crlf)) goto TIDY_UP;
+    if (!write_chunk(fd, tctx, deliver_in_buffer, len)) goto TIDY_UP;
     last_filter_was_NL = (deliver_in_buffer[len-1] == '\n');
     }
 
@@ -1376,7 +1426,7 @@ if (filter_pid > 0 && (rc = child_close(filter_pid, 30)) != 0 && yield)
   {
   yield = FALSE;
   save_errno = ERRNO_FILTER_FAIL;
-  addr->more_errno = rc;
+  tctx->addr->more_errno = rc;
   DEBUG(D_transport) debug_printf("filter process returned %d\n", rc);
   }
 
@@ -1389,15 +1439,20 @@ if (write_pid > 0)
   {
   rc = child_close(write_pid, 30);
   if (yield)
-    {
     if (rc == 0)
       {
       BOOL ok;
-      int dummy = read(pfd[pipe_read], (void *)&ok, sizeof(BOOL));
-      if (!ok)
+      if (read(pfd[pipe_read], (void *)&ok, sizeof(BOOL)) != sizeof(BOOL))
+	{
+	DEBUG(D_transport)
+	  debug_printf("pipe read from writing process: %s\n", strerror(errno));
+	save_errno = ERRNO_FILTER_FAIL;
+        yield = FALSE;
+	}
+      else if (!ok)
         {
-        dummy = read(pfd[pipe_read], (void *)&save_errno, sizeof(int));
-        dummy = read(pfd[pipe_read], (void *)&(addr->more_errno), sizeof(int));
+	int dummy = read(pfd[pipe_read], (void *)&save_errno, sizeof(int));
+        dummy = read(pfd[pipe_read], (void *)&(tctx->addr->more_errno), sizeof(int));
         yield = FALSE;
         }
       }
@@ -1405,10 +1460,9 @@ if (write_pid > 0)
       {
       yield = FALSE;
       save_errno = ERRNO_FILTER_FAIL;
-      addr->more_errno = rc;
+      tctx->addr->more_errno = rc;
       DEBUG(D_transport) debug_printf("writing process returned %d\n", rc);
       }
-    }
   }
 (void)close(pfd[pipe_read]);
 
@@ -1419,28 +1473,27 @@ filter was not NL, insert a NL to make the SMTP protocol work. */
 if (yield)
   {
   nl_check_length = nl_escape_length = 0;
-  if ((options & topt_end_dot) != 0 && (last_filter_was_NL?
-        !write_chunk(fd, US".\n", 2, use_crlf) :
-        !write_chunk(fd, US"\n.\n", 3, use_crlf)))
-    {
+  if (  tctx->options & topt_end_dot
+     && ( last_filter_was_NL
+        ? !write_chunk(fd, tctx, US".\n", 2)
+	: !write_chunk(fd, tctx, US"\n.\n", 3)
+     )  )
     yield = FALSE;
-    }
 
   /* Write out any remaining data in the buffer. */
 
   else
-    {
-    yield = (len = chunk_ptr - deliver_out_buffer) <= 0 ||
-      transport_write_block(fd, deliver_out_buffer, len);
-    }
+    yield = (len = chunk_ptr - deliver_out_buffer) <= 0
+	  || transport_write_block(fd, deliver_out_buffer, len);
   }
-else errno = save_errno;      /* From some earlier error */
+else
+  errno = save_errno;      /* From some earlier error */
 
 DEBUG(D_transport)
   {
   debug_printf("end of filtering transport writing: yield=%d\n", yield);
   if (!yield)
-    debug_printf("errno=%d more_errno=%d\n", errno, addr->more_errno);
+    debug_printf("errno=%d more_errno=%d\n", errno, tctx->addr->more_errno);
   }
 
 return yield;
@@ -1653,15 +1706,8 @@ open_db dbblock;
 open_db *dbm_file;
 uschar buffer[256];
 
-msgq_t      *msgq = NULL;
-int         msgq_count = 0;
-int         msgq_actual = 0;
 int         i;
-BOOL        bFound = FALSE;
-uschar      spool_dir [PATH_MAX];
-uschar      spool_file [PATH_MAX];
 struct stat statbuf;
-BOOL        bContinuation = FALSE;
 
 *more = FALSE;
 
@@ -1691,8 +1737,7 @@ if (dbm_file == NULL) return FALSE;
 
 /* See if there is a record for this host; if not, there's nothing to do. */
 
-host_record = dbfn_read(dbm_file, hostname);
-if (host_record == NULL)
+if (!(host_record = dbfn_read(dbm_file, hostname)))
   {
   dbfn_close(dbm_file);
   DEBUG(D_transport) debug_printf("no messages waiting for %s\n", hostname);
@@ -1719,15 +1764,19 @@ emptied, delete it and continue with any continuation records that may exist.
 but the 1 off will remain without it.  This code now allows me to SKIP over
 a message I do not want to send out on this run.  */
 
-sprintf(CS spool_dir, "%s/input/", spool_directory);
-
 host_length = host_record->count * MESSAGE_ID_LENGTH;
 
 while (1)
   {
+  msgq_t      *msgq;
+  int         msgq_count = 0;
+  int         msgq_actual = 0;
+  BOOL        bFound = FALSE;
+  BOOL        bContinuation = FALSE;
+
   /* create an array to read entire message queue into memory for processing  */
 
-  msgq = (msgq_t*) malloc(sizeof(msgq_t) * host_record->count);
+  msgq = store_malloc(sizeof(msgq_t) * host_record->count);
   msgq_count = host_record->count;
   msgq_actual = msgq_count;
 
@@ -1751,17 +1800,15 @@ while (1)
 
   /* now find the next acceptable message_id */
 
-  bFound = FALSE;
-
   for (i = msgq_count - 1; i >= 0; --i) if (msgq[i].bKeep)
     {
-    if (split_spool_directory)
-	sprintf(CS spool_file, "%s%c/%s-D",
-		      spool_dir, msgq[i].message_id[5], msgq[i].message_id);
-    else
-	sprintf(CS spool_file, "%s%s-D", spool_dir, msgq[i].message_id);
+    uschar subdir[2];
+
+    subdir[0] = split_spool_directory ? msgq[i].message_id[5] : 0;
+    subdir[1] = 0;
 
-    if (Ustat(spool_file, &statbuf) != 0)
+    if (Ustat(spool_fname(US"input", subdir, msgq[i].message_id, US"-D"),
+	      &statbuf) != 0)
       msgq[i].bKeep = FALSE;
     else if (!oicf_func || oicf_func(msgq[i].message_id, oicf_data))
       {
@@ -1778,8 +1825,7 @@ while (1)
       msgq_actual++;
 
   /* reassemble the host record, based on removed message ids, from in
-   * memory queue.
-   */
+  memory queue  */
 
   if (msgq_actual <= 0)
     {
@@ -1806,8 +1852,6 @@ while (1)
 /* Jeremy: check for a continuation record, this code I do not know how to
 test but the code should work */
 
-  bContinuation = FALSE;
-
   while (host_length <= 0)
     {
     int i;
@@ -1838,8 +1882,11 @@ test but the code should work */
     bContinuation = TRUE;
     }
 
-  if (bFound)
+  if (bFound)		/* Usual exit from main loop */
+    {
+    store_free (msgq);
     break;
+    }
 
   /* If host_length <= 0 we have emptied a record and not found a good message,
   and there are no continuation records. Otherwise there is a continuation
@@ -1858,20 +1905,13 @@ test but the code should work */
 
   if (!bContinuation)
     {
-    Ustrcpy (new_message_id, message_id);
+    Ustrcpy(new_message_id, message_id);
     dbfn_close(dbm_file);
     return FALSE;
     }
-  }		/* we need to process a continuation record */
 
-/* clean up in memory queue */
-if (msgq)
-  {
-  free (msgq);
-  msgq = NULL;
-  msgq_count = 0;
-  msgq_actual = 0;
-  }
+  store_free(msgq);
+  }		/* we need to process a continuation record */
 
 /* Control gets here when an existing message has been encountered; its
 id is in new_message_id, and host_length is the revised length of the
@@ -1880,19 +1920,8 @@ record if required, close the database, and return TRUE. */
 
 if (host_length > 0)
   {
-  uschar  msg [MESSAGE_ID_LENGTH + 1];
-  int i;
-
   host_record->count = host_length/MESSAGE_ID_LENGTH;
 
-  /* rebuild the host_record->text */
-
-  for (i = 0; i < host_record->count; ++i)
-    {
-    Ustrncpy(msg, host_record->text + (i*MESSAGE_ID_LENGTH), MESSAGE_ID_LENGTH);
-    msg[MESSAGE_ID_LENGTH] = 0;
-    }
-
   dbfn_write(dbm_file, hostname, host_record, (int)sizeof(dbdata_wait) + host_length);
   *more = TRUE;
   }
@@ -1930,7 +1959,7 @@ DEBUG(D_transport) debug_printf("transport_pass_socket entered\n");
 
 if ((pid = fork()) == 0)
   {
-  int i = 16;
+  int i = 17;
   const uschar **argv;
 
   /* Disconnect entirely from the parent process. If we are running in the
@@ -1946,17 +1975,15 @@ if ((pid = fork()) == 0)
 
   argv = CUSS child_exec_exim(CEE_RETURN_ARGV, TRUE, &i, FALSE, 0);
 
-  /* Call with the dsn flag */
-  if (smtp_use_dsn) argv[i++] = US"-MCD";
-
   if (smtp_authenticated) argv[i++] = US"-MCA";
 
-  #ifdef SUPPORT_TLS
-  if (tls_offered) argv[i++] = US"-MCT";
-  #endif
-
-  if (smtp_use_size) argv[i++] = US"-MCS";
-  if (smtp_use_pipelining) argv[i++] = US"-MCP";
+  if (smtp_peer_options & PEER_OFFERED_CHUNKING) argv[i++] = US"-MCK";
+  if (smtp_peer_options & PEER_OFFERED_DSN) argv[i++] = US"-MCD";
+  if (smtp_peer_options & PEER_OFFERED_PIPE) argv[i++] = US"-MCP";
+  if (smtp_peer_options & PEER_OFFERED_SIZE) argv[i++] = US"-MCS";
+#ifdef SUPPORT_TLS
+  if (smtp_peer_options & PEER_OFFERED_TLS) argv[i++] = US"-MCT";
+#endif
 
   if (queue_run_pid != (pid_t)0)
     {
diff --git a/src/src/transports/Makefile b/src/src/transports/Makefile
index 25973d5df..4eea141ec 100644
--- a/src/src/transports/Makefile
+++ b/src/src/transports/Makefile
@@ -2,7 +2,7 @@
 # calling it transports.a. This is called from the main make file, after cd'ing
 # to the transports subdirectory.
 
-OBJ = appendfile.o autoreply.o lmtp.o pipe.o smtp.o smtp_socks.o tf_maildir.o
+OBJ = appendfile.o autoreply.o lmtp.o pipe.o queuefile.o smtp.o smtp_socks.o tf_maildir.o
 
 transports.a:    $(OBJ)
 		 @$(RM_COMMAND) -f transports.a
@@ -18,6 +18,7 @@ appendfile.o:    $(HDRS) appendfile.c appendfile.h tf_maildir.h
 autoreply.o:     $(HDRS) autoreply.c autoreply.h
 lmtp.o:          $(HDRS) lmtp.c lmtp.h
 pipe.o:          $(HDRS) pipe.c pipe.h
+queuefile.o:     $(HDRS) queuefile.c queuefile.h
 smtp.o:          $(HDRS) smtp.c smtp.h
 smtp_socks.o:    $(HDRS) smtp_socks.c smtp.h
 
diff --git a/src/src/transports/appendfile.c b/src/src/transports/appendfile.c
index c8abe9bc5..884452208 100644
--- a/src/src/transports/appendfile.c
+++ b/src/src/transports/appendfile.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -619,19 +619,18 @@ if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
 host.address = US"127.0.0.1";
 
 
-for (h = &host; h != NULL; h = h->next)
+for (h = &host; h; h = h->next)
   {
   int sock, rc;
-  int host_af = (Ustrchr(h->address, ':') != NULL)? AF_INET6 : AF_INET;
+  int host_af = Ustrchr(h->address, ':') != NULL ? AF_INET6 : AF_INET;
 
   DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
 
-  sock = ip_socket(SOCK_DGRAM, host_af);
-  if (sock < 0) continue;
+  if ((sock = ip_socket(SOCK_DGRAM, host_af)) < 0) continue;
 
   /* Connect never fails for a UDP socket, so don't set a timeout. */
 
-  (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0);
+  (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0, FALSE);
   rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
   (void)close(sock);
 
@@ -679,15 +678,16 @@ if (len == 0) return tblock;
 
 /* Search the formats for a match */
 
-while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size))!= NULL)
+while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size)))
   {
   int slen = Ustrlen(s);
   BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
   uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
-  if (match)
+
+  if (match && tp)
     {
     transport_instance *tt;
-    for (tt = transports; tt != NULL; tt = tt->next)
+    for (tt = transports; tt; tt = tt->next)
       if (Ustrcmp(tp, tt->name) == 0)
         {
         DEBUG(D_transport)
@@ -2873,9 +2873,14 @@ at initialization time. */
 
 if (yield == OK)
   {
-  if (!transport_write_message(addr, fd, ob->options, 0, tblock->add_headers,
-      tblock->remove_headers, ob->check_string, ob->escape_string,
-      tblock->rewrite_rules, tblock->rewrite_existflags))
+  transport_ctx tctx = {
+    tblock,
+    addr,
+    ob->check_string,
+    ob->escape_string,
+    ob->options
+  };
+  if (!transport_write_message(fd, &tctx, 0))
     yield = DEFER;
   }
 
diff --git a/src/src/transports/autoreply.c b/src/src/transports/autoreply.c
index d2aad542a..f07cd83cf 100644
--- a/src/src/transports/autoreply.c
+++ b/src/src/transports/autoreply.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -267,7 +267,6 @@ autoreply_transport_entry(
 {
 int fd, pid, rc;
 int cache_fd = -1;
-int log_fd = -1;
 int cache_size = 0;
 int add_size = 0;
 EXIM_DB *dbm_file = NULL;
@@ -522,9 +521,10 @@ if (oncelog != NULL && *oncelog != 0 && to != NULL)
 
   if (then != 0 && (once_repeat_sec <= 0 || now - then < once_repeat_sec))
     {
+    int log_fd;
     DEBUG(D_transport) debug_printf("message previously sent to %s%s\n", to,
       (once_repeat_sec > 0)? " and repeat time not reached" : "");
-    log_fd = Uopen(logfile, O_WRONLY|O_APPEND|O_CREAT, ob->mode);
+    log_fd = logfile ? Uopen(logfile, O_WRONLY|O_APPEND|O_CREAT, ob->mode) : -1;
     if (log_fd >= 0)
       {
       uschar *ptr = log_buffer;
@@ -691,6 +691,16 @@ if (return_message)
     US"------ This is a copy of the body of the message, without the headers.\n"
     :
     US"------ This is a copy of the message, including all the headers.\n";
+  transport_ctx tctx = {
+    tblock,
+    addr,
+    NULL, NULL,
+    (tblock->body_only ? topt_no_headers : 0) |
+    (tblock->headers_only ? topt_no_body : 0) |
+    (tblock->return_path_add ? topt_add_return_path : 0) |
+    (tblock->delivery_date_add ? topt_add_delivery_date : 0) |
+    (tblock->envelope_to_add ? topt_add_envelope_to : 0)
+  };
 
   if (bounce_return_size_limit > 0 && !tblock->headers_only)
     {
@@ -710,14 +720,7 @@ if (return_message)
 
   fflush(f);
   transport_count = 0;
-  transport_write_message(addr, fileno(f),
-    (tblock->body_only? topt_no_headers : 0) |
-    (tblock->headers_only? topt_no_body : 0) |
-    (tblock->return_path_add? topt_add_return_path : 0) |
-    (tblock->delivery_date_add? topt_add_delivery_date : 0) |
-    (tblock->envelope_to_add? topt_add_envelope_to : 0),
-    bounce_return_size_limit, tblock->add_headers, tblock->remove_headers,
-    NULL, NULL, tblock->rewrite_rules, tblock->rewrite_existflags);
+  transport_write_message(fileno(f), &tctx, bounce_return_size_limit);
   }
 
 /* End the message and wait for the child process to end; no timeout. */
diff --git a/src/src/transports/lmtp.c b/src/src/transports/lmtp.c
index 1f4d7a6bf..0cc981064 100644
--- a/src/src/transports/lmtp.c
+++ b/src/src/transports/lmtp.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -217,6 +217,7 @@ va_list ap;
 va_start(ap, format);
 if (!string_vformat(big_buffer, big_buffer_size, CS format, ap))
   {
+  va_end(ap);
   errno = ERRNO_SMTPFORMAT;
   return FALSE;
   }
@@ -608,6 +609,12 @@ for (addr = addrlist; addr != NULL; addr = addr->next)
 if (send_data)
   {
   BOOL ok;
+  transport_ctx tctx = {
+    tblock,
+    addrlist,
+    US".", US"..",
+    ob->options
+  };
 
   if (!lmtp_write_command(fd_in, "DATA\r\n")) goto WRITE_FAILED;
   if (!lmtp_read_response(out, buffer, sizeof(buffer), '3', timeout))
@@ -627,9 +634,7 @@ if (send_data)
     debug_printf("  LMTP>> writing message and terminating \".\"\n");
 
   transport_count = 0;
-  ok = transport_write_message(addrlist, fd_in, ob->options, 0,
-        tblock->add_headers, tblock->remove_headers, US".", US"..",
-        tblock->rewrite_rules, tblock->rewrite_existflags);
+  ok = transport_write_message(fd_in, &tctx, 0);
 
   /* Failure can either be some kind of I/O disaster (including timeout),
   or the failure of a transport filter or the expansion of added headers. */
diff --git a/src/src/transports/pipe.c b/src/src/transports/pipe.c
index eaf04d150..d3841e050 100644
--- a/src/src/transports/pipe.c
+++ b/src/src/transports/pipe.c
@@ -489,11 +489,12 @@ if (expand_arguments)
 
     for (ad = addr; ad != NULL; ad = ad->next)
       {
-      if (ad != addr) string_cat(s, &size, &offset, US" ", 1);
-      string_cat(s, &size, &offset, ad->address, Ustrlen(ad->address));
+      /*XXX string_append_listele() ? */
+      if (ad != addr) s = string_catn(s, &size, &offset, US" ", 1);
+      s = string_cat(s, &size, &offset, ad->address);
       }
 
-    string_cat(s, &size, &offset, q, Ustrlen(q));
+    s = string_cat(s, &size, &offset, q);
     s[offset] = 0;
     }
 
@@ -553,7 +554,14 @@ const uschar **argv;
 uschar *envp[50];
 const uschar *envlist = ob->environment;
 uschar *cmd, *ss;
-uschar *eol = (ob->use_crlf)? US"\r\n" : US"\n";
+uschar *eol = ob->use_crlf ? US"\r\n" : US"\n";
+transport_ctx tctx = {
+  tblock,
+  addr,
+  ob->check_string,
+  ob->escape_string,
+  ob->options /* set at initialization time */
+};
 
 DEBUG(D_transport) debug_printf("%s transport entered\n", tblock->name);
 
@@ -841,23 +849,19 @@ if (ob->use_bsmtp)
   if (!transport_write_string(fd_in, "MAIL FROM:<%s>%s", return_path, eol))
     goto END_WRITE;
 
-  for (a = addr; a != NULL; a = a->next)
-    {
+  for (a = addr; a; a = a->next)
     if (!transport_write_string(fd_in,
         "RCPT TO:<%s>%s",
         transport_rcpt_address(a, tblock->rcpt_include_affixes),
         eol))
       goto END_WRITE;
-    }
 
   if (!transport_write_string(fd_in, "DATA%s", eol)) goto END_WRITE;
   }
 
-/* Now the actual message - the options were set at initialization time */
+/* Now the actual message */
 
-if (!transport_write_message(addr, fd_in, ob->options, 0, tblock->add_headers,
-  tblock->remove_headers, ob->check_string, ob->escape_string,
-  tblock->rewrite_rules, tblock->rewrite_existflags))
+if (!transport_write_message(fd_in, &tctx, 0))
     goto END_WRITE;
 
 /* Now any configured suffix */
@@ -1100,36 +1104,33 @@ if ((rc = child_close(pid, timeout)) != 0)
 
       if (*ss != 0)
         {
-        addr->message = string_cat(addr->message, &size, &ptr, US" ", 1);
-        addr->message = string_cat(addr->message, &size, &ptr,
-          ss, Ustrlen(ss));
+        addr->message = string_catn(addr->message, &size, &ptr, US" ", 1);
+        addr->message = string_cat (addr->message, &size, &ptr, ss);
         }
 
       /* Now add the command and arguments */
 
-      addr->message = string_cat(addr->message, &size, &ptr,
+      addr->message = string_catn(addr->message, &size, &ptr,
         US" from command:", 14);
 
       for (i = 0; i < sizeof(argv)/sizeof(int *) && argv[i] != NULL; i++)
         {
         BOOL quote = FALSE;
-        addr->message = string_cat(addr->message, &size, &ptr, US" ", 1);
+        addr->message = string_catn(addr->message, &size, &ptr, US" ", 1);
         if (Ustrpbrk(argv[i], " \t") != NULL)
           {
           quote = TRUE;
-          addr->message = string_cat(addr->message, &size, &ptr, US"\"", 1);
+          addr->message = string_catn(addr->message, &size, &ptr, US"\"", 1);
           }
-        addr->message = string_cat(addr->message, &size, &ptr, argv[i],
-          Ustrlen(argv[i]));
+        addr->message = string_cat(addr->message, &size, &ptr, argv[i]);
         if (quote)
-          addr->message = string_cat(addr->message, &size, &ptr, US"\"", 1);
+          addr->message = string_catn(addr->message, &size, &ptr, US"\"", 1);
         }
 
       /* Add previous filter timeout message, if present. */
 
-      if (*tmsg != 0)
-        addr->message = string_cat(addr->message, &size, &ptr, tmsg,
-          Ustrlen(tmsg));
+      if (*tmsg)
+        addr->message = string_cat(addr->message, &size, &ptr, tmsg);
 
       addr->message[ptr] = 0;  /* Ensure concatenated string terminated */
       }
diff --git a/src/src/transports/queuefile.c b/src/src/transports/queuefile.c
new file mode 100644
index 000000000..7f10706c1
--- /dev/null
+++ b/src/src/transports/queuefile.c
@@ -0,0 +1,256 @@
+/*************************************************
+*     Exim - an Internet mail transport agent    *
+*************************************************/
+
+/* Copyright (c) Andrew Colin Kissa <andrew@topdog.za.net> 2016 */
+/* Copyright (c) University of Cambridge 2016 */
+/* See the file NOTICE for conditions of use and distribution. */
+
+
+#include "../exim.h"
+#include "queuefile.h"
+
+/* Options specific to the appendfile transport. They must be in alphabetic
+order (note that "_" comes before the lower case letters). Some of them are
+stored in the publicly visible instance block - these are flagged with the
+opt_public flag. */
+
+optionlist queuefile_transport_options[] = {
+  { "directory", opt_stringptr,
+    (void *)offsetof(queuefile_transport_options_block, dirname) },
+};
+
+/* Size of the options list. An extern variable has to be used so that its
+address can appear in the tables drtables.c. */
+
+int queuefile_transport_options_count =
+  sizeof(queuefile_transport_options) / sizeof(optionlist);
+
+/* Default private options block for the appendfile transport. */
+
+queuefile_transport_options_block queuefile_transport_option_defaults = {
+  NULL,           /* dirname */
+};
+
+/*************************************************
+*          Initialization entry point            *
+*************************************************/
+
+void queuefile_transport_init(transport_instance *tblock)
+{
+queuefile_transport_options_block *ob =
+  (queuefile_transport_options_block *) tblock->options_block;
+
+if (!ob->dirname)
+  log_write(0, LOG_PANIC_DIE | LOG_CONFIG,
+    "directory must be set for the %s transport", tblock->name);
+}
+
+/* This function will copy from a file to another
+
+Arguments:
+  dst        fd to write to (the destination queue file)
+  src        fd to read from (the spool queue file)
+
+Returns:       TRUE if all went well, FALSE otherwise with errno set
+*/
+
+static BOOL
+copy_spool_file(int dst, int src)
+{
+int i, j;
+uschar buffer[16384];
+uschar * s;
+
+if (lseek(src, 0, SEEK_SET) != 0)
+  return FALSE;
+
+do
+  if ((j = read(src, buffer, sizeof(buffer))) > 0)
+    for (s = buffer; (i = write(dst, s, j)) != j; s += i, j -= i)
+      if (i < 0)
+	return FALSE;
+  else if (j < 0)
+    return FALSE;
+while (j > 0);
+return TRUE;
+}
+
+/* This function performs the actual copying of the header
+and data files to the destination directory
+
+Arguments:
+  tb		the transport block
+  addr          address_item being processed
+  sdfd          int Source directory fd
+  ddfd          int Destination directory fd
+  link_file     BOOL use linkat instead of data copy
+  srcfd		fd for data file, or -1 for header file
+
+Returns:       TRUE if all went well, FALSE otherwise
+*/
+
+static BOOL
+copy_spool_files(transport_instance * tb, address_item * addr,
+  int sdfd, int ddfd, BOOL link_file, int srcfd)
+{
+BOOL is_hdr_file = srcfd < 0;
+const uschar * suffix = srcfd < 0 ? US"H" : US"D";
+int dstfd;
+const uschar * filename = string_sprintf("%s-%s", message_id, suffix);
+const uschar * srcpath = spool_fname(US"input", message_subdir, message_id, suffix);
+const uschar * dstpath = string_sprintf("%s/%s-%s",
+  ((queuefile_transport_options_block *) tb->options_block)->dirname,
+  message_id, suffix);
+const uschar * s;
+const uschar * op;
+
+if (link_file)
+  {
+  DEBUG(D_transport) debug_printf("%s transport, linking %s => %s\n",
+    tb->name, srcpath, dstpath);
+
+  if (linkat(sdfd, CCS filename, ddfd, CCS filename, 0) >= 0)
+    return TRUE;
+
+  op = US"linking";
+  s = dstpath;
+  }
+else					/* use data copy */
+  {
+  DEBUG(D_transport) debug_printf("%s transport, copying %s => %s\n",
+    tb->name, srcpath, dstpath);
+
+  if (  (s = dstpath,
+	 (dstfd = openat(ddfd, CCS filename, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE))
+	 < 0
+	)
+     ||    is_hdr_file
+	&& (s = srcpath, (srcfd = openat(sdfd, CCS filename, O_RDONLY)) < 0)
+     )
+    op = US"opening";
+
+  else
+    if (s = dstpath, fchmod(dstfd, SPOOL_MODE) != 0)
+      op = US"setting perms on";
+    else
+      if (!copy_spool_file(dstfd, srcfd))
+	op = US"creating";
+      else
+	return TRUE;
+  }
+
+addr->basic_errno = errno;
+addr->message = string_sprintf("%s transport %s file: %s failed with error: %s",
+  tb->name, op, s, strerror(errno));
+addr->transport_return = DEFER;
+return FALSE;
+}
+
+/*************************************************
+*              Main entry point                  *
+*************************************************/
+
+/* This transport always returns FALSE, indicating that the status in
+the first address is the status for all addresses in a batch. */
+
+BOOL
+queuefile_transport_entry(transport_instance * tblock, address_item * addr)
+{
+queuefile_transport_options_block * ob =
+  (queuefile_transport_options_block *) tblock->options_block;
+BOOL can_link;
+uschar * sourcedir = spool_dname(US"input", message_subdir);
+uschar * s;
+struct stat dstatbuf, sstatbuf;
+int ddfd = -1, sdfd = -1;
+
+DEBUG(D_transport)
+  debug_printf("%s transport entered\n", tblock->name);
+
+#ifndef O_DIRECTORY
+# define O_DIRECTORY 0
+#endif
+#ifndef O_NOFOLLOW
+# define O_NOFOLLOW 0
+#endif
+
+if (ob->dirname[0] != '/')
+  {
+  addr->transport_return = PANIC;
+  addr->message = string_sprintf("%s transport directory: "
+    "%s is not absolute", tblock->name, ob->dirname);
+  return FALSE;
+  }
+
+/* Open the source and destination directories and check if they are
+on the same filesystem, so we can hard-link files rather than copying. */
+
+if (  (s = ob->dirname,
+       (ddfd = Uopen(s, O_RDONLY | O_DIRECTORY | O_NOFOLLOW, 0)) < 0)
+   || (s = sourcedir,
+       (sdfd = Uopen(sourcedir, O_RDONLY | O_DIRECTORY | O_NOFOLLOW, 0)) < 0)
+   )
+  {
+  addr->transport_return = PANIC;
+  addr->basic_errno = errno;
+  addr->message = string_sprintf("%s transport accessing directory: %s "
+    "failed with error: %s", tblock->name, s, strerror(errno));
+  if (ddfd >= 0) (void) close(ddfd);
+  return FALSE;
+  }
+
+if (  (s = ob->dirname, fstat(ddfd, &dstatbuf) < 0)
+   || (s = sourcedir,   fstat(sdfd, &sstatbuf) < 0)
+   )
+  {
+  addr->transport_return = PANIC;
+  addr->basic_errno = errno;
+  addr->message = string_sprintf("%s transport fstat on directory fd: "
+    "%s failed with error: %s", tblock->name, s, strerror(errno));
+  goto RETURN;
+  }
+can_link = (dstatbuf.st_dev == sstatbuf.st_dev);
+
+if (dont_deliver)
+  {
+  DEBUG(D_transport)
+    debug_printf("*** delivery by %s transport bypassed by -N option\n",
+      tblock->name);
+  addr->transport_return = OK;
+  goto RETURN;
+  }
+
+/* Link or copy the header and data spool files */
+
+DEBUG(D_transport)
+  debug_printf("%s transport, copying header file\n", tblock->name);
+
+if (!copy_spool_files(tblock, addr, sdfd, ddfd, can_link, -1))
+  goto RETURN;
+
+DEBUG(D_transport)
+  debug_printf("%s transport, copying data file\n", tblock->name);
+
+if (!copy_spool_files(tblock, addr, sdfd, ddfd, can_link, deliver_datafile))
+  {
+  DEBUG(D_transport)
+    debug_printf("%s transport, copying data file failed, "
+      "unlinking the header file\n", tblock->name);
+  Uunlink(string_sprintf("%s/%s-H", ob->dirname, message_id));
+  goto RETURN;
+  }
+
+DEBUG(D_transport)
+  debug_printf("%s transport succeeded\n", tblock->name);
+
+addr->transport_return = OK;
+
+RETURN:
+if (ddfd >= 0) (void) close(ddfd);
+if (sdfd >= 0) (void) close(sdfd);
+
+/* A return of FALSE means that if there was an error, a common error was
+put in the first address of a batch. */
+return FALSE;
+}
diff --git a/src/src/transports/queuefile.h b/src/src/transports/queuefile.h
new file mode 100644
index 000000000..0e45b51b0
--- /dev/null
+++ b/src/src/transports/queuefile.h
@@ -0,0 +1,29 @@
+/*************************************************
+*     Exim - an Internet mail transport agent    *
+*************************************************/
+
+/* Copyright (c) Andrew Colin Kissa <andrew@topdog.za.net> 2016 */
+/* Copyright (c) University of Cambridge 2016 */
+/* See the file NOTICE for conditions of use and distribution. */
+
+/* Private structure for the private options. */
+
+typedef struct {
+    uschar *dirname;
+} queuefile_transport_options_block;
+
+/* Data for reading the private options. */
+
+extern optionlist queuefile_transport_options[];
+extern int queuefile_transport_options_count;
+
+/* Block containing default values. */
+
+extern queuefile_transport_options_block queuefile_transport_option_defaults;
+
+/* The main and init entry points for the transport */
+
+extern BOOL queuefile_transport_entry(transport_instance *, address_item *);
+extern void queuefile_transport_init(transport_instance *);
+
+/* End of transports/queuefile.h */
diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 78673d4c8..d6ef34eff 100644
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 #include "../exim.h"
@@ -12,6 +12,8 @@
 #define PENDING_DEFER   (PENDING + DEFER)
 #define PENDING_OK      (PENDING + OK)
 
+#define DELIVER_BUFFER_SIZE 4096
+
 
 /* Options specific to the smtp transport. This transport also supports LMTP
 over TCP/IP. The options must be in alphabetic order (note that "_" comes
@@ -44,17 +46,17 @@ optionlist smtp_transport_options[] = {
       (void *)offsetof(smtp_transport_options_block, delay_after_cutoff) },
 #ifndef DISABLE_DKIM
   { "dkim_canon", opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, dkim_canon) },
+      (void *)offsetof(smtp_transport_options_block, dkim.dkim_canon) },
   { "dkim_domain", opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, dkim_domain) },
+      (void *)offsetof(smtp_transport_options_block, dkim.dkim_domain) },
   { "dkim_private_key", opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, dkim_private_key) },
+      (void *)offsetof(smtp_transport_options_block, dkim.dkim_private_key) },
   { "dkim_selector", opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, dkim_selector) },
+      (void *)offsetof(smtp_transport_options_block, dkim.dkim_selector) },
   { "dkim_sign_headers", opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, dkim_sign_headers) },
+      (void *)offsetof(smtp_transport_options_block, dkim.dkim_sign_headers) },
   { "dkim_strict", opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, dkim_strict) },
+      (void *)offsetof(smtp_transport_options_block, dkim.dkim_strict) },
 #endif
   { "dns_qualify_single",   opt_bool,
       (void *)offsetof(smtp_transport_options_block, dns_qualify_single) },
@@ -72,17 +74,6 @@ optionlist smtp_transport_options[] = {
       (void *)offsetof(smtp_transport_options_block, final_timeout) },
   { "gethostbyname",        opt_bool,
       (void *)offsetof(smtp_transport_options_block, gethostbyname) },
-#ifdef SUPPORT_TLS
-  /* These are no longer honoured, as of Exim 4.80; for now, we silently
-  ignore; 4.83 will warn, and a later-still release will remove
-  these options, so that using them becomes an error. */
-  { "gnutls_require_kx",    opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, gnutls_require_kx) },
-  { "gnutls_require_mac",   opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, gnutls_require_mac) },
-  { "gnutls_require_protocols", opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, gnutls_require_proto) },
-#endif
   { "helo_data",            opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, helo_data) },
   { "hosts",                opt_stringptr,
@@ -127,10 +118,14 @@ optionlist smtp_transport_options[] = {
 #endif
   { "hosts_try_auth",       opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, hosts_try_auth) },
+  { "hosts_try_chunking",   opt_stringptr,
+      (void *)offsetof(smtp_transport_options_block, hosts_try_chunking) },
 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
   { "hosts_try_dane",       opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, hosts_try_dane) },
 #endif
+  { "hosts_try_fastopen",   opt_stringptr,
+      (void *)offsetof(smtp_transport_options_block, hosts_try_fastopen) },
 #ifndef DISABLE_PRDR
   { "hosts_try_prdr",       opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, hosts_try_prdr) },
@@ -211,12 +206,14 @@ smtp_transport_options_block smtp_transport_option_defaults = {
   NULL,                /* serialize_hosts */
   NULL,                /* hosts_try_auth */
   NULL,                /* hosts_require_auth */
+  US"*",               /* hosts_try_chunking */
 #ifdef EXPERIMENTAL_DANE
   NULL,                /* hosts_try_dane */
   NULL,                /* hosts_require_dane */
 #endif
+  NULL,                /* hosts_try_fastopen */
 #ifndef DISABLE_PRDR
-  US"*",                /* hosts_try_prdr */
+  US"*",               /* hosts_try_prdr */
 #endif
 #ifndef DISABLE_OCSP
   US"*",               /* hosts_request_ocsp (except under DANE; tls_client_start()) */
@@ -257,9 +254,6 @@ smtp_transport_options_block smtp_transport_option_defaults = {
   NULL,                /* tls_crl */
   NULL,                /* tls_privatekey */
   NULL,                /* tls_require_ciphers */
-  NULL,                /* gnutls_require_kx */
-  NULL,                /* gnutls_require_mac */
-  NULL,                /* gnutls_require_proto */
   NULL,                /* tls_sni */
   US"system",          /* tls_verify_certificates */
   EXIM_CLIENT_DH_DEFAULT_MIN_BITS,
@@ -270,12 +264,13 @@ smtp_transport_options_block smtp_transport_option_defaults = {
   US"*"                /* tls_verify_cert_hostnames */
 #endif
 #ifndef DISABLE_DKIM
- ,NULL,                /* dkim_canon */
-  NULL,                /* dkim_domain */
-  NULL,                /* dkim_private_key */
-  NULL,                /* dkim_selector */
-  NULL,                /* dkim_sign_headers */
-  NULL                 /* dkim_strict */
+ , {NULL,              /* dkim_canon */
+    NULL,              /* dkim_domain */
+    NULL,              /* dkim_private_key */
+    NULL,              /* dkim_selector */
+    NULL,              /* dkim_sign_headers */
+    NULL,              /* dkim_strict */
+    FALSE}	       /* dot_stuffed */
 #endif
 };
 
@@ -293,6 +288,7 @@ static uschar *rf_names[] = { US"NEVER", US"SUCCESS", US"FAILURE", US"DELAY" };
 static uschar *smtp_command;   /* Points to last cmd for error messages */
 static uschar *mail_command;   /* Points to MAIL cmd for error messages */
 static BOOL    update_waiting; /* TRUE to update the "wait" database */
+static BOOL    pipelining_active; /* current transaction is in pipe mode */
 
 
 /*************************************************
@@ -411,15 +407,6 @@ if (ob->hosts_override && ob->hosts != NULL) tblock->overrides_hosts = TRUE;
 for them, but do not do any lookups at this time. */
 
 host_build_hostlist(&(ob->fallback_hostlist), ob->fallback_hosts, FALSE);
-
-#ifdef SUPPORT_TLS
-if (  ob->gnutls_require_kx
-   || ob->gnutls_require_mac
-   || ob->gnutls_require_proto)
-  log_write(0, LOG_MAIN, "WARNING: smtp transport options"
-    " gnutls_require_kx, gnutls_require_mac and gnutls_require_protocols"
-    " are obsolete\n");
-#endif
 }
 
 
@@ -530,13 +517,7 @@ static BOOL
 check_response(host_item *host, int *errno_value, int more_errno,
   uschar *buffer, int *yield, uschar **message, BOOL *pass_message)
 {
-uschar *pl = US"";
-
-if (smtp_use_pipelining &&
-    (Ustrcmp(smtp_command, "MAIL") == 0 ||
-     Ustrcmp(smtp_command, "RCPT") == 0 ||
-     Ustrcmp(smtp_command, "DATA") == 0))
-  pl = US"pipelined ";
+uschar * pl = pipelining_active ? US"pipelined " : US"";
 
 *yield = '4';    /* Default setting is to give a temporary error */
 
@@ -653,11 +634,11 @@ Returns:   nothing
 static void
 write_logs(address_item *addr, host_item *host)
 {
-uschar * message = string_sprintf("H=%s [%s]", host->name, host->address);
+uschar * message = LOGGING(outgoing_port)
+  ? string_sprintf("H=%s [%s]:%d", host->name, host->address,
+		    host->port == PORT_NONE ? 25 : host->port)
+  : string_sprintf("H=%s [%s]", host->name, host->address);
 
-if (LOGGING(outgoing_port))
-  message = string_sprintf("%s:%d", message,
-	      host->port == PORT_NONE ? 25 : host->port);
 if (addr->message)
   {
   message = string_sprintf("%s: %s", message, addr->message);
@@ -668,17 +649,17 @@ if (addr->message)
   }
 else
   {
-  log_write(0, LOG_MAIN, "%s %s", message, strerror(addr->basic_errno));
-  deliver_msglog("%s %s %s\n", tod_stamp(tod_log), message,
-		strerror(addr->basic_errno));
+  const uschar * s = exim_errstr(addr->basic_errno);
+  log_write(0, LOG_MAIN, "%s %s", message, s);
+  deliver_msglog("%s %s %s\n", tod_stamp(tod_log), message, s);
   }
 }
 
 static void
 msglog_line(host_item * host, uschar * message)
 {
-  deliver_msglog("%s H=%s [%s] %s\n", tod_stamp(tod_log),
-    host->name, host->address, message);
+deliver_msglog("%s H=%s [%s] %s\n", tod_stamp(tod_log),
+  host->name, host->address, message);
 }
 
 
@@ -806,6 +787,7 @@ if (pending_MAIL)
   count--;
   if (!smtp_read_response(inblock, buffer, buffsize, '2', timeout))
     {
+    DEBUG(D_transport) debug_printf("bad response for MAIL\n");
     Ustrcpy(big_buffer, mail_command);  /* Fits, because it came from there! */
     if (errno == 0 && buffer[0] != 0)
       {
@@ -1215,9 +1197,15 @@ return FALSE;
 
 
 #ifdef EXPERIMENTAL_DANE
+/* Lookup TLSA record for host/port.
+Return:  OK		success with dnssec; DANE mode
+         DEFER		Do not use this host now, may retry later
+	 FAIL_FORCED	No TLSA record; DANE not usable
+	 FAIL		Do not use this connection
+*/
+
 int
-tlsa_lookup(const host_item * host, dns_answer * dnsa,
-  BOOL dane_required, BOOL * dane)
+tlsa_lookup(const host_item * host, dns_answer * dnsa, BOOL dane_required)
 {
 /* move this out to host.c given the similarity to dns_lookup() ? */
 uschar buffer[300];
@@ -1228,25 +1216,25 @@ const uschar * fullname = buffer;
 
 switch (dns_lookup(dnsa, buffer, T_TLSA, &fullname))
   {
-  case DNS_AGAIN:
-    return DEFER; /* just defer this TLS'd conn */
-
-  default:
-  case DNS_FAIL:
-    if (dane_required)
-      return FAIL;
-    break;
-
   case DNS_SUCCEED:
     if (!dns_is_secure(dnsa))
       {
       log_write(0, LOG_MAIN, "DANE error: TLSA lookup not DNSSEC");
       return DEFER;
       }
-    *dane = TRUE;
-    break;
+    return OK;
+
+  case DNS_AGAIN:
+    return DEFER; /* just defer this TLS'd conn */
+
+  case DNS_NODATA:	/* no TLSA RR for this lookup */
+  case DNS_NOMATCH:	/* no records at all for this lookup */
+    return dane_required ? FAIL : FAIL_FORCED;
+
+  default:
+  case DNS_FAIL:
+    return dane_required ? FAIL : DEFER;
   }
-return OK;
 }
 #endif
 
@@ -1311,7 +1299,6 @@ we will veto this new message.  */
 static BOOL
 smtp_are_same_identities(uschar * message_id, smtp_compare_t * s_compare)
 {
-
 uschar * message_local_identity,
        * current_local_identity,
        * new_sender_address;
@@ -1334,45 +1321,146 @@ uschar
 ehlo_response(uschar * buf, size_t bsize, uschar checks)
 {
 #ifdef SUPPORT_TLS
-if (checks & PEER_OFFERED_TLS)
-  if (pcre_exec(regex_STARTTLS, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
-    checks &= ~PEER_OFFERED_TLS;
+if (  checks & PEER_OFFERED_TLS
+   && pcre_exec(regex_STARTTLS, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
+  checks &= ~PEER_OFFERED_TLS;
 #endif
 
-  if (  checks & PEER_OFFERED_IGNQ
-     && pcre_exec(regex_IGNOREQUOTA, NULL, CS buf, bsize, 0,
-		  PCRE_EOPT, NULL, 0) < 0)
-    checks &= ~PEER_OFFERED_IGNQ;
+if (  checks & PEER_OFFERED_IGNQ
+   && pcre_exec(regex_IGNOREQUOTA, NULL, CS buf, bsize, 0,
+		PCRE_EOPT, NULL, 0) < 0)
+  checks &= ~PEER_OFFERED_IGNQ;
+
+if (  checks & PEER_OFFERED_CHUNKING
+   && pcre_exec(regex_CHUNKING, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
+  checks &= ~PEER_OFFERED_CHUNKING;
 
 #ifndef DISABLE_PRDR
-  if (  checks & PEER_OFFERED_PRDR
-     && pcre_exec(regex_PRDR, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
-    checks &= ~PEER_OFFERED_PRDR;
+if (  checks & PEER_OFFERED_PRDR
+   && pcre_exec(regex_PRDR, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
+  checks &= ~PEER_OFFERED_PRDR;
 #endif
 
 #ifdef SUPPORT_I18N
-  if (  checks & PEER_OFFERED_UTF8
-     && pcre_exec(regex_UTF8, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
-    checks &= ~PEER_OFFERED_UTF8;
+if (  checks & PEER_OFFERED_UTF8
+   && pcre_exec(regex_UTF8, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
+  checks &= ~PEER_OFFERED_UTF8;
 #endif
 
-  if (  checks & PEER_OFFERED_DSN
-     && pcre_exec(regex_DSN, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
-    checks &= ~PEER_OFFERED_DSN;
+if (  checks & PEER_OFFERED_DSN
+   && pcre_exec(regex_DSN, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
+  checks &= ~PEER_OFFERED_DSN;
 
-  if (  checks & PEER_OFFERED_PIPE
-     && pcre_exec(regex_PIPELINING, NULL, CS buf, bsize, 0,
-		  PCRE_EOPT, NULL, 0) < 0)
-    checks &= ~PEER_OFFERED_PIPE;
+if (  checks & PEER_OFFERED_PIPE
+   && pcre_exec(regex_PIPELINING, NULL, CS buf, bsize, 0,
+		PCRE_EOPT, NULL, 0) < 0)
+  checks &= ~PEER_OFFERED_PIPE;
 
-  if (  checks & PEER_OFFERED_SIZE
-     && pcre_exec(regex_SIZE, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
-    checks &= ~PEER_OFFERED_SIZE;
+if (  checks & PEER_OFFERED_SIZE
+   && pcre_exec(regex_SIZE, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
+  checks &= ~PEER_OFFERED_SIZE;
 
 return checks;
 }
 
 
+
+/* Callback for emitting a BDAT data chunk header.
+
+If given a nonzero size, first flush any buffered SMTP commands
+then emit the command.
+
+Reap previous SMTP command responses if requested.
+Reap one SMTP command response if requested.
+
+Returns:	OK or ERROR
+*/
+
+static int
+smtp_chunk_cmd_callback(int fd, transport_ctx * tctx,
+  unsigned chunk_size, unsigned flags)
+{
+smtp_transport_options_block * ob =
+  (smtp_transport_options_block *)(tctx->tblock->options_block);
+int cmd_count = 0;
+int prev_cmd_count;
+uschar * buffer = tctx->buffer;
+
+
+/* Write SMTP chunk header command */
+
+if (chunk_size > 0)
+  if((cmd_count = smtp_write_command(tctx->outblock, FALSE, "BDAT %u%s\r\n",
+			      chunk_size,
+			      flags & tc_chunk_last ? " LAST" : "")
+     ) < 0) return ERROR;
+
+prev_cmd_count = cmd_count += tctx->cmd_count;
+
+/* Reap responses for any previous, but not one we just emitted */
+
+if (chunk_size > 0)
+  prev_cmd_count--;
+if (tctx->pending_BDAT)
+  prev_cmd_count--;
+
+if (flags & tc_reap_prev  &&  prev_cmd_count > 0)
+  {
+  DEBUG(D_transport) debug_printf("look for %d responses"
+    " for previous pipelined cmds\n", prev_cmd_count);
+
+  switch(sync_responses(tctx->first_addr, tctx->tblock->rcpt_include_affixes,
+	  tctx->sync_addr, tctx->host, prev_cmd_count,
+	  ob->address_retry_include_sender,
+	  tctx->pending_MAIL, 0,
+	  tctx->inblock,
+	  ob->command_timeout,
+	  buffer, DELIVER_BUFFER_SIZE))
+    {
+    case 1:				/* 2xx (only) => OK */
+    case 3: tctx->good_RCPT = TRUE;	/* 2xx & 5xx => OK & progress made */
+    case 2: *tctx->completed_address = TRUE; /* 5xx (only) => progress made */
+    case 0: break;			/* No 2xx or 5xx, but no probs */
+
+    case -1:				/* Timeout on RCPT */
+    default: return ERROR;		/* I/O error, or any MAIL/DATA error */
+    }
+  cmd_count = 1;
+  if (!tctx->pending_BDAT)
+    pipelining_active = FALSE;
+  }
+
+/* Reap response for an outstanding BDAT */
+
+if (tctx->pending_BDAT)
+  {
+  DEBUG(D_transport) debug_printf("look for one response for BDAT\n");
+
+  if (!smtp_read_response(tctx->inblock, buffer, DELIVER_BUFFER_SIZE, '2',
+       ob->command_timeout))
+    {
+    if (errno == 0 && buffer[0] == '4')
+      {
+      errno = ERRNO_DATA4XX;	/*XXX does this actually get used? */
+      tctx->first_addr->more_errno |=
+	((buffer[1] - '0')*10 + buffer[2] - '0') << 8;
+      }
+    return ERROR;
+    }
+  cmd_count--;
+  tctx->pending_BDAT = FALSE;
+  pipelining_active = FALSE;
+  }
+else if (chunk_size > 0)
+  tctx->pending_BDAT = TRUE;
+
+
+tctx->cmd_count = cmd_count;
+return OK;
+}
+
+
+
 /*************************************************
 *       Deliver address list to given host       *
 *************************************************/
@@ -1432,27 +1520,33 @@ int rc;
 time_t start_delivery_time = time(NULL);
 smtp_transport_options_block *ob =
   (smtp_transport_options_block *)(tblock->options_block);
-BOOL lmtp = strcmpic(ob->protocol, US"lmtp") == 0;
-BOOL smtps = strcmpic(ob->protocol, US"smtps") == 0;
-BOOL ok = FALSE;
-BOOL send_rset = TRUE;
-BOOL send_quit = TRUE;
-BOOL setting_up = TRUE;
-BOOL completed_address = FALSE;
-BOOL esmtp = TRUE;
-BOOL pending_MAIL;
-BOOL pass_message = FALSE;
-uschar peer_offered = 0;	/*XXX should this be handed on cf. tls_offered, smtp_use_dsn ? */
+struct lflags {
+  BOOL lmtp:1;
+  BOOL smtps:1;
+  BOOL ok:1;
+  BOOL send_rset:1;
+  BOOL send_quit:1;
+  BOOL setting_up:1;
+  BOOL esmtp:1;
+  BOOL esmtp_sent:1;
+  BOOL pending_MAIL:1;
 #ifndef DISABLE_PRDR
-BOOL prdr_active;
+  BOOL prdr_active:1;
 #endif
 #ifdef SUPPORT_I18N
-BOOL utf8_needed = FALSE;
+  BOOL utf8_needed:1;
 #endif
-BOOL dsn_all_lasthop = TRUE;
+  BOOL dsn_all_lasthop:1;
+#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
+  BOOL dane:1;
+  BOOL dane_required:1;
+#endif
+} lflags;
+
+BOOL pass_message = FALSE;
+BOOL completed_address = FALSE;
+uschar peer_offered = 0;
 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
-BOOL dane = FALSE;
-BOOL dane_required = verify_check_given_host(&ob->hosts_require_dane, host) == OK;
 dns_answer tlsa_dnsa;
 #endif
 smtp_inblock inblock;
@@ -1469,14 +1563,32 @@ uschar *helo_data = NULL;
 uschar *message = NULL;
 uschar new_message_id[MESSAGE_ID_LENGTH + 1];
 uschar *p;
-uschar buffer[4096];
+uschar buffer[DELIVER_BUFFER_SIZE];
 uschar inbuffer[4096];
 uschar outbuffer[4096];
 
 suppress_tls = suppress_tls;  /* stop compiler warning when no TLS support */
 
+lflags.lmtp = strcmpic(ob->protocol, US"lmtp") == 0;
+lflags.smtps = strcmpic(ob->protocol, US"smtps") == 0;
+lflags.ok = FALSE;
+lflags.send_rset = TRUE;
+lflags.send_quit = TRUE;
+lflags.setting_up = TRUE;
+lflags.esmtp = TRUE;
+lflags.esmtp_sent = FALSE;
+#ifdef SUPPORT_I18N
+lflags.utf8_needed = FALSE;
+#endif
+lflags.dsn_all_lasthop = TRUE;
+#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
+lflags.dane = FALSE;
+lflags.dane_required = verify_check_given_host(&ob->hosts_require_dane, host) == OK;
+#endif
+
 *message_defer = FALSE;
 smtp_command = US"initial connection";
+buffer[0] = '\0';
 if (max_rcpt == 0) max_rcpt = 999999;
 
 /* Set up the buffer for reading SMTP response packets. */
@@ -1513,7 +1625,7 @@ afterward as we're in a subprocess. */
 tls_modify_variables(&tls_out);
 
 #ifndef SUPPORT_TLS
-if (smtps)
+if (lflags.smtps)
   {
   set_errno_nohost(addrlist, ERRNO_TLSFAILURE, US"TLS support not available",
 	    DEFER, FALSE);
@@ -1533,7 +1645,7 @@ if (continue_hostname == NULL)
 
   if (inblock.sock < 0)
     {
-    set_errno_nohost(addrlist, (errno == ETIMEDOUT)? ERRNO_CONNECTTIMEOUT : errno,
+    set_errno_nohost(addrlist, errno == ETIMEDOUT ? ERRNO_CONNECTTIMEOUT : errno,
       NULL, DEFER, FALSE);
     return DEFER;
     }
@@ -1545,29 +1657,29 @@ if (continue_hostname == NULL)
 
     if (host->dnssec == DS_YES)
       {
-      if(  (  dane_required
-	   || verify_check_given_host(&ob->hosts_try_dane, host) == OK
-	   )
-	&& (rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK
-	&& dane_required	/* do not error on only dane-requested */
+      if(  lflags.dane_required
+	|| verify_check_given_host(&ob->hosts_try_dane, host) == OK
 	)
-	{
-	set_errno_nohost(addrlist, ERRNO_DNSDEFER,
-	  string_sprintf("DANE error: tlsa lookup %s",
-	    rc == DEFER ? "DEFER" : "FAIL"),
-	  rc, FALSE);
-	return rc;
-	}
+	switch (rc = tlsa_lookup(host, &tlsa_dnsa, lflags.dane_required))
+	  {
+	  case OK:		lflags.dane = TRUE; break;
+	  case FAIL_FORCED:	break;
+	  default:		set_errno_nohost(addrlist, ERRNO_DNSDEFER,
+				  string_sprintf("DANE error: tlsa lookup %s",
+				    rc == DEFER ? "DEFER" : "FAIL"),
+				  rc, FALSE);
+				return rc;
+	  }
       }
-    else if (dane_required)
+    else if (lflags.dane_required)
       {
       set_errno_nohost(addrlist, ERRNO_DNSDEFER,
 	string_sprintf("DANE error: %s lookup not DNSSEC", host->name),
 	FAIL, FALSE);
-      return  FAIL;
+      return FAIL;
       }
 
-    if (dane)
+    if (lflags.dane)
       ob->tls_tempfail_tryclear = FALSE;
     }
 #endif	/*DANE*/
@@ -1595,9 +1707,14 @@ if (continue_hostname == NULL)
   is nevertheless a reasonably clean way of programming this kind of logic,
   where you want to escape on any error. */
 
-  if (!smtps)
+  if (!lflags.smtps)
     {
-    BOOL good_response = smtp_read_response(&inblock, buffer, sizeof(buffer),
+    BOOL good_response;
+
+#ifdef TCP_QUICKACK
+    (void) setsockopt(inblock.sock, IPPROTO_TCP, TCP_QUICKACK, US &off, sizeof(off));
+#endif
+    good_response = smtp_read_response(&inblock, buffer, sizeof(buffer),
       '2', ob->command_timeout);
 #ifdef EXPERIMENTAL_DSN_INFO
     smtp_greeting = string_copy(buffer);
@@ -1624,7 +1741,7 @@ if (continue_hostname == NULL)
     /* Now check if the helo_data expansion went well, and sign off cleanly if
     it didn't. */
 
-    if (helo_data == NULL)
+    if (!helo_data)
       {
       uschar *message = string_sprintf("failed to expand helo_data: %s",
         expand_string_message);
@@ -1669,15 +1786,15 @@ goto SEND_QUIT;
   mailers use upper case for some reason (the RFC is quite clear about case
   independence) so, for peace of mind, I gave in. */
 
-  esmtp = verify_check_given_host(&ob->hosts_avoid_esmtp, host) != OK;
+  lflags.esmtp = verify_check_given_host(&ob->hosts_avoid_esmtp, host) != OK;
 
   /* Alas; be careful, since this goto is not an error-out, so conceivably
   we might set data between here and the target which we assume to exist
   and be usable.  I can see this coming back to bite us. */
 #ifdef SUPPORT_TLS
-  if (smtps)
+  if (lflags.smtps)
     {
-    tls_offered = TRUE;
+    smtp_peer_options |= PEER_OFFERED_TLS;
     suppress_tls = FALSE;
     ob->tls_tempfail_tryclear = FALSE;
     smtp_command = US"SSL-on-connect";
@@ -1685,69 +1802,88 @@ goto SEND_QUIT;
     }
 #endif
 
-  if (esmtp)
+  if (lflags.esmtp)
     {
     if (smtp_write_command(&outblock, FALSE, "%s %s\r\n",
-         lmtp? "LHLO" : "EHLO", helo_data) < 0)
+         lflags.lmtp ? "LHLO" : "EHLO", helo_data) < 0)
       goto SEND_FAILED;
+    lflags.esmtp_sent = TRUE;
     if (!smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
            ob->command_timeout))
       {
-      if (errno != 0 || buffer[0] == 0 || lmtp)
+      if (errno != 0 || buffer[0] == 0 || lflags.lmtp)
 	{
 #ifdef EXPERIMENTAL_DSN_INFO
 	helo_response = string_copy(buffer);
 #endif
 	goto RESPONSE_FAILED;
 	}
-      esmtp = FALSE;
+      lflags.esmtp = FALSE;
       }
 #ifdef EXPERIMENTAL_DSN_INFO
     helo_response = string_copy(buffer);
 #endif
     }
   else
-    {
     DEBUG(D_transport)
       debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
-    }
 
-  if (!esmtp)
+  if (!lflags.esmtp)
     {
     BOOL good_response;
+    int n = sizeof(buffer);
+    uschar * rsp = buffer;
+
+    if (lflags.esmtp_sent && (n = Ustrlen(buffer)) < sizeof(buffer)/2)
+      { rsp = buffer + n + 1; n = sizeof(buffer) - n; }
 
     if (smtp_write_command(&outblock, FALSE, "HELO %s\r\n", helo_data) < 0)
       goto SEND_FAILED;
-    good_response = smtp_read_response(&inblock, buffer, sizeof(buffer),
+    good_response = smtp_read_response(&inblock, rsp, n,
       '2', ob->command_timeout);
 #ifdef EXPERIMENTAL_DSN_INFO
-    helo_response = string_copy(buffer);
+    helo_response = string_copy(rsp);
 #endif
-    if (!good_response) goto RESPONSE_FAILED;
+    if (!good_response)
+      {
+      /* Handle special logging for a closed connection after HELO
+      when had previously sent EHLO */
+
+      if (rsp != buffer && rsp[0] == 0 && (errno == 0 || errno == ECONNRESET))
+	{
+	message = NULL;
+	lflags.send_quit = FALSE;
+	save_errno = ERRNO_SMTPCLOSED;
+	message = string_sprintf("Remote host closed connection "
+	      "in response to %s (EHLO response was: %s)",
+	      smtp_command, buffer);
+	goto FAILED;
+	}
+      Ustrncpy(buffer, rsp, sizeof(buffer)/2);
+      goto RESPONSE_FAILED;
+      }
     }
 
-  if (esmtp || lmtp)
+  peer_offered = smtp_peer_options = 0;
+
+  if (lflags.esmtp || lflags.lmtp)
+    {
     peer_offered = ehlo_response(buffer, Ustrlen(buffer),
-      PEER_OFFERED_TLS
-      | 0	/* IGNQ checked later */
-      | 0	/* PRDR checked later */
-      | 0	/* UTF8 checked later */
-      | 0	/* DSN  checked later */
-      | 0	/* PIPE checked later */
-      | 0	/* SIZE checked later */
+      PEER_OFFERED_TLS	/* others checked later */
       );
 
   /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
 
 #ifdef SUPPORT_TLS
-  tls_offered = !!(peer_offered & PEER_OFFERED_TLS);
+    smtp_peer_options |= peer_offered & PEER_OFFERED_TLS;
 #endif
+    }
   }
 
 /* For continuing deliveries down the same channel, the socket is the standard
 input, and we don't need to redo EHLO here (but may need to do so for TLS - see
 below). Set up the pointer to where subsequent commands will be left, for
-error messages. Note that smtp_use_size and smtp_use_pipelining will have been
+error messages. Note that smtp_peer_options will have been
 set from the command line if they were set in the process that passed the
 connection on. */
 
@@ -1772,7 +1908,7 @@ the client not be required to use TLS. If the response is bad, copy the buffer
 for error analysis. */
 
 #ifdef SUPPORT_TLS
-if (  tls_offered
+if (  smtp_peer_options & PEER_OFFERED_TLS
    && !suppress_tls
    && verify_check_given_host(&ob->hosts_avoid_tls, host) != OK)
   {
@@ -1790,8 +1926,10 @@ if (  tls_offered
   if (!smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
       ob->command_timeout))
     {
-    if (errno != 0 || buffer2[0] == 0 ||
-         (buffer2[0] == '4' && !ob->tls_tempfail_tryclear))
+    if (  errno != 0
+       || buffer2[0] == 0
+       || (buffer2[0] == '4' && !ob->tls_tempfail_tryclear)
+       )
       {
       Ustrncpy(buffer, buffer2, sizeof(buffer));
       goto RESPONSE_FAILED;
@@ -1805,7 +1943,7 @@ if (  tls_offered
     {
     int rc = tls_client_start(inblock.sock, host, addrlist, tblock
 # ifdef EXPERIMENTAL_DANE
-			     , dane ? &tlsa_dnsa : NULL
+			     , lflags.dane ? &tlsa_dnsa : NULL
 # endif
 			     );
 
@@ -1816,24 +1954,20 @@ if (  tls_offered
     if (rc != OK)
       {
 # ifdef EXPERIMENTAL_DANE
-      if (rc == DEFER && dane && !dane_required)
-	{
-	log_write(0, LOG_MAIN, "DANE attempt failed;"
-	  " trying CA-root TLS to %s [%s] (not in hosts_require_dane)",
+      if (lflags.dane) log_write(0, LOG_MAIN,
+	  "DANE attempt failed; no TLS connection to %s [%s]",
 	  host->name, host->address);
-	dane = FALSE;
-	goto TLS_NEGOTIATE;
-	}
 # endif
 
       save_errno = ERRNO_TLSFAILURE;
       message = US"failure while setting up TLS session";
-      send_quit = FALSE;
+      lflags.send_quit = FALSE;
       goto TLS_FAILED;
       }
 
     /* TLS session is set up */
 
+    smtp_peer_options_wrap = smtp_peer_options;
     for (addr = addrlist; addr; addr = addr->next)
       if (addr->transport_return == PENDING_DEFER)
         {
@@ -1875,7 +2009,7 @@ if (tls_out.active >= 0)
     }
 
   /* For SMTPS we need to wait for the initial OK response. */
-  if (smtps)
+  if (lflags.smtps)
     {
     good_response = smtp_read_response(&inblock, buffer, sizeof(buffer),
       '2', ob->command_timeout);
@@ -1885,7 +2019,7 @@ if (tls_out.active >= 0)
     if (!good_response) goto RESPONSE_FAILED;
     }
 
-  if (esmtp)
+  if (lflags.esmtp)
     greeting_cmd = "EHLO";
   else
     {
@@ -1895,7 +2029,7 @@ if (tls_out.active >= 0)
     }
 
   if (smtp_write_command(&outblock, FALSE, "%s %s\r\n",
-        lmtp? "LHLO" : greeting_cmd, helo_data) < 0)
+        lflags.lmtp ? "LHLO" : greeting_cmd, helo_data) < 0)
     goto SEND_FAILED;
   good_response = smtp_read_response(&inblock, buffer, sizeof(buffer),
     '2', ob->command_timeout);
@@ -1903,22 +2037,23 @@ if (tls_out.active >= 0)
   helo_response = string_copy(buffer);
 #endif
   if (!good_response) goto RESPONSE_FAILED;
+  smtp_peer_options = 0;
   }
 
 /* If the host is required to use a secure channel, ensure that we
 have one. */
 
-else if (
+else if (  lflags.smtps
 # ifdef EXPERIMENTAL_DANE
-	dane ||
+	|| lflags.dane
 # endif
-        verify_check_given_host(&ob->hosts_require_tls, host) == OK
+        || verify_check_given_host(&ob->hosts_require_tls, host) == OK
 	)
   {
   save_errno = ERRNO_TLSREQUIRED;
   message = string_sprintf("a TLS session is required, but %s",
-    tls_offered? "an attempt to start TLS failed" :
-                 "the server did not offer TLS support");
+    smtp_peer_options & PEER_OFFERED_TLS
+    ? "an attempt to start TLS failed" : "the server did not offer TLS support");
   goto TLS_FAILED;
   }
 #endif	/*SUPPORT_TLS*/
@@ -1934,14 +2069,16 @@ if (continue_hostname == NULL
 #endif
     )
   {
-  if (esmtp || lmtp)
+  if (lflags.esmtp || lflags.lmtp)
+    {
     peer_offered = ehlo_response(buffer, Ustrlen(buffer),
       0 /* no TLS */
-      | (lmtp && ob->lmtp_ignore_quota ? PEER_OFFERED_IGNQ : 0)
+      | (lflags.lmtp && ob->lmtp_ignore_quota ? PEER_OFFERED_IGNQ : 0)
+      | PEER_OFFERED_CHUNKING
       | PEER_OFFERED_PRDR
 #ifdef SUPPORT_I18N
       | (addrlist->prop.utf8_msg ? PEER_OFFERED_UTF8 : 0)
-      	/*XXX if we hand peercaps on to continued-conn processes,
+	/*XXX if we hand peercaps on to continued-conn processes,
 	      must not depend on this addr */
 #endif
       | PEER_OFFERED_DSN
@@ -1949,70 +2086,82 @@ if (continue_hostname == NULL
       | (ob->size_addition >= 0 ? PEER_OFFERED_SIZE : 0)
       );
 
-  /* Set for IGNOREQUOTA if the response to LHLO specifies support and the
-  lmtp_ignore_quota option was set. */
+    /* Set for IGNOREQUOTA if the response to LHLO specifies support and the
+    lmtp_ignore_quota option was set. */
 
-  igquotstr = peer_offered & PEER_OFFERED_IGNQ ? US" IGNOREQUOTA" : US"";
+    igquotstr = peer_offered & PEER_OFFERED_IGNQ ? US" IGNOREQUOTA" : US"";
 
-  /* If the response to EHLO specified support for the SIZE parameter, note
-  this, provided size_addition is non-negative. */
+    /* If the response to EHLO specified support for the SIZE parameter, note
+    this, provided size_addition is non-negative. */
 
-  smtp_use_size = !!(peer_offered & PEER_OFFERED_SIZE);
+    smtp_peer_options |= peer_offered & PEER_OFFERED_SIZE;
 
-  /* Note whether the server supports PIPELINING. If hosts_avoid_esmtp matched
-  the current host, esmtp will be false, so PIPELINING can never be used. If
-  the current host matches hosts_avoid_pipelining, don't do it. */
+    /* Note whether the server supports PIPELINING. If hosts_avoid_esmtp matched
+    the current host, esmtp will be false, so PIPELINING can never be used. If
+    the current host matches hosts_avoid_pipelining, don't do it. */
 
-  smtp_use_pipelining = peer_offered & PEER_OFFERED_PIPE
-    && verify_check_given_host(&ob->hosts_avoid_pipelining, host) != OK;
+    if (  peer_offered & PEER_OFFERED_PIPE
+       && verify_check_given_host(&ob->hosts_avoid_pipelining, host) != OK)
+      smtp_peer_options |= PEER_OFFERED_PIPE;
 
-  DEBUG(D_transport) debug_printf("%susing PIPELINING\n",
-    smtp_use_pipelining ? "" : "not ");
+    DEBUG(D_transport) debug_printf("%susing PIPELINING\n",
+      smtp_peer_options & PEER_OFFERED_PIPE ? "" : "not ");
+
+    if (  peer_offered & PEER_OFFERED_CHUNKING
+       && verify_check_given_host(&ob->hosts_try_chunking, host) != OK)
+      peer_offered &= ~PEER_OFFERED_CHUNKING;
+
+    if (peer_offered & PEER_OFFERED_CHUNKING)
+      {DEBUG(D_transport) debug_printf("CHUNKING usable\n");}
 
 #ifndef DISABLE_PRDR
-  if (  peer_offered & PEER_OFFERED_PRDR
-     && verify_check_given_host(&ob->hosts_try_prdr, host) != OK)
-    peer_offered &= ~PEER_OFFERED_PRDR;
+    if (  peer_offered & PEER_OFFERED_PRDR
+       && verify_check_given_host(&ob->hosts_try_prdr, host) != OK)
+      peer_offered &= ~PEER_OFFERED_PRDR;
 
-  if (peer_offered & PEER_OFFERED_PRDR)
-    {DEBUG(D_transport) debug_printf("PRDR usable\n");}
+    if (peer_offered & PEER_OFFERED_PRDR)
+      {DEBUG(D_transport) debug_printf("PRDR usable\n");}
 #endif
 
-  /* Note if the server supports DSN */
-  smtp_use_dsn = !!(peer_offered & PEER_OFFERED_DSN);
-  DEBUG(D_transport) debug_printf("%susing DSN\n", smtp_use_dsn ? "" : "not ");
+    /* Note if the server supports DSN */
+    smtp_peer_options |= peer_offered & PEER_OFFERED_DSN;
+    DEBUG(D_transport) debug_printf("%susing DSN\n",
+			peer_offered & PEER_OFFERED_DSN ? "" : "not ");
 
-  /* Note if the response to EHLO specifies support for the AUTH extension.
-  If it has, check that this host is one we want to authenticate to, and do
-  the business. The host name and address must be available when the
-  authenticator's client driver is running. */
+    /* Note if the response to EHLO specifies support for the AUTH extension.
+    If it has, check that this host is one we want to authenticate to, and do
+    the business. The host name and address must be available when the
+    authenticator's client driver is running. */
 
-  switch (yield = smtp_auth(buffer, sizeof(buffer), addrlist, host,
-			    ob, esmtp, &inblock, &outblock))
-    {
-    default:		goto SEND_QUIT;
-    case OK:		break;
-    case FAIL_SEND:	goto SEND_FAILED;
-    case FAIL:		goto RESPONSE_FAILED;
+    switch (yield = smtp_auth(buffer, sizeof(buffer), addrlist, host,
+			      ob, lflags.esmtp, &inblock, &outblock))
+      {
+      default:		goto SEND_QUIT;
+      case OK:		break;
+      case FAIL_SEND:	goto SEND_FAILED;
+      case FAIL:	goto RESPONSE_FAILED;
+      }
     }
   }
+pipelining_active = !!(smtp_peer_options & PEER_OFFERED_PIPE);
 
 /* The setting up of the SMTP call is now complete. Any subsequent errors are
 message-specific. */
 
-setting_up = FALSE;
+lflags.setting_up = FALSE;
 
 #ifdef SUPPORT_I18N
 if (addrlist->prop.utf8_msg)
   {
-  utf8_needed =  !addrlist->prop.utf8_downcvt
-	      && !addrlist->prop.utf8_downcvt_maybe;
-  DEBUG(D_transport) if (!utf8_needed) debug_printf("utf8: %s downconvert\n",
-    addrlist->prop.utf8_downcvt ? "mandatory" : "optional");
+  lflags.utf8_needed = !addrlist->prop.utf8_downcvt
+		    && !addrlist->prop.utf8_downcvt_maybe;
+  DEBUG(D_transport) if (!lflags.utf8_needed)
+    debug_printf("utf8: %s downconvert\n",
+      addrlist->prop.utf8_downcvt ? "mandatory" : "optional");
   }
 
 /* If this is an international message we need the host to speak SMTPUTF8 */
-if (utf8_needed && !(peer_offered & PEER_OFFERED_UTF8))
+if (lflags.utf8_needed && !(peer_offered & PEER_OFFERED_UTF8))
   {
   errno = ERRNO_UTF8_FWD;
   goto RESPONSE_FAILED;
@@ -2025,10 +2174,10 @@ set it up. This cannot be done until the identify of the host is known. */
 if (tblock->filter_command != NULL)
   {
   BOOL rc;
-  uschar buffer[64];
-  sprintf(CS buffer, "%.50s transport", tblock->name);
+  uschar fbuf[64];
+  sprintf(CS fbuf, "%.50s transport", tblock->name);
   rc = transport_set_up_command(&transport_filter_argv, tblock->filter_command,
-    TRUE, DEFER, addrlist, buffer, NULL);
+    TRUE, DEFER, addrlist, fbuf, NULL);
   transport_filter_timeout = tblock->filter_timeout;
 
   /* On failure, copy the error to all addresses, abandon the SMTP call, and
@@ -2041,6 +2190,16 @@ if (tblock->filter_command != NULL)
     yield = ERROR;
     goto SEND_QUIT;
     }
+
+  if (  transport_filter_argv
+     && *transport_filter_argv
+     && **transport_filter_argv
+     && peer_offered & PEER_OFFERED_CHUNKING
+     )
+    {
+    peer_offered &= ~PEER_OFFERED_CHUNKING;
+    DEBUG(D_transport) debug_printf("CHUNKING not usable due to transport filter\n");
+    }
   }
 
 
@@ -2055,8 +2214,8 @@ transaction to handle. */
 SEND_MESSAGE:
 sync_addr = first_addr;
 address_count = 0;
-ok = FALSE;
-send_rset = TRUE;
+lflags.ok = FALSE;
+lflags.send_rset = TRUE;
 completed_address = FALSE;
 
 
@@ -2070,14 +2229,14 @@ included in the count.) */
 p = buffer;
 *p = 0;
 
-if (smtp_use_size)
+if (peer_offered & PEER_OFFERED_SIZE)
   {
   sprintf(CS p, " SIZE=%d", message_size+message_linecount+ob->size_addition);
   while (*p) p++;
   }
 
 #ifndef DISABLE_PRDR
-prdr_active = FALSE;
+lflags.prdr_active = FALSE;
 if (peer_offered & PEER_OFFERED_PRDR)
   for (addr = first_addr; addr; addr = addr->next)
     if (addr->transport_return == PENDING_DEFER)
@@ -2085,7 +2244,7 @@ if (peer_offered & PEER_OFFERED_PRDR)
       for (addr = addr->next; addr; addr = addr->next)
         if (addr->transport_return == PENDING_DEFER)
 	  {			/* at least two recipients to send */
-	  prdr_active = TRUE;
+	  lflags.prdr_active = TRUE;
 	  sprintf(CS p, " PRDR"); p += 5;
 	  break;
 	  }
@@ -2103,30 +2262,25 @@ if (  addrlist->prop.utf8_msg
 
 /* check if all addresses have lasthop flag */
 /* do not send RET and ENVID if true */
-for (dsn_all_lasthop = TRUE, addr = first_addr;
+for (lflags.dsn_all_lasthop = TRUE, addr = first_addr;
      address_count < max_rcpt && addr != NULL;
      addr = addr->next)
   if ((addr->dsn_flags & rf_dsnlasthop) != 1)
     {
-    dsn_all_lasthop = FALSE;
+    lflags.dsn_all_lasthop = FALSE;
     break;
     }
 
 /* Add any DSN flags to the mail command */
 
-if (smtp_use_dsn && !dsn_all_lasthop)
+if (peer_offered & PEER_OFFERED_DSN && !lflags.dsn_all_lasthop)
   {
   if (dsn_ret == dsn_ret_hdrs)
-    {
-    Ustrcpy(p, " RET=HDRS");
-    while (*p) p++;
-    }
+    { Ustrcpy(p, " RET=HDRS"); p += 9; }
   else if (dsn_ret == dsn_ret_full)
-    {
-    Ustrcpy(p, " RET=FULL");
-    while (*p) p++;
-    }
-  if (dsn_envid != NULL)
+    { Ustrcpy(p, " RET=FULL"); p += 9; }
+
+  if (dsn_envid)
     {
     string_format(p, sizeof(buffer) - (p-buffer), " ENVID=%s", dsn_envid);
     while (*p) p++;
@@ -2152,7 +2306,7 @@ at any point, for when the buffer fills up, so we write it totally generally.
 When PIPELINING is off, each command written reports that it has flushed the
 buffer. */
 
-pending_MAIL = TRUE;     /* The block starts with MAIL */
+lflags.pending_MAIL = TRUE;     /* The block starts with MAIL */
 
   {
   uschar * s = return_path;
@@ -2177,7 +2331,7 @@ pending_MAIL = TRUE;     /* The block starts with MAIL */
     }
 #endif
 
-  rc = smtp_write_command(&outblock, smtp_use_pipelining,
+  rc = smtp_write_command(&outblock, pipelining_active,
 	  "MAIL FROM:<%s>%s\r\n", s, buffer);
   }
 
@@ -2199,7 +2353,7 @@ switch(rc)
 	}
       goto RESPONSE_FAILED;
       }
-    pending_MAIL = FALSE;
+    lflags.pending_MAIL = FALSE;
     break;
   }
 
@@ -2217,28 +2371,28 @@ the PENDING_DEFER status, because only one attempt is ever made, and we know
 that max_rcpt will be large, so all addresses will be done at once. */
 
 for (addr = first_addr;
-     address_count < max_rcpt && addr != NULL;
+     addr  &&  address_count < max_rcpt;
      addr = addr->next)
+    if (addr->transport_return == PENDING_DEFER)
   {
   int count;
   BOOL no_flush;
   uschar * rcpt_addr;
 
-  addr->dsn_aware = smtp_use_dsn ? dsn_support_yes : dsn_support_no;
-
-  if (addr->transport_return != PENDING_DEFER) continue;
+  addr->dsn_aware = peer_offered & PEER_OFFERED_DSN
+    ? dsn_support_yes : dsn_support_no;
 
   address_count++;
-  no_flush = smtp_use_pipelining && (!mua_wrapper || addr->next != NULL);
+  no_flush = pipelining_active && (!mua_wrapper || addr->next);
 
   /* Add any DSN flags to the rcpt command and add to the sent string */
 
   p = buffer;
   *p = 0;
 
-  if (smtp_use_dsn && (addr->dsn_flags & rf_dsnlasthop) != 1)
+  if (peer_offered & PEER_OFFERED_DSN && !(addr->dsn_flags & rf_dsnlasthop))
     {
-    if ((addr->dsn_flags & rf_dsnflags) != 0)
+    if (addr->dsn_flags & rf_dsnflags)
       {
       int i;
       BOOL first = TRUE;
@@ -2254,7 +2408,7 @@ for (addr = first_addr;
           }
       }
 
-    if (addr->dsn_orcpt != NULL)
+    if (addr->dsn_orcpt)
       {
       string_format(p, sizeof(buffer) - (p-buffer), " ORCPT=%s",
         addr->dsn_orcpt);
@@ -2291,22 +2445,22 @@ for (addr = first_addr;
     {
     switch(sync_responses(first_addr, tblock->rcpt_include_affixes,
              &sync_addr, host, count, ob->address_retry_include_sender,
-             pending_MAIL, 0, &inblock, ob->command_timeout, buffer,
+             lflags.pending_MAIL, 0, &inblock, ob->command_timeout, buffer,
              sizeof(buffer)))
       {
-      case 3: ok = TRUE;                   /* 2xx & 5xx => OK & progress made */
+      case 3: lflags.ok = TRUE;            /* 2xx & 5xx => OK & progress made */
       case 2: completed_address = TRUE;    /* 5xx (only) => progress made */
       break;
 
-      case 1: ok = TRUE;                   /* 2xx (only) => OK, but if LMTP, */
-      if (!lmtp) completed_address = TRUE; /* can't tell about progress yet */
+      case 1: lflags.ok = TRUE;            /* 2xx (only) => OK, but if LMTP, */
+      if (!lflags.lmtp) completed_address = TRUE; /* can't tell about progress yet */
       case 0:                              /* No 2xx or 5xx, but no probs */
       break;
 
       case -1: goto END_OFF;               /* Timeout on RCPT */
       default: goto RESPONSE_FAILED;       /* I/O error, or any MAIL error */
       }
-    pending_MAIL = FALSE;                  /* Dealt with MAIL */
+    lflags.pending_MAIL = FALSE;            /* Dealt with MAIL */
     }
   }      /* Loop for next address */
 
@@ -2323,7 +2477,7 @@ if (mua_wrapper)
       /*XXX could we find a better errno than 0 here? */
       set_errno_nohost(addrlist, 0, badaddr->message, FAIL,
 	testflag(badaddr, af_pass_message));
-      ok = FALSE;
+      lflags.ok = FALSE;
       break;
       }
   }
@@ -2332,33 +2486,34 @@ if (mua_wrapper)
 send DATA, but if it is FALSE (in the normal, non-wrapper case), we may still
 have a good recipient buffered up if we are pipelining. We don't want to waste
 time sending DATA needlessly, so we only send it if either ok is TRUE or if we
-are pipelining. The responses are all handled by sync_responses(). */
+are pipelining. The responses are all handled by sync_responses().
+If using CHUNKING, do not send a BDAT until we know how big a chunk we want
+to send is. */
 
-if (ok || (smtp_use_pipelining && !mua_wrapper))
+if (  !(peer_offered & PEER_OFFERED_CHUNKING)
+   && (lflags.ok || (pipelining_active && !mua_wrapper)))
   {
   int count = smtp_write_command(&outblock, FALSE, "DATA\r\n");
+
   if (count < 0) goto SEND_FAILED;
   switch(sync_responses(first_addr, tblock->rcpt_include_affixes, &sync_addr,
-           host, count, ob->address_retry_include_sender, pending_MAIL,
-           ok? +1 : -1, &inblock, ob->command_timeout, buffer, sizeof(buffer)))
+           host, count, ob->address_retry_include_sender, lflags.pending_MAIL,
+           lflags.ok ? +1 : -1, &inblock, ob->command_timeout, buffer, sizeof(buffer)))
     {
-    case 3: ok = TRUE;                   /* 2xx & 5xx => OK & progress made */
+    case 3: lflags.ok = TRUE;            /* 2xx & 5xx => OK & progress made */
     case 2: completed_address = TRUE;    /* 5xx (only) => progress made */
     break;
 
-    case 1: ok = TRUE;                   /* 2xx (only) => OK, but if LMTP, */
-    if (!lmtp) completed_address = TRUE; /* can't tell about progress yet */
+    case 1: lflags.ok = TRUE;            /* 2xx (only) => OK, but if LMTP, */
+    if (!lflags.lmtp) completed_address = TRUE; /* can't tell about progress yet */
     case 0: break;                       /* No 2xx or 5xx, but no probs */
 
     case -1: goto END_OFF;               /* Timeout on RCPT */
     default: goto RESPONSE_FAILED;       /* I/O error, or any MAIL/DATA error */
     }
+  pipelining_active = FALSE;
   }
 
-/* Save the first address of the next batch. */
-
-first_addr = addr;
-
 /* If there were no good recipients (but otherwise there have been no
 problems), just set ok TRUE, since we have handled address-specific errors
 already. Otherwise, it's OK to send the message. Use the check/escape mechanism
@@ -2366,42 +2521,74 @@ for handling the SMTP dot-handling protocol, flagging to apply to headers as
 well as body. Set the appropriate timeout value to be used for each chunk.
 (Haven't been able to make it work using select() for writing yet.) */
 
-if (!ok) ok = TRUE; else
+if (!(peer_offered & PEER_OFFERED_CHUNKING) && !lflags.ok)
+  {
+  /* Save the first address of the next batch. */
+  first_addr = addr;
+
+  lflags.ok = TRUE;
+  }
+else
   {
+  transport_ctx tctx = {
+    tblock,
+    addrlist,
+    US".", US"..",    /* Escaping strings */
+    topt_use_crlf | topt_escape_headers
+    | (tblock->body_only	? topt_no_headers : 0)
+    | (tblock->headers_only	? topt_no_body : 0)
+    | (tblock->return_path_add	? topt_add_return_path : 0)
+    | (tblock->delivery_date_add ? topt_add_delivery_date : 0)
+    | (tblock->envelope_to_add	? topt_add_envelope_to : 0)
+  };
+
+  /* If using CHUNKING we need a callback from the generic transport
+  support to us, for the sending of BDAT smtp commands and the reaping
+  of responses.  The callback needs a whole bunch of state so set up
+  a transport-context structure to be passed around. */
+
+  if (peer_offered & PEER_OFFERED_CHUNKING)
+    {
+    tctx.check_string = tctx.escape_string = NULL;
+    tctx.options |= topt_use_bdat;
+    tctx.chunk_cb = smtp_chunk_cmd_callback;
+    tctx.inblock = &inblock;
+    tctx.outblock = &outblock;
+    tctx.host = host;
+    tctx.first_addr = first_addr;
+    tctx.sync_addr = &sync_addr;
+    tctx.pending_MAIL = lflags.pending_MAIL;
+    tctx.pending_BDAT = FALSE;
+    tctx.good_RCPT = lflags.ok;
+    tctx.completed_address = &completed_address;
+    tctx.cmd_count = 0;
+    tctx.buffer = buffer;
+    }
+  else
+    tctx.options |= topt_end_dot;
+
+  /* Save the first address of the next batch. */
+  first_addr = addr;
+
+  /* Responses from CHUNKING commands go in buffer.  Otherwise,
+  there has not been a response. */
+
+  buffer[0] = 0;
+
   sigalrm_seen = FALSE;
   transport_write_timeout = ob->data_timeout;
   smtp_command = US"sending data block";   /* For error messages */
   DEBUG(D_transport|D_v)
-    debug_printf("  SMTP>> writing message and terminating \".\"\n");
+    if (peer_offered & PEER_OFFERED_CHUNKING)
+      debug_printf("         will write message using CHUNKING\n");
+    else
+      debug_printf("  SMTP>> writing message and terminating \".\"\n");
   transport_count = 0;
 
 #ifndef DISABLE_DKIM
-  ok = dkim_transport_write_message(addrlist, inblock.sock,
-    topt_use_crlf | topt_end_dot | topt_escape_headers |
-      (tblock->body_only? topt_no_headers : 0) |
-      (tblock->headers_only? topt_no_body : 0) |
-      (tblock->return_path_add? topt_add_return_path : 0) |
-      (tblock->delivery_date_add? topt_add_delivery_date : 0) |
-      (tblock->envelope_to_add? topt_add_envelope_to : 0),
-    0,            /* No size limit */
-    tblock->add_headers, tblock->remove_headers,
-    US".", US"..",    /* Escaping strings */
-    tblock->rewrite_rules, tblock->rewrite_existflags,
-    ob->dkim_private_key, ob->dkim_domain, ob->dkim_selector,
-    ob->dkim_canon, ob->dkim_strict, ob->dkim_sign_headers
-    );
+  lflags.ok = dkim_transport_write_message(inblock.sock, &tctx, &ob->dkim);
 #else
-  ok = transport_write_message(addrlist, inblock.sock,
-    topt_use_crlf | topt_end_dot | topt_escape_headers |
-      (tblock->body_only? topt_no_headers : 0) |
-      (tblock->headers_only? topt_no_body : 0) |
-      (tblock->return_path_add? topt_add_return_path : 0) |
-      (tblock->delivery_date_add? topt_add_delivery_date : 0) |
-      (tblock->envelope_to_add? topt_add_envelope_to : 0),
-    0,            /* No size limit */
-    tblock->add_headers, tblock->remove_headers,
-    US".", US"..",    /* Escaping strings */
-    tblock->rewrite_rules, tblock->rewrite_existflags);
+  lflags.ok = transport_write_message(inblock.sock, &tctx, 0);
 #endif
 
   /* transport_write_message() uses write() because it is called from other
@@ -2412,13 +2599,11 @@ if (!ok) ok = TRUE; else
   transport_write_timeout = 0;   /* for subsequent transports */
 
   /* Failure can either be some kind of I/O disaster (including timeout),
-  or the failure of a transport filter or the expansion of added headers. */
+  or the failure of a transport filter or the expansion of added headers.
+  Or, when CHUNKING, it can be a protocol-detected failure. */
 
-  if (!ok)
-    {
-    buffer[0] = 0;              /* There hasn't been a response */
+  if (!lflags.ok)
     goto RESPONSE_FAILED;
-    }
 
   /* We used to send the terminating "." explicitly here, but because of
   buffering effects at both ends of TCP/IP connections, you don't gain
@@ -2428,25 +2613,46 @@ if (!ok) ok = TRUE; else
 
   smtp_command = US"end of data";
 
+  if (peer_offered & PEER_OFFERED_CHUNKING && tctx.cmd_count > 1)
+    {
+    /* Reap any outstanding MAIL & RCPT commands, but not a DATA-go-ahead */
+    switch(sync_responses(first_addr, tblock->rcpt_include_affixes, &sync_addr,
+	     host, tctx.cmd_count-1, ob->address_retry_include_sender,
+	     lflags.pending_MAIL, 0,
+	     &inblock, ob->command_timeout, buffer, sizeof(buffer)))
+      {
+      case 3: lflags.ok = TRUE;            /* 2xx & 5xx => OK & progress made */
+      case 2: completed_address = TRUE;    /* 5xx (only) => progress made */
+      break;
+
+      case 1: lflags.ok = TRUE;            /* 2xx (only) => OK, but if LMTP, */
+      if (!lflags.lmtp) completed_address = TRUE; /* can't tell about progress yet */
+      case 0: break;                       /* No 2xx or 5xx, but no probs */
+
+      case -1: goto END_OFF;               /* Timeout on RCPT */
+      default: goto RESPONSE_FAILED;       /* I/O error, or any MAIL/DATA error */
+      }
+    }
+
 #ifndef DISABLE_PRDR
   /* For PRDR we optionally get a partial-responses warning
    * followed by the individual responses, before going on with
    * the overall response.  If we don't get the warning then deal
    * with per non-PRDR. */
-  if(prdr_active)
+  if(lflags.prdr_active)
     {
-    ok = smtp_read_response(&inblock, buffer, sizeof(buffer), '3',
+    lflags.ok = smtp_read_response(&inblock, buffer, sizeof(buffer), '3',
       ob->final_timeout);
-    if (!ok && errno == 0)
-      switch(buffer[0])
-        {
-	case '2': prdr_active = FALSE;
-	          ok = TRUE;
-		  break;
-	case '4': errno = ERRNO_DATA4XX;
-                  addrlist->more_errno |= ((buffer[1] - '0')*10 + buffer[2] - '0') << 8;
-		  break;
-        }
+    if (!lflags.ok && errno == 0) switch(buffer[0])
+      {
+      case '2': lflags.prdr_active = FALSE;
+		lflags.ok = TRUE;
+		break;
+      case '4': errno = ERRNO_DATA4XX;
+		addrlist->more_errno |=
+		  ((buffer[1] - '0')*10 + buffer[2] - '0') << 8;
+		break;
+      }
     }
   else
 #endif
@@ -2454,11 +2660,11 @@ if (!ok) ok = TRUE; else
   /* For non-PRDR SMTP, we now read a single response that applies to the
   whole message.  If it is OK, then all the addresses have been delivered. */
 
-  if (!lmtp)
+  if (!lflags.lmtp)
     {
-    ok = smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
+    lflags.ok = smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
       ob->final_timeout);
-    if (!ok && errno == 0 && buffer[0] == '4')
+    if (!lflags.ok && errno == 0 && buffer[0] == '4')
       {
       errno = ERRNO_DATA4XX;
       addrlist->more_errno |= ((buffer[1] - '0')*10 + buffer[2] - '0') << 8;
@@ -2477,13 +2683,15 @@ if (!ok) ok = TRUE; else
   software before the spool gets updated. Also record the final SMTP
   confirmation if needed (for SMTP only). */
 
-  if (ok)
+  if (lflags.ok)
     {
     int flag = '=';
     int delivery_time = (int)(time(NULL) - start_delivery_time);
     int len;
     uschar *conf = NULL;
-    send_rset = FALSE;
+
+    lflags.send_rset = FALSE;
+    pipelining_active = FALSE;
 
     /* Set up confirmation if needed - applies only to SMTP */
 
@@ -2491,7 +2699,7 @@ if (!ok) ok = TRUE; else
 #ifdef DISABLE_EVENT
           LOGGING(smtp_confirmation) &&
 #endif
-          !lmtp
+          !lflags.lmtp
        )
       {
       const uschar *s = string_printing(buffer);
@@ -2512,9 +2720,9 @@ if (!ok) ok = TRUE; else
       it doesn't get tried again too soon. */
 
 #ifndef DISABLE_PRDR
-      if (lmtp || prdr_active)
+      if (lflags.lmtp || lflags.prdr_active)
 #else
-      if (lmtp)
+      if (lflags.lmtp)
 #endif
         {
         if (!smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
@@ -2523,7 +2731,7 @@ if (!ok) ok = TRUE; else
           if (errno != 0 || buffer[0] == 0) goto RESPONSE_FAILED;
           addr->message = string_sprintf(
 #ifndef DISABLE_PRDR
-	    "%s error after %s: %s", prdr_active ? "PRDR":"LMTP",
+	    "%s error after %s: %s", lflags.prdr_active ? "PRDR":"LMTP",
 #else
 	    "LMTP error after %s: %s",
 #endif
@@ -2537,7 +2745,7 @@ if (!ok) ok = TRUE; else
             addr->more_errno |= ((buffer[1] - '0')*10 + buffer[2] - '0') << 8;
             addr->transport_return = DEFER;
 #ifndef DISABLE_PRDR
-            if (!prdr_active)
+            if (!lflags.prdr_active)
 #endif
               retry_add_item(addr, addr->address_retry_key, 0);
             }
@@ -2561,12 +2769,13 @@ if (!ok) ok = TRUE; else
       addr->special_action = flag;
       addr->message = conf;
 #ifndef DISABLE_PRDR
-      if (prdr_active) addr->flags |= af_prdr_used;
+      if (lflags.prdr_active) addr->flags |= af_prdr_used;
 #endif
+      if (peer_offered & PEER_OFFERED_CHUNKING) addr->flags |= af_chunking_used;
       flag = '-';
 
 #ifndef DISABLE_PRDR
-      if (!prdr_active)
+      if (!lflags.prdr_active)
 #endif
         {
         /* Update the journal. For homonymic addresses, use the base address plus
@@ -2588,13 +2797,13 @@ if (!ok) ok = TRUE; else
       }
 
 #ifndef DISABLE_PRDR
-      if (prdr_active)
+      if (lflags.prdr_active)
         {
 	/* PRDR - get the final, overall response.  For any non-success
 	upgrade all the address statuses. */
-        ok = smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
+        lflags.ok = smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
           ob->final_timeout);
-        if (!ok)
+        if (!lflags.ok)
 	  {
 	  if(errno == 0 && buffer[0] == '4')
             {
@@ -2644,7 +2853,7 @@ assumed if errno == 0 and there is no text in the buffer. If control reaches
 here during the setting up phase (i.e. before MAIL FROM) then always defer, as
 the problem is not related to this specific message. */
 
-if (!ok)
+if (!lflags.ok)
   {
   int code, set_rc;
   uschar * set_message;
@@ -2653,7 +2862,7 @@ if (!ok)
     {
     save_errno = errno;
     message = NULL;
-    send_quit = check_response(host, &save_errno, addrlist->more_errno,
+    lflags.send_quit = check_response(host, &save_errno, addrlist->more_errno,
       buffer, &code, &message, &pass_message);
     goto FAILED;
     }
@@ -2664,7 +2873,7 @@ if (!ok)
     code = '4';
     message = US string_sprintf("send() to %s [%s] failed: %s",
       host->name, host->address, strerror(save_errno));
-    send_quit = FALSE;
+    lflags.send_quit = FALSE;
     goto FAILED;
     }
 
@@ -2686,16 +2895,14 @@ if (!ok)
   tried again for a while. */
 
   FAILED:
-  ok = FALSE;                /* For when reached by GOTO */
+  lflags.ok = FALSE;                /* For when reached by GOTO */
   set_message = message;
 
-  if (setting_up)
-    {
+  if (lflags.setting_up)
     if (code == '5')
       set_rc = FAIL;
     else
       yield = set_rc = DEFER;
-    }
 
   /* We want to handle timeouts after MAIL or "." and loss of connection after
   "." specially. They can indicate a problem with the sender address or with
@@ -2822,10 +3029,10 @@ hosts_nopass_tls. */
 
 DEBUG(D_transport)
   debug_printf("ok=%d send_quit=%d send_rset=%d continue_more=%d "
-    "yield=%d first_address is %sNULL\n", ok, send_quit, send_rset,
-    continue_more, yield, (first_addr == NULL)? "":"not ");
+    "yield=%d first_address is %sNULL\n", lflags.ok, lflags.send_quit,
+    lflags.send_rset, continue_more, yield, first_addr ? "not " : "");
 
-if (completed_address && ok && send_quit)
+if (completed_address && lflags.ok && lflags.send_quit)
   {
   BOOL more;
   smtp_compare_t t_compare;
@@ -2847,21 +3054,21 @@ if (completed_address && ok && send_quit)
     uschar *msg;
     BOOL pass_message;
 
-    if (send_rset)
+    if (lflags.send_rset)
       {
-      if (! (ok = smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0))
+      if (! (lflags.ok = smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0))
         {
         msg = US string_sprintf("send() to %s [%s] failed: %s", host->name,
           host->address, strerror(save_errno));
-        send_quit = FALSE;
+        lflags.send_quit = FALSE;
         }
-      else if (! (ok = smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
-                  ob->command_timeout)))
+      else if (! (lflags.ok = smtp_read_response(&inblock, buffer,
+		  sizeof(buffer), '2', ob->command_timeout)))
         {
         int code;
-        send_quit = check_response(host, &errno, 0, buffer, &code, &msg,
+        lflags.send_quit = check_response(host, &errno, 0, buffer, &code, &msg,
           &pass_message);
-        if (!send_quit)
+        if (!lflags.send_quit)
           {
           DEBUG(D_transport) debug_printf("H=%s [%s] %s\n",
 	    host->name, host->address, msg);
@@ -2871,7 +3078,7 @@ if (completed_address && ok && send_quit)
 
     /* Either RSET was not needed, or it succeeded */
 
-    if (ok)
+    if (lflags.ok)
       {
       if (first_addr != NULL)            /* More addresses still to be sent */
         {                                /*   in this run of the transport */
@@ -2889,10 +3096,11 @@ if (completed_address && ok && send_quit)
       if (tls_out.active >= 0)
         {
         tls_close(FALSE, TRUE);
-        if (smtps)
-          ok = FALSE;
+	smtp_peer_options = smtp_peer_options_wrap;
+        if (lflags.smtps)
+          lflags.ok = FALSE;
         else
-          ok = smtp_write_command(&outblock,FALSE,"EHLO %s\r\n",helo_data) >= 0 &&
+          lflags.ok = smtp_write_command(&outblock,FALSE,"EHLO %s\r\n",helo_data) >= 0 &&
                smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
                  ob->command_timeout);
         }
@@ -2904,11 +3112,9 @@ if (completed_address && ok && send_quit)
 /*XXX DSN_INFO: assume likely to do new HELO; but for greet we'll want to
 propagate it from the initial
 */
-      if (ok && transport_pass_socket(tblock->name, host->name, host->address,
-            new_message_id, inblock.sock))
-        {
-        send_quit = FALSE;
-        }
+      if (lflags.ok && transport_pass_socket(tblock->name, host->name,
+	    host->address, new_message_id, inblock.sock))
+        lflags.send_quit = FALSE;
       }
 
     /* If RSET failed and there are addresses left, they get deferred. */
@@ -2940,7 +3146,7 @@ This change is being made on 31-Jul-98. After over a year of trouble-free
 operation, the old commented-out code was removed on 17-Sep-99. */
 
 SEND_QUIT:
-if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
+if (lflags.send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
 
 END_OFF:
 
@@ -2958,6 +3164,14 @@ writing RSET might have failed, or there may be other addresses whose hosts are
 specified in the transports, and therefore not visible at top level, in which
 case continue_more won't get set. */
 
+HDEBUG(D_transport|D_acl|D_v) debug_printf("  SMTP(close)>>\n");
+if (lflags.send_quit)
+  {
+  shutdown(outblock.sock, SHUT_WR);
+  if (fcntl(inblock.sock, F_SETFL, O_NONBLOCK) == 0)
+    for (rc = 16; read(inblock.sock, inbuffer, sizeof(inbuffer)) > 0 && rc > 0;)
+      rc--;				/* drain socket */
+  }
 (void)close(inblock.sock);
 
 #ifndef DISABLE_EVENT
@@ -3044,10 +3258,10 @@ prepare_addresses(address_item *addrlist, host_item *host)
 {
 address_item *first_addr = NULL;
 address_item *addr;
-for (addr = addrlist; addr != NULL; addr = addr->next)
+for (addr = addrlist; addr; addr = addr->next)
   if (addr->transport_return == DEFER)
     {
-    if (first_addr == NULL) first_addr = addr;
+    if (!first_addr) first_addr = addr;
     addr->transport_return = PENDING_DEFER;
     addr->basic_errno = 0;
     addr->more_errno = (host->mx >= 0)? 'M' : 'A';
@@ -3095,7 +3309,6 @@ int hosts_total = 0;
 int total_hosts_tried = 0;
 address_item *addr;
 BOOL expired = TRUE;
-BOOL continuing = continue_hostname != NULL;
 uschar *expanded_hosts = NULL;
 uschar *pistring;
 uschar *tid = string_sprintf("%s transport", tblock->name);
@@ -3107,9 +3320,15 @@ host_item *host = NULL;
 DEBUG(D_transport)
   {
   debug_printf("%s transport entered\n", tblock->name);
-  for (addr = addrlist; addr != NULL; addr = addr->next)
+  for (addr = addrlist; addr; addr = addr->next)
     debug_printf("  %s\n", addr->address);
-  if (continuing) debug_printf("already connected to %s [%s]\n",
+  if (hostlist)
+    {
+    debug_printf("hostlist:\n");
+    for (host = hostlist; host; host = host->next)
+      debug_printf("  %s:%d\n", host->name, host->port);
+    }
+  if (continue_hostname) debug_printf("already connected to %s [%s]\n",
       continue_hostname, continue_host_address);
   }
 
@@ -3125,9 +3344,9 @@ same one in order to be passed to a single transport - or if the transport has
 a host list with hosts_override set, use the host list supplied with the
 transport. It is an error for this not to exist. */
 
-if (hostlist == NULL || (ob->hosts_override && ob->hosts != NULL))
+if (!hostlist || (ob->hosts_override && ob->hosts))
   {
-  if (ob->hosts == NULL)
+  if (!ob->hosts)
     {
     addrlist->message = string_sprintf("%s transport called with no hosts set",
       tblock->name);
@@ -3146,7 +3365,7 @@ if (hostlist == NULL || (ob->hosts_override && ob->hosts != NULL))
   as the hosts string will never be used again, it doesn't matter that we
   replace all the : characters with zeros. */
 
-  if (ob->hostlist == NULL)
+  if (!ob->hostlist)
     {
     uschar *s = ob->hosts;
 
@@ -3156,7 +3375,7 @@ if (hostlist == NULL || (ob->hosts_override && ob->hosts != NULL))
         {
         addrlist->message = string_sprintf("failed to expand list of hosts "
           "\"%s\" in %s transport: %s", s, tblock->name, expand_string_message);
-        addrlist->transport_return = search_find_defer? DEFER : PANIC;
+        addrlist->transport_return = search_find_defer ? DEFER : PANIC;
         return FALSE;     /* Only top address has status */
         }
       DEBUG(D_transport) debug_printf("expanded list of hosts \"%s\" to "
@@ -3169,7 +3388,7 @@ if (hostlist == NULL || (ob->hosts_override && ob->hosts != NULL))
     host_build_hostlist(&hostlist, s, ob->hosts_randomize);
 
     /* Check that the expansion yielded something useful. */
-    if (hostlist == NULL)
+    if (!hostlist)
       {
       addrlist->message =
         string_sprintf("%s transport has empty hosts setting", tblock->name);
@@ -3195,17 +3414,17 @@ must sort it into a random order if it did not come from MX records and has not
 already been randomized (but don't bother if continuing down an existing
 connection). */
 
-else if (ob->hosts_randomize && hostlist->mx == MX_NONE && !continuing)
+else if (ob->hosts_randomize && hostlist->mx == MX_NONE && !continue_hostname)
   {
   host_item *newlist = NULL;
-  while (hostlist != NULL)
+  while (hostlist)
     {
     host_item *h = hostlist;
     hostlist = hostlist->next;
 
     h->sort_key = random_number(100);
 
-    if (newlist == NULL)
+    if (!newlist)
       {
       h->next = NULL;
       newlist = h;
@@ -3218,7 +3437,7 @@ else if (ob->hosts_randomize && hostlist->mx == MX_NONE && !continuing)
     else
       {
       host_item *hh = newlist;
-      while (hh->next != NULL)
+      while (hh->next)
         {
         if (h->sort_key < hh->next->sort_key) break;
         hh = hh->next;
@@ -3280,23 +3499,22 @@ the current message. To cope with this, we have to go round the loop a second
 time. After that, set the status and error data for any addresses that haven't
 had it set already. */
 
-for (cutoff_retry = 0; expired &&
-     cutoff_retry < ((ob->delay_after_cutoff)? 1 : 2);
+for (cutoff_retry = 0;
+     expired && cutoff_retry < (ob->delay_after_cutoff ? 1 : 2);
      cutoff_retry++)
   {
   host_item *nexthost = NULL;
   int unexpired_hosts_tried = 0;
 
   for (host = hostlist;
-       host != NULL &&
-         unexpired_hosts_tried < ob->hosts_max_try &&
-         total_hosts_tried < ob->hosts_max_try_hardlimit;
+          host
+       && unexpired_hosts_tried < ob->hosts_max_try
+       && total_hosts_tried < ob->hosts_max_try_hardlimit;
        host = nexthost)
     {
     int rc;
     int host_af;
     uschar *rs;
-    BOOL serialized = FALSE;
     BOOL host_is_expired = FALSE;
     BOOL message_defer = FALSE;
     BOOL some_deferred = FALSE;
@@ -3326,7 +3544,7 @@ for (cutoff_retry = 0; expired &&
     Note that we mustn't skip unusable hosts if the address is not unset; they
     may be needed as expired hosts on the 2nd time round the cutoff loop. */
 
-    if (host->address == NULL)
+    if (!host->address)
       {
       int new_port, flags;
       host_item *hh;
@@ -3385,7 +3603,7 @@ for (cutoff_retry = 0; expired &&
           "HOST_FIND_AGAIN" : "HOST_FIND_FAILED", host->name);
         host->status = hstatus_unusable;
 
-        for (addr = addrlist; addr != NULL; addr = addr->next)
+        for (addr = addrlist; addr; addr = addr->next)
           {
           if (addr->transport_return != DEFER) continue;
           addr->basic_errno = ERRNO_UNKNOWNHOST;
@@ -3401,7 +3619,7 @@ for (cutoff_retry = 0; expired &&
 
       if (rc == HOST_FOUND_LOCAL && !ob->allow_localhost)
         {
-        for (addr = addrlist; addr != NULL; addr = addr->next)
+        for (addr = addrlist; addr; addr = addr->next)
           {
           addr->basic_errno = 0;
           addr->message = string_sprintf("%s transport found host %s to be "
@@ -3417,8 +3635,10 @@ for (cutoff_retry = 0; expired &&
     result of the lookup. Set expired FALSE, to save the outer loop executing
     twice. */
 
-    if (continuing && (Ustrcmp(continue_hostname, host->name) != 0 ||
-                       Ustrcmp(continue_host_address, host->address) != 0))
+    if (  continue_hostname
+       && (  Ustrcmp(continue_hostname, host->name) != 0
+          || Ustrcmp(continue_host_address, host->address) != 0
+       )  )
       {
       expired = FALSE;
       continue;      /* With next host */
@@ -3442,11 +3662,9 @@ for (cutoff_retry = 0; expired &&
           &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK))
       {
       expired = FALSE;
-      for (addr = addrlist; addr != NULL; addr = addr->next)
-        {
-        if (addr->transport_return != DEFER) continue;
-        addr->message = US"domain matches queue_smtp_domains, or -odqs set";
-        }
+      for (addr = addrlist; addr; addr = addr->next)
+        if (addr->transport_return == DEFER)
+	  addr->message = US"domain matches queue_smtp_domains, or -odqs set";
       continue;      /* With next host */
       }
 
@@ -3469,8 +3687,8 @@ for (cutoff_retry = 0; expired &&
     the standard SMTP port. A host may have its own port setting that overrides
     the default. */
 
-    pistring = string_sprintf(":%d", (host->port == PORT_NONE)?
-      port : host->port);
+    pistring = string_sprintf(":%d", host->port == PORT_NONE
+      ? port : host->port);
     if (Ustrcmp(pistring, ":25") == 0) pistring = US"";
 
     /* Select IPv4 or IPv6, and choose an outgoing interface. If the interface
@@ -3479,7 +3697,7 @@ for (cutoff_retry = 0; expired &&
     because connections to the same host from a different interface should be
     treated separately. */
 
-    host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET : AF_INET6;
+    host_af = Ustrchr(host->address, ':') == NULL ? AF_INET : AF_INET6;
     if ((rs = ob->interface) && *rs)
       {
       if (!smtp_get_interface(rs, host_af, addrlist, &interface, tid))
@@ -3520,24 +3738,24 @@ for (cutoff_retry = 0; expired &&
       switch (host->status)
         {
         case hstatus_unusable:
-        expired = FALSE;
-        setflag(addrlist, af_retry_skipped);
-        /* Fall through */
+	  expired = FALSE;
+	  setflag(addrlist, af_retry_skipped);
+	  /* Fall through */
 
         case hstatus_unusable_expired:
-        switch (host->why)
-          {
-          case hwhy_retry: hosts_retry++; break;
-          case hwhy_failed:  hosts_fail++; break;
-          case hwhy_deferred: hosts_defer++; break;
-          }
-
-        /* If there was a retry message key, implying that previously there
-        was a message-specific defer, we don't want to update the list of
-        messages waiting for these hosts. */
-
-        if (retry_message_key != NULL) update_waiting = FALSE;
-        continue;   /* With the next host or IP address */
+	  switch (host->why)
+	    {
+	    case hwhy_retry: hosts_retry++; break;
+	    case hwhy_failed:  hosts_fail++; break;
+	    case hwhy_deferred: hosts_defer++; break;
+	    }
+
+	  /* If there was a retry message key, implying that previously there
+	  was a message-specific defer, we don't want to update the list of
+	  messages waiting for these hosts. */
+
+	  if (retry_message_key) update_waiting = FALSE;
+	  continue;   /* With the next host or IP address */
         }
       }
 
@@ -3546,12 +3764,11 @@ for (cutoff_retry = 0; expired &&
 
     else
       {
-      if (host->address == NULL ||
-          host->status != hstatus_unusable_expired ||
-          host->last_try > received_time)
+      if (  !host->address
+         || host->status != hstatus_unusable_expired
+	 || host->last_try > received_time)
         continue;
-      DEBUG(D_transport)
-        debug_printf("trying expired host %s [%s]%s\n",
+      DEBUG(D_transport) debug_printf("trying expired host %s [%s]%s\n",
           host->name, host->address, pistring);
       host_is_expired = TRUE;
       }
@@ -3568,8 +3785,8 @@ for (cutoff_retry = 0; expired &&
     and remember this for later deletion. Do not do any of this if we are
     sending the message down a pre-existing connection. */
 
-    if (!continuing &&
-        verify_check_given_host(&ob->serialize_hosts, host) == OK)
+    if (  !continue_hostname
+       && verify_check_given_host(&ob->serialize_hosts, host) == OK)
       {
       serialize_key = string_sprintf("host-serialize-%s", host->name);
       if (!enq_start(serialize_key, 1))
@@ -3580,7 +3797,6 @@ for (cutoff_retry = 0; expired &&
         hosts_serial++;
         continue;
         }
-      serialized = TRUE;
       }
 
     /* OK, we have an IP address that is not waiting for its retry time to
@@ -3594,11 +3810,11 @@ for (cutoff_retry = 0; expired &&
 
     DEBUG(D_transport) debug_printf("delivering %s to %s [%s] (%s%s)\n",
       message_id, host->name, host->address, addrlist->address,
-      (addrlist->next == NULL)? "" : ", ...");
+      addrlist->next ? ", ..." : "");
 
     set_process_info("delivering %s to %s [%s] (%s%s)",
       message_id, host->name, host->address, addrlist->address,
-      (addrlist->next == NULL)? "" : ", ...");
+      addrlist->next ? ", ..." : "");
 
     /* This is not for real; don't do the delivery. If there are
     any remaining hosts, list them. */
@@ -3607,7 +3823,7 @@ for (cutoff_retry = 0; expired &&
       {
       host_item *host2;
       set_errno_nohost(addrlist, 0, NULL, OK, FALSE);
-      for (addr = addrlist; addr != NULL; addr = addr->next)
+      for (addr = addrlist; addr; addr = addr->next)
         {
         addr->host_used = host;
         addr->special_action = '*';
@@ -3617,9 +3833,9 @@ for (cutoff_retry = 0; expired &&
         {
         debug_printf("*** delivery by %s transport bypassed by -N option\n"
                      "*** host and remaining hosts:\n", tblock->name);
-        for (host2 = host; host2 != NULL; host2 = host2->next)
+        for (host2 = host; host2; host2 = host2->next)
           debug_printf("    %s [%s]\n", host2->name,
-            (host2->address == NULL)? US"unset" : host2->address);
+            host2->address ? host2->address : US"unset");
         }
       rc = OK;
       }
@@ -3689,8 +3905,8 @@ for (cutoff_retry = 0; expired &&
       failures, where the log has already been written. If all hosts defer a
       general message is written at the end. */
 
-      if (rc == DEFER && first_addr->basic_errno != ERRNO_AUTHFAIL &&
-                         first_addr->basic_errno != ERRNO_TLSFAILURE)
+      if (rc == DEFER && first_addr->basic_errno != ERRNO_AUTHFAIL
+		      && first_addr->basic_errno != ERRNO_TLSFAILURE)
         write_logs(first_addr, host);
 
 #ifndef DISABLE_EVENT
@@ -3731,16 +3947,18 @@ for (cutoff_retry = 0; expired &&
 
     /* Delivery attempt finished */
 
-    rs = (rc == OK)? US"OK" : (rc == DEFER)? US"DEFER" : (rc == ERROR)?
-      US"ERROR" : US"?";
+    rs = rc == OK ? US"OK"
+       : rc == DEFER ? US"DEFER"
+       : rc == ERROR ? US"ERROR"
+       : US"?";
 
     set_process_info("delivering %s: just tried %s [%s] for %s%s: result %s",
       message_id, host->name, host->address, addrlist->address,
-      (addrlist->next == NULL)? "" : " (& others)", rs);
+      addrlist->next ? " (& others)" : "", rs);
 
     /* Release serialization if set up */
 
-    if (serialized) enq_end(serialize_key);
+    if (serialize_key) enq_end(serialize_key);
 
     /* If the result is DEFER, or if a host retry record is known to exist, we
     need to add an item to the retry chain for updating the retry database
@@ -3750,10 +3968,10 @@ for (cutoff_retry = 0; expired &&
     the unusable tree at the outer level, so even if different address blocks
     contain the same address, it still won't get tried again.) */
 
-    if (rc == DEFER || retry_host_key != NULL)
+    if (rc == DEFER || retry_host_key)
       {
-      int delete_flag = (rc != DEFER)? rf_delete : 0;
-      if (retry_host_key == NULL)
+      int delete_flag = rc != DEFER ? rf_delete : 0;
+      if (!retry_host_key)
         {
 	BOOL incl_ip;
 	if (exp_bool(addrlist, US"transport", tblock->name, D_transport,
@@ -3761,9 +3979,9 @@ for (cutoff_retry = 0; expired &&
 		  ob->expand_retry_include_ip_address, &incl_ip) != OK)
 	  incl_ip = TRUE;	/* error; use most-specific retry record */
 
-        retry_host_key = incl_ip ?
-          string_sprintf("T:%S:%s%s", host->name, host->address, pistring) :
-          string_sprintf("T:%S%s", host->name, pistring);
+        retry_host_key = incl_ip
+	  ? string_sprintf("T:%S:%s%s", host->name, host->address, pistring)
+	  : string_sprintf("T:%S%s", host->name, pistring);
         }
 
       /* If a delivery of another message over an existing SMTP connection
@@ -3776,7 +3994,7 @@ for (cutoff_retry = 0; expired &&
       host is genuinely down, another non-continued message delivery will
       notice it soon enough. */
 
-      if (delete_flag != 0 || !continuing)
+      if (delete_flag != 0 || !continue_hostname)
         retry_add_item(first_addr, retry_host_key, rf_host | delete_flag);
 
       /* We may have tried an expired host, if its retry time has come; ensure
@@ -3784,8 +4002,8 @@ for (cutoff_retry = 0; expired &&
 
       if (rc == DEFER)
         {
-        host->status = (host_is_expired)?
-          hstatus_unusable_expired : hstatus_unusable;
+        host->status = host_is_expired
+	  ? hstatus_unusable_expired : hstatus_unusable;
         host->why = hwhy_deferred;
         }
       }
@@ -3798,10 +4016,10 @@ for (cutoff_retry = 0; expired &&
     reasonable. Also, stop the message from being remembered as waiting
     for specific hosts. */
 
-    if (message_defer || retry_message_key != NULL)
+    if (message_defer || retry_message_key)
       {
-      int delete_flag = message_defer? 0 : rf_delete;
-      if (retry_message_key == NULL)
+      int delete_flag = message_defer ? 0 : rf_delete;
+      if (!retry_message_key)
         {
 	BOOL incl_ip;
 	if (exp_bool(addrlist, US"transport", tblock->name, D_transport,
@@ -3809,10 +4027,10 @@ for (cutoff_retry = 0; expired &&
 		  ob->expand_retry_include_ip_address, &incl_ip) != OK)
 	  incl_ip = TRUE;	/* error; use most-specific retry record */
 
-        retry_message_key = incl_ip ?
-          string_sprintf("T:%S:%s%s:%s", host->name, host->address, pistring,
-            message_id) :
-          string_sprintf("T:%S%s:%s", host->name, pistring, message_id);
+        retry_message_key = incl_ip
+	  ? string_sprintf("T:%S:%s%s:%s", host->name, host->address, pistring,
+	      message_id)
+	  : string_sprintf("T:%S%s:%s", host->name, pistring, message_id);
         }
       retry_add_item(addrlist, retry_message_key,
         rf_message | rf_host | delete_flag);
@@ -3846,7 +4064,7 @@ for (cutoff_retry = 0; expired &&
     case when we were trying to deliver down an existing channel and failed.
     Don't try any other hosts in this case. */
 
-    if (continuing) break;
+    if (continue_hostname) break;
 
     /* If the whole delivery, or some individual addresses, were deferred and
     there are more hosts that could be tried, do not count this host towards
@@ -3856,16 +4074,16 @@ for (cutoff_retry = 0; expired &&
     important because if we don't try all hosts, the address will never time
     out. NOTE: this does not apply to hosts_max_try_hardlimit. */
 
-    if ((rc == DEFER || some_deferred) && nexthost != NULL)
+    if ((rc == DEFER || some_deferred) && nexthost)
       {
       BOOL timedout;
       retry_config *retry = retry_find_config(host->name, NULL, 0, 0);
 
-      if (retry != NULL && retry->rules != NULL)
+      if (retry && retry->rules)
         {
         retry_rule *last_rule;
         for (last_rule = retry->rules;
-             last_rule->next != NULL;
+             last_rule->next;
              last_rule = last_rule->next);
         timedout = time(NULL) - received_time > last_rule->timeout;
         }
@@ -3899,7 +4117,7 @@ specific failures. Force the delivery status for all addresses to FAIL. */
 
 if (mua_wrapper)
   {
-  for (addr = addrlist; addr != NULL; addr = addr->next)
+  for (addr = addrlist; addr; addr = addr->next)
     addr->transport_return = FAIL;
   goto END_TRANSPORT;
   }
@@ -3916,7 +4134,7 @@ If queue_smtp is set, or this transport was called to send a subsequent message
 down an existing TCP/IP connection, and something caused the host not to be
 found, we end up here, but can detect these cases and handle them specially. */
 
-for (addr = addrlist; addr != NULL; addr = addr->next)
+for (addr = addrlist; addr; addr = addr->next)
   {
   /* If host is not NULL, it means that we stopped processing the host list
   because of hosts_max_try or hosts_max_try_hardlimit. In the former case, this
@@ -3925,8 +4143,7 @@ for (addr = addrlist; addr != NULL; addr = addr->next)
   However, if we have hit hosts_max_try_hardlimit, we want to behave as if all
   hosts were tried. */
 
-  if (host != NULL)
-    {
+  if (host)
     if (total_hosts_tried >= ob->hosts_max_try_hardlimit)
       {
       DEBUG(D_transport)
@@ -3939,7 +4156,6 @@ for (addr = addrlist; addr != NULL; addr = addr->next)
         debug_printf("hosts_max_try limit caused some hosts to be skipped\n");
       setflag(addr, af_retry_skipped);
       }
-    }
 
   if (queue_smtp)    /* no deliveries attempted */
     {
@@ -3948,45 +4164,45 @@ for (addr = addrlist; addr != NULL; addr = addr->next)
     addr->message = US"SMTP delivery explicitly queued";
     }
 
-  else if (addr->transport_return == DEFER &&
-       (addr->basic_errno == ERRNO_UNKNOWNERROR || addr->basic_errno == 0) &&
-       addr->message == NULL)
+  else if (  addr->transport_return == DEFER
+	  && (addr->basic_errno == ERRNO_UNKNOWNERROR || addr->basic_errno == 0)
+	  && !addr->message
+	  )
     {
     addr->basic_errno = ERRNO_HRETRY;
-    if (continue_hostname != NULL)
-      {
+    if (continue_hostname)
       addr->message = US"no host found for existing SMTP connection";
-      }
     else if (expired)
       {
       setflag(addr, af_pass_message);   /* This is not a security risk */
-      addr->message = ob->delay_after_cutoff
-        ? US"retry time not reached for any host after a long failure period"
-        : US"all hosts have been failing for a long time and were last tried "
-          "after this message arrived";
+      addr->message = string_sprintf(
+	"all hosts%s have been failing for a long time %s",
+	addr->domain ? string_sprintf(" for '%s'", addr->domain) : US"",
+        ob->delay_after_cutoff
+	? US"(and retry time not reached)"
+	: US"and were last tried after this message arrived");
 
       /* If we are already using fallback hosts, or there are no fallback hosts
       defined, convert the result to FAIL to cause a bounce. */
 
-      if (addr->host_list == addr->fallback_hosts ||
-          addr->fallback_hosts == NULL)
+      if (addr->host_list == addr->fallback_hosts || !addr->fallback_hosts)
         addr->transport_return = FAIL;
       }
     else
       {
-      const uschar * s;
+      const char * s;
       if (hosts_retry == hosts_total)
-        s = US"retry time not reached for any host%s";
+        s = "retry time not reached for any host%s";
       else if (hosts_fail == hosts_total)
-        s = US"all host address lookups%s failed permanently";
+        s = "all host address lookups%s failed permanently";
       else if (hosts_defer == hosts_total)
-        s = US"all host address lookups%s failed temporarily";
+        s = "all host address lookups%s failed temporarily";
       else if (hosts_serial == hosts_total)
-        s = US"connection limit reached for all hosts%s";
+        s = "connection limit reached for all hosts%s";
       else if (hosts_fail+hosts_defer == hosts_total)
-        s = US"all host address lookups%s failed";
+        s = "all host address lookups%s failed";
       else
-        s = US"some host address lookups failed and retry time "
+        s = "some host address lookups failed and retry time "
         "not reached for other hosts or connection limit reached%s";
 
       addr->message = string_sprintf(s,
diff --git a/src/src/transports/smtp.h b/src/src/transports/smtp.h
index 07b601a96..c8df38ab4 100644
--- a/src/src/transports/smtp.h
+++ b/src/src/transports/smtp.h
@@ -21,10 +21,12 @@ typedef struct {
   uschar *serialize_hosts;
   uschar *hosts_try_auth;
   uschar *hosts_require_auth;
+  uschar *hosts_try_chunking;
 #ifdef EXPERIMENTAL_DANE
   uschar *hosts_try_dane;
   uschar *hosts_require_dane;
 #endif
+  uschar *hosts_try_fastopen;
 #ifndef DISABLE_PRDR
   uschar *hosts_try_prdr;
 #endif
@@ -67,9 +69,6 @@ typedef struct {
   uschar *tls_crl;
   uschar *tls_privatekey;
   uschar *tls_require_ciphers;
-  uschar *gnutls_require_kx;
-  uschar *gnutls_require_mac;
-  uschar *gnutls_require_proto;
   uschar *tls_sni;
   uschar *tls_verify_certificates;
   int     tls_dh_min_bits;
@@ -79,12 +78,7 @@ typedef struct {
   uschar *tls_verify_cert_hostnames;
 #endif
 #ifndef DISABLE_DKIM
-  uschar *dkim_domain;
-  uschar *dkim_private_key;
-  uschar *dkim_selector;
-  uschar *dkim_canon;
-  uschar *dkim_sign_headers;
-  uschar *dkim_strict;
+  struct ob_dkim dkim;
 #endif
 } smtp_transport_options_block;
 
diff --git a/src/src/utf8.c b/src/src/utf8.c
index 84ad1dc18..e394db0a8 100644
--- a/src/src/utf8.c
+++ b/src/src/utf8.c
@@ -18,7 +18,7 @@ BOOL
 string_is_utf8(const uschar * s)
 {
 uschar c;
-while ((c = *s++)) if (c & 0x80) return TRUE;
+if (s) while ((c = *s++)) if (c & 0x80) return TRUE;
 return FALSE;
 }
 
diff --git a/src/src/verify.c b/src/src/verify.c
index 53a1daade..9652a395f 100644
--- a/src/src/verify.c
+++ b/src/src/verify.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2016 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions concerned with verifying things. The original code for callout
@@ -39,7 +39,8 @@ static tree_node *dnsbl_cache = NULL;
 #define MT_NOT 1
 #define MT_ALL 2
 
-static uschar cutthrough_response(char, uschar **);
+static uschar cutthrough_response(char, uschar **, int);
+
 
 
 /*************************************************
@@ -155,10 +156,6 @@ do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
   int callout, int callout_overall, int callout_connect, int options,
   uschar *se_mailfrom, uschar *pm_mailfrom)
 {
-BOOL is_recipient = (options & vopt_is_recipient) != 0;
-BOOL callout_no_cache = (options & vopt_callout_no_cache) != 0;
-BOOL callout_random = (options & vopt_callout_random) != 0;
-
 int yield = OK;
 int old_domain_cache_result = ccache_accept;
 BOOL done = FALSE;
@@ -166,8 +163,8 @@ uschar *address_key;
 uschar *from_address;
 uschar *random_local_part = NULL;
 const uschar *save_deliver_domain = deliver_domain;
-uschar **failure_ptr = is_recipient?
-  &recipient_verify_failure : &sender_verify_failure;
+uschar **failure_ptr = options & vopt_is_recipient
+  ? &recipient_verify_failure : &sender_verify_failure;
 open_db dbblock;
 open_db *dbm_file = NULL;
 dbdata_callout_cache new_domain_record;
@@ -189,12 +186,13 @@ because that may influence the result of the callout. */
 address_key = addr->address;
 from_address = US"";
 
-if (is_recipient)
+if (options & vopt_is_recipient)
   {
   if (options & vopt_callout_recipsender)
     {
     address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
     from_address = sender_address;
+    if (cutthrough.delivery) options |= vopt_callout_no_cache;
     }
   else if (options & vopt_callout_recippmaster)
     {
@@ -217,7 +215,7 @@ else
 /* Open the callout cache database, it it exists, for reading only at this
 stage, unless caching has been disabled. */
 
-if (callout_no_cache)
+if (options & vopt_callout_no_cache)
   {
   HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
   }
@@ -229,7 +227,7 @@ else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
 /* If a cache database is available see if we can avoid the need to do an
 actual callout by making use of previously-obtained data. */
 
-if (dbm_file != NULL)
+if (dbm_file)
   {
   dbdata_callout_cache_address *cache_address_record;
   dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
@@ -240,7 +238,7 @@ if (dbm_file != NULL)
   /* If an unexpired cache record was found for this domain, see if the callout
   process can be short-circuited. */
 
-  if (cache_record != NULL)
+  if (cache_record)
     {
     /* In most cases, if an early command (up to and including MAIL FROM:<>)
     was rejected, there is no point carrying on. The callout fails. However, if
@@ -273,26 +271,26 @@ if (dbm_file != NULL)
     the data in the new record. If a random check is required but hasn't been
     done, skip the remaining cache processing. */
 
-    if (callout_random) switch(cache_record->random_result)
+    if (options & vopt_callout_random) switch(cache_record->random_result)
       {
       case ccache_accept:
-      HDEBUG(D_verify)
-        debug_printf("callout cache: domain accepts random addresses\n");
-      goto END_CALLOUT;     /* Default yield is OK */
+	HDEBUG(D_verify)
+	  debug_printf("callout cache: domain accepts random addresses\n");
+	goto END_CALLOUT;     /* Default yield is OK */
 
       case ccache_reject:
-      HDEBUG(D_verify)
-        debug_printf("callout cache: domain rejects random addresses\n");
-      callout_random = FALSE;
-      new_domain_record.random_result = ccache_reject;
-      new_domain_record.random_stamp = cache_record->random_stamp;
-      break;
+	HDEBUG(D_verify)
+	  debug_printf("callout cache: domain rejects random addresses\n");
+	options &= ~vopt_callout_random;
+	new_domain_record.random_result = ccache_reject;
+	new_domain_record.random_stamp = cache_record->random_stamp;
+	break;
 
       default:
-      HDEBUG(D_verify)
-        debug_printf("callout cache: need to check random address handling "
-          "(not cached or cache expired)\n");
-      goto END_CACHE;
+	HDEBUG(D_verify)
+	  debug_printf("callout cache: need to check random address handling "
+	    "(not cached or cache expired)\n");
+	goto END_CACHE;
       }
 
     /* If a postmaster check is requested, but there was a previous failure,
@@ -300,7 +298,7 @@ if (dbm_file != NULL)
     but has not been done before, we are going to have to do a callout, so skip
     remaining cache processing. */
 
-    if (pm_mailfrom != NULL)
+    if (pm_mailfrom)
       {
       if (cache_record->postmaster_result == ccache_reject)
         {
@@ -346,7 +344,7 @@ if (dbm_file != NULL)
       callout_cache_positive_expire,
       callout_cache_negative_expire);
 
-  if (cache_address_record != NULL)
+  if (cache_address_record)
     {
     if (cache_address_record->result == ccache_accept)
       {
@@ -389,7 +387,7 @@ else
   with a random local part, ensure that such a local part is available. If not,
   log the fact, but carry on without randomming. */
 
-  if (callout_random && callout_random_local_part != NULL)
+  if (options & vopt_callout_random && callout_random_local_part != NULL)
     if (!(random_local_part = expand_string(callout_random_local_part)))
       log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
         "callout_random_local_part: %s", expand_string_message);
@@ -407,7 +405,7 @@ else
   and cause the client to time out. So in this case we forgo the PIPELINING
   optimization. */
 
-  if (smtp_out != NULL && !disable_callout_flush) mac_smtp_fflush();
+  if (smtp_out && !disable_callout_flush) mac_smtp_fflush();
 
 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
 and we are holding a cutthrough conn open, we can just append the rcpt to
@@ -456,7 +454,7 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 	     && port == cutthrough.host.port
 	     )
 	    {
-	    uschar * resp;
+	    uschar * resp = NULL;
 
 	    /* Match!  Send the RCPT TO, append the addr, set done */
 	    done =
@@ -464,7 +462,7 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 		transport_rcpt_address(addr,
 		  (addr->transport == NULL)? FALSE :
 		   addr->transport->rcpt_include_affixes)) >= 0 &&
-	      cutthrough_response('2', &resp) == '2';
+	      cutthrough_response('2', &resp, CUTTHROUGH_DATA_TIMEOUT) == '2';
 
 	    /* This would go horribly wrong if a callout fail was ignored by ACL.
 	    We punt by abandoning cutthrough on a reject, like the
@@ -483,7 +481,7 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 	    else
 	      {
 	      cancel_cutthrough_connection("recipient rejected");
-	      if (errno == ETIMEDOUT)
+	      if (!resp || errno == ETIMEDOUT)
 		{
 		HDEBUG(D_verify) debug_printf("SMTP timeout\n");
 		}
@@ -519,7 +517,7 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
   /* Now make connections to the hosts and do real callouts. The list of hosts
   is passed in as an argument. */
 
-  for (host = host_list; host != NULL && !done; host = host->next)
+  for (host = host_list; host && !done; host = host->next)
     {
     smtp_inblock inblock;
     smtp_outblock outblock;
@@ -547,7 +545,7 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 
     /* Skip this host if we don't have an IP address for it. */
 
-    if (host->address == NULL)
+    if (!host->address)
       {
       DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
         host->name);
@@ -564,7 +562,7 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 
     /* Set IPv4 or IPv6 */
 
-    host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
+    host_af = Ustrchr(host->address, ':') == NULL ? AF_INET : AF_INET6;
 
     /* Expand and interpret the interface and port strings. The latter will not
     be used if there is a host-specific port (e.g. from a manualroute router).
@@ -620,6 +618,7 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 		  addr->transport);
     if (inblock.sock < 0)
       {
+      HDEBUG(D_verify) debug_printf("connect: %s\n", strerror(errno));
       addr->message = string_sprintf("could not connect to %s [%s]: %s",
           host->name, host->address, strerror(errno));
       transport_name = NULL;
@@ -640,12 +639,14 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 
       if (host->dnssec == DS_YES)
 	{
-	if(  (  dane_required
-	     || verify_check_given_host(&ob->hosts_try_dane, host) == OK
-	     )
-	  && (rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK
+	if(  dane_required
+	  || verify_check_given_host(&ob->hosts_try_dane, host) == OK
 	  )
-	  return rc;
+	  {
+	  if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required)) != OK)
+	    return rc;
+	  dane = TRUE;
+	  }
 	}
       else if (dane_required)
 	{
@@ -660,10 +661,10 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 
     /* Expand the helo_data string to find the host name to use. */
 
-    if (tf->helo_data != NULL)
+    if (tf->helo_data)
       {
-      uschar *s = expand_string(tf->helo_data);
-      if (s == NULL)
+      uschar * s = expand_string(tf->helo_data);
+      if (!s)
         log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
           "helo_data value for callout: %s", addr->address,
           expand_string_message);
@@ -683,6 +684,9 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
     if (!smtps || (smtps && tls_out.active >= 0))
 #endif
       {
+#ifdef TCP_QUICKACK
+      (void) setsockopt(inblock.sock, IPPROTO_TCP, TCP_QUICKACK, US &off, sizeof(off));
+#endif
       if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
         goto RESPONSE_FAILED;
 
@@ -756,11 +760,11 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 	: 0;
       }
 
-    size_str = peer_offered & PEER_OFFERED_SIZE
+    size_str = options & vopt_is_recipient && peer_offered & PEER_OFFERED_SIZE
       ? string_sprintf(" SIZE=%d", message_size + ob->size_addition) : US"";
 
 #ifdef SUPPORT_TLS
-    tls_offered = !!(peer_offered & PEER_OFFERED_TLS);
+    smtp_peer_options |= peer_offered & PEER_OFFERED_TLS;
 #endif
 
     /* If TLS is available on this connection attempt to
@@ -792,8 +796,10 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
       if (!smtps && !smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
   			ob->command_timeout))
         {
-        if (errno != 0 || buffer2[0] == 0 ||
-        	(buffer2[0] == '4' && !ob->tls_tempfail_tryclear))
+        if (  errno != 0
+	   || buffer2[0] == 0
+	   || buffer2[0] == '4' && !ob->tls_tempfail_tryclear
+	   )
 	  {
 	  Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
 	  done= FALSE;
@@ -807,7 +813,6 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 	int oldtimeout = ob->command_timeout;
 	int rc;
 
-	tls_negotiate:
 	ob->command_timeout = callout;
         rc = tls_client_start(inblock.sock, host, addr, addr->transport
 # ifdef EXPERIMENTAL_DANE
@@ -820,38 +825,22 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 	connection, if the options permit it for this host. */
         if (rc != OK)
           {
-	  if (rc == DEFER)
-	    {
-	    (void)close(inblock.sock);
+	  HDEBUG(D_transport|D_acl|D_v) debug_printf("  SMTP(close)>>\n");
+	  (void)close(inblock.sock);
 # ifndef DISABLE_EVENT
-	    (void) event_raise(addr->transport->event_action,
-				    US"tcp:close", NULL);
-# endif
-# ifdef EXPERIMENTAL_DANE
-	    if (dane)
-	      {
-	      if (!dane_required)
-		{
-		log_write(0, LOG_MAIN, "DANE attempt failed;"
-		  " trying CA-root TLS to %s [%s] (not in hosts_require_dane)",
-		  host->name, host->address);
-		dane = FALSE;
-		goto tls_negotiate;
-		}
-	      }
-	    else
+	  (void) event_raise(addr->transport->event_action,
+				  US"tcp:close", NULL);
 # endif
-	      if (  ob->tls_tempfail_tryclear
-		 && !smtps
-		 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
-		 )
-	      {
-	      log_write(0, LOG_MAIN, "TLS session failure:"
-		" delivering unencrypted to %s [%s] (not in hosts_require_tls)",
-		host->name, host->address);
-	      suppress_tls = TRUE;
-	      goto tls_retry_connection;
-	      }
+	  if (  ob->tls_tempfail_tryclear
+	     && !smtps
+	     && verify_check_given_host(&ob->hosts_require_tls, host) != OK
+	     )
+	    {
+	    log_write(0, LOG_MAIN, "TLS session failure:"
+	      " callout unencrypted to %s [%s] (not in hosts_require_tls)",
+	      host->name, host->address);
+	    suppress_tls = TRUE;
+	    goto tls_retry_connection;
 	    }
 
 	  /*save_errno = ERRNO_TLSFAILURE;*/
@@ -902,13 +891,16 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
     /* Need proper integration with the proper transport mechanism. */
     if (cutthrough.delivery)
       {
+#ifndef DISABLE_DKIM
+      uschar * s;
+#endif
       if (addr->transport->filter_command)
         {
         cutthrough.delivery = FALSE;
         HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
         }
 #ifndef DISABLE_DKIM
-      if (ob->dkim_domain)
+      else if ((s = ob->dkim.dkim_domain) && (s = expand_string(s)) && *s)
         {
         cutthrough.delivery = FALSE;
         HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
@@ -1104,6 +1096,7 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
 #ifdef SUPPORT_TLS
 	    tls_close(FALSE, TRUE);
 #endif
+	    HDEBUG(D_transport|D_acl|D_v) debug_printf("  SMTP(close)>>\n");
 	    (void)close(inblock.sock);
 #ifndef DISABLE_EVENT
 	    (void) event_raise(addr->transport->event_action,
@@ -1255,10 +1248,9 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
             big_buffer, host->name, host->address,
             string_printing(responsebuffer));
 
-        addr->user_message = is_recipient?
-          string_sprintf("Callout verification failed:\n%s", responsebuffer)
-          :
-          string_sprintf("Called:   %s\nSent:     %s\nResponse: %s",
+        addr->user_message = options & vopt_is_recipient
+	  ? string_sprintf("Callout verification failed:\n%s", responsebuffer)
+          : string_sprintf("Called:   %s\nSent:     %s\nResponse: %s",
             host->address, big_buffer, responsebuffer);
 
         /* Hard rejection ends the process */
@@ -1280,13 +1272,16 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
        && rcpt_count == 1
        && done
        && yield == OK
-       && (options & (vopt_callout_recipsender|vopt_callout_recippmaster)) == vopt_callout_recipsender
+       &&    (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
+	   == vopt_callout_recipsender
        && !random_local_part
        && !pm_mailfrom
        && cutthrough.fd < 0
        && !lmtp
        )
       {
+      HDEBUG(D_acl|D_v) debug_printf("holding verify callout open for cutthrough delivery\n");
+
       cutthrough.fd = outblock.sock;	/* We assume no buffer in use in the outblock */
       cutthrough.nrcpt = 1;
       cutthrough.interface = interface;
@@ -1307,12 +1302,20 @@ can do it there for the non-rcpt-verify case.  For this we keep an addresscount.
       {
       /* Ensure no cutthrough on multiple address verifies */
       if (options & vopt_callout_recipsender)
-        cancel_cutthrough_connection("multiple verify calls");
-      if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
+        cancel_cutthrough_connection("not usable for cutthrough");
+      if (send_quit)
+	{
+	(void) smtp_write_command(&outblock, FALSE, "QUIT\r\n");
+
+	/* Wait a short time for response, and discard it */
+	smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
+	  '2', 1);
+	}
 
 #ifdef SUPPORT_TLS
       tls_close(FALSE, TRUE);
 #endif
+      HDEBUG(D_transport|D_acl|D_v) debug_printf("  SMTP(close)>>\n");
       (void)close(inblock.sock);
 #ifndef DISABLE_EVENT
       (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
@@ -1332,7 +1335,8 @@ there was an error before or with MAIL FROM:, and errno was not zero,
 implying some kind of I/O error. We don't want to write the cache in that case.
 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
 
-if (!callout_no_cache && new_domain_record.result != ccache_unknown)
+if (  !(options & vopt_callout_no_cache)
+   && new_domain_record.result != ccache_unknown)
   {
   if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
        == NULL)
@@ -1343,8 +1347,9 @@ if (!callout_no_cache && new_domain_record.result != ccache_unknown)
     {
     (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
       (int)sizeof(dbdata_callout_cache));
-    HDEBUG(D_verify) debug_printf("wrote callout cache domain record:\n"
+    HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
       "  result=%d postmaster=%d random=%d\n",
+      addr->domain,
       new_domain_record.result,
       new_domain_record.postmaster_result,
       new_domain_record.random_result);
@@ -1356,11 +1361,12 @@ is disabled. */
 
 if (done)
   {
-  if (!callout_no_cache && new_address_record.result != ccache_unknown)
+  if (  !(options & vopt_callout_no_cache)
+     && new_address_record.result != ccache_unknown)
     {
-    if (dbm_file == NULL)
+    if (!dbm_file)
       dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
-    if (dbm_file == NULL)
+    if (!dbm_file)
       {
       HDEBUG(D_verify) debug_printf("no callout cache available\n");
       }
@@ -1368,8 +1374,9 @@ if (done)
       {
       (void)dbfn_write(dbm_file, address_key, &new_address_record,
         (int)sizeof(dbdata_callout_cache_address));
-      HDEBUG(D_verify) debug_printf("wrote %s callout cache address record\n",
-        (new_address_record.result == ccache_accept)? "positive" : "negative");
+      HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
+        new_address_record.result == ccache_accept ? "positive" : "negative",
+	address_key);
       }
     }
   }    /* done */
@@ -1380,23 +1387,24 @@ it alone if supplying details. Otherwise, give a generic response. */
 
 else   /* !done */
   {
-  uschar *dullmsg = string_sprintf("Could not complete %s verify callout",
-    is_recipient? "recipient" : "sender");
+  uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
+    options & vopt_is_recipient ? "recipient" : "sender");
   yield = DEFER;
 
-  if (host_list->next != NULL || addr->message == NULL) addr->message = dullmsg;
+  if (host_list->next || !addr->message)
+    addr->message = dullmsg;
 
-  addr->user_message = (!smtp_return_error_details)? dullmsg :
-    string_sprintf("%s for <%s>.\n"
+  addr->user_message = smtp_return_error_details
+    ? string_sprintf("%s for <%s>.\n"
       "The mail server(s) for the domain may be temporarily unreachable, or\n"
       "they may be permanently unreachable from this server. In the latter case,\n%s",
       dullmsg, addr->address,
-      is_recipient?
-        "the address will never be accepted."
-        :
-        "you need to change the address or create an MX record for its domain\n"
-        "if it is supposed to be generally accessible from the Internet.\n"
-        "Talk to your mail administrator for details.");
+      options & vopt_is_recipient
+	? "the address will never be accepted."
+        : "you need to change the address or create an MX record for its domain\n"
+	  "if it is supposed to be generally accessible from the Internet.\n"
+	  "Talk to your mail administrator for details.")
+    : dullmsg;
 
   /* Force a specific error code */
 
@@ -1406,7 +1414,7 @@ else   /* !done */
 /* Come here from within the cache-reading code on fast-track exit. */
 
 END_CALLOUT:
-if (dbm_file != NULL) dbfn_close(dbm_file);
+if (dbm_file) dbfn_close(dbm_file);
 return yield;
 }
 
@@ -1415,10 +1423,11 @@ return yield;
 /* Called after recipient-acl to get a cutthrough connection open when
    one was requested and a recipient-verify wasn't subsequently done.
 */
-void
+int
 open_cutthrough_connection( address_item * addr )
 {
 address_item addr2;
+int rc;
 
 /* Use a recipient-verify-callout to set up the cutthrough connection. */
 /* We must use a copy of the address for verification, because it might
@@ -1427,12 +1436,14 @@ get rewritten. */
 addr2 = *addr;
 HDEBUG(D_acl) debug_printf("----------- %s cutthrough setup ------------\n",
   rcpt_count > 1 ? "more" : "start");
-(void) verify_address(&addr2, NULL,
+rc = verify_address(&addr2, NULL,
 	vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
 	CUTTHROUGH_CMD_TIMEOUT, -1, -1,
 	NULL, NULL, NULL);
+addr->message = addr2.message;
+addr->user_message = addr2.user_message;
 HDEBUG(D_acl) debug_printf("----------- end cutthrough setup ------------\n");
-return;
+return rc;
 }
 
 
@@ -1518,7 +1529,7 @@ return cutthrough_puts(US"\r\n", 2);
 
 /* Get and check response from cutthrough target */
 static uschar
-cutthrough_response(char expect, uschar ** copy)
+cutthrough_response(char expect, uschar ** copy, int timeout)
 {
 smtp_inblock inblock;
 uschar inbuffer[4096];
@@ -1530,7 +1541,7 @@ inblock.ptr = inbuffer;
 inblock.ptrend = inbuffer;
 inblock.sock = cutthrough.fd;
 /* this relies on (inblock.sock == tls_out.active) */
-if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, CUTTHROUGH_DATA_TIMEOUT))
+if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, timeout))
   cancel_cutthrough_connection("target timeout on read");
 
 if(copy != NULL)
@@ -1559,13 +1570,13 @@ cutthrough_puts(US"DATA\r\n", 6);
 cutthrough_flush_send();
 
 /* Assume nothing buffered.  If it was it gets ignored. */
-return cutthrough_response('3', NULL) == '3';
+return cutthrough_response('3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
 }
 
 
-/* fd and use_crlf args only to match write_chunk() */
+/* fd and tctx args only to match write_chunk() */
 static BOOL
-cutthrough_write_chunk(int fd, uschar * s, int len, BOOL use_crlf)
+cutthrough_write_chunk(int fd, transport_ctx * tctx, uschar * s, int len)
 {
 uschar * s2;
 while(s && (s2 = Ustrchr(s, '\n')))
@@ -1584,6 +1595,8 @@ return TRUE;
 BOOL
 cutthrough_headers_send(void)
 {
+transport_ctx tctx;
+
 if(cutthrough.fd < 0)
   return FALSE;
 
@@ -1592,12 +1605,13 @@ if(cutthrough.fd < 0)
 */
 HDEBUG(D_acl) debug_printf("----------- start cutthrough headers send -----------\n");
 
-if (!transport_headers_send(&cutthrough.addr, cutthrough.fd,
-	cutthrough.addr.transport->add_headers,
-	cutthrough.addr.transport->remove_headers,
-	&cutthrough_write_chunk, TRUE,
-	cutthrough.addr.transport->rewrite_rules,
-	cutthrough.addr.transport->rewrite_existflags))
+tctx.tblock = cutthrough.addr.transport;
+tctx.addr = &cutthrough.addr;
+tctx.check_string = US".";
+tctx.escape_string = US"..";
+tctx.options = topt_use_crlf;
+
+if (!transport_headers_send(cutthrough.fd, &tctx, &cutthrough_write_chunk))
   return FALSE;
 
 HDEBUG(D_acl) debug_printf("----------- done cutthrough headers send ------------\n");
@@ -1618,11 +1632,14 @@ if(cutthrough.fd >= 0)
   HDEBUG(D_transport|D_acl|D_v) debug_printf("  SMTP>> QUIT\n");
   _cutthrough_puts(US"QUIT\r\n", 6);	/* avoid recursion */
   _cutthrough_flush_send();
-  /* No wait for response */
+
+  /* Wait a short time for response, and discard it */
+  cutthrough_response('2', NULL, 1);
 
   #ifdef SUPPORT_TLS
   tls_close(FALSE, TRUE);
   #endif
+  HDEBUG(D_transport|D_acl|D_v) debug_printf("  SMTP(close)>>\n");
   (void)close(cutthrough.fd);
   cutthrough.fd = -1;
   HDEBUG(D_acl) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why);
@@ -1659,7 +1676,7 @@ if(  !cutthrough_puts(US".", 1)
   )
   return cutthrough.addr.message;
 
-res = cutthrough_response('2', &cutthrough.addr.message);
+res = cutthrough_response('2', &cutthrough.addr.message, CUTTHROUGH_DATA_TIMEOUT);
 for (addr = &cutthrough.addr; addr; addr = addr->next)
   {
   addr->message = cutthrough.addr.message;
@@ -1817,21 +1834,20 @@ verify_address(address_item *vaddr, FILE *f, int options, int callout,
 {
 BOOL allok = TRUE;
 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
-BOOL is_recipient = (options & vopt_is_recipient) != 0;
 BOOL expn         = (options & vopt_expn) != 0;
 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
 int i;
 int yield = OK;
 int verify_type = expn? v_expn :
      address_test_mode? v_none :
-          is_recipient? v_recipient : v_sender;
+          options & vopt_is_recipient? v_recipient : v_sender;
 address_item *addr_list;
 address_item *addr_new = NULL;
 address_item *addr_remote = NULL;
 address_item *addr_local = NULL;
 address_item *addr_succeed = NULL;
-uschar **failure_ptr = is_recipient?
-  &recipient_verify_failure : &sender_verify_failure;
+uschar **failure_ptr = options & vopt_is_recipient
+  ? &recipient_verify_failure : &sender_verify_failure;
 uschar *ko_prefix, *cr;
 uschar *address = vaddr->address;
 uschar *save_sender;
@@ -1864,7 +1880,7 @@ if (parse_find_at(address) == NULL)
     *failure_ptr = US"qualify";
     return FAIL;
     }
-  address = rewrite_address_qualify(address, is_recipient);
+  address = rewrite_address_qualify(address, options & vopt_is_recipient);
   }
 
 DEBUG(D_verify)
@@ -1879,7 +1895,7 @@ may have been set by domains and local part tests during an ACL. */
 if (global_rewrite_rules != NULL)
   {
   uschar *old = address;
-  address = rewrite_address(address, is_recipient, FALSE,
+  address = rewrite_address(address, options & vopt_is_recipient, FALSE,
     global_rewrite_rules, rewrite_existflags);
   if (address != old)
     {
@@ -1903,7 +1919,7 @@ if (address[0] == 0) return OK;
 
 /* Flip the legacy TLS-related variables over to the outbound set in case
 they're used in the context of a transport used by verification. Reset them
-at exit from this routine. */
+at exit from this routine (so no returns allowed from here on). */
 
 tls_modify_variables(&tls_out);
 
@@ -1912,6 +1928,10 @@ while verifying a sender address (a nice bit of self-reference there). */
 
 save_sender = sender_address;
 
+/* Observability variable for router/transport use */
+
+verify_mode = options & vopt_is_recipient ? US"R" : US"S";
+
 /* Update the address structure with the possibly qualified and rewritten
 address. Set it up as the starting address on the chain of new addresses. */
 
@@ -1927,7 +1947,7 @@ If an address generates more than one child, the loop is used only when
 full_info is set, and this can only be set locally. Remote enquiries just get
 information about the top level address, not anything that it generated. */
 
-while (addr_new != NULL)
+while (addr_new)
   {
   int rc;
   address_item *addr = addr_new;
@@ -1976,18 +1996,18 @@ while (addr_new != NULL)
 
   /* Just in case some router parameter refers to it. */
 
-  return_path = (addr->prop.errors_address != NULL)?
-    addr->prop.errors_address : sender_address;
+  return_path = addr->prop.errors_address
+    ? addr->prop.errors_address : sender_address;
 
   /* Split the address into domain and local part, handling the %-hack if
   necessary, and then route it. While routing a sender address, set
   $sender_address to <> because that is what it will be if we were trying to
   send a bounce to the sender. */
 
-  if (routed != NULL) *routed = FALSE;
+  if (routed) *routed = FALSE;
   if ((rc = deliver_split_address(addr)) == OK)
     {
-    if (!is_recipient) sender_address = null_sender;
+    if (!(options & vopt_is_recipient)) sender_address = null_sender;
     rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
       &addr_succeed, verify_type);
     sender_address = save_sender;     /* Put back the real sender */
@@ -2001,11 +2021,11 @@ while (addr_new != NULL)
 
   if (rc == OK)
     {
-    if (routed != NULL) *routed = TRUE;
+    if (routed) *routed = TRUE;
     if (callout > 0)
       {
-      host_item *host_list = addr->host_list;
       transport_instance * tp;
+      host_item * host_list = addr->host_list;
 
       /* Make up some data for use in the case where there is no remote
       transport. */
@@ -2035,7 +2055,7 @@ while (addr_new != NULL)
         transport is configured to override the router's hosts, we must build a
         host list of the transport's hosts, and find the IP addresses */
 
-        if (tf.hosts != NULL && (host_list == NULL || tf.hosts_override))
+        if (tf.hosts && (!host_list || tf.hosts_override))
           {
           uschar *s;
           const uschar *save_deliver_domain = deliver_domain;
@@ -2049,7 +2069,7 @@ while (addr_new != NULL)
           deliver_domain = save_deliver_domain;
           deliver_localpart = save_deliver_localpart;
 
-          if (s == NULL)
+          if (!s)
             {
             log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
               "\"%s\" in %s transport for callout: %s", tf.hosts,
@@ -2071,7 +2091,7 @@ while (addr_new != NULL)
             if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
             if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
 
-            for (host = host_list; host != NULL; host = nexthost)
+            for (host = host_list; host; host = nexthost)
               {
               nexthost = host->next;
               if (tf.gethostbyname ||
@@ -2098,7 +2118,7 @@ while (addr_new != NULL)
       /* Can only do a callout if we have at least one host! If the callout
       fails, it will have set ${sender,recipient}_verify_failure. */
 
-      if (host_list != NULL)
+      if (host_list)
         {
         HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
         if (host_checking && !host_checking_callout)
@@ -2112,10 +2132,8 @@ while (addr_new != NULL)
 #ifdef SUPPORT_TLS
 	  deliver_set_expansions(addr);
 #endif
-	  verify_mode = is_recipient ? US"R" : US"S";
           rc = do_callout(addr, host_list, &tf, callout, callout_overall,
             callout_connect, options, se_mailfrom, pm_mailfrom);
-	  verify_mode = NULL;
           }
         }
       else
@@ -2141,24 +2159,24 @@ while (addr_new != NULL)
   if (rc == FAIL)
     {
     allok = FALSE;
-    if (f != NULL)
+    if (f)
       {
       address_item *p = addr->parent;
 
       respond_printf(f, "%s%s %s", ko_prefix,
-        full_info? addr->address : address,
-        address_test_mode? "is undeliverable" : "failed to verify");
+        full_info ? addr->address : address,
+        address_test_mode ? "is undeliverable" : "failed to verify");
       if (!expn && admin_user)
         {
         if (addr->basic_errno > 0)
           respond_printf(f, ": %s", strerror(addr->basic_errno));
-        if (addr->message != NULL)
+        if (addr->message)
           respond_printf(f, ": %s", addr->message);
         }
 
       /* Show parents iff doing full info */
 
-      if (full_info) while (p != NULL)
+      if (full_info) while (p)
         {
         respond_printf(f, "%s\n    <-- %s", cr, p->address);
         p = p->parent;
@@ -2168,11 +2186,11 @@ while (addr_new != NULL)
     cancel_cutthrough_connection("routing hard fail");
 
     if (!full_info)
-    {
+      {
       yield = copy_error(vaddr, addr, FAIL);
       goto out;
-    }
-    else yield = FAIL;
+      }
+    yield = FAIL;
     }
 
   /* Soft failure */
@@ -2180,7 +2198,7 @@ while (addr_new != NULL)
   else if (rc == DEFER)
     {
     allok = FALSE;
-    if (f != NULL)
+    if (f)
       {
       address_item *p = addr->parent;
       respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
@@ -2189,7 +2207,7 @@ while (addr_new != NULL)
         {
         if (addr->basic_errno > 0)
           respond_printf(f, ": %s", strerror(addr->basic_errno));
-        if (addr->message != NULL)
+        if (addr->message)
           respond_printf(f, ": %s", addr->message);
         else if (addr->basic_errno <= 0)
           respond_printf(f, ": unknown error");
@@ -2197,7 +2215,7 @@ while (addr_new != NULL)
 
       /* Show parents iff doing full info */
 
-      if (full_info) while (p != NULL)
+      if (full_info) while (p)
         {
         respond_printf(f, "%s\n    <-- %s", cr, p->address);
         p = p->parent;
@@ -2211,7 +2229,7 @@ while (addr_new != NULL)
       yield = copy_error(vaddr, addr, DEFER);
       goto out;
       }
-    else if (yield == OK) yield = DEFER;
+    if (yield == OK) yield = DEFER;
     }
 
   /* If we are handling EXPN, we do not want to continue to route beyond
@@ -2220,20 +2238,20 @@ while (addr_new != NULL)
   else if (expn)
     {
     uschar *ok_prefix = US"250-";
-    if (addr_new == NULL)
-      {
-      if (addr_local == NULL && addr_remote == NULL)
+
+    if (!addr_new)
+      if (!addr_local && !addr_remote)
         respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
       else
         respond_printf(f, "250 <%s>\r\n", address);
-      }
-    else while (addr_new != NULL)
+
+    else do
       {
       address_item *addr2 = addr_new;
       addr_new = addr2->next;
-      if (addr_new == NULL) ok_prefix = US"250 ";
+      if (!addr_new) ok_prefix = US"250 ";
       respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
-      }
+      } while (addr_new);
     yield = OK;
     goto out;
     }
@@ -2255,21 +2273,30 @@ while (addr_new != NULL)
     just a single new address as a special case, and continues on to verify the
     generated address. */
 
-    if (!full_info &&                    /* Stop if short info wanted AND */
-         (((addr_new == NULL ||          /* No new address OR */
-           addr_new->next != NULL ||     /* More than one new address OR */
-           testflag(addr_new, af_pfr)))  /* New address is pfr */
-         ||                              /* OR */
-         (addr_new != NULL &&            /* At least one new address AND */
-          success_on_redirect)))         /* success_on_redirect is set */
+    if (  !full_info			/* Stop if short info wanted AND */
+       && (  (  !addr_new		/* No new address OR */
+             || addr_new->next		/* More than one new address OR */
+	     || testflag(addr_new, af_pfr)	/* New address is pfr */
+	     )
+          ||				/* OR */
+             (  addr_new		/* At least one new address AND */
+             && success_on_redirect	/* success_on_redirect is set */
+	  )  )
+       )
       {
-      if (f != NULL) fprintf(f, "%s %s\n", address,
-        address_test_mode? "is deliverable" : "verified");
+      if (f) fprintf(f, "%s %s\n",
+        address, address_test_mode ? "is deliverable" : "verified");
 
       /* If we have carried on to verify a child address, we want the value
       of $address_data to be that of the child */
 
       vaddr->prop.address_data = addr->prop.address_data;
+
+      /* If stopped because more than one new address, cannot cutthrough */
+
+      if (addr_new && addr_new->next)
+	cancel_cutthrough_connection("multiple addresses from routing");
+
       yield = OK;
       goto out;
       }
@@ -2285,7 +2312,7 @@ If there are no local and no remote addresses, and there were no pipes, files,
 or autoreplies, and there were no errors or deferments, the message is to be
 discarded, usually because of the use of :blackhole: in an alias file. */
 
-if (allok && addr_local == NULL && addr_remote == NULL)
+if (allok && !addr_local && !addr_remote)
   {
   fprintf(f, "mail to %s is discarded\n", address);
   goto out;
@@ -2366,6 +2393,7 @@ for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
 the -bv or -bt case). */
 
 out:
+verify_mode = NULL;
 tls_modify_variables(&tls_in);
 
 return yield;
@@ -2888,9 +2916,8 @@ DEBUG(D_ident) debug_printf("doing ident callback\n");
 to the incoming interface address. If the sender host address is an IPv6
 address, the incoming interface address will also be IPv6. */
 
-host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
-sock = ip_socket(SOCK_STREAM, host_af);
-if (sock < 0) return;
+host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
+if ((sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
 
 if (ip_bind(sock, host_af, interface_address, 0) < 0)
   {
@@ -2899,19 +2926,15 @@ if (ip_bind(sock, host_af, interface_address, 0) < 0)
   goto END_OFF;
   }
 
-if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
-     < 0)
+if (ip_connect(sock, host_af, sender_host_address, port,
+		rfc1413_query_timeout, TRUE) < 0)
   {
   if (errno == ETIMEDOUT && LOGGING(ident_timeout))
-    {
     log_write(0, LOG_MAIN, "ident connection to %s timed out",
       sender_host_address);
-    }
   else
-    {
     DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
       sender_host_address, strerror(errno));
-    }
   goto END_OFF;
   }
 
@@ -3192,9 +3215,9 @@ if (iplookup)
   /* Now do the actual lookup; note that there is no search_close() because
   of the caching arrangements. */
 
-  handle = search_open(filename, search_type, 0, NULL, NULL);
-  if (handle == NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
-    search_error_message);
+  if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
+    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
+
   result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
   if (valueptr != NULL) *valueptr = result;
   return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
diff --git a/src/util/.gitignore b/src/util/.gitignore
new file mode 100644
index 000000000..5d4972483
--- /dev/null
+++ b/src/util/.gitignore
@@ -0,0 +1,2 @@
+# Compiled programs:
+gen_pkcs3
diff --git a/src/util/gen_pkcs3.c b/src/util/gen_pkcs3.c
index 4be2c581e..6a467e07a 100644
--- a/src/util/gen_pkcs3.c
+++ b/src/util/gen_pkcs3.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2012 Phil Pennock.
+/* Copyright (C) 2012,2016 Phil Pennock.
  * This is distributed as part of Exim and licensed under the GPL.
  * See the file "NOTICE" for more details.
  */
@@ -86,7 +86,7 @@ bn_from_text(const char *text)
   rc = BN_hex2bn(&b, spaceless);
 
   if (rc != p - spaceless)
-    die("BN_hex2bn did not convert entire input; took %d of %z bytes",
+    die("BN_hex2bn did not convert entire input; took %d of %zu bytes",
         rc, p - spaceless);
 
   return b;
@@ -134,7 +134,7 @@ emit_c_format_dh(FILE *stream, DH *dh)
       break;
     }
     *nl = '\0';
-    fprintf(stream, "\"%s\\n\"\n", p);
+    fprintf(stream, "\"%s\\n\"%s\n", p, (nl == end - 1 ? ";" : ""));
     p = nl + 1;
   }
 }
@@ -143,9 +143,11 @@ emit_c_format_dh(FILE *stream, DH *dh)
 void __attribute__((__noreturn__))
 usage(FILE *stream, int exitcode)
 {
-  fprintf(stream, "Usage: %s [-CPcst] <dh_p> <dh_g>\n"
+  fprintf(stream, "Usage: %s [-CPcst] <dh_p> <dh_g> [<dh_q>]\n"
 "Both dh_p and dh_g should be hex strings representing the numbers\n"
+"The same applies to the optional dh_q (prime-order subgroup).\n"
 "They may contain whitespace.\n"
+"Older values, dh_g is often just '2', not a long string.\n"
 "\n"
 " -C      show C string form of PEM result\n"
 " -P      do not show PEM\n"
@@ -161,7 +163,7 @@ usage(FILE *stream, int exitcode)
 int
 main(int argc, char *argv[])
 {
-  BIGNUM *p, *g;
+  BIGNUM *p, *g, *q;
   DH *dh;
   int ch;
   bool perform_dh_check = false;
@@ -169,6 +171,7 @@ main(int argc, char *argv[])
   bool show_numbers = false;
   bool show_pem = true;
   bool show_text = false;
+  bool given_q = false;
 
   while ((ch = getopt(argc, argv, "CPcsth")) != -1) {
     switch (ch) {
@@ -201,25 +204,49 @@ main(int argc, char *argv[])
   argc -= optind;
   argv += optind;
 
-  if (argc != 3) {
+  if ((argc < 3) || (argc > 4)) {
     fprintf(stderr, "argc: %d\n", argc);
     usage(stderr, 1);
   }
 
+  // If we use DH_set0_pqg instead of setting dh fields directly; the q value
+  // is optional and may be NULL.
+  // Just blank them all.
+  p = g = q = NULL;
+
   p = bn_from_text(argv[1]);
   g = bn_from_text(argv[2]);
+  if (argc >= 4) {
+    q = bn_from_text(argv[3]);
+    given_q = true;
+  }
 
   if (show_numbers) {
     printf("p = ");
     BN_print_fp(stdout, p);
     printf("\ng = ");
     BN_print_fp(stdout, g);
+    if (given_q) {
+      printf("\nq = ");
+      BN_print_fp(stdout, q);
+    }
     printf("\n");
   }
 
   dh = DH_new();
+  // The documented method for setting q appeared in OpenSSL 1.1.0.
+#if OPENSSL_VERSION_NUMBER >= 0x1010000f
+  // NULL okay for q; yes, the optional value is in the middle.
+  if (DH_set0_pqg(dh, p, q, g) != 1) {
+    die_openssl_err("initialising DH pqg values failed");
+  }
+#else
   dh->p = p;
   dh->g = g;
+  if (given_q) {
+    dh->q = q;
+  }
+#endif
 
   if (perform_dh_check)
     our_dh_check(dh);
@@ -234,6 +261,6 @@ main(int argc, char *argv[])
       PEM_write_DHparams(stdout, dh);
   }
 
-  DH_free(dh); /* should free p & g too */
+  DH_free(dh); /* should free p,g (& q if non-NULL) too */
   return 0;
 }
diff --git a/test/.gitignore b/test/.gitignore
index 57088717e..e93f253ef 100644
--- a/test/.gitignore
+++ b/test/.gitignore
@@ -1,7 +1,6 @@
 autom4te.cache/
 aux-var/
 bin/
-configure
 config.log
 config.status
 dnszones/
@@ -10,3 +9,4 @@ Makefile
 spool/
 test-*
 failed-summary.log
+run-summary.log
diff --git a/test/Makefile.in b/test/Makefile.in
index 70b14753a..0c8d9b71c 100644
--- a/test/Makefile.in
+++ b/test/Makefile.in
@@ -12,6 +12,8 @@ LOADED=@LOADED@
 LOADED_OPT=@LOADED_OPT@
 LIBS=@LIBS@
 
+SRC = @srcdir@/src
+
 ##############################################################################
 
 # List of targets
@@ -26,7 +28,7 @@ makebin:;       @if [ ! -e bin ] ; then mkdir bin 2>/dev/null; echo ""; fi
 
 # Compile and link the programs:
 #
-# bin/cf              a "compare" program 
+# bin/cf              a "compare" program
 # bin/checkaccess     tests whether the exim uid/gid can access the files
 # bin/client          an SMTP script-driven client, without TLS support
 # bin/client-gnutls   ditto, with GnuTLS support
@@ -39,66 +41,66 @@ makebin:;       @if [ ! -e bin ] ; then mkdir bin 2>/dev/null; echo ""; fi
 # bin/server          an SMTP (socket) script-driven server (no TLS support)
 # bin/showids         output current uid, gid, euid, egid
 
-bin/cf:         src/cf.c Makefile
-		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/cf src/cf.c
+bin/cf:         $(SRC)/cf.c Makefile
+		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/cf $(SRC)/cf.c
 		@echo ">>> bin/cf command build"
 		@echo " "
 
-bin/client:     src/client.c Makefile
-		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/client src/client.c $(LIBS)
+bin/client:     $(SRC)/client.c Makefile
+		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/client $(SRC)/client.c $(LIBS)
 		@echo ">>> bin/client command built"
 		@echo " "
 
-bin/client-gnutls: src/client.c Makefile
-		$(CC) $(CFLAGS) -DHAVE_GNUTLS $(LDFLAGS) -o bin/client-gnutls src/client.c -lgnutls -lgcrypt $(LIBS)
+bin/client-gnutls: $(SRC)/client.c Makefile
+		$(CC) $(CFLAGS) -DHAVE_GNUTLS $(LDFLAGS) -o bin/client-gnutls $(SRC)/client.c -lgnutls -lgcrypt $(LIBS)
 		@echo ">>> bin/client-gnutls command built"
 		@echo " "
 
-bin/client-ssl: src/client.c Makefile
-		$(CC) $(CFLAGS) -DHAVE_OPENSSL $(LDFLAGS) -o bin/client-ssl src/client.c -lssl -lcrypto $(LIBS)
+bin/client-ssl: $(SRC)/client.c Makefile
+		$(CC) $(CFLAGS) -DHAVE_OPENSSL $(LDFLAGS) -o bin/client-ssl $(SRC)/client.c -lssl -lcrypto $(LIBS)
 		@echo ">>> bin/client-ssl command built"
 		@echo " "
 
-bin/checkaccess:src/checkaccess.c Makefile
-		$(CC) $(CFLAGS) -DNO_TLS $(LDFLAGS) -o bin/checkaccess src/checkaccess.c
+bin/checkaccess:$(SRC)/checkaccess.c Makefile
+		$(CC) $(CFLAGS) -DNO_TLS $(LDFLAGS) -o bin/checkaccess $(SRC)/checkaccess.c
 		@echo ">>> bin/checkaccess command built"
 		@echo " "
 
-bin/fakens:     src/fakens.c Makefile
-		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/fakens src/fakens.c $(LIBS)
+bin/fakens:     $(SRC)/fakens.c Makefile
+		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/fakens $(SRC)/fakens.c $(LIBS)
 		@echo ">>> bin/fakens command built"
 		@echo " "
 
-bin/fd:         src/fd.c Makefile
-		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/fd src/fd.c
+bin/fd:         $(SRC)/fd.c Makefile
+		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/fd $(SRC)/fd.c
 		@echo ">>> bin/fd command built"
 		@echo " "
 
-bin/iefbr14:    src/iefbr14.c Makefile
-		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/iefbr14 src/iefbr14.c
+bin/iefbr14:    $(SRC)/iefbr14.c Makefile
+		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/iefbr14 $(SRC)/iefbr14.c
 		@echo ">>> bin/iefbr14 command built"
 		@echo " "
 
-bin/loaded:     src/loaded.c Makefile
-		$(CC) $(CFLAGS) $(LDFLAGS) $(LOADED_OPT) -o bin/loaded src/loaded.c
+bin/loaded:     $(SRC)/loaded.c Makefile
+		$(CC) $(CFLAGS) $(LDFLAGS) $(LOADED_OPT) -o bin/loaded $(SRC)/loaded.c
 		@echo ">>> bin/loaded command built"
 		@echo " "
 
-bin/mtpscript:  src/mtpscript.c Makefile
-		$(CC) $(CFLAGS) $(LDFLAGS) $(mtpscript_OPT) -o bin/mtpscript src/mtpscript.c
+bin/mtpscript:  $(SRC)/mtpscript.c Makefile
+		$(CC) $(CFLAGS) $(LDFLAGS) $(mtpscript_OPT) -o bin/mtpscript $(SRC)/mtpscript.c
 		@echo ">>> bin/mtpscript command built"
 		@echo " "
 
-bin/server:     src/server.c Makefile
-		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/server src/server.c $(LIBS)
+bin/server:     $(SRC)/server.c Makefile
+		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/server $(SRC)/server.c $(LIBS)
 		@echo ">>> bin/server command built"
 		@echo " "
 
-bin/showids:    src/showids.c Makefile
-		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/showids src/showids.c
+bin/showids:    $(SRC)/showids.c Makefile
+		$(CC) $(CFLAGS) $(LDFLAGS) -o bin/showids $(SRC)/showids.c
 		@echo ">>> bin/showids command built"
 		@echo " "
-                
-clean:;         rm -rf bin/* 
+
+clean:;         rm -rf bin/*
 
 # End
diff --git a/test/README b/test/README
index a856e2e16..1a300663b 100644
--- a/test/README
+++ b/test/README
@@ -73,12 +73,13 @@ In order to run this test suite, the following requirements must be met:
 
       Defaults:exim-build     timestamp_timeout=480,!tty_tickets
 
-(3) The login under which you run the tests must be in the exim group so that
-    it has access to logs, spool files, etc. The login should not be one of the
-    names "userx", "usery", "userz", or a few other simple ones such as "abcd"
-    and "xyz" and single letters that are used in the tests. The test suite
-    expects the login to have a gecos name; I think it will now run if the
-    gecos field is empty but there may be anomalies.
+(3) The login under which you run the tests must have the exim group as a
+    secondary so that it has access to logs, spool files, etc.  However, it
+    should have a different primary group (eg. "users" vs. "eximgroup"). The
+    login should not be one of the names "userx", "usery", "userz", or a few
+    other simple ones such as "abcd" and "xyz" and single letters that are used
+    in the tests. The test suite expects the login to have a gecos name; I think
+    it will now run if the gecos field is empty but there may be anomalies.
     The login must not contain a dash or an equal sign. (Otherwise some tests
     about local_from_{suffix,prefix} will fail.)
 
@@ -120,11 +121,12 @@ In order to run this test suite, the following requirements must be met:
     configs can be placed into it.  A suitable file location is .../exim/test/trusted_configs
     with content .../exim/test/test-config [fill out the ... to make full
     paths].  This file should be owner/group matching CONFIGURE_OWNER/GROUP,
-    or root/root.  The config files in .../exim/test/confs/ should be owner/group the same.
-    DISABLE_D_OPTION must not be used. If ALT_CONFIG_PREFIX is used, it
+    or root/root, and it has to be accessible for the login, under which
+    you run the tests.  The config files in .../exim/test/confs/ should be
+    owner/group the same.  DISABLE_D_OPTION must not be used. If ALT_CONFIG_PREFIX is used, it
     must contain the directory of the test-suite.  WHITELIST_D_MACROS should contain:
-    
-     DIR:EXIM_PATH:AA:ACL:ACLRCPT:ACL_MAIL:ACL_PREDATA:ACL_RCPT:AFFIX:ALLOW:ARG1:ARG2:AUTHF:AUTHS:AUTH_ID_DOMAIN:BAD:BANNER:BB:BR:BRB:CERT:COM:COMMAND_USER:CONNECTCOND:CONTROL:CREQCIP:CREQMAC:CRL:CSS:D6:DATA:DCF:DDF:DEFAULTDWC:DELAY:DETAILS:DRATELIMIT:DYNAMIC_OPTION:ELI:ERROR_DETAILS:ERT:FAKE:FALLBACK:FILTER:FILTER_PREPEND_HOME:FORBID:FORBID_SMTP_CODE:FUSER:HAI:HAP:HARDLIMIT:HEADER_LINE_MAXSIZE:HEADER_MAXSIZE:HELO_MSG:HL:HOSTS:HOSTS_AVOID_TLS:HOSTS_MAX_TRY:HVH:IFACE:IGNORE_QUOTA:INC:INSERT:IP1:IP2:LAST:LDAPSERVERS:LENCHECK:LIMIT:LIST:LOG_SELECTOR:LS:MAXNM:MESSAGE_LOGS:MSIZE:NOTDAEMON:ONCE:ONLY:OPT:OPTION:ORDER:PAH:PEX:PORT:PTBC:QDG:QOLL:QUOTA:QUOTA_FILECOUNT:QWM:RCPT_MSG:REMEMBER:REQUIRE:RETRY:RETRY1:RETRY2:RETURN:RETURN_ERROR_DETAILS:REWRITE:ROUTE_DATA:RRATELIMIT:RT:S:SELECTOR:SELF:SERVER:SERVERS:SREQCIP:SREQMAC:SRV:STD:STRICT:SUB:SUBMISSION_OPTIONS:TIMEOUTDEFER:TIMES:TRUSTED:TRYCLEAR:UL:USE_SENDER:UTF8:VALUE:WMF:X:Y
+
+     DIR:EXIM_PATH:AA:ACL:ACLRCPT:ACL_MAIL:ACL_PREDATA:ACL_RCPT:AFFIX:ALLOW:ARG1:ARG2:AUTHF:AUTHS:AUTH_ID_DOMAIN:BAD:BANNER:BB:BR:BRB:CERT:COM:COMMAND_USER:CONNECTCOND:CONTROL:CREQCIP:CREQMAC:CRL:CSS:D6:DATA:DCF:DDF:DEFAULTDWC:DELAY:DETAILS:DRATELIMIT:DYNAMIC_OPTION:ELI:ERROR_DETAILS:ERT:FAKE:FALLBACK:FILTER:FILTER_PREPEND_HOME:FORBID:FORBID_SMTP_CODE:FUSER:HAI:HAP:HARDLIMIT:HEADER_LINE_MAXSIZE:HEADER_MAXSIZE:HELO_MSG:HL:HOSTS:HOSTS_AVOID_TLS:HOSTS_MAX_TRY:HVH:IFACE:IGNORE_QUOTA:INC:INSERT:IP1:IP2:LAST:LDAPSERVERS:LENCHECK:LIMIT:LIST:LOG_SELECTOR:MAXNM:MESSAGE_LOGS:MSIZE:NOTDAEMON:ONCE:ONLY:OPT:OPTION:ORDER:PAH:PEX:PORT:PTBC:QDG:QOLL:QUOTA:QUOTA_FILECOUNT:QWM:RCPT_MSG:REMEMBER:REQUIRE:RETRY:RETRY1:RETRY2:RETURN:RETURN_ERROR_DETAILS:REWRITE:ROUTE_DATA:RRATELIMIT:SELECTOR:SELF:SERVER:SERVERS:SREQCIP:SREQMAC:SRV:STRICT:SUB:SUBMISSION_OPTIONS:TIMEOUTDEFER:TIMES:TRUSTED:TRYCLEAR:UL:USE_SENDER:UTF8:VALUE:WMF
 
 (10) Exim must *not* be built with USE_READLINE, as the test-suite's automation
      assumes the simpler I/O model.
@@ -266,11 +268,15 @@ There are some options for the ./runtest script itself:
   -FLAVOUR <flavour>
             This allows "overrides" for the test results. It's intended
             use is to deal with distro specific differences in the test
-            output. The default flavour is "foo". If during the test
-            run differences between the current and the expected output
-            are found and no flavour file exists already, you may update
-            the "common" expected output or you may create a flavour
-            file. If  a flavour file already exists, any updates will go
+            output. The default flavour is "FOO" if autodetection fails.
+            (Autodection is possible for known flavours only. Known
+            flavours are computed after file name extensions in stdout/*
+            and stderr/*.)
+
+            If during the test run differences between the current and
+            the expected output are found and no flavour file exists already,
+            you may update the "common" expected output or you may create a
+            flavour file. If  a flavour file already exists, any updates will go
             into that flavour file!
 
   -KEEP     Normally, after a successful run, the test output files are
@@ -549,6 +555,7 @@ here:
   PORT_D         is replaced by a port number for normal daemon use
   PORT_N         is replaced by a port number that should never respond
   PORT_S         is replaced by a port number for normal bin/server use
+  PORT_DYNAMIC   is replaced by a port number allocated dynamically
   TESTNUM        is replaced by the current test number
   V4NET          is replaced by an IPv4 network number for testing
   V6NET          is replaced by an IPv6 network number for testing
@@ -559,6 +566,10 @@ testing purposes, and for testing Exim with -bh. The only requirement is that
 they are networks that can never be used for an IP address of a real host. I've
 chosen two multicast networks for the moment.
 
+PORT_DYNAMIC is allocated by hunting for a free port (starting at port
+1024) a listener can bind to. This is done by runtest, for simulating
+inetd operations.
+
 If the host has no IPv6 address, "<no IPv6 address found>" is substituted but
 that does not matter because no IPv6 tests will be run. A similar substitution
 is made if there is no IPv4 address, and again, tests that actually require a
@@ -927,7 +938,9 @@ input, details of which are given below. A number of options are implemented:
   -d       causes the server to output debugging information
 
   -t <sec> sets a timeout (default 5) for when the server is
-           awaiting an incoming connection
+           awaiting an incoming connection. If negative, the
+	   absolute value is used and a timeout results in a
+	   nonfailure exit code
 
   -noipv4  causes the server not to set up an IPv4 socket
 
@@ -1017,7 +1030,7 @@ Lines in client scripts are of two kinds:
 Here is a simple example:
 
   client 127.0.0.1 PORT_D
-  ??? 250
+  ??? 220
   EHLO xxx
   ??? 250-
   ??? 250
diff --git a/test/aux-fixed/2800.lmdb-mkdb-dump.py b/test/aux-fixed/2800.lmdb-mkdb-dump.py
new file mode 100644
index 000000000..3de6ba13b
--- /dev/null
+++ b/test/aux-fixed/2800.lmdb-mkdb-dump.py
@@ -0,0 +1,15 @@
+#!/usr/bin/env python
+import os
+import lmdb
+
+if os.path.exists('2800.mdb'):
+    os.unlink('2800.mdb')
+
+env = lmdb.open('2800.mdb', subdir=False);
+with env.begin(write=True) as txn:
+   txn.put('first', 'data for first')
+   txn.put('second', 'A=1 B=2')
+   txn.put('third', 'A1:B2:C3')
+   cursor = txn.cursor()
+   for key, value in cursor:
+       print key, "=>", value
diff --git a/test/aux-fixed/2800.mdb b/test/aux-fixed/2800.mdb
new file mode 100644
index 000000000..2002ee1b5
Binary files /dev/null and b/test/aux-fixed/2800.mdb differ
diff --git a/test/aux-fixed/2800.mdb.src b/test/aux-fixed/2800.mdb.src
new file mode 100644
index 000000000..957952720
--- /dev/null
+++ b/test/aux-fixed/2800.mdb.src
@@ -0,0 +1,3 @@
+first: data for first
+second: A=1 B=2
+third: A1:B2:C3
diff --git a/test/aux-fixed/exim-ca/example.com/BLANK/CA.pem b/test/aux-fixed/exim-ca/example.com/BLANK/CA.pem
index 8e8e7a01d..aab959bdb 100644
--- a/test/aux-fixed/exim-ca/example.com/BLANK/CA.pem
+++ b/test/aux-fixed/exim-ca/example.com/BLANK/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh0bvMeu3S1F6t7vEWH
-86hJbiW97pjm8A930DFhe/UIlgPsAmCePZEMg6EtakY5Huva4kYeBUejbRtd3LE7
-q07sOVQqcKt+X8wXThBBHPk/7q6BL+je3cfuisxsS1neX3m5BOAhROPr6kvFDz4f
-SRb4s3jT3bRgh5a7vl5JRv9FAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAA1n72ajcRt82cyo3R4P
-E9bqjhm4Y6d+a6vk4tPLk1uLD/EQw5ShAY6sM/FUzX8M4oyZ4A9Xouse0iXAVb50
-6gdqzfNtXeR5jIkTVNly0XJ99JfTgVHX0EcHPi3pffhiRCuNG2zEE6jIvUPym7UN
-3BXv6NWbBMOXAaVl99vckvxm
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK2aQA0QoS4VI5Aw1u8f
+Q94dMBwDYSo/+26Gln98d4N12j5UetDNx91Dvrn1mdWnnZvfMbUUIoDlBguwydKn
+90Qz5+bVMTww+wf5WYNY9n4Z9GTnHLTt6kzb0F5OEWu4Vsc5uFy0a/MiXbqAZpQf
+MHjf8F1cec3yt0c5hsaT/RNhAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBADnBYMdbtBpSSHTTvCTR
+XPlwy5nPTxics/HLv5DxIG3BKr97vYgONK+wHN45we8qxnoSpD0VoucJxef0rN4u
+X/yG6VoYjFRL/yW88nXzFy752nK83YrGGdUUWheY4OrAEGMmeyUe9Aw7GGczJi5u
+MTXhPAdr1Fn6Jj+eZy1Uv/yu
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/BLANK/Signer.pem b/test/aux-fixed/exim-ca/example.com/BLANK/Signer.pem
index d7176446f..a6a9e5b94 100644
--- a/test/aux-fixed/exim-ca/example.com/BLANK/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.com/BLANK/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/BLANK/cert8.db b/test/aux-fixed/exim-ca/example.com/BLANK/cert8.db
index e2de860fd..d1e263ae5 100644
Binary files a/test/aux-fixed/exim-ca/example.com/BLANK/cert8.db and b/test/aux-fixed/exim-ca/example.com/BLANK/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/BLANK/key3.db b/test/aux-fixed/exim-ca/example.com/BLANK/key3.db
index da930a58b..261c5657f 100644
Binary files a/test/aux-fixed/exim-ca/example.com/BLANK/key3.db and b/test/aux-fixed/exim-ca/example.com/BLANK/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/CA/CA.pem b/test/aux-fixed/exim-ca/example.com/CA/CA.pem
index 8e8e7a01d..aab959bdb 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/CA.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh0bvMeu3S1F6t7vEWH
-86hJbiW97pjm8A930DFhe/UIlgPsAmCePZEMg6EtakY5Huva4kYeBUejbRtd3LE7
-q07sOVQqcKt+X8wXThBBHPk/7q6BL+je3cfuisxsS1neX3m5BOAhROPr6kvFDz4f
-SRb4s3jT3bRgh5a7vl5JRv9FAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAA1n72ajcRt82cyo3R4P
-E9bqjhm4Y6d+a6vk4tPLk1uLD/EQw5ShAY6sM/FUzX8M4oyZ4A9Xouse0iXAVb50
-6gdqzfNtXeR5jIkTVNly0XJ99JfTgVHX0EcHPi3pffhiRCuNG2zEE6jIvUPym7UN
-3BXv6NWbBMOXAaVl99vckvxm
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK2aQA0QoS4VI5Aw1u8f
+Q94dMBwDYSo/+26Gln98d4N12j5UetDNx91Dvrn1mdWnnZvfMbUUIoDlBguwydKn
+90Qz5+bVMTww+wf5WYNY9n4Z9GTnHLTt6kzb0F5OEWu4Vsc5uFy0a/MiXbqAZpQf
+MHjf8F1cec3yt0c5hsaT/RNhAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBADnBYMdbtBpSSHTTvCTR
+XPlwy5nPTxics/HLv5DxIG3BKr97vYgONK+wHN45we8qxnoSpD0VoucJxef0rN4u
+X/yG6VoYjFRL/yW88nXzFy752nK83YrGGdUUWheY4OrAEGMmeyUe9Aw7GGczJi5u
+MTXhPAdr1Fn6Jj+eZy1Uv/yu
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/OCSP.key b/test/aux-fixed/exim-ca/example.com/CA/OCSP.key
index d67c9f9b0..f44a3c497 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/OCSP.key
+++ b/test/aux-fixed/exim-ca/example.com/CA/OCSP.key
@@ -1,20 +1,20 @@
 Bag Attributes
     friendlyName: OCSP Signer
-    localKeyID: A9 C9 02 7E EE 3B 0C ED EE D4 5A 38 52 2E 0F B1 4E 78 90 6F 
+    localKeyID: 5C 45 60 73 58 0B 05 B0 8A E3 5E E0 82 F4 43 38 BC 92 11 D1 
 Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBANS7PhoxmaBtzEYQ
-NnbpFdSPXjAnKmo4hpJ085KxTD0avIxef+dXk07P8ZgnRBVHLg2aQu6YB2RIEAoA
-rcHiBw07ph4zeCRRGFw1uhvvSjUAutzckuKGqjIFlBS1e2O1+R5PByURSU38MBUx
-HBLz5n9/JA1qvBPj0VdlmXPzdMPNAgMBAAECgYEAzF3Vm3RrEiRpSiXpLPNfdYUG
-B1yY8tK69ZhFJ3gMtecpm/BtD+KiMeSzRGj0jzyCka7Q/kYvU7enMPTV+J0cB2mU
-iCTzijotvRKyqCNTUAGPoW5fexnUSh1LfzpON+V1AL+7ZNXE0rQCOAITMLW8JZwb
-lUQc3sdWOcS5A+i7mgECQQD0oLG72Cmvgm5BJx4c9BebHisr9Oo8BaGUrlLkzufh
-Lsh5ty+iraibPpsEQfZS6PsXzC7PMRX9kUd05FjscF55AkEA3p7znhdcvyd/fIt3
-QlF7cyU8qQBtjUOMRVn2njMko7/3STHiPEeOxJdCVrQKxFRB4bYAcEVvFPDiGHIx
-Ex6q9QJAAkA0QnEzuPyvPQQ6H7QTP4cgiJABU7oNiYutEZPhyE2g5JXN52ZHpd4G
-mRxuQscIAGkNiTR/akza5nVvaAWEqQJBANkY+4y1Tb4gX6PuQgwLeC8PJjvNbghv
-0hAjrmwShe2mnBnmKrEMO38d3xS8mS9i16ism3rhS3WJf4PFgHQb2S0CQQCsI1e3
-Py8DxpsRqyIoxv/3HOT+vAiByiItW24Q59Qbd628bPP0q4y/Fa1dSkXPW8/4DvPr
-+sBszxcYF+ReAISE
+MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOXfY0A/oOp7KA4Q
+AtDupzSVuTLwDERtvI0C3Lbo7gsyx+PAbpnOwOkKoR8BbJ3/ay5UB8Ximwf2u2A4
+MDdtlK1/gmtkkU7l4bKlszy/CQ9ovYaKixFvfM5bI2Z5OUgjDtYG2HkatCKWPrdu
+RSV7xrCYZ+FAV/1zC4On0WoYu80RAgMBAAECgYACAERSalthvym1maEUpYcyF32R
+unI45EWoapZ2RyfPVCVWT7YGw7x9KtkFNpN1+qO5twSMTfEwjA7MgyC0UtFg/wpM
+QeeEK8KIOg7xgur1Q3mpb3E6o4ZOFcPV0S3dGP/kT3TSMbgGzChu2ZK5fLpwNk74
+BCD8eOE8JLq60yGxYwJBAPa431ywNBPp7atC9BDdON4BAEr0r6Cb+SZUJK1+DKpR
+1kVjq7Tt5TipsdBtYnQh2r0SFDKJw37ULDH54DFw07MCQQDuhE8jIQPPohFyLEUn
+HhIHSs/LEYWXtbSkWsZji4r1Q+1tCUOeqfZiMLo6MQgnwu1N534IpOXgmoAWGFsS
+z8orAkEAzIJqA7a7NFaP/4o8LU5yuPMzfu5cNlGTsMXGsVjuvq+fYV1BE3SusM1Y
+62AAYCs/2cGGpG21cwgEqlhqEhFoKQJBAKIT+orOhn5zjRNejedVAb8+0REW6Qb8
+jLIalTFTw6uC6zXq065fpHN41TNx2i7awNLtebF6DFOh6WQaTNjtpl0CQQCt7EvE
+fxcjWKwEJrUXF4gLho1GebR38Et5eRqFuhnMfPM7gu2FrPtXeIel4/Mm7QvBklv7
+a4epoR/YDYlkJ/xa
 -----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/OCSP.p12 b/test/aux-fixed/exim-ca/example.com/CA/OCSP.p12
index a30e7cd8d..25627d990 100644
Binary files a/test/aux-fixed/exim-ca/example.com/CA/OCSP.p12 and b/test/aux-fixed/exim-ca/example.com/CA/OCSP.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.com/CA/OCSP.pem b/test/aux-fixed/exim-ca/example.com/CA/OCSP.pem
index ebc0da930..db7c4dc01 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/OCSP.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/OCSP.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
 MIICBTCCAW6gAwIBAgIBAzANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzN1oXDTM4MDEwMTEyMzQzN1owMjEUMBIGA1UEChMLZXhhbXBsZS5jb20xGjAY
+MzQwM1oXDTM4MDEwMTEyMzQwM1owMjEUMBIGA1UEChMLZXhhbXBsZS5jb20xGjAY
 BgNVBAMTEWNsaWNhIE9DU1AgU2lnbmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
-iQKBgQDUuz4aMZmgbcxGEDZ26RXUj14wJypqOIaSdPOSsUw9GryMXn/nV5NOz/GY
-J0QVRy4NmkLumAdkSBAKAK3B4gcNO6YeM3gkURhcNbob70o1ALrc3JLihqoyBZQU
-tXtjtfkeTwclEUlN/DAVMRwS8+Z/fyQNarwT49FXZZlz83TDzQIDAQABoyowKDAO
+iQKBgQDl32NAP6DqeygOEALQ7qc0lbky8AxEbbyNAty26O4LMsfjwG6ZzsDpCqEf
+AWyd/2suVAfF4psH9rtgODA3bZStf4JrZJFO5eGypbM8vwkPaL2GiosRb3zOWyNm
+eTlIIw7WBth5GrQilj63bkUle8awmGfhQFf9cwuDp9FqGLvNEQIDAQABoyowKDAO
 BgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcN
-AQELBQADgYEAsXoaEXn4y4thG5KiB0k1HwU3NQ5TmuN6Z03WUO/5NLFYtMB0ztaL
-GOJgI5k8jQNuZxNb5nqvQBivZ/DiDAV/G3dPQDbqSgtF2Y5tROdC8/lYynhiY3nI
-2k0BO1snUtbjZbVdzAMVXBUmqUL+xIB2+A2MuTF3pHLMugeQYtbBbJc=
+AQELBQADgYEAItOiudWgomzwbClA9o7UIHV3bP5hQ6ZB6UA47+BB+BYqyq1toxNY
+uUZYuMr02fJzh3Y7yJCipQ0ac0vlFgVg1cuBcjYb+Qj8+jZPdU6iNuHhQVOArCqJ
+htS+pkqXstFkSRvFU6Ps5D8xgSbgFe+UE1iHqMHl5V8h9QlL85QM4Lg=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/Signer.key b/test/aux-fixed/exim-ca/example.com/CA/Signer.key
new file mode 100644
index 000000000..d10600a32
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.com/CA/Signer.key
@@ -0,0 +1,20 @@
+Bag Attributes
+    friendlyName: Signing Cert
+    localKeyID: 66 80 BF 3A C9 12 D9 85 0A B5 ED B3 6A A6 5A A2 73 20 52 EE 
+Key Attributes: <No Attributes>
+-----BEGIN PRIVATE KEY-----
+MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAOOMkRJs7F2ue2M4
+756NNjcQt6ZFfreQOq/A8zl6iM80dcT4OSYTj4x8ekr0kF/pND1GJe8X/RdqDhn3
+ETnJbzPTWnR+ujEI3a/PvdW5lKeyWrfdYKx2XycB+wW16sGB5csHNh3HsCxR3dSR
+v/Oj2lL6pe2/FNjh3sLUbkIF9+MTAgMBAAECgYAa5hHQ0Z3KteaxxC1rRY/MSEZ1
+ZM9bHV/FSUlXQ5lq6RgnjceaV9icclXgiMg3q5vNxyjnz82kLW4iT/cHfjzjSefm
+IYilLzE5jtkXJnCfzWIzLHYKwe1HCLX5S78YYiVJkjKtZrC9hnAPTHRQBBJ9IHHo
+U7Qk2mKzBdbYEpeQ1QJBAPW/Yi0VDisjbFI601PhzoiWLBLz3dEy9ZWj58MvrLWo
+0a/bxsjrxmumcR1qpuszZcHFl/JRQVmJ55Mpy0cFff8CQQDtCtIfGwrN3/QVE2K5
+2+dEbzlDPpk2qmsQXduZT5bXYo9t2Q5bac+V8X9WfvmfxP71SdpvqDUSCVkBACcx
+mcLtAkAI5PhksVJl9U5CW6ayboXPI8BMn07z92g0Fk6ZHeyeVpHgT5AOTZpM4yVM
+70NDWATi0ogBWTeIShl7lhOpamV5AkBRt5ZCdO8flCIwFdPGIQI0PGewP+dPyiZI
+qSKoUqC8tdSeWOKzLuIKXgu5BOMHakE+zGwKbCGHi0NsreHVHp3tAkAUC2+PTjlj
+Z3A+ZzwC/Vt81W+GtQOOmGTWwfUZMowFV/uw7hQRN1ALWTCv6O0xGa7evoSTjS9s
+FXqDkIT381kD
+-----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/Signer.p12 b/test/aux-fixed/exim-ca/example.com/CA/Signer.p12
new file mode 100644
index 000000000..d9ef4ce4a
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/CA/Signer.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.com/CA/Signer.pem b/test/aux-fixed/exim-ca/example.com/CA/Signer.pem
index d7176446f..a6a9e5b94 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/ca.conf b/test/aux-fixed/exim-ca/example.com/CA/ca.conf
index 103e71258..299506f96 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/ca.conf
+++ b/test/aux-fixed/exim-ca/example.com/CA/ca.conf
@@ -1,19 +1,19 @@
 ; Config::Simple 4.59
-; Thu Nov  1 12:34:37 2012
+; Thu Nov  1 12:34:02 2012
 
 [CLICA]
-ocsp_signer=OCSP Signer
 sighash=SHA256
+crl_signer=Signing Cert
 crl_url=http://crl.example.com/latest.crl
-ocsp_url=http://oscp/example.com/
 level=1
-crl_signer=Signing Cert
 signer=Signing Cert
+ocsp_signer=OCSP Signer
+ocsp_url=http://oscp.example.com/
 
 [CA]
+org=example.com
 subject=clica CA
 name=Certificate Authority
-org=example.com
 bits=1024
 
 
diff --git a/test/aux-fixed/exim-ca/example.com/CA/cert8.db b/test/aux-fixed/exim-ca/example.com/CA/cert8.db
index 96eaf920f..c1e110e9e 100644
Binary files a/test/aux-fixed/exim-ca/example.com/CA/cert8.db and b/test/aux-fixed/exim-ca/example.com/CA/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.empty b/test/aux-fixed/exim-ca/example.com/CA/crl.empty
index 36353055c..53a795670 100644
Binary files a/test/aux-fixed/exim-ca/example.com/CA/crl.empty and b/test/aux-fixed/exim-ca/example.com/CA/crl.empty differ
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.empty.in.txt b/test/aux-fixed/exim-ca/example.com/CA/crl.empty.in.txt
index 9ad997438..c7de23ec6 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.empty.in.txt
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.empty.in.txt
@@ -1 +1 @@
-update=20151216164103Z 
+update=20161101174750Z 
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.empty.pem b/test/aux-fixed/exim-ca/example.com/CA/crl.empty.pem
index 2c480cd63..1e496dfbd 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.empty.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.empty.pem
@@ -1,7 +1,7 @@
 -----BEGIN X509 CRL-----
 MIHtMFgCAQEwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhhbXBsZS5jb20x
-GzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydBgPMjAxNTEyMTYxNjQxMDNaMA0G
-CSqGSIb3DQEBCwUAA4GBAHP7LDu9YflzDqwChDy5txXymX13+iYnBZx0Q9JfbThm
-wPVH4iCfsqQ+vWhEnTcFDYWZ43USFm6JjKWOLQBO7NX1pFF/5Y/YSV3OiKER1cGl
-GRikqJ/B+80V4+7SjFdkGU3A5sYSsnRDZYEtSfykc5tdhZqjXmBwFUckGzCPLuso
+GzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydBgPMjAxNjExMDExNzQ3NTBaMA0G
+CSqGSIb3DQEBCwUAA4GBANWNiRAfuqCpy5xCJRHBQX8PeS7SMvKsgN3/7CahxPMo
+/1AXqiQfsSK91kI4EVbcTUuEIlSmZyVk5fVFsfn1nYDyTjqmpuiNhR1473KJsLO6
+CkWLFB0FLcpZIxoKjA00F7fWXA+OI95pr76JixcWUYESQBkgWQGYxEvhdgDH+Fh6
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.v2 b/test/aux-fixed/exim-ca/example.com/CA/crl.v2
index 9a4b5b88d..d3acb6e5e 100644
Binary files a/test/aux-fixed/exim-ca/example.com/CA/crl.v2 and b/test/aux-fixed/exim-ca/example.com/CA/crl.v2 differ
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.v2.in.txt b/test/aux-fixed/exim-ca/example.com/CA/crl.v2.in.txt
index 26b5b38a0..a488ee041 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.v2.in.txt
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.v2.in.txt
@@ -1,3 +1,3 @@
-update=20151216164105Z 
-addcert 102 20151216164105Z
-addcert 202 20151216164105Z
+update=20161101174753Z 
+addcert 102 20161101174753Z
+addcert 202 20161101174753Z
diff --git a/test/aux-fixed/exim-ca/example.com/CA/crl.v2.pem b/test/aux-fixed/exim-ca/example.com/CA/crl.v2.pem
index 1d61998e9..4f3928500 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/crl.v2.pem
+++ b/test/aux-fixed/exim-ca/example.com/CA/crl.v2.pem
@@ -1,9 +1,9 @@
 -----BEGIN X509 CRL-----
 MIIBHTCBhwIBATANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFtcGxlLmNv
-bTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0GA8yMDE1MTIxNjE2NDEwNVow
-LTAUAgFmGA8yMDE1MTIxNjE2NDEwNVowFQICAMoYDzIwMTUxMjE2MTY0MTA1WjAN
-BgkqhkiG9w0BAQsFAAOBgQCbR/9pp3MS1SqJiPu1/7lix4dtcqXEDkSH/AjiTZNi
-WXuK0wystCuzaSuAR+iZwk7DmxGhx5k+L5adlcWJNhBXR3zfZB4dwVhVKUpKSayO
-RE5iq8kYF5ifU9aroTtrbh2yR+XXHd8X7tkkt/bsMVNm1aQ/NgJeApmlZtB7Gx/o
-jg==
+bTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0GA8yMDE2MTEwMTE3NDc1M1ow
+LTAUAgFmGA8yMDE2MTEwMTE3NDc1M1owFQICAMoYDzIwMTYxMTAxMTc0NzUzWjAN
+BgkqhkiG9w0BAQsFAAOBgQBecwRKnMEtZ1Hy5UKs5KR8N9oM1lvHeVCpf2KDYgR2
+x0W4qsPVhMQTt23XhNZwQ+FX+u1l+doNZlwBk7HJOdnrT0X6KlCIO/jomd5NtQ7c
+DtWoNakhoESob/L2Kcd9RlkeZmhV9sJ/nFDURy6367+jWa5HHhyfEQDOj2rQ8mqQ
+Qw==
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.com/CA/key3.db b/test/aux-fixed/exim-ca/example.com/CA/key3.db
index 4a97462c2..99a934872 100644
Binary files a/test/aux-fixed/exim-ca/example.com/CA/key3.db and b/test/aux-fixed/exim-ca/example.com/CA/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/CA/noise.file b/test/aux-fixed/exim-ca/example.com/CA/noise.file
index ee7abc694..175520295 100644
--- a/test/aux-fixed/exim-ca/example.com/CA/noise.file
+++ b/test/aux-fixed/exim-ca/example.com/CA/noise.file
@@ -1,201 +1,188 @@
 processor	: 0
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 2615.210
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
 physical id	: 0
-siblings	: 4
+siblings	: 1
 core id		: 0
-cpu cores	: 2
+cpu cores	: 1
 apicid		: 0
 initial apicid	: 0
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
 processor	: 1
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 3274.734
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
-physical id	: 0
-siblings	: 4
+physical id	: 1
+siblings	: 1
 core id		: 0
-cpu cores	: 2
+cpu cores	: 1
 apicid		: 1
 initial apicid	: 1
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
 processor	: 2
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 3300.222
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
-physical id	: 0
-siblings	: 4
-core id		: 1
-cpu cores	: 2
+physical id	: 2
+siblings	: 1
+core id		: 0
+cpu cores	: 1
 apicid		: 2
 initial apicid	: 2
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
 processor	: 3
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 3594.414
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
-physical id	: 0
-siblings	: 4
-core id		: 1
-cpu cores	: 2
+physical id	: 3
+siblings	: 1
+core id		: 0
+cpu cores	: 1
 apicid		: 3
 initial apicid	: 3
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
            CPU0       CPU1       CPU2       CPU3       
-  0:         68          0          0          0   IO-APIC   2-edge      timer
-  1:        689       7853        658        778   IO-APIC   1-edge      i8042
-  8:          0          0          1          0   IO-APIC   8-edge      rtc0
-  9:       1160        695        344        261   IO-APIC   9-fasteoi   acpi
- 12:     314976    1327914     163447     143732   IO-APIC  12-edge      i8042
- 16:        332        194        163        132   IO-APIC  16-fasteoi   ehci_hcd:usb3, mmc0
- 18:          0          0          0          0   IO-APIC  18-fasteoi   i801_smbus
- 23:         17         31          0          0   IO-APIC  23-fasteoi   ehci_hcd:usb4
- 24:      43314       5748     786804       3298   PCI-MSI 512000-edge      0000:00:1f.2
- 25:          0          0          0          0   PCI-MSI 327680-edge      xhci_hcd
- 26:          3          4          0          1   PCI-MSI 409600-edge      enp0s25
- 27:        852        591         64         42   PCI-MSI 32768-edge      i915
- 28:          8          6          3          6   PCI-MSI 360448-edge      mei_me
- 29:         62         82          0          6   PCI-MSI 442368-edge      snd_hda_intel
- 30:     779441       1591         37         80   PCI-MSI 1572864-edge      iwlwifi
-NMI:         94         87         91         87   Non-maskable interrupts
-LOC:    2715890    2175650    2756976    2240423   Local timer interrupts
+  0:        135          0          0          0   IO-APIC-edge      timer
+  1:          1          2          3          2   IO-APIC-edge      i8042
+  6:          0          1          1          1   IO-APIC-edge      floppy
+  8:          0          0          0          0   IO-APIC-edge      rtc0
+  9:          0          0          0          0   IO-APIC-fasteoi   acpi
+ 10:        496        482        486        468   IO-APIC-fasteoi   virtio4
+ 11:         10        147         30         27   IO-APIC-fasteoi   uhci_hcd:usb1, qxl
+ 12:          0         41         47         38   IO-APIC-edge      i8042
+ 14:          0          0          0          0   IO-APIC-edge      ata_piix
+ 15:         24         20     182194         20   IO-APIC-edge      ata_piix
+ 24:          0          0          0          0   PCI-MSI-edge      virtio0-config
+ 25:          0          0          0          0   PCI-MSI-edge      virtio2-config
+ 26:          0          3          1          4   PCI-MSI-edge      virtio2-virtqueues
+ 27:    3075029         25         27         24   PCI-MSI-edge      virtio0-input.0
+ 28:          0          0          1          0   PCI-MSI-edge      virtio0-output.0
+ 29:          0          0          0          0   PCI-MSI-edge      virtio1-config
+ 30:          8         10          6     263036   PCI-MSI-edge      virtio1-input.0
+ 31:          0          1          1          0   PCI-MSI-edge      virtio1-output.0
+ 32:          0          0          0          0   PCI-MSI-edge      virtio3-config
+ 33:       2251       1443       1443      76412   PCI-MSI-edge      virtio3-req.0
+NMI:          0          0          0          0   Non-maskable interrupts
+LOC:    2927588    2332410    2357757    2469878   Local timer interrupts
 SPU:          0          0          0          0   Spurious interrupts
-PMI:         94         87         91         87   Performance monitoring interrupts
-IWI:          0          6          3          4   IRQ work interrupts
+PMI:          0          0          0          0   Performance monitoring interrupts
+IWI:     171654      62779      47813      57003   IRQ work interrupts
 RTR:          0          0          0          0   APIC ICR read retries
-RES:     181874     181890     174943     218142   Rescheduling interrupts
-CAL:     155876      95337     153276      90505   Function call interrupts
-TLB:      19954      22438      21482      20783   TLB shootdowns
+RES:     801927     676810     570786     698330   Rescheduling interrupts
+CAL:      22675      11464      17532       1233   Function call interrupts
+TLB:      82281      78051      78821      80323   TLB shootdowns
 TRM:          0          0          0          0   Thermal event interrupts
 THR:          0          0          0          0   Threshold APIC interrupts
-DFR:          0          0          0          0   Deferred Error APIC interrupts
 MCE:          0          0          0          0   Machine check exceptions
-MCP:         29         29         29         29   Machine check polls
-HYP:          0          0          0          0   Hypervisor callback interrupts
+MCP:        624        624        624        624   Machine check polls
 ERR:          0
 MIS:          0
-PIN:          0          0          0          0   Posted-interrupt notification event
-PIW:          0          0          0          0   Posted-interrupt wakeup event
-MemTotal:       16127228 kB
-MemFree:        11188304 kB
-MemAvailable:   11366680 kB
-Buffers:           13528 kB
-Cached:           250856 kB
-SwapCached:      1969132 kB
-Active:          2291068 kB
-Inactive:        2270716 kB
-Active(anon):    2258368 kB
-Inactive(anon):  2128068 kB
-Active(file):      32700 kB
-Inactive(file):   142648 kB
-Unevictable:       22232 kB
-Mlocked:           22232 kB
-SwapTotal:       7286780 kB
-SwapFree:         617204 kB
-Dirty:              3652 kB
+MemTotal:        1785008 kB
+MemFree:          252440 kB
+MemAvailable:    1297232 kB
+Buffers:               0 kB
+Cached:           491464 kB
+SwapCached:          252 kB
+Active:           330668 kB
+Inactive:         223256 kB
+Active(anon):      30216 kB
+Inactive(anon):    73420 kB
+Active(file):     300452 kB
+Inactive(file):   149836 kB
+Unevictable:           0 kB
+Mlocked:               0 kB
+SwapTotal:       3354620 kB
+SwapFree:        3353308 kB
+Dirty:               728 kB
 Writeback:             0 kB
-AnonPages:       2350492 kB
-Mapped:           158544 kB
-Shmem:             80340 kB
-Slab:             122620 kB
-SReclaimable:      63028 kB
-SUnreclaim:        59592 kB
-KernelStack:       12384 kB
-PageTables:        60012 kB
+AnonPages:         62116 kB
+Mapped:            18712 kB
+Shmem:             41176 kB
+Slab:             898296 kB
+SReclaimable:     847920 kB
+SUnreclaim:        50376 kB
+KernelStack:        2752 kB
+PageTables:         5844 kB
 NFS_Unstable:          0 kB
 Bounce:                0 kB
 WritebackTmp:          0 kB
-CommitLimit:    15350392 kB
-Committed_AS:   22212804 kB
+CommitLimit:     4247124 kB
+Committed_AS:     387204 kB
 VmallocTotal:   34359738367 kB
-VmallocUsed:      457088 kB
-VmallocChunk:   34358947836 kB
+VmallocUsed:      149692 kB
+VmallocChunk:   34359524352 kB
 HardwareCorrupted:     0 kB
-AnonHugePages:   1890304 kB
+AnonHugePages:      6144 kB
 HugePages_Total:       0
 HugePages_Free:        0
 HugePages_Rsvd:        0
 HugePages_Surp:        0
 Hugepagesize:       2048 kB
-DirectMap4k:      144572 kB
-DirectMap2M:    16322560 kB
+DirectMap4k:       67576 kB
+DirectMap2M:     4126720 kB
 Inter-|   Receive                                                |  Transmit
  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
-virbr1-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
- vnet0:  128666     393    0    0    0     0          0         0   317089    3974    0    0    0     0       0          0
- vnet5:   43924     524    0    0    0     0          0         0   221582    3857    0    0    0     0       0          0
-enp0s25: 31338290   49183    0    0    0     0          0      1035 10708826   44319    0    0    0     0       0          0
-virbr0-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
- vnet2:   69293     283    0    0    0     0          0         0   364106    3768    0    0    0     0       0          0
- vnet4:   59178     194    0    0    0     0          0         0   238283    3592    0    0    0     0       0          0
-virbr0: 5345737    5274    0    0    0     0          0         0  1408922    5318    0    0    0     0       0          0
- vnet1: 5034219    3505    0    0    0     0          0         0  1151009    7191    0    0    0     0       0          0
-    lo:   20864     210    0    0    0     0          0         0    20864     210    0    0    0     0       0          0
-virbr1:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
-wlp3s0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
- vnet3:   84293     375    0    0    0     0          0         0   279453    3662    0    0    0     0       0          0
+  eth0: 218818091 3198854    0 95478    0     0          0         0  7346771   57437    0    0    0     0       0          0
+  eth1: 29581672  268301    0 93500    0     0          0         0 30026524   67527    0    0    0     0       0          0
+    lo:    1056      11    0    0    0     0          0         0     1056      11    0    0    0     0       0          0
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/expired1.example.com/ca_chain.pem
index d30156d31..a231554fb 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.com/CN=clica Signing Cert
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.com/CN=clica CA
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh0bvMeu3S1F6t7vEWH
-86hJbiW97pjm8A930DFhe/UIlgPsAmCePZEMg6EtakY5Huva4kYeBUejbRtd3LE7
-q07sOVQqcKt+X8wXThBBHPk/7q6BL+je3cfuisxsS1neX3m5BOAhROPr6kvFDz4f
-SRb4s3jT3bRgh5a7vl5JRv9FAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAA1n72ajcRt82cyo3R4P
-E9bqjhm4Y6d+a6vk4tPLk1uLD/EQw5ShAY6sM/FUzX8M4oyZ4A9Xouse0iXAVb50
-6gdqzfNtXeR5jIkTVNly0XJ99JfTgVHX0EcHPi3pffhiRCuNG2zEE6jIvUPym7UN
-3BXv6NWbBMOXAaVl99vckvxm
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK2aQA0QoS4VI5Aw1u8f
+Q94dMBwDYSo/+26Gln98d4N12j5UetDNx91Dvrn1mdWnnZvfMbUUIoDlBguwydKn
+90Qz5+bVMTww+wf5WYNY9n4Z9GTnHLTt6kzb0F5OEWu4Vsc5uFy0a/MiXbqAZpQf
+MHjf8F1cec3yt0c5hsaT/RNhAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBADnBYMdbtBpSSHTTvCTR
+XPlwy5nPTxics/HLv5DxIG3BKr97vYgONK+wHN45we8qxnoSpD0VoucJxef0rN4u
+X/yG6VoYjFRL/yW88nXzFy752nK83YrGGdUUWheY4OrAEGMmeyUe9Aw7GGczJi5u
+MTXhPAdr1Fn6Jj+eZy1Uv/yu
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/expired1.example.com/cert8.db
index f0b014803..c22fc2d82 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired1.example.com/cert8.db and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.chain.pem
index e8807fb30..5490231f0 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired1.example.com
-    localKeyID: 1D 8D B3 EB E2 01 97 B8 A4 4F 93 B5 39 7A 10 AF 68 87 60 97 
+    localKeyID: 74 0B 83 3D D8 F1 19 00 06 6B B7 31 AB 7D 7B 9E 9E F8 39 D5 
 subject=/CN=expired1.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZzANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOFoXDTEyMTIwMTEyMzQzOFowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
-ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKmS9h3sQnaUqTtzQdvM
-dsszclutlJF9n2k/e/8Mz9xu/yiRc2pcWSFGNx2XmYIrLdrb79F0dHFejctZNOoB
-7dctDzyN8FOkbUnGcAYMW7RnsAcocnNoWqyR60w7BajfL5elVPKTtmwxCNOy7j5s
-pn3o70o0WaJP34SGaPdYfWBrAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQwNVoXDTEyMTIwMTEyMzQwNVowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
+ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALy2HJZRTcNSDF5QRW3X
+BQNLIYmrDUq3yumF4PE9MOXr0+xg/EmPQwJDB3zh06zwt1T+sV6iQb2Q0c2FhaHO
+uwWJqUbAiFsnT9BTVoRKu2ucZGSMQnkN6/pm72DHob6rMrTfPj6KOyTivuAhyDW5
+i1goyUFTdn8SJ61l8HL5byF9AgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLmNvbS8wHwYDVR0R
-BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEAuW6u
-xSxwfUv1NIJQIGyDPf9kEi7nPch1u1ta7E6usS3nlH1GfYNYTdBudLABm4sU44iD
-1I9QHqTfGfmFsKWtIG8XQE/tTW9DqOtht0j6WTxfeZXqCFlIJhwr1DrvEkKw/DPE
-kxhqh7U8uIf2h9UXIa1agAZQ2q9pnPvtu7hsMuc=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wHwYDVR0R
+BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEARaN7
+KMTp2MpeFZ1L2SN9WRYwykEiD9E9aP+ML/TKtt+9T7GUooFVuJCo6XxwDwKQeU5k
+hXeBId0fzHBbxmm8hv/OCC8A0bXokabggpwcpJj1KiWjTCNjP0SpcDbCVh/tnqnW
+VObxV0+BX8B33kUGQmxWMZTknCSQYOcae9Oifac=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.key b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.key
index 903936e4a..c8917b26b 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired1.example.com
-    localKeyID: 1D 8D B3 EB E2 01 97 B8 A4 4F 93 B5 39 7A 10 AF 68 87 60 97 
+    localKeyID: 74 0B 83 3D D8 F1 19 00 06 6B B7 31 AB 7D 7B 9E 9E F8 39 D5 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQId4zaw1+hp4UCAggA
-MBQGCCqGSIb3DQMHBAhWhjpnf3JJfwSCAoBwGvY8Z+AUn2O1j9MqHrwj9U/+uPQH
-0I4dumc8zqOkNZ4XvyDN7An8BlKPFSIkrB8+/AliWNhhmk80/7kB7XZ8BrqZ1Lyj
-CuMJO4u1Pg7aCO2eO7Uq/0H7WgnZOFsJ+BmL7ozu7LXZVuVZXIgtb76Cmmv1+Llf
-31UgEHMHugNyCS1t9aSVXzUQwaFOporeDuQucF2xZK+KlIZ+SA9es9zPubFNrSh6
-lz8k6muz/TVlv+mUQ1NJjfRi2mlgtmnVBtkcAzW9JULt+QGSoTeWCVekCma/hbWG
-I2dhyF1ILC1wNRTe4rW1jigIAvKSWu1iZmnPEtMLaax3uVUifszq/WEazlpuk7jo
-7AmuG8s0XRTW6MH3idNN8LJQ07ZaMZrDk9VeBgrfM8LfIBgWj/QOgObJdqz1YpPg
-52tNLBThqto2QFV8Nyw8wCYLdPALEapHnmIWHzpozyOyhhNJtxHqunnZ7lrihD2n
-+yqMORMzAjNBgXgmrqhTfNFwK1bDGM+feBZWh/d9yLTgEeHIn12bjB619leBtUI5
-8+YaXbl8Z9s8h0OuF4Q1ix8R2WZdCAwy6W96B/HxqcWy6BsnapwkYQbc9ifHqAT9
-TXpnWJ/xYL7ZgUPzGGzu4FhZcHOtKO8SM1YOLJhe+Uws622M/7a+XPl9WL6Xvw8C
-J/Lq/RnHm0CbMOcAPk5IiMbWXi6oWaDEUI6HkcNDPWEMRNeZaBto7VBV3rhkohFO
-YpyAK+ttXGFo/iHr4VkFKZQ6AaUpkzE+DkLAPM+0x7Rrdm1NFNfP/WmPAP8vjrCT
-FdMBy5vCXtUsHVKl4Aa9ic/fAXPVO/xLuqY0vaSn4Krvj5H6tBbo8L7l
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI4jACuaIHJ84CAggA
+MBQGCCqGSIb3DQMHBAj08DCtju6rWwSCAoD1UBHO5lXLwHuQcfSjaRQF6fwzI8fK
+okLEQMxBRXirCP6webLBy3X6kGsKNxxs3Wd6JAV0Gw4ESRUConGQEpqGIjdmKhcH
++lKSQssW0CSw5axXpJr0nt+hBbxpKPScJugriJBJlZoGf86/1j81bHmZV7bT9G8e
+jMD1VeGmRi9kVZWfKLmMWiR6FbXei9jsqZCVtoYWj/zu4HBveVwfKFW58Eff1nYT
+YcW9eLJPvMFYpCnCVptkXK6IjNjnGlGkXUC2QAH+J1IH83kXOw/O+EccdJFKD1tP
+uxNQCiw4X5vAmcdmt4i6N8Iozqz2vz2OGxCW+ymCEJq6ZdaHLQngHeN/FzHq2kiD
+3crfjsoZYKzHV8XkzyHAx1qTySRbucgf/HukabqVBUZ8VEQKRCfMsF6csd9Ch0bm
+gUcqU8vSxlzlG+pRPxYBsSZraOyj9+Gkkb9XwMnXm+kTHqBejgB8iL27ZA6mUNX9
+Flnu3fmg8XUJWmsmUvHInAEm0QkuvR21wlyq3OvFXW5Z3YCimm6sWCYgJRBe7l8I
+DhIr4ki/oMwfKGmnvBSFJoSlj/O9JiNVO+5WdB4c43HQ3Ck07oVFw3UJNhXHnVnh
+u8fAYrgui+LTBEoKOVwEAADQBDMZ2Eq2PLSAs5xQp/n7Ygrptb8egbpiY75CvRuv
+I6Yq6Yb6vnE20Q8LapUZNymN6mfltu/79/XGYYTki89eSpsjgDPvcA95y8t7UuHi
+PlEYxaVo5qqRJGh/GKBa6rtsJR+hRwTeVhGp503N6e6eLpc+wZm0tuRv1BFu6HM/
+sCpnza17FDflZk8A27TGNguUnYtV6sZ9Db2LcdAKMiGbgYXxzsXzPjnr
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.dated.resp
index f26ae27fa..d6731eddb 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.good.resp
index 08c8b67c6..f65e84336 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.req
index f71baa690..2a0661886 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.req and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.revoked.resp
index 798ec42df..6f2afa08e 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.dated.resp
new file mode 100644
index 000000000..bc3bf999c
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.good.resp
new file mode 100644
index 000000000..c9f2a7234
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..1a94405aa
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..76584f9e9
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..0aa9f4e1a
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..540c48a63
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.p12 b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.p12
index 9290b2c2d..e581f0f89 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.p12 and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.pem b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.pem
index c4ca235a8..42ce2bb6a 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired1.example.com
-    localKeyID: 1D 8D B3 EB E2 01 97 B8 A4 4F 93 B5 39 7A 10 AF 68 87 60 97 
+    localKeyID: 74 0B 83 3D D8 F1 19 00 06 6B B7 31 AB 7D 7B 9E 9E F8 39 D5 
 subject=/CN=expired1.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZzANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOFoXDTEyMTIwMTEyMzQzOFowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
-ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKmS9h3sQnaUqTtzQdvM
-dsszclutlJF9n2k/e/8Mz9xu/yiRc2pcWSFGNx2XmYIrLdrb79F0dHFejctZNOoB
-7dctDzyN8FOkbUnGcAYMW7RnsAcocnNoWqyR60w7BajfL5elVPKTtmwxCNOy7j5s
-pn3o70o0WaJP34SGaPdYfWBrAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQwNVoXDTEyMTIwMTEyMzQwNVowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
+ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALy2HJZRTcNSDF5QRW3X
+BQNLIYmrDUq3yumF4PE9MOXr0+xg/EmPQwJDB3zh06zwt1T+sV6iQb2Q0c2FhaHO
+uwWJqUbAiFsnT9BTVoRKu2ucZGSMQnkN6/pm72DHob6rMrTfPj6KOyTivuAhyDW5
+i1goyUFTdn8SJ61l8HL5byF9AgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLmNvbS8wHwYDVR0R
-BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEAuW6u
-xSxwfUv1NIJQIGyDPf9kEi7nPch1u1ta7E6usS3nlH1GfYNYTdBudLABm4sU44iD
-1I9QHqTfGfmFsKWtIG8XQE/tTW9DqOtht0j6WTxfeZXqCFlIJhwr1DrvEkKw/DPE
-kxhqh7U8uIf2h9UXIa1agAZQ2q9pnPvtu7hsMuc=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wHwYDVR0R
+BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEARaN7
+KMTp2MpeFZ1L2SN9WRYwykEiD9E9aP+ML/TKtt+9T7GUooFVuJCo6XxwDwKQeU5k
+hXeBId0fzHBbxmm8hv/OCC8A0bXokabggpwcpJj1KiWjTCNjP0SpcDbCVh/tnqnW
+VObxV0+BX8B33kUGQmxWMZTknCSQYOcae9Oifac=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.unlocked.key
index 569c3b056..04e991a12 100644
--- a/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/expired1.example.com/expired1.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCpkvYd7EJ2lKk7c0HbzHbLM3JbrZSRfZ9pP3v/DM/cbv8okXNq
-XFkhRjcdl5mCKy3a2+/RdHRxXo3LWTTqAe3XLQ88jfBTpG1JxnAGDFu0Z7AHKHJz
-aFqsketMOwWo3y+XpVTyk7ZsMQjTsu4+bKZ96O9KNFmiT9+Ehmj3WH1gawIDAQAB
-AoGAfQ/j8CGkyuvM/Al/Euny2t5wgui736l0fhzSCEKcsogyKutK4bCGE6JDV9HM
-51GNGhKHBkUK8+m2TbjW65bMn2hJxlViQLuvnb2mlZZOLOpEIdbpV1yRENztrx2l
-f7ZND+EjsItH78wnsXa+qgxi8sUMaALOeQ7yQgOjqO1O5VECQQDQ24S+iYOfvkL8
-xzHYGjKOyQrEWaDkZKq0we6adF/Aylc+MMida5W11ZVdjDzTrspamJomF9MOJkiQ
-NYQ+jii1AkEAz9mEA9rWLFIY+BjoDPUP3V3xup0uDLlwlN9SGwo//88+Zlam0O2t
-ebWSFvfslgybE2FDtFohudnwsE90UzC4nwJAQ4oJVjhP6TN0pBuiQbjPCp92rOIz
-BkiLb2KbTzU81bJZHhJWfZmR0zhbUeIMtYN7imp4xsLDjHrS0leMCVKdVQJAZKgY
-MK237rrLcMrPBgdf6XpnaFJaTLs5dD86SfIK0F2TAIiSPLf9vOVbnFfwcTIln5sI
-6LyFfLW4xAmWcfs0TQJBALePhUzat8EM5Ao1a5vmAVOH6Yp2lh/sdSF2wU3Rr/bt
-jfT+7rX1Ue5hOgjJ+c8K4f2KQU4yX7HtkwmFFg6W1/s=
+MIICXQIBAAKBgQC8thyWUU3DUgxeUEVt1wUDSyGJqw1Kt8rpheDxPTDl69PsYPxJ
+j0MCQwd84dOs8LdU/rFeokG9kNHNhYWhzrsFialGwIhbJ0/QU1aESrtrnGRkjEJ5
+Dev6Zu9gx6G+qzK03z4+ijsk4r7gIcg1uYtYKMlBU3Z/EietZfBy+W8hfQIDAQAB
+AoGAARQ7A3xRGbmmuCOFh0siXiOEn+q8Ynh/EGL4KuufmrjOEKOMCB7K6NwAy3LB
+0dLubIpL8cySGbcnQur6aRqeUApckTKEQCJVngWNCuyOsS2c4ymMhL6c5iKM/s7z
+DK/JR7rSI6eaWuNzJDN7uk3d6B36UPQrKYcY3LUUgcJ4n3ECQQDj4IXAQ2U3szUW
+ZWIH43GrF3RVj6ozfLoyX/JEV8AZlLwzYBTcrMncTwxbGSZgf1axWMBg/X77OAlP
+pbAwYvsRAkEA1AAzet5Dn/dZbsF03gSOSF7sb8UvgYUZwVWN9o4FXFjkYTCOhLFi
+xKGLQEb5KBUef1KEUpxgr79NVycs6s4HrQJBAJmlHQmRZ4Gy1yyOlxZyiIWvfsTh
+5QRqKLEmeBcUg3W8D1kkg2x3JHPi6JXT00hlE3LoQG4k/aUtFzoYoT8+vcECQGu/
+smqHXv2FvOmi36Ab1qkHvcnNAaklmgJ+Vknywty9vU18XWMpuRZROLIxoF7z5O03
+ZlOKcUXByDA8lAK/Nn0CQQCMpajB4RGF9IxWhfkNqdcEaei1qFlLo7l7KpZUI6UK
+056Q7UpuPfUaUG1reUKlwDAUzvj0djAQhbJqrmagd2NV
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired1.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/expired1.example.com/key3.db
index c71333d64..d3c7c6fa2 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired1.example.com/key3.db and b/test/aux-fixed/exim-ca/example.com/expired1.example.com/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/expired2.example.com/ca_chain.pem
index d30156d31..a231554fb 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.com/CN=clica Signing Cert
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.com/CN=clica CA
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh0bvMeu3S1F6t7vEWH
-86hJbiW97pjm8A930DFhe/UIlgPsAmCePZEMg6EtakY5Huva4kYeBUejbRtd3LE7
-q07sOVQqcKt+X8wXThBBHPk/7q6BL+je3cfuisxsS1neX3m5BOAhROPr6kvFDz4f
-SRb4s3jT3bRgh5a7vl5JRv9FAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAA1n72ajcRt82cyo3R4P
-E9bqjhm4Y6d+a6vk4tPLk1uLD/EQw5ShAY6sM/FUzX8M4oyZ4A9Xouse0iXAVb50
-6gdqzfNtXeR5jIkTVNly0XJ99JfTgVHX0EcHPi3pffhiRCuNG2zEE6jIvUPym7UN
-3BXv6NWbBMOXAaVl99vckvxm
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK2aQA0QoS4VI5Aw1u8f
+Q94dMBwDYSo/+26Gln98d4N12j5UetDNx91Dvrn1mdWnnZvfMbUUIoDlBguwydKn
+90Qz5+bVMTww+wf5WYNY9n4Z9GTnHLTt6kzb0F5OEWu4Vsc5uFy0a/MiXbqAZpQf
+MHjf8F1cec3yt0c5hsaT/RNhAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBADnBYMdbtBpSSHTTvCTR
+XPlwy5nPTxics/HLv5DxIG3BKr97vYgONK+wHN45we8qxnoSpD0VoucJxef0rN4u
+X/yG6VoYjFRL/yW88nXzFy752nK83YrGGdUUWheY4OrAEGMmeyUe9Aw7GGczJi5u
+MTXhPAdr1Fn6Jj+eZy1Uv/yu
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/expired2.example.com/cert8.db
index d1cddcdd7..9193f520a 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired2.example.com/cert8.db and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.chain.pem
index 474bf710c..cf0d3a438 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired2.example.com
-    localKeyID: 48 F3 D4 21 D9 EF 74 92 A0 CB E0 C0 CB E6 A7 51 91 BA CD DA 
+    localKeyID: 55 EB 55 1B FD 2C A9 66 7D 3F 2E B2 F5 5B EF 6F 60 12 64 2E 
 subject=/CN=expired2.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMswDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0MzhaFw0xMjEyMDExMjM0MzhaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
-bGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDmqrEeyxGQtG7IJoUJ
-0VHcLaQ5naoruyTS0vqijmyQPJjPNA+FiZypHjhIT9M0TMa4Ynu/DDKRZm1p0XPw
-Ntrg5hGnae6HucyOCk0Xpftz2A5OmP2scYfUV8sMC9a6Wf0WQxOzUxGwAOJK1pIz
-eHAs0YBUPlDmFv49fAtKk6IcQwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MDhaFw0xMjEyMDExMjM0MDhaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
+bGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClbz0OWRqZiN1CDR91
+FskX0vqava1R6/9PfVFwD/7D6FpEVV97OBkDVORWbx/V/3yaeoT0TKDU3DWompq4
+1oIhfvq8ffKINjZEk9d3f89lOPomajUg3BGDnWm3Mp2E0p9BmKnKUd7MKGljg9SF
+L7g4QqHHE/ZqbEm6YxouFZTT4QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5jb20vMB8GA1Ud
-EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAL3Z
-BanvuX9pUeYcY4Z3BTR9XiUpcGKWqjUtuQtPJOjGfOVIinVfRc0NQt6p4G0eeAcG
-Ap4USuH8+Ijq7rENwcd/StkZNU+oeMu+Ip2dqSyQw0HAjuSVtZ1e/ZmneKs69MlI
-nG905GotlbcyM0IXWJZiJojzpTAhRJ1fkX3z/NY5
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB8GA1Ud
+EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAD1w
+KJkGLBSlvTDA8jJJaiVEJiWgdF9pz/QonwzZxArktb69nlZLrS6BJLQtf83IU3/n
+l7Rpo7cWkSY6XpBEUsV0qemZkhoqon658Kz/8b/7QSL5ch8uHSY8SqTJj5OoJN6P
+efJ0EKBciYbOWgwmdR1ywSs9rAoIFGrhuwJC3FQT
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.key b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.key
index 73a46ed03..0deebaf1a 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired2.example.com
-    localKeyID: 48 F3 D4 21 D9 EF 74 92 A0 CB E0 C0 CB E6 A7 51 91 BA CD DA 
+    localKeyID: 55 EB 55 1B FD 2C A9 66 7D 3F 2E B2 F5 5B EF 6F 60 12 64 2E 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI49ai+j3zSLECAggA
-MBQGCCqGSIb3DQMHBAiunIlM+CtJBwSCAoAWHvPMKjy3JnV/lSz9asSUbqZcTCqT
-61bqwCLxtG4L+KweqzwantJyVJLdX1+g/LqU318xXB/2pF2bkEYKJylywPB+UZty
-o/u434lz/qPc67vRW8PzITaD6PG4pc69yTEluhTc/RCIj1AmKkYPAaEfxthlNTnP
-Eu+BpP+6g944wyLuejWDVg0e8LL64+vKYuyeDm1+gl6hD+NIu0d+1KztmWJQNT2K
-PBwkC0GqC89sMqQbV8tJYK8PwNB6HxnlhX+7C64z+hUzHWppne1FMuqRmN9e/yyT
-2m65Uw7DCEx2dSlIsoxKXeLraep1SfWSwSIZ9WTkP7QbRIqrE0SjNTet1imFelyN
-M3G8SC+XwxE2DrkyfsxF3NYyoLJVPLlGTDjy4tqZOO1E3QVuqlFmv4vUDBVFiqkI
-ESsBuQqfO1XRq9KogsmT3x2t/wedTywv4mOOnJCBB1JRNrqlsfpbfOYujrDRoIfp
-BltSHq76QMwBy0y5CWtmVDIBtO7+5x7aoX/XqaBw3y7SoaG7yWtHEPyc0AMVx3xG
-7umvkew0wNs1ns+2P6obpnOZYRWbtuYiBenYJVF6YXzNbHA8xtab3+hYEtZLarms
-Xs3n5UY854cmGvZBWYwd37/rTfoMg522mN7+Or6nKYLhBXbCm2HKJ+TZIzS1BPMc
-Fn21GheAmtOlKJwQ6JXMDwLgjMXe+409HYySsmst8RNQ+ygDWLxb57sl2vob2xLP
-+s/fd+W0VXy042xrEQzaDktuHMnFM5RtEjL7c8I9KrPTV+6xwdn7iZIQPl06SGwv
-fZN9oFqADkhCoEWi8gFg6pR/WfLyMEDl5K1jt79GbJBN4ZmVGl4Ri7El
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIJiwjFZ552mACAggA
+MBQGCCqGSIb3DQMHBAj0PuFR42ejFQSCAoBt9UrR6LOVJ3y5JA/6hTg9/QTzQ8Vp
+o43rQ7VVYyYM4K9CcFgZlMbxTiHac0n2zqcy2cwewOULnUg/ddhzViU46pRWvY85
+4TPTKQETHCHc+/h3G0sAhb3YG/khFeez/kg75ZESpfhfaNLq2SMFjJ1K9JgztHYi
+UdrVAD51KBUQhQCGG4p5vw+AL6+RH2Lao1U4T8r2XGt8Du4UemkBS/sE17F2xGru
+axZ1Y/lkM0SXL2kYqwTFvb2XXtLFhGcMRxJbntNQk5HmweON+RWZ7EulF9f2jkei
+XqZT2vzDDzDufvxlFlbjzS88OUf52oj1wdewwqtqA/Ab97ETAWCOcC02CdxIcaXw
+Uyy5OWigW69TYQONgvY75r0l9hytR8wG4tujXUJOZWkVE37hzWFifE8AYLmf0Bog
+Oinb/YHMYvJtnUH0YCk3pH+I5km23Jb3wxUbM0RCntvJso0ZGBbJ2dHpD2jAF2dK
+wgNYA3FBTjSOaJBHw1VNo2npOOR3/9YephvkYlFQIvwn7M+QMmYwzYiSp/o957A7
+IqC1SNyDl2Mbw7hVLKFYAZV323zmnH48eWeYyVeHoksqB3b97zVnpVYhkwYZz9so
+vNpFOaoVYyRZujRWDzrwjEsvxAvxCgZoRQETPuGHBIc32TlynNuWWeD3Uwok+Yq0
+U/MCj+7+W3jmy3gUeqU+eA5sIQcopp5pzUUuvxc/wgMiWvxokPRBQquTSri3Arkk
+3uzK5Nee6XbkG0rf1fz9XBn+I/i6/m0pxGWkvAI2xoOWTEI2Tk4RkgwiMtNf0NrO
+nMOum0uygKyMFLWt1oN41xXciYLMF2lfZgn+zTGJB6YU8mXETfs1BNS4
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.dated.resp
index 741e42e0d..e8760d60d 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.good.resp
index 00e49542b..42eafcd70 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.req
index bd4d9784c..050b978f6 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.req and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.revoked.resp
index dba4647df..42eafcd70 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.dated.resp
new file mode 100644
index 000000000..6b8dcf557
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.good.resp
new file mode 100644
index 000000000..be54cd85d
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..be54cd85d
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..34ca8911f
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..05e7a4672
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..05e7a4672
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.p12 b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.p12
index 1f85e008e..93ac81853 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.p12 and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.pem b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.pem
index 173737236..68038cdf6 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired2.example.com
-    localKeyID: 48 F3 D4 21 D9 EF 74 92 A0 CB E0 C0 CB E6 A7 51 91 BA CD DA 
+    localKeyID: 55 EB 55 1B FD 2C A9 66 7D 3F 2E B2 F5 5B EF 6F 60 12 64 2E 
 subject=/CN=expired2.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMswDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0MzhaFw0xMjEyMDExMjM0MzhaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
-bGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDmqrEeyxGQtG7IJoUJ
-0VHcLaQ5naoruyTS0vqijmyQPJjPNA+FiZypHjhIT9M0TMa4Ynu/DDKRZm1p0XPw
-Ntrg5hGnae6HucyOCk0Xpftz2A5OmP2scYfUV8sMC9a6Wf0WQxOzUxGwAOJK1pIz
-eHAs0YBUPlDmFv49fAtKk6IcQwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MDhaFw0xMjEyMDExMjM0MDhaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
+bGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClbz0OWRqZiN1CDR91
+FskX0vqava1R6/9PfVFwD/7D6FpEVV97OBkDVORWbx/V/3yaeoT0TKDU3DWompq4
+1oIhfvq8ffKINjZEk9d3f89lOPomajUg3BGDnWm3Mp2E0p9BmKnKUd7MKGljg9SF
+L7g4QqHHE/ZqbEm6YxouFZTT4QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5jb20vMB8GA1Ud
-EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAL3Z
-BanvuX9pUeYcY4Z3BTR9XiUpcGKWqjUtuQtPJOjGfOVIinVfRc0NQt6p4G0eeAcG
-Ap4USuH8+Ijq7rENwcd/StkZNU+oeMu+Ip2dqSyQw0HAjuSVtZ1e/ZmneKs69MlI
-nG905GotlbcyM0IXWJZiJojzpTAhRJ1fkX3z/NY5
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB8GA1Ud
+EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAD1w
+KJkGLBSlvTDA8jJJaiVEJiWgdF9pz/QonwzZxArktb69nlZLrS6BJLQtf83IU3/n
+l7Rpo7cWkSY6XpBEUsV0qemZkhoqon658Kz/8b/7QSL5ch8uHSY8SqTJj5OoJN6P
+efJ0EKBciYbOWgwmdR1ywSs9rAoIFGrhuwJC3FQT
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.unlocked.key
index b6ddfdda3..11b9c1d30 100644
--- a/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/expired2.example.com/expired2.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDmqrEeyxGQtG7IJoUJ0VHcLaQ5naoruyTS0vqijmyQPJjPNA+F
-iZypHjhIT9M0TMa4Ynu/DDKRZm1p0XPwNtrg5hGnae6HucyOCk0Xpftz2A5OmP2s
-cYfUV8sMC9a6Wf0WQxOzUxGwAOJK1pIzeHAs0YBUPlDmFv49fAtKk6IcQwIDAQAB
-AoGBAM069dhWCUzcnOyMCTaQ/OqP2VxCAZRjMAI8IS/c1I8Iu1UwFtdTdwWpk54T
-F/GilfSb+0oiSiPAJH1QFH2X8OkUkPgv0DHtSW+0fwJN/nK4tTuV/8BVVKsUt0v2
-5xLnK+itUSjoDCMEW43Win6lIj9tggGSkY27emE+y7BvomQRAkEA9ui7p9cB3dNj
-KwbW6ltpjzYutUs0GAA4qqLswqRZ/k+T+PldtejfYmROL6ibVSnHJ70TqQApdSGc
-TkxwGQjNhwJBAO8o3Wy5hLGXhbDW1OSuIUaodj3lG1Bd+irwHb+Zb5Csmu5u/NzO
-SlxYTurkDqkkFHFyMXyehfoZIAlT+opASmUCQBPvCC9tuVXaWhhALhuvk58fRbgX
-QTZq1ihYjPrN4AIbFJw2La2hBl/gLzvDxf6jJ9P6fNrZC3/MXd0oaKhswIMCQCrD
-7OxPNDopdR+NGt6VgJ/I6fPhbwPs+hoJe9hSEJAXPVEbiZ3WSZe/tsTr6O8342vx
-1oWJNz3klkT0vl1QZ70CQDMfkK5odTziL5HXcekpOO0sa4r5kxQL5+yCnfJ2nmZM
-N406ISc2/TxDgY+QnOZyioIXt04hhBVAXKACTXboeGo=
+MIICXAIBAAKBgQClbz0OWRqZiN1CDR91FskX0vqava1R6/9PfVFwD/7D6FpEVV97
+OBkDVORWbx/V/3yaeoT0TKDU3DWompq41oIhfvq8ffKINjZEk9d3f89lOPomajUg
+3BGDnWm3Mp2E0p9BmKnKUd7MKGljg9SFL7g4QqHHE/ZqbEm6YxouFZTT4QIDAQAB
+AoGAH7HsNK+FlRzPpzP0bu5qoJHfSX5FkohwZb5Qt/OYj9gYUzc4D9dzk1vUU2r+
+4nUMXlxS1KtJtP5rmV3lfrw6OfmhTO+W71ytTz8ZzHtdj/je8d4aWNE8WqQfg2j6
+jHsieWi8CygWx4ka7U3UrxgX0nh0N+ioaqjPNgHvV2rR3EECQQDbbYdn+lV/5Y9e
+GSGE09QccqPZ3sEdnp3ELBIzezvkSdA5EDIbzma5spSj8wm2/VIfCn3uh5X0A3ti
+0WzrofjNAkEAwQHw+DRoI2vy21wSL0yQaM4Um1fITjSslmdUFZpilhzqFyZcLyyK
+TCqRCmlqP2tUuLMWpWKxNpW0VbnX36BXZQJAOfJLzuaqC5N47/WdB3HVUwnnQVL1
+Frhbm4Gz8Mp7f4cKqPcg9HzmXeXOIRm+mAd/11iy9vnxXLZKsEb0B6oHhQJAfSVD
+F8zzUTRnbfCPIfglEq+9ENSkXoEs/wDUtoU6M1dgOc53q2bX7XcUQIoFiEWR04jb
+wDTz7w62tXchEDEpOQJBAJyZKsZn18xufngUMUjY/7ZxW5ndDI82Ek5b19eiKJ/4
+w2xcrO/s4E9BQBRKIBtZB7+PiniUduQIifA4AaUGGFw=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/expired2.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/expired2.example.com/key3.db
index a0619f652..8733aeea1 100644
Binary files a/test/aux-fixed/exim-ca/example.com/expired2.example.com/key3.db and b/test/aux-fixed/exim-ca/example.com/expired2.example.com/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/ca_chain.pem
index d30156d31..a231554fb 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.com/CN=clica Signing Cert
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.com/CN=clica CA
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh0bvMeu3S1F6t7vEWH
-86hJbiW97pjm8A930DFhe/UIlgPsAmCePZEMg6EtakY5Huva4kYeBUejbRtd3LE7
-q07sOVQqcKt+X8wXThBBHPk/7q6BL+je3cfuisxsS1neX3m5BOAhROPr6kvFDz4f
-SRb4s3jT3bRgh5a7vl5JRv9FAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAA1n72ajcRt82cyo3R4P
-E9bqjhm4Y6d+a6vk4tPLk1uLD/EQw5ShAY6sM/FUzX8M4oyZ4A9Xouse0iXAVb50
-6gdqzfNtXeR5jIkTVNly0XJ99JfTgVHX0EcHPi3pffhiRCuNG2zEE6jIvUPym7UN
-3BXv6NWbBMOXAaVl99vckvxm
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK2aQA0QoS4VI5Aw1u8f
+Q94dMBwDYSo/+26Gln98d4N12j5UetDNx91Dvrn1mdWnnZvfMbUUIoDlBguwydKn
+90Qz5+bVMTww+wf5WYNY9n4Z9GTnHLTt6kzb0F5OEWu4Vsc5uFy0a/MiXbqAZpQf
+MHjf8F1cec3yt0c5hsaT/RNhAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBADnBYMdbtBpSSHTTvCTR
+XPlwy5nPTxics/HLv5DxIG3BKr97vYgONK+wHN45we8qxnoSpD0VoucJxef0rN4u
+X/yG6VoYjFRL/yW88nXzFy752nK83YrGGdUUWheY4OrAEGMmeyUe9Aw7GGczJi5u
+MTXhPAdr1Fn6Jj+eZy1Uv/yu
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/cert8.db
index 26859e007..8aca12a5b 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/cert8.db and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/key3.db
index c2eb2b118..8f12d2ae6 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/key3.db and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
index 2f7b2bf4f..896802452 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked1.example.com
-    localKeyID: 06 E2 CF 1F 8F 0C AA 53 ED 62 CE 37 E5 20 9A CE EE 71 5C 5C 
+    localKeyID: 2F 87 10 D4 45 CA 26 A1 B5 3C 01 0B 35 E1 A9 21 CB 19 40 8B 
 subject=/CN=revoked1.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZjANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOFoXDTM4MDEwMTEyMzQzOFowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
-ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAN+vuGqXGYUPhjF/K7QR
-M8pUsJFK9zLkFaXI7/uAAYaR1JxZbNGziRqR+GRcTtcYWaolwdqCRHb4f/OmUPwe
-a5bLLUCwp0uj12ixmHnvjPoDWqgE8aZ23m4+gizORuCd82159ON8CfQz4Q91ybI2
-UwltpKh+4Dkj6ru/6KjUTHQjAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQwNFoXDTM4MDEwMTEyMzQwNFowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
+ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALyYHbMbeVQ8dkOnPIfX
+2g8umDn9cjwm323zvGSHrg272vPedx9sEdYNFnfci8J4K07izRlO3wzYwQYQX6Hb
+N03uBjpkIHRNj+XK3QxGbQ33CnPWLtdBO6WUrMVJtIqQDjJCDoiKMaWatt5zFcSJ
+kqy5cJSRnCEDYZt3c57TngedAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLmNvbS8wHwYDVR0R
-BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEASefM
-vigqpVMCxf2n21RaSiHBr5EXU8hpAXLIVRBmch8tf5PBpKPmIKWe6ZiOGg9sG7oA
-Y42jKaBaCPyO/nUC0hcMB6ronLCK/na3RaiE3EBQAHaKNhHJ6DqoSc4hg4JEP7pF
-hCq7eYA/3G+JWo9COZr8T/qxAzd3wFSzI+1CgUY=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wHwYDVR0R
+BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEAPmeh
+CHnTo0ibhhjyGp1rhblScvRrPTpNLipDwTp2qVVo1T47lwaX2VsEYByEP/cP/MVn
+ymzifYvwnEQg49hLEFVoNmMVJgwwxcw0pAkDRCG9cQzYDLHt7nr2QL2/67kRexqO
+T2WnHsi/6x3z6z0CWv/F0n8NkBki+9QKWzumpQE=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.key b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.key
index 35b3f555e..293a15497 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked1.example.com
-    localKeyID: 06 E2 CF 1F 8F 0C AA 53 ED 62 CE 37 E5 20 9A CE EE 71 5C 5C 
+    localKeyID: 2F 87 10 D4 45 CA 26 A1 B5 3C 01 0B 35 E1 A9 21 CB 19 40 8B 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIKh17F/r2BAECAggA
-MBQGCCqGSIb3DQMHBAiGnj7bRKR/PQSCAoAs1sshi/N0T6mcZ7Djfl/v9bX8BNml
-Mz0WDjYPtEnth5FZdRdzhyvSLg8Ntygu2A0PVzFH9o4hAxAUTpZ1KP9zKk3dYcWF
-hucqMxTSZV4wrdpD+9KfqI3W261BsSETEPs1ZwEkkZWbz3kgy1jbJOMundSQ7b4D
-S2kNsSEAV0LkPxzbKZxZamzxshQQNdKO7vfj/KsRJmjNoZ8KgEgP61OMo2e+KEKu
-FZSAK56pFZtRRCa1oVoT6urqmMPb9hxNjb1V5uvZ/c1xKyp5B+zcyzH17WpFuBGQ
-PMT+hgAJqu85KbE0xbbpNQ1b69aoTl8Fvz5+ZUnFLeJOZZa77Vexk5PDqdC98rWb
-NxlNNhyYHclUtN/09qpeIRmIQR0DVmaR6NnYVtiWNpi7iCUTWb5JK9zt6c+28Q0Q
-bEO6JZz13mjunvbjIynsG5iSS86hleJIbYy3YALoun83z1RDcb/o44AyI8sUFL/+
-cJ/eknsdYXdnoWJZG3/iMIG63o+dIalmspxH2SfalB6RRB8y16xigRvO7dbha3bY
-aI+6x7LJ1Wp3XU23OmcBV3wdLt5hP5N8aBKwq+e8WqpEWNq0gU7BHuZjDiu4o4x7
-IlKAir+nmjXrEs3UCAIHD6Ea+vqgsZa+lnNDYHkQiw5dlvbom6KUtTwCoqswbh7F
-EO2HJsiysUOIWeYBgRFtllTv8Nf4S2KkgxEAtqHd81Zo+ZGcWVfDE4UVf53nY0Vz
-E4buuS7oE4kl7/QGAjAiJd7T5YA8abicHO365T64qRFpFMv10TZAN4Ijn+Lq8c/C
-h0FsSUNibO7+XYsQK2eYYif7ligPEQsHN+AiRnJxDhaMaeH1YShgijsX
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIRQJD2Jy7lCwCAggA
+MBQGCCqGSIb3DQMHBAgMKJPII3znFgSCAoALLJf1g9rfI6itd9sWFuQEgsgQPA/d
+B+HEoEYZkMG9fRpn/OkpVVj2OKKnw0tzhOHvSJS9wc4PGkfp433K84J+GvQf9+pd
+hilP7z8rzN1y8DGWEU5jyY4o7jFtF3UNTdNEJvv6w8HxFSf9Ne5Gnp3qhP0r9AQw
+ulPHvR5UbIf0G7rkj1bGsUxBqazApaBmBr7tcY+9wuSRjZFNhr72e8cerYvYo3ow
+I6kO+1dFGKEoBuOADGD5OzWU+cLBuQ+uid10IlctkKM/3ORlKSfutN8O/Qdbx+nb
+TTTJHa+RHVp2dU1sxPTt4WXqvTjx4r5IL4LThqA7yGBBPBZHO6Wk2nCTRnmxaAkh
+SE1FSzt9A2X90MEwteZZpKuB2IJwEJYLfqwA6woBf9EoSrMtlcCF8rX/EtVMD1ss
+QIYO/2vdESAFTq7PuDEbC0Lgp0USZLeqTtOifHcPCWSr7d8q93zwdZpWPJF7EayD
+mzpbM5olt3VdFGQrJDgx/lJqqROz5sA1+PkdxbD9lgAQA1CQVA6OdN2B8GcOuIO3
+mg1L4KTZ6lecCuq7uP4rC4TBU707gqurVsX4N6Y6G/99ChbrwrQ9MdkeZpBPP/hx
+HtNwxQjnGklzcqPEf5n8Bu4PUnPFSFSM9lGy1ugF6AS5uDTOdoHaWpDpG5TF8+cc
+2P9DnT1H28zqSkEmKp1u4WbbChc3h9KSFB2oKg322DLF33ehPDJr1yx42SNXmvcF
+IhiJXk0toe+vE7TpW6tZEigpakLv6731ioUDBvUv12YU2OmLoK4zktjP/Yb/+DEr
+J4UUmSU1bi0nS5JynQpnTQhgvN9z18neSp1OxL0tHogpyoQRnIPaRyfP
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.dated.resp
index 0167d59b0..8ccd6d93e 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.good.resp
index 4990a0f75..3b7ac1ea4 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.req
index 4e209f8db..07d2ad223 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.req and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.revoked.resp
index 75bf36915..e95fc4317 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.dated.resp
new file mode 100644
index 000000000..4c6b97ce5
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.good.resp
new file mode 100644
index 000000000..df239a695
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..321280de1
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..770dfbb0b
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..5030b74ff
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..246743029
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.p12 b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.p12
index adf40d204..256487146 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.p12 and b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.pem b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.pem
index d37af1173..5e5d00f63 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked1.example.com
-    localKeyID: 06 E2 CF 1F 8F 0C AA 53 ED 62 CE 37 E5 20 9A CE EE 71 5C 5C 
+    localKeyID: 2F 87 10 D4 45 CA 26 A1 B5 3C 01 0B 35 E1 A9 21 CB 19 40 8B 
 subject=/CN=revoked1.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZjANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOFoXDTM4MDEwMTEyMzQzOFowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
-ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAN+vuGqXGYUPhjF/K7QR
-M8pUsJFK9zLkFaXI7/uAAYaR1JxZbNGziRqR+GRcTtcYWaolwdqCRHb4f/OmUPwe
-a5bLLUCwp0uj12ixmHnvjPoDWqgE8aZ23m4+gizORuCd82159ON8CfQz4Q91ybI2
-UwltpKh+4Dkj6ru/6KjUTHQjAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQwNFoXDTM4MDEwMTEyMzQwNFowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
+ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALyYHbMbeVQ8dkOnPIfX
+2g8umDn9cjwm323zvGSHrg272vPedx9sEdYNFnfci8J4K07izRlO3wzYwQYQX6Hb
+N03uBjpkIHRNj+XK3QxGbQ33CnPWLtdBO6WUrMVJtIqQDjJCDoiKMaWatt5zFcSJ
+kqy5cJSRnCEDYZt3c57TngedAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLmNvbS8wHwYDVR0R
-BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEASefM
-vigqpVMCxf2n21RaSiHBr5EXU8hpAXLIVRBmch8tf5PBpKPmIKWe6ZiOGg9sG7oA
-Y42jKaBaCPyO/nUC0hcMB6ronLCK/na3RaiE3EBQAHaKNhHJ6DqoSc4hg4JEP7pF
-hCq7eYA/3G+JWo9COZr8T/qxAzd3wFSzI+1CgUY=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wHwYDVR0R
+BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQADgYEAPmeh
+CHnTo0ibhhjyGp1rhblScvRrPTpNLipDwTp2qVVo1T47lwaX2VsEYByEP/cP/MVn
+ymzifYvwnEQg49hLEFVoNmMVJgwwxcw0pAkDRCG9cQzYDLHt7nr2QL2/67kRexqO
+T2WnHsi/6x3z6z0CWv/F0n8NkBki+9QKWzumpQE=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
index 11518a350..95e1c9021 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/revoked1.example.com/revoked1.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDfr7hqlxmFD4Yxfyu0ETPKVLCRSvcy5BWlyO/7gAGGkdScWWzR
-s4kakfhkXE7XGFmqJcHagkR2+H/zplD8HmuWyy1AsKdLo9dosZh574z6A1qoBPGm
-dt5uPoIszkbgnfNtefTjfAn0M+EPdcmyNlMJbaSofuA5I+q7v+io1Ex0IwIDAQAB
-AoGAGQLs+/4pPFegCajOmjPSNq2BkL1xJp+aTA9LxjNp+EIWI+Vb5ZbNncr0m0Q3
-DJYMcJoIMwad4S+oHvZZ19cO8HfmEGnn1ePs87ZFnalp+ibDLGFdfV163kqs02NQ
-/6oy37/a6wNhufv38m6JtRMB3NXdxC7a58tKAPoRraIn/gECQQD/i7nz/gIT3Ij+
-SrsF45Pq1AtazXUq5oiGHImr6xTJXHdnTyQujXQWhWmwJLi69VOhiUEvKcCfAcLl
-FO4ZSuJ7AkEA4BV/eL1qsEzF4EDAn5z6MTaScebAkG6K+fcITK+I7Iky5zxI3UA5
-xGrLjeJVQ8mX5yAVQ3Ka9TJTQ0IiAK24eQJBAN3GOX9StiLehdWKrXyS4NAvbhtD
-q6erolghdClLPyLxqH5z5IayJElXRz2i4N8AAbBzGasApTZZpPaCj5BLuPkCQDeN
-PM+67ZMNRVTl2Jr5OJEwvTddhEmKDgwP8M/KCIDTNnpa2Jl5DZki/JmNDaRDetQC
-gSL6a23z7u5Sm8ldR8kCQCPlnKzTrhnY39ECcXPqigyhSwagZJdbhID+RAaeeX3C
-y8M6hyk9Xnm4ctOiC+T5Fiz2JNIuRf3OqqBphMrVTI0=
+MIICXAIBAAKBgQC8mB2zG3lUPHZDpzyH19oPLpg5/XI8Jt9t87xkh64Nu9rz3ncf
+bBHWDRZ33IvCeCtO4s0ZTt8M2MEGEF+h2zdN7gY6ZCB0TY/lyt0MRm0N9wpz1i7X
+QTullKzFSbSKkA4yQg6IijGlmrbecxXEiZKsuXCUkZwhA2Gbd3Oe054HnQIDAQAB
+AoGASF9BinGBGmPHaIfdUS3ypr/VN++8Ljwmop2VjqiIkQmlaM9WvE6u+4rzM9UF
+JwARcojTdyJOszHcxNR0tnqW2l5yJhKKEQ/3fOgGkQuqzP2KH6JESQiUsCQAbOyE
+ncnnNFJ5UaI+8LB5SeT06L9EXQ6bqRVRG433Cs6/EMqlYqsCQQDrZGm7BIzzzxfY
+DLLn91SyAlf/WXgM6tIMqYL6DpLWZlTGgXZeFuLU0y3V1NgMaj9flWPR6iO8vn1j
+KX5aBz6DAkEAzRrexFY1bzHpQkrzbX75lUCSE3N1/JKTfMTq7x6FZJ6N1tyLHrp4
+1niwMHikazs5hjWlMsIZYTgPkjD/0XLHXwJAAitevhaApg6WjaswSusAoNNctEHC
+1Xuki/FT/7H6sHco+Ntgl+VmGcgIeBwKEbM4+kyKKvkZczfeN/e97l56uQJBAMVV
+iur/vp1jOfeMQTUiK2NMIr8QIX6GT9yFYTv684BhhDorKra/1i8TIwEfsaFx8+CK
+kIyLbvu4glK3TgnoEqUCQDu6hMf9ppZ9jTa79LAmZnNQotAwYYMVrUwvfoEBSK9i
+6j+27Ki18/saH9SJyYIrQSXEVgWLrRHu24+pkJ48E68=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/ca_chain.pem
index d30156d31..a231554fb 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.com/CN=clica Signing Cert
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.com/CN=clica CA
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh0bvMeu3S1F6t7vEWH
-86hJbiW97pjm8A930DFhe/UIlgPsAmCePZEMg6EtakY5Huva4kYeBUejbRtd3LE7
-q07sOVQqcKt+X8wXThBBHPk/7q6BL+je3cfuisxsS1neX3m5BOAhROPr6kvFDz4f
-SRb4s3jT3bRgh5a7vl5JRv9FAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAA1n72ajcRt82cyo3R4P
-E9bqjhm4Y6d+a6vk4tPLk1uLD/EQw5ShAY6sM/FUzX8M4oyZ4A9Xouse0iXAVb50
-6gdqzfNtXeR5jIkTVNly0XJ99JfTgVHX0EcHPi3pffhiRCuNG2zEE6jIvUPym7UN
-3BXv6NWbBMOXAaVl99vckvxm
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK2aQA0QoS4VI5Aw1u8f
+Q94dMBwDYSo/+26Gln98d4N12j5UetDNx91Dvrn1mdWnnZvfMbUUIoDlBguwydKn
+90Qz5+bVMTww+wf5WYNY9n4Z9GTnHLTt6kzb0F5OEWu4Vsc5uFy0a/MiXbqAZpQf
+MHjf8F1cec3yt0c5hsaT/RNhAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBADnBYMdbtBpSSHTTvCTR
+XPlwy5nPTxics/HLv5DxIG3BKr97vYgONK+wHN45we8qxnoSpD0VoucJxef0rN4u
+X/yG6VoYjFRL/yW88nXzFy752nK83YrGGdUUWheY4OrAEGMmeyUe9Aw7GGczJi5u
+MTXhPAdr1Fn6Jj+eZy1Uv/yu
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/cert8.db
index 29da3981b..4bd149396 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/cert8.db and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/key3.db
index a5eed8e18..4cd46729a 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/key3.db and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.chain.pem
index 309f3736a..04dc774ae 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked2.example.com
-    localKeyID: BA A1 F0 8D 1A 19 D9 11 A9 DD 54 D6 A5 13 AA 51 78 94 9F BF 
+    localKeyID: 60 1E 5F 04 72 87 3D DF D6 6E A8 72 9C 31 3D 4F EE 2F 08 52 
 subject=/CN=revoked2.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMowDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0MzhaFw0zODAxMDExMjM0MzhaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
-bGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCz8dtSCUuUklr3d1y7
-FbtPN8uEKekTvZlKgW95OaPd5f4TsjHbo9b9BM+bFiX8yQ6mxQPqKfYHXF8UC87H
-2xYex0q9Oz/kcpAF/SUglqCOZrIIvA3TdSwUUjNf/FuDS8Sa8FAHFTGKeY9gdCEZ
-yZ0dYke9lajL974fmVWR9J4TrQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MDdaFw0zODAxMDExMjM0MDdaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
+bGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDH+p2yj4NWa1uzkvNN
+E3kE6axpNn5FXJ5NG1KVfpJIqK5LPbEGH6+VvmTgntn9143mhaYnA5moXk5bETXw
+OJ0hqXJK9XpjpXJrK8Nhx7BY5krtM0UsDq3EhNEw6+AKDBwT+9uD2y50X9UKkLJh
+JshmcK0fStVWlExN1ytD0gKURQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5jb20vMB8GA1Ud
-EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAKXo
-tzQ2BtddjynZ41wryaFTmJURCUZqx/TUGpD9LZSKjumZQWOJ+J9fAIYk4bDJ/odI
-mzclOaxEYhZpddEdyU0XK14LlzxA44lBMVhkLVlrpcqWT2nggwj+0Rx/LxXHftnQ
-XbPGAqNhBhAbk8U+DC/28TlkcocapCiQJN2nGexX
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB8GA1Ud
+EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAFbp
+R8Z0SgNHSvM/NAjsWvrHHMFfOggViyNk9Z2TOJ3NHsQ/WPmWJfVobD0wS9JupDsY
+i9J3RjmkIPv/R3bJ2zNrGZ0Vo26T8VW8WZV+K47jDhl8Yc6nm633qaIkvDUrQT1D
+8ndRU/5kTWzsj49lU8uxzxK6Zi3anMKeucZN2N1G
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.key b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.key
index 45a362593..19598677a 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked2.example.com
-    localKeyID: BA A1 F0 8D 1A 19 D9 11 A9 DD 54 D6 A5 13 AA 51 78 94 9F BF 
+    localKeyID: 60 1E 5F 04 72 87 3D DF D6 6E A8 72 9C 31 3D 4F EE 2F 08 52 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI8yFiiVFOqjECAggA
-MBQGCCqGSIb3DQMHBAjJRNO3cgYqMASCAoCmbh+OMTNlW6/2nOhcsTH00BpEr7IQ
-ERPq/St6LbTBulx4kYhaNcj/sFwVhk/1FI1SNCtp/nfhJxMvCSmOne/aQVi5o5li
-/4MtTmQD223rA78za23lAGqtPQS9n9E15SW9lBMBt5epEdxdUKQ4tjDCJMwd7h5A
-7wAdumaMk+Ks6JjrrrH2v7ms3fFDD25JBoTL3NnVoZQfiNky+IDwECALujyZ/FuD
-A19PdEqS5BWN72lE3OZogO3N9oxrN1EOBGxDyuyp4ShB2Ngr6gcNejYNtkCPhLBl
-duKSb1ujpnhQPxxgsxarwBKjcUUlFmcL3OUlNr9VJLAMTqmnlnvQRJEldhqNd66T
-u2eAW3Axg7wN/oRDTNTCOC3ef1sfk+jJ8iWcWjPKe6RJWELNb9p44TL1dYKwZdbQ
-dhzW4ke0Sqsk86OyXM4iSbsORD5nvOl/Bvu3foRnJ2QX5lq88/WLgDudZZT+JEFD
-r8vSBAUaIoTPjKuT5YO3n/lrCowk1hzkMYkSk/UW0+zIYyKju4CgnVwFeWmuC9AP
-Yx4gCRMJE58ZszGRZS49RzsbnNyDCJEbZB9lB5t8L1Rg/YI5THUM4L0tT/Il3tvs
-3HI1WOl0rbduSA+ZRIk2f9WsscwpFZzhXFfr1Fuf6oFZrZ2a9JXL7o4TFviAyfyM
-+VL6yZomDOunCHEf1XTP6MNnYTf5/upLr9fMum/yno+gtoomub0ycfrEmMCirzW1
-OsbXxoDvyrf08CDNYs60eyZYYJ4BjZA8ma+inPzdEch1Hj3b+FCbvT/nJFrxDxp9
-8NvOYuFlQH2C3eSmUrDkx372EgfzvXlUYT3PpvAgFg5MJlUH4oMqxLjM
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIzQ9LbVmACpoCAggA
+MBQGCCqGSIb3DQMHBAiQAqzjbeMJdQSCAoDIZV+TwEeKGLUd579pnH7rbgghDFZh
+uBH+Nn/T4w2cRZzePbGLORnaLUw4TqwNj0wkT1z3qWvVAv5EDbDrOJiWv+AhUCsR
+Efu1N486pkCnZH5YYQ+A1TKR4SkWgqVXdsg8YA7rafsz59i/HBm5aE95iV1cIuZS
+PGJSxZxUZqAFzWs6P3tGe6bO87BrQ6BRqIgYaZu3TTWvadSMEbnOnsnGOu4Q6frG
+4qEcaG4u0T2LnvcMDyh35O11kOoF+WxqnJSKnPuJtuyODN43e0hx9akNWI0e4LKH
+PvQ2KREajv2B000SE+dIMoYR2r6et4+mTqkmmVtTpBhsnw9CS1I3WyDEJLtSIWs1
+EdIiPSRLWVT3cDy3TBIX8iTu6yTUk+isXPEUHRyUvSOdRjpYrQgEWhVuUBOgwo9V
+FpS6Zt+JFR47q3VRA/3VMcDT4BF0viee0SFNwsgGKRBPdajGUpVuyxsrussirBBm
+32/lmb/gRMqsDtuBz1gaasa8N0u1bIYzXBvwYGritLT2Ijsd/PsydJBNPG3CjYNE
+BCABnMW7oJ5aEU1+fItj88K+d0WCjb6O0dV8DfpLxHyzQeZDJuRiRUBEDfyddl2N
+3MixmChxb/p2jiznlxSPspqp3uBzvJYO1mx6UTy3tgexyknmZDFhmaenZbwLqcrD
+JLjwbdvpgRE06RzDQVH7feNoqYlQl4LD/E+taQzBtBZuBSXZliLF20DlnXSoC+ho
+/RjoBZMqA6zm+keHvisX204m5xa1xcwhVXJdaOqmfPpi2oS/3ijCScVLJFtbRGPD
+Ch9++RCyfE/3VjtHQF2LpxeICIF5aZlrhNxzJHdfh44ZLv8Q0iK/S4GE
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.dated.resp
index 3e5968bfe..f7cd813a4 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.good.resp
index 698da0330..bbdce3331 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.req
index 03c18be5b..96f16d588 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.req and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.revoked.resp
index 698da0330..bbdce3331 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.dated.resp
new file mode 100644
index 000000000..b772948fc
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.good.resp
new file mode 100644
index 000000000..1152cceea
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..1152cceea
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..40035ab9f
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..3efffc287
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..3efffc287
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.p12 b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.p12
index 5c47d7c75..f6151cc72 100644
Binary files a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.p12 and b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.pem b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.pem
index ea42fd848..7af534e6e 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked2.example.com
-    localKeyID: BA A1 F0 8D 1A 19 D9 11 A9 DD 54 D6 A5 13 AA 51 78 94 9F BF 
+    localKeyID: 60 1E 5F 04 72 87 3D DF D6 6E A8 72 9C 31 3D 4F EE 2F 08 52 
 subject=/CN=revoked2.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMowDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0MzhaFw0zODAxMDExMjM0MzhaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
-bGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCz8dtSCUuUklr3d1y7
-FbtPN8uEKekTvZlKgW95OaPd5f4TsjHbo9b9BM+bFiX8yQ6mxQPqKfYHXF8UC87H
-2xYex0q9Oz/kcpAF/SUglqCOZrIIvA3TdSwUUjNf/FuDS8Sa8FAHFTGKeY9gdCEZ
-yZ0dYke9lajL974fmVWR9J4TrQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MDdaFw0zODAxMDExMjM0MDdaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
+bGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDH+p2yj4NWa1uzkvNN
+E3kE6axpNn5FXJ5NG1KVfpJIqK5LPbEGH6+VvmTgntn9143mhaYnA5moXk5bETXw
+OJ0hqXJK9XpjpXJrK8Nhx7BY5krtM0UsDq3EhNEw6+AKDBwT+9uD2y50X9UKkLJh
+JshmcK0fStVWlExN1ytD0gKURQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5jb20vMB8GA1Ud
-EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAKXo
-tzQ2BtddjynZ41wryaFTmJURCUZqx/TUGpD9LZSKjumZQWOJ+J9fAIYk4bDJ/odI
-mzclOaxEYhZpddEdyU0XK14LlzxA44lBMVhkLVlrpcqWT2nggwj+0Rx/LxXHftnQ
-XbPGAqNhBhAbk8U+DC/28TlkcocapCiQJN2nGexX
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMB8GA1Ud
+EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAFbp
+R8Z0SgNHSvM/NAjsWvrHHMFfOggViyNk9Z2TOJ3NHsQ/WPmWJfVobD0wS9JupDsY
+i9J3RjmkIPv/R3bJ2zNrGZ0Vo26T8VW8WZV+K47jDhl8Yc6nm633qaIkvDUrQT1D
+8ndRU/5kTWzsj49lU8uxzxK6Zi3anMKeucZN2N1G
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.unlocked.key
index 1f94e1a5d..173cdeaff 100644
--- a/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/revoked2.example.com/revoked2.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQCz8dtSCUuUklr3d1y7FbtPN8uEKekTvZlKgW95OaPd5f4TsjHb
-o9b9BM+bFiX8yQ6mxQPqKfYHXF8UC87H2xYex0q9Oz/kcpAF/SUglqCOZrIIvA3T
-dSwUUjNf/FuDS8Sa8FAHFTGKeY9gdCEZyZ0dYke9lajL974fmVWR9J4TrQIDAQAB
-AoGAXCSR0R1PZYHYMPYfNvG226bPgRrQ7jndQAito16/qYX3J/DMlRL9qMyI3npl
-816lMQKbsZHRGQ3U5ffx5+cpGLe3jPJ+ywdpfvBwcy/kRjGl/KDQAuqdNcmt2RLZ
-zby2sVeRtW9E6ixPiWvZfVbr/7fWspofCBXnQ/oK74TKimECQQDd6pu58Wze+IPB
-D59xCj+hkB6gtAqXlsYbVlkh9bM69LTKTE38mGqYU0XHpjepWrkGdIHFrq/9JNh+
-4NhPmBslAkEAz5T9hZSTR/m+d/yMHxWSJuNzjlvK/ymLV1cPOUXC9Mo1NO9qk9yx
-cUCy0YBIYYhYx7PBdHhTlR20+OJc/iEz6QJBAI0uWtBbNeZMuJW0uL0TxhOlOrcG
-k86JD5QIxUADrnkNgY9KKDtRRE+Qes5fgv3tR9VBfeYkEra8IDfoF/XbUTkCQC+M
-jVYf5mzCRGLvspkcM9I8n6eoVyODvKtRAee4lyPDfdSWUu9zyiGLFGrw26Obu9pi
-zpmDRoINv/qSv4Jm0KECQQC2jHpwrSPzJGLn5heATVfVDsFdH7ddXDaiLbgTlsBH
-GpZfeOl9UPGpBTZmBczFrUGPovtTOOYl5u68tFGpkUbP
+MIICXQIBAAKBgQDH+p2yj4NWa1uzkvNNE3kE6axpNn5FXJ5NG1KVfpJIqK5LPbEG
+H6+VvmTgntn9143mhaYnA5moXk5bETXwOJ0hqXJK9XpjpXJrK8Nhx7BY5krtM0Us
+Dq3EhNEw6+AKDBwT+9uD2y50X9UKkLJhJshmcK0fStVWlExN1ytD0gKURQIDAQAB
+AoGAUKTHiFTobWaw3bsyY1ApeuoyrWEczaLacZTFmmSm4Ccp1kzEAQixGY1kh9J3
+bS7KWf5mcRA6HFQffAj2O+/QqSYRh+FpqF7G+Vuy9EEp1DFEHBW5EVAuL4yv8g6Y
+6b8w4bd1qegg/85teFQgPgLYjQUs9jyOwTf4YGeiP6cgLvcCQQDyBFbxbxNz9mpl
+U4RfzxDZMALHlYrQPPOpHdM5veKYpHInGtpf2/HIqeRLiuQ4dadK4KSfHaUiVgc1
+hFh1BnQvAkEA04h+plOp9rQLBFcnr4fD0xR6/5GNigUL3CftIOJrGcOdMpZFMwNu
+GDRqwLqwEe4k0yTXJJOFYkYW0ZgMPY79ywJBAOpmDZcUz7B2ryGoPANXV6gi+e44
+BhQdlJjtDBFWucrBKtZ5CZviOFDzSutngBa2zOqWnJqHadLRo3XP0qS1NX0CQHq5
++3j2m2qlxKqNAlpls2iYvk/em7bS/LGLfJmSo7677k02QAm72Lk0WCdfaN3ORBE4
+k5YF/OIqdfy+cYOZnYcCQQDgWQddjHDpMTmGSIHF7LFvmOsxc8RvaCf/rbqIR4me
+GTtOL3aAlwVcagn1Otph+abTL6PSNJQOe5kGwatGKcAn
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
index d30156d31..a231554fb 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.com/CN=clica Signing Cert
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.com/CN=clica CA
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh0bvMeu3S1F6t7vEWH
-86hJbiW97pjm8A930DFhe/UIlgPsAmCePZEMg6EtakY5Huva4kYeBUejbRtd3LE7
-q07sOVQqcKt+X8wXThBBHPk/7q6BL+je3cfuisxsS1neX3m5BOAhROPr6kvFDz4f
-SRb4s3jT3bRgh5a7vl5JRv9FAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAA1n72ajcRt82cyo3R4P
-E9bqjhm4Y6d+a6vk4tPLk1uLD/EQw5ShAY6sM/FUzX8M4oyZ4A9Xouse0iXAVb50
-6gdqzfNtXeR5jIkTVNly0XJ99JfTgVHX0EcHPi3pffhiRCuNG2zEE6jIvUPym7UN
-3BXv6NWbBMOXAaVl99vckvxm
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK2aQA0QoS4VI5Aw1u8f
+Q94dMBwDYSo/+26Gln98d4N12j5UetDNx91Dvrn1mdWnnZvfMbUUIoDlBguwydKn
+90Qz5+bVMTww+wf5WYNY9n4Z9GTnHLTt6kzb0F5OEWu4Vsc5uFy0a/MiXbqAZpQf
+MHjf8F1cec3yt0c5hsaT/RNhAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBADnBYMdbtBpSSHTTvCTR
+XPlwy5nPTxics/HLv5DxIG3BKr97vYgONK+wHN45we8qxnoSpD0VoucJxef0rN4u
+X/yG6VoYjFRL/yW88nXzFy752nK83YrGGdUUWheY4OrAEGMmeyUe9Aw7GGczJi5u
+MTXhPAdr1Fn6Jj+eZy1Uv/yu
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/server1.example.com/cert8.db
index 2954be60f..bf36a5b8b 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server1.example.com/cert8.db and b/test/aux-fixed/exim-ca/example.com/server1.example.com/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/fullchain.pem b/test/aux-fixed/exim-ca/example.com/server1.example.com/fullchain.pem
index 27921a756..78033a246 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/fullchain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/fullchain.pem
@@ -1,25 +1,25 @@
 Bag Attributes
     friendlyName: server1.example.com
-    localKeyID: D4 9D 8D 60 1B 5A C6 66 02 A2 64 35 71 A8 31 A8 E2 BA D7 48 
+    localKeyID: 83 06 18 47 AC F4 ED 86 00 12 B7 91 F0 42 C7 AF 6E CB 0C 46 
 subject=/CN=server1.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIIC2zCCAkSgAwIBAgIBZTANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOFoXDTM4MDEwMTEyMzQzOFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
-LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEArn0R2/5S4HXPWniCUhAN
-LjIN8KmJ34ZQP2iX6Xin2mGoZRG2WBJtiR7MZfo80W2iFmQzvLN03KINUdeQj5UN
-Gs6yWzQeVHCiA+njszl/NWH7EHt0ftz2XUrQtPGqwoLCCnqnTK9iOpVblQRqbO9r
-1KoQ5LVz47/cAnphIv2938sCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
+MzQwNFoXDTM4MDEwMTEyMzQwNFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
+LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA54CbrIH0gCvUPwM0NXZk
+XPPPTp2T3soEJfDq09OFF3frbzbn3Y9Aa7saE388maxmB92XdYdcluh82wGcpMNZ
+3zZ3YsGiofjVjFCGIprOaQ0lZXYxjHdtxrn0gCsygS8eBZ3FrTLbshvvJLlLdlGI
+MRBb1XThD0UZdL2oV0j48KkCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5jb20vMHAGA1Ud
-EQRpMGeCE3NlcnZlcjEuZXhhbXBsZS5jb22CIWFsdGVybmF0ZW5hbWUuc2VydmVy
-MS5leGFtcGxlLmNvbYIJKi50ZXN0LmV4giJhbHRlcm5hdGVuYW1lMi5zZXJ2ZXIx
-LmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAD5WJVJcS3nHk+JG6kI1JSdB
-na0pmOL2mzK7HOlqaIG6p4J/PfjVSqaYr+R4Mb9BejthGsj2nnfG8eqX/CvIUHjD
-FTMjRmO58wTMCGg24yvPUmaVnu/wOMB89EKzpuZAUt4bFRpd53ZcMey8YFADUW6f
-Sb8ooudNbc6VBlWggSFJ
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMHAGA1Ud
+EQRpMGeCIWFsdGVybmF0ZW5hbWUuc2VydmVyMS5leGFtcGxlLmNvbYIiYWx0ZXJu
+YXRlbmFtZTIuc2VydmVyMS5leGFtcGxlLmNvbYITc2VydmVyMS5leGFtcGxlLmNv
+bYIJKi50ZXN0LmV4MA0GCSqGSIb3DQEBCwUAA4GBACGRwx8oRd0srNY4ROewu95a
+3EUcRvF2qA2/qk/0A14e+7cQFk1OUfGPueQ4EGkCwWsnLXwV8LcLTFGrIUM2Pk46
+aH1hFTfDKrg+NIVOHFRVlXoLgHA4d9C9TsTKq68U6qMkQxPrJ5eCEaIVKTwV8vjp
+jdetILV31wGPhJXB6CXb
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Signing Cert
@@ -27,17 +27,17 @@ subject=/O=example.com/CN=clica Signing Cert
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -45,14 +45,14 @@ subject=/O=example.com/CN=clica CA
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh0bvMeu3S1F6t7vEWH
-86hJbiW97pjm8A930DFhe/UIlgPsAmCePZEMg6EtakY5Huva4kYeBUejbRtd3LE7
-q07sOVQqcKt+X8wXThBBHPk/7q6BL+je3cfuisxsS1neX3m5BOAhROPr6kvFDz4f
-SRb4s3jT3bRgh5a7vl5JRv9FAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAA1n72ajcRt82cyo3R4P
-E9bqjhm4Y6d+a6vk4tPLk1uLD/EQw5ShAY6sM/FUzX8M4oyZ4A9Xouse0iXAVb50
-6gdqzfNtXeR5jIkTVNly0XJ99JfTgVHX0EcHPi3pffhiRCuNG2zEE6jIvUPym7UN
-3BXv6NWbBMOXAaVl99vckvxm
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK2aQA0QoS4VI5Aw1u8f
+Q94dMBwDYSo/+26Gln98d4N12j5UetDNx91Dvrn1mdWnnZvfMbUUIoDlBguwydKn
+90Qz5+bVMTww+wf5WYNY9n4Z9GTnHLTt6kzb0F5OEWu4Vsc5uFy0a/MiXbqAZpQf
+MHjf8F1cec3yt0c5hsaT/RNhAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBADnBYMdbtBpSSHTTvCTR
+XPlwy5nPTxics/HLv5DxIG3BKr97vYgONK+wHN45we8qxnoSpD0VoucJxef0rN4u
+X/yG6VoYjFRL/yW88nXzFy752nK83YrGGdUUWheY4OrAEGMmeyUe9Aw7GGczJi5u
+MTXhPAdr1Fn6Jj+eZy1Uv/yu
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/server1.example.com/key3.db
index c9fd02a1e..869ae1191 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server1.example.com/key3.db and b/test/aux-fixed/exim-ca/example.com/server1.example.com/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
index d609067d2..0c217a74a 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem
@@ -1,37 +1,37 @@
 Bag Attributes
     friendlyName: server1.example.com
-    localKeyID: D4 9D 8D 60 1B 5A C6 66 02 A2 64 35 71 A8 31 A8 E2 BA D7 48 
+    localKeyID: 83 06 18 47 AC F4 ED 86 00 12 B7 91 F0 42 C7 AF 6E CB 0C 46 
 subject=/CN=server1.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIIC2zCCAkSgAwIBAgIBZTANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOFoXDTM4MDEwMTEyMzQzOFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
-LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEArn0R2/5S4HXPWniCUhAN
-LjIN8KmJ34ZQP2iX6Xin2mGoZRG2WBJtiR7MZfo80W2iFmQzvLN03KINUdeQj5UN
-Gs6yWzQeVHCiA+njszl/NWH7EHt0ftz2XUrQtPGqwoLCCnqnTK9iOpVblQRqbO9r
-1KoQ5LVz47/cAnphIv2938sCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
+MzQwNFoXDTM4MDEwMTEyMzQwNFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
+LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA54CbrIH0gCvUPwM0NXZk
+XPPPTp2T3soEJfDq09OFF3frbzbn3Y9Aa7saE388maxmB92XdYdcluh82wGcpMNZ
+3zZ3YsGiofjVjFCGIprOaQ0lZXYxjHdtxrn0gCsygS8eBZ3FrTLbshvvJLlLdlGI
+MRBb1XThD0UZdL2oV0j48KkCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5jb20vMHAGA1Ud
-EQRpMGeCE3NlcnZlcjEuZXhhbXBsZS5jb22CIWFsdGVybmF0ZW5hbWUuc2VydmVy
-MS5leGFtcGxlLmNvbYIJKi50ZXN0LmV4giJhbHRlcm5hdGVuYW1lMi5zZXJ2ZXIx
-LmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAD5WJVJcS3nHk+JG6kI1JSdB
-na0pmOL2mzK7HOlqaIG6p4J/PfjVSqaYr+R4Mb9BejthGsj2nnfG8eqX/CvIUHjD
-FTMjRmO58wTMCGg24yvPUmaVnu/wOMB89EKzpuZAUt4bFRpd53ZcMey8YFADUW6f
-Sb8ooudNbc6VBlWggSFJ
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMHAGA1Ud
+EQRpMGeCIWFsdGVybmF0ZW5hbWUuc2VydmVyMS5leGFtcGxlLmNvbYIiYWx0ZXJu
+YXRlbmFtZTIuc2VydmVyMS5leGFtcGxlLmNvbYITc2VydmVyMS5leGFtcGxlLmNv
+bYIJKi50ZXN0LmV4MA0GCSqGSIb3DQEBCwUAA4GBACGRwx8oRd0srNY4ROewu95a
+3EUcRvF2qA2/qk/0A14e+7cQFk1OUfGPueQ4EGkCwWsnLXwV8LcLTFGrIUM2Pk46
+aH1hFTfDKrg+NIVOHFRVlXoLgHA4d9C9TsTKq68U6qMkQxPrJ5eCEaIVKTwV8vjp
+jdetILV31wGPhJXB6CXb
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.key b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.key
index 6dad7c95c..11679524a 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: server1.example.com
-    localKeyID: D4 9D 8D 60 1B 5A C6 66 02 A2 64 35 71 A8 31 A8 E2 BA D7 48 
+    localKeyID: 83 06 18 47 AC F4 ED 86 00 12 B7 91 F0 42 C7 AF 6E CB 0C 46 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIAWta/0EFh3kCAggA
-MBQGCCqGSIb3DQMHBAgg49RqNafa5gSCAoDCr7VhbDfic7umTyKEaGKtVrjiUnzy
-JLv/ONg/O6KVAzRqJZxTmwB3C1wJo9RPd377KR156hxx31Xi2My62DRlwkjFV1F9
-lDmA5lC+QXtuSKCNHM9EJGiRYo4JnZIWaviZHU9cyIyLDoV5s7qI/t3VRUeK1aLx
-lEqVqyPSbcVEX3rOGvPrzN/hW3WKLPxUSEBWBp2RidFj4cxudORCcYfjeHDszUe8
-AwTf82zKWcfAK+hEGKpq45FfD/UzP32oQkzctlQnoOi0ElI+trumldu/ywjX1gzb
-07Lbbg5x5av8kzh8Gue+RD2Swcb4bq8zEK8hPNIz0ougHnfxTvNW1qBU4K8Ygm70
-8gA3MEJed9raElBrN5CD1vFQCZOkitIFQ63PyxQyal0DzlUhVZnD6ZemPPs71+rh
-ypHMbRrb292aWJRkjO9zV1kI4ZsMSi0kh7oZEsw+7LKGHYP5lzWb6CQC0DDbEKDJ
-zpH/ewegpm2klnCXv3Vr1MLEB3Mc7hYi41ZhyQlSpxA5MXe81JfDIwcaAs64Jo0z
-H41CxdV5q0kQftgV+S8zNIQ4i36vUHvez9TdtBHlcy4dukqZeeU+o50vzzT29BP+
-QDfSzunvB5oorFAr2Nf9p4WfvjlKlZslkUo63cJmUYH1gEf/+0GWruse9pJ7BtHo
-6zgedGjEsLGUQfh9xwj5Vo5w4dv9kYkmbfmYdToLYXndW9kQFcpqXANB7ukSu21r
-WyoWuSayxYy/4yQqLrlSGu2Yj06wmJSLT95l0iEQBbs2pEdj2u72bjHNuYn9t3Kk
-Zq8xWKQdWgY/4UVKAVCb8d3yOhuqjONZykcV8a+vdK/8L9Mi9TNyVaa0
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQICbhwx2ULosMCAggA
+MBQGCCqGSIb3DQMHBAiYrkRIOMV+swSCAoBerG3VHBlRrcYC55/infkD5/5+O+1I
+tCK6keqj9CrQ8jo7vX6Rpx4Cy1oiNHJgo+tUGxsLau7as+4EhfJSGG08FEUZny04
+7Ve5WtSsufbz0ZALjk0R9lJ363rMxSAOl6tP20dMjBYGLmHTMt5+uJbA5kmhQ3ul
+jPuhvVlfG+pxM0WFHglgBA/8OKyT2ka2ldhwHBBofX5LXc5QcbLmicO9Dr81hzbb
+paqLhuVZ0GNrl1sM8HkifLMOPNlm8UlkLZV3m456E9HgDAgBxq12YAChz07njNbs
+e6l6La0bbmLYJ4sVyRqNPzrMgricuxKranzpODA9+dgAuhjQoXGIWyarScPKdcaL
+QXjZK0l9i6wNXaI5gYEEP4mJ6cwmoG/SKZ+DRMAibl3J/nvoq2deCM19mpJPAp+L
+60Q3ZadfrLPUMquLMHMoJ6EOLsFqLoaFxjFzLSdOJoz4i7lYCy7C0/GDbU4xsu+q
+55lwPflzOxDRXh6NDVuXeVevOVJr4KD3acvLqxDigNXpTxKvCQaS1uiy9UXSMCvv
+Y6JEhD9HPjqRAzzssy3HkEP6IDTXr9X7JTyl0iENkxt4fERYG8BufrVMBEw1ELr5
+zkieo67RYv9OUfpf3kYFnVR3/Dkkpz3HVRhef/H320/8ThKhotdUUORRbOsDaZoS
+ETLG6oTkGDm2TBRvdjh511gKUr+yTMxqRmPTTsym6DDVfggXV7aWE+ef5RKjbndZ
+NjgD2SR1VlVn/60j+1UYoLfhOjw4iIfEShFlWiYHZd37B1tQappbzs+VXjkRVYix
+DlxzzRALkOX2oisWH6Y9Fnq79k2t0LlY9aRA8RE6rPLxw3TgPnDLHgZY
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
index 9ad65b358..1ae0307ad 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
index 3044932b0..89c960ca5 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.req
index 77f3a9c95..56837f35a 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.req and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
index 5e937f8fd..3d978d4fb 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.dated.resp
new file mode 100644
index 000000000..cecce7884
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.good.resp
new file mode 100644
index 000000000..331db0aa9
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..8385415f9
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..61263f98d
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..34518ef2e
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..801547233
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.p12 b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.p12
index 72d4be2dc..3b191af3d 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.p12 and b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
index 8c81d2830..9562c3cf8 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
@@ -1,23 +1,23 @@
 Bag Attributes
     friendlyName: server1.example.com
-    localKeyID: D4 9D 8D 60 1B 5A C6 66 02 A2 64 35 71 A8 31 A8 E2 BA D7 48 
+    localKeyID: 83 06 18 47 AC F4 ED 86 00 12 B7 91 F0 42 C7 AF 6E CB 0C 46 
 subject=/CN=server1.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIIC2zCCAkSgAwIBAgIBZTANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLmNvbTEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOFoXDTM4MDEwMTEyMzQzOFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
-LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEArn0R2/5S4HXPWniCUhAN
-LjIN8KmJ34ZQP2iX6Xin2mGoZRG2WBJtiR7MZfo80W2iFmQzvLN03KINUdeQj5UN
-Gs6yWzQeVHCiA+njszl/NWH7EHt0ftz2XUrQtPGqwoLCCnqnTK9iOpVblQRqbO9r
-1KoQ5LVz47/cAnphIv2938sCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
+MzQwNFoXDTM4MDEwMTEyMzQwNFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
+LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA54CbrIH0gCvUPwM0NXZk
+XPPPTp2T3soEJfDq09OFF3frbzbn3Y9Aa7saE388maxmB92XdYdcluh82wGcpMNZ
+3zZ3YsGiofjVjFCGIprOaQ0lZXYxjHdtxrn0gCsygS8eBZ3FrTLbshvvJLlLdlGI
+MRBb1XThD0UZdL2oV0j48KkCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLmNvbS9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5jb20vMHAGA1Ud
-EQRpMGeCE3NlcnZlcjEuZXhhbXBsZS5jb22CIWFsdGVybmF0ZW5hbWUuc2VydmVy
-MS5leGFtcGxlLmNvbYIJKi50ZXN0LmV4giJhbHRlcm5hdGVuYW1lMi5zZXJ2ZXIx
-LmV4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4GBAD5WJVJcS3nHk+JG6kI1JSdB
-na0pmOL2mzK7HOlqaIG6p4J/PfjVSqaYr+R4Mb9BejthGsj2nnfG8eqX/CvIUHjD
-FTMjRmO58wTMCGg24yvPUmaVnu/wOMB89EKzpuZAUt4bFRpd53ZcMey8YFADUW6f
-Sb8ooudNbc6VBlWggSFJ
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5jb20vMHAGA1Ud
+EQRpMGeCIWFsdGVybmF0ZW5hbWUuc2VydmVyMS5leGFtcGxlLmNvbYIiYWx0ZXJu
+YXRlbmFtZTIuc2VydmVyMS5leGFtcGxlLmNvbYITc2VydmVyMS5leGFtcGxlLmNv
+bYIJKi50ZXN0LmV4MA0GCSqGSIb3DQEBCwUAA4GBACGRwx8oRd0srNY4ROewu95a
+3EUcRvF2qA2/qk/0A14e+7cQFk1OUfGPueQ4EGkCwWsnLXwV8LcLTFGrIUM2Pk46
+aH1hFTfDKrg+NIVOHFRVlXoLgHA4d9C9TsTKq68U6qMkQxPrJ5eCEaIVKTwV8vjp
+jdetILV31wGPhJXB6CXb
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
index aac6ea5ef..fb8228772 100644
--- a/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQCufRHb/lLgdc9aeIJSEA0uMg3wqYnfhlA/aJfpeKfaYahlEbZY
-Em2JHsxl+jzRbaIWZDO8s3Tcog1R15CPlQ0azrJbNB5UcKID6eOzOX81YfsQe3R+
-3PZdStC08arCgsIKeqdMr2I6lVuVBGps72vUqhDktXPjv9wCemEi/b3fywIDAQAB
-AoGBAKpRBne4HWlfVVC3xG0ZoePvk8/PjPaUAgyCqZWI4j61iEtvKI97HVP0rgr0
-YR0DaG12zVFp0a3yuBGk2kRsduaRCWfveyy9RKweLU3ykSJS013q4FROXXh8CEhf
-TVm/JY5LL1qwKZqQGi6BwAJEDwlntTrirjobMxjD49aWTcIBAkEA2Y4+62TvEANl
-bQygSbnQIXZdvHyQMirV944u1cqEcm3zflVULpPjDdBdvOhGMd2napdWvNorl8CP
-3/o8d8ougQJBAM1Sj3RbMOMVRvSJ3olb1qY7NG4GituL+bV2e4usZ+vh1qYEZA87
-S0jvfAgmDVYV7jcl/CrHj8vJgWHSLkziQEsCQQCj5Cf8NxZtbtGKvDdIMyXa/4uQ
-Ahqy4Fg+XStlPWJXvgLwCiIX0Kr87hqfxC+VQ1Dq2MWsEYNDl/oLFj1VVMeBAkA+
-WSzAu5RL0ME8LsWJ1n6G+gGAy7HM22OXjAQWNONVyL2CqmCsE2hYHIkAfHWeR4iP
-7JP3daQf0O/eAZIXvLijAkBWP8qfzCF5ONBnWTrGdTWG0p2OPgk/XGl4hVK2gFoD
-sqOKXCi2yb3a51bubQFGKIazO16IeDrE2XvCPzMniQwh
+MIICXAIBAAKBgQDngJusgfSAK9Q/AzQ1dmRc889OnZPeygQl8OrT04UXd+tvNufd
+j0BruxoTfzyZrGYH3Zd1h1yW6HzbAZykw1nfNndiwaKh+NWMUIYims5pDSVldjGM
+d23GufSAKzKBLx4FncWtMtuyG+8kuUt2UYgxEFvVdOEPRRl0vahXSPjwqQIDAQAB
+AoGAMTC5I2Mrtk5Z15fRMKj682tU+fHuuTC4x+0UoLT5uz5edu+2PfRR7nI/vLPV
+BxxEQ9iYdb8w89nrqceCZtohjq55WDWCuJUewZQyNSHC/v+Q+J9YmCnoU9SFX4gB
+Kr8tU+I1LhlIzCBd4K/0iCrASN69L93G6IIrpfR24pBNjU8CQQD0rfDVXLPjpjA2
+8E9kaqYlfk7QL9XhAla3wRioqPDg9001H8KVRnWqbLmiGFCWn+sATZ2nW9oV9THp
+6MFkjAt3AkEA8jaYCzt6LW051XpovqfEN9n4fAPDSAhMx4Hych4BlA2k4oLtTNqB
+xh6fTY5PIkKuhH7vSiMnZSGX1vpGQrGs3wJBAIXfzg/PoxWBzougvK/Cspl9HH5I
+TgvJDc2It4dAuFs+tF3GvN6UKLlQt9j62M0xPpFx5jq1xQOSnvbOxVHQVk0CQCt0
+nAa33w2zYQLp+UzrcIrMsoYdbrXHt26747GRrJrRb9mrv8NgGJRg/he+BniRGhpv
+Y6Mbd3/vbPyG3oAsvGUCQBX/JRVcosW/GqF0Au6rd7pPS0HU6ebXtlSTb3Nd24Xk
+uutI78VFuyv4ZUmj3qRxj65IoVCK2h3Z96PDgw1QbFU=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/ca_chain.pem b/test/aux-fixed/exim-ca/example.com/server2.example.com/ca_chain.pem
index d30156d31..a231554fb 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.com/CN=clica Signing Cert
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.com/CN=clica CA
 issuer=/O=example.com/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOh0bvMeu3S1F6t7vEWH
-86hJbiW97pjm8A930DFhe/UIlgPsAmCePZEMg6EtakY5Huva4kYeBUejbRtd3LE7
-q07sOVQqcKt+X8wXThBBHPk/7q6BL+je3cfuisxsS1neX3m5BOAhROPr6kvFDz4f
-SRb4s3jT3bRgh5a7vl5JRv9FAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAA1n72ajcRt82cyo3R4P
-E9bqjhm4Y6d+a6vk4tPLk1uLD/EQw5ShAY6sM/FUzX8M4oyZ4A9Xouse0iXAVb50
-6gdqzfNtXeR5jIkTVNly0XJ99JfTgVHX0EcHPi3pffhiRCuNG2zEE6jIvUPym7UN
-3BXv6NWbBMOXAaVl99vckvxm
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjApMRQwEgYDVQQKEwtleGFtcGxlLmNvbTERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAK2aQA0QoS4VI5Aw1u8f
+Q94dMBwDYSo/+26Gln98d4N12j5UetDNx91Dvrn1mdWnnZvfMbUUIoDlBguwydKn
+90Qz5+bVMTww+wf5WYNY9n4Z9GTnHLTt6kzb0F5OEWu4Vsc5uFy0a/MiXbqAZpQf
+MHjf8F1cec3yt0c5hsaT/RNhAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBADnBYMdbtBpSSHTTvCTR
+XPlwy5nPTxics/HLv5DxIG3BKr97vYgONK+wHN45we8qxnoSpD0VoucJxef0rN4u
+X/yG6VoYjFRL/yW88nXzFy752nK83YrGGdUUWheY4OrAEGMmeyUe9Aw7GGczJi5u
+MTXhPAdr1Fn6Jj+eZy1Uv/yu
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/cert8.db b/test/aux-fixed/exim-ca/example.com/server2.example.com/cert8.db
index e788f0a08..26f197eea 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server2.example.com/cert8.db and b/test/aux-fixed/exim-ca/example.com/server2.example.com/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/key3.db b/test/aux-fixed/exim-ca/example.com/server2.example.com/key3.db
index c1b6664cf..380b60566 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server2.example.com/key3.db and b/test/aux-fixed/exim-ca/example.com/server2.example.com/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.chain.pem b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.chain.pem
index 0ad714134..3fd06a48f 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.chain.pem
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: server2.example.com
-    localKeyID: 1A 42 0D 86 5B 90 06 8F B8 22 E7 15 67 A4 56 A3 57 8D 26 AA 
+    localKeyID: 93 74 64 09 0D 55 41 58 38 49 39 03 E6 38 82 1D 15 25 10 17 
 subject=/CN=server2.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0MzhaFw0zODAxMDExMjM0MzhaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
-ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALoxxS9eRRSkEJF5CmlL
-ToLY3886wsCOc+vuBo+2V69Q7aCC3Wa13UTZ7SVPhliw29gl48Ua7Go5E6E4+6n7
-SNL+VfuMtNg2zs4BIhXTfiPZ9U2YF77+Y64MFPBxK98F/RB/wjqAiWf5aigaQCSG
-X7Bf1bb1s3UwCi0M/wXHYj7TAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
+MjM0MDZaFw0zODAxMDExMjM0MDZaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
+ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKyfVyM2/OEp07jUT275
+Z443TxznHO7R/gOy2YSg8boviB72gXWcnvPD7JJ19zT4dAX7ycYhJJHvnfurI9sx
+lbeC12v1Vci9auGtSdyTfiFE6sHj5WG85eRLPyp9Bh10oHF5f5/O8ql5oY6Mp64f
+gzkQww6adLTJhMXdYum4pYS7AgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLmNvbS8wHgYDVR0R
-BBcwFYITc2VydmVyMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQCZCepT
-W/JRRZlxxEIcQVlQLpdcxuJnYvNbZwzn7Os0K7og1S7jl4PDncao6APk6f4WAfFj
-b4ZZc1NytSHPLuodWToY1bUzIBMKwk9Jof2yw2mr/3ElyzRDlVmXri+6b0X5WmfM
-eWI7npeb6Pl6n18tTYKkGGcFwsFsC+CeuLOzNw==
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wHgYDVR0R
+BBcwFYITc2VydmVyMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBxsq97
+lShV8znjjTJD6S9oKO8Ddjw6anrXbkdOaSVn+3rrvLtpnD/ot3jQqXgMekaNAd7M
+xv0Tvo2ZuhLu69/pZZhM6f8u/nFeEf5IgWaRp/VwipxjNresaZUGXlSbU/+p2Qc0
+Z/XwBfcW6yiJjpgnWF9hwz9y9dwvt2dIhxjGcg==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM3WhcNMzgw
-MTAxMTIzNDM3WjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GggX
-i+loP31ey0vxDpYe0mlBMHwC9ucGZo2HdTsJeOcGjqR4OTpZcOGbZB+Rhm+ZKZ+D
-lmIAjAit/sSJkqVj0hWlTdtSmgBuejsVqBHg3JwxVCnZmzo0+ILuod9tPcnVMjpz
-qj9CQAEcP+S329jlRKny14LCQzRc09QpszLuxwIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLmNvbTERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDAyWhcNMzgw
+MTAxMTIzNDAyWjAzMRQwEgYDVQQKEwtleGFtcGxlLmNvbTEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjjJES
+bOxdrntjOO+ejTY3ELemRX63kDqvwPM5eojPNHXE+DkmE4+MfHpK9JBf6TQ9RiXv
+F/0Xag4Z9xE5yW8z01p0froxCN2vz73VuZSnslq33WCsdl8nAfsFterBgeXLBzYd
+x7AsUd3Ukb/zo9pS+qXtvxTY4d7C1G5CBffjEwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-yc6X34U2IKvN9y2EnNYwfsRPEE2LerSN9Tt3UgOuhuETJM7upwacJqOiN+HXQ0xp
-qhRxcDdrNy7MvymNLkc0mSiFGEjWG8dmZz/NFwGCzHSIhPxl6YryfbldbnqQLop0
-KpaftG9PQ4QxymUGjbvty95QvU2MlGA19NbXcLa4Vio=
+C7ceggvAVv4ZSKHzibMYkkXpnTEgsOcY3LJr9hWaJIVf1wQQWaWwSpKGDg4wQnIu
+amd7gq+gPngvvuduUM/Xj6qIqPZJ3CN07qoM7NIDQ4woJloF3G5vn5A6FH2eFizX
+zBPeRvPEZ6SCqQaD5KDwaQ4GrrX3hNU4fNI0e+9v9EQ=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.key b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.key
index c3980ea49..20886e279 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.key
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: server2.example.com
-    localKeyID: 1A 42 0D 86 5B 90 06 8F B8 22 E7 15 67 A4 56 A3 57 8D 26 AA 
+    localKeyID: 93 74 64 09 0D 55 41 58 38 49 39 03 E6 38 82 1D 15 25 10 17 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI3ifkFALe1RsCAggA
-MBQGCCqGSIb3DQMHBAivK+R4BHCKOQSCAoDZEpqVLwIbnvhINpJF4GbhfuJsegMB
-CHrWIWE+/Uzc9dcf4FILsvwcvH+u0JbpZfxpKNs/XYkb6x8rlKajodb4MZUQP6z7
-5fYM+4dpRTEzgNBGUgGenEWqzOJYn07QJcqYhEkeWDfLomOZXkfrNh0CON1nYdUm
-1u33hIWqgbJoUXyxn5goHbwKRrDzdGRNzRKaOSC2Z7i/ZD95irOQ92jttqnpgXiw
-guF4rZH9659yZc7oO5RC4aS8qNXbD86vfKeGch1NBCG6tWxnVbKib5xV/MVb47qq
-CLR0s16UooFsCnXdy+bnkn5/pZ0mCPSab1vhMFwWDvcczJrNxFEYy/Bm+p1iExuu
-mOToNay/97ggu1nlZKMKMmB7/gGP/d/be44oKEr6kgUj+W5t0BrBltntm6dZo9pK
-o8mXC7Fj+qXGs4m3j/jr+iVGvpt0A0JWvtRaty9HmoHZpEJgECvhktUmHiMuvKSX
-iLrTJpHpBBPwHcwYx/xxQzSMmupDMsTpoRbBklMSQdeJBkRlkudsiZRdUKMnn+bS
-whH5jH8wzMaKzzHAsXUTajmUDSoK3ETFqfZpNWdUysppjK5BTBQFWo54/7fuiloe
-zz0dW9iJVbt6HHRYmnpgZ4wg2LajhfHBXMSiKJhGZmZf8CvPN8K6HETDoK0Sylqy
-ACbsHqOC0sIqFgxWLfqkafh4iB/tmoBT31Qg97OFAeOHwd4kMu01CzgDXiUyUb8s
-H+I8jmmWK7lPs1cXW/ePdt4vdqrdW7FC7Ealqs9KiMkYd1nSvHyE1mAtEQl4+/xG
-FWPEQIvXYUpZAAxevXmukAUKNPY0AytybqqqfkQe6CbpSeOfzdtdnOgz
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIaCVkvUUXUUoCAggA
+MBQGCCqGSIb3DQMHBAiHwVLAkyFHwASCAoCvzbvhMu88cVthellg1tLg6gIhGaus
+E9ieFnGgBEtuiKe6aZ7YAMkloEAZTOOMS0E4YAPOeKk3Yi9qRIngYpkSJHmx2FXu
+Z5sxV48Rb8+V1I7IxcWt0aWuvfPf/fNHXCxNFAVjA6Pyv1we8qKuJ+eQhHE5GE7o
+nwE2wbnIkJEQczGomuxJz1NpI6wlCWhr13n8CKlqctwhiUEqWQ6F6T/OJ8KMyPl5
+hQZunwLsnbPaXkqQS052RbDs8CpR7tTb6BiH8JcusDD4Tac4Tni1/A5ikgHLYeMt
+IIj9ywBX4a/w3Q7rXvYWlePo5UHFaHwMovgITEfg0E/O2FRsOkNZMyXhhzWdxI+O
+id8olki2dSq2QclpkU+KQZJG1he7cgw4H3uq999YWpsM1ZYYnQWl/2ygvOv/xQZo
+3HHHBm1rITifu1PZK0Nrk2L0EGUiyJhyha24imR2sAlL4kfSj6sQe86DmdtQ4CJ8
+oLFntckhHx/WzEng8ZTBkl1VcmW2hQOAWLZ/fjidMTW0JRIVlsl1UbA8g5SwaSKL
+yaFyVWksit5vPDe2hEHXZrJRN5xnto5vwKnkks4FNah8cJRT7Tvv13hQTNqxBBGk
+YqJdPryEv7XAFpKvM5B7d8prJOTflCoPm5T4tHeWwwmE04OqhNl/lenbW4er+JpD
+6zAd1temSUZVMne9X6uSQ7oRNZgoay1TeSeo0mPITR/iFGoGrvppupxY7SLRthxk
+GLJS5r143eMfAHwtj0uyn7JMBaIpUBhqTFtncE2Z6bas1iCyGp6THz7r/Kci3zCj
+qkOPVxen4rjqz3Y99ctQAvOa0npIYUe++9Oj8hEAJMZeqhxJEeijoykv
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.dated.resp
index aa3926853..20dda65fe 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.good.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.good.resp
index 9cb897bf2..223e57081 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.req b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.req
index 882490e06..0d068fd25 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.req and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.revoked.resp
index 9cb897bf2..223e57081 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.dated.resp
new file mode 100644
index 000000000..6808a9692
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.good.resp
new file mode 100644
index 000000000..4a0688372
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..4a0688372
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..c912e8eab
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..45bf7a979
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..10dc884d0
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.p12 b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.p12
index 3447c0696..af92f2164 100644
Binary files a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.p12 and b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem
index 8ffa8ced1..9ac33c061 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: server2.example.com
-    localKeyID: 1A 42 0D 86 5B 90 06 8F B8 22 E7 15 67 A4 56 A3 57 8D 26 AA 
+    localKeyID: 93 74 64 09 0D 55 41 58 38 49 39 03 E6 38 82 1D 15 25 10 17 
 subject=/CN=server2.example.com
 issuer=/O=example.com/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0MzhaFw0zODAxMDExMjM0MzhaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
-ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALoxxS9eRRSkEJF5CmlL
-ToLY3886wsCOc+vuBo+2V69Q7aCC3Wa13UTZ7SVPhliw29gl48Ua7Go5E6E4+6n7
-SNL+VfuMtNg2zs4BIhXTfiPZ9U2YF77+Y64MFPBxK98F/RB/wjqAiWf5aigaQCSG
-X7Bf1bb1s3UwCi0M/wXHYj7TAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
+MjM0MDZaFw0zODAxMDExMjM0MDZaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
+ZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKyfVyM2/OEp07jUT275
+Z443TxznHO7R/gOy2YSg8boviB72gXWcnvPD7JJ19zT4dAX7ycYhJJHvnfurI9sx
+lbeC12v1Vci9auGtSdyTfiFE6sHj5WG85eRLPyp9Bh10oHF5f5/O8ql5oY6Mp64f
+gzkQww6adLTJhMXdYum4pYS7AgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLmNvbS8wHgYDVR0R
-BBcwFYITc2VydmVyMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQCZCepT
-W/JRRZlxxEIcQVlQLpdcxuJnYvNbZwzn7Os0K7og1S7jl4PDncao6APk6f4WAfFj
-b4ZZc1NytSHPLuodWToY1bUzIBMKwk9Jof2yw2mr/3ElyzRDlVmXri+6b0X5WmfM
-eWI7npeb6Pl6n18tTYKkGGcFwsFsC+CeuLOzNw==
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wHgYDVR0R
+BBcwFYITc2VydmVyMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBxsq97
+lShV8znjjTJD6S9oKO8Ddjw6anrXbkdOaSVn+3rrvLtpnD/ot3jQqXgMekaNAd7M
+xv0Tvo2ZuhLu69/pZZhM6f8u/nFeEf5IgWaRp/VwipxjNresaZUGXlSbU/+p2Qc0
+Z/XwBfcW6yiJjpgnWF9hwz9y9dwvt2dIhxjGcg==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key
index 36a9dbdd6..5ba159d78 100644
--- a/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQC6McUvXkUUpBCReQppS06C2N/POsLAjnPr7gaPtlevUO2ggt1m
-td1E2e0lT4ZYsNvYJePFGuxqOROhOPup+0jS/lX7jLTYNs7OASIV034j2fVNmBe+
-/mOuDBTwcSvfBf0Qf8I6gIln+WooGkAkhl+wX9W29bN1MAotDP8Fx2I+0wIDAQAB
-AoGAR4bHESNNtlgwZTHyZfCgAHP/xkP0fLQ8o+2UZ7DMjnSwVHDxTHugvMpa53Jd
-UcTfL3GexiFJoKS8fbq+MtZtarg3ftcZlIo6MevkmrFx+egJGOFjxtQ1WuQvfXiQ
-0EVluY7UQ0uQwGcR6DKzF64W+g+3KvvaB63Yk9mW5zDALcECQQDsJuD04ViTIiAW
-vLcgY3sKJ3xtmDm89EpqCCIC+2mAr6s5B1La3XLBwpvB8UatTlgrorp5w23Sudjr
-xa+ztrptAkEAydf9kP0chQT6+JC+Dvqn5X5ABGFWpMyKgFkX4vCsnGzjPKpJ1cnF
-oYuSewKJ4q4uPfLGmfwx6RDcSHyaP9kWPwJBAI53/it+cCOD6PwOqiReH/LGU6kC
-t4KpluNVOL+30bSTRqdHJdNo2jzPHYzp9QvFQihBKmMfZfhFqvrC7vdq/BkCQE9U
-owZ/VNw7LuDPEsQUZDTgwAx4rXMsKSt02NyLN2xrp4xKaaarHQ/3KWVLhCIhz27t
-on0XEA7IX6vlvUJm8kUCQFGTRjMIiNL4rvukKi1hgRFul/Bgx9xjUy5pmXTJZQhp
-A7rrhpTkMJ01tTBWQOYNFw5JghzW+6hBfeQX9bbYhzU=
+MIICXQIBAAKBgQCsn1cjNvzhKdO41E9u+WeON08c5xzu0f4DstmEoPG6L4ge9oF1
+nJ7zw+ySdfc0+HQF+8nGISSR7537qyPbMZW3gtdr9VXIvWrhrUnck34hROrB4+Vh
+vOXkSz8qfQYddKBxeX+fzvKpeaGOjKeuH4M5EMMOmnS0yYTF3WLpuKWEuwIDAQAB
+AoGAFRVnGq16KHQn4GDKDOdYXxXhS0ntDjxGtqPvDlRsAc4RZZq9CCTngyVwbRkM
+ZwNbhGmS5OiiY1KtbJIkEH8XZn2d4SpRkGumIaMVOyN4iHuj7ALNXkTvcBT50J2J
+YUjeIdjTTvj2AR3h3kA/4HMU10qvn5j5wXegKjTt1vFctxUCQQDeNsRQj0L6DKoI
+d9HaDTpmSfiVEtsbtkclBZ9z38AVduHA6lv9hUd2I6NkAVPqJ9Nc9786ACtCNAvd
+Y85rSMedAkEAxt5SuZ7TP64x+eWXgLMO36N3z4F/R7GWlGwOR1bKjOY3Z3CSb+5M
+w+Voef3x2jshqOQaYSGsdOvkhF5aaYiKNwJBANnr3cSfanCsoMejMiLknCQaYPVZ
+Q5W+wbC1/fT2NnsWVjkJ3OMYpMdgFemKP9A/9FGVCW0JI2NOhWA9c/7UpiUCQC7A
+b3RB2WncGtWj2wUfkzySIoV+7Rw+rKbB7G1rAv0y1g2UUmjL/fIDyZb8U1I5moUo
+8uao0vE9z6AqyliLB+sCQQC6aavxAR1ylgoQfcKLkZZu5PXzmyxJcWvUn74f0abd
+crkYiOyNvh7VAiYsWDB2cZ/Bqe/VcY6qt/uZS5nA9Jv9
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/BLANK/CA.pem b/test/aux-fixed/exim-ca/example.net/BLANK/CA.pem
index e6143a24d..e26debdbb 100644
--- a/test/aux-fixed/exim-ca/example.net/BLANK/CA.pem
+++ b/test/aux-fixed/exim-ca/example.net/BLANK/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOY7eAp9lkZsBxaHMAn5
-1zK898gr+Yxq+Vxgi6sXXmhsq20D/qHjVsKakEQtQLdBc3di6kRPURWiHrVqwQ+t
-RIpR1pQXqoaPmVf11aCvS3pEUaBreO+LQ3CJImrS887XIrGPDuuYuTaKrChtcMPN
-idZRKhwJAajAVJvivdDv6ucHAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABVCocYnR8xCX0k6HVaW
-RX+SAucii+m4sX6TJ/yWjNvQjKxrs3gwe19yOJB0WCOQKqU2s7UhxovW39qD4q60
-dSKq+qjW/4DfLmi1d/5aMqAq9au/s7W9Ut/jqqdL5eY31lxWRyW+D+29mfRyl+B7
-H0+wMSKs4DNtTYYEd+3W8kEw
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALW2VpRYVYpYPshnP4+7
+qUT15Ny+e8NsdobVwjRyVBqr0LHSWS5ubY4jBQ5iUGE2G/ixtUxMcGfGSNhuGFYQ
+FKvuh4F6AvlhFpqd6WFt9cb+AsWl4izqweNqo+uWcCJcqprYj/Jw13PkVK3pK1ua
+Dw/dqStmank6CTL03/GgUuyxAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAHW7exapgmmDg8dEcyLS
+QadT0QZVQkDxLEo4HcOX6SwLKJ9uNwdUCI7MWP0D/EV+2q0wNgG+YZtzyhgI/mdU
+CR8lFrFCTT0JqBWHtCZelw9+eGY2/o3ahSWJBvaZliF/53HnL4L4EtYmlCV+5Uuw
++IUzziMDFxJiuC4JNJkapdKX
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/BLANK/Signer.pem b/test/aux-fixed/exim-ca/example.net/BLANK/Signer.pem
index cb087f190..fb8e87823 100644
--- a/test/aux-fixed/exim-ca/example.net/BLANK/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.net/BLANK/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/BLANK/cert8.db b/test/aux-fixed/exim-ca/example.net/BLANK/cert8.db
index 7400388d0..b0a0fe2f6 100644
Binary files a/test/aux-fixed/exim-ca/example.net/BLANK/cert8.db and b/test/aux-fixed/exim-ca/example.net/BLANK/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/BLANK/key3.db b/test/aux-fixed/exim-ca/example.net/BLANK/key3.db
index 076c0c906..dab30bd94 100644
Binary files a/test/aux-fixed/exim-ca/example.net/BLANK/key3.db and b/test/aux-fixed/exim-ca/example.net/BLANK/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/CA/CA.pem b/test/aux-fixed/exim-ca/example.net/CA/CA.pem
index e6143a24d..e26debdbb 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/CA.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOY7eAp9lkZsBxaHMAn5
-1zK898gr+Yxq+Vxgi6sXXmhsq20D/qHjVsKakEQtQLdBc3di6kRPURWiHrVqwQ+t
-RIpR1pQXqoaPmVf11aCvS3pEUaBreO+LQ3CJImrS887XIrGPDuuYuTaKrChtcMPN
-idZRKhwJAajAVJvivdDv6ucHAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABVCocYnR8xCX0k6HVaW
-RX+SAucii+m4sX6TJ/yWjNvQjKxrs3gwe19yOJB0WCOQKqU2s7UhxovW39qD4q60
-dSKq+qjW/4DfLmi1d/5aMqAq9au/s7W9Ut/jqqdL5eY31lxWRyW+D+29mfRyl+B7
-H0+wMSKs4DNtTYYEd+3W8kEw
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALW2VpRYVYpYPshnP4+7
+qUT15Ny+e8NsdobVwjRyVBqr0LHSWS5ubY4jBQ5iUGE2G/ixtUxMcGfGSNhuGFYQ
+FKvuh4F6AvlhFpqd6WFt9cb+AsWl4izqweNqo+uWcCJcqprYj/Jw13PkVK3pK1ua
+Dw/dqStmank6CTL03/GgUuyxAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAHW7exapgmmDg8dEcyLS
+QadT0QZVQkDxLEo4HcOX6SwLKJ9uNwdUCI7MWP0D/EV+2q0wNgG+YZtzyhgI/mdU
+CR8lFrFCTT0JqBWHtCZelw9+eGY2/o3ahSWJBvaZliF/53HnL4L4EtYmlCV+5Uuw
++IUzziMDFxJiuC4JNJkapdKX
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/OCSP.key b/test/aux-fixed/exim-ca/example.net/CA/OCSP.key
index 4b0d0b14e..081bef5d0 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/OCSP.key
+++ b/test/aux-fixed/exim-ca/example.net/CA/OCSP.key
@@ -1,20 +1,20 @@
 Bag Attributes
     friendlyName: OCSP Signer
-    localKeyID: 2B 71 28 34 32 0D 11 38 D4 58 56 6F 6F C3 61 5D 81 FE A0 3D 
+    localKeyID: 83 C3 E7 52 73 7B A0 21 3F 34 6F 32 52 51 4C FF F9 D2 8A B5 
 Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOPOTJdnNPKc329E
-q6lLuWoT3Ti9dIx1ip/yvv5gC9FV2mdtmH3zmf1lHiX79FKcGzn32hhtNvOh0JOx
-nw91UuEuD9SZ2MYz0OkzmmUBneDvYnGBsBo/nGcI0oeeZp57ysUR1IlT20MVgTFP
-ghHTUY28IsdZpMkrUA2XDUUkRaQzAgMBAAECgYAEHLI3PW6wPnKuEIBEwxAqwQcK
-Qik7a9e/wWL/Nn6gHbueiFTrWR1bfJrJtr2XTCgVqMqwDDCkvzQDpn4nikefrjtt
-P9S8+iw5O1buwWOsgNPRz7w8CH5RNbA/+kG+e+782CWiDywJQRtqVZaQYmvs8xts
-CyRD9+1ZxhwWYANtYQJBAPgxWKpar5XDuTrYXm76mvjWFtALZeaBniuEWhIwCr2o
-6/X5B3DGx57rVa1EXHkkku1V4kfjPHKd1I/NWTPxkVECQQDq+MfV9cxpbFC+FAU0
-aU02UOw12mvpzLqUtlaNycjUiR5TzS4uzIupgrgkwGtYz2o/B/BqoRDmSYzkORu9
-u9xDAkEAgWdpLVkfF1z3JOFPS1nKl1c4ibyHosmOKG5XcAgwcXazoIn5ASoDRq64
-+yAbfuY83RXcZ1LpX3E/NMMCcXzQIQJBANrfqI4mayWcjs2wKnT6zcCVuqIjdrgP
-S5GxE4j5+If5vfVDwAw53rKkoFEjqBrPAmH6TDmXFP3eb0474Bppvq8CQQDgaaZa
-58xBhjvmhvud/GeYPfv8n14Sivd3t9Jb5lPq//y7vosU8lLs2MKoLre/UnTZjLJ4
-xSQEj2cy8J/4YxxQ
+MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBANpnYhecN75yeM5F
+IRsYNr79au1MLQ4FIudAPAsAFCj5AQ2dTq5na+Au807Tg/pNa/DscXsnMPusyEF2
+9tBOzGQjytdK80thpMgxPfZtknPJXs/09qH1AfuDNA5+d0wp3lzp+HIPZ+6qEsjG
+gAzF8O3Hxn66tTh96su7+PeTvxGhAgMBAAECgYAFkOifmtqi9e1zLpDmhRddVoWY
+ccpkyOvJ5GW5VyuUXBz3OhPvmv01WtX2o3ppvUoRyzFU0N/JPLbzb+jwL+9qln5W
+hn8ZRAVQurdg+pIDjsv18uEf01ac7mW8HySG25gQh7JdEwBKdn520gBZ4HlzEKT8
+zT9B+6UyYSH1rfZYwQJBAPK4Gix/LFWlGbUZTgZlVt8WmUg8Py8hEAsnOQouzdCn
++ODFL45GXvIwUMK/KJUX4RWUoyNv4RtZLzm2vMfUPOECQQDmWq7toGkd95shGy/u
+5WZS5KE0fQG7k1nVb2ja2lyekisJIpaNbswqN/TsYIGCcJjsBzov1fUx3gxAh3Oo
+lqzBAkBwmkBqTEWBJisa/TZZeUIoFQ/flzOo5anPws6Pjs8k8ghgHprFYphBu3B8
+KLrnEED4BhD5K7o/OczS9Zf3DNuBAkBroeemhJNZOz6y418sQufix41DVz2eBaWu
+AtZ9nBY2yZluNUkfYKvo9ihs4lLhPfdWIbJgc5qT6GrVI/U4yt6BAkEAsuJIERpj
+5ICE0nhqM4UUKNuplmnW15tRRft0synrXm7fJm3je+sJoq5id3ylrD0nLAiF3yNA
+UFclX4W55QENIw==
 -----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/OCSP.p12 b/test/aux-fixed/exim-ca/example.net/CA/OCSP.p12
index 7238e2d92..bb3bcbc70 100644
Binary files a/test/aux-fixed/exim-ca/example.net/CA/OCSP.p12 and b/test/aux-fixed/exim-ca/example.net/CA/OCSP.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.net/CA/OCSP.pem b/test/aux-fixed/exim-ca/example.net/CA/OCSP.pem
index 5fcd82b4b..b8cc1c618 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/OCSP.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/OCSP.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
 MIICBTCCAW6gAwIBAgIBAzANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQ0MFoXDTM4MDEwMTEyMzQ0MFowMjEUMBIGA1UEChMLZXhhbXBsZS5uZXQxGjAY
+MzQxN1oXDTM4MDEwMTEyMzQxN1owMjEUMBIGA1UEChMLZXhhbXBsZS5uZXQxGjAY
 BgNVBAMTEWNsaWNhIE9DU1AgU2lnbmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
-iQKBgQDjzkyXZzTynN9vRKupS7lqE904vXSMdYqf8r7+YAvRVdpnbZh985n9ZR4l
-+/RSnBs599oYbTbzodCTsZ8PdVLhLg/UmdjGM9DpM5plAZ3g72JxgbAaP5xnCNKH
-nmaee8rFEdSJU9tDFYExT4IR01GNvCLHWaTJK1ANlw1FJEWkMwIDAQABoyowKDAO
+iQKBgQDaZ2IXnDe+cnjORSEbGDa+/WrtTC0OBSLnQDwLABQo+QENnU6uZ2vgLvNO
+04P6TWvw7HF7JzD7rMhBdvbQTsxkI8rXSvNLYaTIMT32bZJzyV7P9Pah9QH7gzQO
+fndMKd5c6fhyD2fuqhLIxoAMxfDtx8Z+urU4ferLu/j3k78RoQIDAQABoyowKDAO
 BgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcN
-AQELBQADgYEABM8q56l/p1RDO9Gt5bhGazmwONqNCFh9fJWAJ1XIHo8pU4KaZJEi
-xs48FrHDyZRbx1GOiYtOhADffyZdbIt05/eG4eVNgR7ZdViC5vcuc0zFMThLj4kZ
-ho1F42EKuNoc7merGpA6DL18BFClKvy4NwnCzXZkyQFfCN8hPq61mGA=
+AQELBQADgYEAUsdueNj83wgbyybqrEIeL8opnLTyX+hwomW2vqGT4+7GTCMKsJJT
+fo/iC8O+t6aUt4HdiO3IBqtjibYxluykCA9AzfBT1GjMDp5Kd2FhTHIQq5yGACiq
+YSJ/qNRL4IwZ+rC6q47OwdhFlvgwGHTRi5Njn6bmJ+8k2DN1hJVnkOM=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/Signer.key b/test/aux-fixed/exim-ca/example.net/CA/Signer.key
new file mode 100644
index 000000000..7f0836301
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.net/CA/Signer.key
@@ -0,0 +1,20 @@
+Bag Attributes
+    friendlyName: Signing Cert
+    localKeyID: 58 8C 98 1B 26 7E 2E 4E 46 B8 4E B9 F5 C9 F7 86 85 EE 51 6A 
+Key Attributes: <No Attributes>
+-----BEGIN PRIVATE KEY-----
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAOkttp796P+PVpTi
+2285PNrEXM2yb40jK4T+wS7J9hbeV/RDcNRISCbQKT5cL6M9pjI0ONXsWDzbpzLz
+/MYz6m9FQTwuwlse3iTzF06YsdwozHRPsmGkxcejZRkzE9NxmwB8HIkatxQw5hh7
+y4JXVpuAfM5kNKT7opMus/RjaFszAgMBAAECgYAw2zKl2naMwVg3RtcKVVhSUA1P
+zgDAdiuCqKwKZSeKQBj2pYDJAcIYW8ogdklG7z5Yy4dTDzunuLAuJWADmVIXiuvo
+jnX3RwpVbSm+nCje391A5q5yHv30GEVPjXrjg/GjEvkClZ5tDEdkKljUxIMbJyq/
+yjSYlMNPB6UKK28FjQJBAPbr2D+7/SL6gKFou5m7lwIAlNuynuxclZUXD7POlRQ/
+88PQyOdGABIKpLeWJNt2+ufq5haP3OLgzVU6XfXMXd8CQQDxwIPVspRw2H5q2N7k
++6OE9gxdr5koBtnGnSmTqHHLlMTWuFsm7C1Nw8uBq7N/XLh2raZARO5m5JVsq+sn
+KYUtAkB1nIC0WuaH8qmyOCCjaSbUXVKKEtp/2tmk2gcwrgV0T8HcU2ZeQolmDovG
+pk2H+3QnY0uVE5Eyv8EOB28Z1O4hAkEAh5XFWtDxV+jT3fEL8bkAGM42WUTmzQAq
+m64BZ4MNb3RcgWCcHtRPBFJPjMZTwZarDkSN/XWrj6Gb/HrfQ/ORcQJBAIhfTkOy
+DDTIOVLQeeP1hJooxPBZlisGzyUOKRgjeplhHfTRQ+4tAHdxcdgZgF1NIQgi2ofo
+OqABIbFcG8z0FZQ=
+-----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/Signer.p12 b/test/aux-fixed/exim-ca/example.net/CA/Signer.p12
new file mode 100644
index 000000000..53276dc4f
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/CA/Signer.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.net/CA/Signer.pem b/test/aux-fixed/exim-ca/example.net/CA/Signer.pem
index cb087f190..fb8e87823 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/ca.conf b/test/aux-fixed/exim-ca/example.net/CA/ca.conf
index d57b222ba..9f6038396 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/ca.conf
+++ b/test/aux-fixed/exim-ca/example.net/CA/ca.conf
@@ -1,14 +1,14 @@
 ; Config::Simple 4.59
-; Thu Nov  1 12:34:40 2012
+; Thu Nov  1 12:34:16 2012
 
 [CLICA]
 sighash=SHA256
-level=1
 crl_signer=Signing Cert
 crl_url=http://crl.example.net/latest.crl
-ocsp_url=http://oscp/example.net/
-ocsp_signer=OCSP Signer
+level=1
 signer=Signing Cert
+ocsp_signer=OCSP Signer
+ocsp_url=http://oscp.example.net/
 
 [CA]
 org=example.net
diff --git a/test/aux-fixed/exim-ca/example.net/CA/cert8.db b/test/aux-fixed/exim-ca/example.net/CA/cert8.db
index 338d534f7..86d163733 100644
Binary files a/test/aux-fixed/exim-ca/example.net/CA/cert8.db and b/test/aux-fixed/exim-ca/example.net/CA/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.empty b/test/aux-fixed/exim-ca/example.net/CA/crl.empty
index 2e35093e9..5c5a78b68 100644
Binary files a/test/aux-fixed/exim-ca/example.net/CA/crl.empty and b/test/aux-fixed/exim-ca/example.net/CA/crl.empty differ
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.empty.in.txt b/test/aux-fixed/exim-ca/example.net/CA/crl.empty.in.txt
index 9ad997438..a29362bdb 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.empty.in.txt
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.empty.in.txt
@@ -1 +1 @@
-update=20151216164103Z 
+update=20161101174751Z 
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.empty.pem b/test/aux-fixed/exim-ca/example.net/CA/crl.empty.pem
index 76e5d131c..3035713fa 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.empty.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.empty.pem
@@ -1,7 +1,7 @@
 -----BEGIN X509 CRL-----
 MIHtMFgCAQEwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhhbXBsZS5uZXQx
-GzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydBgPMjAxNTEyMTYxNjQxMDNaMA0G
-CSqGSIb3DQEBCwUAA4GBABn5NY9lZHLZdatvwWpzfTv7o+l+z0eLlipis3sXx3Uu
-UocsNbNB75eqKqQVOxqVzYLoDStvvef04jHnJYK28BfbpPa9cY7hwKrQxOXu/4eo
-m0JrVyoJMKXDgOEVvAMPgB6E0u9tdAt0+O0WqHkQcrNlvp0aFFYAumMD5/gFok9v
+GzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydBgPMjAxNjExMDExNzQ3NTFaMA0G
+CSqGSIb3DQEBCwUAA4GBAHJwzBzqjnhUHwDcUqCb2/V3lygZcDSYuH5bm6nMXTML
+T/nAYYNEnx+vLvl3PoOnY3R4QOUfFO7IdW/Awxp9Pl5aARBMAqgtGdyEX26n/g5n
+ayj9Go1CaaVhRP/2x2hnlvvyKvwGxrA0w7Fp7qIBTQXd71yNdqkAXwPjZ+IjzIdh
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.v2 b/test/aux-fixed/exim-ca/example.net/CA/crl.v2
index befea56bb..df8c59847 100644
Binary files a/test/aux-fixed/exim-ca/example.net/CA/crl.v2 and b/test/aux-fixed/exim-ca/example.net/CA/crl.v2 differ
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.v2.in.txt b/test/aux-fixed/exim-ca/example.net/CA/crl.v2.in.txt
index 26b5b38a0..a488ee041 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.v2.in.txt
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.v2.in.txt
@@ -1,3 +1,3 @@
-update=20151216164105Z 
-addcert 102 20151216164105Z
-addcert 202 20151216164105Z
+update=20161101174753Z 
+addcert 102 20161101174753Z
+addcert 202 20161101174753Z
diff --git a/test/aux-fixed/exim-ca/example.net/CA/crl.v2.pem b/test/aux-fixed/exim-ca/example.net/CA/crl.v2.pem
index 76f36be6c..6096391ec 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/crl.v2.pem
+++ b/test/aux-fixed/exim-ca/example.net/CA/crl.v2.pem
@@ -1,9 +1,9 @@
 -----BEGIN X509 CRL-----
 MIIBHTCBhwIBATANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFtcGxlLm5l
-dDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0GA8yMDE1MTIxNjE2NDEwNVow
-LTAUAgFmGA8yMDE1MTIxNjE2NDEwNVowFQICAMoYDzIwMTUxMjE2MTY0MTA1WjAN
-BgkqhkiG9w0BAQsFAAOBgQAox2QRHKCtfgtt50f0G5B4NWFJUXWveolrZ1HPBgCL
-dm+y4WGB6BHzAcByRrmF4HRnIipmvyH2ntZfetUAtmwAPGZR7SXOwdEZ5Vk7dHxi
-k239UDkHrkAWyVryaVllZ8SCu45xBGYFSrNUPPQuGKAQH0uZgf9BcjsfXHYobPKe
-QQ==
+dDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0GA8yMDE2MTEwMTE3NDc1M1ow
+LTAUAgFmGA8yMDE2MTEwMTE3NDc1M1owFQICAMoYDzIwMTYxMTAxMTc0NzUzWjAN
+BgkqhkiG9w0BAQsFAAOBgQCIo/iYs4nbqo6CVRT6JDlNEvsPqKtlqlE22bPMNZVw
+smpdTlIk+MZ8bf3wH9TStOA7u1/9cKlE1eCLzXVjlKWevY81/Pk+aoJxlJMIBeRB
+zbKKcF9WzuD/FxbueS2OfDUJqR/+cFMhII+1OF7WwGAZsBH3UwG2TdO/dtIER2vc
+gg==
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.net/CA/key3.db b/test/aux-fixed/exim-ca/example.net/CA/key3.db
index 4c8aee5f9..1ae5c4826 100644
Binary files a/test/aux-fixed/exim-ca/example.net/CA/key3.db and b/test/aux-fixed/exim-ca/example.net/CA/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/CA/noise.file b/test/aux-fixed/exim-ca/example.net/CA/noise.file
index 714129d4d..24a5a48ef 100644
--- a/test/aux-fixed/exim-ca/example.net/CA/noise.file
+++ b/test/aux-fixed/exim-ca/example.net/CA/noise.file
@@ -1,201 +1,188 @@
 processor	: 0
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 3399.910
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
 physical id	: 0
-siblings	: 4
+siblings	: 1
 core id		: 0
-cpu cores	: 2
+cpu cores	: 1
 apicid		: 0
 initial apicid	: 0
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
 processor	: 1
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 3399.910
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
-physical id	: 0
-siblings	: 4
+physical id	: 1
+siblings	: 1
 core id		: 0
-cpu cores	: 2
+cpu cores	: 1
 apicid		: 1
 initial apicid	: 1
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
 processor	: 2
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 3195.664
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
-physical id	: 0
-siblings	: 4
-core id		: 1
-cpu cores	: 2
+physical id	: 2
+siblings	: 1
+core id		: 0
+cpu cores	: 1
 apicid		: 2
 initial apicid	: 2
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
 processor	: 3
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 3399.910
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
-physical id	: 0
-siblings	: 4
-core id		: 1
-cpu cores	: 2
+physical id	: 3
+siblings	: 1
+core id		: 0
+cpu cores	: 1
 apicid		: 3
 initial apicid	: 3
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
            CPU0       CPU1       CPU2       CPU3       
-  0:         68          0          0          0   IO-APIC   2-edge      timer
-  1:        689       7853        658        778   IO-APIC   1-edge      i8042
-  8:          0          0          1          0   IO-APIC   8-edge      rtc0
-  9:       1160        695        344        261   IO-APIC   9-fasteoi   acpi
- 12:     314976    1327914     163447     143732   IO-APIC  12-edge      i8042
- 16:        332        194        163        132   IO-APIC  16-fasteoi   ehci_hcd:usb3, mmc0
- 18:          0          0          0          0   IO-APIC  18-fasteoi   i801_smbus
- 23:         17         31          0          0   IO-APIC  23-fasteoi   ehci_hcd:usb4
- 24:      44762       5748     786804       3298   PCI-MSI 512000-edge      0000:00:1f.2
- 25:          0          0          0          0   PCI-MSI 327680-edge      xhci_hcd
- 26:          3          6          1          1   PCI-MSI 409600-edge      enp0s25
- 27:        852        591         64         42   PCI-MSI 32768-edge      i915
- 28:          8          6          3          6   PCI-MSI 360448-edge      mei_me
- 29:         62         82          0          6   PCI-MSI 442368-edge      snd_hda_intel
- 30:     779603       1591         37         80   PCI-MSI 1572864-edge      iwlwifi
-NMI:         94         87         91         87   Non-maskable interrupts
-LOC:    2717165    2177070    2758401    2241707   Local timer interrupts
+  0:        135          0          0          0   IO-APIC-edge      timer
+  1:          1          2          3          2   IO-APIC-edge      i8042
+  6:          0          1          1          1   IO-APIC-edge      floppy
+  8:          0          0          0          0   IO-APIC-edge      rtc0
+  9:          0          0          0          0   IO-APIC-fasteoi   acpi
+ 10:        496        482        486        468   IO-APIC-fasteoi   virtio4
+ 11:         10        147         30         27   IO-APIC-fasteoi   uhci_hcd:usb1, qxl
+ 12:          0         41         47         38   IO-APIC-edge      i8042
+ 14:          0          0          0          0   IO-APIC-edge      ata_piix
+ 15:         24         20     182208         20   IO-APIC-edge      ata_piix
+ 24:          0          0          0          0   PCI-MSI-edge      virtio0-config
+ 25:          0          0          0          0   PCI-MSI-edge      virtio2-config
+ 26:          0          3          1          4   PCI-MSI-edge      virtio2-virtqueues
+ 27:    3075309         25         27         24   PCI-MSI-edge      virtio0-input.0
+ 28:          0          0          1          0   PCI-MSI-edge      virtio0-output.0
+ 29:          0          0          0          0   PCI-MSI-edge      virtio1-config
+ 30:          8         10          6     263048   PCI-MSI-edge      virtio1-input.0
+ 31:          0          1          1          0   PCI-MSI-edge      virtio1-output.0
+ 32:          0          0          0          0   PCI-MSI-edge      virtio3-config
+ 33:       2251       1443       1443      76460   PCI-MSI-edge      virtio3-req.0
+NMI:          0          0          0          0   Non-maskable interrupts
+LOC:    2930727    2337740    2362650    2473899   Local timer interrupts
 SPU:          0          0          0          0   Spurious interrupts
-PMI:         94         87         91         87   Performance monitoring interrupts
-IWI:          0         38          3          4   IRQ work interrupts
+PMI:          0          0          0          0   Performance monitoring interrupts
+IWI:     172169      63376      48335      57101   IRQ work interrupts
 RTR:          0          0          0          0   APIC ICR read retries
-RES:     181926     181930     174985     218174   Rescheduling interrupts
-CAL:     155928      95381     153320      90535   Function call interrupts
-TLB:      19955      22444      21487      20786   TLB shootdowns
+RES:     803394     677845     571916     698750   Rescheduling interrupts
+CAL:      22684      11471      17545       1233   Function call interrupts
+TLB:      82385      78148      78910      80389   TLB shootdowns
 TRM:          0          0          0          0   Thermal event interrupts
 THR:          0          0          0          0   Threshold APIC interrupts
-DFR:          0          0          0          0   Deferred Error APIC interrupts
 MCE:          0          0          0          0   Machine check exceptions
-MCP:         29         29         29         29   Machine check polls
-HYP:          0          0          0          0   Hypervisor callback interrupts
+MCP:        624        624        624        624   Machine check polls
 ERR:          0
 MIS:          0
-PIN:          0          0          0          0   Posted-interrupt notification event
-PIW:          0          0          0          0   Posted-interrupt wakeup event
-MemTotal:       16127228 kB
-MemFree:        11172348 kB
-MemAvailable:   11360848 kB
-Buffers:           16824 kB
-Cached:           258036 kB
-SwapCached:      1969000 kB
-Active:          2299052 kB
-Inactive:        2277200 kB
-Active(anon):    2261212 kB
-Inactive(anon):  2129652 kB
-Active(file):      37840 kB
-Inactive(file):   147548 kB
-Unevictable:       22232 kB
-Mlocked:           22232 kB
-SwapTotal:       7286780 kB
-SwapFree:         619792 kB
-Dirty:              5712 kB
+MemTotal:        1785008 kB
+MemFree:          255196 kB
+MemAvailable:    1299360 kB
+Buffers:               0 kB
+Cached:           490764 kB
+SwapCached:          252 kB
+Active:           329040 kB
+Inactive:         222876 kB
+Active(anon):      28888 kB
+Inactive(anon):    73412 kB
+Active(file):     300152 kB
+Inactive(file):   149464 kB
+Unevictable:           0 kB
+Mlocked:               0 kB
+SwapTotal:       3354620 kB
+SwapFree:        3353308 kB
+Dirty:              2224 kB
 Writeback:             0 kB
-AnonPages:       2355600 kB
-Mapped:           161840 kB
-Shmem:             79820 kB
-Slab:             122648 kB
-SReclaimable:      63112 kB
-SUnreclaim:        59536 kB
-KernelStack:       12384 kB
-PageTables:        60456 kB
+AnonPages:         60940 kB
+Mapped:            18716 kB
+Shmem:             41148 kB
+Slab:             898272 kB
+SReclaimable:     847964 kB
+SUnreclaim:        50308 kB
+KernelStack:        2656 kB
+PageTables:         5240 kB
 NFS_Unstable:          0 kB
 Bounce:                0 kB
 WritebackTmp:          0 kB
-CommitLimit:    15350392 kB
-Committed_AS:   22203576 kB
+CommitLimit:     4247124 kB
+Committed_AS:     383304 kB
 VmallocTotal:   34359738367 kB
-VmallocUsed:      457088 kB
-VmallocChunk:   34358947836 kB
+VmallocUsed:      149692 kB
+VmallocChunk:   34359524352 kB
 HardwareCorrupted:     0 kB
-AnonHugePages:   1890304 kB
+AnonHugePages:      6144 kB
 HugePages_Total:       0
 HugePages_Free:        0
 HugePages_Rsvd:        0
 HugePages_Surp:        0
 Hugepagesize:       2048 kB
-DirectMap4k:      144572 kB
-DirectMap2M:    16322560 kB
+DirectMap4k:       67576 kB
+DirectMap2M:     4126720 kB
 Inter-|   Receive                                                |  Transmit
  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
-virbr1-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
- vnet0:  128666     393    0    0    0     0          0         0   317193    3976    0    0    0     0       0          0
- vnet5:   43924     524    0    0    0     0          0         0   221686    3859    0    0    0     0       0          0
-enp0s25: 31338290   49183    0    0    0     0          0      1035 10708826   44319    0    0    0     0       0          0
-virbr0-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
- vnet2:   69293     283    0    0    0     0          0         0   364210    3770    0    0    0     0       0          0
- vnet4:   59178     194    0    0    0     0          0         0   238387    3594    0    0    0     0       0          0
-virbr0: 5345737    5274    0    0    0     0          0         0  1408922    5318    0    0    0     0       0          0
- vnet1: 5034219    3505    0    0    0     0          0         0  1151113    7193    0    0    0     0       0          0
-    lo:   20864     210    0    0    0     0          0         0    20864     210    0    0    0     0       0          0
-virbr1:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
-wlp3s0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
- vnet3:   84293     375    0    0    0     0          0         0   279557    3664    0    0    0     0       0          0
+  eth0: 218836605 3199144    0 95485    0     0          0         0  7359507   57561    0    0    0     0       0          0
+  eth1: 29582512  268313    0 93507    0     0          0         0 30026986   67532    0    0    0     0       0          0
+    lo:    1056      11    0    0    0     0          0         0     1056      11    0    0    0     0       0          0
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/expired1.example.net/ca_chain.pem
index d2b533cba..860ab0a8f 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.net/CN=clica Signing Cert
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.net/CN=clica CA
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOY7eAp9lkZsBxaHMAn5
-1zK898gr+Yxq+Vxgi6sXXmhsq20D/qHjVsKakEQtQLdBc3di6kRPURWiHrVqwQ+t
-RIpR1pQXqoaPmVf11aCvS3pEUaBreO+LQ3CJImrS887XIrGPDuuYuTaKrChtcMPN
-idZRKhwJAajAVJvivdDv6ucHAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABVCocYnR8xCX0k6HVaW
-RX+SAucii+m4sX6TJ/yWjNvQjKxrs3gwe19yOJB0WCOQKqU2s7UhxovW39qD4q60
-dSKq+qjW/4DfLmi1d/5aMqAq9au/s7W9Ut/jqqdL5eY31lxWRyW+D+29mfRyl+B7
-H0+wMSKs4DNtTYYEd+3W8kEw
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALW2VpRYVYpYPshnP4+7
+qUT15Ny+e8NsdobVwjRyVBqr0LHSWS5ubY4jBQ5iUGE2G/ixtUxMcGfGSNhuGFYQ
+FKvuh4F6AvlhFpqd6WFt9cb+AsWl4izqweNqo+uWcCJcqprYj/Jw13PkVK3pK1ua
+Dw/dqStmank6CTL03/GgUuyxAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAHW7exapgmmDg8dEcyLS
+QadT0QZVQkDxLEo4HcOX6SwLKJ9uNwdUCI7MWP0D/EV+2q0wNgG+YZtzyhgI/mdU
+CR8lFrFCTT0JqBWHtCZelw9+eGY2/o3ahSWJBvaZliF/53HnL4L4EtYmlCV+5Uuw
++IUzziMDFxJiuC4JNJkapdKX
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/expired1.example.net/cert8.db
index 51acaf041..c0d93a72f 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired1.example.net/cert8.db and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.chain.pem
index 05d8b7dec..4dd728c7f 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired1.example.net
-    localKeyID: 30 93 A9 CA 9C 39 D2 39 11 AD 46 15 42 E3 D0 BB 2A E3 3D 32 
+    localKeyID: 9A AF 11 07 E4 1D BC 1C D0 1C 7E 7F 0C 91 F7 69 20 A2 88 E9 
 subject=/CN=expired1.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZzANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQ0MVoXDTEyMTIwMTEyMzQ0MVowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
-ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJrX3SMipXzwFiOjbvdH
-5ap8oCcCgO5GbVTW+2lFM2epq1mtF9xvVAYfzu7X9XLi3OQcdOWraVKLURlK0JJb
-AdzrAsajbs5F9PWIXuXbtLPSrWx1xa+9It/Mwc3451wXJNWWLzfutOiLrsd0B3FZ
-M1LuhJ8cc2OncVQC8+Ty1oudAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQyMFoXDTEyMTIwMTEyMzQyMFowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
+ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOetOZ/lz5792Jijv3XL
+2sZ489lHQBYdaC87pXVJ7xTedmZ/S/dlKA9DYuRmZIay+pCZwDIxL8OSKTbQHjKN
+cXDOqVLzraH6VGjZPNjUxNrci23yoXC1GQkEcjSgJDU/kQeqbwppqr2mq28MK4XP
+fPZnX726A9kOYi54MJN4JqDXAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm5ldC8wHwYDVR0R
-BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEAgwSn
-B4YRfFKbUCp0ILBQBaRUno4MzUyJloT7e09j+/CQaLPQhxHEuFrTBXFkwL0oxCOn
-TrsoGCO+OG/5ETUsdHJKJleqeCjPzu/cOUl48NZKHfI0FRGnjXqgeBln9r8kQLeG
-8IIvXJGecIWm+IpKMFgo0q7yd3nIVl5Xk4xq1po=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm5ldC8wHwYDVR0R
+BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEAlW3u
+wOkP/n3NxCdnmsIMPkUfsYhB2QwOnXTeS3X0Wkb9UETJxL/wyOubx6rV3BCQDk0k
+bHlofR66DbqXkZ+W+LvJ4ibIaxkE6OpcJS3kx+twJ0Ii70tYPfoRcjAY4n+w+BIn
+CbVeXkP8zop5pnIJfmauz63oaOkPa2fyUeq+lXA=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.key b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.key
index 312b77809..9b705cfdf 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired1.example.net
-    localKeyID: 30 93 A9 CA 9C 39 D2 39 11 AD 46 15 42 E3 D0 BB 2A E3 3D 32 
+    localKeyID: 9A AF 11 07 E4 1D BC 1C D0 1C 7E 7F 0C 91 F7 69 20 A2 88 E9 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIfc37w/ONzOMCAggA
-MBQGCCqGSIb3DQMHBAj4hLDQfNOVvwSCAoB5SgUvtiT9VLrNjrSmf6aOa09y+UjS
-ZEnlot2pIS/rgC2+DfUZM0h0M6eaBYpuFY9N86qGD5byCmStCz8oABFq35jGpVx2
-QXCE18F4Ca93bLPw11pXdmVqEoOzwmXM6ElDUDqE2CXmV2ZbFGFtSVETNcrjKg30
-CgEW7ryU2Hlab0hWZ+2poEGexgiposQ5IbMO0OVeoHlCMhAVu4KEHc7n+a+XKlt7
-8O/yK+DRtMbCYG2qmFUdF4YmVx+GmECGXzvWlPJ/0lg/wHzWTIiv2oI+R1NvYxCa
-JePJ0WFpae5D1g1vGZN2eu4VAbA71bH/dkcDPx30Yc+qC7hH8HiVw4D2JFt1y/6r
-FG4ECUe0GPLkpyttKHMFh200fNJVO1zMucmV5mJg/A+LHQcvT85QNrZx1Xb3K9Ou
-o0/a/jY3K+joLP/q4uCvnLf4J2JoyiQaydCQ0jOItNUivWOeVI24mU+EqgOASEjB
-j48WU5GlopgqUl5vgTTvJww5LrZKpA0Ft+prMZuwYl86hN4FZGRc6FkymKwpTRzL
-w2WnSZCuhjx83UpLYVuzTpZze6hZwSCoV3y63Tb1moBrvf+3sxYlxjmeOq62GJ9D
-z6/nCvP6YR0GWup4I5Zs0F4BpHUJZhYchrbSKC7sty39fBS5Xfa5I55T1JOiQxLp
-pQGfWSUEqquHkAkaQ+uGqWljN1mw01e4C/4LZAXds4dnNs+/1GIIVR+CWPSj9MYe
-UxoBtgPw0ZwtQDSImo5PC9tgJibkBUQLT+Yy1IAhug3onYuORC/cQmrKmWe/NDOb
-8AvrONnFw6yeQzWpjx7irPflLo+KPKZbYOwp7IK1oFQDW3FX0efMVGMR
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIBdkc/9nuKRkCAggA
+MBQGCCqGSIb3DQMHBAga59grlxIvnASCAoAOPMW/jpiJuAtqmJJFeFmeUz8ucX7N
+laacTJjPGEXfmTNNsB/gBXbsEGm3yKSXIjcb1S62HFbdAbdpHdj0Usr9RxuBlcC6
+GcRdL3qt9YSZ/RuzFr0jYZbiqI3vB0N6fX8qg6Lp/AhZLxsRi2sAzdQ0cAHWP3c3
+6YpL0OTv0VJtqM6foAmmUwEU1xkSr1bcXML23I5Vm13OxkX1RdY1OyQqqJ48wyIY
+wdtxBfwQUobpNZg+G4ioqXfv1ZhsI0UyxKUYf5wP+7noQgv/SWGe3IOMxLZp8YOD
+lm0TMjB7L9QqzZlOT+AjkATuycetzPiYgxAey0JVvTk/An+jJqgDIkbeAxuGIQp7
+k146GsD4MiVtqU73dkZdm+ZsEl+rAbhjLgXuDNc0mgvqRBWr80PdBDWXP89n59by
+Vx55mMCB+4IyiFW/PdsydC8fWZH0EIE/ntsDCjyf+tDHkBk7nB9l/FlRJSY539vn
+PIaL6/7iCon+gGe6aHVTNtLJX9ICxFU4xFrhoprV4GBjCWLdaHc/al7kXKAO+3xD
+y0IT1ousFn8IsPvAZS2Lkn9V46ok5mUJXoOwnBMZWsHXhm6u0lVa7AweqJtYhUIc
+bdueSPVyblHDaXIUaL6oU0F5Y8DKDy4ZNKXRYaFrU9vT8g8EdwALpoWY38q7p30r
+K7HvXmGrW2tvDIKNKrycnQO0M27av3zpm44Ch5o97gXGZFLFnsfOcn3NN/tr14IJ
+m25WE5DIcxL5kIAi2/80PiR3Donj1Xco5lsx3aMuWAp1hkTC5PKN0o1oKZHCuXae
+7t0e655FRJ7DARZW+qqfnBRHQTRxDrgMgn3Q2R0E+QlS1YQJLXhsQvxm
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.dated.resp
index edc571918..0c2e60999 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.good.resp
index aafad4739..4b9db77b4 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.req
index bdb872132..fde5be432 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.req and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.revoked.resp
index eb491b6f4..ed05f5daa 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.dated.resp
new file mode 100644
index 000000000..2d6e1c301
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.good.resp
new file mode 100644
index 000000000..668919d74
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..777255b2a
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..038581e73
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..073b3c161
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..233ddca97
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.p12 b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.p12
index 7cf4fdd39..05f122d29 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.p12 and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.pem b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.pem
index 787418cac..b7a32db9e 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired1.example.net
-    localKeyID: 30 93 A9 CA 9C 39 D2 39 11 AD 46 15 42 E3 D0 BB 2A E3 3D 32 
+    localKeyID: 9A AF 11 07 E4 1D BC 1C D0 1C 7E 7F 0C 91 F7 69 20 A2 88 E9 
 subject=/CN=expired1.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZzANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQ0MVoXDTEyMTIwMTEyMzQ0MVowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
-ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJrX3SMipXzwFiOjbvdH
-5ap8oCcCgO5GbVTW+2lFM2epq1mtF9xvVAYfzu7X9XLi3OQcdOWraVKLURlK0JJb
-AdzrAsajbs5F9PWIXuXbtLPSrWx1xa+9It/Mwc3451wXJNWWLzfutOiLrsd0B3FZ
-M1LuhJ8cc2OncVQC8+Ty1oudAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQyMFoXDTEyMTIwMTEyMzQyMFowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
+ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOetOZ/lz5792Jijv3XL
+2sZ489lHQBYdaC87pXVJ7xTedmZ/S/dlKA9DYuRmZIay+pCZwDIxL8OSKTbQHjKN
+cXDOqVLzraH6VGjZPNjUxNrci23yoXC1GQkEcjSgJDU/kQeqbwppqr2mq28MK4XP
+fPZnX726A9kOYi54MJN4JqDXAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm5ldC8wHwYDVR0R
-BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEAgwSn
-B4YRfFKbUCp0ILBQBaRUno4MzUyJloT7e09j+/CQaLPQhxHEuFrTBXFkwL0oxCOn
-TrsoGCO+OG/5ETUsdHJKJleqeCjPzu/cOUl48NZKHfI0FRGnjXqgeBln9r8kQLeG
-8IIvXJGecIWm+IpKMFgo0q7yd3nIVl5Xk4xq1po=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm5ldC8wHwYDVR0R
+BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEAlW3u
+wOkP/n3NxCdnmsIMPkUfsYhB2QwOnXTeS3X0Wkb9UETJxL/wyOubx6rV3BCQDk0k
+bHlofR66DbqXkZ+W+LvJ4ibIaxkE6OpcJS3kx+twJ0Ii70tYPfoRcjAY4n+w+BIn
+CbVeXkP8zop5pnIJfmauz63oaOkPa2fyUeq+lXA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.unlocked.key
index 7c99a8e17..76cba4a96 100644
--- a/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/expired1.example.net/expired1.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCa190jIqV88BYjo273R+WqfKAnAoDuRm1U1vtpRTNnqatZrRfc
-b1QGH87u1/Vy4tzkHHTlq2lSi1EZStCSWwHc6wLGo27ORfT1iF7l27Sz0q1sdcWv
-vSLfzMHN+OdcFyTVli837rToi67HdAdxWTNS7oSfHHNjp3FUAvPk8taLnQIDAQAB
-AoGAdt52Rg3H6yTIai2B91V7ayjnLWtPnRv1vKaZNJRKRS9MerhV1ASnBViP3G1v
-YPXlyzxJRTMU1Khc5sS3X1N8FnF20LuyVZpvKKFcxkGrU77+8Zl8+vpdK1zxv0S2
-X8POJAZHqScqXdRC03nnA0mp1Zb71CGQ2D4OM3f/qaLp9kUCQQDOPCdYcyLFfd5U
-IrDXucXrMPfhaKMEmpYXl99fwMVRmT7rYFgqGEIYAINjl1Bgu0FCecSfPOBH/Dar
-IldhiglLAkEAwDUQWntbAA08w3r5TS7uHcZ85Ec1Rz/q7nVDk5IVQHr0obOZLFHt
-hIZhL6xDDyB3ecCJm5csJh1WgSp0E7xVtwJAHTi8wnWd6anKBNXdhNOXzZlkphWz
-c4WL2s/0IJcp3kP+fE9sbpp9UvVPqJ7aDrq5pnemeoGfrdN404rMIs/yPQJAa44G
-DavTe07s/rJUyRUG2BCXGKKkNK+WxkNGQlDPpZpoRAgdIYji8XLE9YleqRtQ4AeW
-uUM5yEZIftUDyXttNwJBAI5usOrcqizhIF0kwAnlfn70G8QsfDVHXvuOS7Hwx4wr
-x96beknpccYAojJxWdzeP4hzLc9apLUUTBy4sYZCcMA=
+MIICXQIBAAKBgQDnrTmf5c+e/diYo791y9rGePPZR0AWHWgvO6V1Se8U3nZmf0v3
+ZSgPQ2LkZmSGsvqQmcAyMS/Dkik20B4yjXFwzqlS862h+lRo2TzY1MTa3Itt8qFw
+tRkJBHI0oCQ1P5EHqm8Kaaq9pqtvDCuFz3z2Z1+9ugPZDmIueDCTeCag1wIDAQAB
+AoGAZOIfp6sw37D2MnGLm8XrPGXK+aB3HaoshfTZNdu+Cj5dHIDuGYqpCQx08bRM
+rgMd7P2mnbShce4hmEbD/4tsC7kCGGtwRsxeVZyxklgpBXRMGjQghx32JM9jn7lE
+0ZVILJlrKRFlUY96wAB3rjAefPqrpYV1d48fVUc2/ofXSAECQQD+xRAkJfKUn+wv
+1ro/xwsITbCWLTL4Gl6LTM5pbEsrA/CU686A6yW5ku5CnjoB3XAz4e71fMepf3WE
+GHzILb7XAkEA6MudfRW9Yq5HkKpkwGoSPBsE9ip5fszNDLmLxjAKI9IzLutSwtFU
+Gh/0B4FJpu+xUiWgQTVozBwvEnKjmzvuAQJBAK1fASr4P+nwIlQzta7tDo7p/39S
+5tp7Z1c4P0bykPyGw9Mz3OVSH+v3FvhyoFrgjBhiabDY5y5rNFdeKpw2tSUCQQCH
+ST0+4hFrdai1U7C1eW8bawBZJpnwrIhFatbl2CksZA3GqI8yFIBxpjwk2Ge7EfTU
+rnURMD60z3Qznleh8RQBAkBRm+clmkmjPx6ZzD5+3vX0lPa+Lf4HQb6OqgJpchDk
+AkFnH61DZRdCX7DRipkhzuBlzK0tbSsl+labyfTY7g2H
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired1.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/expired1.example.net/key3.db
index 67e9e3593..32cae78ff 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired1.example.net/key3.db and b/test/aux-fixed/exim-ca/example.net/expired1.example.net/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/expired2.example.net/ca_chain.pem
index d2b533cba..860ab0a8f 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.net/CN=clica Signing Cert
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.net/CN=clica CA
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOY7eAp9lkZsBxaHMAn5
-1zK898gr+Yxq+Vxgi6sXXmhsq20D/qHjVsKakEQtQLdBc3di6kRPURWiHrVqwQ+t
-RIpR1pQXqoaPmVf11aCvS3pEUaBreO+LQ3CJImrS887XIrGPDuuYuTaKrChtcMPN
-idZRKhwJAajAVJvivdDv6ucHAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABVCocYnR8xCX0k6HVaW
-RX+SAucii+m4sX6TJ/yWjNvQjKxrs3gwe19yOJB0WCOQKqU2s7UhxovW39qD4q60
-dSKq+qjW/4DfLmi1d/5aMqAq9au/s7W9Ut/jqqdL5eY31lxWRyW+D+29mfRyl+B7
-H0+wMSKs4DNtTYYEd+3W8kEw
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALW2VpRYVYpYPshnP4+7
+qUT15Ny+e8NsdobVwjRyVBqr0LHSWS5ubY4jBQ5iUGE2G/ixtUxMcGfGSNhuGFYQ
+FKvuh4F6AvlhFpqd6WFt9cb+AsWl4izqweNqo+uWcCJcqprYj/Jw13PkVK3pK1ua
+Dw/dqStmank6CTL03/GgUuyxAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAHW7exapgmmDg8dEcyLS
+QadT0QZVQkDxLEo4HcOX6SwLKJ9uNwdUCI7MWP0D/EV+2q0wNgG+YZtzyhgI/mdU
+CR8lFrFCTT0JqBWHtCZelw9+eGY2/o3ahSWJBvaZliF/53HnL4L4EtYmlCV+5Uuw
++IUzziMDFxJiuC4JNJkapdKX
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/expired2.example.net/cert8.db
index 511828260..8487428dc 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired2.example.net/cert8.db and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.chain.pem
index 5373d84ba..9ceb8fdde 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired2.example.net
-    localKeyID: AC A0 16 38 87 AB 28 96 6E 21 6E 26 E1 90 00 11 5D 25 79 AF 
+    localKeyID: 1B FE B7 F4 F9 64 D6 55 85 0D B8 4F 66 7D DD 24 CE 4A 67 95 
 subject=/CN=expired2.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMswDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDFaFw0xMjEyMDExMjM0NDFaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
-bGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcSCmpy4lm9UKl6gu/
-ISgxTijBFZFTaBeT91+GxJpBwmZhAmqgUTTITRKVXQ3jTPoB6mjhUrBhRAn6fV15
-eepFOgRIfq9wleLYHf3MmHuD05FQxgdFdYqj7rMM7wslteA6BCVy0/jZmaGnRZ1Z
-oiAXXrV5goHmV++Iskx40/wh7wIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MjJaFw0xMjEyMDExMjM0MjJaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
+bGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVBCb/zCK6rPCw1M9n
+PBc8vzTv9QMlMbkC5tNYzYcL/9r4AC8HoIsPrs/mbGwPdzGDfTRVz7XsYHfm75Ir
+6W4RGkh8y0mHQR9FidE6OtlhsuhZjUez7DdIusFZpwpusmhbwl2PkFF5+w5xRN/p
+mI+AH3EDLeL4e8rGEDjUlYEHBQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5uZXQvMB8GA1Ud
-EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBADaj
-ygpTux0LFCBD60TiEh2XNOnX/DvxrRdX6BBUWCec9upygG398XNF1GivtQLd1wE2
-xN3h9LvyXOm+mTdflm3VmYQqNwdQWupjNKxGFTUWV3Jl9m/Nd+UM4fWNSM0T6TE1
-YXSuOBA0DN06kGKpp7GJZBB5PRhbbE+4sbKqQNlC
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB8GA1Ud
+EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAK8/
+DlZCyZtARfYN3wRLvn5QP397KqugKDRSGW5pQVsheBPCe5DPnZ6XbL1DWQgzoAA6
+kRBKNm5l9C5lOtzcD0h8OmX+GOpHZyVF4LGKTowqKeS79CxqOCzYvOsOIfHcI0AF
+jARIiZn1GzMKQvrf3Lq7ctrs5M6a3GCsbr38rvlr
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.key b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.key
index f6c05f83e..2c6212ed0 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired2.example.net
-    localKeyID: AC A0 16 38 87 AB 28 96 6E 21 6E 26 E1 90 00 11 5D 25 79 AF 
+    localKeyID: 1B FE B7 F4 F9 64 D6 55 85 0D B8 4F 66 7D DD 24 CE 4A 67 95 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIn7wBE32WUxkCAggA
-MBQGCCqGSIb3DQMHBAgujTxmGe8opwSCAoDo+aUg2uDhyEsCkSLqzTxQCirDWNj7
-3qgzDmlIl5E6TK8/kTYvYK2THBMe1MnD+bWEaQym/H4N05WcNmOgh7t1HOPwhNnN
-0Iy5Y7lB8qzubLai+X+Z6qonu61K+i/FBos+yFUYgbEf3+pJYO410+rnJvuNUa+Q
-O0ez15JZAA3aBG/90McavLgsJfowyYcMs4IV8kuK4N3l3SgTC4fUegtE/FTg1Pk/
-opdrBTnh/I8Spjw5T2RtFfPH700besFMRWbGU9AcpV3U5RhTVkBCkvNlmNDRuLDO
-oOv16t/2XldumEvDCweJkFQTd1YQHxkM/v4lCG5dUtZvUHLG5m0P/GNA8HKbcAuy
-OwyrCZACYmOKgHhqM/wa0JvDb2ZPUV6yMNkOiG6pPNh99pH9/rbKGzfFu2XRifSg
-ilLpYp3vuVYlTmBwAbXBDyl/Aiv1CUGfmFMmOYQNWPxSe5XVKLck5iq8DKxAdmdN
-xi1GIXXoS68kf8jD/gcxtwOqOW1hWkdBmdfW0fZ7e27FuUTHUxJvDqDXoBcLvKUx
-68NJcH0pujmdUFbm+qKN0p7Eaclii26h3LyGoNq7cPP7Hqo9bcV4Xtpnhz1crH5U
-cs+gZ3hnVEDtCUnL7lQUKUQNKZTCzzRo5UGQDIEEHy7qYh8UtMzsIOuFacu5pmkf
-vEjIGiB3RPNQJ7EGMK1qxu1MxZ5MdQQuONpf8FFDzXhIM1p35Zqm+k3fC8Jnu42f
-CrhffQ1+8+aKUIyQ5czEcK/z1LPqQBBE8cflJVU09Gd6KNH7ZHI6oHiZO51GlrNm
-4/gGjcEavXJ6ewY2cKZBXXfo4XE2cpGFMnUeJoEtPCf+SQtQLw9Ad6Hp
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIo+Z1MMAxXMUCAggA
+MBQGCCqGSIb3DQMHBAi2sn4DoRlq9wSCAoAFcaKcbpOKq563nFJqtRUeC50PJsns
+uRnK54IDJV8FyiC1k4YRFuyzD6v0p2CyNp7AG3bBo7CvMCcVaPZQwU9QB4/m7/VQ
+9BWHjJuNyK6Ea4T7j+N2mnqhKTUDxgu3uSMgjgykkpiduCGVXetabt0GNWLs+zNh
+I+NESGFS4E52Lec4g5kBuCfDOR+gAXV0Gbc8/MaHygAR2/rtRn5Nc+wutKchvCzx
+SUQFiK6NFnCB5fuci1A1P8nZckk9ik987f/lY94EgWVeXy36Dnjk7S3l7bDqAwVD
+aglrZfXarhts4VCj0JfHKfZ+Dw+2Nl6LZzaTEBeGWyQ4IRZxn7c5CQv5PtK22oKx
+00R9YIaEwKnkLqwhxGnOL3isNixuMQsHAvBvzf/3rRkiN++6NlWKwF4ULcb9qm+O
+k/KEITJbFxhOogAS3aZmXD8NeJPzbQ8CTrJGs5lT+xatb2pqDC/9FpYcLSreTWNu
+3T0EjfRCOmW5E5pPlpKIFxRUd/U0tHC26v7mOX1nTCnrzRVQALliNUnDCXDKsVbQ
+QNrkUwdSba7SrVy5Gxrd23mQriJRA082pA7fZ/P8hqKBneB0xCYMdsd2wOaA8ZUz
+OxvvIcEOaAjDWVOYoi3TKBYxhaLLFFbeDITSAVSbvqWXWzWflPaAfAU0jkSK4mHb
+Hj1wnmCexxO/Kv9sYxX1Hq3b4SrrpywWDwCR70AewdcftBp8tw4uV5A0EZoEjutA
+pQMxFSAPdQ/vBmqLNZzYQlcbhTY4cnIEnlfG7cG458h2pUT2wfqYaBki/Ehjl5Yq
+R2foB9GcFuGxNTsUheREjG5hQMHLaZISpA7ZZPkLpL+ffrNZr22lQDq6
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.dated.resp
index f6215ef72..deda60206 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.good.resp
index 1adb757b9..e14739606 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.req
index 49d083c40..a11fe0573 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.req and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.revoked.resp
index 1adb757b9..e14739606 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.dated.resp
new file mode 100644
index 000000000..594bff309
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.good.resp
new file mode 100644
index 000000000..78fa4ad40
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..78fa4ad40
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..ed31d931e
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..2c7f98a87
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..2c7f98a87
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.p12 b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.p12
index 1382a72dd..5798024a7 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.p12 and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.pem b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.pem
index 9ea6409c3..385a44de1 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired2.example.net
-    localKeyID: AC A0 16 38 87 AB 28 96 6E 21 6E 26 E1 90 00 11 5D 25 79 AF 
+    localKeyID: 1B FE B7 F4 F9 64 D6 55 85 0D B8 4F 66 7D DD 24 CE 4A 67 95 
 subject=/CN=expired2.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMswDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDFaFw0xMjEyMDExMjM0NDFaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
-bGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcSCmpy4lm9UKl6gu/
-ISgxTijBFZFTaBeT91+GxJpBwmZhAmqgUTTITRKVXQ3jTPoB6mjhUrBhRAn6fV15
-eepFOgRIfq9wleLYHf3MmHuD05FQxgdFdYqj7rMM7wslteA6BCVy0/jZmaGnRZ1Z
-oiAXXrV5goHmV++Iskx40/wh7wIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MjJaFw0xMjEyMDExMjM0MjJaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
+bGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVBCb/zCK6rPCw1M9n
+PBc8vzTv9QMlMbkC5tNYzYcL/9r4AC8HoIsPrs/mbGwPdzGDfTRVz7XsYHfm75Ir
+6W4RGkh8y0mHQR9FidE6OtlhsuhZjUez7DdIusFZpwpusmhbwl2PkFF5+w5xRN/p
+mI+AH3EDLeL4e8rGEDjUlYEHBQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5uZXQvMB8GA1Ud
-EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBADaj
-ygpTux0LFCBD60TiEh2XNOnX/DvxrRdX6BBUWCec9upygG398XNF1GivtQLd1wE2
-xN3h9LvyXOm+mTdflm3VmYQqNwdQWupjNKxGFTUWV3Jl9m/Nd+UM4fWNSM0T6TE1
-YXSuOBA0DN06kGKpp7GJZBB5PRhbbE+4sbKqQNlC
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB8GA1Ud
+EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAK8/
+DlZCyZtARfYN3wRLvn5QP397KqugKDRSGW5pQVsheBPCe5DPnZ6XbL1DWQgzoAA6
+kRBKNm5l9C5lOtzcD0h8OmX+GOpHZyVF4LGKTowqKeS79CxqOCzYvOsOIfHcI0AF
+jARIiZn1GzMKQvrf3Lq7ctrs5M6a3GCsbr38rvlr
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.unlocked.key
index e6caecc11..45271166d 100644
--- a/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/expired2.example.net/expired2.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQDcSCmpy4lm9UKl6gu/ISgxTijBFZFTaBeT91+GxJpBwmZhAmqg
-UTTITRKVXQ3jTPoB6mjhUrBhRAn6fV15eepFOgRIfq9wleLYHf3MmHuD05FQxgdF
-dYqj7rMM7wslteA6BCVy0/jZmaGnRZ1ZoiAXXrV5goHmV++Iskx40/wh7wIDAQAB
-AoGAX5eRPPXuspdMTOO8JT0mS/83AFNztVY+pR98fOdkaZULCJ4b12ZmGWYY4mh3
-VmRZOeuXh/BySkNUcTdmEQku9/1Nnm1Oo8bOEkQ9eVW9qTEP/BmSVRbzk41hm94N
-KlhfWofC1JNpLTdUOY9x+9PjUN7M5efsG7SEgqiDxuH5FoECQQD55/AN11YKfqhC
-9pGzDbG97NerXVrTwltFWMAfBsRTNto5PC/Ni2xGjLTIXNo/ZCvo5AelBuuw2cNp
-TNUh6p2XAkEA4adLKhVgIV/I29KclidUy+Rx0SeEJf0wh3YDXTjNEHtCx7HGLGXJ
-yE2csNoj4OfNxcVN9c1TzAZeHquJJMhZaQJAGw4AEA+K8hHqN22oMmE+J9iXNKcj
-qR82cFh+XB2IbZXXpDCe4DrC2xRqkfJzcj9u/YSKS1Rnebrpi+HUhRp4OwJACJLM
-nkq1nk7/WKrF3EaeSCjj0iiIMtFN2Le5JP+VevzT6rZsax9q7TtVqrp/BnqILO10
-KtSkTGophUzLJySdkQJABowPjs9tT6uaAf6+JQKdpAqE/J7xfcjVIoUbXrEvdb4u
-yTr5X6vBC5L4hO7D5uZ/oASHokk0NldI09bU1MDUwA==
+MIICWwIBAAKBgQDVBCb/zCK6rPCw1M9nPBc8vzTv9QMlMbkC5tNYzYcL/9r4AC8H
+oIsPrs/mbGwPdzGDfTRVz7XsYHfm75Ir6W4RGkh8y0mHQR9FidE6OtlhsuhZjUez
+7DdIusFZpwpusmhbwl2PkFF5+w5xRN/pmI+AH3EDLeL4e8rGEDjUlYEHBQIDAQAB
+AoGACrYgPemmb2ul2MaCvWa0pm3Y/B3+b/7dlktEImmHWm+ds63Sr5f/liTMuIII
+Nwjf2QRRPuVoeP/q15aBa6rbyXHbDjTkKrqFhOTdoEIuwJUK+XFXjY6nuNGlDgbJ
+MGt0zFvnc0HX8w7IF+UswicZwP+B7X2vvCkviASAJEEEl8ECQQD2t3vx35ssXZry
+SDizl4REmAElp6nIay1IKi7PxidiwZdjA9I25KIYxHvq9BRGBFzT2Jo9JYpZXgrh
+q7DFJukhAkEA3QgLsKQEztzSm2D9gPbXvLqnYep3a/sRW/60J9g/BtjFBFx8HNsy
+oxVGx5iId6TN0zu8XJVbuuYhwg51y2RtZQJAJPLvzhaV77wJE5X7X/ImLfux2EjW
+5ZwfiPpATn+3sFOb74lH906gdCMhB9wMGTxYBqYe219+68loycljzPL54QJARPFv
+hAeFIGksoB6etA1KuamW8CnMWjgT8BgAZbVD44TV30hhxjZxEwFd9IAVgQw8zziA
+xngoBqIlwXv1Lh4DKQJAd9TcaAxoTOwxcjFwo6bQzAMPk3DVxcBK94M/s54Bd9iu
+Do79WbyY1PwkfGbqm0ZU6hQ/ebQ8VpN0aps/plbKCw==
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/expired2.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/expired2.example.net/key3.db
index c95846e29..0d1e29940 100644
Binary files a/test/aux-fixed/exim-ca/example.net/expired2.example.net/key3.db and b/test/aux-fixed/exim-ca/example.net/expired2.example.net/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/ca_chain.pem
index d2b533cba..860ab0a8f 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.net/CN=clica Signing Cert
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.net/CN=clica CA
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOY7eAp9lkZsBxaHMAn5
-1zK898gr+Yxq+Vxgi6sXXmhsq20D/qHjVsKakEQtQLdBc3di6kRPURWiHrVqwQ+t
-RIpR1pQXqoaPmVf11aCvS3pEUaBreO+LQ3CJImrS887XIrGPDuuYuTaKrChtcMPN
-idZRKhwJAajAVJvivdDv6ucHAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABVCocYnR8xCX0k6HVaW
-RX+SAucii+m4sX6TJ/yWjNvQjKxrs3gwe19yOJB0WCOQKqU2s7UhxovW39qD4q60
-dSKq+qjW/4DfLmi1d/5aMqAq9au/s7W9Ut/jqqdL5eY31lxWRyW+D+29mfRyl+B7
-H0+wMSKs4DNtTYYEd+3W8kEw
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALW2VpRYVYpYPshnP4+7
+qUT15Ny+e8NsdobVwjRyVBqr0LHSWS5ubY4jBQ5iUGE2G/ixtUxMcGfGSNhuGFYQ
+FKvuh4F6AvlhFpqd6WFt9cb+AsWl4izqweNqo+uWcCJcqprYj/Jw13PkVK3pK1ua
+Dw/dqStmank6CTL03/GgUuyxAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAHW7exapgmmDg8dEcyLS
+QadT0QZVQkDxLEo4HcOX6SwLKJ9uNwdUCI7MWP0D/EV+2q0wNgG+YZtzyhgI/mdU
+CR8lFrFCTT0JqBWHtCZelw9+eGY2/o3ahSWJBvaZliF/53HnL4L4EtYmlCV+5Uuw
++IUzziMDFxJiuC4JNJkapdKX
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/cert8.db
index 913abc037..edf55a6d2 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/cert8.db and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/key3.db
index c08ab8ace..4a77acd45 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/key3.db and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.chain.pem
index 44e3dc967..66706013e 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked1.example.net
-    localKeyID: 84 0F 0F B3 85 1F FA C1 B7 69 02 5E B6 E3 7B B6 7B 1D A0 D5 
+    localKeyID: 2A AC E8 62 3E FD 18 F7 B0 8B 34 15 B9 75 FB 67 95 D7 09 CE 
 subject=/CN=revoked1.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZjANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQ0MVoXDTM4MDEwMTEyMzQ0MVowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
-ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPH2t5GSlQuiRWAWr5ED
-FRRamWBxppW/9ExG2ToOkHQxN54oPSaNFF8fIAsOHLCl6K9FM906Ug9lpLbTZr4f
-napBPRIqhzyTHEEJyRqx7/RqU7GR91TvaygIY4XJAVKV65wNOyZ5cb+TUYSQdzrE
-PjgLwKsOWcUtFxvffjJtm4epAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQxOVoXDTM4MDEwMTEyMzQxOVowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
+ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM1WXW0S7RgmWV4aWaOU
+dgKR11AozRW4lPaV1RBuES6KFpf3UaAidXB4b4b+GCPSm/ipkIuKgndhZLF7I+sw
+fRtxCivf2Ma0DHJsY61ngf17zBP65nMmQAev360R6plasC84mjVZeYtPSpy/KUgY
+1Kfg2PRTMfPIPmBvaK1Rx+Q9AgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm5ldC8wHwYDVR0R
-BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEAjVTu
-rsWM8RmPpTvywmQ92GFqyVU4DgIrg69viG6fnmvTvzwWg9qFnlgYVf6kUAQoboYr
-x63D2zplKK6JwmSdlSFSPGommOWUugDWX2XUrwF2TKw19rjHbTD7KkJQ47ZM+wau
-pxD7wIpRtIBn5YQZE9S+kSZHjGoPAY0Ms6Q6qBY=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm5ldC8wHwYDVR0R
+BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEAB6xH
+EtocDYao+0eNrhKVnr5KZ0U2Ll8GF+xUoZrkDwXs1o5Juue/+1B4CPcK2UlqH1F2
+UDH40fPCKzdZeKfkpvU3+iqrht1ThJf6AOERqoqFCfxmb/Zvu4YgACkCZezlyCfK
+IbLb7ZU0lAT7wu4/T3bxKp7NdU6QDEoQq5/NgUA=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.key b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.key
index 492175e18..5412c8a40 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked1.example.net
-    localKeyID: 84 0F 0F B3 85 1F FA C1 B7 69 02 5E B6 E3 7B B6 7B 1D A0 D5 
+    localKeyID: 2A AC E8 62 3E FD 18 F7 B0 8B 34 15 B9 75 FB 67 95 D7 09 CE 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQInBBhbOCuw44CAggA
-MBQGCCqGSIb3DQMHBAjV6peXVTL56ASCAoA0qB+hv7EJyxnqt7+Phe4noZjL8+yW
-0/q/Sm3Kgs82jX1cl2M/Qvif8X6MboXYakZES9QB8HjqH2B+VKA7ihAYr+4iPHhE
-EYjkydD0Us6pjx0JytvgOTAsHynpqIbBCc+iqgNTpKwEfU7NIYLQFJHQzhllqlp0
-I4V7O9lDdHxVmRYL21U7Kfn/tljjWLkL8nB2ez7B0m1pjwfCUm29KKjsd7D6yslY
-esrnQqF4P03YAS9Sce+n5CsNQs5cIwvvAd98s8g9jliJQtBNGKIEAqNxe5/BET4b
-raKr4xVhRw0XirMUjeIlgtlW7L20TuBaDuI3ufyUFAEjwLJ3BM99eRETIzjjd+64
-dHxvwIwKff0a+Kqsg+Qk1gwoNysTZbaWqrcjiNKQh5Cel9kwzAWtqsFZ27LPuR03
-ybme8/k/hmw3GXNDs1/rNS/+EXdpB3vmWucWxP7cHr5p3Z5MRIgkPo7IzGQVmPBQ
-ca/tPfs2YFHPX+WevtPRdhtjlGCSsGMtLfKz1IrszSWFB+e794ZhD8uYvIpj/j2F
-cpS+0Dyae6UyttC0PUTYj0tGq6bfPzMSefAxWzClB7e6bIcX+wN1+CXr60OgwYGa
-xPP8/jUEYOhYI5G+amjzEko55QS2waaG6so/mZbeeJcOityAb9F0W08rkcr7Mg1n
-mb58ukHBFYAFqRGLi85XHi3dYM9aR5Y66IOgH21tqRnW/lLUDg4E4PYYtnKMmDz2
-ytFjA/tkhHeMCq8s7VcqsTDZvswbN3nN9zb/aH+f7763VXcmnRUmHfP3wxtxBi7g
-xb0UBKWIGs3WnlshHQrB4IgMqux+dzCPqM3psfzNXFDJNTL5QqpgkYpC
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIT4DkRKP6XOoCAggA
+MBQGCCqGSIb3DQMHBAhTQIh3a3KSlQSCAoBB/GpPS7kNKT+442dnPS4BXbT3hxg2
+9/tZPRWHKIYh4aCzu+QQbjJ73jLBmrjlwTHyaTJYuOTHxMW5rnji8U+2hX3pSBgi
+3cBmcH8pfsx8IC0Y2JyM65tJItCs8Uh3Zp6TKBddc5bDVbKrC2wS8xvm9QILJT33
+Cvm6oC/3HvxmnSHrpm8Mt/WhwvYY1SlSueGrQ5iqFnqtnOmMicKQiieWpw2b5++v
+OVmHsSbuh6gfTPCVovM/Q0wsGzHRrYbyHVoUJFTBGDlLrSru0pOHyDpQHfTTfGF/
+EFClCgcWtu3pcXpyjCdsvzuawxQVFyTKTojxNy0TLNcx+4U8kma+1kFPn2+umFlp
+VN2tYfOVDOBHDft8kthaQfPhE9yQo+CGBE0fqpxCteXqoObFpQnn+fR4L2CUPvgg
++WZcLm3ig6WNhSjx1kQrp6OEALi0oCLZGKmOs1FyiKv07AyrsuSaBw1k4cHWgn1f
+LWvF1ndpgRCh+WFGrjYkkKI3KU+4EFRCqUIPFruALtUSymuThbvyJY1lut5MilmO
+t3WGkvfIEQhrSN58lT7eJcNn0m4GTznRITc7pJ6N8jNnSKFRzTUJ/auWncDvdNYh
+jEP/uEn9aOMjS0hHGYzl0YPsC9ryo1XGEi9kh0TSI/UVP06GgAXKYl6awe66l8pJ
+61dLP2O/Pim3FeRcGVBPA6uBdPVx2gr048FgcrOSX+KTLA+bnEJhMGNuUf85pKvD
+jUlYG38fypfjQk8eQfJiuMpcipT0aQBxHeRvdsygGqxkzjOFbYLVmvDhw5xR0Aml
+K3tZHz2mD43xCfn1d2H9fuHj45Xabk+aDY4p2gP/qsz2SiiHXb6Ytz7x
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.dated.resp
index 71b8b41e2..4844d37d9 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.good.resp
index 145f23513..70f99d3d9 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.req
index 58592da75..08548f8a0 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.req and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.revoked.resp
index ae1bbcd46..04d35a0f0 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.dated.resp
new file mode 100644
index 000000000..71d8c8068
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.good.resp
new file mode 100644
index 000000000..eb68e1ddd
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..d9f99da6f
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..4d5a45b02
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..64c992689
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..3021513b4
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.p12 b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.p12
index e8f5b013c..c31ebfa59 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.p12 and b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.pem b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.pem
index d28e82620..aab5b2fab 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked1.example.net
-    localKeyID: 84 0F 0F B3 85 1F FA C1 B7 69 02 5E B6 E3 7B B6 7B 1D A0 D5 
+    localKeyID: 2A AC E8 62 3E FD 18 F7 B0 8B 34 15 B9 75 FB 67 95 D7 09 CE 
 subject=/CN=revoked1.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZjANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQ0MVoXDTM4MDEwMTEyMzQ0MVowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
-ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPH2t5GSlQuiRWAWr5ED
-FRRamWBxppW/9ExG2ToOkHQxN54oPSaNFF8fIAsOHLCl6K9FM906Ug9lpLbTZr4f
-napBPRIqhzyTHEEJyRqx7/RqU7GR91TvaygIY4XJAVKV65wNOyZ5cb+TUYSQdzrE
-PjgLwKsOWcUtFxvffjJtm4epAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQxOVoXDTM4MDEwMTEyMzQxOVowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
+ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM1WXW0S7RgmWV4aWaOU
+dgKR11AozRW4lPaV1RBuES6KFpf3UaAidXB4b4b+GCPSm/ipkIuKgndhZLF7I+sw
+fRtxCivf2Ma0DHJsY61ngf17zBP65nMmQAev360R6plasC84mjVZeYtPSpy/KUgY
+1Kfg2PRTMfPIPmBvaK1Rx+Q9AgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm5ldC8wHwYDVR0R
-BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEAjVTu
-rsWM8RmPpTvywmQ92GFqyVU4DgIrg69viG6fnmvTvzwWg9qFnlgYVf6kUAQoboYr
-x63D2zplKK6JwmSdlSFSPGommOWUugDWX2XUrwF2TKw19rjHbTD7KkJQ47ZM+wau
-pxD7wIpRtIBn5YQZE9S+kSZHjGoPAY0Ms6Q6qBY=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm5ldC8wHwYDVR0R
+BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5uZXQwDQYJKoZIhvcNAQELBQADgYEAB6xH
+EtocDYao+0eNrhKVnr5KZ0U2Ll8GF+xUoZrkDwXs1o5Juue/+1B4CPcK2UlqH1F2
+UDH40fPCKzdZeKfkpvU3+iqrht1ThJf6AOERqoqFCfxmb/Zvu4YgACkCZezlyCfK
+IbLb7ZU0lAT7wu4/T3bxKp7NdU6QDEoQq5/NgUA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.unlocked.key
index c8881933c..e74439b32 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/revoked1.example.net/revoked1.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDx9reRkpULokVgFq+RAxUUWplgcaaVv/RMRtk6DpB0MTeeKD0m
-jRRfHyALDhywpeivRTPdOlIPZaS202a+H52qQT0SKoc8kxxBCckase/0alOxkfdU
-72soCGOFyQFSleucDTsmeXG/k1GEkHc6xD44C8CrDlnFLRcb334ybZuHqQIDAQAB
-AoGBANSydkenPRHPAYEoMAkfVoZf5ffbr/5vkMcEeKwKZX1eTm/fG3IqDkBX0gkl
-zJ6UGWkJQkA0pjIWvaZhSy3SCPsNYO/hWAWD1JgHXA3ROzHdEJG6yp9+mjvO5A4X
-NUZBsXgxX6zg053TavwLSQel1q+6T0SSDCSyPS4OJKH/+rgpAkEA/S/5JaOIMeiS
-KbprMWcKtdXQ6AeQgTUScLLOlQ2nSzNuFJwItRKTpXedl0hR42v4XeckR/yM4ZzV
-a/RXyW1S6wJBAPSm01B8VQKfTPRkKKhWNKstBFlu9jP90RV5N/vd2mGxx/wx4Xti
-/YGCxelHbPwYVhar6aZN51jhW7Q3sJ6GYrsCQQDDUsIzzlAgqJoyBPXzO9ogY55x
-knxhoY7jUJ5ckRbxxfBzh9iT0IwFCB2Uex9pgn8t+kacHnKVDwf665rZ8zQXAkEA
-veoKu73oV+LFYCmoDhTtSbvmVm52nKF5fwvcU55CefgB4FnwSVHsrG6Rp6cUiRVz
-LqJA/CIZZrt57ooUhtqXJQJAXUkGmSME4RYuBthX2nld+0ZUXjMLhMwe0vIZtsYT
-flHXDKBAJMkyvDdgbpZm9sq5awM9/rSVY0Q0DzH+8l9Pvg==
+MIICXQIBAAKBgQDNVl1tEu0YJlleGlmjlHYCkddQKM0VuJT2ldUQbhEuihaX91Gg
+InVweG+G/hgj0pv4qZCLioJ3YWSxeyPrMH0bcQor39jGtAxybGOtZ4H9e8wT+uZz
+JkAHr9+tEeqZWrAvOJo1WXmLT0qcvylIGNSn4Nj0UzHzyD5gb2itUcfkPQIDAQAB
+AoGAUMaZyA+671Yer9Mj0iLT7Zzbm7ABRXswNnSotWbnIWy3CJ8FID6N/mmSTgNl
+EaqHKuHhd9NMEZRhnSP49EtF2zIja4GyMHegemv5N8qsiYP98S+vH4hk4/sKIqHB
+BhLOFf/rd8kyXdJxkzTh+9/Cw8AxdYl0BNApuM15zmYa3o0CQQDvqdpJ8M3Jq4eV
+tABvH2UjS0zcH2Xg2u4Yxvr2wuIsMhScqIeww/DvnpdaWWpBEUA2ZtmttNZebpIi
+H+gfjZdrAkEA21WEwzgDx9LNOTaVjASeHp4jcPQU0AVDiMvh0eBuaGlXuhsq/wcO
+kvSU3/CEpWIT9UO+m6mjL4nUuXkmRU9k9wJBAK22AUCCx8YbDAVYGNBygw4X8DfE
+kkVuqhFPeGwPSXwbOJFsHh3jh+lGnBGiqb9Lz60e0zxyzMZZgpY1Zjwols0CQCDN
+959jH12hr8Qg39kjT6rwqAha2UoLn4A0TkAfuyOurcpOCe4+1fUw05ty08QQmT+T
+tEx/4MJZcRGUhx7Ssx0CQQCF5X9X5kNNLVTEjmnGSJHobuLUYXRH74olKGAxfQm9
+YuKwgEJAGEAuAG9+QYMJsBPsqm18w6bd0FIhrqNzW+0+
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/ca_chain.pem
index d2b533cba..860ab0a8f 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.net/CN=clica Signing Cert
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.net/CN=clica CA
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOY7eAp9lkZsBxaHMAn5
-1zK898gr+Yxq+Vxgi6sXXmhsq20D/qHjVsKakEQtQLdBc3di6kRPURWiHrVqwQ+t
-RIpR1pQXqoaPmVf11aCvS3pEUaBreO+LQ3CJImrS887XIrGPDuuYuTaKrChtcMPN
-idZRKhwJAajAVJvivdDv6ucHAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABVCocYnR8xCX0k6HVaW
-RX+SAucii+m4sX6TJ/yWjNvQjKxrs3gwe19yOJB0WCOQKqU2s7UhxovW39qD4q60
-dSKq+qjW/4DfLmi1d/5aMqAq9au/s7W9Ut/jqqdL5eY31lxWRyW+D+29mfRyl+B7
-H0+wMSKs4DNtTYYEd+3W8kEw
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALW2VpRYVYpYPshnP4+7
+qUT15Ny+e8NsdobVwjRyVBqr0LHSWS5ubY4jBQ5iUGE2G/ixtUxMcGfGSNhuGFYQ
+FKvuh4F6AvlhFpqd6WFt9cb+AsWl4izqweNqo+uWcCJcqprYj/Jw13PkVK3pK1ua
+Dw/dqStmank6CTL03/GgUuyxAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAHW7exapgmmDg8dEcyLS
+QadT0QZVQkDxLEo4HcOX6SwLKJ9uNwdUCI7MWP0D/EV+2q0wNgG+YZtzyhgI/mdU
+CR8lFrFCTT0JqBWHtCZelw9+eGY2/o3ahSWJBvaZliF/53HnL4L4EtYmlCV+5Uuw
++IUzziMDFxJiuC4JNJkapdKX
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/cert8.db
index 1412c7fc8..075b72fe9 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/cert8.db and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/key3.db
index 0cf4b79b1..84ed95130 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/key3.db and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.chain.pem
index 035e33ced..05f67932d 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked2.example.net
-    localKeyID: FE 0B 1F 98 D3 E3 36 0D 3A 1B 60 F6 BF EA 95 48 9A A5 A9 F2 
+    localKeyID: F8 C0 F0 9F B1 B0 60 D3 BE 6C 2B 2E F9 EB 57 9F C3 63 FB 20 
 subject=/CN=revoked2.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMowDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDFaFw0zODAxMDExMjM0NDFaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
-bGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDvSjA1Zo+EffOhSjyb
-7oyvoCD6rf0Qql8A35hH3wOQI7EfH084ZG8+otxUDKi/HeCnIpOFT7/wsh8VGCr4
-Zz0mCYhr6S/bvcloLBxtHeZKXiOdhxJ3YM795z8OaJLNzVxd/njcClo+4wdHSpqd
-IIjoWE4xB065onTeuORon2Xg5QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MjFaFw0zODAxMDExMjM0MjFaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
+bGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDnDs91kOgdASz36BY9
+VC9wr7fB/tc1Gh2HoJqofTKR+0bD1Bi2MiA+LtRxitsaoNOS0UIxebeqaZ570H/G
+MN01QVwsxSrqxGPESUrLybk0qUxnd7MkRnq1CKjldCG7ufH3ACFjlOGUEbbCIKeY
+bTyBbFjrsCRdzoyeSII4y6HxJQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5uZXQvMB8GA1Ud
-EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAGEf
-go4f68ipm2R/BSA5o+nLp1AP/wRiehG/TgywofRT4Ut16fPn6ppTWL8XteG6uV44
-JZa7p5YV8WAl0dbWndTXNVW85RIBE9Od93azVqg1fQELTuoXamgo+F81L+bCQvZk
-gkPJ+vDlYKdFDu4RFupRbPHD5weUoQFwrgWkmzC2
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB8GA1Ud
+EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAGXt
+Sqxp2tsIOszNEdaj8QGunGxXWfX5J8z/XjPhJz0uLTTau7FU12Kxs/UrKq1Y5Gdr
+6VjY0aRj4MylBx7QGMtHAHcHHs90Fb9sA4lCDfrFoP4tkLFOhyJRIj525SLN8nHW
+u0dr1LlV0T9SNfsFDkyNhlb8/5TxM2ujGcQVvWlU
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.key b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.key
index bd60d9975..0b8c68eaa 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked2.example.net
-    localKeyID: FE 0B 1F 98 D3 E3 36 0D 3A 1B 60 F6 BF EA 95 48 9A A5 A9 F2 
+    localKeyID: F8 C0 F0 9F B1 B0 60 D3 BE 6C 2B 2E F9 EB 57 9F C3 63 FB 20 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI2nx+Ck+hzRcCAggA
-MBQGCCqGSIb3DQMHBAib90v/PI3I3ASCAoAvxfAub/d3g2KatqhPvllYO4Wc06Ao
-IEya93YOz0Ku2winZE6acAypUSspBRZdAeUd2i/K+9TUmPU4EXsIk6gI5MUmQ00g
-cb8lcriKhM/eqKWVu/NlwWzNVGr34fd9LTMFNZCLpcFBtMIQHkqWB9Z9Ua0pb122
-OCHEkFDi0Cb1Mcg3yXSN6mNXBTpoUUHwzzOx5TwhT4FanN5ceAiDrRDrRbHJr9WY
-w8kXAR509NnWba7LDWA2dS7POof5BlqtCUuBarApoIOmDcgJh0n7CAkNgESycfQ3
-khaw5MccDaQXMMvzA7Os3mkap1WHhKrepp2KxWITN2ahAAvVxg5FIbjlP7CA4LKw
-H9KOJ6euVpe4yoiM7bkGpbyvKU7TWCirr9VyENgS5nO2Bt9IwPsNJnZEwn76sdl+
-Qq06pUm/CKMeXiP7QWKPfxy9bcwYf8hQ0PLcC45wiJhrflKdc6GTJigCC+UGmfEz
-HYnjjBTj5ZJSLYAfTGABvHgXSir9+2arIly81lm3RYDSe3d5CErOIBr4MXMAVWeG
-O1M3V0swMLhqPrhkrZ8ICtI7T5JrIbQ7YsjwKZIHtdR6ejrwF62tsD7qHmgcvmi8
-mNmx8NHHh9tS7dz42fNyoh8YrK+/OIhEN7TbI8FRvtZhAUyBYJjewLVj9hac4x13
-upIW2itPEdDPaO4aFhgvMhGEG1avUdmKAKM2gosGk2E5PYxOiQ87T5BDfkNlHgyA
-yW+GoVQtt24K3wrKM8udlwe75474A8sa/IlAqGsjKxqqIsjbGQ65daGymhVW4h4v
-id/la+9bBz+C6B9CDhW2RD0hHSOBM2H5GvzMtx5meJy8Wcj/Rk1yXSqC
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIimhRhAhkNdwCAggA
+MBQGCCqGSIb3DQMHBAhaasJDQXVyJQSCAoDVjygVy8c0w0QsbPCvYDbiyrkPOqES
+r8ubXlcI5B4GSsoi4Ho9xdOiYQOyi3fCGpj/xa8uwvyDNCUNt0ndc9lO7m2joUpx
+rRvbjsFWDdWXUaKRnCKfYd6P3NxAs/bu0x0VzySI/d3goG55q8EdM9O69VYcuwSK
+uD2bHdd044TDCUvIhtd/j6BwiSvXbReDSrRAi2YaKTBTkg/hJmNltkyh2POlaHt1
+MXijtn4V1STsp+3Z3Vi4g3W9CG2e772McVtrtcwVPkN9iigpFNJymA2hBOS1xKzU
++XTMNwPrdx/wN5jzkV6e9d91kXwTBgzc1cI7sARi8dn5q0cNUyt9dA116ujXbE1b
+kSFwhCYVgYW/XxxbjicnQQ+3rH/SPlGGrccvqEyYfTYggK9cQoKVYZrkKbbjhb9z
+25xegLYHH6m00sYw/9dLxK+AhhHcUpJaJ+so6jJVmPHJRJq8Uwom8DElZEuwYEYF
+g+2juJ6bc5nbZVn4Sud/yUzl9TEkgLJXWCPw6BClDID6IoQGct8hI4/LizvK/cJp
+YQZ+iVl8wyPigDR1+1RPdbRiCLqZRpONXa1OVmQNlOVbNYJhJ8kOtNBLnOrYi/hN
+WDcgY6FmSDIaSrk168y079bibguONh7XYtJ8JbY2tJGXJfnlwqF6xkJvtWUhRpqE
+VzEk+5/WcuxxXRERunYAzZ00VFZi/g5+LfL9GeJWpU8VYlh/OExYXDmq/BRnMxlh
+8NIR4b5zZQ4lfUazMRZOvKXTPhjwf2YWly9IYuFzQdOvRY4JZpP5hGH1YzU66tVw
+w7na64Uiq9jvWvqJsgaXd89z0AJ/FrhQ5YIHulvuinFiJEI0g1GvAWAX
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.dated.resp
index 51c6ee725..038917466 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.good.resp
index bcb8792ea..11befcce6 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.req
index 718302de7..a0543ac74 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.req and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.revoked.resp
index bcb8792ea..11befcce6 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.dated.resp
new file mode 100644
index 000000000..a50ed008f
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.good.resp
new file mode 100644
index 000000000..f0f53d4cc
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..f0f53d4cc
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..671a58cdf
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..01ee3fbc0
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..01ee3fbc0
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.p12 b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.p12
index 14620a77f..145e55e24 100644
Binary files a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.p12 and b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.pem b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.pem
index a59857812..664b4c415 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked2.example.net
-    localKeyID: FE 0B 1F 98 D3 E3 36 0D 3A 1B 60 F6 BF EA 95 48 9A A5 A9 F2 
+    localKeyID: F8 C0 F0 9F B1 B0 60 D3 BE 6C 2B 2E F9 EB 57 9F C3 63 FB 20 
 subject=/CN=revoked2.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMowDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDFaFw0zODAxMDExMjM0NDFaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
-bGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDvSjA1Zo+EffOhSjyb
-7oyvoCD6rf0Qql8A35hH3wOQI7EfH084ZG8+otxUDKi/HeCnIpOFT7/wsh8VGCr4
-Zz0mCYhr6S/bvcloLBxtHeZKXiOdhxJ3YM795z8OaJLNzVxd/njcClo+4wdHSpqd
-IIjoWE4xB065onTeuORon2Xg5QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MjFaFw0zODAxMDExMjM0MjFaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
+bGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDnDs91kOgdASz36BY9
+VC9wr7fB/tc1Gh2HoJqofTKR+0bD1Bi2MiA+LtRxitsaoNOS0UIxebeqaZ570H/G
+MN01QVwsxSrqxGPESUrLybk0qUxnd7MkRnq1CKjldCG7ufH3ACFjlOGUEbbCIKeY
+bTyBbFjrsCRdzoyeSII4y6HxJQIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5uZXQvMB8GA1Ud
-EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAGEf
-go4f68ipm2R/BSA5o+nLp1AP/wRiehG/TgywofRT4Ut16fPn6ppTWL8XteG6uV44
-JZa7p5YV8WAl0dbWndTXNVW85RIBE9Od93azVqg1fQELTuoXamgo+F81L+bCQvZk
-gkPJ+vDlYKdFDu4RFupRbPHD5weUoQFwrgWkmzC2
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMB8GA1Ud
+EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAGXt
+Sqxp2tsIOszNEdaj8QGunGxXWfX5J8z/XjPhJz0uLTTau7FU12Kxs/UrKq1Y5Gdr
+6VjY0aRj4MylBx7QGMtHAHcHHs90Fb9sA4lCDfrFoP4tkLFOhyJRIj525SLN8nHW
+u0dr1LlV0T9SNfsFDkyNhlb8/5TxM2ujGcQVvWlU
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.unlocked.key
index 4aedb5a9c..909e31bbc 100644
--- a/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/revoked2.example.net/revoked2.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDvSjA1Zo+EffOhSjyb7oyvoCD6rf0Qql8A35hH3wOQI7EfH084
-ZG8+otxUDKi/HeCnIpOFT7/wsh8VGCr4Zz0mCYhr6S/bvcloLBxtHeZKXiOdhxJ3
-YM795z8OaJLNzVxd/njcClo+4wdHSpqdIIjoWE4xB065onTeuORon2Xg5QIDAQAB
-AoGBAONns8zr/PRC5mefr13ZJKY7HVxeQSO3ZbXkyEl1LWOsJ8WV8al7+SSjjZPq
-u+t0r2zmtR96HMTX4iYf46ZSJo7LDcJsPeYMBorrbmLUrKvNPhku/x0r0mxmPPZx
-YnkB2Qt0h+XttTm6YOeNmeYEP3LAGgNA6nkrYF/Ct08VRKyBAkEA+FpDsquwxjKi
-bS7fvQcIyS/afgRpCBu1pAxbOPuN1TLN2AqhUhF22s2EYc8UcbNwMTC00gtb6hdC
-xNnzzivsEQJBAPaoe5yXUAa4hcwbyMS212VQVUbS5j4AUTqA0XYSNHNuX3xIH+ny
-6RjpNyn+1zkAPMbW+IzWz86rk94tfEVky5UCQQDZakQLvWxjBl7VkIyEMg1J+1+e
-pIPCemeYtsyBZQ80jmZP9HZnnyxavkJfUecG5tyX45jYrOMJWtWz+U4Ltr3RAkAh
-UsXQdAjVv5wj5SUMnn8fKuk6dkew3K4cr0adIvx/E8xGqB/XpX+kY+2V+N3uz39m
-hahyrprImxmRDKgbX/C5AkEA1v2059LAiJeh7jtoQWNLwke8lWl+YNiKYwMdka8s
-/KV+99ihoonE4reSWHcOQve5CIB8q/P2mLuOyieLC0qBXw==
+MIICXQIBAAKBgQDnDs91kOgdASz36BY9VC9wr7fB/tc1Gh2HoJqofTKR+0bD1Bi2
+MiA+LtRxitsaoNOS0UIxebeqaZ570H/GMN01QVwsxSrqxGPESUrLybk0qUxnd7Mk
+Rnq1CKjldCG7ufH3ACFjlOGUEbbCIKeYbTyBbFjrsCRdzoyeSII4y6HxJQIDAQAB
+AoGAGLr6lHxGg7g4/m2+V6EXlMmR8vcaRKo/Z+FWPFtuGrbY26PrYzDZR56OiXqR
+ufdlvcyc95ut/1TfrCPkUSuwuUrsEGQ3ikTpJ6VvC/MSsTcR0+pTCanCjOqqT4ww
+/Z6aMqTJRh1fcCZqExmgrvg8ErK/NnxMUh0ow2pmJcBpVsECQQD3bTVrtEEiIcup
+hUs35rE1L3E7srlnHRL5Adt4yjwBjGWH9YU2ZPLZJlHJGBlrF8Z02M79cl9U0zuu
+awmLHU7FAkEA7xBnN5kPeit4LH4MMsOFfN7dYAsAcJfWY2bxzaEeLopY2MK1omdV
+aAAm7FynZNz2t5AgEtBqobELCuDtk1w+4QJBAL5tD6tH/MUPK5bZnq10YDhlvglL
+IURJ7Rs2IbrSMuKiMlY0UQUvJnSX+GQDpzR0BOpTHuOTDenT9N/lQ2AM+10CQQDM
+YYys5qlpvBIgj56kI65S5EIEo0M7/0OlddRSBWXFSjfNESGx93/3yvF773aY76Pp
+qUkSbKZNGAwlv8i8zAdhAkA69PWHkogtutdvmUoQSsmzsqIg561sD6n5243Afhq8
+5TMwYm9olx6gDrobNYOTf8rsrikSf3O3LpUA9e7tIBp4
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/server1.example.net/ca_chain.pem
index d2b533cba..860ab0a8f 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.net/CN=clica Signing Cert
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.net/CN=clica CA
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOY7eAp9lkZsBxaHMAn5
-1zK898gr+Yxq+Vxgi6sXXmhsq20D/qHjVsKakEQtQLdBc3di6kRPURWiHrVqwQ+t
-RIpR1pQXqoaPmVf11aCvS3pEUaBreO+LQ3CJImrS887XIrGPDuuYuTaKrChtcMPN
-idZRKhwJAajAVJvivdDv6ucHAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABVCocYnR8xCX0k6HVaW
-RX+SAucii+m4sX6TJ/yWjNvQjKxrs3gwe19yOJB0WCOQKqU2s7UhxovW39qD4q60
-dSKq+qjW/4DfLmi1d/5aMqAq9au/s7W9Ut/jqqdL5eY31lxWRyW+D+29mfRyl+B7
-H0+wMSKs4DNtTYYEd+3W8kEw
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALW2VpRYVYpYPshnP4+7
+qUT15Ny+e8NsdobVwjRyVBqr0LHSWS5ubY4jBQ5iUGE2G/ixtUxMcGfGSNhuGFYQ
+FKvuh4F6AvlhFpqd6WFt9cb+AsWl4izqweNqo+uWcCJcqprYj/Jw13PkVK3pK1ua
+Dw/dqStmank6CTL03/GgUuyxAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAHW7exapgmmDg8dEcyLS
+QadT0QZVQkDxLEo4HcOX6SwLKJ9uNwdUCI7MWP0D/EV+2q0wNgG+YZtzyhgI/mdU
+CR8lFrFCTT0JqBWHtCZelw9+eGY2/o3ahSWJBvaZliF/53HnL4L4EtYmlCV+5Uuw
++IUzziMDFxJiuC4JNJkapdKX
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/server1.example.net/cert8.db
index 4148c8d47..8ccfa25d4 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server1.example.net/cert8.db and b/test/aux-fixed/exim-ca/example.net/server1.example.net/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/fullchain.pem b/test/aux-fixed/exim-ca/example.net/server1.example.net/fullchain.pem
index 22b9f6955..2e9d047a2 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/fullchain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/fullchain.pem
@@ -1,25 +1,25 @@
 Bag Attributes
     friendlyName: server1.example.net
-    localKeyID: 0F 3A 98 3F 6C EA 09 B2 7B 0C 1F 02 79 4C EF 58 24 6D 16 95 
+    localKeyID: 44 AB D2 68 6E 76 EE 41 1E 4C AF 3D 69 E0 10 16 57 63 41 CD 
 subject=/CN=server1.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIIC2zCCAkSgAwIBAgIBZTANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQ0MFoXDTM4MDEwMTEyMzQ0MFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
-Lm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqqPsme1TMZTe3IZgxUO4
-4zwa2iRWX8cL6d/HthFf+YXmaa+5MImRT6sqnWdsmSQKQbd8SvoW2+xgbxqjDHX1
-bcprcYn7QjviIIY0B3ZvuMf5E+9Tt2jnJRoO3SFX5i0pNWrIggMeDBP9lG5/k3zr
-B7kb9RXQoVBB3jwd9Ya3s/kCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
+MzQxOFoXDTM4MDEwMTEyMzQxOFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
+Lm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1gVz0Nze9gQCYIRrlakZ
+kKeyPy5H6E5uJU3jiK2sQ2cb9nQLXdPX7HndhFixMSaKPB2RgYyxnruo+DZ1XSpm
+gTnofP5ImBmZ6RO+BcOyMAa576orEDOxdfFS8QYzk6xKM8j4A1TlxM/EEgqAQN2y
+DqClzQK1K6Cx52k7h11b1q0CAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5uZXQvMHAGA1Ud
-EQRpMGeCE3NlcnZlcjEuZXhhbXBsZS5uZXSCCSoudGVzdC5leIIiYWx0ZXJuYXRl
-bmFtZTIuc2VydmVyMS5leGFtcGxlLm5ldIIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIx
-LmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAI7UXdoBXL/J3vsxnfwD0V31
-aHIturNL8/Xy8IJEf3Vp0L1wI6KKZIv0pkEhT1VGBOoZLZSKscjmniglLsulOzMh
-ADhe6HDw0QoLzPY5ED2nbNUVu0baf+Ns8m3VCdp7NtWL+9q2/Cxsa6qH1gxKWhfQ
-7HRyQbf5f81gLhZlRnnK
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMHAGA1Ud
+EQRpMGeCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5uZXSCE3NlcnZl
+cjEuZXhhbXBsZS5uZXSCCSoudGVzdC5leIIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIx
+LmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAM/Q0DEhwFn9kuWKxvPaoLuj
+T1iiEv/g8iImZaydWuBSJ4FL8RS8sLtY7/j6Ohc9JnocLnvgKTcITaxjpWDIIzE1
+nPLzY/xGMbOGF7p/U5MAcBZzmkPxsj/etMm1gfYUcqPjJIfh7MGuWB1g4SFf8xox
+KH2Y1/8YLIYzqDIpv1FV
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Signing Cert
@@ -27,17 +27,17 @@ subject=/O=example.net/CN=clica Signing Cert
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -45,14 +45,14 @@ subject=/O=example.net/CN=clica CA
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOY7eAp9lkZsBxaHMAn5
-1zK898gr+Yxq+Vxgi6sXXmhsq20D/qHjVsKakEQtQLdBc3di6kRPURWiHrVqwQ+t
-RIpR1pQXqoaPmVf11aCvS3pEUaBreO+LQ3CJImrS887XIrGPDuuYuTaKrChtcMPN
-idZRKhwJAajAVJvivdDv6ucHAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABVCocYnR8xCX0k6HVaW
-RX+SAucii+m4sX6TJ/yWjNvQjKxrs3gwe19yOJB0WCOQKqU2s7UhxovW39qD4q60
-dSKq+qjW/4DfLmi1d/5aMqAq9au/s7W9Ut/jqqdL5eY31lxWRyW+D+29mfRyl+B7
-H0+wMSKs4DNtTYYEd+3W8kEw
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALW2VpRYVYpYPshnP4+7
+qUT15Ny+e8NsdobVwjRyVBqr0LHSWS5ubY4jBQ5iUGE2G/ixtUxMcGfGSNhuGFYQ
+FKvuh4F6AvlhFpqd6WFt9cb+AsWl4izqweNqo+uWcCJcqprYj/Jw13PkVK3pK1ua
+Dw/dqStmank6CTL03/GgUuyxAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAHW7exapgmmDg8dEcyLS
+QadT0QZVQkDxLEo4HcOX6SwLKJ9uNwdUCI7MWP0D/EV+2q0wNgG+YZtzyhgI/mdU
+CR8lFrFCTT0JqBWHtCZelw9+eGY2/o3ahSWJBvaZliF/53HnL4L4EtYmlCV+5Uuw
++IUzziMDFxJiuC4JNJkapdKX
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/server1.example.net/key3.db
index 50e328f89..93896e23b 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server1.example.net/key3.db and b/test/aux-fixed/exim-ca/example.net/server1.example.net/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
index 8069cac16..bcfafb139 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.chain.pem
@@ -1,37 +1,37 @@
 Bag Attributes
     friendlyName: server1.example.net
-    localKeyID: 0F 3A 98 3F 6C EA 09 B2 7B 0C 1F 02 79 4C EF 58 24 6D 16 95 
+    localKeyID: 44 AB D2 68 6E 76 EE 41 1E 4C AF 3D 69 E0 10 16 57 63 41 CD 
 subject=/CN=server1.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIIC2zCCAkSgAwIBAgIBZTANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQ0MFoXDTM4MDEwMTEyMzQ0MFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
-Lm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqqPsme1TMZTe3IZgxUO4
-4zwa2iRWX8cL6d/HthFf+YXmaa+5MImRT6sqnWdsmSQKQbd8SvoW2+xgbxqjDHX1
-bcprcYn7QjviIIY0B3ZvuMf5E+9Tt2jnJRoO3SFX5i0pNWrIggMeDBP9lG5/k3zr
-B7kb9RXQoVBB3jwd9Ya3s/kCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
+MzQxOFoXDTM4MDEwMTEyMzQxOFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
+Lm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1gVz0Nze9gQCYIRrlakZ
+kKeyPy5H6E5uJU3jiK2sQ2cb9nQLXdPX7HndhFixMSaKPB2RgYyxnruo+DZ1XSpm
+gTnofP5ImBmZ6RO+BcOyMAa576orEDOxdfFS8QYzk6xKM8j4A1TlxM/EEgqAQN2y
+DqClzQK1K6Cx52k7h11b1q0CAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5uZXQvMHAGA1Ud
-EQRpMGeCE3NlcnZlcjEuZXhhbXBsZS5uZXSCCSoudGVzdC5leIIiYWx0ZXJuYXRl
-bmFtZTIuc2VydmVyMS5leGFtcGxlLm5ldIIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIx
-LmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAI7UXdoBXL/J3vsxnfwD0V31
-aHIturNL8/Xy8IJEf3Vp0L1wI6KKZIv0pkEhT1VGBOoZLZSKscjmniglLsulOzMh
-ADhe6HDw0QoLzPY5ED2nbNUVu0baf+Ns8m3VCdp7NtWL+9q2/Cxsa6qH1gxKWhfQ
-7HRyQbf5f81gLhZlRnnK
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMHAGA1Ud
+EQRpMGeCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5uZXSCE3NlcnZl
+cjEuZXhhbXBsZS5uZXSCCSoudGVzdC5leIIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIx
+LmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAM/Q0DEhwFn9kuWKxvPaoLuj
+T1iiEv/g8iImZaydWuBSJ4FL8RS8sLtY7/j6Ohc9JnocLnvgKTcITaxjpWDIIzE1
+nPLzY/xGMbOGF7p/U5MAcBZzmkPxsj/etMm1gfYUcqPjJIfh7MGuWB1g4SFf8xox
+KH2Y1/8YLIYzqDIpv1FV
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.key b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.key
index 13d1950b7..9ee1df6ef 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: server1.example.net
-    localKeyID: 0F 3A 98 3F 6C EA 09 B2 7B 0C 1F 02 79 4C EF 58 24 6D 16 95 
+    localKeyID: 44 AB D2 68 6E 76 EE 41 1E 4C AF 3D 69 E0 10 16 57 63 41 CD 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIKthpSMz4bFMCAggA
-MBQGCCqGSIb3DQMHBAi/D50+VZ7OhwSCAoBMBjTIbaAT0eoRqHJsl599iG0RCiE9
-ZTwYbR6zg9r03dxY3ZG4V4TG1cXS1Z8czBYqmmegSmtwXnKgJcycE0JihfwE0WVN
-182NmWdVLWMwAiKhYchm9kiBWNb2+zs3d/jdU038/d9kOqff0+fMMChINHvZaJHL
-ceEbfjvmge2NNfu0bHh7shY09vqHr9ebunZq3/z5q+wx/GbZs91nD6UPx+Mexgxs
-I2WDTdj9fgzkSFlldTCGMiwXzDxmE1imP/qW8Dke3o5nEvIHCR/PCfI33irJ/MBB
-AOQpa/KaviJkfc16TonOHq8TF4qRLoan6ykP3zBNYxKtacDuYLgnRoUicHuT3Iqp
-g9vzoQ1/YrbFEVaPt1VzB8JYLhsRE9bfsM+MtKlQ1QCUPmWoRhwqxAtu8UX8adIA
-UfLkoHa9G4jm6p01/6YvT4kxu7CiMeBfmOMoGt1kYgCbF8gey8GLYKPFccDPZmW6
-JjD3DwAmKXxw80tl1lkJydMyfl/BWlBRmcU//k4l1VK0DYOm8OQ20P7UOpiarkUm
-Dfadmyp4Osx/Y8QjmiDY7vLg4won/Bn7J5vjwvcard+4GyATUCw6VHE9YzoWp1wa
-d+9Cl92s8k9Z8GcbEc7SgdBbM/rC/zXI4QlVZkEc7AWFKYa9ttTeQ05U28heliL4
-klFECxzMdrZHeWgg/EPNlUAZkW9ZyZsO5qeKMlQxZWXh/D+n0rcZ+caXxqoY+FCu
-LCAUu1yj+pUbpTCFHtycfdDWQfjr6F+1V3Zu6nAFBgwTqvl9Jd17L6ffSHi5CFSO
-V99DfRpSoBP/VE4zV0wqRHl4b8R/3Vamc8bwHuAVCKtRMUx+iiK7u2lp
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI62XXI1iHMRwCAggA
+MBQGCCqGSIb3DQMHBAgUfBqahNODUQSCAoAAns5L+WDU8Ax0WUYmdqBHVeOmhclz
+LaPCde8mum8ZZ7eAo4YxuPXMJUnxdBLdR0xGH+GFOwmk3B1jTRKuJapHrKlEBCgk
+jni46aFXqNRMZQJnaJiw9lx48DIiLi7QE8nGxVivVKGG0/nUbqtCpyA3tE9LJgmA
+VlawKPwdiUhE+spUMEruwNoqCTT7ZK+25AjrWYwTsGKatlFRur2iMnsXd8UwXKy3
+kXLf7FZtM6ZpTLNiwcGFzxLDLrMHd4YrUzTkrsGS3Nw3JbeLUZ6JRqU6W8AOS9Js
+/kryPO0SUIvCosmhKfdik5L3EGy4hffjEyidSk2VCzqzAVvwk9oIVC7tS8GOdxno
+uJ929KUbjWOMdaVgh+VUWKG0anViZhQmrtDAajKuWtYbr+jprydaN40kw4/sE3c4
+90X5vCr7fBuqy3ODYg45k+H2RdN3ATYFwr4AhRBIDr2oIS1SdSwj48T7RG2zqlYe
+XM9JLmmbr6mmX1QY2rMnBbZyriHLpHEx4UV9Codt5y2xJmLhyz8bzKxngKkHC3Ov
+vdTS6R5Lar4SguWUY8q0gwvvLGGjU3xpLFt1xya82ZzDoz182mByjNvVqAgxy6Zb
+VC8W/wvcsQt11NxH7XoEdumBu1THGQn7oVOv0iSlaaoQwjvBG2vsXxlrOG3syk2A
+H/b80kI2VZyxI/VGgLO5Qm6S5gpeq+ZcgMlaJ9sHI4Y+O5AqJzADpLRIdLgRaFnE
+BTlNGjrtxSXIUyvXsqR5CJ7Nrq1zBhqjVoGewRVR3aXPcQayrIWDAiIzeegGsCTP
+xJvWzk2IZGrsl2a4z7YmgTvZssZJzqSIePbeAE1PDc/er6oglPtAndKa
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.dated.resp
index c9c7a211b..4f879e278 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.good.resp
index 64d7a3b10..08ac6ea53 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.req
index da8d72b37..e1fc2a5f1 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.req and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.revoked.resp
index 508790c10..14fa19503 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.dated.resp
new file mode 100644
index 000000000..1c6284a38
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.good.resp
new file mode 100644
index 000000000..0c9f56117
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..4c8e4e478
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..d61082adb
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..de1c598ed
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..45a56c35c
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.p12 b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.p12
index a3b75fbca..c678f8d27 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.p12 and b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem
index c64cf1394..ad2de62e4 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem
@@ -1,23 +1,23 @@
 Bag Attributes
     friendlyName: server1.example.net
-    localKeyID: 0F 3A 98 3F 6C EA 09 B2 7B 0C 1F 02 79 4C EF 58 24 6D 16 95 
+    localKeyID: 44 AB D2 68 6E 76 EE 41 1E 4C AF 3D 69 E0 10 16 57 63 41 CD 
 subject=/CN=server1.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIIC2zCCAkSgAwIBAgIBZTANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm5ldDEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQ0MFoXDTM4MDEwMTEyMzQ0MFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
-Lm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqqPsme1TMZTe3IZgxUO4
-4zwa2iRWX8cL6d/HthFf+YXmaa+5MImRT6sqnWdsmSQKQbd8SvoW2+xgbxqjDHX1
-bcprcYn7QjviIIY0B3ZvuMf5E+9Tt2jnJRoO3SFX5i0pNWrIggMeDBP9lG5/k3zr
-B7kb9RXQoVBB3jwd9Ya3s/kCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
+MzQxOFoXDTM4MDEwMTEyMzQxOFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
+Lm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1gVz0Nze9gQCYIRrlakZ
+kKeyPy5H6E5uJU3jiK2sQ2cb9nQLXdPX7HndhFixMSaKPB2RgYyxnruo+DZ1XSpm
+gTnofP5ImBmZ6RO+BcOyMAa576orEDOxdfFS8QYzk6xKM8j4A1TlxM/EEgqAQN2y
+DqClzQK1K6Cx52k7h11b1q0CAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm5ldC9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5uZXQvMHAGA1Ud
-EQRpMGeCE3NlcnZlcjEuZXhhbXBsZS5uZXSCCSoudGVzdC5leIIiYWx0ZXJuYXRl
-bmFtZTIuc2VydmVyMS5leGFtcGxlLm5ldIIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIx
-LmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAI7UXdoBXL/J3vsxnfwD0V31
-aHIturNL8/Xy8IJEf3Vp0L1wI6KKZIv0pkEhT1VGBOoZLZSKscjmniglLsulOzMh
-ADhe6HDw0QoLzPY5ED2nbNUVu0baf+Ns8m3VCdp7NtWL+9q2/Cxsa6qH1gxKWhfQ
-7HRyQbf5f81gLhZlRnnK
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5uZXQvMHAGA1Ud
+EQRpMGeCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5uZXSCE3NlcnZl
+cjEuZXhhbXBsZS5uZXSCCSoudGVzdC5leIIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIx
+LmV4YW1wbGUubmV0MA0GCSqGSIb3DQEBCwUAA4GBAM/Q0DEhwFn9kuWKxvPaoLuj
+T1iiEv/g8iImZaydWuBSJ4FL8RS8sLtY7/j6Ohc9JnocLnvgKTcITaxjpWDIIzE1
+nPLzY/xGMbOGF7p/U5MAcBZzmkPxsj/etMm1gfYUcqPjJIfh7MGuWB1g4SFf8xox
+KH2Y1/8YLIYzqDIpv1FV
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
index c3f6fce63..de18f056d 100644
--- a/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQCqo+yZ7VMxlN7chmDFQ7jjPBraJFZfxwvp38e2EV/5heZpr7kw
-iZFPqyqdZ2yZJApBt3xK+hbb7GBvGqMMdfVtymtxiftCO+IghjQHdm+4x/kT71O3
-aOclGg7dIVfmLSk1asiCAx4ME/2Ubn+TfOsHuRv1FdChUEHePB31hrez+QIDAQAB
-AoGAL8qXcokAeut5+4N7SORtvN7RmnUA5/REhu0Q7xIwsh7paII5uLlexFRpLAqS
-ZNWuNbehDRK8Ij4yyAtKzSugX/ls6wVy+Vtf0sInU92EGdjwofIB1ajQgJ9zYw+A
-8Z2Rxa90TQoqkhgY99mH8sfjWzZdIFsfTaCRRvewRlfJDQECQQDV8W2QzxfZx4tE
-ZLKxULaElSYm1QM3siSyDB6plp/hUTWwQ0zfaz8sZbzESfabFd2SX6yVg0jQKUxG
-vQhPhNehAkEAzC9O7yUDbIim8T/7ZhmCMy1TzDU8I9fphQjcFEGEWpu+Yg3B3BXS
-Uh7hJ+r9v1bmUPZ18AJ3iNsq1W+uqWudWQJAHjgY2tB1tPw7jrCOkP8umLGcjvWd
-m7tc9Y1Cs3+kG6Zl5/zJmfFDHhlMvYkY/TTsdCVxcjj2CvkaXg+LYfgIoQJAN5my
-TuCvXACiJROdK6JKmBEBvpvIcqI6zqUo+MMWfW3nm9/PKFUw3nfWK/6Ldmz9bpKO
-bvrc/gFgWpp831mUkQJALrDFsFFr0xo+wkxBZgL0ijiIvHGLy4UaVU84QUqGU5pb
-NHOKni8utK8KSNY3j58ZCGxOcLBWSDnjZmKYdnfFiA==
+MIICXAIBAAKBgQDWBXPQ3N72BAJghGuVqRmQp7I/LkfoTm4lTeOIraxDZxv2dAtd
+09fsed2EWLExJoo8HZGBjLGeu6j4NnVdKmaBOeh8/kiYGZnpE74Fw7IwBrnvqisQ
+M7F18VLxBjOTrEozyPgDVOXEz8QSCoBA3bIOoKXNArUroLHnaTuHXVvWrQIDAQAB
+AoGAA4at+I43By8cOepcmmfhkbJNm8Bfs2pdYrR0j/sqiCbB/W6+hDJ6D32Xgndy
+nehwZRqom82NXJvjZgmBqAILk8Q8PrArj6azlHBIQpymmvtxTCogHNdSw4k8+q6Q
+dtyW9W4vYbrTXaYTEElLmVSYgxlVddWL6eTmqMTKGYjgkcECQQD8I9rEtydHgET0
+tSJvsGGrCeuGFpsL3KVhdSWKcaIxiuHs9umkAdU11K7ArWTCbqkeAowdZTvZiymZ
+oaSAA47tAkEA2Uw1idLroZ6Oo0jti1EFxFtKKRyWAgyu5PqPqqrI+7VqmfWfH+LQ
+2lCCjwW+1rjFJ3Y5uNuoOFmd3/3ctKiuwQJBALDFhmwiKFS1tiKGF5WMaH0coFZK
+5Prk/8Ga+u3cCyWGxCx5U4abjlqGONp29kxmfwS+LnOxdMtpCIpgTE8/r2UCQAj3
+K/5TxYUVla0HBUYKQcKoQZcQpt/OxiiMbgEMqt43zf4sNDSMlzFqwPhFtGoHlZrb
+NeZ6qaYpjGoBf2m0zAECQAbyKsFxNNHpWbzRS6HLVNanwLHBdJcy0cPRiownLJQ+
+zjuKEyPdvg74CEz4/gvF+h0XvRjbnKsvf05WVz14YwQ=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/ca_chain.pem b/test/aux-fixed/exim-ca/example.net/server2.example.net/ca_chain.pem
index d2b533cba..860ab0a8f 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.net/CN=clica Signing Cert
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.net/CN=clica CA
 issuer=/O=example.net/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOY7eAp9lkZsBxaHMAn5
-1zK898gr+Yxq+Vxgi6sXXmhsq20D/qHjVsKakEQtQLdBc3di6kRPURWiHrVqwQ+t
-RIpR1pQXqoaPmVf11aCvS3pEUaBreO+LQ3CJImrS887XIrGPDuuYuTaKrChtcMPN
-idZRKhwJAajAVJvivdDv6ucHAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABVCocYnR8xCX0k6HVaW
-RX+SAucii+m4sX6TJ/yWjNvQjKxrs3gwe19yOJB0WCOQKqU2s7UhxovW39qD4q60
-dSKq+qjW/4DfLmi1d/5aMqAq9au/s7W9Ut/jqqdL5eY31lxWRyW+D+29mfRyl+B7
-H0+wMSKs4DNtTYYEd+3W8kEw
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjApMRQwEgYDVQQKEwtleGFtcGxlLm5ldDERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALW2VpRYVYpYPshnP4+7
+qUT15Ny+e8NsdobVwjRyVBqr0LHSWS5ubY4jBQ5iUGE2G/ixtUxMcGfGSNhuGFYQ
+FKvuh4F6AvlhFpqd6WFt9cb+AsWl4izqweNqo+uWcCJcqprYj/Jw13PkVK3pK1ua
+Dw/dqStmank6CTL03/GgUuyxAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAHW7exapgmmDg8dEcyLS
+QadT0QZVQkDxLEo4HcOX6SwLKJ9uNwdUCI7MWP0D/EV+2q0wNgG+YZtzyhgI/mdU
+CR8lFrFCTT0JqBWHtCZelw9+eGY2/o3ahSWJBvaZliF/53HnL4L4EtYmlCV+5Uuw
++IUzziMDFxJiuC4JNJkapdKX
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/cert8.db b/test/aux-fixed/exim-ca/example.net/server2.example.net/cert8.db
index 67e2fbbc2..ee40f21f8 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server2.example.net/cert8.db and b/test/aux-fixed/exim-ca/example.net/server2.example.net/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/key3.db b/test/aux-fixed/exim-ca/example.net/server2.example.net/key3.db
index 097d15ab2..35f015fcc 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server2.example.net/key3.db and b/test/aux-fixed/exim-ca/example.net/server2.example.net/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.chain.pem b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.chain.pem
index b8db45e31..e2db0a183 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.chain.pem
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: server2.example.net
-    localKeyID: 9E DB 1F 81 35 7E 72 8A 0E E8 A7 29 2D C8 AA 4F 47 9E 4E FC 
+    localKeyID: E4 EA 63 F9 F4 03 5B BC 53 9A D8 69 D8 F9 CC E6 03 91 F4 56 
 subject=/CN=server2.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDFaFw0zODAxMDExMjM0NDFaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
-ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPmz1Pq2JS+nTg2NgpEt
-n1L6c6OLq1waIWdH1PrsaXwz0sjAp6l5xjLIHau+0Jbeg4CkkYNYLWFcFlrhzry5
-kTsoBhwhJKsanY3fe7t4iKIxCtiX1YqoxC/+4vEpszdHnT4Io3hE2d2gooBdR9jD
-oYJm9S6J2U/GX1jONCJ80TPzAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
+MjM0MjFaFw0zODAxMDExMjM0MjFaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
+ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANENFWh+HMxEjZsG21Fp
+OhPtsdBiudnR48Wu3NYD5lraEaVePlwTxPoMEmYqwIqtYe4+x8vlmLaWvKkTjJwT
+AgJV8NVWr9jH4XjyZm9/GK0CyQScibjE/fsCYQvBU/VKHO9pTc5sr7nsaOTZW7NH
+l1ocYnzIj9YXAu3Iw6AX7gLDAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm5ldC8wHgYDVR0R
-BBcwFYITc2VydmVyMi5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOBgQA8sLmL
-GONk/MlDKooo/jYBdtDxjq4DsG1m5xJMi5FXU1XejeW4MtzhjYLqELuXLW7xlilm
-Qebnov+JLBpJlEQEC3ffUo5tQYFkXI828/0kle4FR+6O2VYUFgPMOLE8DXTsh03h
-55xpE0xly3K8FRPmWllR0QELmmFT97IltC6zHg==
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm5ldC8wHgYDVR0R
+BBcwFYITc2VydmVyMi5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOBgQBKHs44
+5Sv7+GVj7XgmAsYDiOTfMcQ/bD4RRa2err0iku/SCYEATCxZLbo6iCLcwgtkf3YQ
+6AFj+d5w1qAmOgm9wfZKIRPoM5ndEOeR3VdffHEeXG4yo7/8DL+pbZjDTFl9dLSa
+kblJFdinSu4Gcy4E+bH0mC0E04ujCTqxiIg2fg==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDQwWhcNMzgw
-MTAxMTIzNDQwWjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXxUua
-JOUjKYqtSZyRwCoF1o5VI5yr+sinPkKPpGQnFd28bani9yCcLdvvOVCBPBmBe3vJ
-sjRSu5YO3fGlE7dRbiUBCvmOtZ4Kk39mgQcThWp8R8Mxk//ex5BSLlw3q43BY3Om
-+V59fPWaYgHKE/RIjneGJb97oa3AmxjvZcZXnQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm5ldDERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDE2WhcNMzgw
+MTAxMTIzNDE2WjAzMRQwEgYDVQQKEwtleGFtcGxlLm5ldDEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDpLbae
+/ej/j1aU4ttvOTzaxFzNsm+NIyuE/sEuyfYW3lf0Q3DUSEgm0Ck+XC+jPaYyNDjV
+7Fg826cy8/zGM+pvRUE8LsJbHt4k8xdOmLHcKMx0T7JhpMXHo2UZMxPTcZsAfByJ
+GrcUMOYYe8uCV1abgHzOZDSk+6KTLrP0Y2hbMwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-rPmUtgNXl5WO6GDheUimkO9DGTeKnk8n/Hwlm6KjqYfkaJuf1YTKD2bgqfsW4TQM
-uN/wZurB9sbZTdrPqqD+pS8xV8CloldkH4x3PtUz+0Z4Fkgf4IQG1GKI/OGu2Ego
-6UjWNb+M5nNokpzyV7bAslmTj6Q7CCVQuNSKGfOIJEc=
+Xcsvkc9hpdwT+ZGrnhSfYwF1HhTlI+1QfsQ0kO/TvDwswj3xJjaGfs+zg6anSgng
+JDNm5tklwvPbJaE79vPvVWy9jmUq5IeFAt2x1heTql2kY7P0oH3kYwgp1K0fNLf7
+/HHWzo3gtrho+AYKr3E7OZpfpx9AGig00bwJYQEFgEA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.key b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.key
index 885e71224..28866d164 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.key
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: server2.example.net
-    localKeyID: 9E DB 1F 81 35 7E 72 8A 0E E8 A7 29 2D C8 AA 4F 47 9E 4E FC 
+    localKeyID: E4 EA 63 F9 F4 03 5B BC 53 9A D8 69 D8 F9 CC E6 03 91 F4 56 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI6PKjsaJAXrUCAggA
-MBQGCCqGSIb3DQMHBAjMjlnQKylAngSCAoDgYIIrmVj83p/FHd2GKt7NbJxZW3jM
-Mj0jOOFXdkUJ0BPhLlcpaC3760sRiD1nAU0OGdj9DH1id9lgFKzKIOBbaKkRRKdT
-DrI2CjgMgdLYpfFWwrOMQ4OVnTaRYO7ThPBFKB8MuEQGjfspkrHc5p3twpKNucvU
-KN6Z4LiYHED2L9thLwH6kXE0nSstBk6cdmqMBX3+GUp3D0+takuyyrgBVJe8O0Tz
-nXuEIoAnziGscz7LQh399/HBhsWGwJhb/PQ6/3bkFrw14MDAg6qN2NuHfy+njU+c
-1xtrVrFeHmEFEPJTRnieyAnnHzr2LgYvIpoxtL0Yps/okS7Gl1UnaQqQARWcyTNM
-ruZoFSDZ/3FPVdB6S1tCYHrqIAZXXGYtUsqyneweurL9fprQCb6sBv1SAc3nj1AR
-UGx+p/hPp6Bm3xRmPeedltAITTIxAPE7UA+xASc6j5O5wJB7mrF9vNbt7ZkjzcgT
-87pUbe7gTtBJC6sX54PizyRaN3vnLr1nu/JDNzu1BxjEo3BshLNolrnB3YEwH8Lv
-oT8leIg6sZ8RTI6/KIdSttlatsKFFG3wqXTx8cJDBSGbyUc2mQiCPbQWBb4GUhFG
-aKwmPz8IMYyctSMJxr995eii8mogtzw7s8OirMNaJaWaG874c3I2aNIqeRm/w1Xr
-ZBD2P2vStWdivhYlcTCretqr/1G7x7iGEQPpV5bdzSz54ECEYAnCoS/IShEt/2AG
-Qxase5FQ1JyciDhPIaygRGJZCkE0i8nvdjTgqd5YiFX0OCYDlpKVa2IxysIhfjk9
-H6fkjYIWF2GhjEWpNYGXJ29fIfiNgZ+iAWHJ7cF/t98cDnHdXhUkdHxB
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI9zGVV4cEu7ECAggA
+MBQGCCqGSIb3DQMHBAjD1hKFRDzEsASCAoBQNuSurHPQ4NdFqMPbcZM1H+OOIkZF
+4YEUKCPoSyeTKVkaNKiwipZ4uLVamJLlbpJ3eOpyTNU0TNyVzBSxRyyxRgiDmY+/
+KYUvaI59LpXGE/OZEIdb/lsxQr5mKhFg8bNseg/HpLl0KHgIt+5hiufvP602b9Ch
+02HZmXcYKhFDnO6X/bQMp+fed2Y2tPdfNXUdwhrp9y0gKZtzXIvme0PQN1wG22Iu
+s0eC51z391eJ/CoTx4yxV00slpN5ItbxCmqBTBSF5eMBZHcSQpmt0d+xGDaYfhyL
+xdM353qu2NJ/nX4vILtz6KdWBrJt5PuN3DjTzjJM566KYLRVQSUMVeDsGm3jb+QR
+hV4beOplXkD1J72BVgs6I5unBuoem9MHMZSC/TVaEUDPZtWzbjGWLErK4zUfugq1
+ITfFbS4wusy4t8M1pSL/0gqNSRCvcPJN7JvmOKfY4vhvmYGmqsduJ3nHetvWPOsC
+2pAlwfJIhQGhvXZpVtEh6jyGC/YFGUfrDASYzF3TTcVGpklVZmgglYNg3r0wiV2D
+cz6P6O1fR1K3fA3FuSLdhGBitfN01RZdWCsmjP7HHqHEx+4CjTX3qfimCYZkC5xJ
++q0deKfchndPvqNhiKZpWsubFpXtKNTIAvE1HwkA+O6PUHbnd6GE3qjehaKCNK01
+u9+z6ZljGq+tPybNO4D/NlU8XKzfoYXg3ADCqUXs1JsssoCqae0l5do90ZI8vkwr
+dEyRdYdHUaByl28qMTW9Mp9NsnHMf+pFbEpdcWMQCaSTXnoTA7Ocgax7n4sJEQ+U
+GByIBSmb0BnWKLhXAgHMZ7VWAYAfLGo1qfrB5X3nqGcbziQ/7z9rdzPx
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.dated.resp
index a7a1b58b5..a1968f29f 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.good.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.good.resp
index 8e040ea85..9bdc7952c 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.req b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.req
index c9f7e0cec..4e6a94f59 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.req and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.revoked.resp
index 8e040ea85..9bdc7952c 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.dated.resp
new file mode 100644
index 000000000..1e1cfa0c1
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.good.resp
new file mode 100644
index 000000000..7329776bd
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..6aa87a7c9
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..e92aa97f3
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..848474224
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..848474224
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.p12 b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.p12
index 2b1ded363..02a13a035 100644
Binary files a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.p12 and b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.pem b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.pem
index 5c9fd359f..5b62114d2 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.pem
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: server2.example.net
-    localKeyID: 9E DB 1F 81 35 7E 72 8A 0E E8 A7 29 2D C8 AA 4F 47 9E 4E FC 
+    localKeyID: E4 EA 63 F9 F4 03 5B BC 53 9A D8 69 D8 F9 CC E6 03 91 F4 56 
 subject=/CN=server2.example.net
 issuer=/O=example.net/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5uZXQxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDFaFw0zODAxMDExMjM0NDFaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
-ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAPmz1Pq2JS+nTg2NgpEt
-n1L6c6OLq1waIWdH1PrsaXwz0sjAp6l5xjLIHau+0Jbeg4CkkYNYLWFcFlrhzry5
-kTsoBhwhJKsanY3fe7t4iKIxCtiX1YqoxC/+4vEpszdHnT4Io3hE2d2gooBdR9jD
-oYJm9S6J2U/GX1jONCJ80TPzAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
+MjM0MjFaFw0zODAxMDExMjM0MjFaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
+ZS5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANENFWh+HMxEjZsG21Fp
+OhPtsdBiudnR48Wu3NYD5lraEaVePlwTxPoMEmYqwIqtYe4+x8vlmLaWvKkTjJwT
+AgJV8NVWr9jH4XjyZm9/GK0CyQScibjE/fsCYQvBU/VKHO9pTc5sr7nsaOTZW7NH
+l1ocYnzIj9YXAu3Iw6AX7gLDAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUubmV0L2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm5ldC8wHgYDVR0R
-BBcwFYITc2VydmVyMi5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOBgQA8sLmL
-GONk/MlDKooo/jYBdtDxjq4DsG1m5xJMi5FXU1XejeW4MtzhjYLqELuXLW7xlilm
-Qebnov+JLBpJlEQEC3ffUo5tQYFkXI828/0kle4FR+6O2VYUFgPMOLE8DXTsh03h
-55xpE0xly3K8FRPmWllR0QELmmFT97IltC6zHg==
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm5ldC8wHgYDVR0R
+BBcwFYITc2VydmVyMi5leGFtcGxlLm5ldDANBgkqhkiG9w0BAQsFAAOBgQBKHs44
+5Sv7+GVj7XgmAsYDiOTfMcQ/bD4RRa2err0iku/SCYEATCxZLbo6iCLcwgtkf3YQ
+6AFj+d5w1qAmOgm9wfZKIRPoM5ndEOeR3VdffHEeXG4yo7/8DL+pbZjDTFl9dLSa
+kblJFdinSu4Gcy4E+bH0mC0E04ujCTqxiIg2fg==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.unlocked.key b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.unlocked.key
index bde8cd4fd..bde062bae 100644
--- a/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.net/server2.example.net/server2.example.net.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQD5s9T6tiUvp04NjYKRLZ9S+nOji6tcGiFnR9T67Gl8M9LIwKep
-ecYyyB2rvtCW3oOApJGDWC1hXBZa4c68uZE7KAYcISSrGp2N33u7eIiiMQrYl9WK
-qMQv/uLxKbM3R50+CKN4RNndoKKAXUfYw6GCZvUuidlPxl9YzjQifNEz8wIDAQAB
-AoGBAO8Mp4fBWsZNQB8fa3E7IP1agdx/OPT6myH6Fb6HF9Fs941zSs+nogQ5qpYi
-HiVhLrm4UwpQH1nGxCwLY1UvvgTlCgJK2xQsc/GJutQPQrbiqXp2fRftS9vxS/OV
-Hzk9r+vlbQuSEmmocjcT3zbWLT8/2UBj6dtaLO8rSjIktL4JAkEA/VbRhRqnhrt4
-h+rm6GVIp2qnB5298bgBPZ6M+Qq9S5aGnZxSPCj7YrlJIVVXAvi+H4/aDBMy4Quh
-a0KpswJ3/wJBAPxTPDX4QKDnHUeNo/JAythWMYGg9WwZGYuK74KuL/kPKQYFayYr
-wxf6LvaOnW1r5UNsdhytyQWPWRlJ810u5A0CQQCULAIxgox3PhDaFiblx899s+Br
-kPQ2e3OmUaSMSJ68phan+nUSoLmfXVWLfHl+0HOKzD0xEM2SWJYZwQy2GXyLAkBR
-23rkE1Z8HJ4eEXBHbgegaU4EPMCBwh7Ma1VKMtIzXVy0rFtXdckD5VEJAblGv0MQ
-PYaPxT06xYdlMd12tHidAkEA8NeuWnXF38ztLCTVAjakKH639GEKzTj6sdLUFSNG
-HlivngW/mkugu36fR8Su1BXJs9S8U8RHm0VPv0NyzvWwYw==
+MIICXQIBAAKBgQDRDRVofhzMRI2bBttRaToT7bHQYrnZ0ePFrtzWA+Za2hGlXj5c
+E8T6DBJmKsCKrWHuPsfL5Zi2lrypE4ycEwICVfDVVq/Yx+F48mZvfxitAskEnIm4
+xP37AmELwVP1ShzvaU3ObK+57Gjk2VuzR5daHGJ8yI/WFwLtyMOgF+4CwwIDAQAB
+AoGAFrOyCHfxjqk/K3+yH4Qq33Enpzahcisd7iDQMJmZ0XHvCqNSaFNpR7I56Uhp
+QmYTxXih392eGO4DrOTHl0dlJ0NH6i9nOg8qrHKnItozZ6xtCJ1DE3kB8SqXk3xW
+ghRepamaHlujSu8yWIwWNt+vPftccTDu+k/LkGV84YYfKJECQQD/2qtuyNOxceAa
+llD9PSGWHGgEwQt6Ko5BQX8ZyQdAs9BD/FKWLTsmvbJ3XxKlQ92KWRI9RmXgFeKq
+N49vCjYrAkEA0SuVzhjSbWvn7gWESnRHVsdodiB9YIBBZB0Qj3FgPx+9w/RuJFyi
+SwlEo9tbQE2ZeAPbXn9071BQd9CyIUHxyQJBAKuCTkEpZp8gkvW/pfLcM9OIn0Hw
+ll0CgfHEkgsa8z2wTAAG+OWq1GgX6baTiNA4Oh4vr0ZcFpaslRE9xWzOD5kCQARA
+Uoch0gUPUGNyEUJCIsEMxH7CIko30Rxrys5fi4k85+p3qVVr3JCR26dI6g3gheH+
+khLVnFbQ1xHYWAZ9BKECQQC87g+wvVpo8sQ94QYPPKfpJiVx/0yURYnkMRHIa1b0
+zaNNeDg6bBSOxclqtF5ZZKYkThu4iZJ9ZARNxvZ4/8CN
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/BLANK/CA.pem b/test/aux-fixed/exim-ca/example.org/BLANK/CA.pem
index 1a2facc7b..3605fed62 100644
--- a/test/aux-fixed/exim-ca/example.org/BLANK/CA.pem
+++ b/test/aux-fixed/exim-ca/example.org/BLANK/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMmC4zNWYntPtKW8nuwo
-JbC14Cwuck7DufEvR6WAtos3NUxjWpS4rQl7bW62AoaSdX0bSIxpyS2wtgQxIoFJ
-yU0Ukseh5lTpAvXEgKyjutRJswbQj0w94O0487KcyBqd1ZDJHJYs9VJ+BfrETwwc
-74Tk8FUQHaH6EQJ28GIJUIJfAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAISxe2t3sJCPBKD6wyb/
-lAsOu+Llby0cXetGKzGhC+HFHvI5OsjhMtOE5uGp7UYlJzbRrfMx/gSR9pjaXxah
-Bt7JFvcPI6wSDU4bBClsuvMTisenANOOscWHSEvB/YQes3OLnqC2RGSppKshjwVF
-fdbkhlMTV2Oyub2TvrscntOV
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7g6InDJBOPnTmNseci
+UYVZtfokI9WjOsisA4jt9BQMkdmACXfgO2LSF4n1qKv3dgZh+RsWnCQScft4PDfy
+KLvKy5HUrKJOhGrjEdOY4kfe8yzvPnvLFnVvoT+7oecYhb20onX4cwrYbDse0prB
+mUdzxCZ4lvb+Ohbevfq+TUR7AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIhvpc4aqmpWysW6pinq
+DwULNiL96lcNaZ8tZXfdHGgbzfgYir+sbKObg+wOHObkRmEY/FcIF9sbwJuetOiO
+gMTEQwB13J6VurRcfTygrqHe0F0bC/Zq/AJ/BEbdVhtQ5H68G7qMBZw2aVpflZBy
+e/xewJdeLc+y5zuobX05I7rP
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/BLANK/Signer.pem b/test/aux-fixed/exim-ca/example.org/BLANK/Signer.pem
index 44d97c60e..0d15f116b 100644
--- a/test/aux-fixed/exim-ca/example.org/BLANK/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.org/BLANK/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/BLANK/cert8.db b/test/aux-fixed/exim-ca/example.org/BLANK/cert8.db
index 0f0a8809e..2116ce305 100644
Binary files a/test/aux-fixed/exim-ca/example.org/BLANK/cert8.db and b/test/aux-fixed/exim-ca/example.org/BLANK/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/BLANK/key3.db b/test/aux-fixed/exim-ca/example.org/BLANK/key3.db
index 63e029e58..26e4de73c 100644
Binary files a/test/aux-fixed/exim-ca/example.org/BLANK/key3.db and b/test/aux-fixed/exim-ca/example.org/BLANK/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/CA/CA.pem b/test/aux-fixed/exim-ca/example.org/CA/CA.pem
index 1a2facc7b..3605fed62 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/CA.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/CA.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMmC4zNWYntPtKW8nuwo
-JbC14Cwuck7DufEvR6WAtos3NUxjWpS4rQl7bW62AoaSdX0bSIxpyS2wtgQxIoFJ
-yU0Ukseh5lTpAvXEgKyjutRJswbQj0w94O0487KcyBqd1ZDJHJYs9VJ+BfrETwwc
-74Tk8FUQHaH6EQJ28GIJUIJfAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAISxe2t3sJCPBKD6wyb/
-lAsOu+Llby0cXetGKzGhC+HFHvI5OsjhMtOE5uGp7UYlJzbRrfMx/gSR9pjaXxah
-Bt7JFvcPI6wSDU4bBClsuvMTisenANOOscWHSEvB/YQes3OLnqC2RGSppKshjwVF
-fdbkhlMTV2Oyub2TvrscntOV
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7g6InDJBOPnTmNseci
+UYVZtfokI9WjOsisA4jt9BQMkdmACXfgO2LSF4n1qKv3dgZh+RsWnCQScft4PDfy
+KLvKy5HUrKJOhGrjEdOY4kfe8yzvPnvLFnVvoT+7oecYhb20onX4cwrYbDse0prB
+mUdzxCZ4lvb+Ohbevfq+TUR7AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIhvpc4aqmpWysW6pinq
+DwULNiL96lcNaZ8tZXfdHGgbzfgYir+sbKObg+wOHObkRmEY/FcIF9sbwJuetOiO
+gMTEQwB13J6VurRcfTygrqHe0F0bC/Zq/AJ/BEbdVhtQ5H68G7qMBZw2aVpflZBy
+e/xewJdeLc+y5zuobX05I7rP
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/OCSP.key b/test/aux-fixed/exim-ca/example.org/CA/OCSP.key
index 8ecdb8ba9..4b2b1441d 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/OCSP.key
+++ b/test/aux-fixed/exim-ca/example.org/CA/OCSP.key
@@ -1,20 +1,20 @@
 Bag Attributes
     friendlyName: OCSP Signer
-    localKeyID: D6 C4 53 5D 8A 50 B5 C1 C7 EB 32 9E 6F 76 00 B5 AC 5D 11 18 
+    localKeyID: DA A9 16 A1 04 4F F1 18 E3 A4 58 B8 71 3F 53 46 B5 4B 22 EC 
 Key Attributes: <No Attributes>
 -----BEGIN PRIVATE KEY-----
-MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAMMdPPNEmetl85Ya
-2a9eMRQ6i8bVY8Dimdb/PIgYBAkpxb0xu92WYxFAz26wnzp5oauUDsBLxmwC4QEh
-dN6aYGEOmt5HzblqfVPgSWWufj4z8dyKFkSmJFnRDW6vCXgnLWt+Eu3zVwfEqwU/
-VKoYZXfofS+Q0QCD0u6tnu89t6LPAgMBAAECgYA4JjXgHCHfaFuNGvUCTqz5EVAg
-TFCEtbFn+dPFpoOiz26kX6ecwSaJVIldZV6tSUuJQPZtyGC1vK5b0PD9DpglVSdw
-3QNxR9qh7fgnFm1iN+O2WhohEOCzmcV/D/YzaYeHkiNhMM4ZaCx9MoFVx17g6TVG
-xxqLwBrZQiopHIP1wQJBAPLHafZT7xrqrpFVL/s2UsmjkSWZCZ7zUX0UlgXmBI7K
-6YDXKLxzyaym+NAaT1D23pmmd4H9ph9CCgRIwlLfwbkCQQDNvVQ5T3am7zG05C2v
-GAXW7GzCW73yQ5hIxb5cuoIYewi57BMf/CJDlrwJm6WkWUHWfeSTEdyqFRUiCrcr
-fmzHAkEAnQgrG69SmyBs5YgqTtzmU5I+0gjY1j0f2j20hAAxtoK84h9JNAvYyJn/
-metKnl3vwYaRCj2cc99tRzQgrSYZ0QJAMm0oOo/Gdi4EUeDnbZYGwGHcWlrgGIQG
-zDdjbBjukA9/2QoKufkzcLt+RSCYHcsevvLGVmG3YxydvGVB9fAbuwJAQAogtDL4
-gGtl8CR7Fs8X1kxZ7+1JRb17IMXy7zajUrWid7x2rwUCYTRNPUm1iCKpEkTWN9q7
-vu0zpoakGup90Q==
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAMVsIWDfi6gE1Wx9
+TeovWG3Zy33eImGUuNk9q/vDYULCTUlH0iSyZF59iqGGMOEsPtCBWghmDIupO917
+7ewiuX3Yk+k/N54XfB/gvWD1iiDcBBrAIkAy36WwnVFSJwt4c1UaOhRV+zjC4jiJ
+5P0xAG5p/FgWHuafIdlZtrujuFa3AgMBAAECgYAUFQA+NO8lW7yECSkEUeWaYwW2
+m4J+z5yQCJx2gzThEBfBhQtEzVq1W+rerGJLfW80UXwhj5PmHwRmbsVQeGXK0A2A
+OIbuRJ/0Z/iQ2ppp/Uqalgkfen2Eopb8dn6bT0hZooaJpGAwIqrnyQ7vDfC8Uylh
+7k9FpQYX24zTidEeJQJBAO4m+Y+0Z7L0hKlZZeamcbjBCPX8I1Y085d5KM4LTNvA
+Ey7/IY8Ft6ImnzCvz05SZnalVwz23dtzr2Lr/jaEUoUCQQDUN72NVHKuGO79rMuv
+IFW7f79qCt3hS1J023aWACRNVqggt1eBmBzjQFVwESyL2BbQzzb2aK8bIR8q+MeA
+Vw8LAkEAgZVbfcIgGtPJy4wFUneGsYz3n0FOyP2O/gDDHzou2/OrfIr+a6Akx2pU
+fF1tY6SadDyLHVbGaT6NVDos3OUrMQJAO3pj5fiFK8ZRNUf4zlyBqstjGpVxGnPB
+6H6Z/fCMPCDNfl3kaK35arfdOkuV8JvfySZKgUVVzoS595FCWPYNgQJBANQWNkkC
+J4PminJFaEWz/zKt74oJCihdHatmWAB/udxVsAxcP1S2lZnqvj19H3Q5ffNaCHSM
+iBB4GC0UWPEjpWY=
 -----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/OCSP.p12 b/test/aux-fixed/exim-ca/example.org/CA/OCSP.p12
index e9b4d79b5..0200fdfd9 100644
Binary files a/test/aux-fixed/exim-ca/example.org/CA/OCSP.p12 and b/test/aux-fixed/exim-ca/example.org/CA/OCSP.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.org/CA/OCSP.pem b/test/aux-fixed/exim-ca/example.org/CA/OCSP.pem
index 2c5179b9c..14c32460b 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/OCSP.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/OCSP.pem
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
 MIICBTCCAW6gAwIBAgIBAzANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOVoXDTM4MDEwMTEyMzQzOVowMjEUMBIGA1UEChMLZXhhbXBsZS5vcmcxGjAY
+MzQwOVoXDTM4MDEwMTEyMzQwOVowMjEUMBIGA1UEChMLZXhhbXBsZS5vcmcxGjAY
 BgNVBAMTEWNsaWNhIE9DU1AgU2lnbmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
-iQKBgQDDHTzzRJnrZfOWGtmvXjEUOovG1WPA4pnW/zyIGAQJKcW9MbvdlmMRQM9u
-sJ86eaGrlA7AS8ZsAuEBIXTemmBhDpreR825an1T4Ellrn4+M/HcihZEpiRZ0Q1u
-rwl4Jy1rfhLt81cHxKsFP1SqGGV36H0vkNEAg9LurZ7vPbeizwIDAQABoyowKDAO
+iQKBgQDFbCFg34uoBNVsfU3qL1ht2ct93iJhlLjZPav7w2FCwk1JR9IksmRefYqh
+hjDhLD7QgVoIZgyLqTvde+3sIrl92JPpPzeeF3wf4L1g9Yog3AQawCJAMt+lsJ1R
+UicLeHNVGjoUVfs4wuI4ieT9MQBuafxYFh7mnyHZWba7o7hWtwIDAQABoyowKDAO
 BgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcN
-AQELBQADgYEAsP1Qz1r0qTWcsFBlNef6aw/0algvmSdcJN4KV9/HR32LD9xm5qUb
-/HbzUSslP9YelCdX1md1v8nTngLbrOh9PzAP33AQbHrers+agP5UNOJjSZoi6JFK
-R3Ajk+aG+je2eZP1zukejiOG1UnRXL6kcvIeXUQhXuOacFKeliz5BdE=
+AQELBQADgYEAOqoUYB9JsaA6P6BRreY2d7vq/mEgMdQqOmLs372MUgEmuaTib+8T
+W1ZzPVAyKAXLA0Mx9Cm4M2u6GM2xd5n+pZQEF+PMJEnLOUOZzIZMd3FQoq2YOvKG
+5oosmINwUkb9JeBFLcHZDZ+/byKa7gPPWGwhqo/X9aCWyRISLjOZSTY=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/Signer.key b/test/aux-fixed/exim-ca/example.org/CA/Signer.key
new file mode 100644
index 000000000..8f7d2bebe
--- /dev/null
+++ b/test/aux-fixed/exim-ca/example.org/CA/Signer.key
@@ -0,0 +1,20 @@
+Bag Attributes
+    friendlyName: Signing Cert
+    localKeyID: 60 68 96 E4 EE 63 A4 1C 88 76 FC AC 75 0D C9 27 DD DC 0F 16 
+Key Attributes: <No Attributes>
+-----BEGIN PRIVATE KEY-----
+MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALuQnzM8pAcc33ZD
+SRd5pcpUdTSwuNKtJLI6WPbR08aIraXeHnnrcZ7MtyRyCXBdRWFkKjYyT/l6rSzQ
+otZY+f30JR52TGEyzsM/y7etYHAO1NyouzTm6+Jx92jRCnP3BoCjHBHYhyHA0kPY
+jp9eEhqP8ZjfimN/sJn7pB+eOW2DAgMBAAECgYA8cjykFgBknGz1n3SQQK9p17MY
+AnXly0/eskgWbwO5YTXZFQ6sSvDIdP/2mlupXx2rZ8zkv20foOXrYeeAfZc+r7Bw
+k9WBOrca9JW8evBq6Pz5WuhCy7MNtvSY+0OjIIqf4MDh8FtJunN7GcGp+D0xc3kr
+QMnoP4zSXdTNhT4rDQJBANzFSWGHbTlG0NSxSDCxXffSxWpAEbVGuy+hYXGXpQBh
+qht94exlHJSUKLNj7aAXpG/H23/gnuTUyfMxsJf2LEUCQQDZfti4W8E3N2hKxLQS
+OJDy2MdNTCRmgyrVriedvhY20jay2y1nhvfiqPUZzNnyyYoAfuR+lncIETyS82Vk
+0mMnAkEAweRrPELKhKFTS1mgA1PjKYJta5F1e/Xw9DYR9MewXJNp6Nc4EnwDC+LL
+lDHRQudAvgOTHc5S/rp72yDq7auA2QJBAJPmVE2Z55w6y2r8tE8ntDnP/EeuHZqw
+W7KPCVWVa9m/vX6G2StrdqnlpzbyPMuDDZskrxD+FNehkQWFClAzWUUCQBMtw1jj
+ofWdwvPI9+S9+Ar9boRfjm560R7WAM4Vpca+Bfn8XODBuL3zJZYtuPqOeZcf945L
+Tbh+58nTebzJg44=
+-----END PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/Signer.p12 b/test/aux-fixed/exim-ca/example.org/CA/Signer.p12
new file mode 100644
index 000000000..56d304b98
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/CA/Signer.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.org/CA/Signer.pem b/test/aux-fixed/exim-ca/example.org/CA/Signer.pem
index 44d97c60e..0d15f116b 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/Signer.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/Signer.pem
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/ca.conf b/test/aux-fixed/exim-ca/example.org/CA/ca.conf
index 98a2d61df..17ad6f648 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/ca.conf
+++ b/test/aux-fixed/exim-ca/example.org/CA/ca.conf
@@ -1,19 +1,19 @@
 ; Config::Simple 4.59
-; Thu Nov  1 12:34:39 2012
-
-[CA]
-subject=clica CA
-bits=1024
-org=example.org
-name=Certificate Authority
+; Thu Nov  1 12:34:08 2012
 
 [CLICA]
-ocsp_signer=OCSP Signer
 sighash=SHA256
+crl_signer=Signing Cert
 crl_url=http://crl.example.org/latest.crl
 level=1
-ocsp_url=http://oscp/example.org/
 signer=Signing Cert
-crl_signer=Signing Cert
+ocsp_signer=OCSP Signer
+ocsp_url=http://oscp.example.org/
+
+[CA]
+org=example.org
+subject=clica CA
+name=Certificate Authority
+bits=1024
 
 
diff --git a/test/aux-fixed/exim-ca/example.org/CA/cert8.db b/test/aux-fixed/exim-ca/example.org/CA/cert8.db
index 4cee7e74a..ad54edb08 100644
Binary files a/test/aux-fixed/exim-ca/example.org/CA/cert8.db and b/test/aux-fixed/exim-ca/example.org/CA/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.empty b/test/aux-fixed/exim-ca/example.org/CA/crl.empty
index 74a19dffc..918cb9044 100644
Binary files a/test/aux-fixed/exim-ca/example.org/CA/crl.empty and b/test/aux-fixed/exim-ca/example.org/CA/crl.empty differ
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.empty.in.txt b/test/aux-fixed/exim-ca/example.org/CA/crl.empty.in.txt
index 9ad997438..a29362bdb 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.empty.in.txt
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.empty.in.txt
@@ -1 +1 @@
-update=20151216164103Z 
+update=20161101174751Z 
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.empty.pem b/test/aux-fixed/exim-ca/example.org/CA/crl.empty.pem
index 447d2404c..82a72d4d8 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.empty.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.empty.pem
@@ -1,7 +1,7 @@
 -----BEGIN X509 CRL-----
 MIHtMFgCAQEwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhhbXBsZS5vcmcx
-GzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydBgPMjAxNTEyMTYxNjQxMDNaMA0G
-CSqGSIb3DQEBCwUAA4GBABEV4AP9BFujJuUkbR4aEeXrdV7x1E9hgRggYhKCM1Wc
-oQQXPo5WkZWi2clpTC3swKeX0bSzhCCi4ghfdl45L8grr1cC0T/jYQ6YkbQ4APyY
-2WZftyJafx3bRAsw/ZO/zJTaOr1959sMB0pD1urOI2keZFwl8kutjCliLxm//cVo
+GzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydBgPMjAxNjExMDExNzQ3NTFaMA0G
+CSqGSIb3DQEBCwUAA4GBAFTm0R/eAa6I8NpxnYj8JaaPMla1Y85epIzla3MiT49/
+sxRGwfsvxVRbBgDOkGICVgnEOPF68efOQhGrDP8mUccHYConCPnlwphhjBbf5coQ
+QfJBDqr6hBbYf5qnWdgND+eso+nhA2bJOElAs6bk+R0FCJdeubd+HhjFoQ6idEeP
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.v2 b/test/aux-fixed/exim-ca/example.org/CA/crl.v2
index d55e6fa3d..0bee035f7 100644
Binary files a/test/aux-fixed/exim-ca/example.org/CA/crl.v2 and b/test/aux-fixed/exim-ca/example.org/CA/crl.v2 differ
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.v2.in.txt b/test/aux-fixed/exim-ca/example.org/CA/crl.v2.in.txt
index 26b5b38a0..a488ee041 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.v2.in.txt
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.v2.in.txt
@@ -1,3 +1,3 @@
-update=20151216164105Z 
-addcert 102 20151216164105Z
-addcert 202 20151216164105Z
+update=20161101174753Z 
+addcert 102 20161101174753Z
+addcert 202 20161101174753Z
diff --git a/test/aux-fixed/exim-ca/example.org/CA/crl.v2.pem b/test/aux-fixed/exim-ca/example.org/CA/crl.v2.pem
index 1c4b586df..08a80ea4f 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/crl.v2.pem
+++ b/test/aux-fixed/exim-ca/example.org/CA/crl.v2.pem
@@ -1,9 +1,9 @@
 -----BEGIN X509 CRL-----
 MIIBHTCBhwIBATANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFtcGxlLm9y
-ZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0GA8yMDE1MTIxNjE2NDEwNVow
-LTAUAgFmGA8yMDE1MTIxNjE2NDEwNVowFQICAMoYDzIwMTUxMjE2MTY0MTA1WjAN
-BgkqhkiG9w0BAQsFAAOBgQCdVM34udjam9lKU/yXaAV/PJsjTuxnrzlaRR3c06dp
-HMwoNSkn/64Tvw7BJOaEtcrQmqEyq1eeLtOa9uYWO1G7rgbD7HoqcVFkCCr+qGBb
-El7apHvAweVi+4RC4cL3FxmB7M6THW0gw1olGDBdahPdzD01meFXdOwLG4L1iqu+
-tw==
+ZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0GA8yMDE2MTEwMTE3NDc1M1ow
+LTAUAgFmGA8yMDE2MTEwMTE3NDc1M1owFQICAMoYDzIwMTYxMTAxMTc0NzUzWjAN
+BgkqhkiG9w0BAQsFAAOBgQCwqQU6wOjlfQ4FtSznjytU5foi0kZWHFlWjmMjuz0f
+1UpZzpddpu8mxXIjZebvRSj5e1IQP9sk8H3sdd0D7mmiItk+qUKyJoWbEeA4om5y
+0DOoRpBGj5xE9QggV4eoxlesqI+WgKjv4vkJqlh6Ot/Ift6Wg6VrKREJTVLm3MQK
+5g==
 -----END X509 CRL-----
diff --git a/test/aux-fixed/exim-ca/example.org/CA/key3.db b/test/aux-fixed/exim-ca/example.org/CA/key3.db
index d950477a0..ff1ae49ad 100644
Binary files a/test/aux-fixed/exim-ca/example.org/CA/key3.db and b/test/aux-fixed/exim-ca/example.org/CA/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/CA/noise.file b/test/aux-fixed/exim-ca/example.org/CA/noise.file
index 292fddd12..a6e21f498 100644
--- a/test/aux-fixed/exim-ca/example.org/CA/noise.file
+++ b/test/aux-fixed/exim-ca/example.org/CA/noise.file
@@ -1,201 +1,188 @@
 processor	: 0
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 2736.761
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
 physical id	: 0
-siblings	: 4
+siblings	: 1
 core id		: 0
-cpu cores	: 2
+cpu cores	: 1
 apicid		: 0
 initial apicid	: 0
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
 processor	: 1
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 2185.535
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
-physical id	: 0
-siblings	: 4
+physical id	: 1
+siblings	: 1
 core id		: 0
-cpu cores	: 2
+cpu cores	: 1
 apicid		: 1
 initial apicid	: 1
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
 processor	: 2
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 2806.203
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
-physical id	: 0
-siblings	: 4
-core id		: 1
-cpu cores	: 2
+physical id	: 2
+siblings	: 1
+core id		: 0
+cpu cores	: 1
 apicid		: 2
 initial apicid	: 2
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
 processor	: 3
 vendor_id	: GenuineIntel
 cpu family	: 6
-model		: 58
-model name	: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
-stepping	: 9
-microcode	: 0x1b
-cpu MHz		: 2908.609
+model		: 13
+model name	: QEMU Virtual CPU version 1.5.3
+stepping	: 3
+microcode	: 0x1
+cpu MHz		: 1994.999
 cache size	: 4096 KB
-physical id	: 0
-siblings	: 4
-core id		: 1
-cpu cores	: 2
+physical id	: 3
+siblings	: 1
+core id		: 0
+cpu cores	: 1
 apicid		: 3
 initial apicid	: 3
 fpu		: yes
 fpu_exception	: yes
-cpuid level	: 13
+cpuid level	: 4
 wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm ida arat epb pln pts dtherm tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt
-bugs		:
-bogomips	: 5786.61
+flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pse36 clflush mmx fxsr sse sse2 syscall nx lm rep_good nopl pni cx16 hypervisor lahf_lm
+bogomips	: 3989.99
 clflush size	: 64
 cache_alignment	: 64
-address sizes	: 36 bits physical, 48 bits virtual
+address sizes	: 38 bits physical, 48 bits virtual
 power management:
 
            CPU0       CPU1       CPU2       CPU3       
-  0:         68          0          0          0   IO-APIC   2-edge      timer
-  1:        689       7853        658        778   IO-APIC   1-edge      i8042
-  8:          0          0          1          0   IO-APIC   8-edge      rtc0
-  9:       1160        695        344        261   IO-APIC   9-fasteoi   acpi
- 12:     314976    1327914     163447     143732   IO-APIC  12-edge      i8042
- 16:        332        194        163        132   IO-APIC  16-fasteoi   ehci_hcd:usb3, mmc0
- 18:          0          0          0          0   IO-APIC  18-fasteoi   i801_smbus
- 23:         17         31          0          0   IO-APIC  23-fasteoi   ehci_hcd:usb4
- 24:      43443       5748     786804       3298   PCI-MSI 512000-edge      0000:00:1f.2
- 25:          0          0          0          0   PCI-MSI 327680-edge      xhci_hcd
- 26:          3          4          1          1   PCI-MSI 409600-edge      enp0s25
- 27:        852        591         64         42   PCI-MSI 32768-edge      i915
- 28:          8          6          3          6   PCI-MSI 360448-edge      mei_me
- 29:         62         82          0          6   PCI-MSI 442368-edge      snd_hda_intel
- 30:     779528       1591         37         80   PCI-MSI 1572864-edge      iwlwifi
-NMI:         94         87         91         87   Non-maskable interrupts
-LOC:    2716585    2176306    2757682    2241051   Local timer interrupts
+  0:        135          0          0          0   IO-APIC-edge      timer
+  1:          1          2          3          2   IO-APIC-edge      i8042
+  6:          0          1          1          1   IO-APIC-edge      floppy
+  8:          0          0          0          0   IO-APIC-edge      rtc0
+  9:          0          0          0          0   IO-APIC-fasteoi   acpi
+ 10:        496        482        486        468   IO-APIC-fasteoi   virtio4
+ 11:         10        147         30         27   IO-APIC-fasteoi   uhci_hcd:usb1, qxl
+ 12:          0         41         47         38   IO-APIC-edge      i8042
+ 14:          0          0          0          0   IO-APIC-edge      ata_piix
+ 15:         24         20     182202         20   IO-APIC-edge      ata_piix
+ 24:          0          0          0          0   PCI-MSI-edge      virtio0-config
+ 25:          0          0          0          0   PCI-MSI-edge      virtio2-config
+ 26:          0          3          1          4   PCI-MSI-edge      virtio2-virtqueues
+ 27:    3075155         25         27         24   PCI-MSI-edge      virtio0-input.0
+ 28:          0          0          1          0   PCI-MSI-edge      virtio0-output.0
+ 29:          0          0          0          0   PCI-MSI-edge      virtio1-config
+ 30:          8         10          6     263042   PCI-MSI-edge      virtio1-input.0
+ 31:          0          1          1          0   PCI-MSI-edge      virtio1-output.0
+ 32:          0          0          0          0   PCI-MSI-edge      virtio3-config
+ 33:       2251       1443       1443      76439   PCI-MSI-edge      virtio3-req.0
+NMI:          0          0          0          0   Non-maskable interrupts
+LOC:    2928502    2336072    2358940    2472920   Local timer interrupts
 SPU:          0          0          0          0   Spurious interrupts
-PMI:         94         87         91         87   Performance monitoring interrupts
-IWI:          0          6          3          4   IRQ work interrupts
+PMI:          0          0          0          0   Performance monitoring interrupts
+IWI:     172144      62813      48129      57019   IRQ work interrupts
 RTR:          0          0          0          0   APIC ICR read retries
-RES:     181902     181908     174961     218150   Rescheduling interrupts
-CAL:     155914      95370     153295      90514   Function call interrupts
-TLB:      19954      22440      21483      20784   TLB shootdowns
+RES:     803123     677010     571558     698502   Rescheduling interrupts
+CAL:      22679      11469      17535       1233   Function call interrupts
+TLB:      82367      78077      78876      80352   TLB shootdowns
 TRM:          0          0          0          0   Thermal event interrupts
 THR:          0          0          0          0   Threshold APIC interrupts
-DFR:          0          0          0          0   Deferred Error APIC interrupts
 MCE:          0          0          0          0   Machine check exceptions
-MCP:         29         29         29         29   Machine check polls
-HYP:          0          0          0          0   Hypervisor callback interrupts
+MCP:        624        624        624        624   Machine check polls
 ERR:          0
 MIS:          0
-PIN:          0          0          0          0   Posted-interrupt notification event
-PIW:          0          0          0          0   Posted-interrupt wakeup event
-MemTotal:       16127228 kB
-MemFree:        11186684 kB
-MemAvailable:   11365672 kB
-Buffers:           13604 kB
-Cached:           251132 kB
-SwapCached:      1968812 kB
-Active:          2291884 kB
-Inactive:        2270760 kB
-Active(anon):    2258436 kB
-Inactive(anon):  2128252 kB
-Active(file):      33448 kB
-Inactive(file):   142508 kB
-Unevictable:       22232 kB
-Mlocked:           22232 kB
-SwapTotal:       7286780 kB
-SwapFree:         618256 kB
-Dirty:              4152 kB
+MemTotal:        1785008 kB
+MemFree:          254052 kB
+MemAvailable:    1298532 kB
+Buffers:               0 kB
+Cached:           491108 kB
+SwapCached:          252 kB
+Active:           329132 kB
+Inactive:         223080 kB
+Active(anon):      28840 kB
+Inactive(anon):    73412 kB
+Active(file):     300292 kB
+Inactive(file):   149668 kB
+Unevictable:           0 kB
+Mlocked:               0 kB
+SwapTotal:       3354620 kB
+SwapFree:        3353308 kB
+Dirty:              1476 kB
 Writeback:             0 kB
-AnonPages:       2351516 kB
-Mapped:           158396 kB
-Shmem:             79820 kB
-Slab:             122620 kB
-SReclaimable:      63032 kB
-SUnreclaim:        59588 kB
-KernelStack:       12336 kB
-PageTables:        59672 kB
+AnonPages:         61072 kB
+Mapped:            18504 kB
+Shmem:             41148 kB
+Slab:             898368 kB
+SReclaimable:     847936 kB
+SUnreclaim:        50432 kB
+KernelStack:        2672 kB
+PageTables:         5384 kB
 NFS_Unstable:          0 kB
 Bounce:                0 kB
 WritebackTmp:          0 kB
-CommitLimit:    15350392 kB
-Committed_AS:   22213012 kB
+CommitLimit:     4247124 kB
+Committed_AS:     383308 kB
 VmallocTotal:   34359738367 kB
-VmallocUsed:      457088 kB
-VmallocChunk:   34358947836 kB
+VmallocUsed:      149692 kB
+VmallocChunk:   34359524352 kB
 HardwareCorrupted:     0 kB
-AnonHugePages:   1890304 kB
+AnonHugePages:      6144 kB
 HugePages_Total:       0
 HugePages_Free:        0
 HugePages_Rsvd:        0
 HugePages_Surp:        0
 Hugepagesize:       2048 kB
-DirectMap4k:      144572 kB
-DirectMap2M:    16322560 kB
+DirectMap4k:       67576 kB
+DirectMap2M:     4126720 kB
 Inter-|   Receive                                                |  Transmit
  face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
-virbr1-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
- vnet0:  128666     393    0    0    0     0          0         0   317141    3975    0    0    0     0       0          0
- vnet5:   43924     524    0    0    0     0          0         0   221634    3858    0    0    0     0       0          0
-enp0s25: 31338290   49183    0    0    0     0          0      1035 10708826   44319    0    0    0     0       0          0
-virbr0-nic:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
- vnet2:   69293     283    0    0    0     0          0         0   364158    3769    0    0    0     0       0          0
- vnet4:   59178     194    0    0    0     0          0         0   238335    3593    0    0    0     0       0          0
-virbr0: 5345737    5274    0    0    0     0          0         0  1408922    5318    0    0    0     0       0          0
- vnet1: 5034219    3505    0    0    0     0          0         0  1151061    7192    0    0    0     0       0          0
-    lo:   20864     210    0    0    0     0          0         0    20864     210    0    0    0     0       0          0
-virbr1:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
-wlp3s0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
- vnet3:   84293     375    0    0    0     0          0         0   279505    3663    0    0    0     0       0          0
+  eth0: 218826535 3198986    0 95481    0     0          0         0  7353205   57500    0    0    0     0       0          0
+  eth1: 29582092  268307    0 93503    0     0          0         0 30026750   67530    0    0    0     0       0          0
+    lo:    1056      11    0    0    0     0          0         0     1056      11    0    0    0     0       0          0
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/expired1.example.org/ca_chain.pem
index dd7fe720a..47f6b1cc0 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.org/CN=clica Signing Cert
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.org/CN=clica CA
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMmC4zNWYntPtKW8nuwo
-JbC14Cwuck7DufEvR6WAtos3NUxjWpS4rQl7bW62AoaSdX0bSIxpyS2wtgQxIoFJ
-yU0Ukseh5lTpAvXEgKyjutRJswbQj0w94O0487KcyBqd1ZDJHJYs9VJ+BfrETwwc
-74Tk8FUQHaH6EQJ28GIJUIJfAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAISxe2t3sJCPBKD6wyb/
-lAsOu+Llby0cXetGKzGhC+HFHvI5OsjhMtOE5uGp7UYlJzbRrfMx/gSR9pjaXxah
-Bt7JFvcPI6wSDU4bBClsuvMTisenANOOscWHSEvB/YQes3OLnqC2RGSppKshjwVF
-fdbkhlMTV2Oyub2TvrscntOV
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7g6InDJBOPnTmNseci
+UYVZtfokI9WjOsisA4jt9BQMkdmACXfgO2LSF4n1qKv3dgZh+RsWnCQScft4PDfy
+KLvKy5HUrKJOhGrjEdOY4kfe8yzvPnvLFnVvoT+7oecYhb20onX4cwrYbDse0prB
+mUdzxCZ4lvb+Ohbevfq+TUR7AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIhvpc4aqmpWysW6pinq
+DwULNiL96lcNaZ8tZXfdHGgbzfgYir+sbKObg+wOHObkRmEY/FcIF9sbwJuetOiO
+gMTEQwB13J6VurRcfTygrqHe0F0bC/Zq/AJ/BEbdVhtQ5H68G7qMBZw2aVpflZBy
+e/xewJdeLc+y5zuobX05I7rP
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/expired1.example.org/cert8.db
index 0f79c998a..f1366921b 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired1.example.org/cert8.db and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.chain.pem
index 0915b2afb..2ea593ca8 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired1.example.org
-    localKeyID: CB AF 4D EC E3 18 F0 8C C5 C7 C1 CB 9C 06 DD F8 FC B4 FD C5 
+    localKeyID: 1F E8 12 E8 2B 26 DE 83 89 52 9D 86 BB 3E 54 0C 0E F0 1E 85 
 subject=/CN=expired1.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZzANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOVoXDTEyMTIwMTEyMzQzOVowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
-ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANBmkKDiZXSdKAc+3NsU
-eI3pcP31d5jcJehg9ighxXb9OHsALIZ9am/6x/rodBGBw5NckTtk11AQqrhjMxZr
-LgA973bLVK94VO57ZUipz3Kfb0zRiQzBy2qwAsEs70GSwT18sMOck0HavG1bQzxg
-OTlj2W1uNBYSO5XCBUOtCkOPAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQxMloXDTEyMTIwMTEyMzQxMlowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
+ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ65ETDQ0BFUzfULaRgT
+7y3Lmo6D824GBywv4Dndgc5pChikv7TyCv3d8JdGs+ujXJUqzp0ahK/vamjoj8WH
++MKRVXamiDbNsVggjr9GaF+4bP4+Pxlk9RNpbqlpuMzn0U1u63/QnMjOii/zZN5T
+q0yvOLl2RYYnftKkhA1o9h2tAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm9yZy8wHwYDVR0R
-BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEAQLkO
-5jBmejXkJLrCMPQBPQWFyG2jeNcvz+Nw5eP1bd8cKxyVaVk7ZnQrJS0BerNl4yIZ
-J54nxqJVbFFMq4OGVMzVdvkrvrkfEM60Xx9qkYawhIj1zQT0AbrbOqJSVJAxadUp
-GB6iqXETQykIg1VuhHzX5XQ9PH5ppKJEGMFiZVw=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm9yZy8wHwYDVR0R
+BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEAuyaK
+diFbp3JdXCjvrupsLExA9592LshGTyBO8o36MLUFdzGIIsYN0vXWvJfiTShIGAtx
+9RMiwbjoUwVf5bQPHBeQJTIlkxBSJ11h8DJynNLVrxcQ9l95sO0KbCcJF/C24xO+
+FmxmReGz95B/70pGdejwqbZHND6jTU7lzk17iEA=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.key b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.key
index 2fef34240..6438fad2d 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired1.example.org
-    localKeyID: CB AF 4D EC E3 18 F0 8C C5 C7 C1 CB 9C 06 DD F8 FC B4 FD C5 
+    localKeyID: 1F E8 12 E8 2B 26 DE 83 89 52 9D 86 BB 3E 54 0C 0E F0 1E 85 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIhbmaWkVx36ICAggA
-MBQGCCqGSIb3DQMHBAgEMsxsOXFO7QSCAoAIjXzp+weJKxbB6RqHQGzbb2QBoHHk
-aBU+M/aochrN4/7p1Urj9t+c7bGZR7O4JjeJwbsI+LSh/FzR07RPWWr7amPOZ8lj
-5NZGtENPOdZK5o6giIpMJtW6QKzfkt3mwLCqrKACpRmqBv07BMs46yIzH+lGCt7U
-Y+Z/7x0mCK8OHBSAJmUTGslsEDwOKJoRRJj/XCUTRSK4W0IcQDNM24TRcq8jKh0U
-Ah3JpV1G8lc2aX0tsN3PFSV52pju9qSwdCwB8rJPM2kkpyh9dh3UzxC1WQJWGoLG
-8HebhOqLs60dDc4W0oZ+EPojgeKvL6phEA8LyEFkIUDmGCZnRgU+kE5KngQfgF2c
-q4I3lKHah1UIpzIQA8FUBB6kYvpsedEdgnJYn1ag3+FiMCRvO/QsplX1XH+g5bll
-IWsj+IosrOnKFPNTywk5Hly3IVRhG11u13NqP4kDXGYDDqPeOtTAqhcE3HGwHGIv
-6eaCrJHzSfvCaVugLnY1o07DCp4v4TaTsOHTjwe45Fe/lsdbhpf1t8hW8gRFoI/A
-BQFqosRedTzsxOVzc/lgZ2RXrh6abEoBSwguIL77sMdbRAH8p4sxaiyfuVwhjtws
-kKCP/Zj4SDctSZsIX+eZyd2zCY4yRhHp7ZuFVWSlDv6bkm1qWxEe+DgrRxQ60mdu
-s+naavKtXf0MjjbCgWq22eGPWDF9ZxbY4ZYbpCE06z02s9x4WHpqJ+jYH4v5dczo
-FLOWwBxWHDk8llDToLKuWJlLL9X91cTsZKGOexesZTndeZElzyhSo2S58XmW5gzf
-aMDTiUZrtkFmg1B7kO7FVpDhGKwsahZWnfkUAhxuP7UA4/29UA7zYIm7
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIa+ZaRfZ9YdMCAggA
+MBQGCCqGSIb3DQMHBAiiBWlQ0jW19wSCAoCiihzOTQtSnUUuGcsOlhbJOZKALjU+
+55566IeI7awy2s+E3YqFc+Ii+kLHVc1aAiWLhOLvQJEs5ox1xAqgJyZwxs2mgxRS
+kLkFrYtjeqXVZPr1rO77ngWxRR+f9biHXjjbi8aAt2dfn8JdaL6lD+e6H0Y6+coP
+VIFCgov8gNB0sm+QDB5Jq9+vxZSgplbyJsJdzUUDST90XDtI1PFdXZlV+3fCUT+H
+u3gJ38OdQ5HEQYizDCR6buwiGWGJkAONI5oBBtyfAH5eGE9ogzEwf8OHUSqQwuNl
+EVaCUrwrCCu8w8DE24rsRaMcP8ApXQEtxN8hdBWqqyYs3uGdHWmVp/h7CutVqyVj
+JBt8yqNdRyBeGXLH1PnnLS94J93hVj3XrOG/ScGEXgPzDXNK7ws47iySLCW/DVwQ
+XpawOMKvnRRPw8Tmeq8Gx4uFke5h45EwlsBIa5Sfq00uMCyJXg62BD21Opo3jo0T
+dhBxlUTXlQXgF0GzxM6aXX2ZDoNfHzJR+C6mBAVs26NobLr2NZ+i4HgylylA6tuJ
+rYL1PgQbKeWHMIcx22PHij97BV/+H7bBRUxqJM4da9cg4t6IxPpB3dJf6cXqAkbH
+/msgx0KVYdBANIC8AF5+pyhRA2+WrVvFxyvb8Ji4DaV5re+nNLt9ZFRiCiFjUL0z
+pydZiTddgQ3I1WGCiteqLEEsSvy34Ju3PyQoQJkNH3TFmvHcNvjd78gRWPTnY9DI
+1PpUJD0GYtvAxj5PZaord+ESHEzGURaIVbUEuguXVdg239f7Kw+NymdEo/Ne3LD6
++VU/2Sq/vxRUCdJKkhEGcBLeLvducWbB7duVLi8agK4LyaakcCsy91GX
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.dated.resp
index aea1191df..b50485125 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.good.resp
index 93fd7f284..da0c15310 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.req
index fedbae7a0..183d4ccde 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.req and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.revoked.resp
index f32e08972..2d038f9c8 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.dated.resp
new file mode 100644
index 000000000..32f5b2a9c
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.good.resp
new file mode 100644
index 000000000..888033cd6
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..7fb1ac034
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..83e946e09
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..4a0ed3278
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..8619084a6
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.p12 b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.p12
index 7d382f74f..5e7d57bcd 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.p12 and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.pem b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.pem
index d6c65fb73..a58f0afa0 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired1.example.org
-    localKeyID: CB AF 4D EC E3 18 F0 8C C5 C7 C1 CB 9C 06 DD F8 FC B4 FD C5 
+    localKeyID: 1F E8 12 E8 2B 26 DE 83 89 52 9D 86 BB 3E 54 0C 0E F0 1E 85 
 subject=/CN=expired1.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZzANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOVoXDTEyMTIwMTEyMzQzOVowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
-ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANBmkKDiZXSdKAc+3NsU
-eI3pcP31d5jcJehg9ighxXb9OHsALIZ9am/6x/rodBGBw5NckTtk11AQqrhjMxZr
-LgA973bLVK94VO57ZUipz3Kfb0zRiQzBy2qwAsEs70GSwT18sMOck0HavG1bQzxg
-OTlj2W1uNBYSO5XCBUOtCkOPAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQxMloXDTEyMTIwMTEyMzQxMlowHzEdMBsGA1UEAxMUZXhwaXJlZDEuZXhhbXBs
+ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ65ETDQ0BFUzfULaRgT
+7y3Lmo6D824GBywv4Dndgc5pChikv7TyCv3d8JdGs+ujXJUqzp0ahK/vamjoj8WH
++MKRVXamiDbNsVggjr9GaF+4bP4+Pxlk9RNpbqlpuMzn0U1u63/QnMjOii/zZN5T
+q0yvOLl2RYYnftKkhA1o9h2tAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm9yZy8wHwYDVR0R
-BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEAQLkO
-5jBmejXkJLrCMPQBPQWFyG2jeNcvz+Nw5eP1bd8cKxyVaVk7ZnQrJS0BerNl4yIZ
-J54nxqJVbFFMq4OGVMzVdvkrvrkfEM60Xx9qkYawhIj1zQT0AbrbOqJSVJAxadUp
-GB6iqXETQykIg1VuhHzX5XQ9PH5ppKJEGMFiZVw=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm9yZy8wHwYDVR0R
+BBgwFoIUZXhwaXJlZDEuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEAuyaK
+diFbp3JdXCjvrupsLExA9592LshGTyBO8o36MLUFdzGIIsYN0vXWvJfiTShIGAtx
+9RMiwbjoUwVf5bQPHBeQJTIlkxBSJ11h8DJynNLVrxcQ9l95sO0KbCcJF/C24xO+
+FmxmReGz95B/70pGdejwqbZHND6jTU7lzk17iEA=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.unlocked.key
index 61e3b2fa2..6394db1ff 100644
--- a/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/expired1.example.org/expired1.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDQZpCg4mV0nSgHPtzbFHiN6XD99XeY3CXoYPYoIcV2/Th7ACyG
-fWpv+sf66HQRgcOTXJE7ZNdQEKq4YzMWay4APe92y1SveFTue2VIqc9yn29M0YkM
-wctqsALBLO9BksE9fLDDnJNB2rxtW0M8YDk5Y9ltbjQWEjuVwgVDrQpDjwIDAQAB
-AoGAR9mEtaM4fWsNeOoIdRPquGqqhTRTJoWIIEUFuTJjhTGqfmXB9CBbSP46Ylww
-YDTP/AdnHwYWYclNQsMYwvry4YyRglSnhQrHgoI7C9qGVu8d/vNiqHfTKkzBxZW1
-KGSb2+6vFs4rJjYJx5E+o+wtArzcDfSu2IdKIgwDDAgmdYECQQD8iwUMRkCZMH2m
-1OGidbHlSYpHFq5bkuyYINPu3LIRJV3fBOKWLfctGAPhOSX+EA4/aERgXMRrglhv
-Pp3RqN9PAkEA00Dbre1dS6d9q4scRG2ZArGjeyrGybOi4erONzWgJxGHX0b1Kqy2
-G04JelTlqrIjHGOIVJwyab/rnxrOYcVHwQJAHn4GoQHGgPia407m43/EeAPWH1k8
-ui/WQ1QLYtbg5TMWz3u+hBWOt7IjnckRrkhv//Xt85if2r9FQEFWOt9h/wJBALgs
-Y1lPB3ddnoJf1VUS98MRe6V1tblDk03Cl+YqKmXlMlAuXK/Hwzwq3Lh6K4CVrWai
-n8ikJI9tcs5TYHp8tAECQAMHdSMuqtW5kS+hWYpufUIbEpej9iznAynH+XNK+E6p
-+LdfUdiHdAFS4b6j83YgnTYD/QwyEjV0r7vmmn1A8Eg=
+MIICXQIBAAKBgQCeuREw0NARVM31C2kYE+8ty5qOg/NuBgcsL+A53YHOaQoYpL+0
+8gr93fCXRrPro1yVKs6dGoSv72po6I/Fh/jCkVV2pog2zbFYII6/RmhfuGz+Pj8Z
+ZPUTaW6pabjM59FNbut/0JzIzoov82TeU6tMrzi5dkWGJ37SpIQNaPYdrQIDAQAB
+AoGAFPxRGowxRmlZBdIpZgaUtBBccgVeNSjU3/HAisYPuJPIwvNdaXYrH9+tRMMT
+XM9vmUVcpgbwjjZwckh1Yd+VcybnPABw3auOeoKWTKHg0B6gShwBSkkh9Pq8zW3t
+lOR8GFm0UmbvKf0Z8GFGfkHab/eKwMCVm8t4PHNnwfE81l0CQQDMFWNViXqe+n0g
+ZHh6Sp3/+nKJ0bKQD6dYcTI6tPhBhBFvQUFVSRsVyeBlGRB++BOxd/Yw93qJbCcC
+VD/PrMbXAkEAxxmkLlBr3nfOabPT3Yi8ctvg3zIJ9j6NslZMxCdJ96qoZu51VnBl
+1TvhM78/LnbW9uCh2KkPR1SV9W+bsuhjGwJAaKcjHC72sWWUGrNK0LNI2IZOi/v7
+jEJqt0C82DwK/lXCNwIIhbqKaB7wsgcrXWDLgHsaxTtzG9tZGamoW0+nWwJBALW8
+LQXteJjnyOzpLXGgt0sscxWoSjmQHaz0YzwFFNpR10elUEunavx5nPWsExLpfQx6
+PKFUp9KXXg5bYsaqopMCQQCEGg5SRni9xSapkmf0RjA/6v+rSGGyLnMl2hNGazN0
+BVMfbhPWJ3Xs8vJYZUAnDC8P1BC2t45lOVNr/Ah9bJ1T
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired1.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/expired1.example.org/key3.db
index 462820708..1717e7393 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired1.example.org/key3.db and b/test/aux-fixed/exim-ca/example.org/expired1.example.org/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/expired2.example.org/ca_chain.pem
index dd7fe720a..47f6b1cc0 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.org/CN=clica Signing Cert
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.org/CN=clica CA
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMmC4zNWYntPtKW8nuwo
-JbC14Cwuck7DufEvR6WAtos3NUxjWpS4rQl7bW62AoaSdX0bSIxpyS2wtgQxIoFJ
-yU0Ukseh5lTpAvXEgKyjutRJswbQj0w94O0487KcyBqd1ZDJHJYs9VJ+BfrETwwc
-74Tk8FUQHaH6EQJ28GIJUIJfAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAISxe2t3sJCPBKD6wyb/
-lAsOu+Llby0cXetGKzGhC+HFHvI5OsjhMtOE5uGp7UYlJzbRrfMx/gSR9pjaXxah
-Bt7JFvcPI6wSDU4bBClsuvMTisenANOOscWHSEvB/YQes3OLnqC2RGSppKshjwVF
-fdbkhlMTV2Oyub2TvrscntOV
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7g6InDJBOPnTmNseci
+UYVZtfokI9WjOsisA4jt9BQMkdmACXfgO2LSF4n1qKv3dgZh+RsWnCQScft4PDfy
+KLvKy5HUrKJOhGrjEdOY4kfe8yzvPnvLFnVvoT+7oecYhb20onX4cwrYbDse0prB
+mUdzxCZ4lvb+Ohbevfq+TUR7AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIhvpc4aqmpWysW6pinq
+DwULNiL96lcNaZ8tZXfdHGgbzfgYir+sbKObg+wOHObkRmEY/FcIF9sbwJuetOiO
+gMTEQwB13J6VurRcfTygrqHe0F0bC/Zq/AJ/BEbdVhtQ5H68G7qMBZw2aVpflZBy
+e/xewJdeLc+y5zuobX05I7rP
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/expired2.example.org/cert8.db
index 166bb1d5b..4617a4de8 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired2.example.org/cert8.db and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.chain.pem
index 193a8fd3e..f467d062a 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: expired2.example.org
-    localKeyID: 38 7A 92 D7 7E DA 54 41 9B AD 17 1C 7C C4 DC 21 56 A2 7B BC 
+    localKeyID: BC 49 19 1E EE 31 06 3E 4B AE 35 33 9F 5F A4 D8 A8 A0 57 69 
 subject=/CN=expired2.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMswDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDBaFw0xMjEyMDExMjM0NDBaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
-bGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQ+5aNT2L7hnoAMQeA
-RfTbno6NCWYB5PdJSAMguibxmax0hgU2k0fdmnVhd5w4Y6IDGLd6wFW5WVba5YCM
-LizGvoz8x7tPz/XvODi3uUYgXev7bAOlKXYFeCLwvu4W/Jp1pO0sPn+jW8B/idBB
-JoVc3Lq9QdMqJ6ItzMlUHKS32QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MTVaFw0xMjEyMDExMjM0MTVaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
+bGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpk3vdqmKGLJ1atHFL
+VM6BNY2H/RAPgt7bc+6zb6/PBIzkQC5yjA552IHOs3LWLYRKUHEcJ/7KsAO6Xi3i
+9nD2leVy8vjfudjqgdAb3BSXdXMuqm6GFHHAAClB46Cr6pzHD4f9r8GoDvHjvqFe
+n1EObewAbGAhj22DfPA2vfV68wIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5vcmcvMB8GA1Ud
-EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBAFRy
-WES/CS3uN3SUPueFsg5wd/dQMKEjlwlNE+f2kzoJJxswrUB6whlPWR0jQwlde4/5
-TVJsgW3iviP5PVH10Pg+kEk9CCJKha0pTyaKEatnyb4igrt6pLf5KcPjWMTo9gxW
-WAFUb6Zih2/saGCqM31rPArlNwOwkgE+Vjrhd7MR
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB8GA1Ud
+EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBAG5q
+2Axh9aXYSUyzVv478q7JhGOJKQ6ZpmVChQghFikeo/GAxv0gm62aD2Ka9+iNkc66
+yGIFOc+QK7pOIClhDpp3AKWrgzhmdYQ3aOfbgTigG4jYjz5SldE0nedrK/xRVJ/J
+oLxAhtxpRO9htIJTcx2pW4DRu4Wv13uncB436kPD
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.key b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.key
index 4c323a4ab..d77fea48d 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired2.example.org
-    localKeyID: 38 7A 92 D7 7E DA 54 41 9B AD 17 1C 7C C4 DC 21 56 A2 7B BC 
+    localKeyID: BC 49 19 1E EE 31 06 3E 4B AE 35 33 9F 5F A4 D8 A8 A0 57 69 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQINRAqyFrpUUsCAggA
-MBQGCCqGSIb3DQMHBAhH+bOO/ETpdgSCAoBBsrXfvxAGbG/fUB1XqSwhzLDw37V9
-yBA9Hel4O+kDfkkRBMWT+vX3472QeRXRjnaDm57OTFSwq9kDXOu2Xn/wcbyYre2N
-hIkQUwxblza05FgNlwSDtkXbhGSj6A7m1nL/5DSZIfi1vw+tAxR8l5ed1Zrxl9Mf
-kaAAKMazbessK4hbgjvU39X56JVpL1UE9ITnPdTtoPZLMO0iYT6VwkQDK6yAj5gQ
-v3il1RTUhqqfTsrDZcL+Pj8nT++9R5uIxDmto6iWFRCObur9zV6VjKoR8du3Arbl
-fSr/GeKA8ToEFS9ssa0hctkrQkFyhWPUNbSmeMmp+cpS5h8j8ULFb6bTtjDbYUU+
-vryAb7UFD2JVdF66yPBlvsO2FEQLpAF9BbgTlw8h1ULkrmquOmReCzCv1j7y5S/X
-CfOW+9I7O7dHu1NNJT5dA2IRXvhoq9mFoP3cF19fgfYgmOSZYBRFpwf3zTzo1MPj
-ewMGdz6+pwWU+YGZZRbuGxqGCl2kr/SJOeex+BDxLd2cPyLBINnOE2eJ4BigRAad
-9KNEUYnGB/7OluRJLwqFoFGtk5VIRMphZVcxQSmXv8rHebMXlVeSCHZ6wtw0VBGS
-Ibwou6ujzAffMAISx7SfBMPRpzhkkqUL+WWTWwTwyITexCym+X4EsxRxGfKKifRW
-unmRGZWFYOUF8f/zURT7eeCNC9K+Ud3aICQixcYsaew8hPB1kYawZ7WOMgJ3Q1Y4
-5BNdnhwtmdEyqRAsB2p0KjfTpM+cg5VR4H0AYcJNlX6F41hWsspwc3DOfUDqDMIU
-DsARGxauT7xT38MtXGa3iiI71TJ07uVywIMATMQoILh3lE0bqr8MGYwT
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIXzoSEpxpBAACAggA
+MBQGCCqGSIb3DQMHBAg9BBR7hWZt7wSCAoBlLeuxRVykDRj7vKA4febmUGxPbNwF
+Vyt6Y1Bsn8VpwxDypA32u7xx+o4fi0J6o8CbovDChfFO/U9ptxyRHNN3ZGWuBuEB
+XwXMzIAjymoqRVDEOdTWziyrTHVm74SuUPirxZ1TwGVz4tJKQclhaIOpB3dByV6x
+QyJ208vp9D1ona7TYJ/+CfQUHLHcZ6b1am9DitIxfoRJL6n11A8LYA1JjIYK+ESa
+ZKngsYOnl9LMoTXaPWsR5KSCmi4OrqnjAoDCb9Mrn4Bn2UeJkYRg4FEVK+fM0wrs
+UytmP4p/u88reHRWiCT/yRNCJxuRcDrFMYtU3InExEXDIek+IjQQAeF82rn9Ku0m
+Sl+q1wxT15PRPmFXK5rkcdzlwu8dS7vo9W9wUQyE2BpDGUJmKGWmhFeus8XoJuTa
+7jC1TR60VkGUHyHPfatV7IjyEGBr4rWp1MnpRH1Yw4vSgX7AAVWdoeX4YfNB6gsA
+ioX1dYLQpZZ4+DB6lPNUEX6pYyszwqmYUMuVvu/j6SGYsyoxrIHapL5cmTsBjt+S
+uvoeglZixIrZLcUDn4fpcC9Ks7QswF1MzEsqxW2ZcKjPYyBJ6otMid6u8BRWnkAx
+8IZvRFddStKjS7iiuAQ3N02cn727q/sdwvXEaV3A7Pc/hK+PPF47m/Yg4Wi4JSIp
+6OLwRPqTkBDJ7QJcrem6zod+eyoMY2KyDmP9geJAM7hfk7JhPcV9ikEZe7rAUaA4
+F08WxbFSEIKoc07ZBjeQjztmpK6z2c5+JsDenPpRS+p1gonKvpbIIeKfsPoW4IEE
+cWGFH7GPtWfc+ubPiGsFEFICUwxFK9rc82pxe7qmQ/ZEw0JUnM+Hv+o4
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.dated.resp
index 132379d0c..2a4543f65 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.good.resp
index 3536034af..949dda73a 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.req
index 9050e6a10..6580a7bf0 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.req and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.revoked.resp
index 3536034af..9bb4399f2 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.dated.resp
new file mode 100644
index 000000000..e09228da2
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.good.resp
new file mode 100644
index 000000000..6a5d3e0a5
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..6a5d3e0a5
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..8da9a6f6d
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..efa2b94d0
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..efa2b94d0
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.p12 b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.p12
index 2f3cd44f2..c71e9921e 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.p12 and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.pem b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.pem
index f88c6bd38..ebb0e515b 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: expired2.example.org
-    localKeyID: 38 7A 92 D7 7E DA 54 41 9B AD 17 1C 7C C4 DC 21 56 A2 7B BC 
+    localKeyID: BC 49 19 1E EE 31 06 3E 4B AE 35 33 9F 5F A4 D8 A8 A0 57 69 
 subject=/CN=expired2.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMswDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDBaFw0xMjEyMDExMjM0NDBaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
-bGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQ+5aNT2L7hnoAMQeA
-RfTbno6NCWYB5PdJSAMguibxmax0hgU2k0fdmnVhd5w4Y6IDGLd6wFW5WVba5YCM
-LizGvoz8x7tPz/XvODi3uUYgXev7bAOlKXYFeCLwvu4W/Jp1pO0sPn+jW8B/idBB
-JoVc3Lq9QdMqJ6ItzMlUHKS32QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MTVaFw0xMjEyMDExMjM0MTVaMB8xHTAbBgNVBAMTFGV4cGlyZWQyLmV4YW1w
+bGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpk3vdqmKGLJ1atHFL
+VM6BNY2H/RAPgt7bc+6zb6/PBIzkQC5yjA552IHOs3LWLYRKUHEcJ/7KsAO6Xi3i
+9nD2leVy8vjfudjqgdAb3BSXdXMuqm6GFHHAAClB46Cr6pzHD4f9r8GoDvHjvqFe
+n1EObewAbGAhj22DfPA2vfV68wIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5vcmcvMB8GA1Ud
-EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBAFRy
-WES/CS3uN3SUPueFsg5wd/dQMKEjlwlNE+f2kzoJJxswrUB6whlPWR0jQwlde4/5
-TVJsgW3iviP5PVH10Pg+kEk9CCJKha0pTyaKEatnyb4igrt6pLf5KcPjWMTo9gxW
-WAFUb6Zih2/saGCqM31rPArlNwOwkgE+Vjrhd7MR
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB8GA1Ud
+EQQYMBaCFGV4cGlyZWQyLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBAG5q
+2Axh9aXYSUyzVv478q7JhGOJKQ6ZpmVChQghFikeo/GAxv0gm62aD2Ka9+iNkc66
+yGIFOc+QK7pOIClhDpp3AKWrgzhmdYQ3aOfbgTigG4jYjz5SldE0nedrK/xRVJ/J
+oLxAhtxpRO9htIJTcx2pW4DRu4Wv13uncB436kPD
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.unlocked.key
index 1e16fbfea..8df9ef56d 100644
--- a/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/expired2.example.org/expired2.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDQ+5aNT2L7hnoAMQeARfTbno6NCWYB5PdJSAMguibxmax0hgU2
-k0fdmnVhd5w4Y6IDGLd6wFW5WVba5YCMLizGvoz8x7tPz/XvODi3uUYgXev7bAOl
-KXYFeCLwvu4W/Jp1pO0sPn+jW8B/idBBJoVc3Lq9QdMqJ6ItzMlUHKS32QIDAQAB
-AoGAe/Q+ICLuOvJQeryaDmNwELPDKbRhZM5CPp0P/eFsJ/FWcObtQKmq/q4W4XDo
-oCm4ds26Rny+W+m5sqxdyse4ljccOjf+tlrYKHlqD7KeLex4G8WY2XAV6oR0pS5a
-siFbpNsRZ6CwMaNFn/qXtd+XX7auCCFGDqfdB92QNcait4ECQQDoSq502bkiu2aQ
-R/mYCNgTiKlOqvSgub/NWn99WgOO/OTwXYlp16FX4TDp6YmHyEFc/zCV8CXEbuB5
-9I6lVEktAkEA5k/j3unsfdI/M6VyjDSV7pHXNsNicpyXQv9iAp6pm8hpGBiMbOtT
-LleDuvvXV2ubbshcJwZ5oICYA81SF4c83QJBAJtU1TPuI47GId95Qb4Yq+TkDdM9
-Hjgb/dYkHfyEpLyI/857vde5CXrqavr/36eckZjOTH73B0pDmnfywTBtHEECQQDh
-z3KcHL7CnmFZQd4NmYFnZ5abGvZraRzlk3+FEgs5skVYWrlUEWZ9CVEfA80e6WJ8
-O/YeTTrzIyHomGbkqrQBAkBMR8RICK61Gl8bHxv3NsKvvZiUH9H7rPPdBzMPGHll
-4YFtO29mdpHuprE+bpiEfNG4+ouCqEJOfydGBy1qEKqx
+MIICXAIBAAKBgQCpk3vdqmKGLJ1atHFLVM6BNY2H/RAPgt7bc+6zb6/PBIzkQC5y
+jA552IHOs3LWLYRKUHEcJ/7KsAO6Xi3i9nD2leVy8vjfudjqgdAb3BSXdXMuqm6G
+FHHAAClB46Cr6pzHD4f9r8GoDvHjvqFen1EObewAbGAhj22DfPA2vfV68wIDAQAB
+AoGADiqfB3argnAJuUEn0dZE5jB2IW03wUP6oDTANUdYVaAYsRzXhIRE1VMMDRua
+tV/aFGdB+8svkvk/Zntls/dImn42uCr9WlM26qsV9c8e8dcQRmHQgWn3uSimrYP7
+FMTYrpTv+WCBxmDkAioh/efN0R2UNiv4i1AwRBiagXFVLkECQQDYf13hDEgV2Djq
+LDcjNyHLLDPI8kCdCYiy8BNitv6iOVdW9KB5Wpa200qYPhyFicXz3eWZtgm62ODo
+rX875CdhAkEAyIRpD5vTmsezgmH4N2dZzAf55QtXEnM+t/rAf3tu6Tb/DVJnDlLr
+oEu3lTJk8egoYd2s1u7EbTfmkkTFovTG0wJAENdHjDwSV3CsbLrnxxuAy3cyyAzg
+LdcSBSlbuLAXerMPMjpxST9cvfgNs24RdenTtjaqp5xbgWdhh3gHj7cdwQJBAKXw
+znFYZ/oDoo8YPK69HRc40pm2lMx0C0d+gKf/on3mQZToyNiVzuHNR5R1LAz2L9Ut
++se0uWIZjPsnZtfA8nkCQEEtRUwc4wj8Mit2SWHViaK7EckNZrQ6ZkC55DxCDulv
+Qgy1MaPR7Imzh8RTvWywSMrvkE/+lwEZjMKzxb56sIo=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/expired2.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/expired2.example.org/key3.db
index 7b99ff273..54bf2cb79 100644
Binary files a/test/aux-fixed/exim-ca/example.org/expired2.example.org/key3.db and b/test/aux-fixed/exim-ca/example.org/expired2.example.org/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/ca_chain.pem
index dd7fe720a..47f6b1cc0 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.org/CN=clica Signing Cert
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.org/CN=clica CA
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMmC4zNWYntPtKW8nuwo
-JbC14Cwuck7DufEvR6WAtos3NUxjWpS4rQl7bW62AoaSdX0bSIxpyS2wtgQxIoFJ
-yU0Ukseh5lTpAvXEgKyjutRJswbQj0w94O0487KcyBqd1ZDJHJYs9VJ+BfrETwwc
-74Tk8FUQHaH6EQJ28GIJUIJfAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAISxe2t3sJCPBKD6wyb/
-lAsOu+Llby0cXetGKzGhC+HFHvI5OsjhMtOE5uGp7UYlJzbRrfMx/gSR9pjaXxah
-Bt7JFvcPI6wSDU4bBClsuvMTisenANOOscWHSEvB/YQes3OLnqC2RGSppKshjwVF
-fdbkhlMTV2Oyub2TvrscntOV
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7g6InDJBOPnTmNseci
+UYVZtfokI9WjOsisA4jt9BQMkdmACXfgO2LSF4n1qKv3dgZh+RsWnCQScft4PDfy
+KLvKy5HUrKJOhGrjEdOY4kfe8yzvPnvLFnVvoT+7oecYhb20onX4cwrYbDse0prB
+mUdzxCZ4lvb+Ohbevfq+TUR7AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIhvpc4aqmpWysW6pinq
+DwULNiL96lcNaZ8tZXfdHGgbzfgYir+sbKObg+wOHObkRmEY/FcIF9sbwJuetOiO
+gMTEQwB13J6VurRcfTygrqHe0F0bC/Zq/AJ/BEbdVhtQ5H68G7qMBZw2aVpflZBy
+e/xewJdeLc+y5zuobX05I7rP
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/cert8.db
index e103f0d28..f205eba15 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/cert8.db and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/key3.db
index dadd4489f..8f7a57ea4 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/key3.db and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.chain.pem
index 137b1354a..02f8e08fa 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked1.example.org
-    localKeyID: 92 C5 45 B6 00 77 BA 8B F9 80 EA 9D E1 C8 CF 26 8E 4A AB 64 
+    localKeyID: 62 09 23 AE C1 DA 20 CB E4 CB F7 7D 56 C2 EF B9 96 E4 60 8E 
 subject=/CN=revoked1.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZjANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOVoXDTM4MDEwMTEyMzQzOVowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
-ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMFKQOMflyggZWs8aPiS
-zZ2CH47ISXmXJNKk5/nTZZ+NgyOpV34fDOjLBsw9UT1NMCLiec3z7qCMT4eeFXWm
-g9d3mC4Gwlaw1Kn+DdFFQxvpGb5C22K7tHafoefdtprGTpcGQ90FDtmUCY6fGSbW
-A8UyxttXLmTE/pPz9OkfvQlxAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQxMVoXDTM4MDEwMTEyMzQxMVowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
+ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKzAXVcUFIbXHd4434hL
+AMLBwWwJfq9081hOorKkcOvZJ1AosMWzWRgnMuC5srj4zkGiJq2iR2CL26A+/34u
+b6QQbVaTdtYz4xPNY760BECVOzpXKkD+8LYpZpZY6BU6LKHgdtwwWit2jiryLLhH
+RTGwGQpd5zmNvk6yAB4AKcaDAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm9yZy8wHwYDVR0R
-BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEASoDf
-KWa0eBRyOr/s6iYBE/92HwEYzYRJTQ72WYOyWzgxgEQFNUGSoPDm5/Uz8RtCN7WA
-jP3izpoDT9RljW/381kJjfcyhApK6P20d9Wh6jTbVNEyh2MU8GaU5Yx7q2MWuxCW
-LUxer4bHOOBFsKtScIJJ/5FIUxV2X/jTvXdX9uU=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm9yZy8wHwYDVR0R
+BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEAR4pF
+hRr+vuDmtx4Z1H4PQrMviAolUggT5fK6Xt/VWI42rhRyIAmk9+L72UpeOJPay9zH
+Y90WWTmVF3Z0ygtJoqxMa4+yCHP0X5YvoMxU0F69gwZ1VwMSH0eaqfy96keC51IH
+GGJhDQnSCvdaZkwHSr9x0NbjkScHEIYbGGjgFHI=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.key b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.key
index 23cf71b99..cf605b57c 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked1.example.org
-    localKeyID: 92 C5 45 B6 00 77 BA 8B F9 80 EA 9D E1 C8 CF 26 8E 4A AB 64 
+    localKeyID: 62 09 23 AE C1 DA 20 CB E4 CB F7 7D 56 C2 EF B9 96 E4 60 8E 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQINwKIYat5xm0CAggA
-MBQGCCqGSIb3DQMHBAiAyXqFcnQatgSCAoA0oKUYqXC149u/VeKeqbKXi6fwO7tG
-cS9AwgTHkBNtfrvrL+9eWCfy/qlCPNI/VUGnW9iyspBYBQeUvn84NzhJrhdipMU+
-PfCoIYG9eI2gTpuAgrd9jKxS2pf7M9Aw1WZlH8DWU6r5yjWRSJHqdZs5snK37D0N
-tJ/1xQdKGLpi3OQwvaHNpVrQp5FgmkHaDVRwSaCmIbsIPbwS4Z5JW5f0KOcpoRFJ
-BeNaZcVrDq7lQUEQB777qS1Y82qnMEvQGzs2ZOYNOIS/wSe+LkcLaOpm2Zk0SQDa
-ZwFpcm4X8vIKFdCfXc7DLennynnsppI13KXzzkZA4xFqkuwzhzG8HrclqULg02db
-tMECAeqNzZ+fSAOUHU7Y5UL/XVuTNqZ1jL0MsUGMmfme3Am0me2eo2WH4gukeneI
-rirTr+brVu56yi+4MhrHdQn2R6ZHLy0FS2rZmrr/4LOeMOfIRpmxTpG6hYumO4ie
-TdmKr/YMz/8hXlQsMe0klY2D5+ulh7JJn1G6CMqGdNOTtFll7zfwLFT0DgO58sll
-8oekFLt2ms4hu82FXkHvhIucOMPF+dGKsiCQmhqCH5wyEhbuQGqqyOxeEz8/oQ5q
-1e9E6iQCi2gI502QukaS7WG3OhoxGZ9oaLpPnWmy2hDzWtJAMLnq7SNwM1uggzWa
-hchlbjxTXWOUcrJgi5plPIz4dp5eHdwC4wXef0e6HWBKC5c0mWi/aO3RQWEikQdu
-NhZmIKgTcYFntWn71Q9XKJfvF0cuej+e1/wa9cwIGGXOH9QHzRT3SDYFqKgQJCKR
-uUlxTbYcazh9WFxM1F1kJE3DydioSM7DEHsBAqipOW4EaxRtksi4tU5t
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQINt3ve3qUUP0CAggA
+MBQGCCqGSIb3DQMHBAgrqUmSSqVCSwSCAoBmJ39SMKPkCtt3ZVosxt3FRTOCDDLJ
+2o9MS+QMqLxHZC8bDefqM205j22PLE82XfVGIkgOKCRF7tXeH5hEMeSm/YzY+c15
+Nd3kjasxBCPH1DUnOCoFQ/aZ84krdSVPRPf1eVuWSLymMPDG7WchdQY0qcKHGPCS
+5tMOFGFhR+pYJTuEasK9PfSDx6bG3ia2Big+6O9SW8ubJ8f5T0v4dQ+NXOHJ690r
+y0YoqtZcQG+9RoXTKFVLpKFW3PEWkDVjOrTpkvzHrbtZGETvp7uM2z0QtCS4ylCq
+jDwfoeAGmJexcImVWWHSKESCWoK5vwvC/0wd/WO4I5WCL2rgRzQM1K6TyB+0p99n
+dzVqDKy++7Y7CHP61RZmP/rHL12xFhKAax+kW3QTqceT7Q3iXvM9h5NEoWAOPjkO
+qWr3nmeHDvzYof6WB4TojbcqNNVep9LHxfkIltiLemyniigf/uisq+Nbbwxuv538
+raOUjqV0FKPsNXeOM5dJ85dQ7MUZj9UNFE6siSDMb4r7wdLLrcEv0yOecXHNfnzL
+JFP51OfMJh6kVSxuagH8W7X5LG/W4NhRc4EAVvLiYyFnAaJvH/twdgepEgNMnF+H
+xMvn8JqBEiwXSUdU0rSOmmB1DDJi756oRFbWn0s9+yy5ZonkPnSUtUCTw9rBXijx
+s+9OvsF+a8igsTrPv48bBNxKumwSwasM329CUSj1bnoFMdXU5CeKAdrpFUvpKTlX
+//HmRqnJ46OyNP+uUrktg9pDAucCg36vXMn0VOVqrh+XiZX0NAIghCD9ZjWDtECp
+yvvIcdEmF5hNt2c8pnCvoabVC9SHUfF6rPUx9RQyUWFcFhiPLGqa4nx1
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.dated.resp
index 38142a266..0d1a5cd57 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.good.resp
index 935b0da1d..c19cb4c9e 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.req
index 417dc3e22..68f02ea86 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.req and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.revoked.resp
index b0266a9e1..f3e2287d0 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.dated.resp
new file mode 100644
index 000000000..63863a169
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.good.resp
new file mode 100644
index 000000000..643482e0b
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..6bdac0eb3
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..7fe063033
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..155b6c285
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..b4ae58517
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.p12 b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.p12
index ec58827dc..2c8620c06 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.p12 and b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.pem b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.pem
index af6bd6ddf..a9950ae8f 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked1.example.org
-    localKeyID: 92 C5 45 B6 00 77 BA 8B F9 80 EA 9D E1 C8 CF 26 8E 4A AB 64 
+    localKeyID: 62 09 23 AE C1 DA 20 CB E4 CB F7 7D 56 C2 EF B9 96 E4 60 8E 
 subject=/CN=revoked1.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiTCCAfKgAwIBAgIBZjANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOVoXDTM4MDEwMTEyMzQzOVowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
-ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMFKQOMflyggZWs8aPiS
-zZ2CH47ISXmXJNKk5/nTZZ+NgyOpV34fDOjLBsw9UT1NMCLiec3z7qCMT4eeFXWm
-g9d3mC4Gwlaw1Kn+DdFFQxvpGb5C22K7tHafoefdtprGTpcGQ90FDtmUCY6fGSbW
-A8UyxttXLmTE/pPz9OkfvQlxAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
+MzQxMVoXDTM4MDEwMTEyMzQxMVowHzEdMBsGA1UEAxMUcmV2b2tlZDEuZXhhbXBs
+ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKzAXVcUFIbXHd4434hL
+AMLBwWwJfq9081hOorKkcOvZJ1AosMWzWRgnMuC5srj4zkGiJq2iR2CL26A+/34u
+b6QQbVaTdtYz4xPNY760BECVOzpXKkD+8LYpZpZY6BU6LKHgdtwwWit2jiryLLhH
+RTGwGQpd5zmNvk6yAB4AKcaDAgMBAAGjgcAwgb0wDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm9yZy8wHwYDVR0R
-BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEASoDf
-KWa0eBRyOr/s6iYBE/92HwEYzYRJTQ72WYOyWzgxgEQFNUGSoPDm5/Uz8RtCN7WA
-jP3izpoDT9RljW/381kJjfcyhApK6P20d9Wh6jTbVNEyh2MU8GaU5Yx7q2MWuxCW
-LUxer4bHOOBFsKtScIJJ/5FIUxV2X/jTvXdX9uU=
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm9yZy8wHwYDVR0R
+BBgwFoIUcmV2b2tlZDEuZXhhbXBsZS5vcmcwDQYJKoZIhvcNAQELBQADgYEAR4pF
+hRr+vuDmtx4Z1H4PQrMviAolUggT5fK6Xt/VWI42rhRyIAmk9+L72UpeOJPay9zH
+Y90WWTmVF3Z0ygtJoqxMa4+yCHP0X5YvoMxU0F69gwZ1VwMSH0eaqfy96keC51IH
+GGJhDQnSCvdaZkwHSr9x0NbjkScHEIYbGGjgFHI=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.unlocked.key
index 9782fcb0e..a07ff6938 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/revoked1.example.org/revoked1.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWgIBAAKBgQDBSkDjH5coIGVrPGj4ks2dgh+OyEl5lyTSpOf502WfjYMjqVd+
-HwzoywbMPVE9TTAi4nnN8+6gjE+HnhV1poPXd5guBsJWsNSp/g3RRUMb6Rm+Qtti
-u7R2n6Hn3baaxk6XBkPdBQ7ZlAmOnxkm1gPFMsbbVy5kxP6T8/TpH70JcQIDAQAB
-AoGAewZ48FbeDdM42h1ULsq5hoQY8/c1FOgHru75G4Da0MfwbRVOs96th8oZpItu
-ltb3SWze3CBjhNppkEclH4IBrVnd6QesKygRZTJ0jTiu34vjsiO9pmif556cgInr
-eMlXE18LUsbcVQCKEEIbj9ZGaWWdxNbrshEgsemkNBNPXbUCQQDv6niIArEMEyB1
-XWZgBhGfPqQ117CTLygodIdhpPGmOUBxajbEgO6QQe4Mgo/QlBXnS0blCZ0CjQ8J
-eklXczwDAkEAzj+SZJ2E7lTKfzJLYS8rNCD3maYrrDRFDdgbJn+Pk9GteIj+6jD9
-YMOEPgsqeVj6rXfFoyIqe7UzIT8W0m+8ewJAd3gf+0Kz3Vps8GTJRQngnpb3+KPm
-lvSFn9efTt1vRCIAWDnW+fVmVsmt++bMLMaBPcM7k3Q9DnclxMdzXCvS9wI/Nfpt
-Vefj4nxOgvumvsiZhgsawhu7UlZbvEPS10CLUySNQf6YuLIZnjmNYq+JbjjbYor2
-LrvCYp4Jw6m/T1PvAkAbdprMpbU502lJQ6V27XQmBXo4w7Ea56DefbsB5d6heBCM
-godeig9Ax7DiRSOwxv3OzMeKgg1N3YxBDkNuwuJa
+MIICWwIBAAKBgQCswF1XFBSG1x3eON+ISwDCwcFsCX6vdPNYTqKypHDr2SdQKLDF
+s1kYJzLgubK4+M5Boiatokdgi9ugPv9+Lm+kEG1Wk3bWM+MTzWO+tARAlTs6VypA
+/vC2KWaWWOgVOiyh4HbcMFordo4q8iy4R0UxsBkKXec5jb5OsgAeACnGgwIDAQAB
+AoGAOr/w/nxFvtXJwpl069UWHSXnseZIv0L2v0F+82IZRRxE0m4EMDgeRKiQFP0S
+WvXCr2+F1+cofx0RRB4opbEFJic+kXq+B1JHjzODN5A0hUyMxmn6mvVQ6WmKzL81
+nhZKXq2Y0KWHG4gpUwIXAfcXIx9NGauwj7jO3VtT6InjKYECQQDiunzwfC0D2lHm
+V/8o1BQ7ej8ITwo9wCxwMRqefCk5EEtmIAMp5OU+GEi9Bev89BhEJZCh+usZQG7V
+OrAso39FAkEAww3nIQ4eEM4dqdIZXvFxQRqhXS3bPC7mCvDc1KykYPHUFtSSG1HL
+GVi3/edZRLLvQ1WCRUUffArxklPPntSHJwJAJtAL4VMwlY9DI+5+dKvRhtkHf1Gg
+jC+gq9gMGYNhvy4F6kaipAJWKAoaMZmY62WR3eCcYM5Gfr0j/Aae8BVRDQJAIZV/
+Oj3IB3S1vsuh+qrvqRoAtp5ypQYeLbwTCbtAAkEhF106WuHWamLQKzNuN1nnwFw0
+teCU7zKjLWKo2NwW+QJAIAu5TSZI53Tfn/hRBqvIbgOUIkisPkOQUikCSj8/OGNc
+JT/EdpMGPF62VtSPPJnCe4q2+r2tUfmuWGNJvvzI5g==
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/ca_chain.pem
index dd7fe720a..47f6b1cc0 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.org/CN=clica Signing Cert
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.org/CN=clica CA
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMmC4zNWYntPtKW8nuwo
-JbC14Cwuck7DufEvR6WAtos3NUxjWpS4rQl7bW62AoaSdX0bSIxpyS2wtgQxIoFJ
-yU0Ukseh5lTpAvXEgKyjutRJswbQj0w94O0487KcyBqd1ZDJHJYs9VJ+BfrETwwc
-74Tk8FUQHaH6EQJ28GIJUIJfAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAISxe2t3sJCPBKD6wyb/
-lAsOu+Llby0cXetGKzGhC+HFHvI5OsjhMtOE5uGp7UYlJzbRrfMx/gSR9pjaXxah
-Bt7JFvcPI6wSDU4bBClsuvMTisenANOOscWHSEvB/YQes3OLnqC2RGSppKshjwVF
-fdbkhlMTV2Oyub2TvrscntOV
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7g6InDJBOPnTmNseci
+UYVZtfokI9WjOsisA4jt9BQMkdmACXfgO2LSF4n1qKv3dgZh+RsWnCQScft4PDfy
+KLvKy5HUrKJOhGrjEdOY4kfe8yzvPnvLFnVvoT+7oecYhb20onX4cwrYbDse0prB
+mUdzxCZ4lvb+Ohbevfq+TUR7AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIhvpc4aqmpWysW6pinq
+DwULNiL96lcNaZ8tZXfdHGgbzfgYir+sbKObg+wOHObkRmEY/FcIF9sbwJuetOiO
+gMTEQwB13J6VurRcfTygrqHe0F0bC/Zq/AJ/BEbdVhtQ5H68G7qMBZw2aVpflZBy
+e/xewJdeLc+y5zuobX05I7rP
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/cert8.db
index f314d13ec..e8741033a 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/cert8.db and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/key3.db
index 52af4d5cc..361b23099 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/key3.db and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.chain.pem
index dea7b7810..9c1fb4786 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: revoked2.example.org
-    localKeyID: A3 A0 ED 35 B4 59 E0 6E 23 7B D1 A8 7B CE 0E 67 DA 8F B3 72 
+    localKeyID: A8 C5 3E ED 81 EA 3F C1 29 F3 99 8B 80 DE 3E 49 33 2A 01 BA 
 subject=/CN=revoked2.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMowDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDBaFw0zODAxMDExMjM0NDBaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
-bGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDICO4Ac31eD1JPcg3f
-sZkA2ca3PXYlOx9lochRiJeZkIWJCEsfGDC5kESEI5w88XJ4b73kZdicJfxCyRZM
-qjinifY+J9Hx51Q1eyhK0OU/3y1mcz8xBTIYKXcQEcxLpFcjrxSh0JA9VDWFlZMw
-2iOOCFwyV0hOJqilOGZUqVuTjwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MTRaFw0zODAxMDExMjM0MTRaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
+bGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWREymQBM1gpiZ6S4o
+NXLaz/Ib3aV0rYWemC20Fwmrm94vJogfLKO9tCEdZzpGOxhe9Y96qwoCIMj0Ygh8
+edEWGq0g5Ke0985W9vH58tHjSIUtRWeCFqsBLQjWS4Vd4qliUMnQiwn5vRjbZrG0
+j/VJnogI+YnXAItuWWerohQ84QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5vcmcvMB8GA1Ud
-EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBADnf
-cBedQm4PI6op1YDJMPCuJ0lpexHDF4Md6F8RmhSxAU1+fIC6CD8snQtEWRuEq/TR
-nI6RQ4qCBFZi4vGAn5m8NDA89xX4uv101uYPrvymRbDiFhpSOCJ45Ia83LLtS58z
-dF1i8AuksC7Oy+3ou5pcg7Hl3mpgyIoj2FnGrHnG
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB8GA1Ud
+EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBACF2
+0KANuezWEJ42ouOza31RHJEAt1KG4Bg4s6sGjUV4mV87sdob5cdUTZOJFMZK/QmJ
+q4s6PtYTh3fGqg07T6C8k0zrmN30KPGlpdhPZjOqXzZXu56yYMgHZC6D85udK+vh
+zgDbkg4/4chZBdOsM+ErMDJNZulK3vsYbTVvviDm
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.key b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.key
index 77eb20697..7b6dc038d 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked2.example.org
-    localKeyID: A3 A0 ED 35 B4 59 E0 6E 23 7B D1 A8 7B CE 0E 67 DA 8F B3 72 
+    localKeyID: A8 C5 3E ED 81 EA 3F C1 29 F3 99 8B 80 DE 3E 49 33 2A 01 BA 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIT4udedrNkGwCAggA
-MBQGCCqGSIb3DQMHBAgLZwHx6XtwoQSCAoC5OzCUa4Y7cgjEaa7cHlt9tAVvIrMv
-R+bQiaXJmCWLtscST1fincREqgpQJJu2JDIWvGfg08E9lPWML2KS6bxE/PxVr+aA
-ZKanoID3uZY5kTmGKFkgk8y5fuEzSIpVkgBUe1i6dyC+Fo5+j19jNJgG2mqfsY+e
-Fye6dEmxPUIU/vRU4DowqNRqTh3unaoUkkymqmHiqQqYOnUguo6FSHZhhVaMNn2F
-tpjadGliehd5HtPoVsv3ns9wbbaS7EtPjDm1DnDx2DtzsYIOEUuvLFoE6vgZZB+9
-PHTW9jeOEM+I5fblavI0PHAYTYDp/FjL3CwgysLPPc0s3VeErs9Lz/oFSHns4+dd
-bA9cLPHdq5VZNmPgXP34wup2gX0DmuMB71XaRG1VCsM6hMyNT18pQNZ5UJoDnwru
-3tRie0W8isVC0Bpr4T4Mrhb/CtV/DMsz86WE8Jk2YdpgzfxtTnAtFT8qvPN5RXUG
-9jieHv1KMBek3i7pNmabNODM0T+P1w2kE9Cm4OlxjniDuUS2uIWVLWCrrup6ikhX
-5Qq89pdAoGuK7SM/vzNKxTjrWBEYF4ZVol6LpEtuPFFJqUZLUWdjOUAmebc6xzcl
-HoOvwqgCyVdF+BFSIEhw28Q3panQ3vemikOKoQI2V2wvW4H+jnAycXE7Jr7vgUEg
-lYPwDmQGxzQXT3nTZRLHi9k0wDHs+QFy0Z5k4HrZ7XIGEi45bgvIG64x9HqhNgb+
-dnQA8CUBhCFyTp53UNpis0ksVpBh/2tKtLSi7jYvPW2yjFpD2yVUg4K5grNtIb02
-+Sqj1eR5nq51Yqb0P668l7PhO/zjeKFpJi9cvtYYVMfK9gO6t2nAm0/G
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIOqUsEZxApfECAggA
+MBQGCCqGSIb3DQMHBAiS2tvMTVDiQQSCAoAteyeon9iTmTlqZqspp3GLMUDreM9W
+2C0RZdAZJTr+joPK7yIKZe7lEEBL4ednib7l3Jz3ogSyAyuBiZTU4NBpDlxLYgnT
+0PLncSe2z+Lw29+oNYcD5EMrjFpyQnlZa01kv2B5QK+HTkusCUbkBIkpb4yxCXrb
+3ra0eB4me73+I9URPQHOlcDxKDAo0QZQIAgp5OfE2G8UeWu5Wnc+Fj6OsakhfloI
+s2ujZQFWlc7b57BeL/i4bKaJEkNcQqZjp72Rh0NAZRLEjs/WawBQpbB3Uqxg/vID
+4YeTmPh5tHwWiyEUBeXVilGEF9i6Dn9TILHVjsgHHM5CUe0EA+JPfzsyj8MZYsfK
+VJ1l9ZYx9r4eJPg3mHc+DzWGmK58mav2FeTGHaFW1gxmR38n4T5rIUXgnX6dzJS8
+caGS4Yt8EvGyUOmvelTv0LaVHwav28fAEzQ+rO9ofGDBpcpbAHZuFjnYrb/YuoWa
+FND9XQFVCUWi/rasadg0sTlR8k/6/BcMuGheUlyc/LEOVsD8nRO7109sIAjzlXOQ
+ejf6uzVEkOtr7EC0TYyFPudFewOvjzdPgR+TMIG+7mwaCt5XKZuaJhGCaL+rReyQ
+HNTvBId2NmBLX6atcg2AAP4KFkPvBXpqK3cFvFTagA8q9lA3qYGIRehxu9e5NQeq
+oI5WfniiFunZ8I4Qjj4wTDnJtyRkkxXt3ng8uuqBpXmQjFcDbupoqD9V6MZciJIb
+pgf+H2oUSuz+QaJW003SbxrnCcYp69rVfkZBs68ob+hU4GkhOKFvNdJEqhfNEr6Y
+3gKjomLAUXQMK6CrEQm+uTaDXVjb64ANPp67DJaMmY9IM4pkszdL+Ci/
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.dated.resp
index f9300cdb4..fd246fa0e 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.good.resp
index da15ea254..63860eaa4 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.req
index 0d207eab1..1903acc0a 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.req and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.revoked.resp
index da15ea254..63860eaa4 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.dated.resp
new file mode 100644
index 000000000..19d87f887
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.good.resp
new file mode 100644
index 000000000..c201e960d
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..c201e960d
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..96bf11063
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..1dbe916c7
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..1dbe916c7
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.p12 b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.p12
index b3ff2673b..6e30b03ab 100644
Binary files a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.p12 and b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.pem b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.pem
index b701d974b..30872bca4 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: revoked2.example.org
-    localKeyID: A3 A0 ED 35 B4 59 E0 6E 23 7B D1 A8 7B CE 0E 67 DA 8F B3 72 
+    localKeyID: A8 C5 3E ED 81 EA 3F C1 29 F3 99 8B 80 DE 3E 49 33 2A 01 BA 
 subject=/CN=revoked2.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICijCCAfOgAwIBAgICAMowDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0NDBaFw0zODAxMDExMjM0NDBaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
-bGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDICO4Ac31eD1JPcg3f
-sZkA2ca3PXYlOx9lochRiJeZkIWJCEsfGDC5kESEI5w88XJ4b73kZdicJfxCyRZM
-qjinifY+J9Hx51Q1eyhK0OU/3y1mcz8xBTIYKXcQEcxLpFcjrxSh0JA9VDWFlZMw
-2iOOCFwyV0hOJqilOGZUqVuTjwIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
+MjM0MTRaFw0zODAxMDExMjM0MTRaMB8xHTAbBgNVBAMTFHJldm9rZWQyLmV4YW1w
+bGUub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDWREymQBM1gpiZ6S4o
+NXLaz/Ib3aV0rYWemC20Fwmrm94vJogfLKO9tCEdZzpGOxhe9Y96qwoCIMj0Ygh8
+edEWGq0g5Ke0985W9vH58tHjSIUtRWeCFqsBLQjWS4Vd4qliUMnQiwn5vRjbZrG0
+j/VJnogI+YnXAItuWWerohQ84QIDAQABo4HAMIG9MA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5vcmcvMB8GA1Ud
-EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBADnf
-cBedQm4PI6op1YDJMPCuJ0lpexHDF4Md6F8RmhSxAU1+fIC6CD8snQtEWRuEq/TR
-nI6RQ4qCBFZi4vGAn5m8NDA89xX4uv101uYPrvymRbDiFhpSOCJ45Ia83LLtS58z
-dF1i8AuksC7Oy+3ou5pcg7Hl3mpgyIoj2FnGrHnG
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMB8GA1Ud
+EQQYMBaCFHJldm9rZWQyLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBACF2
+0KANuezWEJ42ouOza31RHJEAt1KG4Bg4s6sGjUV4mV87sdob5cdUTZOJFMZK/QmJ
+q4s6PtYTh3fGqg07T6C8k0zrmN30KPGlpdhPZjOqXzZXu56yYMgHZC6D85udK+vh
+zgDbkg4/4chZBdOsM+ErMDJNZulK3vsYbTVvviDm
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.unlocked.key
index ee6d84efc..d3feb16eb 100644
--- a/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/revoked2.example.org/revoked2.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDICO4Ac31eD1JPcg3fsZkA2ca3PXYlOx9lochRiJeZkIWJCEsf
-GDC5kESEI5w88XJ4b73kZdicJfxCyRZMqjinifY+J9Hx51Q1eyhK0OU/3y1mcz8x
-BTIYKXcQEcxLpFcjrxSh0JA9VDWFlZMw2iOOCFwyV0hOJqilOGZUqVuTjwIDAQAB
-AoGAaKGDHGlMYi7RdwzJhQB4b6F5988GRWMvgRGmnj88TO7zakIUSSd2FRoJPLUD
-vDzvC2Ani5haPRMBaE2WhHNlPhAyJIU6dSCPFhGHl89HOq4ROGBwUDDwyl23wkdS
-yu6iIbrXDkKWPcNYiIX+VwKha0Fw/Pn3zTWQIetrPoSRXQECQQDuobW9iHkUPHRY
-32FB0Y4t+VxExGD8CdPBHvfhFBPwNu9zn3eeOa6l00gqmfT4QOBg9z9YWEth8zYG
-8jXHV3HxAkEA1pgRO2VqC6NifvbQp4TknRm0YLf8LTwjFPyCD/FBbl4Yahx/YNgy
-mtxEPVaTR5C58IxU8+i6cF79Ww5dBG3dfwJAH47dNQqGUKnKDTLFbunirqvKiwGZ
-fdti2KhaybZZCKyLMDRHonIoaZ+ubIvdvLL/uXMZOnq6xWJfo72GZS1oUQJAFdmb
-/5E+7/pt4AGfkz8LzBc+744sRirWY5+mWps1D1jTYZKPQbwhwvTkmd5D1sictiqD
-x+YNfb2eTHQ08muBXwJBAJxD+8SWPppwX9oMprp4beBP6s2S+02kJGw+MmMpbs2i
-tX4cT89Pca/xgnQPwDoWR/WFlAGSQj/RWq3WhoFSbCo=
+MIICXAIBAAKBgQDWREymQBM1gpiZ6S4oNXLaz/Ib3aV0rYWemC20Fwmrm94vJogf
+LKO9tCEdZzpGOxhe9Y96qwoCIMj0Ygh8edEWGq0g5Ke0985W9vH58tHjSIUtRWeC
+FqsBLQjWS4Vd4qliUMnQiwn5vRjbZrG0j/VJnogI+YnXAItuWWerohQ84QIDAQAB
+AoGASAqQxvkWPFCbpGwdY9GMu3tdSPc+ETviiE9cVofEbZmrm6jV7b1hlIAC/lLd
+6g0mhY8E3dayN8L0Lg7kEY4XuTwdGD9pfRLsoPQzWcmr0gw5p/36CcZQIP+Pt1vV
+stExLwGNLOybPlmHN57dHN7mmx7M+6QFG6/F/VxxEp8Sy/0CQQD4YnwDMTJV8NIZ
+lZzDItcrmd5984nO5+nUJeCVCQgPw4I1uZiY0E/Cx6kcdwxD45eEBa37E/xRMIFg
+RvX4A/+jAkEA3NYH/KnYE7ZeP7PeubJ3W2pJ5GqBEK7Nge+T6DieYPYdapXsVu1V
+wy8JxA6s2egCsSsubYHKCbYQ/sTemqFJqwJASfsLdOfyViakbXpidryp2hK6cklX
+gokQ3F9rxPgrroZNAjOFf/6Lwzg05oWO4amoN2p5p48MWCJaZpK8MGMAgQJBAJso
+jggJ1VVURrf/SreyGoZSEYS5B+GOz7lBeOwqC60YfuaKW7lfm2g9vmDP5sZbarjM
+HBy4mhlkoGBANh7yv20CQCqx6S5HWBL3pq9SIvIRsB+WkwW2n30+qrTu723eeT1/
+NvDlRNEI5NxCrCyaokKgXZU7sRTP0JgcZoczHY5gyZ8=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/server1.example.org/ca_chain.pem
index dd7fe720a..47f6b1cc0 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.org/CN=clica Signing Cert
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.org/CN=clica CA
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMmC4zNWYntPtKW8nuwo
-JbC14Cwuck7DufEvR6WAtos3NUxjWpS4rQl7bW62AoaSdX0bSIxpyS2wtgQxIoFJ
-yU0Ukseh5lTpAvXEgKyjutRJswbQj0w94O0487KcyBqd1ZDJHJYs9VJ+BfrETwwc
-74Tk8FUQHaH6EQJ28GIJUIJfAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAISxe2t3sJCPBKD6wyb/
-lAsOu+Llby0cXetGKzGhC+HFHvI5OsjhMtOE5uGp7UYlJzbRrfMx/gSR9pjaXxah
-Bt7JFvcPI6wSDU4bBClsuvMTisenANOOscWHSEvB/YQes3OLnqC2RGSppKshjwVF
-fdbkhlMTV2Oyub2TvrscntOV
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7g6InDJBOPnTmNseci
+UYVZtfokI9WjOsisA4jt9BQMkdmACXfgO2LSF4n1qKv3dgZh+RsWnCQScft4PDfy
+KLvKy5HUrKJOhGrjEdOY4kfe8yzvPnvLFnVvoT+7oecYhb20onX4cwrYbDse0prB
+mUdzxCZ4lvb+Ohbevfq+TUR7AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIhvpc4aqmpWysW6pinq
+DwULNiL96lcNaZ8tZXfdHGgbzfgYir+sbKObg+wOHObkRmEY/FcIF9sbwJuetOiO
+gMTEQwB13J6VurRcfTygrqHe0F0bC/Zq/AJ/BEbdVhtQ5H68G7qMBZw2aVpflZBy
+e/xewJdeLc+y5zuobX05I7rP
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/server1.example.org/cert8.db
index 50aee3342..254ea6b51 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server1.example.org/cert8.db and b/test/aux-fixed/exim-ca/example.org/server1.example.org/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/fullchain.pem b/test/aux-fixed/exim-ca/example.org/server1.example.org/fullchain.pem
index 040bb37d1..20e8583f5 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/fullchain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/fullchain.pem
@@ -1,25 +1,25 @@
 Bag Attributes
     friendlyName: server1.example.org
-    localKeyID: 9F 34 37 BE 94 61 34 9B 09 60 34 72 70 F3 CC 59 C3 4C CA 62 
+    localKeyID: 2A 6F DA 4F 4A 79 1E 96 98 93 94 B5 B3 DD 7E 3F BA E9 B7 DE 
 subject=/CN=server1.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIIC2zCCAkSgAwIBAgIBZTANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOVoXDTM4MDEwMTEyMzQzOVowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
-Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1cRJSx9NEPXBa1WUPmas
-rmsJJiz2XerQaxGYkgBOeE4xGUjlGDrL38g2bl7iI2trNYEQZfouKl/u3RmOoy63
-I3DnEXJtir8YeqlWKwN8v6vYqJY8Dg4F4SxxCxfREcQmPRsK5iI/ooBylRcxiQsz
-OacYB5JDNpSCi3bNmDobKwUCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
+MzQxMFoXDTM4MDEwMTEyMzQxMFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
+Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqR50t7jEnAr98WjQzvsb
+N9SIcPLriSJVaOXOTrPC8fuaBbt8FDcGP/Gc8U/DwbbvcXLHIWd4Vk040M0cZIqp
+yIWz7hNM2qYaKlIKDEpn+h1RfGyClWoC2K/Nzh9hgWylzP21bTwLlb3IoGhIlUFq
+A1KEWXdK9NJOBdybDmBJucMCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5vcmcvMHAGA1Ud
-EQRpMGeCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5vcmeCIWFsdGVy
-bmF0ZW5hbWUuc2VydmVyMS5leGFtcGxlLm9yZ4ITc2VydmVyMS5leGFtcGxlLm9y
-Z4IJKi50ZXN0LmV4MA0GCSqGSIb3DQEBCwUAA4GBACtUUNjJzARl0cPfxC9uERbp
-g81Ig3+W0gyZCaU6VX8VB/w2k7sQZGWfYCWAOHqXmTdwGZ80aSjgZRBpPRdx8z7S
-KKBoicjvTLJZIm4GrNKlvmlANhqrXD/JIzpqCHgC57Ly37Ro9JAYcFCOCvGx2Y2t
-MJKULq5mBRLVrKPJtaXU
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMHAGA1Ud
+EQRpMGeCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5vcmeCE3NlcnZl
+cjEuZXhhbXBsZS5vcmeCCSoudGVzdC5leIIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIx
+LmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBAEn/U765e9k8EEQAkeEXyk4/
+oFdOUW0CwpZi0NEJwyeC0zBbUk32ZXfzNLI0lnol/HBuL2J/K7tn9UATrH5x1OUk
+cUEYmnyzXO3SnFP4O43/BAvZ502AdZScafLbfAiGabdw9ILE/X+p7mP+PzBvcOre
+nlli+ow6thH+fYgpjRFU
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Signing Cert
@@ -27,17 +27,17 @@ subject=/O=example.org/CN=clica Signing Cert
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -45,14 +45,14 @@ subject=/O=example.org/CN=clica CA
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMmC4zNWYntPtKW8nuwo
-JbC14Cwuck7DufEvR6WAtos3NUxjWpS4rQl7bW62AoaSdX0bSIxpyS2wtgQxIoFJ
-yU0Ukseh5lTpAvXEgKyjutRJswbQj0w94O0487KcyBqd1ZDJHJYs9VJ+BfrETwwc
-74Tk8FUQHaH6EQJ28GIJUIJfAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAISxe2t3sJCPBKD6wyb/
-lAsOu+Llby0cXetGKzGhC+HFHvI5OsjhMtOE5uGp7UYlJzbRrfMx/gSR9pjaXxah
-Bt7JFvcPI6wSDU4bBClsuvMTisenANOOscWHSEvB/YQes3OLnqC2RGSppKshjwVF
-fdbkhlMTV2Oyub2TvrscntOV
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7g6InDJBOPnTmNseci
+UYVZtfokI9WjOsisA4jt9BQMkdmACXfgO2LSF4n1qKv3dgZh+RsWnCQScft4PDfy
+KLvKy5HUrKJOhGrjEdOY4kfe8yzvPnvLFnVvoT+7oecYhb20onX4cwrYbDse0prB
+mUdzxCZ4lvb+Ohbevfq+TUR7AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIhvpc4aqmpWysW6pinq
+DwULNiL96lcNaZ8tZXfdHGgbzfgYir+sbKObg+wOHObkRmEY/FcIF9sbwJuetOiO
+gMTEQwB13J6VurRcfTygrqHe0F0bC/Zq/AJ/BEbdVhtQ5H68G7qMBZw2aVpflZBy
+e/xewJdeLc+y5zuobX05I7rP
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/server1.example.org/key3.db
index 8b123f887..30d07e1d7 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server1.example.org/key3.db and b/test/aux-fixed/exim-ca/example.org/server1.example.org/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.chain.pem
index 602b0e257..0bda2214e 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.chain.pem
@@ -1,37 +1,37 @@
 Bag Attributes
     friendlyName: server1.example.org
-    localKeyID: 9F 34 37 BE 94 61 34 9B 09 60 34 72 70 F3 CC 59 C3 4C CA 62 
+    localKeyID: 2A 6F DA 4F 4A 79 1E 96 98 93 94 B5 B3 DD 7E 3F BA E9 B7 DE 
 subject=/CN=server1.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIIC2zCCAkSgAwIBAgIBZTANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOVoXDTM4MDEwMTEyMzQzOVowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
-Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1cRJSx9NEPXBa1WUPmas
-rmsJJiz2XerQaxGYkgBOeE4xGUjlGDrL38g2bl7iI2trNYEQZfouKl/u3RmOoy63
-I3DnEXJtir8YeqlWKwN8v6vYqJY8Dg4F4SxxCxfREcQmPRsK5iI/ooBylRcxiQsz
-OacYB5JDNpSCi3bNmDobKwUCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
+MzQxMFoXDTM4MDEwMTEyMzQxMFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
+Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqR50t7jEnAr98WjQzvsb
+N9SIcPLriSJVaOXOTrPC8fuaBbt8FDcGP/Gc8U/DwbbvcXLHIWd4Vk040M0cZIqp
+yIWz7hNM2qYaKlIKDEpn+h1RfGyClWoC2K/Nzh9hgWylzP21bTwLlb3IoGhIlUFq
+A1KEWXdK9NJOBdybDmBJucMCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5vcmcvMHAGA1Ud
-EQRpMGeCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5vcmeCIWFsdGVy
-bmF0ZW5hbWUuc2VydmVyMS5leGFtcGxlLm9yZ4ITc2VydmVyMS5leGFtcGxlLm9y
-Z4IJKi50ZXN0LmV4MA0GCSqGSIb3DQEBCwUAA4GBACtUUNjJzARl0cPfxC9uERbp
-g81Ig3+W0gyZCaU6VX8VB/w2k7sQZGWfYCWAOHqXmTdwGZ80aSjgZRBpPRdx8z7S
-KKBoicjvTLJZIm4GrNKlvmlANhqrXD/JIzpqCHgC57Ly37Ro9JAYcFCOCvGx2Y2t
-MJKULq5mBRLVrKPJtaXU
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMHAGA1Ud
+EQRpMGeCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5vcmeCE3NlcnZl
+cjEuZXhhbXBsZS5vcmeCCSoudGVzdC5leIIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIx
+LmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBAEn/U765e9k8EEQAkeEXyk4/
+oFdOUW0CwpZi0NEJwyeC0zBbUk32ZXfzNLI0lnol/HBuL2J/K7tn9UATrH5x1OUk
+cUEYmnyzXO3SnFP4O43/BAvZ502AdZScafLbfAiGabdw9ILE/X+p7mP+PzBvcOre
+nlli+ow6thH+fYgpjRFU
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.key b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.key
index d4013f8e4..b34ec69dc 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: server1.example.org
-    localKeyID: 9F 34 37 BE 94 61 34 9B 09 60 34 72 70 F3 CC 59 C3 4C CA 62 
+    localKeyID: 2A 6F DA 4F 4A 79 1E 96 98 93 94 B5 B3 DD 7E 3F BA E9 B7 DE 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIWFsB796OzDICAggA
-MBQGCCqGSIb3DQMHBAiKH0PsNTKf+ASCAoDpIiasiiHh2zZlrmZx+Zfsk/r+lQIJ
-5qcXy8gpGceJIRiI7eaY9MF8P19G1O8z69O7RRlJj84nLIETErPB4ypt0flyeRqR
-dvz3EGsIu2OmJjM6MFiIJDtNQtjqsBOimpCAnirDCCOzpNLGrK7K9NuMd4johuex
-NrwYrC31Uc09YDXF2BmhKWO9WTUQbmX+3msZVWVfWkIpZHfzfo9P6yfQR7cHF7d4
-HSPpGyFdPNwqMmNGKsoLzdAcU+u7JW9q7eUPeuWpmu2wEvqg4SFBWBHFSYJJAtbK
-y5+vhsQyXbzYbkEF8bLJjQHYMPPc+wOSVMJW5b40bdqweiSr8k9O16qj4kBdS40f
-iSAgzgUkKzQjuO0aYUk6n/3YjbSVHNAhtLGb3nsxsWBinJCXLFSYZ9zmwmjSL/0A
-HIG68RnzgF+Wh3O14eoTyUkEX9gKLZrKbaDfGqO2rI4zXEM/fhK0pP5D1t01KT2L
-Ff+SrqJV0vr+RbzqHjOnHjUMcR1MdF+jNG/VgcYA7UZ37chA9531STDHIeeaXJSx
-r9ENM8Kg2OkRenvCPsyCVL/u36ae2EWlBZJjrH9jSrWu+1W90LozDtXi9PEe3zuw
-oY88zgACDZQLrAzxbs3eQx6CnROw57IqUyFlcKft98axIQ/6J3A7EX7yRJIfqwX0
-w0ir/JxU70SUKuhahMy2ECakKhJWR04Sexw766jcXe9Wg1yqB//aWaUB8s0j3oe3
-Emcmbx0Tx0SCuBOhGlf8jxxavHeWkDA2FSZz3EjkkZUmXc/PKaQs8BMR1lXdehbr
-4ElEmHGTmMwSq2UO0YGI4YLN3/DNiqFykGdeWyG5Q47vteWVVBlwbdJ/
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIiQi2yo4iWpUCAggA
+MBQGCCqGSIb3DQMHBAhU5AKV9mRkdgSCAoCir+zzDqSL5hmUS/4WmPoRsVYB/w27
+mCi9x5+2gPSzNk4zOoMjArwEjDKtdc970fRkxglesl7pj9JLVfrnuAP/F4r91q/W
+TTraltXGK87/2a3YEVcgPQlzleEeeOWKQAePbK/uRzCmKgItyRQJ2Dr189opE3HH
+OwKr3hfRvZvHxzrPMmIVeeG7xRDJRkyVXNOoni+jmZOROElvXnJ/+gHhZZYiQfkn
+tuXGTxOTGC1AmMcu5PK69B7S079SwX7MLZQ6W7AJpl3rrsPlEg8LfxCc3uT5rqfv
+1PNtjUr0VlVPx+K6gI3Fxr3WX+hLlPI2lBYBmOKDbFL5lfXoSGA08aaC3vdO0cQA
+L+4w7fHyn19if7JZ6ucoXn+9OM50PsGKB0TlOgvKH2u0z4p1/nfK5e2849BMBKVs
+uNuhTlxPkXh7qNCEfhprFQY0AB0P0OKk2CfKoucAVYD0zHjwaxMtEH/vP0oWvk5t
+B6iiT9WXzggXiRQyvSd6LQB1sqgzGMKTdtwWHZ4lO+jtwqPgr0NeQCnszD/sD/1x
+qNLSNAZBVH+2NL319j2itogoe3k76NQ8QbNPfEcKVEsfrT6IByho9tV759RRsFze
++ufN1Fkkms8xMkl0L/CLAgHvoYuFjCyjVDRJ1IdrIhjT9Rjbgpq5Kbhlwkk0oUVd
+4A+irv61PdguBo7vVFRVSRE35cJxrcG9Z4WB74OIG6tcYomq2PStJ1IOe/WJI6VZ
+g/3iOQms11qN4uZ0kZsDo3qN8qaPkvc8inQXOV0T5l2Fzr/kc+trRIaFQSsQBYhA
+vW9SZwSD9iPBO0xIkxgdvVL7op4y8qCIY4dpU5bpxinND/tlSh+F66uO
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.dated.resp
index 07ee69ff2..ac9155f40 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.good.resp
index 05c9a4b81..bbea88e11 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.req
index 4ff7fc0c3..54239452c 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.req and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.revoked.resp
index 4a3bedf0d..7a9343d01 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.dated.resp
new file mode 100644
index 000000000..aabc0804b
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.good.resp
new file mode 100644
index 000000000..016415a50
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..e5aaa84d5
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..fb5a5ae60
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..5a63a2809
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..686c10de4
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.p12 b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.p12
index 4524185f8..edf0ac330 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.p12 and b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.pem b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.pem
index bb93f58a2..53ea242e0 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.pem
@@ -1,23 +1,23 @@
 Bag Attributes
     friendlyName: server1.example.org
-    localKeyID: 9F 34 37 BE 94 61 34 9B 09 60 34 72 70 F3 CC 59 C3 4C CA 62 
+    localKeyID: 2A 6F DA 4F 4A 79 1E 96 98 93 94 B5 B3 DD 7E 3F BA E9 B7 DE 
 subject=/CN=server1.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIIC2zCCAkSgAwIBAgIBZTANBgkqhkiG9w0BAQsFADAzMRQwEgYDVQQKEwtleGFt
 cGxlLm9yZzEbMBkGA1UEAxMSY2xpY2EgU2lnbmluZyBDZXJ0MB4XDTEyMTEwMTEy
-MzQzOVoXDTM4MDEwMTEyMzQzOVowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
-Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1cRJSx9NEPXBa1WUPmas
-rmsJJiz2XerQaxGYkgBOeE4xGUjlGDrL38g2bl7iI2trNYEQZfouKl/u3RmOoy63
-I3DnEXJtir8YeqlWKwN8v6vYqJY8Dg4F4SxxCxfREcQmPRsK5iI/ooBylRcxiQsz
-OacYB5JDNpSCi3bNmDobKwUCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
+MzQxMFoXDTM4MDEwMTEyMzQxMFowHjEcMBoGA1UEAxMTc2VydmVyMS5leGFtcGxl
+Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqR50t7jEnAr98WjQzvsb
+N9SIcPLriSJVaOXOTrPC8fuaBbt8FDcGP/Gc8U/DwbbvcXLHIWd4Vk040M0cZIqp
+yIWz7hNM2qYaKlIKDEpn+h1RfGyClWoC2K/Nzh9hgWylzP21bTwLlb3IoGhIlUFq
+A1KEWXdK9NJOBdybDmBJucMCAwEAAaOCARIwggEOMA4GA1UdDwEB/wQEAwIE8DAg
 BgNVHSUBAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYDVR0fBCswKTAnoCWg
 I4YhaHR0cDovL2NybC5leGFtcGxlLm9yZy9sYXRlc3QuY3JsMDQGCCsGAQUFBwEB
-BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AvZXhhbXBsZS5vcmcvMHAGA1Ud
-EQRpMGeCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5vcmeCIWFsdGVy
-bmF0ZW5hbWUuc2VydmVyMS5leGFtcGxlLm9yZ4ITc2VydmVyMS5leGFtcGxlLm9y
-Z4IJKi50ZXN0LmV4MA0GCSqGSIb3DQEBCwUAA4GBACtUUNjJzARl0cPfxC9uERbp
-g81Ig3+W0gyZCaU6VX8VB/w2k7sQZGWfYCWAOHqXmTdwGZ80aSjgZRBpPRdx8z7S
-KKBoicjvTLJZIm4GrNKlvmlANhqrXD/JIzpqCHgC57Ly37Ro9JAYcFCOCvGx2Y2t
-MJKULq5mBRLVrKPJtaXU
+BCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29zY3AuZXhhbXBsZS5vcmcvMHAGA1Ud
+EQRpMGeCImFsdGVybmF0ZW5hbWUyLnNlcnZlcjEuZXhhbXBsZS5vcmeCE3NlcnZl
+cjEuZXhhbXBsZS5vcmeCCSoudGVzdC5leIIhYWx0ZXJuYXRlbmFtZS5zZXJ2ZXIx
+LmV4YW1wbGUub3JnMA0GCSqGSIb3DQEBCwUAA4GBAEn/U765e9k8EEQAkeEXyk4/
+oFdOUW0CwpZi0NEJwyeC0zBbUk32ZXfzNLI0lnol/HBuL2J/K7tn9UATrH5x1OUk
+cUEYmnyzXO3SnFP4O43/BAvZ502AdZScafLbfAiGabdw9ILE/X+p7mP+PzBvcOre
+nlli+ow6thH+fYgpjRFU
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.unlocked.key
index 04487d2b9..0410cf7bb 100644
--- a/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/server1.example.org/server1.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXwIBAAKBgQDVxElLH00Q9cFrVZQ+ZqyuawkmLPZd6tBrEZiSAE54TjEZSOUY
-OsvfyDZuXuIja2s1gRBl+i4qX+7dGY6jLrcjcOcRcm2Kvxh6qVYrA3y/q9ioljwO
-DgXhLHELF9ERxCY9GwrmIj+igHKVFzGJCzM5pxgHkkM2lIKLds2YOhsrBQIDAQAB
-AoGBAMi+6XmTroLT100d8/ZZ46Z0PAZOyRpPjmROBPJvOUG/ZFpzWzlS1eyUj5E8
-p69NjEOVrbmmpT4EE0QtYQcbsrzs+lRpaIY1FC5AuKZ9QsSItrB/2WF9Ms2sVXt2
-1ouMaKAEZHyKXF48l853w/igyzFPxRqcF3lk9aOOFVDpHlmBAkEA8qafFxistngj
-uFWqlMTf+uBN2sYVaTbhBA9ZZ6VdqyZUCWeZHb2X2xghcGbK8hDR7GEERNUBhzou
-9RkrMTXcYQJBAOGG3+3Oc+qtB2+fm6pdgQv/OaHmnWbGoMH4/7UpgoMCaac66sHL
-D2VzKdeKR79MCJrFnIK6ACx8zpzhNS678SUCQQDesNA8sCaB58xQdj5w/iXY5lZN
-O5GW2Ai2YyfYGUnXsvtZDjzVsJRXPNQjhhMnCQy/dWInkZ0vb9R8mDatmRLBAkEA
-kR6T21ccueaLQWWH6lFup4Sc1jQqFqc7bHXIPQ+v3pNf3u8HfpomlxZK11ownsTT
-SJxeALSlRfstjD9SVHc1TQJBAOuSFkzS6+c+bWpp9ZPjrk7lzWhqTZ9sKzMkIcaz
-nMghBJmiZ6BvxfZEO2DZ5OVFkb+QxX7qCiHbQTTNNL1tgsU=
+MIICWwIBAAKBgQCpHnS3uMScCv3xaNDO+xs31Ihw8uuJIlVo5c5Os8Lx+5oFu3wU
+NwY/8ZzxT8PBtu9xcschZ3hWTTjQzRxkiqnIhbPuE0zaphoqUgoMSmf6HVF8bIKV
+agLYr83OH2GBbKXM/bVtPAuVvcigaEiVQWoDUoRZd0r00k4F3JsOYEm5wwIDAQAB
+AoGANwfbiAr+Ix6qinsGc0ufjDfC3CoXvaxn6XXZ/58cANzTvijHU9ah2H3ZCWbg
+trC90oc8R+Dg9ggzxDHyGr9KRpewk9CDAEgkKASCHogALyTl85fGf0XBjgfa4ys0
+LCWpjLDHySNx+wTln5DI4MU2OpShbgfvBY5hNRnGXebj9F0CQQDa40lMSbUX65gl
+s9sar/S2ExOVZCpcYaR/38H5Bti8HzvGEMGjx1AaOTW0v/hjXRadovbDC9vgtSsU
+uXINuvSNAkEAxcr6P2mnoin7v/7Jne9JpDBjdB+WiUJY+1h10tLIaD0eu71yx/oO
+Icp1/6FY4RyTKtj8jeE3kvy4MkCzkOFbjwJALntHjHC2iR7Zj2ATLiahY6zHYtkD
+edyuTw1YJqbCjahgTB4w0LO5mef+NKTzfT4+WDlMB31UMvKl9F+xDaNe3QJASMxJ
+SLehXD0pjGPBXyCoMQciQ6YwqLpDt9a6Hus3ma4NNrommdW+B8/VmE2RQeFbhSSx
+56Jh6vaa8NwBeyyGnwJAV403J4IfFKu1jwH/bi4zoQI5F9M7zKXyxz+z85UJIHIR
+7S7T3vbMa8aWMGdOkxN/44+EYHKZigDgN0fngTRuKw==
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/ca_chain.pem b/test/aux-fixed/exim-ca/example.org/server2.example.org/ca_chain.pem
index dd7fe720a..47f6b1cc0 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/ca_chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/ca_chain.pem
@@ -4,17 +4,17 @@ subject=/O=example.org/CN=clica Signing Cert
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
 Bag Attributes
     friendlyName: Certificate Authority
@@ -22,14 +22,14 @@ subject=/O=example.org/CN=clica CA
 issuer=/O=example.org/CN=clica CA
 -----BEGIN CERTIFICATE-----
 MIIB7jCCAVegAwIBAgIBATANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
-Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMmC4zNWYntPtKW8nuwo
-JbC14Cwuck7DufEvR6WAtos3NUxjWpS4rQl7bW62AoaSdX0bSIxpyS2wtgQxIoFJ
-yU0Ukseh5lTpAvXEgKyjutRJswbQj0w94O0487KcyBqd1ZDJHJYs9VJ+BfrETwwc
-74Tk8FUQHaH6EQJ28GIJUIJfAgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
-DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAISxe2t3sJCPBKD6wyb/
-lAsOu+Llby0cXetGKzGhC+HFHvI5OsjhMtOE5uGp7UYlJzbRrfMx/gSR9pjaXxah
-Bt7JFvcPI6wSDU4bBClsuvMTisenANOOscWHSEvB/YQes3OLnqC2RGSppKshjwVF
-fdbkhlMTV2Oyub2TvrscntOV
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjApMRQwEgYDVQQKEwtleGFtcGxlLm9yZzERMA8GA1UEAxMIY2xp
+Y2EgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7g6InDJBOPnTmNseci
+UYVZtfokI9WjOsisA4jt9BQMkdmACXfgO2LSF4n1qKv3dgZh+RsWnCQScft4PDfy
+KLvKy5HUrKJOhGrjEdOY4kfe8yzvPnvLFnVvoT+7oecYhb20onX4cwrYbDse0prB
+mUdzxCZ4lvb+Ohbevfq+TUR7AgMBAAGjJjAkMBIGA1UdEwEB/wQIMAYBAf8CAQEw
+DgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIhvpc4aqmpWysW6pinq
+DwULNiL96lcNaZ8tZXfdHGgbzfgYir+sbKObg+wOHObkRmEY/FcIF9sbwJuetOiO
+gMTEQwB13J6VurRcfTygrqHe0F0bC/Zq/AJ/BEbdVhtQ5H68G7qMBZw2aVpflZBy
+e/xewJdeLc+y5zuobX05I7rP
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/cert8.db b/test/aux-fixed/exim-ca/example.org/server2.example.org/cert8.db
index a71d40807..84f186edd 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server2.example.org/cert8.db and b/test/aux-fixed/exim-ca/example.org/server2.example.org/cert8.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/key3.db b/test/aux-fixed/exim-ca/example.org/server2.example.org/key3.db
index 4cdf555cd..4fafdbe58 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server2.example.org/key3.db and b/test/aux-fixed/exim-ca/example.org/server2.example.org/key3.db differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.chain.pem b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.chain.pem
index 3cb3cd085..be2d7d601 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.chain.pem
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.chain.pem
@@ -1,35 +1,35 @@
 Bag Attributes
     friendlyName: server2.example.org
-    localKeyID: E4 FD 7A D4 85 73 D1 21 1D D7 BE 02 53 6C 15 75 E9 85 B7 23 
+    localKeyID: BF 37 DA C8 19 97 0F 16 A1 F8 90 02 DB 17 CB C7 89 33 D1 E2 
 subject=/CN=server2.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0MzlaFw0zODAxMDExMjM0MzlaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
-ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMj2LV9J8BpcT0gz+/BB
-rRhEgWfaR+WDr2BYv8p026j6S8UOyi23b1dcVz7IabD26tiXFqn5k5l3/PPU6LrF
-mmevNugh+FRT9kQGN8fgJ8/tE6K5M9FEY3ZzZD0pWK2UIAqR/hLKYjWXr1tozyYK
-cpkvdGqj1Cvdecy8S1j9zIRfAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
+MjM0MTNaFw0zODAxMDExMjM0MTNaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
+ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALsNJFJOkDN3pjWXSiId
+781OhAJ8Tev7iHxPqT/CBjvBbBqBYnAk5q2VzeBBdrD9g3s0uXTdv8KsJeKVU9cE
+2VzaAiTXT0EG/kLpxR/HimLHpS6VMHWe6V//nNOscwa1v3h+MVc45rDT9l0MDvIC
+OgzW8rM3xzhFhtk1zbSn5ieJAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm9yZy8wHgYDVR0R
-BBcwFYITc2VydmVyMi5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQB2SpQL
-x4vUKOk6O4fqkYpTEFzVrsYSC35u9ZyLO/gjZfiornVOz8MWQofQmBtb8s4PCRqe
-wqGCLWEb4dkVkEFbJ3AyZsJUYRK4as08dy/zDi9PRG0AgRer6JFNJ81kmFVg+fnA
-wKpgAeZXCEx1KRG5v84b20NWl740gUXpigAWAQ==
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm9yZy8wHgYDVR0R
+BBcwFYITc2VydmVyMi5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQB8tfPX
+PqGaV8+AkMX/qtqd745YYYE1tibX2LX6ok8OdLcjdM8mPRb3J/bJrifpJiVhYESY
+XKBruZZxh4Fzh9HgKHidkfCP3py2CfpycR1BQ8eellv6mNibdoEjSCAvCEVJAaez
+pmwN1VlAzO9qx6sH5xKMxCfV2uJDQNSYAwH4Bg==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIICLDCCAZWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADApMRQwEgYDVQQKEwtleGFt
-cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDM5WhcNMzgw
-MTAxMTIzNDM5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
-Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCpoeV
-zjmqBMOrYxP7rj6aXYODfaD1lZTsnopvtoNJu2BBZO9sa2bVPBcF4uyMFBG1oiMs
-ojP+is6A30KLytVq+N04/jj9rpDUhVKet7upKwvj29ltl/8l9/jx00pJDunSHt8h
-OQaWSz/SZAqW9fA+xVqEZ9RCSv/Ugo2mdGb4xQIDAQABo1owWDAOBgNVHQ8BAf8E
+cGxlLm9yZzERMA8GA1UEAxMIY2xpY2EgQ0EwHhcNMTIxMTAxMTIzNDA5WhcNMzgw
+MTAxMTIzNDA5WjAzMRQwEgYDVQQKEwtleGFtcGxlLm9yZzEbMBkGA1UEAxMSY2xp
+Y2EgU2lnbmluZyBDZXJ0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7kJ8z
+PKQHHN92Q0kXeaXKVHU0sLjSrSSyOlj20dPGiK2l3h5563GezLckcglwXUVhZCo2
+Mk/5eq0s0KLWWPn99CUedkxhMs7DP8u3rWBwDtTcqLs05uvicfdo0Qpz9waAoxwR
+2IchwNJD2I6fXhIaj/GY34pjf7CZ+6QfnjltgwIDAQABo1owWDAOBgNVHQ8BAf8E
 BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRw
 Oi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwDQYJKoZIhvcNAQELBQADgYEA
-IddoaqJ/H9Ya+Iz1wRpWziTi3z7goy9Rxd6Q8f85Nra4M/3Ax2irXtgQINRho37l
-RmoaXVy+pTU1ncQfRiVfQML2ce9+OCQ4p5rZFxZDhh0OxKaHKrfFTvHbeNB1FH8Z
-SH0mRVgnK1F+8TTkThNZctKe0jhqzsp41sRBPrYIEUk=
+IQxQegBv96He97J15mtGvo/CjjVDtKVrSJgWOqoIz/UXveM2BvQ35RPHm+a4LYMV
+6+g6/n3ulW/zMLXUTzly9VnbVKEWOjbuz3cJhpiBXABkZ3n1Pp0SiXe+SYdGGVUi
+QtcQVMqGdnPfgC8ycxNff+mv9E+iauC/4guJKlFPmNc=
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.key b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.key
index 9572430b8..56747036e 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.key
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.key
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: server2.example.org
-    localKeyID: E4 FD 7A D4 85 73 D1 21 1D D7 BE 02 53 6C 15 75 E9 85 B7 23 
+    localKeyID: BF 37 DA C8 19 97 0F 16 A1 F8 90 02 DB 17 CB C7 89 33 D1 E2 
 Key Attributes: <No Attributes>
 -----BEGIN ENCRYPTED PRIVATE KEY-----
-MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIK56kTGU+QxMCAggA
-MBQGCCqGSIb3DQMHBAghqiBxmn7UnASCAoBEeu1CflSYGV/PqgxGzfx5wJJrA4cD
-ZpMO6MiTHPFtc0InHbTbktgCSV+PCKaxrGlEcFFMIxZEtXrAkDe12saApfwfM3D8
-l+vEhBmxl+VQoUMCbgp1ujlNQ2QKvcjXFrcX29KG3k6NANFyFjmdCLXXWcfWhIFT
-7oQbmKpr7giq3cOFjj8X/hSQSH7S0rNEH7NrPB33OVfaRbJqNoIvBk9u/7/Bo3mi
-nLck2lxiRqiqqlRmYT3PDk3EAXM+gIFXTsfblP6c3XrUcLoTj2FVkDdzRrr5f4u5
-W2b5IbeErVeCBst0sV5chB+YW2gmglQNnUZEdRDQX2R3V7j1o8zuQRRUWlL9NcV6
-yr3v8Wn5RKaLH6Uy1FEqF5fDF/CwqZxBvj3FdKzGFgRsqBmOXBcPbNcSYghlhIND
-3vk9+IRPTGjYu0H6gfLKNQsr1QrEbGtTtugJZgo3YJgt3xib/rmb561ZYDFKjY0L
-79hOiIhikqZRaWqXWNyvnTwAtQ4kiF82neBX8Qjo0mwn8DOFX0qTbLEpXhW7Tex/
-tFeI+20VTzJek0J2xBapxp74NL6JFaiRNLLJwdfPmAJ8fjBey4TrZhpiyfsZJtnf
-sHN0QMxfrQBzyEbWr3vgYg0NsR/2ZW5ozH/BVPdtDsQU1y1iIH8nrV0uNa/O7WzO
-qvmQKw/BXCbdouZbVPF6O2Gc07kDJTqmZT5tfMKdBpehwOu9KENPAJwZAUUXj08z
-N2Tec1BZApFcQrKPqfRA5LPnvYXdsxeArdeJwNMpGBP5wyX71aYUK7TiV4cQo3gs
-sLDMbdWR5zsFPUzSgAQ+H8Uv6ylpv1JqCBPzEIESsJymgoyqmVrQKSdg
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI3OJxMlFMPCICAggA
+MBQGCCqGSIb3DQMHBAjtwebzSkWpeQSCAoDs+GuspE8T6O+6y30iq0g0b57q0eNH
+oxAal4jHMOL1N7Kuxh1qSjkQUfCK+QQIiGEfyHA/kNzgs8lC0iHWOZ4OuaWzYrPP
+5cCVJYEfkGaT6DzfzHAkIcJv/3i5sfLdsHi9hTYKrj1cXEa2oEbLF9BVUhqPfM8+
+ius1tcNClNqfVFg6hcyr/iIQOkG+MwoLxYaX1vLOm42DQtQoPWFD4JrlsdDI1x0L
+TWpYTCv3twnFkiO037MhB0E6SSE9rDnwm5zFDY5/7gBK8lgm/qlK7IJre9pvzx38
+WI1QLViWKOtMXxLf49MDMBJMP0vk1TW5xhjuZ9dw9RvMrmv/9nQiSyjV4DA1QzVx
+qj16E0lCQe+JbJ91iiMAGVh91AS1mxlcHY09T3oZ8yUN758hOZCVQnpmZwEJybIc
+E0NxXE5dIj83aMPiIfOBLIPZG9h3VPUYDUCfWm2/7YIbZcCDgrNo+Jly2+E4AJ9b
+evgnXsIMd7Rf9+bzew+j7oObDdJ09Bp+gAGv9sRClcWuuQgdTLLkzJYG3ppq7AaH
+AnlquIfgCH+OaJOHFAhnFzq6viSmQjg2Q3SDbyyYeOorrS2r7zMqmG+ctnfjTF0/
+z3VjqOsoHj9WPA6aJTH7mcK5wB/QrFQhVAQTShOuJ2AkbIwb5pLf8PEH7ginnlFc
+ZUuRhl4oTsanIkUnisynG2MfnEcSwl2oYjWURque2qgVQEfFjvjxwPNl6ZUExrdP
+bymXsBnOh25Q9sQCFukZiZdEuxnMNnXZQL0ed4sJ8zSx7VS/IbR/20zID0BlraTJ
+i0po2h1IIotsBkcUU4/a6EA7jSpKLBiiIf0jk7J0hEWCRXiEY1QmxjVU
 -----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.dated.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.dated.resp
index 9d13ac127..8b2cb21aa 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.dated.resp and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.good.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.good.resp
index a695297ee..73a95e22a 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.good.resp and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.req b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.req
index 8341b77ae..e604249fd 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.req and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.req differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.revoked.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.revoked.resp
index a695297ee..73a95e22a 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.revoked.resp and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.dated.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.dated.resp
new file mode 100644
index 000000000..8e8e64355
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.good.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.good.resp
new file mode 100644
index 000000000..e65f49a7f
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.revoked.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.revoked.resp
new file mode 100644
index 000000000..e65f49a7f
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signer.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.dated.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.dated.resp
new file mode 100644
index 000000000..76bced2c3
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.dated.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.good.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.good.resp
new file mode 100644
index 000000000..c6702e86d
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.good.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.revoked.resp b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.revoked.resp
new file mode 100644
index 000000000..c6702e86d
Binary files /dev/null and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.ocsp.signernocert.revoked.resp differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.p12 b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.p12
index 85d397bc5..2e9ed5d04 100644
Binary files a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.p12 and b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.p12 differ
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.pem b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.pem
index 934ac34e8..833986aa4 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.pem
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.pem
@@ -1,21 +1,21 @@
 Bag Attributes
     friendlyName: server2.example.org
-    localKeyID: E4 FD 7A D4 85 73 D1 21 1D D7 BE 02 53 6C 15 75 E9 85 B7 23 
+    localKeyID: BF 37 DA C8 19 97 0F 16 A1 F8 90 02 DB 17 CB C7 89 33 D1 E2 
 subject=/CN=server2.example.org
 issuer=/O=example.org/CN=clica Signing Cert
 -----BEGIN CERTIFICATE-----
 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhh
 bXBsZS5vcmcxGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDEx
-MjM0MzlaFw0zODAxMDExMjM0MzlaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
-ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMj2LV9J8BpcT0gz+/BB
-rRhEgWfaR+WDr2BYv8p026j6S8UOyi23b1dcVz7IabD26tiXFqn5k5l3/PPU6LrF
-mmevNugh+FRT9kQGN8fgJ8/tE6K5M9FEY3ZzZD0pWK2UIAqR/hLKYjWXr1tozyYK
-cpkvdGqj1Cvdecy8S1j9zIRfAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
+MjM0MTNaFw0zODAxMDExMjM0MTNaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBs
+ZS5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALsNJFJOkDN3pjWXSiId
+781OhAJ8Tev7iHxPqT/CBjvBbBqBYnAk5q2VzeBBdrD9g3s0uXTdv8KsJeKVU9cE
+2VzaAiTXT0EG/kLpxR/HimLHpS6VMHWe6V//nNOscwa1v3h+MVc45rDT9l0MDvIC
+OgzW8rM3xzhFhtk1zbSn5ieJAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAG
 A1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAj
 hiFodHRwOi8vY3JsLmV4YW1wbGUub3JnL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEE
-KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLm9yZy8wHgYDVR0R
-BBcwFYITc2VydmVyMi5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQB2SpQL
-x4vUKOk6O4fqkYpTEFzVrsYSC35u9ZyLO/gjZfiornVOz8MWQofQmBtb8s4PCRqe
-wqGCLWEb4dkVkEFbJ3AyZsJUYRK4as08dy/zDi9PRG0AgRer6JFNJ81kmFVg+fnA
-wKpgAeZXCEx1KRG5v84b20NWl740gUXpigAWAQ==
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLm9yZy8wHgYDVR0R
+BBcwFYITc2VydmVyMi5leGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOBgQB8tfPX
+PqGaV8+AkMX/qtqd745YYYE1tibX2LX6ok8OdLcjdM8mPRb3J/bJrifpJiVhYESY
+XKBruZZxh4Fzh9HgKHidkfCP3py2CfpycR1BQ8eellv6mNibdoEjSCAvCEVJAaez
+pmwN1VlAzO9qx6sH5xKMxCfV2uJDQNSYAwH4Bg==
 -----END CERTIFICATE-----
diff --git a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.unlocked.key b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.unlocked.key
index bbd6494ba..a91f89397 100644
--- a/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.unlocked.key
+++ b/test/aux-fixed/exim-ca/example.org/server2.example.org/server2.example.org.unlocked.key
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDI9i1fSfAaXE9IM/vwQa0YRIFn2kflg69gWL/KdNuo+kvFDsot
-t29XXFc+yGmw9urYlxap+ZOZd/zz1Oi6xZpnrzboIfhUU/ZEBjfH4CfP7ROiuTPR
-RGN2c2Q9KVitlCAKkf4SymI1l69baM8mCnKZL3Rqo9Qr3XnMvEtY/cyEXwIDAQAB
-AoGBAIU+XHUKtAz2WYbZGNmC4j7t5RMzsmnl9xkdnwSgmKggVK6ykLDhKAy3aA1z
-mkhAXxP+kYNfvFKMMQaGi0yTCj04MlfoCp/6sfwFRERKX1SXsXTVqe52sphPILc8
-Hh/XnnsDQ5moXl4V4nmHJjKvbAJ0QYEEs5ub7vC+s/W+m6fxAkEA/oybxxK/8vTJ
-BTrhAeCKsS9kwvrU67JhsL5gBQNSqsq8tlqUphIlBeEImC9sPga4HSi1Tdb+6UJp
-P4IIg9u6ZwJBAMobYi42jp1/xs6sZ27bLMFEZ5WBJiX12IKpOEV8/Kl34hBpD+PT
-OQlH3HJZ2r7feDnkaZOuJW7udGdg8fZ4m0kCQQDXvmEBtziNOT9veVnf92pVhq/G
-OkZghk4aOSC03v4f17lebSN0JgjPFM3t/rOlVpiRzkDsen6PQURnGVUSPRedAkEA
-qvKYi/A3lv6CIUPwRPL8GwkJ+IoBw2/7zyDk6Nm8OHefbjP/bbu2baQr0UkxXetV
-HNqXdoOBRCBLszlr0AbZiQJAIuP9czE0POJZgJ6vZdl/DUg6GVT91fRfOOj5LX7u
-tiunxTLUIuSqHgBGrHTEMbyarUW8XzuqsV0h2mfagorMlQ==
+MIICXAIBAAKBgQC7DSRSTpAzd6Y1l0oiHe/NToQCfE3r+4h8T6k/wgY7wWwagWJw
+JOatlc3gQXaw/YN7NLl03b/CrCXilVPXBNlc2gIk109BBv5C6cUfx4pix6UulTB1
+nulf/5zTrHMGtb94fjFXOOaw0/ZdDA7yAjoM1vKzN8c4RYbZNc20p+YniQIDAQAB
+AoGADQLjQ6ls3POl92TcdoaUE3kydBTO+8sNqa4F5SY7NkVkXmyhGxFqDWmV/lM3
+bSTZVETs4Jz7NZCxevMtt4+CChW6vEM7TosEfUQ+Sp8D1t7PJJm8fIVAagm42HmA
+xUS0+5nAKepo0cWytuNVKLg1t/RFAASWhDVGVLre5OD63/0CQQDeCBg5O2QrjQEx
+CttJf+UfQ4PMv1gLEP/toY4ZINrItPo9rIaqbev2jkovDNIILVuImAT7zbQAgKQA
+/X5BThDVAkEA16sJ4box1KjnuAzsIMvs/gEVlX1ba3Hf8XlQ+8yMO/tbIKZNX2LQ
+4ZdEi2IextphwxrF9IO6OAzR5cf8V8E15QJAfmidYfguT5030HQd5Pqrt+D4aNmH
+hsVm8CPKgwPxi9N9pR9UjDOI5Baeparm6UDpnBrwu2uhz6dtuCKafxOzAQJAdJy6
+3x66Su55PH9gPeuF3WHgtc/uWo5cNEkQjNXxDY2/nEvPkj/wCcqs+WC4m3UBX2le
+l/OSATSNWd1kiF6kMQJBALwevGEIolnWI19Q/V1kigRYM+6SXDHcqZ+Bd4/MbdFS
+6XQBwJke2ysY9iKCx9dzUUtS0vMpEv15g+RFveWe9Ss=
 -----END RSA PRIVATE KEY-----
diff --git a/test/aux-fixed/exim-ca/genall b/test/aux-fixed/exim-ca/genall
index 2f3e24d12..a5c8b2105 100755
--- a/test/aux-fixed/exim-ca/genall
+++ b/test/aux-fixed/exim-ca/genall
@@ -4,6 +4,8 @@
 set -e
 set -x
 
+clica --help >/dev/null 2>&1
+
 echo Ensure time is set to 2012/11/01 12:34
 echo use -  date -u 110112342012
 echo hit return when ready
@@ -13,7 +15,7 @@ do
     idir="example.$tld"
     rm -fr "$idir"
     clica -D "$idir" -p password -B 1024 -I -N example.$tld -F \
-	-C http://crl.example.$tld/latest.crl -O http://oscp/example.$tld/
+	-C http://crl.example.$tld/latest.crl -O http://oscp.example.$tld/
 
     clica -D example.$tld -p password -s 101 -S server1.example.$tld \
 	-8 alternatename.server1.example.$tld,alternatename2.server1.example.$tld,*.test.ex
@@ -42,8 +44,19 @@ do
     pk12util -o $CADIR/OCSP.p12 -n 'OCSP Signer' -d $CADIR -K password -W password
     openssl pkcs12 -in $CADIR/OCSP.p12 -passin pass:password -passout pass:password -nodes -nocerts -out $CADIR/OCSP.key
 
+    # also need variation from Signer
+    pk12util -o $CADIR/Signer.p12 -n 'Signing Cert' -d $CADIR -K password -W password
+    openssl pkcs12 -in $CADIR/Signer.p12 -passin pass:password -passout pass:password -nodes -nocerts -out $CADIR/Signer.key
 
     # create some index files for the ocsp responder to work with
+# tab-sep
+# 0: Revoked/Expired/Valid letter
+# 1: Expiry date (ASN1_UTCTIME)
+# 2: Revocation date
+# 3: Serial no. (unique)
+# 4: file
+# 5: DN, index
+
     cat >$CADIR/index.valid.txt <<EOF
 V	130110200751Z		65	unknown	CN=server1.example.$tld
 V	130110200751Z		66	unknown	CN=revoked1.example.$tld
@@ -62,14 +75,25 @@ R	130110200751Z	100201142709Z,superseded	cb	unknown	CN=expired2.example.$tld
 EOF
 
     # Now create all the ocsp requests and responses
-    OGENCOMMON="-rsigner $CADIR/OCSP.pem -rkey $CADIR/OCSP.key -CA $CADIR/Signer.pem -noverify"
     for server in server1 revoked1 expired1 server2 revoked2 expired2
     do
 	SPFX=example.$tld/$server.example.$tld/$server.example.$tld
-	openssl ocsp -issuer $CADIR/Signer.pem -cert $SPFX.pem -reqout $SPFX.ocsp.req
-	openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON   -ndays 3652 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.good.resp
-	openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON   -ndays 30   -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.dated.resp
-	openssl ocsp -index $CADIR/index.revoked.txt $OGENCOMMON -ndays 3652 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.revoked.resp
+	openssl ocsp -issuer $CADIR/Signer.pem -cert $SPFX.pem -no_nonce -sha256 -reqout $SPFX.ocsp.req
+
+	OGENCOMMON="-rsigner $CADIR/OCSP.pem -rkey $CADIR/OCSP.key -CA $CADIR/Signer.pem -noverify"
+	openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON   -ndays 3652 -sha256 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.good.resp
+	openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON   -ndays 30   -sha256 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.dated.resp
+	openssl ocsp -index $CADIR/index.revoked.txt $OGENCOMMON -ndays 3652 -sha256 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.revoked.resp
+
+	OGENCOMMON="-rsigner $CADIR/Signer.pem -rkey $CADIR/Signer.key -CA $CADIR/Signer.pem -noverify"
+	openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON   -ndays 3652 -sha256 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.signer.good.resp
+	openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON   -ndays 30   -sha256 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.signer.dated.resp
+	openssl ocsp -index $CADIR/index.revoked.txt $OGENCOMMON -ndays 3652 -sha256 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.signer.revoked.resp
+
+	OGENCOMMON="-rsigner $CADIR/Signer.pem -rkey $CADIR/Signer.key -CA $CADIR/Signer.pem -resp_no_certs -noverify"
+	openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON   -ndays 3652 -sha256 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.signernocert.good.resp
+	openssl ocsp -index $CADIR/index.valid.txt $OGENCOMMON   -ndays 30   -sha256 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.signernocert.dated.resp
+	openssl ocsp -index $CADIR/index.revoked.txt $OGENCOMMON -ndays 3652 -sha256 -reqin $SPFX.ocsp.req -respout $SPFX.ocsp.signernocert.revoked.resp
     done
 done
 
diff --git a/test/aux-fixed/valgrind.supp b/test/aux-fixed/valgrind.supp
new file mode 100644
index 000000000..5f3b8dfd4
--- /dev/null
+++ b/test/aux-fixed/valgrind.supp
@@ -0,0 +1,8 @@
+{
+  macro_whitelist
+  Memcheck:Leak
+  fun:malloc
+  fun:store_malloc_3
+  fun:macros_trusted
+  fun:main
+}
diff --git a/test/aux-var-src/std_conf_prefix b/test/aux-var-src/std_conf_prefix
new file mode 100644
index 000000000..2565c2677
--- /dev/null
+++ b/test/aux-var-src/std_conf_prefix
@@ -0,0 +1,2 @@
+.include DIR/aux-var/tls_conf_prefix
+tls_advertise_hosts =
diff --git a/test/aux-var-src/tls_conf_prefix b/test/aux-var-src/tls_conf_prefix
new file mode 100644
index 000000000..39dddd98f
--- /dev/null
+++ b/test/aux-var-src/tls_conf_prefix
@@ -0,0 +1,14 @@
+exim_path = EXIM_PATH
+keep_environment =
+host_lookup_order = bydns
+spool_directory = DIR/spool
+
+.ifdef SERVER
+log_file_path = DIR/spool/log/SERVER%slog
+.else
+log_file_path = DIR/spool/log/%slog
+.endif
+
+gecos_pattern = ""
+gecos_name = CALLER_NAME
+chunking_advertise_hosts =
diff --git a/test/configure b/test/configure
new file mode 100755
index 000000000..26489c630
--- /dev/null
+++ b/test/configure
@@ -0,0 +1,4660 @@
+#! /bin/sh
+# Guess values for system-dependent variables and create Makefiles.
+# Generated by GNU Autoconf 2.69.
+#
+#
+# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+#
+#
+# This configure script is free software; the Free Software Foundation
+# gives unlimited permission to copy, distribute and modify it.
+## -------------------- ##
+## M4sh Initialization. ##
+## -------------------- ##
+
+# Be more Bourne compatible
+DUALCASE=1; export DUALCASE # for MKS sh
+if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+  emulate sh
+  NULLCMD=:
+  # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
+  # is contrary to our usage.  Disable this feature.
+  alias -g '${1+"$@"}'='"$@"'
+  setopt NO_GLOB_SUBST
+else
+  case `(set -o) 2>/dev/null` in #(
+  *posix*) :
+    set -o posix ;; #(
+  *) :
+     ;;
+esac
+fi
+
+
+as_nl='
+'
+export as_nl
+# Printing a long string crashes Solaris 7 /usr/bin/printf.
+as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
+as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
+as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
+# Prefer a ksh shell builtin over an external printf program on Solaris,
+# but without wasting forks for bash or zsh.
+if test -z "$BASH_VERSION$ZSH_VERSION" \
+    && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
+  as_echo='print -r --'
+  as_echo_n='print -rn --'
+elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
+  as_echo='printf %s\n'
+  as_echo_n='printf %s'
+else
+  if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
+    as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
+    as_echo_n='/usr/ucb/echo -n'
+  else
+    as_echo_body='eval expr "X$1" : "X\\(.*\\)"'
+    as_echo_n_body='eval
+      arg=$1;
+      case $arg in #(
+      *"$as_nl"*)
+	expr "X$arg" : "X\\(.*\\)$as_nl";
+	arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;;
+      esac;
+      expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl"
+    '
+    export as_echo_n_body
+    as_echo_n='sh -c $as_echo_n_body as_echo'
+  fi
+  export as_echo_body
+  as_echo='sh -c $as_echo_body as_echo'
+fi
+
+# The user is always right.
+if test "${PATH_SEPARATOR+set}" != set; then
+  PATH_SEPARATOR=:
+  (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
+    (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
+      PATH_SEPARATOR=';'
+  }
+fi
+
+
+# IFS
+# We need space, tab and new line, in precisely that order.  Quoting is
+# there to prevent editors from complaining about space-tab.
+# (If _AS_PATH_WALK were called with IFS unset, it would disable word
+# splitting by setting IFS to empty value.)
+IFS=" ""	$as_nl"
+
+# Find who we are.  Look in the path if we contain no directory separator.
+as_myself=
+case $0 in #((
+  *[\\/]* ) as_myself=$0 ;;
+  *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+  done
+IFS=$as_save_IFS
+
+     ;;
+esac
+# We did not find ourselves, most probably we were run as `sh COMMAND'
+# in which case we are not to be found in the path.
+if test "x$as_myself" = x; then
+  as_myself=$0
+fi
+if test ! -f "$as_myself"; then
+  $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+  exit 1
+fi
+
+# Unset variables that we do not need and which cause bugs (e.g. in
+# pre-3.0 UWIN ksh).  But do not cause bugs in bash 2.01; the "|| exit 1"
+# suppresses any "Segmentation fault" message there.  '((' could
+# trigger a bug in pdksh 5.2.14.
+for as_var in BASH_ENV ENV MAIL MAILPATH
+do eval test x\${$as_var+set} = xset \
+  && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+done
+PS1='$ '
+PS2='> '
+PS4='+ '
+
+# NLS nuisances.
+LC_ALL=C
+export LC_ALL
+LANGUAGE=C
+export LANGUAGE
+
+# CDPATH.
+(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
+
+# Use a proper internal environment variable to ensure we don't fall
+  # into an infinite loop, continuously re-executing ourselves.
+  if test x"${_as_can_reexec}" != xno && test "x$CONFIG_SHELL" != x; then
+    _as_can_reexec=no; export _as_can_reexec;
+    # We cannot yet assume a decent shell, so we have to provide a
+# neutralization value for shells without unset; and this also
+# works around shells that cannot unset nonexistent variables.
+# Preserve -v and -x to the replacement shell.
+BASH_ENV=/dev/null
+ENV=/dev/null
+(unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV
+case $- in # ((((
+  *v*x* | *x*v* ) as_opts=-vx ;;
+  *v* ) as_opts=-v ;;
+  *x* ) as_opts=-x ;;
+  * ) as_opts= ;;
+esac
+exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
+# Admittedly, this is quite paranoid, since all the known shells bail
+# out after a failed `exec'.
+$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
+as_fn_exit 255
+  fi
+  # We don't want this to propagate to other subprocesses.
+          { _as_can_reexec=; unset _as_can_reexec;}
+if test "x$CONFIG_SHELL" = x; then
+  as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then :
+  emulate sh
+  NULLCMD=:
+  # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which
+  # is contrary to our usage.  Disable this feature.
+  alias -g '\${1+\"\$@\"}'='\"\$@\"'
+  setopt NO_GLOB_SUBST
+else
+  case \`(set -o) 2>/dev/null\` in #(
+  *posix*) :
+    set -o posix ;; #(
+  *) :
+     ;;
+esac
+fi
+"
+  as_required="as_fn_return () { (exit \$1); }
+as_fn_success () { as_fn_return 0; }
+as_fn_failure () { as_fn_return 1; }
+as_fn_ret_success () { return 0; }
+as_fn_ret_failure () { return 1; }
+
+exitcode=0
+as_fn_success || { exitcode=1; echo as_fn_success failed.; }
+as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; }
+as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; }
+as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; }
+if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then :
+
+else
+  exitcode=1; echo positional parameters were not saved.
+fi
+test x\$exitcode = x0 || exit 1
+test -x / || exit 1"
+  as_suggested="  as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO
+  as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO
+  eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" &&
+  test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1
+test \$(( 1 + 1 )) = 2 || exit 1"
+  if (eval "$as_required") 2>/dev/null; then :
+  as_have_required=yes
+else
+  as_have_required=no
+fi
+  if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then :
+
+else
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+as_found=false
+for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+  as_found=:
+  case $as_dir in #(
+	 /*)
+	   for as_base in sh bash ksh sh5; do
+	     # Try only shells that exist, to save several forks.
+	     as_shell=$as_dir/$as_base
+	     if { test -f "$as_shell" || test -f "$as_shell.exe"; } &&
+		    { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then :
+  CONFIG_SHELL=$as_shell as_have_required=yes
+		   if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then :
+  break 2
+fi
+fi
+	   done;;
+       esac
+  as_found=false
+done
+$as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } &&
+	      { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then :
+  CONFIG_SHELL=$SHELL as_have_required=yes
+fi; }
+IFS=$as_save_IFS
+
+
+      if test "x$CONFIG_SHELL" != x; then :
+  export CONFIG_SHELL
+             # We cannot yet assume a decent shell, so we have to provide a
+# neutralization value for shells without unset; and this also
+# works around shells that cannot unset nonexistent variables.
+# Preserve -v and -x to the replacement shell.
+BASH_ENV=/dev/null
+ENV=/dev/null
+(unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV
+case $- in # ((((
+  *v*x* | *x*v* ) as_opts=-vx ;;
+  *v* ) as_opts=-v ;;
+  *x* ) as_opts=-x ;;
+  * ) as_opts= ;;
+esac
+exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
+# Admittedly, this is quite paranoid, since all the known shells bail
+# out after a failed `exec'.
+$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
+exit 255
+fi
+
+    if test x$as_have_required = xno; then :
+  $as_echo "$0: This script requires a shell more modern than all"
+  $as_echo "$0: the shells that I found on your system."
+  if test x${ZSH_VERSION+set} = xset ; then
+    $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should"
+    $as_echo "$0: be upgraded to zsh 4.3.4 or later."
+  else
+    $as_echo "$0: Please tell bug-autoconf@gnu.org about your system,
+$0: including any error possibly output before this
+$0: message. Then install a modern shell, or manually run
+$0: the script under such a shell if you do have one."
+  fi
+  exit 1
+fi
+fi
+fi
+SHELL=${CONFIG_SHELL-/bin/sh}
+export SHELL
+# Unset more variables known to interfere with behavior of common tools.
+CLICOLOR_FORCE= GREP_OPTIONS=
+unset CLICOLOR_FORCE GREP_OPTIONS
+
+## --------------------- ##
+## M4sh Shell Functions. ##
+## --------------------- ##
+# as_fn_unset VAR
+# ---------------
+# Portably unset VAR.
+as_fn_unset ()
+{
+  { eval $1=; unset $1;}
+}
+as_unset=as_fn_unset
+
+# as_fn_set_status STATUS
+# -----------------------
+# Set $? to STATUS, without forking.
+as_fn_set_status ()
+{
+  return $1
+} # as_fn_set_status
+
+# as_fn_exit STATUS
+# -----------------
+# Exit the shell with STATUS, even in a "trap 0" or "set -e" context.
+as_fn_exit ()
+{
+  set +e
+  as_fn_set_status $1
+  exit $1
+} # as_fn_exit
+
+# as_fn_mkdir_p
+# -------------
+# Create "$as_dir" as a directory, including parents if necessary.
+as_fn_mkdir_p ()
+{
+
+  case $as_dir in #(
+  -*) as_dir=./$as_dir;;
+  esac
+  test -d "$as_dir" || eval $as_mkdir_p || {
+    as_dirs=
+    while :; do
+      case $as_dir in #(
+      *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
+      *) as_qdir=$as_dir;;
+      esac
+      as_dirs="'$as_qdir' $as_dirs"
+      as_dir=`$as_dirname -- "$as_dir" ||
+$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+	 X"$as_dir" : 'X\(//\)[^/]' \| \
+	 X"$as_dir" : 'X\(//\)$' \| \
+	 X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X"$as_dir" |
+    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)[^/].*/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\).*/{
+	    s//\1/
+	    q
+	  }
+	  s/.*/./; q'`
+      test -d "$as_dir" && break
+    done
+    test -z "$as_dirs" || eval "mkdir $as_dirs"
+  } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir"
+
+
+} # as_fn_mkdir_p
+
+# as_fn_executable_p FILE
+# -----------------------
+# Test if FILE is an executable regular file.
+as_fn_executable_p ()
+{
+  test -f "$1" && test -x "$1"
+} # as_fn_executable_p
+# as_fn_append VAR VALUE
+# ----------------------
+# Append the text in VALUE to the end of the definition contained in VAR. Take
+# advantage of any shell optimizations that allow amortized linear growth over
+# repeated appends, instead of the typical quadratic growth present in naive
+# implementations.
+if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
+  eval 'as_fn_append ()
+  {
+    eval $1+=\$2
+  }'
+else
+  as_fn_append ()
+  {
+    eval $1=\$$1\$2
+  }
+fi # as_fn_append
+
+# as_fn_arith ARG...
+# ------------------
+# Perform arithmetic evaluation on the ARGs, and store the result in the
+# global $as_val. Take advantage of shells that can avoid forks. The arguments
+# must be portable across $(()) and expr.
+if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
+  eval 'as_fn_arith ()
+  {
+    as_val=$(( $* ))
+  }'
+else
+  as_fn_arith ()
+  {
+    as_val=`expr "$@" || test $? -eq 1`
+  }
+fi # as_fn_arith
+
+
+# as_fn_error STATUS ERROR [LINENO LOG_FD]
+# ----------------------------------------
+# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are
+# provided, also output the error to LOG_FD, referencing LINENO. Then exit the
+# script with STATUS, using 1 if that was 0.
+as_fn_error ()
+{
+  as_status=$1; test $as_status -eq 0 && as_status=1
+  if test "$4"; then
+    as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+    $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
+  fi
+  $as_echo "$as_me: error: $2" >&2
+  as_fn_exit $as_status
+} # as_fn_error
+
+if expr a : '\(a\)' >/dev/null 2>&1 &&
+   test "X`expr 00001 : '.*\(...\)'`" = X001; then
+  as_expr=expr
+else
+  as_expr=false
+fi
+
+if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then
+  as_basename=basename
+else
+  as_basename=false
+fi
+
+if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
+  as_dirname=dirname
+else
+  as_dirname=false
+fi
+
+as_me=`$as_basename -- "$0" ||
+$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
+	 X"$0" : 'X\(//\)$' \| \
+	 X"$0" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X/"$0" |
+    sed '/^.*\/\([^/][^/]*\)\/*$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\/\(\/\/\)$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\/\(\/\).*/{
+	    s//\1/
+	    q
+	  }
+	  s/.*/./; q'`
+
+# Avoid depending upon Character Ranges.
+as_cr_letters='abcdefghijklmnopqrstuvwxyz'
+as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+as_cr_Letters=$as_cr_letters$as_cr_LETTERS
+as_cr_digits='0123456789'
+as_cr_alnum=$as_cr_Letters$as_cr_digits
+
+
+  as_lineno_1=$LINENO as_lineno_1a=$LINENO
+  as_lineno_2=$LINENO as_lineno_2a=$LINENO
+  eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" &&
+  test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || {
+  # Blame Lee E. McMahon (1931-1989) for sed's syntax.  :-)
+  sed -n '
+    p
+    /[$]LINENO/=
+  ' <$as_myself |
+    sed '
+      s/[$]LINENO.*/&-/
+      t lineno
+      b
+      :lineno
+      N
+      :loop
+      s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/
+      t loop
+      s/-\n.*//
+    ' >$as_me.lineno &&
+  chmod +x "$as_me.lineno" ||
+    { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; }
+
+  # If we had to re-execute with $CONFIG_SHELL, we're ensured to have
+  # already done that, so ensure we don't try to do so again and fall
+  # in an infinite loop.  This has already happened in practice.
+  _as_can_reexec=no; export _as_can_reexec
+  # Don't try to exec as it changes $[0], causing all sort of problems
+  # (the dirname of $[0] is not the place where we might find the
+  # original and so on.  Autoconf is especially sensitive to this).
+  . "./$as_me.lineno"
+  # Exit status is that of the last command.
+  exit
+}
+
+ECHO_C= ECHO_N= ECHO_T=
+case `echo -n x` in #(((((
+-n*)
+  case `echo 'xy\c'` in
+  *c*) ECHO_T='	';;	# ECHO_T is single tab character.
+  xy)  ECHO_C='\c';;
+  *)   echo `echo ksh88 bug on AIX 6.1` > /dev/null
+       ECHO_T='	';;
+  esac;;
+*)
+  ECHO_N='-n';;
+esac
+
+rm -f conf$$ conf$$.exe conf$$.file
+if test -d conf$$.dir; then
+  rm -f conf$$.dir/conf$$.file
+else
+  rm -f conf$$.dir
+  mkdir conf$$.dir 2>/dev/null
+fi
+if (echo >conf$$.file) 2>/dev/null; then
+  if ln -s conf$$.file conf$$ 2>/dev/null; then
+    as_ln_s='ln -s'
+    # ... but there are two gotchas:
+    # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
+    # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
+    # In both cases, we have to default to `cp -pR'.
+    ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
+      as_ln_s='cp -pR'
+  elif ln conf$$.file conf$$ 2>/dev/null; then
+    as_ln_s=ln
+  else
+    as_ln_s='cp -pR'
+  fi
+else
+  as_ln_s='cp -pR'
+fi
+rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file
+rmdir conf$$.dir 2>/dev/null
+
+if mkdir -p . 2>/dev/null; then
+  as_mkdir_p='mkdir -p "$as_dir"'
+else
+  test -d ./-p && rmdir ./-p
+  as_mkdir_p=false
+fi
+
+as_test_x='test -x'
+as_executable_p=as_fn_executable_p
+
+# Sed expression to map a string onto a valid CPP name.
+as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'"
+
+# Sed expression to map a string onto a valid variable name.
+as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'"
+
+
+test -n "$DJDIR" || exec 7<&0 </dev/null
+exec 6>&1
+
+# Name of the host.
+# hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status,
+# so uname gets run too.
+ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q`
+
+#
+# Initializations.
+#
+ac_default_prefix=/usr/local
+ac_clean_files=
+ac_config_libobj_dir=.
+LIBOBJS=
+cross_compiling=no
+subdirs=
+MFLAGS=
+MAKEFLAGS=
+
+# Identity of this package.
+PACKAGE_NAME=
+PACKAGE_TARNAME=
+PACKAGE_VERSION=
+PACKAGE_STRING=
+PACKAGE_BUGREPORT=
+PACKAGE_URL=
+
+ac_unique_file="listtests"
+# Factoring default headers for most tests.
+ac_includes_default="\
+#include <stdio.h>
+#ifdef HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_STAT_H
+# include <sys/stat.h>
+#endif
+#ifdef STDC_HEADERS
+# include <stdlib.h>
+# include <stddef.h>
+#else
+# ifdef HAVE_STDLIB_H
+#  include <stdlib.h>
+# endif
+#endif
+#ifdef HAVE_STRING_H
+# if !defined STDC_HEADERS && defined HAVE_MEMORY_H
+#  include <memory.h>
+# endif
+# include <string.h>
+#endif
+#ifdef HAVE_STRINGS_H
+# include <strings.h>
+#endif
+#ifdef HAVE_INTTYPES_H
+# include <inttypes.h>
+#endif
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
+#ifdef HAVE_UNISTD_H
+# include <unistd.h>
+#endif"
+
+ac_subst_vars='LTLIBOBJS
+LIBOBJS
+LOADED_OPT
+LOADED
+CLIENT_GNUTLS
+CLIENT_SSL
+BIND_8_COMPAT
+EGREP
+GREP
+CPP
+OBJEXT
+EXEEXT
+ac_ct_CC
+CPPFLAGS
+LDFLAGS
+CFLAGS
+CC
+target_alias
+host_alias
+build_alias
+LIBS
+ECHO_T
+ECHO_N
+ECHO_C
+DEFS
+mandir
+localedir
+libdir
+psdir
+pdfdir
+dvidir
+htmldir
+infodir
+docdir
+oldincludedir
+includedir
+localstatedir
+sharedstatedir
+sysconfdir
+datadir
+datarootdir
+libexecdir
+sbindir
+bindir
+program_transform_name
+prefix
+exec_prefix
+PACKAGE_URL
+PACKAGE_BUGREPORT
+PACKAGE_STRING
+PACKAGE_VERSION
+PACKAGE_TARNAME
+PACKAGE_NAME
+PATH_SEPARATOR
+SHELL'
+ac_subst_files=''
+ac_user_opts='
+enable_option_checking
+'
+      ac_precious_vars='build_alias
+host_alias
+target_alias
+CC
+CFLAGS
+LDFLAGS
+LIBS
+CPPFLAGS
+CPP'
+
+
+# Initialize some variables set by options.
+ac_init_help=
+ac_init_version=false
+ac_unrecognized_opts=
+ac_unrecognized_sep=
+# The variables have the same names as the options, with
+# dashes changed to underlines.
+cache_file=/dev/null
+exec_prefix=NONE
+no_create=
+no_recursion=
+prefix=NONE
+program_prefix=NONE
+program_suffix=NONE
+program_transform_name=s,x,x,
+silent=
+site=
+srcdir=
+verbose=
+x_includes=NONE
+x_libraries=NONE
+
+# Installation directory options.
+# These are left unexpanded so users can "make install exec_prefix=/foo"
+# and all the variables that are supposed to be based on exec_prefix
+# by default will actually change.
+# Use braces instead of parens because sh, perl, etc. also accept them.
+# (The list follows the same order as the GNU Coding Standards.)
+bindir='${exec_prefix}/bin'
+sbindir='${exec_prefix}/sbin'
+libexecdir='${exec_prefix}/libexec'
+datarootdir='${prefix}/share'
+datadir='${datarootdir}'
+sysconfdir='${prefix}/etc'
+sharedstatedir='${prefix}/com'
+localstatedir='${prefix}/var'
+includedir='${prefix}/include'
+oldincludedir='/usr/include'
+docdir='${datarootdir}/doc/${PACKAGE}'
+infodir='${datarootdir}/info'
+htmldir='${docdir}'
+dvidir='${docdir}'
+pdfdir='${docdir}'
+psdir='${docdir}'
+libdir='${exec_prefix}/lib'
+localedir='${datarootdir}/locale'
+mandir='${datarootdir}/man'
+
+ac_prev=
+ac_dashdash=
+for ac_option
+do
+  # If the previous option needs an argument, assign it.
+  if test -n "$ac_prev"; then
+    eval $ac_prev=\$ac_option
+    ac_prev=
+    continue
+  fi
+
+  case $ac_option in
+  *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;;
+  *=)   ac_optarg= ;;
+  *)    ac_optarg=yes ;;
+  esac
+
+  # Accept the important Cygnus configure options, so we can diagnose typos.
+
+  case $ac_dashdash$ac_option in
+  --)
+    ac_dashdash=yes ;;
+
+  -bindir | --bindir | --bindi | --bind | --bin | --bi)
+    ac_prev=bindir ;;
+  -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*)
+    bindir=$ac_optarg ;;
+
+  -build | --build | --buil | --bui | --bu)
+    ac_prev=build_alias ;;
+  -build=* | --build=* | --buil=* | --bui=* | --bu=*)
+    build_alias=$ac_optarg ;;
+
+  -cache-file | --cache-file | --cache-fil | --cache-fi \
+  | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c)
+    ac_prev=cache_file ;;
+  -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \
+  | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*)
+    cache_file=$ac_optarg ;;
+
+  --config-cache | -C)
+    cache_file=config.cache ;;
+
+  -datadir | --datadir | --datadi | --datad)
+    ac_prev=datadir ;;
+  -datadir=* | --datadir=* | --datadi=* | --datad=*)
+    datadir=$ac_optarg ;;
+
+  -datarootdir | --datarootdir | --datarootdi | --datarootd | --dataroot \
+  | --dataroo | --dataro | --datar)
+    ac_prev=datarootdir ;;
+  -datarootdir=* | --datarootdir=* | --datarootdi=* | --datarootd=* \
+  | --dataroot=* | --dataroo=* | --dataro=* | --datar=*)
+    datarootdir=$ac_optarg ;;
+
+  -disable-* | --disable-*)
+    ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'`
+    # Reject names that are not valid shell variable names.
+    expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
+      as_fn_error $? "invalid feature name: $ac_useropt"
+    ac_useropt_orig=$ac_useropt
+    ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
+    case $ac_user_opts in
+      *"
+"enable_$ac_useropt"
+"*) ;;
+      *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig"
+	 ac_unrecognized_sep=', ';;
+    esac
+    eval enable_$ac_useropt=no ;;
+
+  -docdir | --docdir | --docdi | --doc | --do)
+    ac_prev=docdir ;;
+  -docdir=* | --docdir=* | --docdi=* | --doc=* | --do=*)
+    docdir=$ac_optarg ;;
+
+  -dvidir | --dvidir | --dvidi | --dvid | --dvi | --dv)
+    ac_prev=dvidir ;;
+  -dvidir=* | --dvidir=* | --dvidi=* | --dvid=* | --dvi=* | --dv=*)
+    dvidir=$ac_optarg ;;
+
+  -enable-* | --enable-*)
+    ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'`
+    # Reject names that are not valid shell variable names.
+    expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
+      as_fn_error $? "invalid feature name: $ac_useropt"
+    ac_useropt_orig=$ac_useropt
+    ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
+    case $ac_user_opts in
+      *"
+"enable_$ac_useropt"
+"*) ;;
+      *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig"
+	 ac_unrecognized_sep=', ';;
+    esac
+    eval enable_$ac_useropt=\$ac_optarg ;;
+
+  -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \
+  | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \
+  | --exec | --exe | --ex)
+    ac_prev=exec_prefix ;;
+  -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \
+  | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \
+  | --exec=* | --exe=* | --ex=*)
+    exec_prefix=$ac_optarg ;;
+
+  -gas | --gas | --ga | --g)
+    # Obsolete; use --with-gas.
+    with_gas=yes ;;
+
+  -help | --help | --hel | --he | -h)
+    ac_init_help=long ;;
+  -help=r* | --help=r* | --hel=r* | --he=r* | -hr*)
+    ac_init_help=recursive ;;
+  -help=s* | --help=s* | --hel=s* | --he=s* | -hs*)
+    ac_init_help=short ;;
+
+  -host | --host | --hos | --ho)
+    ac_prev=host_alias ;;
+  -host=* | --host=* | --hos=* | --ho=*)
+    host_alias=$ac_optarg ;;
+
+  -htmldir | --htmldir | --htmldi | --htmld | --html | --htm | --ht)
+    ac_prev=htmldir ;;
+  -htmldir=* | --htmldir=* | --htmldi=* | --htmld=* | --html=* | --htm=* \
+  | --ht=*)
+    htmldir=$ac_optarg ;;
+
+  -includedir | --includedir | --includedi | --included | --include \
+  | --includ | --inclu | --incl | --inc)
+    ac_prev=includedir ;;
+  -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \
+  | --includ=* | --inclu=* | --incl=* | --inc=*)
+    includedir=$ac_optarg ;;
+
+  -infodir | --infodir | --infodi | --infod | --info | --inf)
+    ac_prev=infodir ;;
+  -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*)
+    infodir=$ac_optarg ;;
+
+  -libdir | --libdir | --libdi | --libd)
+    ac_prev=libdir ;;
+  -libdir=* | --libdir=* | --libdi=* | --libd=*)
+    libdir=$ac_optarg ;;
+
+  -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \
+  | --libexe | --libex | --libe)
+    ac_prev=libexecdir ;;
+  -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \
+  | --libexe=* | --libex=* | --libe=*)
+    libexecdir=$ac_optarg ;;
+
+  -localedir | --localedir | --localedi | --localed | --locale)
+    ac_prev=localedir ;;
+  -localedir=* | --localedir=* | --localedi=* | --localed=* | --locale=*)
+    localedir=$ac_optarg ;;
+
+  -localstatedir | --localstatedir | --localstatedi | --localstated \
+  | --localstate | --localstat | --localsta | --localst | --locals)
+    ac_prev=localstatedir ;;
+  -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \
+  | --localstate=* | --localstat=* | --localsta=* | --localst=* | --locals=*)
+    localstatedir=$ac_optarg ;;
+
+  -mandir | --mandir | --mandi | --mand | --man | --ma | --m)
+    ac_prev=mandir ;;
+  -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*)
+    mandir=$ac_optarg ;;
+
+  -nfp | --nfp | --nf)
+    # Obsolete; use --without-fp.
+    with_fp=no ;;
+
+  -no-create | --no-create | --no-creat | --no-crea | --no-cre \
+  | --no-cr | --no-c | -n)
+    no_create=yes ;;
+
+  -no-recursion | --no-recursion | --no-recursio | --no-recursi \
+  | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r)
+    no_recursion=yes ;;
+
+  -oldincludedir | --oldincludedir | --oldincludedi | --oldincluded \
+  | --oldinclude | --oldinclud | --oldinclu | --oldincl | --oldinc \
+  | --oldin | --oldi | --old | --ol | --o)
+    ac_prev=oldincludedir ;;
+  -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \
+  | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \
+  | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*)
+    oldincludedir=$ac_optarg ;;
+
+  -prefix | --prefix | --prefi | --pref | --pre | --pr | --p)
+    ac_prev=prefix ;;
+  -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*)
+    prefix=$ac_optarg ;;
+
+  -program-prefix | --program-prefix | --program-prefi | --program-pref \
+  | --program-pre | --program-pr | --program-p)
+    ac_prev=program_prefix ;;
+  -program-prefix=* | --program-prefix=* | --program-prefi=* \
+  | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*)
+    program_prefix=$ac_optarg ;;
+
+  -program-suffix | --program-suffix | --program-suffi | --program-suff \
+  | --program-suf | --program-su | --program-s)
+    ac_prev=program_suffix ;;
+  -program-suffix=* | --program-suffix=* | --program-suffi=* \
+  | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*)
+    program_suffix=$ac_optarg ;;
+
+  -program-transform-name | --program-transform-name \
+  | --program-transform-nam | --program-transform-na \
+  | --program-transform-n | --program-transform- \
+  | --program-transform | --program-transfor \
+  | --program-transfo | --program-transf \
+  | --program-trans | --program-tran \
+  | --progr-tra | --program-tr | --program-t)
+    ac_prev=program_transform_name ;;
+  -program-transform-name=* | --program-transform-name=* \
+  | --program-transform-nam=* | --program-transform-na=* \
+  | --program-transform-n=* | --program-transform-=* \
+  | --program-transform=* | --program-transfor=* \
+  | --program-transfo=* | --program-transf=* \
+  | --program-trans=* | --program-tran=* \
+  | --progr-tra=* | --program-tr=* | --program-t=*)
+    program_transform_name=$ac_optarg ;;
+
+  -pdfdir | --pdfdir | --pdfdi | --pdfd | --pdf | --pd)
+    ac_prev=pdfdir ;;
+  -pdfdir=* | --pdfdir=* | --pdfdi=* | --pdfd=* | --pdf=* | --pd=*)
+    pdfdir=$ac_optarg ;;
+
+  -psdir | --psdir | --psdi | --psd | --ps)
+    ac_prev=psdir ;;
+  -psdir=* | --psdir=* | --psdi=* | --psd=* | --ps=*)
+    psdir=$ac_optarg ;;
+
+  -q | -quiet | --quiet | --quie | --qui | --qu | --q \
+  | -silent | --silent | --silen | --sile | --sil)
+    silent=yes ;;
+
+  -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
+    ac_prev=sbindir ;;
+  -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
+  | --sbi=* | --sb=*)
+    sbindir=$ac_optarg ;;
+
+  -sharedstatedir | --sharedstatedir | --sharedstatedi \
+  | --sharedstated | --sharedstate | --sharedstat | --sharedsta \
+  | --sharedst | --shareds | --shared | --share | --shar \
+  | --sha | --sh)
+    ac_prev=sharedstatedir ;;
+  -sharedstatedir=* | --sharedstatedir=* | --sharedstatedi=* \
+  | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \
+  | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \
+  | --sha=* | --sh=*)
+    sharedstatedir=$ac_optarg ;;
+
+  -site | --site | --sit)
+    ac_prev=site ;;
+  -site=* | --site=* | --sit=*)
+    site=$ac_optarg ;;
+
+  -srcdir | --srcdir | --srcdi | --srcd | --src | --sr)
+    ac_prev=srcdir ;;
+  -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*)
+    srcdir=$ac_optarg ;;
+
+  -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \
+  | --syscon | --sysco | --sysc | --sys | --sy)
+    ac_prev=sysconfdir ;;
+  -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \
+  | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*)
+    sysconfdir=$ac_optarg ;;
+
+  -target | --target | --targe | --targ | --tar | --ta | --t)
+    ac_prev=target_alias ;;
+  -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*)
+    target_alias=$ac_optarg ;;
+
+  -v | -verbose | --verbose | --verbos | --verbo | --verb)
+    verbose=yes ;;
+
+  -version | --version | --versio | --versi | --vers | -V)
+    ac_init_version=: ;;
+
+  -with-* | --with-*)
+    ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'`
+    # Reject names that are not valid shell variable names.
+    expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
+      as_fn_error $? "invalid package name: $ac_useropt"
+    ac_useropt_orig=$ac_useropt
+    ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
+    case $ac_user_opts in
+      *"
+"with_$ac_useropt"
+"*) ;;
+      *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig"
+	 ac_unrecognized_sep=', ';;
+    esac
+    eval with_$ac_useropt=\$ac_optarg ;;
+
+  -without-* | --without-*)
+    ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'`
+    # Reject names that are not valid shell variable names.
+    expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null &&
+      as_fn_error $? "invalid package name: $ac_useropt"
+    ac_useropt_orig=$ac_useropt
+    ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'`
+    case $ac_user_opts in
+      *"
+"with_$ac_useropt"
+"*) ;;
+      *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig"
+	 ac_unrecognized_sep=', ';;
+    esac
+    eval with_$ac_useropt=no ;;
+
+  --x)
+    # Obsolete; use --with-x.
+    with_x=yes ;;
+
+  -x-includes | --x-includes | --x-include | --x-includ | --x-inclu \
+  | --x-incl | --x-inc | --x-in | --x-i)
+    ac_prev=x_includes ;;
+  -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \
+  | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*)
+    x_includes=$ac_optarg ;;
+
+  -x-libraries | --x-libraries | --x-librarie | --x-librari \
+  | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l)
+    ac_prev=x_libraries ;;
+  -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \
+  | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*)
+    x_libraries=$ac_optarg ;;
+
+  -*) as_fn_error $? "unrecognized option: \`$ac_option'
+Try \`$0 --help' for more information"
+    ;;
+
+  *=*)
+    ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='`
+    # Reject names that are not valid shell variable names.
+    case $ac_envvar in #(
+      '' | [0-9]* | *[!_$as_cr_alnum]* )
+      as_fn_error $? "invalid variable name: \`$ac_envvar'" ;;
+    esac
+    eval $ac_envvar=\$ac_optarg
+    export $ac_envvar ;;
+
+  *)
+    # FIXME: should be removed in autoconf 3.0.
+    $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2
+    expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null &&
+      $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2
+    : "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}"
+    ;;
+
+  esac
+done
+
+if test -n "$ac_prev"; then
+  ac_option=--`echo $ac_prev | sed 's/_/-/g'`
+  as_fn_error $? "missing argument to $ac_option"
+fi
+
+if test -n "$ac_unrecognized_opts"; then
+  case $enable_option_checking in
+    no) ;;
+    fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;;
+    *)     $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;;
+  esac
+fi
+
+# Check all directory arguments for consistency.
+for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
+		datadir sysconfdir sharedstatedir localstatedir includedir \
+		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
+		libdir localedir mandir
+do
+  eval ac_val=\$$ac_var
+  # Remove trailing slashes.
+  case $ac_val in
+    */ )
+      ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'`
+      eval $ac_var=\$ac_val;;
+  esac
+  # Be sure to have absolute directory names.
+  case $ac_val in
+    [\\/$]* | ?:[\\/]* )  continue;;
+    NONE | '' ) case $ac_var in *prefix ) continue;; esac;;
+  esac
+  as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val"
+done
+
+# There might be people who depend on the old broken behavior: `$host'
+# used to hold the argument of --host etc.
+# FIXME: To remove some day.
+build=$build_alias
+host=$host_alias
+target=$target_alias
+
+# FIXME: To remove some day.
+if test "x$host_alias" != x; then
+  if test "x$build_alias" = x; then
+    cross_compiling=maybe
+  elif test "x$build_alias" != "x$host_alias"; then
+    cross_compiling=yes
+  fi
+fi
+
+ac_tool_prefix=
+test -n "$host_alias" && ac_tool_prefix=$host_alias-
+
+test "$silent" = yes && exec 6>/dev/null
+
+
+ac_pwd=`pwd` && test -n "$ac_pwd" &&
+ac_ls_di=`ls -di .` &&
+ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` ||
+  as_fn_error $? "working directory cannot be determined"
+test "X$ac_ls_di" = "X$ac_pwd_ls_di" ||
+  as_fn_error $? "pwd does not report name of working directory"
+
+
+# Find the source files, if location was not specified.
+if test -z "$srcdir"; then
+  ac_srcdir_defaulted=yes
+  # Try the directory containing this script, then the parent directory.
+  ac_confdir=`$as_dirname -- "$as_myself" ||
+$as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+	 X"$as_myself" : 'X\(//\)[^/]' \| \
+	 X"$as_myself" : 'X\(//\)$' \| \
+	 X"$as_myself" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X"$as_myself" |
+    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)[^/].*/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\).*/{
+	    s//\1/
+	    q
+	  }
+	  s/.*/./; q'`
+  srcdir=$ac_confdir
+  if test ! -r "$srcdir/$ac_unique_file"; then
+    srcdir=..
+  fi
+else
+  ac_srcdir_defaulted=no
+fi
+if test ! -r "$srcdir/$ac_unique_file"; then
+  test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .."
+  as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir"
+fi
+ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work"
+ac_abs_confdir=`(
+	cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg"
+	pwd)`
+# When building in place, set srcdir=.
+if test "$ac_abs_confdir" = "$ac_pwd"; then
+  srcdir=.
+fi
+# Remove unnecessary trailing slashes from srcdir.
+# Double slashes in file names in object file debugging info
+# mess up M-x gdb in Emacs.
+case $srcdir in
+*/) srcdir=`expr "X$srcdir" : 'X\(.*[^/]\)' \| "X$srcdir" : 'X\(.*\)'`;;
+esac
+for ac_var in $ac_precious_vars; do
+  eval ac_env_${ac_var}_set=\${${ac_var}+set}
+  eval ac_env_${ac_var}_value=\$${ac_var}
+  eval ac_cv_env_${ac_var}_set=\${${ac_var}+set}
+  eval ac_cv_env_${ac_var}_value=\$${ac_var}
+done
+
+#
+# Report the --help message.
+#
+if test "$ac_init_help" = "long"; then
+  # Omit some internal or obsolete options to make the list less imposing.
+  # This message is too long to be a string in the A/UX 3.1 sh.
+  cat <<_ACEOF
+\`configure' configures this package to adapt to many kinds of systems.
+
+Usage: $0 [OPTION]... [VAR=VALUE]...
+
+To assign environment variables (e.g., CC, CFLAGS...), specify them as
+VAR=VALUE.  See below for descriptions of some of the useful variables.
+
+Defaults for the options are specified in brackets.
+
+Configuration:
+  -h, --help              display this help and exit
+      --help=short        display options specific to this package
+      --help=recursive    display the short help of all the included packages
+  -V, --version           display version information and exit
+  -q, --quiet, --silent   do not print \`checking ...' messages
+      --cache-file=FILE   cache test results in FILE [disabled]
+  -C, --config-cache      alias for \`--cache-file=config.cache'
+  -n, --no-create         do not create output files
+      --srcdir=DIR        find the sources in DIR [configure dir or \`..']
+
+Installation directories:
+  --prefix=PREFIX         install architecture-independent files in PREFIX
+                          [$ac_default_prefix]
+  --exec-prefix=EPREFIX   install architecture-dependent files in EPREFIX
+                          [PREFIX]
+
+By default, \`make install' will install all the files in
+\`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc.  You can specify
+an installation prefix other than \`$ac_default_prefix' using \`--prefix',
+for instance \`--prefix=\$HOME'.
+
+For better control, use the options below.
+
+Fine tuning of the installation directories:
+  --bindir=DIR            user executables [EPREFIX/bin]
+  --sbindir=DIR           system admin executables [EPREFIX/sbin]
+  --libexecdir=DIR        program executables [EPREFIX/libexec]
+  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
+  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
+  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
+  --libdir=DIR            object code libraries [EPREFIX/lib]
+  --includedir=DIR        C header files [PREFIX/include]
+  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
+  --datarootdir=DIR       read-only arch.-independent data root [PREFIX/share]
+  --datadir=DIR           read-only architecture-independent data [DATAROOTDIR]
+  --infodir=DIR           info documentation [DATAROOTDIR/info]
+  --localedir=DIR         locale-dependent data [DATAROOTDIR/locale]
+  --mandir=DIR            man documentation [DATAROOTDIR/man]
+  --docdir=DIR            documentation root [DATAROOTDIR/doc/PACKAGE]
+  --htmldir=DIR           html documentation [DOCDIR]
+  --dvidir=DIR            dvi documentation [DOCDIR]
+  --pdfdir=DIR            pdf documentation [DOCDIR]
+  --psdir=DIR             ps documentation [DOCDIR]
+_ACEOF
+
+  cat <<\_ACEOF
+_ACEOF
+fi
+
+if test -n "$ac_init_help"; then
+
+  cat <<\_ACEOF
+
+Some influential environment variables:
+  CC          C compiler command
+  CFLAGS      C compiler flags
+  LDFLAGS     linker flags, e.g. -L<lib dir> if you have libraries in a
+              nonstandard directory <lib dir>
+  LIBS        libraries to pass to the linker, e.g. -l<library>
+  CPPFLAGS    (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if
+              you have headers in a nonstandard directory <include dir>
+  CPP         C preprocessor
+
+Use these variables to override the choices made by `configure' or to help
+it to find libraries and programs with nonstandard names/locations.
+
+Report bugs to the package provider.
+_ACEOF
+ac_status=$?
+fi
+
+if test "$ac_init_help" = "recursive"; then
+  # If there are subdirs, report their specific --help.
+  for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue
+    test -d "$ac_dir" ||
+      { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } ||
+      continue
+    ac_builddir=.
+
+case "$ac_dir" in
+.) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
+*)
+  ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'`
+  # A ".." for each directory in $ac_dir_suffix.
+  ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
+  case $ac_top_builddir_sub in
+  "") ac_top_builddir_sub=. ac_top_build_prefix= ;;
+  *)  ac_top_build_prefix=$ac_top_builddir_sub/ ;;
+  esac ;;
+esac
+ac_abs_top_builddir=$ac_pwd
+ac_abs_builddir=$ac_pwd$ac_dir_suffix
+# for backward compatibility:
+ac_top_builddir=$ac_top_build_prefix
+
+case $srcdir in
+  .)  # We are building in place.
+    ac_srcdir=.
+    ac_top_srcdir=$ac_top_builddir_sub
+    ac_abs_top_srcdir=$ac_pwd ;;
+  [\\/]* | ?:[\\/]* )  # Absolute name.
+    ac_srcdir=$srcdir$ac_dir_suffix;
+    ac_top_srcdir=$srcdir
+    ac_abs_top_srcdir=$srcdir ;;
+  *) # Relative name.
+    ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix
+    ac_top_srcdir=$ac_top_build_prefix$srcdir
+    ac_abs_top_srcdir=$ac_pwd/$srcdir ;;
+esac
+ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix
+
+    cd "$ac_dir" || { ac_status=$?; continue; }
+    # Check for guested configure.
+    if test -f "$ac_srcdir/configure.gnu"; then
+      echo &&
+      $SHELL "$ac_srcdir/configure.gnu" --help=recursive
+    elif test -f "$ac_srcdir/configure"; then
+      echo &&
+      $SHELL "$ac_srcdir/configure" --help=recursive
+    else
+      $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2
+    fi || ac_status=$?
+    cd "$ac_pwd" || { ac_status=$?; break; }
+  done
+fi
+
+test -n "$ac_init_help" && exit $ac_status
+if $ac_init_version; then
+  cat <<\_ACEOF
+configure
+generated by GNU Autoconf 2.69
+
+Copyright (C) 2012 Free Software Foundation, Inc.
+This configure script is free software; the Free Software Foundation
+gives unlimited permission to copy, distribute and modify it.
+_ACEOF
+  exit
+fi
+
+## ------------------------ ##
+## Autoconf initialization. ##
+## ------------------------ ##
+
+# ac_fn_c_try_compile LINENO
+# --------------------------
+# Try to compile conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_compile ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  rm -f conftest.$ac_objext
+  if { { ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_compile") 2>conftest.err
+  ac_status=$?
+  if test -s conftest.err; then
+    grep -v '^ *+' conftest.err >conftest.er1
+    cat conftest.er1 >&5
+    mv -f conftest.er1 conftest.err
+  fi
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then :
+  ac_retval=0
+else
+  $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_retval=1
+fi
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+  as_fn_set_status $ac_retval
+
+} # ac_fn_c_try_compile
+
+# ac_fn_c_try_cpp LINENO
+# ----------------------
+# Try to preprocess conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_cpp ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  if { { ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
+  ac_status=$?
+  if test -s conftest.err; then
+    grep -v '^ *+' conftest.err >conftest.er1
+    cat conftest.er1 >&5
+    mv -f conftest.er1 conftest.err
+  fi
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; } > conftest.i && {
+	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       }; then :
+  ac_retval=0
+else
+  $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+    ac_retval=1
+fi
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+  as_fn_set_status $ac_retval
+
+} # ac_fn_c_try_cpp
+
+# ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES
+# -------------------------------------------------------
+# Tests whether HEADER exists, giving a warning if it cannot be compiled using
+# the include files in INCLUDES and setting the cache variable VAR
+# accordingly.
+ac_fn_c_check_header_mongrel ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  if eval \${$3+:} false; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
+$as_echo_n "checking for $2... " >&6; }
+if eval \${$3+:} false; then :
+  $as_echo_n "(cached) " >&6
+fi
+eval ac_res=\$$3
+	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+$as_echo "$ac_res" >&6; }
+else
+  # Is the header compilable?
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5
+$as_echo_n "checking $2 usability... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+$4
+#include <$2>
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  ac_header_compiler=yes
+else
+  ac_header_compiler=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5
+$as_echo "$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5
+$as_echo_n "checking $2 presence... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <$2>
+_ACEOF
+if ac_fn_c_try_cpp "$LINENO"; then :
+  ac_header_preproc=yes
+else
+  ac_header_preproc=no
+fi
+rm -f conftest.err conftest.i conftest.$ac_ext
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5
+$as_echo "$ac_header_preproc" >&6; }
+
+# So?  What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #((
+  yes:no: )
+    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5
+$as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;}
+    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
+$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
+    ;;
+  no:yes:* )
+    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5
+$as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;}
+    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2:     check for missing prerequisite headers?" >&5
+$as_echo "$as_me: WARNING: $2:     check for missing prerequisite headers?" >&2;}
+    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5
+$as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;}
+    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2:     section \"Present But Cannot Be Compiled\"" >&5
+$as_echo "$as_me: WARNING: $2:     section \"Present But Cannot Be Compiled\"" >&2;}
+    { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
+$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
+    ;;
+esac
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
+$as_echo_n "checking for $2... " >&6; }
+if eval \${$3+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  eval "$3=\$ac_header_compiler"
+fi
+eval ac_res=\$$3
+	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+$as_echo "$ac_res" >&6; }
+fi
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+
+} # ac_fn_c_check_header_mongrel
+
+# ac_fn_c_try_run LINENO
+# ----------------------
+# Try to link conftest.$ac_ext, and return whether this succeeded. Assumes
+# that executables *can* be run.
+ac_fn_c_try_run ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  if { { ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_link") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; } && { ac_try='./conftest$ac_exeext'
+  { { case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_try") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; }; then :
+  ac_retval=0
+else
+  $as_echo "$as_me: program exited with status $ac_status" >&5
+       $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+       ac_retval=$ac_status
+fi
+  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+  as_fn_set_status $ac_retval
+
+} # ac_fn_c_try_run
+
+# ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES
+# -------------------------------------------------------
+# Tests whether HEADER exists and can be compiled using the include files in
+# INCLUDES, setting the cache variable VAR accordingly.
+ac_fn_c_check_header_compile ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
+$as_echo_n "checking for $2... " >&6; }
+if eval \${$3+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+$4
+#include <$2>
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  eval "$3=yes"
+else
+  eval "$3=no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+eval ac_res=\$$3
+	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+$as_echo "$ac_res" >&6; }
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+
+} # ac_fn_c_check_header_compile
+
+# ac_fn_c_try_link LINENO
+# -----------------------
+# Try to link conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_link ()
+{
+  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+  rm -f conftest.$ac_objext conftest$ac_exeext
+  if { { ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_link") 2>conftest.err
+  ac_status=$?
+  if test -s conftest.err; then
+    grep -v '^ *+' conftest.err >conftest.er1
+    cat conftest.er1 >&5
+    mv -f conftest.er1 conftest.err
+  fi
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext && {
+	 test "$cross_compiling" = yes ||
+	 test -x conftest$ac_exeext
+       }; then :
+  ac_retval=0
+else
+  $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_retval=1
+fi
+  # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
+  # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
+  # interfere with the next link command; also delete a directory that is
+  # left behind by Apple's compiler.  We do this before executing the actions.
+  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
+  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+  as_fn_set_status $ac_retval
+
+} # ac_fn_c_try_link
+cat >config.log <<_ACEOF
+This file contains any messages produced by compilers while
+running configure, to aid debugging if configure makes a mistake.
+
+It was created by $as_me, which was
+generated by GNU Autoconf 2.69.  Invocation command line was
+
+  $ $0 $@
+
+_ACEOF
+exec 5>>config.log
+{
+cat <<_ASUNAME
+## --------- ##
+## Platform. ##
+## --------- ##
+
+hostname = `(hostname || uname -n) 2>/dev/null | sed 1q`
+uname -m = `(uname -m) 2>/dev/null || echo unknown`
+uname -r = `(uname -r) 2>/dev/null || echo unknown`
+uname -s = `(uname -s) 2>/dev/null || echo unknown`
+uname -v = `(uname -v) 2>/dev/null || echo unknown`
+
+/usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null || echo unknown`
+/bin/uname -X     = `(/bin/uname -X) 2>/dev/null     || echo unknown`
+
+/bin/arch              = `(/bin/arch) 2>/dev/null              || echo unknown`
+/usr/bin/arch -k       = `(/usr/bin/arch -k) 2>/dev/null       || echo unknown`
+/usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null || echo unknown`
+/usr/bin/hostinfo      = `(/usr/bin/hostinfo) 2>/dev/null      || echo unknown`
+/bin/machine           = `(/bin/machine) 2>/dev/null           || echo unknown`
+/usr/bin/oslevel       = `(/usr/bin/oslevel) 2>/dev/null       || echo unknown`
+/bin/universe          = `(/bin/universe) 2>/dev/null          || echo unknown`
+
+_ASUNAME
+
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    $as_echo "PATH: $as_dir"
+  done
+IFS=$as_save_IFS
+
+} >&5
+
+cat >&5 <<_ACEOF
+
+
+## ----------- ##
+## Core tests. ##
+## ----------- ##
+
+_ACEOF
+
+
+# Keep a trace of the command line.
+# Strip out --no-create and --no-recursion so they do not pile up.
+# Strip out --silent because we don't want to record it for future runs.
+# Also quote any args containing shell meta-characters.
+# Make two passes to allow for proper duplicate-argument suppression.
+ac_configure_args=
+ac_configure_args0=
+ac_configure_args1=
+ac_must_keep_next=false
+for ac_pass in 1 2
+do
+  for ac_arg
+  do
+    case $ac_arg in
+    -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;;
+    -q | -quiet | --quiet | --quie | --qui | --qu | --q \
+    | -silent | --silent | --silen | --sile | --sil)
+      continue ;;
+    *\'*)
+      ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
+    esac
+    case $ac_pass in
+    1) as_fn_append ac_configure_args0 " '$ac_arg'" ;;
+    2)
+      as_fn_append ac_configure_args1 " '$ac_arg'"
+      if test $ac_must_keep_next = true; then
+	ac_must_keep_next=false # Got value, back to normal.
+      else
+	case $ac_arg in
+	  *=* | --config-cache | -C | -disable-* | --disable-* \
+	  | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \
+	  | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \
+	  | -with-* | --with-* | -without-* | --without-* | --x)
+	    case "$ac_configure_args0 " in
+	      "$ac_configure_args1"*" '$ac_arg' "* ) continue ;;
+	    esac
+	    ;;
+	  -* ) ac_must_keep_next=true ;;
+	esac
+      fi
+      as_fn_append ac_configure_args " '$ac_arg'"
+      ;;
+    esac
+  done
+done
+{ ac_configure_args0=; unset ac_configure_args0;}
+{ ac_configure_args1=; unset ac_configure_args1;}
+
+# When interrupted or exit'd, cleanup temporary files, and complete
+# config.log.  We remove comments because anyway the quotes in there
+# would cause problems or look ugly.
+# WARNING: Use '\'' to represent an apostrophe within the trap.
+# WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug.
+trap 'exit_status=$?
+  # Save into config.log some information that might help in debugging.
+  {
+    echo
+
+    $as_echo "## ---------------- ##
+## Cache variables. ##
+## ---------------- ##"
+    echo
+    # The following way of writing the cache mishandles newlines in values,
+(
+  for ac_var in `(set) 2>&1 | sed -n '\''s/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'\''`; do
+    eval ac_val=\$$ac_var
+    case $ac_val in #(
+    *${as_nl}*)
+      case $ac_var in #(
+      *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
+$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+      esac
+      case $ac_var in #(
+      _ | IFS | as_nl) ;; #(
+      BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #(
+      *) { eval $ac_var=; unset $ac_var;} ;;
+      esac ;;
+    esac
+  done
+  (set) 2>&1 |
+    case $as_nl`(ac_space='\'' '\''; set) 2>&1` in #(
+    *${as_nl}ac_space=\ *)
+      sed -n \
+	"s/'\''/'\''\\\\'\'''\''/g;
+	  s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\''\\2'\''/p"
+      ;; #(
+    *)
+      sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p"
+      ;;
+    esac |
+    sort
+)
+    echo
+
+    $as_echo "## ----------------- ##
+## Output variables. ##
+## ----------------- ##"
+    echo
+    for ac_var in $ac_subst_vars
+    do
+      eval ac_val=\$$ac_var
+      case $ac_val in
+      *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+      esac
+      $as_echo "$ac_var='\''$ac_val'\''"
+    done | sort
+    echo
+
+    if test -n "$ac_subst_files"; then
+      $as_echo "## ------------------- ##
+## File substitutions. ##
+## ------------------- ##"
+      echo
+      for ac_var in $ac_subst_files
+      do
+	eval ac_val=\$$ac_var
+	case $ac_val in
+	*\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+	esac
+	$as_echo "$ac_var='\''$ac_val'\''"
+      done | sort
+      echo
+    fi
+
+    if test -s confdefs.h; then
+      $as_echo "## ----------- ##
+## confdefs.h. ##
+## ----------- ##"
+      echo
+      cat confdefs.h
+      echo
+    fi
+    test "$ac_signal" != 0 &&
+      $as_echo "$as_me: caught signal $ac_signal"
+    $as_echo "$as_me: exit $exit_status"
+  } >&5
+  rm -f core *.core core.conftest.* &&
+    rm -f -r conftest* confdefs* conf$$* $ac_clean_files &&
+    exit $exit_status
+' 0
+for ac_signal in 1 2 13 15; do
+  trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal
+done
+ac_signal=0
+
+# confdefs.h avoids OS command line length limits that DEFS can exceed.
+rm -f -r conftest* confdefs.h
+
+$as_echo "/* confdefs.h */" > confdefs.h
+
+# Predefined preprocessor variables.
+
+cat >>confdefs.h <<_ACEOF
+#define PACKAGE_NAME "$PACKAGE_NAME"
+_ACEOF
+
+cat >>confdefs.h <<_ACEOF
+#define PACKAGE_TARNAME "$PACKAGE_TARNAME"
+_ACEOF
+
+cat >>confdefs.h <<_ACEOF
+#define PACKAGE_VERSION "$PACKAGE_VERSION"
+_ACEOF
+
+cat >>confdefs.h <<_ACEOF
+#define PACKAGE_STRING "$PACKAGE_STRING"
+_ACEOF
+
+cat >>confdefs.h <<_ACEOF
+#define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT"
+_ACEOF
+
+cat >>confdefs.h <<_ACEOF
+#define PACKAGE_URL "$PACKAGE_URL"
+_ACEOF
+
+
+# Let the site file select an alternate cache file if it wants to.
+# Prefer an explicitly selected file to automatically selected ones.
+ac_site_file1=NONE
+ac_site_file2=NONE
+if test -n "$CONFIG_SITE"; then
+  # We do not want a PATH search for config.site.
+  case $CONFIG_SITE in #((
+    -*)  ac_site_file1=./$CONFIG_SITE;;
+    */*) ac_site_file1=$CONFIG_SITE;;
+    *)   ac_site_file1=./$CONFIG_SITE;;
+  esac
+elif test "x$prefix" != xNONE; then
+  ac_site_file1=$prefix/share/config.site
+  ac_site_file2=$prefix/etc/config.site
+else
+  ac_site_file1=$ac_default_prefix/share/config.site
+  ac_site_file2=$ac_default_prefix/etc/config.site
+fi
+for ac_site_file in "$ac_site_file1" "$ac_site_file2"
+do
+  test "x$ac_site_file" = xNONE && continue
+  if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then
+    { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5
+$as_echo "$as_me: loading site script $ac_site_file" >&6;}
+    sed 's/^/| /' "$ac_site_file" >&5
+    . "$ac_site_file" \
+      || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "failed to load site script $ac_site_file
+See \`config.log' for more details" "$LINENO" 5; }
+  fi
+done
+
+if test -r "$cache_file"; then
+  # Some versions of bash will fail to source /dev/null (special files
+  # actually), so we avoid doing that.  DJGPP emulates it as a regular file.
+  if test /dev/null != "$cache_file" && test -f "$cache_file"; then
+    { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5
+$as_echo "$as_me: loading cache $cache_file" >&6;}
+    case $cache_file in
+      [\\/]* | ?:[\\/]* ) . "$cache_file";;
+      *)                      . "./$cache_file";;
+    esac
+  fi
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5
+$as_echo "$as_me: creating cache $cache_file" >&6;}
+  >$cache_file
+fi
+
+# Check that the precious variables saved in the cache have kept the same
+# value.
+ac_cache_corrupted=false
+for ac_var in $ac_precious_vars; do
+  eval ac_old_set=\$ac_cv_env_${ac_var}_set
+  eval ac_new_set=\$ac_env_${ac_var}_set
+  eval ac_old_val=\$ac_cv_env_${ac_var}_value
+  eval ac_new_val=\$ac_env_${ac_var}_value
+  case $ac_old_set,$ac_new_set in
+    set,)
+      { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
+$as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
+      ac_cache_corrupted=: ;;
+    ,set)
+      { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5
+$as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
+      ac_cache_corrupted=: ;;
+    ,);;
+    *)
+      if test "x$ac_old_val" != "x$ac_new_val"; then
+	# differences in whitespace do not lead to failure.
+	ac_old_val_w=`echo x $ac_old_val`
+	ac_new_val_w=`echo x $ac_new_val`
+	if test "$ac_old_val_w" != "$ac_new_val_w"; then
+	  { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5
+$as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
+	  ac_cache_corrupted=:
+	else
+	  { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5
+$as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;}
+	  eval $ac_var=\$ac_old_val
+	fi
+	{ $as_echo "$as_me:${as_lineno-$LINENO}:   former value:  \`$ac_old_val'" >&5
+$as_echo "$as_me:   former value:  \`$ac_old_val'" >&2;}
+	{ $as_echo "$as_me:${as_lineno-$LINENO}:   current value: \`$ac_new_val'" >&5
+$as_echo "$as_me:   current value: \`$ac_new_val'" >&2;}
+      fi;;
+  esac
+  # Pass precious variables to config.status.
+  if test "$ac_new_set" = set; then
+    case $ac_new_val in
+    *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;;
+    *) ac_arg=$ac_var=$ac_new_val ;;
+    esac
+    case " $ac_configure_args " in
+      *" '$ac_arg' "*) ;; # Avoid dups.  Use of quotes ensures accuracy.
+      *) as_fn_append ac_configure_args " '$ac_arg'" ;;
+    esac
+  fi
+done
+if $ac_cache_corrupted; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+  { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5
+$as_echo "$as_me: error: changes in the environment can compromise the build" >&2;}
+  as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5
+fi
+## -------------------- ##
+## Main body of script. ##
+## -------------------- ##
+
+ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
+
+
+
+
+
+
+ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+if test -n "$ac_tool_prefix"; then
+  # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args.
+set dummy ${ac_tool_prefix}gcc; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_CC+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$CC"; then
+  ac_cv_prog_CC="$CC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_prog_CC="${ac_tool_prefix}gcc"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+CC=$ac_cv_prog_CC
+if test -n "$CC"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+$as_echo "$CC" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+fi
+if test -z "$ac_cv_prog_CC"; then
+  ac_ct_CC=$CC
+  # Extract the first word of "gcc", so it can be a program name with args.
+set dummy gcc; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_ac_ct_CC+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$ac_ct_CC"; then
+  ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_prog_ac_ct_CC="gcc"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+ac_ct_CC=$ac_cv_prog_ac_ct_CC
+if test -n "$ac_ct_CC"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
+$as_echo "$ac_ct_CC" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+  if test "x$ac_ct_CC" = x; then
+    CC=""
+  else
+    case $cross_compiling:$ac_tool_warned in
+yes:)
+{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ac_tool_warned=yes ;;
+esac
+    CC=$ac_ct_CC
+  fi
+else
+  CC="$ac_cv_prog_CC"
+fi
+
+if test -z "$CC"; then
+          if test -n "$ac_tool_prefix"; then
+    # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args.
+set dummy ${ac_tool_prefix}cc; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_CC+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$CC"; then
+  ac_cv_prog_CC="$CC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_prog_CC="${ac_tool_prefix}cc"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+CC=$ac_cv_prog_CC
+if test -n "$CC"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+$as_echo "$CC" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+  fi
+fi
+if test -z "$CC"; then
+  # Extract the first word of "cc", so it can be a program name with args.
+set dummy cc; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_CC+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$CC"; then
+  ac_cv_prog_CC="$CC" # Let the user override the test.
+else
+  ac_prog_rejected=no
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
+       ac_prog_rejected=yes
+       continue
+     fi
+    ac_cv_prog_CC="cc"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+if test $ac_prog_rejected = yes; then
+  # We found a bogon in the path, so make sure we never use it.
+  set dummy $ac_cv_prog_CC
+  shift
+  if test $# != 0; then
+    # We chose a different compiler from the bogus one.
+    # However, it has the same basename, so the bogon will be chosen
+    # first if we set CC to just the basename; use the full file name.
+    shift
+    ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@"
+  fi
+fi
+fi
+fi
+CC=$ac_cv_prog_CC
+if test -n "$CC"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+$as_echo "$CC" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+fi
+if test -z "$CC"; then
+  if test -n "$ac_tool_prefix"; then
+  for ac_prog in cl.exe
+  do
+    # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
+set dummy $ac_tool_prefix$ac_prog; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_CC+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$CC"; then
+  ac_cv_prog_CC="$CC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_prog_CC="$ac_tool_prefix$ac_prog"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+CC=$ac_cv_prog_CC
+if test -n "$CC"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+$as_echo "$CC" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+    test -n "$CC" && break
+  done
+fi
+if test -z "$CC"; then
+  ac_ct_CC=$CC
+  for ac_prog in cl.exe
+do
+  # Extract the first word of "$ac_prog", so it can be a program name with args.
+set dummy $ac_prog; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_prog_ac_ct_CC+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$ac_ct_CC"; then
+  ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_prog_ac_ct_CC="$ac_prog"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+fi
+fi
+ac_ct_CC=$ac_cv_prog_ac_ct_CC
+if test -n "$ac_ct_CC"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
+$as_echo "$ac_ct_CC" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+  test -n "$ac_ct_CC" && break
+done
+
+  if test "x$ac_ct_CC" = x; then
+    CC=""
+  else
+    case $cross_compiling:$ac_tool_warned in
+yes:)
+{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ac_tool_warned=yes ;;
+esac
+    CC=$ac_ct_CC
+  fi
+fi
+
+fi
+
+
+test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "no acceptable C compiler found in \$PATH
+See \`config.log' for more details" "$LINENO" 5; }
+
+# Provide some information about the compiler.
+$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
+set X $ac_compile
+ac_compiler=$2
+for ac_option in --version -v -V -qversion; do
+  { { ac_try="$ac_compiler $ac_option >&5"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_compiler $ac_option >&5") 2>conftest.err
+  ac_status=$?
+  if test -s conftest.err; then
+    sed '10a\
+... rest of stderr output deleted ...
+         10q' conftest.err >conftest.er1
+    cat conftest.er1 >&5
+  fi
+  rm -f conftest.er1 conftest.err
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }
+done
+
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+ac_clean_files_save=$ac_clean_files
+ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out"
+# Try to create an executable without -o first, disregard a.out.
+# It will help us diagnose broken compilers, and finding out an intuition
+# of exeext.
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5
+$as_echo_n "checking whether the C compiler works... " >&6; }
+ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'`
+
+# The possible output files:
+ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*"
+
+ac_rmfiles=
+for ac_file in $ac_files
+do
+  case $ac_file in
+    *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;;
+    * ) ac_rmfiles="$ac_rmfiles $ac_file";;
+  esac
+done
+rm -f $ac_rmfiles
+
+if { { ac_try="$ac_link_default"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_link_default") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then :
+  # Autoconf-2.13 could set the ac_cv_exeext variable to `no'.
+# So ignore a value of `no', otherwise this would lead to `EXEEXT = no'
+# in a Makefile.  We should not override ac_cv_exeext if it was cached,
+# so that the user can short-circuit this test for compilers unknown to
+# Autoconf.
+for ac_file in $ac_files ''
+do
+  test -f "$ac_file" || continue
+  case $ac_file in
+    *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj )
+	;;
+    [ab].out )
+	# We found the default executable, but exeext='' is most
+	# certainly right.
+	break;;
+    *.* )
+	if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no;
+	then :; else
+	   ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'`
+	fi
+	# We set ac_cv_exeext here because the later test for it is not
+	# safe: cross compilers may not add the suffix if given an `-o'
+	# argument, so we may need to know it at that point already.
+	# Even if this section looks crufty: it has the advantage of
+	# actually working.
+	break;;
+    * )
+	break;;
+  esac
+done
+test "$ac_cv_exeext" = no && ac_cv_exeext=
+
+else
+  ac_file=''
+fi
+if test -z "$ac_file"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+$as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error 77 "C compiler cannot create executables
+See \`config.log' for more details" "$LINENO" 5; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5
+$as_echo_n "checking for C compiler default output file name... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5
+$as_echo "$ac_file" >&6; }
+ac_exeext=$ac_cv_exeext
+
+rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out
+ac_clean_files=$ac_clean_files_save
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5
+$as_echo_n "checking for suffix of executables... " >&6; }
+if { { ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_link") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then :
+  # If both `conftest.exe' and `conftest' are `present' (well, observable)
+# catch `conftest.exe'.  For instance with Cygwin, `ls conftest' will
+# work properly (i.e., refer to `conftest.exe'), while it won't with
+# `rm'.
+for ac_file in conftest.exe conftest conftest.*; do
+  test -f "$ac_file" || continue
+  case $ac_file in
+    *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;;
+    *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'`
+	  break;;
+    * ) break;;
+  esac
+done
+else
+  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "cannot compute suffix of executables: cannot compile and link
+See \`config.log' for more details" "$LINENO" 5; }
+fi
+rm -f conftest conftest$ac_cv_exeext
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5
+$as_echo "$ac_cv_exeext" >&6; }
+
+rm -f conftest.$ac_ext
+EXEEXT=$ac_cv_exeext
+ac_exeext=$EXEEXT
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <stdio.h>
+int
+main ()
+{
+FILE *f = fopen ("conftest.out", "w");
+ return ferror (f) || fclose (f) != 0;
+
+  ;
+  return 0;
+}
+_ACEOF
+ac_clean_files="$ac_clean_files conftest.out"
+# Check that the compiler produces executables we can run.  If not, either
+# the compiler is broken, or we cross compile.
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5
+$as_echo_n "checking whether we are cross compiling... " >&6; }
+if test "$cross_compiling" != yes; then
+  { { ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_link") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }
+  if { ac_try='./conftest$ac_cv_exeext'
+  { { case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_try") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; }; then
+    cross_compiling=no
+  else
+    if test "$cross_compiling" = maybe; then
+	cross_compiling=yes
+    else
+	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "cannot run C compiled programs.
+If you meant to cross compile, use \`--host'.
+See \`config.log' for more details" "$LINENO" 5; }
+    fi
+  fi
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5
+$as_echo "$cross_compiling" >&6; }
+
+rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out
+ac_clean_files=$ac_clean_files_save
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5
+$as_echo_n "checking for suffix of object files... " >&6; }
+if ${ac_cv_objext+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.o conftest.obj
+if { { ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+  (eval "$ac_compile") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then :
+  for ac_file in conftest.o conftest.obj conftest.*; do
+  test -f "$ac_file" || continue;
+  case $ac_file in
+    *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;;
+    *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'`
+       break;;
+  esac
+done
+else
+  $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "cannot compute suffix of object files: cannot compile
+See \`config.log' for more details" "$LINENO" 5; }
+fi
+rm -f conftest.$ac_cv_objext conftest.$ac_ext
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5
+$as_echo "$ac_cv_objext" >&6; }
+OBJEXT=$ac_cv_objext
+ac_objext=$OBJEXT
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5
+$as_echo_n "checking whether we are using the GNU C compiler... " >&6; }
+if ${ac_cv_c_compiler_gnu+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+#ifndef __GNUC__
+       choke me
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  ac_compiler_gnu=yes
+else
+  ac_compiler_gnu=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+ac_cv_c_compiler_gnu=$ac_compiler_gnu
+
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
+$as_echo "$ac_cv_c_compiler_gnu" >&6; }
+if test $ac_compiler_gnu = yes; then
+  GCC=yes
+else
+  GCC=
+fi
+ac_test_CFLAGS=${CFLAGS+set}
+ac_save_CFLAGS=$CFLAGS
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
+$as_echo_n "checking whether $CC accepts -g... " >&6; }
+if ${ac_cv_prog_cc_g+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_save_c_werror_flag=$ac_c_werror_flag
+   ac_c_werror_flag=yes
+   ac_cv_prog_cc_g=no
+   CFLAGS="-g"
+   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  ac_cv_prog_cc_g=yes
+else
+  CFLAGS=""
+      cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+
+else
+  ac_c_werror_flag=$ac_save_c_werror_flag
+	 CFLAGS="-g"
+	 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  ac_cv_prog_cc_g=yes
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+   ac_c_werror_flag=$ac_save_c_werror_flag
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
+$as_echo "$ac_cv_prog_cc_g" >&6; }
+if test "$ac_test_CFLAGS" = set; then
+  CFLAGS=$ac_save_CFLAGS
+elif test $ac_cv_prog_cc_g = yes; then
+  if test "$GCC" = yes; then
+    CFLAGS="-g -O2"
+  else
+    CFLAGS="-g"
+  fi
+else
+  if test "$GCC" = yes; then
+    CFLAGS="-O2"
+  else
+    CFLAGS=
+  fi
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5
+$as_echo_n "checking for $CC option to accept ISO C89... " >&6; }
+if ${ac_cv_prog_cc_c89+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_cv_prog_cc_c89=no
+ac_save_CC=$CC
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <stdarg.h>
+#include <stdio.h>
+struct stat;
+/* Most of the following tests are stolen from RCS 5.7's src/conf.sh.  */
+struct buf { int x; };
+FILE * (*rcsopen) (struct buf *, struct stat *, int);
+static char *e (p, i)
+     char **p;
+     int i;
+{
+  return p[i];
+}
+static char *f (char * (*g) (char **, int), char **p, ...)
+{
+  char *s;
+  va_list v;
+  va_start (v,p);
+  s = g (p, va_arg (v,int));
+  va_end (v);
+  return s;
+}
+
+/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default.  It has
+   function prototypes and stuff, but not '\xHH' hex character constants.
+   These don't provoke an error unfortunately, instead are silently treated
+   as 'x'.  The following induces an error, until -std is added to get
+   proper ANSI mode.  Curiously '\x00'!='x' always comes out true, for an
+   array size at least.  It's necessary to write '\x00'==0 to get something
+   that's true only with -std.  */
+int osf4_cc_array ['\x00' == 0 ? 1 : -1];
+
+/* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters
+   inside strings and character constants.  */
+#define FOO(x) 'x'
+int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1];
+
+int test (int i, double x);
+struct s1 {int (*f) (int a);};
+struct s2 {int (*f) (double a);};
+int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int);
+int argc;
+char **argv;
+int
+main ()
+{
+return f (e, argv, 0) != argv[0]  ||  f (e, argv, 1) != argv[1];
+  ;
+  return 0;
+}
+_ACEOF
+for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \
+	-Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
+do
+  CC="$ac_save_CC $ac_arg"
+  if ac_fn_c_try_compile "$LINENO"; then :
+  ac_cv_prog_cc_c89=$ac_arg
+fi
+rm -f core conftest.err conftest.$ac_objext
+  test "x$ac_cv_prog_cc_c89" != "xno" && break
+done
+rm -f conftest.$ac_ext
+CC=$ac_save_CC
+
+fi
+# AC_CACHE_VAL
+case "x$ac_cv_prog_cc_c89" in
+  x)
+    { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+$as_echo "none needed" >&6; } ;;
+  xno)
+    { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+$as_echo "unsupported" >&6; } ;;
+  *)
+    CC="$CC $ac_cv_prog_cc_c89"
+    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
+$as_echo "$ac_cv_prog_cc_c89" >&6; } ;;
+esac
+if test "x$ac_cv_prog_cc_c89" != xno; then :
+
+fi
+
+ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
+
+
+
+ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
+$as_echo_n "checking how to run the C preprocessor... " >&6; }
+# On Suns, sometimes $CPP names a directory.
+if test -n "$CPP" && test -d "$CPP"; then
+  CPP=
+fi
+if test -z "$CPP"; then
+  if ${ac_cv_prog_CPP+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+      # Double quotes because CPP needs to be expanded
+    for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp"
+    do
+      ac_preproc_ok=false
+for ac_c_preproc_warn_flag in '' yes
+do
+  # Use a header file that comes with gcc, so configuring glibc
+  # with a fresh cross-compiler works.
+  # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+  # <limits.h> exists even on freestanding compilers.
+  # On the NeXT, cc -E runs the code through the compiler's parser,
+  # not just through cpp. "Syntax error" is here to catch this case.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+		     Syntax error
+_ACEOF
+if ac_fn_c_try_cpp "$LINENO"; then :
+
+else
+  # Broken: fails on valid input.
+continue
+fi
+rm -f conftest.err conftest.i conftest.$ac_ext
+
+  # OK, works on sane cases.  Now check whether nonexistent headers
+  # can be detected and how.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <ac_nonexistent.h>
+_ACEOF
+if ac_fn_c_try_cpp "$LINENO"; then :
+  # Broken: success on invalid input.
+continue
+else
+  # Passes both tests.
+ac_preproc_ok=:
+break
+fi
+rm -f conftest.err conftest.i conftest.$ac_ext
+
+done
+# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
+rm -f conftest.i conftest.err conftest.$ac_ext
+if $ac_preproc_ok; then :
+  break
+fi
+
+    done
+    ac_cv_prog_CPP=$CPP
+
+fi
+  CPP=$ac_cv_prog_CPP
+else
+  ac_cv_prog_CPP=$CPP
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
+$as_echo "$CPP" >&6; }
+ac_preproc_ok=false
+for ac_c_preproc_warn_flag in '' yes
+do
+  # Use a header file that comes with gcc, so configuring glibc
+  # with a fresh cross-compiler works.
+  # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+  # <limits.h> exists even on freestanding compilers.
+  # On the NeXT, cc -E runs the code through the compiler's parser,
+  # not just through cpp. "Syntax error" is here to catch this case.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+		     Syntax error
+_ACEOF
+if ac_fn_c_try_cpp "$LINENO"; then :
+
+else
+  # Broken: fails on valid input.
+continue
+fi
+rm -f conftest.err conftest.i conftest.$ac_ext
+
+  # OK, works on sane cases.  Now check whether nonexistent headers
+  # can be detected and how.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <ac_nonexistent.h>
+_ACEOF
+if ac_fn_c_try_cpp "$LINENO"; then :
+  # Broken: success on invalid input.
+continue
+else
+  # Passes both tests.
+ac_preproc_ok=:
+break
+fi
+rm -f conftest.err conftest.i conftest.$ac_ext
+
+done
+# Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
+rm -f conftest.i conftest.err conftest.$ac_ext
+if $ac_preproc_ok; then :
+
+else
+  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "C preprocessor \"$CPP\" fails sanity check
+See \`config.log' for more details" "$LINENO" 5; }
+fi
+
+ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5
+$as_echo_n "checking for grep that handles long lines and -e... " >&6; }
+if ${ac_cv_path_GREP+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if test -z "$GREP"; then
+  ac_path_GREP_found=false
+  # Loop through the user's path and test for each of PROGNAME-LIST
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_prog in grep ggrep; do
+    for ac_exec_ext in '' $ac_executable_extensions; do
+      ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext"
+      as_fn_executable_p "$ac_path_GREP" || continue
+# Check for GNU ac_path_GREP and select it if it is found.
+  # Check for GNU $ac_path_GREP
+case `"$ac_path_GREP" --version 2>&1` in
+*GNU*)
+  ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;;
+*)
+  ac_count=0
+  $as_echo_n 0123456789 >"conftest.in"
+  while :
+  do
+    cat "conftest.in" "conftest.in" >"conftest.tmp"
+    mv "conftest.tmp" "conftest.in"
+    cp "conftest.in" "conftest.nl"
+    $as_echo 'GREP' >> "conftest.nl"
+    "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break
+    diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
+    as_fn_arith $ac_count + 1 && ac_count=$as_val
+    if test $ac_count -gt ${ac_path_GREP_max-0}; then
+      # Best one so far, save it but keep looking for a better one
+      ac_cv_path_GREP="$ac_path_GREP"
+      ac_path_GREP_max=$ac_count
+    fi
+    # 10*(2^10) chars as input seems more than enough
+    test $ac_count -gt 10 && break
+  done
+  rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
+esac
+
+      $ac_path_GREP_found && break 3
+    done
+  done
+  done
+IFS=$as_save_IFS
+  if test -z "$ac_cv_path_GREP"; then
+    as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
+  fi
+else
+  ac_cv_path_GREP=$GREP
+fi
+
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5
+$as_echo "$ac_cv_path_GREP" >&6; }
+ GREP="$ac_cv_path_GREP"
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
+$as_echo_n "checking for egrep... " >&6; }
+if ${ac_cv_path_EGREP+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  if echo a | $GREP -E '(a|b)' >/dev/null 2>&1
+   then ac_cv_path_EGREP="$GREP -E"
+   else
+     if test -z "$EGREP"; then
+  ac_path_EGREP_found=false
+  # Loop through the user's path and test for each of PROGNAME-LIST
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_prog in egrep; do
+    for ac_exec_ext in '' $ac_executable_extensions; do
+      ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext"
+      as_fn_executable_p "$ac_path_EGREP" || continue
+# Check for GNU ac_path_EGREP and select it if it is found.
+  # Check for GNU $ac_path_EGREP
+case `"$ac_path_EGREP" --version 2>&1` in
+*GNU*)
+  ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
+*)
+  ac_count=0
+  $as_echo_n 0123456789 >"conftest.in"
+  while :
+  do
+    cat "conftest.in" "conftest.in" >"conftest.tmp"
+    mv "conftest.tmp" "conftest.in"
+    cp "conftest.in" "conftest.nl"
+    $as_echo 'EGREP' >> "conftest.nl"
+    "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break
+    diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
+    as_fn_arith $ac_count + 1 && ac_count=$as_val
+    if test $ac_count -gt ${ac_path_EGREP_max-0}; then
+      # Best one so far, save it but keep looking for a better one
+      ac_cv_path_EGREP="$ac_path_EGREP"
+      ac_path_EGREP_max=$ac_count
+    fi
+    # 10*(2^10) chars as input seems more than enough
+    test $ac_count -gt 10 && break
+  done
+  rm -f conftest.in conftest.tmp conftest.nl conftest.out;;
+esac
+
+      $ac_path_EGREP_found && break 3
+    done
+  done
+  done
+IFS=$as_save_IFS
+  if test -z "$ac_cv_path_EGREP"; then
+    as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5
+  fi
+else
+  ac_cv_path_EGREP=$EGREP
+fi
+
+   fi
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
+$as_echo "$ac_cv_path_EGREP" >&6; }
+ EGREP="$ac_cv_path_EGREP"
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5
+$as_echo_n "checking for ANSI C header files... " >&6; }
+if ${ac_cv_header_stdc+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <stdlib.h>
+#include <stdarg.h>
+#include <string.h>
+#include <float.h>
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  ac_cv_header_stdc=yes
+else
+  ac_cv_header_stdc=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+
+if test $ac_cv_header_stdc = yes; then
+  # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <string.h>
+
+_ACEOF
+if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
+  $EGREP "memchr" >/dev/null 2>&1; then :
+
+else
+  ac_cv_header_stdc=no
+fi
+rm -f conftest*
+
+fi
+
+if test $ac_cv_header_stdc = yes; then
+  # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <stdlib.h>
+
+_ACEOF
+if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
+  $EGREP "free" >/dev/null 2>&1; then :
+
+else
+  ac_cv_header_stdc=no
+fi
+rm -f conftest*
+
+fi
+
+if test $ac_cv_header_stdc = yes; then
+  # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
+  if test "$cross_compiling" = yes; then :
+  :
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <ctype.h>
+#include <stdlib.h>
+#if ((' ' & 0x0FF) == 0x020)
+# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
+# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
+#else
+# define ISLOWER(c) \
+		   (('a' <= (c) && (c) <= 'i') \
+		     || ('j' <= (c) && (c) <= 'r') \
+		     || ('s' <= (c) && (c) <= 'z'))
+# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c))
+#endif
+
+#define XOR(e, f) (((e) && !(f)) || (!(e) && (f)))
+int
+main ()
+{
+  int i;
+  for (i = 0; i < 256; i++)
+    if (XOR (islower (i), ISLOWER (i))
+	|| toupper (i) != TOUPPER (i))
+      return 2;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_run "$LINENO"; then :
+
+else
+  ac_cv_header_stdc=no
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
+fi
+
+fi
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5
+$as_echo "$ac_cv_header_stdc" >&6; }
+if test $ac_cv_header_stdc = yes; then
+
+$as_echo "#define STDC_HEADERS 1" >>confdefs.h
+
+fi
+
+# On IRIX 5.3, sys/types and inttypes.h are conflicting.
+for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \
+		  inttypes.h stdint.h unistd.h
+do :
+  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
+"
+if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+
+done
+
+
+for ac_header in sys/socket.h
+do :
+  ac_fn_c_check_header_mongrel "$LINENO" "sys/socket.h" "ac_cv_header_sys_socket_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_socket_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_SYS_SOCKET_H 1
+_ACEOF
+
+fi
+
+done
+
+for ac_header in openssl/crypto.h
+do :
+  ac_fn_c_check_header_mongrel "$LINENO" "openssl/crypto.h" "ac_cv_header_openssl_crypto_h" "$ac_includes_default"
+if test "x$ac_cv_header_openssl_crypto_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_OPENSSL_CRYPTO_H 1
+_ACEOF
+ CLIENT_SSL=bin/client-ssl
+fi
+
+done
+
+for ac_header in gnutls/gnutls.h
+do :
+  ac_fn_c_check_header_mongrel "$LINENO" "gnutls/gnutls.h" "ac_cv_header_gnutls_gnutls_h" "$ac_includes_default"
+if test "x$ac_cv_header_gnutls_gnutls_h" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_GNUTLS_GNUTLS_H 1
+_ACEOF
+ CLIENT_GNUTLS=bin/client-gnutls
+fi
+
+done
+
+
+
+
+host_os=`uname -s`
+
+case $CC-$host_os in
+  gcc-*linux* | gcc-*Linux* | gcc-*LINUX* | gcc-FreeBSD)
+    LOADED=bin/loaded
+    LOADED_OPT="-shared -fPIC"
+    echo "Using gcc on $host_os: will compile dynamically loaded module"
+    ;;
+  *)
+    LOADED=
+    echo "Will not compile dynamically loaded module: not known OS/CC combination"
+    ;;
+esac
+
+
+case $host_os in
+  Darwin)
+    BIND_8_COMPAT=-DBIND_8_COMPAT
+    ;;
+esac
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing inet_addr" >&5
+$as_echo_n "checking for library containing inet_addr... " >&6; }
+if ${ac_cv_search_inet_addr+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char inet_addr ();
+int
+main ()
+{
+return inet_addr ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' nsl; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_inet_addr=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_inet_addr+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_inet_addr+:} false; then :
+
+else
+  ac_cv_search_inet_addr=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_addr" >&5
+$as_echo "$ac_cv_search_inet_addr" >&6; }
+ac_res=$ac_cv_search_inet_addr
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing connect" >&5
+$as_echo_n "checking for library containing connect... " >&6; }
+if ${ac_cv_search_connect+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char connect ();
+int
+main ()
+{
+return connect ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' socket; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_connect=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_connect+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_connect+:} false; then :
+
+else
+  ac_cv_search_connect=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_connect" >&5
+$as_echo "$ac_cv_search_connect" >&6; }
+ac_res=$ac_cv_search_connect
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing inet_pton" >&5
+$as_echo_n "checking for library containing inet_pton... " >&6; }
+if ${ac_cv_search_inet_pton+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char inet_pton ();
+int
+main ()
+{
+return inet_pton ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' nsl socket resolv; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_inet_pton=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_inet_pton+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_inet_pton+:} false; then :
+
+else
+  ac_cv_search_inet_pton=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_pton" >&5
+$as_echo "$ac_cv_search_inet_pton" >&6; }
+ac_res=$ac_cv_search_inet_pton
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing inet_ntop" >&5
+$as_echo_n "checking for library containing inet_ntop... " >&6; }
+if ${ac_cv_search_inet_ntop+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char inet_ntop ();
+int
+main ()
+{
+return inet_ntop ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' nsl socket resolv; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_inet_ntop=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_inet_ntop+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_inet_ntop+:} false; then :
+
+else
+  ac_cv_search_inet_ntop=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_ntop" >&5
+$as_echo "$ac_cv_search_inet_ntop" >&6; }
+ac_res=$ac_cv_search_inet_ntop
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+
+
+
+
+
+
+
+
+
+
+ac_config_files="$ac_config_files Makefile"
+
+cat >confcache <<\_ACEOF
+# This file is a shell script that caches the results of configure
+# tests run on this system so they can be shared between configure
+# scripts and configure runs, see configure's option --config-cache.
+# It is not useful on other systems.  If it contains results you don't
+# want to keep, you may remove or edit it.
+#
+# config.status only pays attention to the cache file if you give it
+# the --recheck option to rerun configure.
+#
+# `ac_cv_env_foo' variables (set or unset) will be overridden when
+# loading this file, other *unset* `ac_cv_foo' will be assigned the
+# following values.
+
+_ACEOF
+
+# The following way of writing the cache mishandles newlines in values,
+# but we know of no workaround that is simple, portable, and efficient.
+# So, we kill variables containing newlines.
+# Ultrix sh set writes to stderr and can't be redirected directly,
+# and sets the high bit in the cache file unless we assign to the vars.
+(
+  for ac_var in `(set) 2>&1 | sed -n 's/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'`; do
+    eval ac_val=\$$ac_var
+    case $ac_val in #(
+    *${as_nl}*)
+      case $ac_var in #(
+      *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
+$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+      esac
+      case $ac_var in #(
+      _ | IFS | as_nl) ;; #(
+      BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #(
+      *) { eval $ac_var=; unset $ac_var;} ;;
+      esac ;;
+    esac
+  done
+
+  (set) 2>&1 |
+    case $as_nl`(ac_space=' '; set) 2>&1` in #(
+    *${as_nl}ac_space=\ *)
+      # `set' does not quote correctly, so add quotes: double-quote
+      # substitution turns \\\\ into \\, and sed turns \\ into \.
+      sed -n \
+	"s/'/'\\\\''/g;
+	  s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p"
+      ;; #(
+    *)
+      # `set' quotes correctly as required by POSIX, so do not add quotes.
+      sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p"
+      ;;
+    esac |
+    sort
+) |
+  sed '
+     /^ac_cv_env_/b end
+     t clear
+     :clear
+     s/^\([^=]*\)=\(.*[{}].*\)$/test "${\1+set}" = set || &/
+     t end
+     s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/
+     :end' >>confcache
+if diff "$cache_file" confcache >/dev/null 2>&1; then :; else
+  if test -w "$cache_file"; then
+    if test "x$cache_file" != "x/dev/null"; then
+      { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5
+$as_echo "$as_me: updating cache $cache_file" >&6;}
+      if test ! -f "$cache_file" || test -h "$cache_file"; then
+	cat confcache >"$cache_file"
+      else
+        case $cache_file in #(
+        */* | ?:*)
+	  mv -f confcache "$cache_file"$$ &&
+	  mv -f "$cache_file"$$ "$cache_file" ;; #(
+        *)
+	  mv -f confcache "$cache_file" ;;
+	esac
+      fi
+    fi
+  else
+    { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5
+$as_echo "$as_me: not updating unwritable cache $cache_file" >&6;}
+  fi
+fi
+rm -f confcache
+
+test "x$prefix" = xNONE && prefix=$ac_default_prefix
+# Let make expand exec_prefix.
+test "x$exec_prefix" = xNONE && exec_prefix='${prefix}'
+
+# Transform confdefs.h into DEFS.
+# Protect against shell expansion while executing Makefile rules.
+# Protect against Makefile macro expansion.
+#
+# If the first sed substitution is executed (which looks for macros that
+# take arguments), then branch to the quote section.  Otherwise,
+# look for a macro that doesn't take arguments.
+ac_script='
+:mline
+/\\$/{
+ N
+ s,\\\n,,
+ b mline
+}
+t clear
+:clear
+s/^[	 ]*#[	 ]*define[	 ][	 ]*\([^	 (][^	 (]*([^)]*)\)[	 ]*\(.*\)/-D\1=\2/g
+t quote
+s/^[	 ]*#[	 ]*define[	 ][	 ]*\([^	 ][^	 ]*\)[	 ]*\(.*\)/-D\1=\2/g
+t quote
+b any
+:quote
+s/[	 `~#$^&*(){}\\|;'\''"<>?]/\\&/g
+s/\[/\\&/g
+s/\]/\\&/g
+s/\$/$$/g
+H
+:any
+${
+	g
+	s/^\n//
+	s/\n/ /g
+	p
+}
+'
+DEFS=`sed -n "$ac_script" confdefs.h`
+
+
+ac_libobjs=
+ac_ltlibobjs=
+U=
+for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue
+  # 1. Remove the extension, and $U if already installed.
+  ac_script='s/\$U\././;s/\.o$//;s/\.obj$//'
+  ac_i=`$as_echo "$ac_i" | sed "$ac_script"`
+  # 2. Prepend LIBOBJDIR.  When used with automake>=1.10 LIBOBJDIR
+  #    will be set to the directory where LIBOBJS objects are built.
+  as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext"
+  as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo'
+done
+LIBOBJS=$ac_libobjs
+
+LTLIBOBJS=$ac_ltlibobjs
+
+
+
+: "${CONFIG_STATUS=./config.status}"
+ac_write_fail=0
+ac_clean_files_save=$ac_clean_files
+ac_clean_files="$ac_clean_files $CONFIG_STATUS"
+{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5
+$as_echo "$as_me: creating $CONFIG_STATUS" >&6;}
+as_write_fail=0
+cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1
+#! $SHELL
+# Generated by $as_me.
+# Run this file to recreate the current configuration.
+# Compiler output produced by configure, useful for debugging
+# configure, is in config.log if it exists.
+
+debug=false
+ac_cs_recheck=false
+ac_cs_silent=false
+
+SHELL=\${CONFIG_SHELL-$SHELL}
+export SHELL
+_ASEOF
+cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1
+## -------------------- ##
+## M4sh Initialization. ##
+## -------------------- ##
+
+# Be more Bourne compatible
+DUALCASE=1; export DUALCASE # for MKS sh
+if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+  emulate sh
+  NULLCMD=:
+  # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
+  # is contrary to our usage.  Disable this feature.
+  alias -g '${1+"$@"}'='"$@"'
+  setopt NO_GLOB_SUBST
+else
+  case `(set -o) 2>/dev/null` in #(
+  *posix*) :
+    set -o posix ;; #(
+  *) :
+     ;;
+esac
+fi
+
+
+as_nl='
+'
+export as_nl
+# Printing a long string crashes Solaris 7 /usr/bin/printf.
+as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
+as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
+as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
+# Prefer a ksh shell builtin over an external printf program on Solaris,
+# but without wasting forks for bash or zsh.
+if test -z "$BASH_VERSION$ZSH_VERSION" \
+    && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
+  as_echo='print -r --'
+  as_echo_n='print -rn --'
+elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
+  as_echo='printf %s\n'
+  as_echo_n='printf %s'
+else
+  if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
+    as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
+    as_echo_n='/usr/ucb/echo -n'
+  else
+    as_echo_body='eval expr "X$1" : "X\\(.*\\)"'
+    as_echo_n_body='eval
+      arg=$1;
+      case $arg in #(
+      *"$as_nl"*)
+	expr "X$arg" : "X\\(.*\\)$as_nl";
+	arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;;
+      esac;
+      expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl"
+    '
+    export as_echo_n_body
+    as_echo_n='sh -c $as_echo_n_body as_echo'
+  fi
+  export as_echo_body
+  as_echo='sh -c $as_echo_body as_echo'
+fi
+
+# The user is always right.
+if test "${PATH_SEPARATOR+set}" != set; then
+  PATH_SEPARATOR=:
+  (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
+    (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
+      PATH_SEPARATOR=';'
+  }
+fi
+
+
+# IFS
+# We need space, tab and new line, in precisely that order.  Quoting is
+# there to prevent editors from complaining about space-tab.
+# (If _AS_PATH_WALK were called with IFS unset, it would disable word
+# splitting by setting IFS to empty value.)
+IFS=" ""	$as_nl"
+
+# Find who we are.  Look in the path if we contain no directory separator.
+as_myself=
+case $0 in #((
+  *[\\/]* ) as_myself=$0 ;;
+  *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+  done
+IFS=$as_save_IFS
+
+     ;;
+esac
+# We did not find ourselves, most probably we were run as `sh COMMAND'
+# in which case we are not to be found in the path.
+if test "x$as_myself" = x; then
+  as_myself=$0
+fi
+if test ! -f "$as_myself"; then
+  $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+  exit 1
+fi
+
+# Unset variables that we do not need and which cause bugs (e.g. in
+# pre-3.0 UWIN ksh).  But do not cause bugs in bash 2.01; the "|| exit 1"
+# suppresses any "Segmentation fault" message there.  '((' could
+# trigger a bug in pdksh 5.2.14.
+for as_var in BASH_ENV ENV MAIL MAILPATH
+do eval test x\${$as_var+set} = xset \
+  && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+done
+PS1='$ '
+PS2='> '
+PS4='+ '
+
+# NLS nuisances.
+LC_ALL=C
+export LC_ALL
+LANGUAGE=C
+export LANGUAGE
+
+# CDPATH.
+(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
+
+
+# as_fn_error STATUS ERROR [LINENO LOG_FD]
+# ----------------------------------------
+# Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are
+# provided, also output the error to LOG_FD, referencing LINENO. Then exit the
+# script with STATUS, using 1 if that was 0.
+as_fn_error ()
+{
+  as_status=$1; test $as_status -eq 0 && as_status=1
+  if test "$4"; then
+    as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+    $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
+  fi
+  $as_echo "$as_me: error: $2" >&2
+  as_fn_exit $as_status
+} # as_fn_error
+
+
+# as_fn_set_status STATUS
+# -----------------------
+# Set $? to STATUS, without forking.
+as_fn_set_status ()
+{
+  return $1
+} # as_fn_set_status
+
+# as_fn_exit STATUS
+# -----------------
+# Exit the shell with STATUS, even in a "trap 0" or "set -e" context.
+as_fn_exit ()
+{
+  set +e
+  as_fn_set_status $1
+  exit $1
+} # as_fn_exit
+
+# as_fn_unset VAR
+# ---------------
+# Portably unset VAR.
+as_fn_unset ()
+{
+  { eval $1=; unset $1;}
+}
+as_unset=as_fn_unset
+# as_fn_append VAR VALUE
+# ----------------------
+# Append the text in VALUE to the end of the definition contained in VAR. Take
+# advantage of any shell optimizations that allow amortized linear growth over
+# repeated appends, instead of the typical quadratic growth present in naive
+# implementations.
+if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
+  eval 'as_fn_append ()
+  {
+    eval $1+=\$2
+  }'
+else
+  as_fn_append ()
+  {
+    eval $1=\$$1\$2
+  }
+fi # as_fn_append
+
+# as_fn_arith ARG...
+# ------------------
+# Perform arithmetic evaluation on the ARGs, and store the result in the
+# global $as_val. Take advantage of shells that can avoid forks. The arguments
+# must be portable across $(()) and expr.
+if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
+  eval 'as_fn_arith ()
+  {
+    as_val=$(( $* ))
+  }'
+else
+  as_fn_arith ()
+  {
+    as_val=`expr "$@" || test $? -eq 1`
+  }
+fi # as_fn_arith
+
+
+if expr a : '\(a\)' >/dev/null 2>&1 &&
+   test "X`expr 00001 : '.*\(...\)'`" = X001; then
+  as_expr=expr
+else
+  as_expr=false
+fi
+
+if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then
+  as_basename=basename
+else
+  as_basename=false
+fi
+
+if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then
+  as_dirname=dirname
+else
+  as_dirname=false
+fi
+
+as_me=`$as_basename -- "$0" ||
+$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \
+	 X"$0" : 'X\(//\)$' \| \
+	 X"$0" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X/"$0" |
+    sed '/^.*\/\([^/][^/]*\)\/*$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\/\(\/\/\)$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\/\(\/\).*/{
+	    s//\1/
+	    q
+	  }
+	  s/.*/./; q'`
+
+# Avoid depending upon Character Ranges.
+as_cr_letters='abcdefghijklmnopqrstuvwxyz'
+as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+as_cr_Letters=$as_cr_letters$as_cr_LETTERS
+as_cr_digits='0123456789'
+as_cr_alnum=$as_cr_Letters$as_cr_digits
+
+ECHO_C= ECHO_N= ECHO_T=
+case `echo -n x` in #(((((
+-n*)
+  case `echo 'xy\c'` in
+  *c*) ECHO_T='	';;	# ECHO_T is single tab character.
+  xy)  ECHO_C='\c';;
+  *)   echo `echo ksh88 bug on AIX 6.1` > /dev/null
+       ECHO_T='	';;
+  esac;;
+*)
+  ECHO_N='-n';;
+esac
+
+rm -f conf$$ conf$$.exe conf$$.file
+if test -d conf$$.dir; then
+  rm -f conf$$.dir/conf$$.file
+else
+  rm -f conf$$.dir
+  mkdir conf$$.dir 2>/dev/null
+fi
+if (echo >conf$$.file) 2>/dev/null; then
+  if ln -s conf$$.file conf$$ 2>/dev/null; then
+    as_ln_s='ln -s'
+    # ... but there are two gotchas:
+    # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail.
+    # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable.
+    # In both cases, we have to default to `cp -pR'.
+    ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe ||
+      as_ln_s='cp -pR'
+  elif ln conf$$.file conf$$ 2>/dev/null; then
+    as_ln_s=ln
+  else
+    as_ln_s='cp -pR'
+  fi
+else
+  as_ln_s='cp -pR'
+fi
+rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file
+rmdir conf$$.dir 2>/dev/null
+
+
+# as_fn_mkdir_p
+# -------------
+# Create "$as_dir" as a directory, including parents if necessary.
+as_fn_mkdir_p ()
+{
+
+  case $as_dir in #(
+  -*) as_dir=./$as_dir;;
+  esac
+  test -d "$as_dir" || eval $as_mkdir_p || {
+    as_dirs=
+    while :; do
+      case $as_dir in #(
+      *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
+      *) as_qdir=$as_dir;;
+      esac
+      as_dirs="'$as_qdir' $as_dirs"
+      as_dir=`$as_dirname -- "$as_dir" ||
+$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+	 X"$as_dir" : 'X\(//\)[^/]' \| \
+	 X"$as_dir" : 'X\(//\)$' \| \
+	 X"$as_dir" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X"$as_dir" |
+    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)[^/].*/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\).*/{
+	    s//\1/
+	    q
+	  }
+	  s/.*/./; q'`
+      test -d "$as_dir" && break
+    done
+    test -z "$as_dirs" || eval "mkdir $as_dirs"
+  } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir"
+
+
+} # as_fn_mkdir_p
+if mkdir -p . 2>/dev/null; then
+  as_mkdir_p='mkdir -p "$as_dir"'
+else
+  test -d ./-p && rmdir ./-p
+  as_mkdir_p=false
+fi
+
+
+# as_fn_executable_p FILE
+# -----------------------
+# Test if FILE is an executable regular file.
+as_fn_executable_p ()
+{
+  test -f "$1" && test -x "$1"
+} # as_fn_executable_p
+as_test_x='test -x'
+as_executable_p=as_fn_executable_p
+
+# Sed expression to map a string onto a valid CPP name.
+as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'"
+
+# Sed expression to map a string onto a valid variable name.
+as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'"
+
+
+exec 6>&1
+## ----------------------------------- ##
+## Main body of $CONFIG_STATUS script. ##
+## ----------------------------------- ##
+_ASEOF
+test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1
+
+cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+# Save the log message, to keep $0 and so on meaningful, and to
+# report actual input values of CONFIG_FILES etc. instead of their
+# values after options handling.
+ac_log="
+This file was extended by $as_me, which was
+generated by GNU Autoconf 2.69.  Invocation command line was
+
+  CONFIG_FILES    = $CONFIG_FILES
+  CONFIG_HEADERS  = $CONFIG_HEADERS
+  CONFIG_LINKS    = $CONFIG_LINKS
+  CONFIG_COMMANDS = $CONFIG_COMMANDS
+  $ $0 $@
+
+on `(hostname || uname -n) 2>/dev/null | sed 1q`
+"
+
+_ACEOF
+
+case $ac_config_files in *"
+"*) set x $ac_config_files; shift; ac_config_files=$*;;
+esac
+
+
+
+cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+# Files that config.status was made for.
+config_files="$ac_config_files"
+
+_ACEOF
+
+cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+ac_cs_usage="\
+\`$as_me' instantiates files and other configuration actions
+from templates according to the current configuration.  Unless the files
+and actions are specified as TAGs, all are instantiated by default.
+
+Usage: $0 [OPTION]... [TAG]...
+
+  -h, --help       print this help, then exit
+  -V, --version    print version number and configuration settings, then exit
+      --config     print configuration, then exit
+  -q, --quiet, --silent
+                   do not print progress messages
+  -d, --debug      don't remove temporary files
+      --recheck    update $as_me by reconfiguring in the same conditions
+      --file=FILE[:TEMPLATE]
+                   instantiate the configuration file FILE
+
+Configuration files:
+$config_files
+
+Report bugs to the package provider."
+
+_ACEOF
+cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
+ac_cs_version="\\
+config.status
+configured by $0, generated by GNU Autoconf 2.69,
+  with options \\"\$ac_cs_config\\"
+
+Copyright (C) 2012 Free Software Foundation, Inc.
+This config.status script is free software; the Free Software Foundation
+gives unlimited permission to copy, distribute and modify it."
+
+ac_pwd='$ac_pwd'
+srcdir='$srcdir'
+test -n "\$AWK" || AWK=awk
+_ACEOF
+
+cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+# The default lists apply if the user does not specify any file.
+ac_need_defaults=:
+while test $# != 0
+do
+  case $1 in
+  --*=?*)
+    ac_option=`expr "X$1" : 'X\([^=]*\)='`
+    ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'`
+    ac_shift=:
+    ;;
+  --*=)
+    ac_option=`expr "X$1" : 'X\([^=]*\)='`
+    ac_optarg=
+    ac_shift=:
+    ;;
+  *)
+    ac_option=$1
+    ac_optarg=$2
+    ac_shift=shift
+    ;;
+  esac
+
+  case $ac_option in
+  # Handling of the options.
+  -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r)
+    ac_cs_recheck=: ;;
+  --version | --versio | --versi | --vers | --ver | --ve | --v | -V )
+    $as_echo "$ac_cs_version"; exit ;;
+  --config | --confi | --conf | --con | --co | --c )
+    $as_echo "$ac_cs_config"; exit ;;
+  --debug | --debu | --deb | --de | --d | -d )
+    debug=: ;;
+  --file | --fil | --fi | --f )
+    $ac_shift
+    case $ac_optarg in
+    *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
+    '') as_fn_error $? "missing file argument" ;;
+    esac
+    as_fn_append CONFIG_FILES " '$ac_optarg'"
+    ac_need_defaults=false;;
+  --he | --h |  --help | --hel | -h )
+    $as_echo "$ac_cs_usage"; exit ;;
+  -q | -quiet | --quiet | --quie | --qui | --qu | --q \
+  | -silent | --silent | --silen | --sile | --sil | --si | --s)
+    ac_cs_silent=: ;;
+
+  # This is an error.
+  -*) as_fn_error $? "unrecognized option: \`$1'
+Try \`$0 --help' for more information." ;;
+
+  *) as_fn_append ac_config_targets " $1"
+     ac_need_defaults=false ;;
+
+  esac
+  shift
+done
+
+ac_configure_extra_args=
+
+if $ac_cs_silent; then
+  exec 6>/dev/null
+  ac_configure_extra_args="$ac_configure_extra_args --silent"
+fi
+
+_ACEOF
+cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+if \$ac_cs_recheck; then
+  set X $SHELL '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion
+  shift
+  \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6
+  CONFIG_SHELL='$SHELL'
+  export CONFIG_SHELL
+  exec "\$@"
+fi
+
+_ACEOF
+cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+exec 5>>config.log
+{
+  echo
+  sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX
+## Running $as_me. ##
+_ASBOX
+  $as_echo "$ac_log"
+} >&5
+
+_ACEOF
+cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+_ACEOF
+
+cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+
+# Handling of arguments.
+for ac_config_target in $ac_config_targets
+do
+  case $ac_config_target in
+    "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
+
+  *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
+  esac
+done
+
+
+# If the user did not use the arguments to specify the items to instantiate,
+# then the envvar interface is used.  Set only those that are not.
+# We use the long form for the default assignment because of an extremely
+# bizarre bug on SunOS 4.1.3.
+if $ac_need_defaults; then
+  test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files
+fi
+
+# Have a temporary directory for convenience.  Make it in the build tree
+# simply because there is no reason against having it here, and in addition,
+# creating and moving files from /tmp can sometimes cause problems.
+# Hook for its removal unless debugging.
+# Note that there is a small window in which the directory will not be cleaned:
+# after its creation but before its name has been assigned to `$tmp'.
+$debug ||
+{
+  tmp= ac_tmp=
+  trap 'exit_status=$?
+  : "${ac_tmp:=$tmp}"
+  { test ! -d "$ac_tmp" || rm -fr "$ac_tmp"; } && exit $exit_status
+' 0
+  trap 'as_fn_exit 1' 1 2 13 15
+}
+# Create a (secure) tmp directory for tmp files.
+
+{
+  tmp=`(umask 077 && mktemp -d "./confXXXXXX") 2>/dev/null` &&
+  test -d "$tmp"
+}  ||
+{
+  tmp=./conf$$-$RANDOM
+  (umask 077 && mkdir "$tmp")
+} || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5
+ac_tmp=$tmp
+
+# Set up the scripts for CONFIG_FILES section.
+# No need to generate them if there are no CONFIG_FILES.
+# This happens for instance with `./config.status config.h'.
+if test -n "$CONFIG_FILES"; then
+
+
+ac_cr=`echo X | tr X '\015'`
+# On cygwin, bash can eat \r inside `` if the user requested igncr.
+# But we know of no other shell where ac_cr would be empty at this
+# point, so we can use a bashism as a fallback.
+if test "x$ac_cr" = x; then
+  eval ac_cr=\$\'\\r\'
+fi
+ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' </dev/null 2>/dev/null`
+if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then
+  ac_cs_awk_cr='\\r'
+else
+  ac_cs_awk_cr=$ac_cr
+fi
+
+echo 'BEGIN {' >"$ac_tmp/subs1.awk" &&
+_ACEOF
+
+
+{
+  echo "cat >conf$$subs.awk <<_ACEOF" &&
+  echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' &&
+  echo "_ACEOF"
+} >conf$$subs.sh ||
+  as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
+ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'`
+ac_delim='%!_!# '
+for ac_last_try in false false false false false :; do
+  . ./conf$$subs.sh ||
+    as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
+
+  ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X`
+  if test $ac_delim_n = $ac_delim_num; then
+    break
+  elif $ac_last_try; then
+    as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5
+  else
+    ac_delim="$ac_delim!$ac_delim _$ac_delim!! "
+  fi
+done
+rm -f conf$$subs.sh
+
+cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+cat >>"\$ac_tmp/subs1.awk" <<\\_ACAWK &&
+_ACEOF
+sed -n '
+h
+s/^/S["/; s/!.*/"]=/
+p
+g
+s/^[^!]*!//
+:repl
+t repl
+s/'"$ac_delim"'$//
+t delim
+:nl
+h
+s/\(.\{148\}\)..*/\1/
+t more1
+s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/
+p
+n
+b repl
+:more1
+s/["\\]/\\&/g; s/^/"/; s/$/"\\/
+p
+g
+s/.\{148\}//
+t nl
+:delim
+h
+s/\(.\{148\}\)..*/\1/
+t more2
+s/["\\]/\\&/g; s/^/"/; s/$/"/
+p
+b
+:more2
+s/["\\]/\\&/g; s/^/"/; s/$/"\\/
+p
+g
+s/.\{148\}//
+t delim
+' <conf$$subs.awk | sed '
+/^[^""]/{
+  N
+  s/\n//
+}
+' >>$CONFIG_STATUS || ac_write_fail=1
+rm -f conf$$subs.awk
+cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+_ACAWK
+cat >>"\$ac_tmp/subs1.awk" <<_ACAWK &&
+  for (key in S) S_is_set[key] = 1
+  FS = ""
+
+}
+{
+  line = $ 0
+  nfields = split(line, field, "@")
+  substed = 0
+  len = length(field[1])
+  for (i = 2; i < nfields; i++) {
+    key = field[i]
+    keylen = length(key)
+    if (S_is_set[key]) {
+      value = S[key]
+      line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3)
+      len += length(value) + length(field[++i])
+      substed = 1
+    } else
+      len += 1 + keylen
+  }
+
+  print line
+}
+
+_ACAWK
+_ACEOF
+cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then
+  sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g"
+else
+  cat
+fi < "$ac_tmp/subs1.awk" > "$ac_tmp/subs.awk" \
+  || as_fn_error $? "could not setup config files machinery" "$LINENO" 5
+_ACEOF
+
+# VPATH may cause trouble with some makes, so we remove sole $(srcdir),
+# ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and
+# trailing colons and then remove the whole line if VPATH becomes empty
+# (actually we leave an empty line to preserve line numbers).
+if test "x$srcdir" = x.; then
+  ac_vpsub='/^[	 ]*VPATH[	 ]*=[	 ]*/{
+h
+s///
+s/^/:/
+s/[	 ]*$/:/
+s/:\$(srcdir):/:/g
+s/:\${srcdir}:/:/g
+s/:@srcdir@:/:/g
+s/^:*//
+s/:*$//
+x
+s/\(=[	 ]*\).*/\1/
+G
+s/\n//
+s/^[^=]*=[	 ]*$//
+}'
+fi
+
+cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+fi # test -n "$CONFIG_FILES"
+
+
+eval set X "  :F $CONFIG_FILES      "
+shift
+for ac_tag
+do
+  case $ac_tag in
+  :[FHLC]) ac_mode=$ac_tag; continue;;
+  esac
+  case $ac_mode$ac_tag in
+  :[FHL]*:*);;
+  :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5;;
+  :[FH]-) ac_tag=-:-;;
+  :[FH]*) ac_tag=$ac_tag:$ac_tag.in;;
+  esac
+  ac_save_IFS=$IFS
+  IFS=:
+  set x $ac_tag
+  IFS=$ac_save_IFS
+  shift
+  ac_file=$1
+  shift
+
+  case $ac_mode in
+  :L) ac_source=$1;;
+  :[FH])
+    ac_file_inputs=
+    for ac_f
+    do
+      case $ac_f in
+      -) ac_f="$ac_tmp/stdin";;
+      *) # Look for the file first in the build tree, then in the source tree
+	 # (if the path is not absolute).  The absolute path cannot be DOS-style,
+	 # because $ac_f cannot contain `:'.
+	 test -f "$ac_f" ||
+	   case $ac_f in
+	   [\\/$]*) false;;
+	   *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";;
+	   esac ||
+	   as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;;
+      esac
+      case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac
+      as_fn_append ac_file_inputs " '$ac_f'"
+    done
+
+    # Let's still pretend it is `configure' which instantiates (i.e., don't
+    # use $as_me), people would be surprised to read:
+    #    /* config.h.  Generated by config.status.  */
+    configure_input='Generated from '`
+	  $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g'
+	`' by configure.'
+    if test x"$ac_file" != x-; then
+      configure_input="$ac_file.  $configure_input"
+      { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5
+$as_echo "$as_me: creating $ac_file" >&6;}
+    fi
+    # Neutralize special characters interpreted by sed in replacement strings.
+    case $configure_input in #(
+    *\&* | *\|* | *\\* )
+       ac_sed_conf_input=`$as_echo "$configure_input" |
+       sed 's/[\\\\&|]/\\\\&/g'`;; #(
+    *) ac_sed_conf_input=$configure_input;;
+    esac
+
+    case $ac_tag in
+    *:-:* | *:-) cat >"$ac_tmp/stdin" \
+      || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;;
+    esac
+    ;;
+  esac
+
+  ac_dir=`$as_dirname -- "$ac_file" ||
+$as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+	 X"$ac_file" : 'X\(//\)[^/]' \| \
+	 X"$ac_file" : 'X\(//\)$' \| \
+	 X"$ac_file" : 'X\(/\)' \| . 2>/dev/null ||
+$as_echo X"$ac_file" |
+    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)[^/].*/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\/\)$/{
+	    s//\1/
+	    q
+	  }
+	  /^X\(\/\).*/{
+	    s//\1/
+	    q
+	  }
+	  s/.*/./; q'`
+  as_dir="$ac_dir"; as_fn_mkdir_p
+  ac_builddir=.
+
+case "$ac_dir" in
+.) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
+*)
+  ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'`
+  # A ".." for each directory in $ac_dir_suffix.
+  ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'`
+  case $ac_top_builddir_sub in
+  "") ac_top_builddir_sub=. ac_top_build_prefix= ;;
+  *)  ac_top_build_prefix=$ac_top_builddir_sub/ ;;
+  esac ;;
+esac
+ac_abs_top_builddir=$ac_pwd
+ac_abs_builddir=$ac_pwd$ac_dir_suffix
+# for backward compatibility:
+ac_top_builddir=$ac_top_build_prefix
+
+case $srcdir in
+  .)  # We are building in place.
+    ac_srcdir=.
+    ac_top_srcdir=$ac_top_builddir_sub
+    ac_abs_top_srcdir=$ac_pwd ;;
+  [\\/]* | ?:[\\/]* )  # Absolute name.
+    ac_srcdir=$srcdir$ac_dir_suffix;
+    ac_top_srcdir=$srcdir
+    ac_abs_top_srcdir=$srcdir ;;
+  *) # Relative name.
+    ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix
+    ac_top_srcdir=$ac_top_build_prefix$srcdir
+    ac_abs_top_srcdir=$ac_pwd/$srcdir ;;
+esac
+ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix
+
+
+  case $ac_mode in
+  :F)
+  #
+  # CONFIG_FILE
+  #
+
+_ACEOF
+
+cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+# If the template does not know about datarootdir, expand it.
+# FIXME: This hack should be removed a few years after 2.60.
+ac_datarootdir_hack=; ac_datarootdir_seen=
+ac_sed_dataroot='
+/datarootdir/ {
+  p
+  q
+}
+/@datadir@/p
+/@docdir@/p
+/@infodir@/p
+/@localedir@/p
+/@mandir@/p'
+case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in
+*datarootdir*) ac_datarootdir_seen=yes;;
+*@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*)
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
+$as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
+_ACEOF
+cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+  ac_datarootdir_hack='
+  s&@datadir@&$datadir&g
+  s&@docdir@&$docdir&g
+  s&@infodir@&$infodir&g
+  s&@localedir@&$localedir&g
+  s&@mandir@&$mandir&g
+  s&\\\${datarootdir}&$datarootdir&g' ;;
+esac
+_ACEOF
+
+# Neutralize VPATH when `$srcdir' = `.'.
+# Shell code in configure.ac might set extrasub.
+# FIXME: do we really want to maintain this feature?
+cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
+ac_sed_extra="$ac_vpsub
+$extrasub
+_ACEOF
+cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
+:t
+/@[a-zA-Z_][a-zA-Z_0-9]*@/!b
+s|@configure_input@|$ac_sed_conf_input|;t t
+s&@top_builddir@&$ac_top_builddir_sub&;t t
+s&@top_build_prefix@&$ac_top_build_prefix&;t t
+s&@srcdir@&$ac_srcdir&;t t
+s&@abs_srcdir@&$ac_abs_srcdir&;t t
+s&@top_srcdir@&$ac_top_srcdir&;t t
+s&@abs_top_srcdir@&$ac_abs_top_srcdir&;t t
+s&@builddir@&$ac_builddir&;t t
+s&@abs_builddir@&$ac_abs_builddir&;t t
+s&@abs_top_builddir@&$ac_abs_top_builddir&;t t
+$ac_datarootdir_hack
+"
+eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$ac_tmp/subs.awk" \
+  >$ac_tmp/out || as_fn_error $? "could not create $ac_file" "$LINENO" 5
+
+test -z "$ac_datarootdir_hack$ac_datarootdir_seen" &&
+  { ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } &&
+  { ac_out=`sed -n '/^[	 ]*datarootdir[	 ]*:*=/p' \
+      "$ac_tmp/out"`; test -z "$ac_out"; } &&
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+which seems to be undefined.  Please make sure it is defined" >&5
+$as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+which seems to be undefined.  Please make sure it is defined" >&2;}
+
+  rm -f "$ac_tmp/stdin"
+  case $ac_file in
+  -) cat "$ac_tmp/out" && rm -f "$ac_tmp/out";;
+  *) rm -f "$ac_file" && mv "$ac_tmp/out" "$ac_file";;
+  esac \
+  || as_fn_error $? "could not create $ac_file" "$LINENO" 5
+ ;;
+
+
+
+  esac
+
+done # for ac_tag
+
+
+as_fn_exit 0
+_ACEOF
+ac_clean_files=$ac_clean_files_save
+
+test $ac_write_fail = 0 ||
+  as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5
+
+
+# configure is writing to config.log, and then calls config.status.
+# config.status does its own redirection, appending to config.log.
+# Unfortunately, on DOS this fails, as config.log is still kept open
+# by configure, so config.status won't be able to write to it; its
+# output is simply discarded.  So we exec the FD to /dev/null,
+# effectively closing config.log, so it can be properly (re)opened and
+# appended to by config.status.  When coming back to configure, we
+# need to make the FD available again.
+if test "$no_create" != yes; then
+  ac_cs_success=:
+  ac_config_status_args=
+  test "$silent" = yes &&
+    ac_config_status_args="$ac_config_status_args --quiet"
+  exec 5>/dev/null
+  $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false
+  exec 5>>config.log
+  # Use ||, not &&, to avoid exiting from the if with $? = 1, which
+  # would make configure fail if this is the last instruction.
+  $ac_cs_success || as_fn_exit 1
+fi
+if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
+$as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
+fi
+
diff --git a/test/confs/0000 b/test/confs/0000
index a0c5072d6..12c91fda1 100644
--- a/test/confs/0000
+++ b/test/confs/0000
@@ -3,11 +3,11 @@
 # This configuration is used when the test script is finding out what features
 # are in the Exim binary. It needs to discover where the test suite's spool
 # directory is going to be.
-
 spool_directory = DIR/spool
 log_file_path = DIR/spool/log/%slog
 gecos_pattern = ""
 gecos_name = CALLER_NAME
 tls_advertise_hosts =
+keep_environment =
 
 # End
diff --git a/test/confs/0001 b/test/confs/0001
index 5350ba463..b0f8f61e3 100644
--- a/test/confs/0001
+++ b/test/confs/0001
@@ -5,6 +5,7 @@
 # mess up the creation of the spool directory etc.
 
 exim_path = EXIM_PATH
+keep_environment =
 host_lookup_order = bydns
 spool_directory = DIR/spool
 log_file_path = DIR/spool/log/%slog
@@ -147,7 +148,7 @@ no_queue_only_override
 queue_only_file = /var/spool/exim/queue_only
 queue_only_load = 8.2
 no_queue_run_in_order
-queue_run_max = 5
+queue_run_max = ${if = {1}{1} {5}{10}}
 queue_smtp_domains = x.y.z
 receive_timeout = 0s
 received_header_text = Received: ${if def:sender_rcvhost {from ${sender_rcvhost}\n\t}{${if def:sender_ident {from ${sender_ident} }}${if def:sender_helo_name {(helo=${sender_helo_name})\n\t}}}}by ${primary_hostname} ${if def:received_protocol {with ${received_protocol}}} (Exim ${version_number} #${compile_number})\n\tid ${message_id}${if def:received_for {\n\tfor $received_for}}
@@ -192,12 +193,13 @@ no_strip_excess_angle_brackets
 no_strip_trailing_dot
 no_syslog_duplication
 syslog_facility = uucp
+no_syslog_pid
 syslog_processname = mta-exim
 no_syslog_timestamp
 system_filter = /home/exim/test/filter
 system_filter_directory_transport =
 system_filter_file_transport =
-system_filter_group = mail
+system_filter_group = MAILGROUP
 system_filter_pipe_transport =
 system_filter_reply_transport =
 system_filter_user = 99
@@ -235,7 +237,7 @@ manualroute:
   no_fail_verify_recipient
   no_fail_verify_sender
   fallback_hosts = localhost
-  group = mail
+  group = MAILGROUP
   headers_add =
   headers_remove =
   host_find_failed = freeze
@@ -369,7 +371,7 @@ forward:
   forbid_filter_run
   no_forbid_include
   no_forbid_pipe
-  group = mail
+  group = MAILGROUP
   headers_add =
   headers_remove =
   hide_child_in_errmsg
@@ -385,7 +387,7 @@ forward:
   more
   no_one_time
   owners = root
-  owngroups = mail
+  owngroups = MAILGROUP
   pipe_transport = dummy
   no_qualify_preserve_domain
   redirect_router = aliasfile2
@@ -419,7 +421,7 @@ localuser:
   no_fail_verify_recipient
   no_fail_verify_sender
   fallback_hosts =
-  group = mail
+  group = MAILGROUP
   headers_add = X-added: by localuser
   headers_remove =
   no_initgroups
@@ -459,7 +461,7 @@ smartuser:
   file_transport = dummy
   forbid_file
   forbid_pipe
-  group = mail
+  group = MAILGROUP
   headers_add =
   headers_remove =
   hide_child_in_errmsg
@@ -518,7 +520,7 @@ appendfile:
   file = /home/$local_part/inbox
   file_format = "From : appendfile"
   no_file_must_exist
-  group = mail
+  group = MAILGROUP
   headers_add = X-original-domain: $original_domain\nX-original-localp: $original_local_part
   headers_remove =
   headers_rewrite = a@b c@d
@@ -529,7 +531,7 @@ appendfile:
   lockfile_timeout = 30m
   mailbox_size = 1000
   mailbox_filecount = 9999
-  message_size_limit = 1M
+  message_size_limit = 1G
   mode = 0600
   mode_fail_narrower
   no_notify_comsat
diff --git a/test/confs/0002 b/test/confs/0002
index 0616f5ecf..6ca2d1bcb 100644
--- a/test/confs/0002
+++ b/test/confs/0002
@@ -4,6 +4,7 @@ LENCHECK=
 PTBC=
 
 exim_path = EXIM_PATH
+keep_environment = USER
 host_lookup_order = bydns
 primary_hostname = myhost.test.ex
 spool_directory = DIR/spool
diff --git a/test/confs/0003 b/test/confs/0003
index 0c95732cc..af93db7c6 100644
--- a/test/confs/0003
+++ b/test/confs/0003
@@ -1,12 +1,7 @@
 # Exim test configuration 0003
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 acl_smtp_rcpt = check_recipient
 domainlist local_domains = test.ex
diff --git a/test/confs/0004 b/test/confs/0004
index 8faf1c60a..8ebec4d98 100644
--- a/test/confs/0004
+++ b/test/confs/0004
@@ -1,12 +1,7 @@
 # Exim test configuration 0004
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 acl_smtp_rcpt = check_recipient
 domainlist local_domains = test.ex
diff --git a/test/confs/0005 b/test/confs/0005
index de20203a3..7c0689c16 100644
--- a/test/confs/0005
+++ b/test/confs/0005
@@ -1,12 +1,7 @@
 # Exim test configuration 0005
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0006 b/test/confs/0006
index 597c6bafb..c01a2fe2e 100644
--- a/test/confs/0006
+++ b/test/confs/0006
@@ -1,12 +1,7 @@
 # Exim test configuration 0006
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0007 b/test/confs/0007
index e31fd4c5c..05631cc39 100644
--- a/test/confs/0007
+++ b/test/confs/0007
@@ -1,12 +1,7 @@
 # Exim test configuration 0007
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0008 b/test/confs/0008
index 1a3ce395f..91db09111 100644
--- a/test/confs/0008
+++ b/test/confs/0008
@@ -1,12 +1,7 @@
 # Exim test configuration 0008
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0009 b/test/confs/0009
index ce366fd38..422fe3d1d 100644
--- a/test/confs/0009
+++ b/test/confs/0009
@@ -1,12 +1,7 @@
 # Exim test configuration 0009
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0010 b/test/confs/0010
index 074928a87..39e3fcf88 100644
--- a/test/confs/0010
+++ b/test/confs/0010
@@ -1,12 +1,7 @@
 # Exim test configuration 0010
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0011 b/test/confs/0011
index 53864399f..f8c04763d 100644
--- a/test/confs/0011
+++ b/test/confs/0011
@@ -1,12 +1,7 @@
 # Exim test configuration 0011
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0012 b/test/confs/0012
index 7b07d27fc..b367e8992 100644
--- a/test/confs/0012
+++ b/test/confs/0012
@@ -1,12 +1,7 @@
 # Exim test configuration 0012
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0013 b/test/confs/0013
index bc266e5fd..1b2cec88f 100644
--- a/test/confs/0013
+++ b/test/confs/0013
@@ -1,14 +1,9 @@
 # Exim test configuration 0013
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0014 b/test/confs/0014
index da0abb449..1fdd92d0c 100644
--- a/test/confs/0014
+++ b/test/confs/0014
@@ -1,13 +1,8 @@
 # Exim test configuration 0014
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0015 b/test/confs/0015
index 04dc46cf2..c6fccd316 100644
--- a/test/confs/0015
+++ b/test/confs/0015
@@ -1,12 +1,7 @@
 # Exim test configuration 0015
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0016 b/test/confs/0016
index d68778639..4260c88be 100644
--- a/test/confs/0016
+++ b/test/confs/0016
@@ -1,12 +1,7 @@
 # Exim test configuration 0016
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0017 b/test/confs/0017
index c1b94ccd0..74585c689 100644
--- a/test/confs/0017
+++ b/test/confs/0017
@@ -1,12 +1,7 @@
 # Exim test configuration 0017
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0018 b/test/confs/0018
index 1eb1b08f7..4b85cf3d3 100644
--- a/test/confs/0018
+++ b/test/confs/0018
@@ -1,12 +1,7 @@
 # Exim test configuration 0018
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0019 b/test/confs/0019
index 2ca5d5893..dbb303b6e 100644
--- a/test/confs/0019
+++ b/test/confs/0019
@@ -1,12 +1,7 @@
-# Exim test configuration 2409
+# Exim test configuration 0019
+
+.include DIR/aux-var/std_conf_prefix
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0020 b/test/confs/0020
index 1182e6a84..ce48c884c 100644
--- a/test/confs/0020
+++ b/test/confs/0020
@@ -1,13 +1,8 @@
 # Exim test configuration 0020
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0021 b/test/confs/0021
index 31cf2c670..ae5a309b9 100644
--- a/test/confs/0021
+++ b/test/confs/0021
@@ -2,15 +2,11 @@
 
 SERVER=
 BR=
+LOG_SELECTOR=
+
+.include DIR/aux-var/std_conf_prefix
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -26,6 +22,7 @@ acl_smtp_mail = mail
 acl_smtp_rcpt = rcpt
 
 BR
+log_selector = LOG_SELECTOR
 
 qualify_domain = test.ex
 trusted_users = CALLER
diff --git a/test/confs/0022 b/test/confs/0022
index e2ebe66f9..bd04442aa 100644
--- a/test/confs/0022
+++ b/test/confs/0022
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0023 b/test/confs/0023
index 0883bffa4..2481976ce 100644
--- a/test/confs/0023
+++ b/test/confs/0023
@@ -2,14 +2,9 @@
 
 LOG_SELECTOR=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0024 b/test/confs/0024
index 0d5578423..3dbbc2c25 100644
--- a/test/confs/0024
+++ b/test/confs/0024
@@ -1,13 +1,8 @@
 # Exim test configuration 0024
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0025 b/test/confs/0025
index a655d5f88..3ecc5dd68 100644
--- a/test/confs/0025
+++ b/test/confs/0025
@@ -1,13 +1,8 @@
 # Exim test configuration 0025
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0026 b/test/confs/0026
index f40587980..07fa40976 100644
--- a/test/confs/0026
+++ b/test/confs/0026
@@ -1,13 +1,8 @@
 # Exim test configuration 0026
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0027 b/test/confs/0027
index b508a5b65..9c775bd5d 100644
--- a/test/confs/0027
+++ b/test/confs/0027
@@ -1,13 +1,8 @@
 # Exim test configuration 0027
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0028 b/test/confs/0028
index cc0784b06..149d8eda8 100644
--- a/test/confs/0028
+++ b/test/confs/0028
@@ -1,13 +1,8 @@
 # Exim test configuration 0028
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0029 b/test/confs/0029
index a4eb1b1db..09e77963f 100644
--- a/test/confs/0029
+++ b/test/confs/0029
@@ -1,13 +1,8 @@
 # Exim test configuration 0029
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0030 b/test/confs/0030
index c7c5f0867..446a7ede8 100644
--- a/test/confs/0030
+++ b/test/confs/0030
@@ -1,13 +1,8 @@
 # Exim test configuration 0030
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0031 b/test/confs/0031
index 0328320ca..e3f0360fc 100644
--- a/test/confs/0031
+++ b/test/confs/0031
@@ -1,13 +1,8 @@
 # Exim test configuration 0031
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0032 b/test/confs/0032
index 1648fd217..961cefadd 100644
--- a/test/confs/0032
+++ b/test/confs/0032
@@ -1,13 +1,8 @@
 # Exim test configuration 0032
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0033 b/test/confs/0033
index 9e95388c3..ca06da772 100644
--- a/test/confs/0033
+++ b/test/confs/0033
@@ -1,13 +1,8 @@
 # Exim test configuration 0033
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0034 b/test/confs/0034
index e5f7931c3..8eb9dce69 100644
--- a/test/confs/0034
+++ b/test/confs/0034
@@ -1,13 +1,8 @@
 # Exim test configuration 0034
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0035 b/test/confs/0035
index 36ad12a83..8d34269a2 100644
--- a/test/confs/0035
+++ b/test/confs/0035
@@ -3,14 +3,9 @@
 SERVER=
 SUBMISSION_OPTIONS=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0036 b/test/confs/0036
index 0c5044445..48479c787 100644
--- a/test/confs/0036
+++ b/test/confs/0036
@@ -2,14 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0037 b/test/confs/0037
index 98ef4d3d4..8ba94ded1 100644
--- a/test/confs/0037
+++ b/test/confs/0037
@@ -2,13 +2,8 @@
 
 FILTER_PREPEND_HOME=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0038 b/test/confs/0038
index 514af9e8a..0ef9028f1 100644
--- a/test/confs/0038
+++ b/test/confs/0038
@@ -4,14 +4,9 @@ RRATELIMIT=0/1h/strict
 DRATELIMIT=0/1h/per_byte/strict
 ACLRCPT=check_rcpt
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0039 b/test/confs/0039
index f8ad999f5..8ca8b1eec 100644
--- a/test/confs/0039
+++ b/test/confs/0039
@@ -2,14 +2,9 @@
 
 QDG=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0040 b/test/confs/0040
index 71f903845..35453a0dd 100644
--- a/test/confs/0040
+++ b/test/confs/0040
@@ -1,12 +1,7 @@
 # Exim test configuration 0040
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0041 b/test/confs/0041
index ec1067584..5157170f2 100644
--- a/test/confs/0041
+++ b/test/confs/0041
@@ -1,12 +1,7 @@
 # Exim test configuration 0041
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0042 b/test/confs/0042
index c65be6f99..14c8a9635 100644
--- a/test/confs/0042
+++ b/test/confs/0042
@@ -1,12 +1,7 @@
 # Exim test configuration 0042
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0043 b/test/confs/0043
index eaa13a859..0bf3547c7 100644
--- a/test/confs/0043
+++ b/test/confs/0043
@@ -1,12 +1,7 @@
 # Exim test configuration 0043
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0044 b/test/confs/0044
index 963a55ea3..e4db43db0 100644
--- a/test/confs/0044
+++ b/test/confs/0044
@@ -1,12 +1,7 @@
 # Exim test configuration 0044
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0045 b/test/confs/0045
index 764a7f213..a59c8e2c1 100644
--- a/test/confs/0045
+++ b/test/confs/0045
@@ -1,12 +1,7 @@
 # Exim test configuration 0045
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0046 b/test/confs/0046
index a64d3d9ea..9fff3b91b 100644
--- a/test/confs/0046
+++ b/test/confs/0046
@@ -2,13 +2,8 @@
 
 NL=FALSE
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0047 b/test/confs/0047
index ff8aea173..187f855ef 100644
--- a/test/confs/0047
+++ b/test/confs/0047
@@ -1,12 +1,7 @@
 # Exim test configuration 0047
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0048 b/test/confs/0048
index c15945f98..9c2d4428f 100644
--- a/test/confs/0048
+++ b/test/confs/0048
@@ -2,13 +2,8 @@
 
 MESSAGE_LOGS = true
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0049 b/test/confs/0049
index 4dc39d87b..a00dde1f5 100644
--- a/test/confs/0049
+++ b/test/confs/0049
@@ -1,13 +1,8 @@
 # Exim test configuration 0049
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0050 b/test/confs/0050
index 47869246c..32a822a9b 100644
--- a/test/confs/0050
+++ b/test/confs/0050
@@ -1,14 +1,9 @@
 # Exim test configuration 0050
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0051 b/test/confs/0051
index af1e10acd..2fde9e557 100644
--- a/test/confs/0051
+++ b/test/confs/0051
@@ -1,14 +1,9 @@
 # Exim test configuration 0051
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0052 b/test/confs/0052
index 3b36daf04..2af555cca 100644
--- a/test/confs/0052
+++ b/test/confs/0052
@@ -1,14 +1,9 @@
 # Exim test configuration 0052
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0053 b/test/confs/0053
index 0e6a98546..04263a59f 100644
--- a/test/confs/0053
+++ b/test/confs/0053
@@ -1,14 +1,9 @@
 # Exim test configuration 0053
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0054 b/test/confs/0054
index 13ca588a4..3ad875157 100644
--- a/test/confs/0054
+++ b/test/confs/0054
@@ -1,14 +1,9 @@
 # Exim test configuration 0054
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0055 b/test/confs/0055
index 0c64561b3..72a2be740 100644
--- a/test/confs/0055
+++ b/test/confs/0055
@@ -1,13 +1,8 @@
 # Exim test configuration 0055
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0056 b/test/confs/0056
index cc151dd70..1678e2063 100644
--- a/test/confs/0056
+++ b/test/confs/0056
@@ -1,13 +1,8 @@
 # Exim test configuration 0056
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0057 b/test/confs/0057
index 2b13c187d..db09830ad 100644
--- a/test/confs/0057
+++ b/test/confs/0057
@@ -1,13 +1,8 @@
 # Exim test configuration 0057
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0058 b/test/confs/0058
index 4c3472379..2b52453a0 100644
--- a/test/confs/0058
+++ b/test/confs/0058
@@ -1,13 +1,8 @@
 # Exim test configuration 0058
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0059 b/test/confs/0059
index 6c771f1d2..40e877be8 100644
--- a/test/confs/0059
+++ b/test/confs/0059
@@ -1,13 +1,8 @@
 # Exim test configuration 0059
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0060 b/test/confs/0060
index c17f00372..6ff220906 100644
--- a/test/confs/0060
+++ b/test/confs/0060
@@ -1,13 +1,8 @@
 # Exim test configuration 0060
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0061 b/test/confs/0061
index 5f8521499..07c85e4a9 100644
--- a/test/confs/0061
+++ b/test/confs/0061
@@ -1,13 +1,8 @@
 # Exim test configuration 0061
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = ten-1.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0062 b/test/confs/0062
index 3e3ee757d..b5d47c862 100644
--- a/test/confs/0062
+++ b/test/confs/0062
@@ -1,13 +1,8 @@
 # Exim test configuration 0062
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0063 b/test/confs/0063
index e832aa81a..b297ec011 100644
--- a/test/confs/0063
+++ b/test/confs/0063
@@ -1,13 +1,8 @@
 # Exim test configuration 0063
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0064 b/test/confs/0064
index 5046f2375..f0d9e9618 100644
--- a/test/confs/0064
+++ b/test/confs/0064
@@ -1,13 +1,8 @@
 # Exim test configuration 0064
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0065 b/test/confs/0065
index 47b90b199..fb01f3772 100644
--- a/test/confs/0065
+++ b/test/confs/0065
@@ -1,13 +1,8 @@
 # Exim test configuration 0065
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0066 b/test/confs/0066
index 6271d5a0d..dcf3bcffc 100644
--- a/test/confs/0066
+++ b/test/confs/0066
@@ -1,13 +1,8 @@
 # Exim test configuration 0066
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0067 b/test/confs/0067
index de9a0db9c..35bd3b24c 100644
--- a/test/confs/0067
+++ b/test/confs/0067
@@ -1,13 +1,8 @@
 # Exim test configuration 0067
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0068 b/test/confs/0068
index f4239beea..f8078fdf3 100644
--- a/test/confs/0068
+++ b/test/confs/0068
@@ -1,12 +1,7 @@
 # Exim test configuration 0068
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0069 b/test/confs/0069
index 3514a1ea1..ca81da915 100644
--- a/test/confs/0069
+++ b/test/confs/0069
@@ -2,14 +2,9 @@
 
 LOG_SELECTOR=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0070 b/test/confs/0070
index 1c439b72b..9ef3b2ad8 100644
--- a/test/confs/0070
+++ b/test/confs/0070
@@ -2,14 +2,9 @@
 
 HVH=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0071 b/test/confs/0071
index 00d45578a..d7ab2ff5d 100644
--- a/test/confs/0071
+++ b/test/confs/0071
@@ -1,12 +1,7 @@
 # Exim test configuration 0071
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0072 b/test/confs/0072
index 69ad904cd..9bb73984d 100644
--- a/test/confs/0072
+++ b/test/confs/0072
@@ -4,13 +4,8 @@ ONCE=once=DIR/spool/autolog
 ONLY=
 RETURN=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0073 b/test/confs/0073
index dfea2c293..da716efb6 100644
--- a/test/confs/0073
+++ b/test/confs/0073
@@ -1,12 +1,7 @@
 # Exim test configuration 0073
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0074 b/test/confs/0074
index c967ba27c..3102206b0 100644
--- a/test/confs/0074
+++ b/test/confs/0074
@@ -1,12 +1,7 @@
 # Exim test configuration 0074
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0075 b/test/confs/0075
index e4a6fdfca..8b8c77ca6 100644
--- a/test/confs/0075
+++ b/test/confs/0075
@@ -1,12 +1,7 @@
 # Exim test configuration 0075
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0076 b/test/confs/0076
index 840fde7e3..1415280f9 100644
--- a/test/confs/0076
+++ b/test/confs/0076
@@ -1,12 +1,7 @@
 # Exim test configuration 0076
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0077 b/test/confs/0077
index 18edff925..564554e39 100644
--- a/test/confs/0077
+++ b/test/confs/0077
@@ -1,13 +1,8 @@
 # Exim test configuration 0077
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0078 b/test/confs/0078
index 7955d10c5..aa1e445f3 100644
--- a/test/confs/0078
+++ b/test/confs/0078
@@ -1,13 +1,8 @@
 # Exim test configuration 0078
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0079 b/test/confs/0079
index 3279e52e8..25ef65879 100644
--- a/test/confs/0079
+++ b/test/confs/0079
@@ -1,12 +1,7 @@
 # Exim test configuration 0079
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0080 b/test/confs/0080
index fc5f82449..fbe026c26 100644
--- a/test/confs/0080
+++ b/test/confs/0080
@@ -1,12 +1,7 @@
 # Exim test configuration 0080
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0081 b/test/confs/0081
index 29a35862b..f403728c3 100644
--- a/test/confs/0081
+++ b/test/confs/0081
@@ -1,12 +1,7 @@
 # Exim test configuration 0081
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0082 b/test/confs/0082
index 7219daf2d..29ff8d15c 100644
--- a/test/confs/0082
+++ b/test/confs/0082
@@ -1,12 +1,7 @@
 # Exim test configuration 0082
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0083 b/test/confs/0083
index e7b1a0486..fcae1f5d1 100644
--- a/test/confs/0083
+++ b/test/confs/0083
@@ -1,12 +1,7 @@
 # Exim test configuration 0083
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0084 b/test/confs/0084
index 44e57633d..94e386e02 100644
--- a/test/confs/0084
+++ b/test/confs/0084
@@ -1,13 +1,8 @@
 # Exim test configuration 0084
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0085 b/test/confs/0085
index efd52533c..25eea9e90 100644
--- a/test/confs/0085
+++ b/test/confs/0085
@@ -1,13 +1,8 @@
 # Exim test configuration 0085
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0086 b/test/confs/0086
index f512e3194..a0a29b62d 100644
--- a/test/confs/0086
+++ b/test/confs/0086
@@ -1,13 +1,8 @@
 # Exim test configuration 0086
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0087 b/test/confs/0087
index 2e8200a3d..8141edb98 100644
--- a/test/confs/0087
+++ b/test/confs/0087
@@ -1,13 +1,8 @@
 # Exim test configuration 0087
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0088 b/test/confs/0088
index 13f0ffc62..054944d95 100644
--- a/test/confs/0088
+++ b/test/confs/0088
@@ -1,13 +1,8 @@
 # Exim test configuration 0088
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0089 b/test/confs/0089
index 4b6bc6500..b8bd142db 100644
--- a/test/confs/0089
+++ b/test/confs/0089
@@ -1,13 +1,8 @@
 # Exim test configuration 0089
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0090 b/test/confs/0090
index 735ea021a..907d27544 100644
--- a/test/confs/0090
+++ b/test/confs/0090
@@ -1,13 +1,8 @@
 # Exim test configuration 0090
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0091 b/test/confs/0091
index 58bd6df71..2ef91af8f 100644
--- a/test/confs/0091
+++ b/test/confs/0091
@@ -1,13 +1,8 @@
 # Exim test configuration 0091
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0092 b/test/confs/0092
index e0c221bbf..e5cdf119a 100644
--- a/test/confs/0092
+++ b/test/confs/0092
@@ -7,14 +7,9 @@ domainlist local_domains = test.ex : *.test.ex
 
 domainlist relay_domains = test.ex
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0093 b/test/confs/0093
index e94481518..2ed0a5207 100644
--- a/test/confs/0093
+++ b/test/confs/0093
@@ -1,12 +1,7 @@
 # Exim test configuration 0093
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0094 b/test/confs/0094
index 79825c758..04c9d8078 100644
--- a/test/confs/0094
+++ b/test/confs/0094
@@ -1,12 +1,7 @@
 # Exim test configuration 0094
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0095 b/test/confs/0095
index ba3e7b805..c20b06d7c 100644
--- a/test/confs/0095
+++ b/test/confs/0095
@@ -3,14 +3,9 @@
 ERT=
 QWM=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0096 b/test/confs/0096
index 074dc2fd4..ff5f5cebc 100644
--- a/test/confs/0096
+++ b/test/confs/0096
@@ -1,12 +1,7 @@
 # Exim test configuration 0096
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0097 b/test/confs/0097
index 3c711253a..0841952bf 100644
--- a/test/confs/0097
+++ b/test/confs/0097
@@ -1,12 +1,7 @@
 # Exim test configuration 0097
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0098 b/test/confs/0098
index 03f94ac37..465c2310a 100644
--- a/test/confs/0098
+++ b/test/confs/0098
@@ -2,13 +2,8 @@
 
 WMF=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0099 b/test/confs/0099
index 0b4c1372b..8b4299130 100644
--- a/test/confs/0099
+++ b/test/confs/0099
@@ -2,13 +2,8 @@
 
 RETRY =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
@@ -24,7 +19,7 @@ begin routers
 
 bydns:
   driver = dnslookup
-  domains = mxt2.test.ex
+  domains = mxt2.test.ex : mxnonexist.test.ex
   transport = smtp
   fail_defer_domains = *
 
diff --git a/test/confs/0100 b/test/confs/0100
index d9843d074..c404d5a73 100644
--- a/test/confs/0100
+++ b/test/confs/0100
@@ -1,12 +1,7 @@
 # Exim test configuration 0100
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0101 b/test/confs/0101
index 3b421a755..377eae705 100644
--- a/test/confs/0101
+++ b/test/confs/0101
@@ -1,12 +1,7 @@
 # Exim test configuration 0101
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0102 b/test/confs/0102
index e9e7512df..dde11a5e9 100644
--- a/test/confs/0102
+++ b/test/confs/0102
@@ -1,12 +1,7 @@
 # Exim test configuration 0102
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0103 b/test/confs/0103
index 63311a21a..9a136c7bc 100644
--- a/test/confs/0103
+++ b/test/confs/0103
@@ -1,12 +1,7 @@
 # Exim test configuration 0103
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0104 b/test/confs/0104
index 18ce0b046..de0889adb 100644
--- a/test/confs/0104
+++ b/test/confs/0104
@@ -1,12 +1,7 @@
 # Exim test configuration 0104
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0105 b/test/confs/0105
index 3cc1a80e9..1b954f460 100644
--- a/test/confs/0105
+++ b/test/confs/0105
@@ -1,12 +1,7 @@
 # Exim test configuration 0105
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0106 b/test/confs/0106
index faaccd0c8..ef91e8b10 100644
--- a/test/confs/0106
+++ b/test/confs/0106
@@ -1,13 +1,8 @@
 # Exim test configuration 0106
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0107 b/test/confs/0107
index 72bc6c5c2..9bbb7e7a3 100644
--- a/test/confs/0107
+++ b/test/confs/0107
@@ -1,12 +1,7 @@
 # Exim test configuration 0107
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0108 b/test/confs/0108
index f8e5d0b12..a4ee442e2 100644
--- a/test/confs/0108
+++ b/test/confs/0108
@@ -1,12 +1,7 @@
 # Exim test configuration 0108
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0109 b/test/confs/0109
index ebc53295d..59957b96b 100644
--- a/test/confs/0109
+++ b/test/confs/0109
@@ -1,12 +1,7 @@
 # Exim test configuration 0109
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0110 b/test/confs/0110
index 63377228c..361c12fb4 100644
--- a/test/confs/0110
+++ b/test/confs/0110
@@ -1,12 +1,7 @@
 # Exim test configuration 0110
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0111 b/test/confs/0111
index 9a840e956..61fc9a887 100644
--- a/test/confs/0111
+++ b/test/confs/0111
@@ -1,12 +1,7 @@
 # Exim test configuration 0111
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0112 b/test/confs/0112
index 312baae73..06e436abb 100644
--- a/test/confs/0112
+++ b/test/confs/0112
@@ -1,12 +1,7 @@
 # Exim test configuration 0112
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0113 b/test/confs/0113
index a5bc653fc..1fd61009f 100644
--- a/test/confs/0113
+++ b/test/confs/0113
@@ -1,12 +1,7 @@
 # Exim test configuration 0113
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0114 b/test/confs/0114
index 10cf42a82..d5a60bb00 100644
--- a/test/confs/0114
+++ b/test/confs/0114
@@ -1,12 +1,7 @@
 # Exim test configuration 0114
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0115 b/test/confs/0115
index aaf04e501..799112f08 100644
--- a/test/confs/0115
+++ b/test/confs/0115
@@ -1,12 +1,7 @@
 # Exim test configuration 0115
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0116 b/test/confs/0116
index e657b11c2..313d32c63 100644
--- a/test/confs/0116
+++ b/test/confs/0116
@@ -1,12 +1,7 @@
 # Exim test configuration 0116
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0117 b/test/confs/0117
index f80fc9ae5..5a266d32b 100644
--- a/test/confs/0117
+++ b/test/confs/0117
@@ -1,12 +1,7 @@
 # Exim test configuration 0117
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0118 b/test/confs/0118
index 45b9f79e4..cf8838f32 100644
--- a/test/confs/0118
+++ b/test/confs/0118
@@ -1,12 +1,7 @@
 # Exim test configuration 0118
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0119 b/test/confs/0119
index f33253242..4514635e5 100644
--- a/test/confs/0119
+++ b/test/confs/0119
@@ -1,12 +1,7 @@
 # Exim test configuration 0119
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0120 b/test/confs/0120
index 6ede1ee4e..95a5b3e8a 100644
--- a/test/confs/0120
+++ b/test/confs/0120
@@ -1,12 +1,7 @@
 # Exim test configuration 0120
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0121 b/test/confs/0121
index 6c6f65d3a..ca2d338a1 100644
--- a/test/confs/0121
+++ b/test/confs/0121
@@ -1,12 +1,7 @@
 # Exim test configuration 0121
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0122 b/test/confs/0122
index 8ed176fe3..3fec1235d 100644
--- a/test/confs/0122
+++ b/test/confs/0122
@@ -1,12 +1,7 @@
 # Exim test configuration 0122
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0123 b/test/confs/0123
index fc8ded626..6eae763a1 100644
--- a/test/confs/0123
+++ b/test/confs/0123
@@ -1,12 +1,7 @@
 # Exim test configuration 0123
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0124 b/test/confs/0124
index 8dff37eeb..da81a998a 100644
--- a/test/confs/0124
+++ b/test/confs/0124
@@ -1,12 +1,7 @@
 # Exim test configuration 0124
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0125 b/test/confs/0125
index 23547965f..69fe2d674 100644
--- a/test/confs/0125
+++ b/test/confs/0125
@@ -1,12 +1,7 @@
 # Exim test configuration 0125
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0126 b/test/confs/0126
index 5b4bb9c3b..537060608 100644
--- a/test/confs/0126
+++ b/test/confs/0126
@@ -1,13 +1,8 @@
 # Exim test configuration 0126
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0127 b/test/confs/0127
index f3dbe76e6..1906bb430 100644
--- a/test/confs/0127
+++ b/test/confs/0127
@@ -1,13 +1,8 @@
 # Exim test configuration 0127
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0128 b/test/confs/0128
index f81392e9c..9acfb5e9d 100644
--- a/test/confs/0128
+++ b/test/confs/0128
@@ -1,12 +1,7 @@
 # Exim test configuration 0128
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0129 b/test/confs/0129
index 0fe74070b..c91b02587 100644
--- a/test/confs/0129
+++ b/test/confs/0129
@@ -1,12 +1,7 @@
 # Exim test configuration 0129
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0130 b/test/confs/0130
index c6dfcc420..02a095358 100644
--- a/test/confs/0130
+++ b/test/confs/0130
@@ -1,12 +1,7 @@
 # Exim test configuration 0130
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0131 b/test/confs/0131
index 85aa1250d..c55813e77 100644
--- a/test/confs/0131
+++ b/test/confs/0131
@@ -1,12 +1,7 @@
 # Exim test configuration 0131
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0132 b/test/confs/0132
index b018f2d6c..83bbb3608 100644
--- a/test/confs/0132
+++ b/test/confs/0132
@@ -1,12 +1,7 @@
 # Exim test configuration 0132
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0133 b/test/confs/0133
index c85cc8dc3..bc4e6283f 100644
--- a/test/confs/0133
+++ b/test/confs/0133
@@ -1,12 +1,7 @@
 # Exim test configuration 0133
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0134 b/test/confs/0134
index 8217278c4..9530df652 100644
--- a/test/confs/0134
+++ b/test/confs/0134
@@ -1,12 +1,7 @@
 # Exim test configuration 0134
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0135 b/test/confs/0135
index 549579f5b..2c62f0473 100644
--- a/test/confs/0135
+++ b/test/confs/0135
@@ -1,12 +1,7 @@
 # Exim test configuration 0135
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0136 b/test/confs/0136
index b35b4e078..efc73c58d 100644
--- a/test/confs/0136
+++ b/test/confs/0136
@@ -2,13 +2,8 @@
 
 BRB=true
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0137 b/test/confs/0137
index 82714a382..1a2094ef3 100644
--- a/test/confs/0137
+++ b/test/confs/0137
@@ -1,15 +1,11 @@
 # Exim test configuration 0137
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
+log_selector = +subject
 domainlist local_domains = test.ex
 qualify_domain = test.ex
 
diff --git a/test/confs/0138 b/test/confs/0138
index a59fc8d46..66539d6b0 100644
--- a/test/confs/0138
+++ b/test/confs/0138
@@ -1,12 +1,7 @@
 # Exim test configuration 0138
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0139 b/test/confs/0139
index a5a315e0a..eb3990c72 100644
--- a/test/confs/0139
+++ b/test/confs/0139
@@ -1,12 +1,7 @@
 # Exim test configuration 0139
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0140 b/test/confs/0140
index d44f11a04..fbc64b43b 100644
--- a/test/confs/0140
+++ b/test/confs/0140
@@ -1,12 +1,7 @@
 # Exim test configuration 0140
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0141 b/test/confs/0141
index a9d2d2f68..96f6ef112 100644
--- a/test/confs/0141
+++ b/test/confs/0141
@@ -1,12 +1,7 @@
 # Exim test configuration 0141
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0142 b/test/confs/0142
index 86d911101..748e76b8b 100644
--- a/test/confs/0142
+++ b/test/confs/0142
@@ -1,12 +1,7 @@
 # Exim test configuration 0142
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0143 b/test/confs/0143
index fd3bb295d..5a6ee34a9 100644
--- a/test/confs/0143
+++ b/test/confs/0143
@@ -1,13 +1,8 @@
 # Exim test configuration 0143
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0144 b/test/confs/0144
index d337a8e1e..34b38230f 100644
--- a/test/confs/0144
+++ b/test/confs/0144
@@ -1,14 +1,9 @@
 # Exim test configuration 0144
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0145 b/test/confs/0145
index ab8cc6691..16b02a858 100644
--- a/test/confs/0145
+++ b/test/confs/0145
@@ -1,14 +1,9 @@
 # Exim test configuration 0145
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0146 b/test/confs/0146
index f2f0e26a3..d8b6067e7 100644
--- a/test/confs/0146
+++ b/test/confs/0146
@@ -1,14 +1,9 @@
 # Exim test configuration 0146
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0147 b/test/confs/0147
index 643e86d44..996d064be 100644
--- a/test/confs/0147
+++ b/test/confs/0147
@@ -6,15 +6,10 @@ x#xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx#xxxxxxxxxxxxxxxxxxxxxxxxxxxx
 ABCD_XYZ = abcdxyz
 ABCD=abcd + ABCD_XYZ
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0148 b/test/confs/0148
index 6a87274d4..ea31cddbe 100644
--- a/test/confs/0148
+++ b/test/confs/0148
@@ -1,14 +1,9 @@
 # Exim test configuration 0148
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0149 b/test/confs/0149
index 33c022f22..60c742acf 100644
--- a/test/confs/0149
+++ b/test/confs/0149
@@ -1,14 +1,9 @@
 # Exim test configuration 0149
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0150 b/test/confs/0150
index fa4bac12e..dd421a125 100644
--- a/test/confs/0150
+++ b/test/confs/0150
@@ -1,12 +1,7 @@
 # Exim test configuration 0150
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0151 b/test/confs/0151
index 58aa30eed..d5d178654 100644
--- a/test/confs/0151
+++ b/test/confs/0151
@@ -1,12 +1,7 @@
 # Exim test configuration 0151
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0152 b/test/confs/0152
index 2804f6616..7671d52ed 100644
--- a/test/confs/0152
+++ b/test/confs/0152
@@ -1,12 +1,7 @@
 # Exim test configuration 0152
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0153 b/test/confs/0153
index c7fc79d54..c16f88fe9 100644
--- a/test/confs/0153
+++ b/test/confs/0153
@@ -1,12 +1,7 @@
 # Exim test configuration 0153
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0154 b/test/confs/0154
index 84ed47d7d..bc5ffb899 100644
--- a/test/confs/0154
+++ b/test/confs/0154
@@ -1,12 +1,7 @@
 # Exim test configuration 0154
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0155 b/test/confs/0155
index b51837c4d..a85ebe5d7 100644
--- a/test/confs/0155
+++ b/test/confs/0155
@@ -1,12 +1,7 @@
 # Exim test configuration 0155
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0156 b/test/confs/0156
index 389811416..d1faa7514 100644
--- a/test/confs/0156
+++ b/test/confs/0156
@@ -1,12 +1,7 @@
 # Exim test configuration 0156
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0157 b/test/confs/0157
index 69556016e..1589f82ed 100644
--- a/test/confs/0157
+++ b/test/confs/0157
@@ -1,12 +1,7 @@
 # Exim test configuration 0157
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0158 b/test/confs/0158
index 5af747138..ccd261e56 100644
--- a/test/confs/0158
+++ b/test/confs/0158
@@ -1,12 +1,7 @@
 # Exim test configuration 0158
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0159 b/test/confs/0159
index 59d3087c9..e648d9304 100644
--- a/test/confs/0159
+++ b/test/confs/0159
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0160 b/test/confs/0160
index 68a5fe77a..f64883729 100644
--- a/test/confs/0160
+++ b/test/confs/0160
@@ -1,13 +1,8 @@
 # Exim test configuration 0160
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0161 b/test/confs/0161
index 46175d9a0..8b91ea053 100644
--- a/test/confs/0161
+++ b/test/confs/0161
@@ -1,13 +1,8 @@
 # Exim test configuration 0161
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0162 b/test/confs/0162
index b8bc6ae55..0ec376230 100644
--- a/test/confs/0162
+++ b/test/confs/0162
@@ -1,13 +1,8 @@
 # Exim test configuration 0162
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0163 b/test/confs/0163
index 4b217eef6..7b19d9f16 100644
--- a/test/confs/0163
+++ b/test/confs/0163
@@ -1,13 +1,8 @@
 # Exim test configuration 0163
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0164 b/test/confs/0164
index 1d28066b4..6d94efdfd 100644
--- a/test/confs/0164
+++ b/test/confs/0164
@@ -1,12 +1,7 @@
 # Exim test configuration 0164
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0165 b/test/confs/0165
index 03be27c40..03e9a825e 100644
--- a/test/confs/0165
+++ b/test/confs/0165
@@ -1,12 +1,7 @@
 # Exim test configuration 0165
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0166 b/test/confs/0166
index 6d492d7fd..93489dc56 100644
--- a/test/confs/0166
+++ b/test/confs/0166
@@ -1,12 +1,7 @@
 # Exim test configuration 0166
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0167 b/test/confs/0167
index 633993424..a65b9ed65 100644
--- a/test/confs/0167
+++ b/test/confs/0167
@@ -1,12 +1,7 @@
 # Exim test configuration 0167
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0168 b/test/confs/0168
index ea10f1244..196b8e60c 100644
--- a/test/confs/0168
+++ b/test/confs/0168
@@ -1,12 +1,7 @@
 # Exim test configuration 0168
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0169 b/test/confs/0169
index 4a42f0de2..beafec56d 100644
--- a/test/confs/0169
+++ b/test/confs/0169
@@ -1,13 +1,8 @@
 # Exim test configuration 0169
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0170 b/test/confs/0170
index 735b7b262..5e25e24d8 100644
--- a/test/confs/0170
+++ b/test/confs/0170
@@ -1,13 +1,8 @@
 # Exim test configuration 0170
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0171 b/test/confs/0171
index 2c2d18e41..fe4fc2c15 100644
--- a/test/confs/0171
+++ b/test/confs/0171
@@ -1,12 +1,7 @@
 # Exim test configuration 0171
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0172 b/test/confs/0172
index 82d1feac8..9dcc42f81 100644
--- a/test/confs/0172
+++ b/test/confs/0172
@@ -1,12 +1,7 @@
 # Exim test configuration 0172
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0173 b/test/confs/0173
index 6f8ded7cb..1b423e152 100644
--- a/test/confs/0173
+++ b/test/confs/0173
@@ -1,12 +1,7 @@
 # Exim test configuration 0173
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0174 b/test/confs/0174
index a3e11143e..b7fe882e2 100644
--- a/test/confs/0174
+++ b/test/confs/0174
@@ -1,12 +1,7 @@
 # Exim test configuration 0174
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0175 b/test/confs/0175
index 2898683e5..b20e4fe1a 100644
--- a/test/confs/0175
+++ b/test/confs/0175
@@ -1,12 +1,7 @@
 # Exim test configuration 0175
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0176 b/test/confs/0176
index cf5d41f15..81d0b5ddf 100644
--- a/test/confs/0176
+++ b/test/confs/0176
@@ -1,12 +1,7 @@
 # Exim test configuration 0176
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0177 b/test/confs/0177
index ccf9611f9..7921a8b55 100644
--- a/test/confs/0177
+++ b/test/confs/0177
@@ -1,12 +1,7 @@
 # Exim test configuration 0177
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0178 b/test/confs/0178
index aaa83f0eb..bdabf6afa 100644
--- a/test/confs/0178
+++ b/test/confs/0178
@@ -1,12 +1,7 @@
 # Exim test configuration 0178
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0179 b/test/confs/0179
index d3a6da6fd..fdd5fb10c 100644
--- a/test/confs/0179
+++ b/test/confs/0179
@@ -1,13 +1,8 @@
 # Exim test configuration 0179
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0180 b/test/confs/0180
index 663780b90..c4a0bd5af 100644
--- a/test/confs/0180
+++ b/test/confs/0180
@@ -1,15 +1,11 @@
 # Exim test configuration 0180
 
-CSS=check_spool_space=100000000K
+# Require immense amount of disk space, expecting to fail.  Can unfortunately work on big filesystems.
+CSS=check_spool_space=400G
+
+.include DIR/aux-var/std_conf_prefix
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0181 b/test/confs/0181
index ab3bfdb2f..f00a9b28a 100644
--- a/test/confs/0181
+++ b/test/confs/0181
@@ -1,13 +1,8 @@
 # Exim test configuration 0181
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0182 b/test/confs/0182
index f76ae7f67..17d60789c 100644
--- a/test/confs/0182
+++ b/test/confs/0182
@@ -1,13 +1,8 @@
 # Exim test configuration 0182
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0183 b/test/confs/0183
index 65643d477..6699237a2 100644
--- a/test/confs/0183
+++ b/test/confs/0183
@@ -1,13 +1,8 @@
 # Exim test configuration 0183
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0184 b/test/confs/0184
index 9e43a38fd..9e15a4895 100644
--- a/test/confs/0184
+++ b/test/confs/0184
@@ -1,12 +1,7 @@
 # Exim test configuration 0184
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0185 b/test/confs/0185
index d88d1e2f9..d6e9fe020 100644
--- a/test/confs/0185
+++ b/test/confs/0185
@@ -1,12 +1,7 @@
 # Exim test configuration 0185
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0186 b/test/confs/0186
index 5aa2c70d5..21b31060c 100644
--- a/test/confs/0186
+++ b/test/confs/0186
@@ -1,12 +1,7 @@
 # Exim test configuration 0186
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0187 b/test/confs/0187
index af570f0e0..bca41b5f7 100644
--- a/test/confs/0187
+++ b/test/confs/0187
@@ -1,12 +1,7 @@
 # Exim test configuration 0187
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0188 b/test/confs/0188
index 70eabdd51..d94506ef5 100644
--- a/test/confs/0188
+++ b/test/confs/0188
@@ -1,12 +1,7 @@
 # Exim test configuration 0188
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0189 b/test/confs/0189
index bc29d4961..5d12465b3 100644
--- a/test/confs/0189
+++ b/test/confs/0189
@@ -1,13 +1,8 @@
 # Exim test configuration 0189
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0190 b/test/confs/0190
index e76cdbbd1..03ded9ce2 100644
--- a/test/confs/0190
+++ b/test/confs/0190
@@ -1,12 +1,7 @@
 # Exim test configuration 0190
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0191 b/test/confs/0191
index 4585e390a..9dba8c35d 100644
--- a/test/confs/0191
+++ b/test/confs/0191
@@ -1,12 +1,7 @@
 # Exim test configuration 0191
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0192 b/test/confs/0192
index 42fb603ca..d7bd3c1b1 100644
--- a/test/confs/0192
+++ b/test/confs/0192
@@ -1,13 +1,8 @@
 # Exim test configuration 0192
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0193 b/test/confs/0193
index 1cba850e7..4dbb06679 100644
--- a/test/confs/0193
+++ b/test/confs/0193
@@ -1,13 +1,8 @@
 # Exim test configuration 0193
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0194 b/test/confs/0194
index e2c4160ea..d813d9290 100644
--- a/test/confs/0194
+++ b/test/confs/0194
@@ -1,13 +1,8 @@
 # Exim test configuration 0194
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0195 b/test/confs/0195
index 75c19ca62..2d51bebfa 100644
--- a/test/confs/0195
+++ b/test/confs/0195
@@ -1,13 +1,8 @@
 # Exim test configuration 0195
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0196 b/test/confs/0196
index 096aa30ab..38a839144 100644
--- a/test/confs/0196
+++ b/test/confs/0196
@@ -1,13 +1,8 @@
 # Exim test configuration 0196
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0197 b/test/confs/0197
index 32760b5a1..b3f25c4c0 100644
--- a/test/confs/0197
+++ b/test/confs/0197
@@ -3,13 +3,8 @@
 # Remove connection timeout when copying for real use,
 # and these settings.
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 queue_run_in_order
 trusted_users = CALLER
diff --git a/test/confs/0198 b/test/confs/0198
index 3946f8441..f754a3187 100644
--- a/test/confs/0198
+++ b/test/confs/0198
@@ -1,12 +1,7 @@
 # Exim test configuration 0198
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 queue_run_in_order
 trusted_users = CALLER
 
diff --git a/test/confs/0199 b/test/confs/0199
index e7e17716f..8b0e760f5 100644
--- a/test/confs/0199
+++ b/test/confs/0199
@@ -1,13 +1,8 @@
 # Exim test configuration 0199
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0200 b/test/confs/0200
index 0660b9a2e..ab50f36df 100644
--- a/test/confs/0200
+++ b/test/confs/0200
@@ -1,13 +1,8 @@
 # Exim test configuration 0200
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0201 b/test/confs/0201
index 0c1a0510a..5385baa9a 100644
--- a/test/confs/0201
+++ b/test/confs/0201
@@ -1,13 +1,8 @@
 # Exim test configuration 0201
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0202 b/test/confs/0202
index 56f601416..dc68127ae 100644
--- a/test/confs/0202
+++ b/test/confs/0202
@@ -1,12 +1,7 @@
 # Exim test configuration 0202
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0203 b/test/confs/0203
index 3e7f49652..38e879010 100644
--- a/test/confs/0203
+++ b/test/confs/0203
@@ -1,12 +1,7 @@
 # Exim test configuration 0203
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0204 b/test/confs/0204
index fa0400a91..138dbe0a1 100644
--- a/test/confs/0204
+++ b/test/confs/0204
@@ -1,13 +1,8 @@
 # Exim test configuration 0204
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0205 b/test/confs/0205
index 4dc1be78a..069e85033 100644
--- a/test/confs/0205
+++ b/test/confs/0205
@@ -1,13 +1,8 @@
 # Exim test configuration 0205
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0206 b/test/confs/0206
index 80fc0d851..628d2ec4d 100644
--- a/test/confs/0206
+++ b/test/confs/0206
@@ -1,13 +1,8 @@
 # Exim test configuration 0206
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0207 b/test/confs/0207
index 1bc90fe41..eed3e2565 100644
--- a/test/confs/0207
+++ b/test/confs/0207
@@ -1,13 +1,8 @@
 # Exim test configuration 0207
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0208 b/test/confs/0208
index 8a1a87dfe..5a0b9f153 100644
--- a/test/confs/0208
+++ b/test/confs/0208
@@ -2,14 +2,9 @@
 
 MESSAGE_LOGS = true
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0209 b/test/confs/0209
index 28a3d6d77..82046c7bc 100644
--- a/test/confs/0209
+++ b/test/confs/0209
@@ -1,12 +1,7 @@
 # Exim test configuration 0209
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0210 b/test/confs/0210
index 28e29cd6d..b1db52218 100644
--- a/test/confs/0210
+++ b/test/confs/0210
@@ -1,12 +1,7 @@
 # Exim test configuration 0210
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0211 b/test/confs/0211
index 6a532b6a0..96f3beac1 100644
--- a/test/confs/0211
+++ b/test/confs/0211
@@ -1,12 +1,7 @@
 # Exim test configuration 0211
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0212 b/test/confs/0212
index a4c623bd8..39db8c800 100644
--- a/test/confs/0212
+++ b/test/confs/0212
@@ -1,12 +1,7 @@
 # Exim test configuration 0212
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0213 b/test/confs/0213
index e28136352..ba0b9e403 100644
--- a/test/confs/0213
+++ b/test/confs/0213
@@ -1,12 +1,7 @@
 # Exim test configuration 0213
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0214 b/test/confs/0214
index e06affae8..0e97c0ba6 100644
--- a/test/confs/0214
+++ b/test/confs/0214
@@ -1,13 +1,8 @@
 # Exim test configuration 0214
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0215 b/test/confs/0215
index 30277dac8..ad40d6338 100644
--- a/test/confs/0215
+++ b/test/confs/0215
@@ -4,14 +4,9 @@ IGNORE_QUOTA=false
 AUTHS=
 AUTHF=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0216 b/test/confs/0216
index 777737c07..01e1dd801 100644
--- a/test/confs/0216
+++ b/test/confs/0216
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0217 b/test/confs/0217
index a446c2896..0b3abb71d 100644
--- a/test/confs/0217
+++ b/test/confs/0217
@@ -2,14 +2,9 @@
 
 HAP=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0218 b/test/confs/0218
index 4a96d825e..b5cb57691 100644
--- a/test/confs/0218
+++ b/test/confs/0218
@@ -1,13 +1,8 @@
 # Exim test configuration 0218
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0219 b/test/confs/0219
index 9ae32da17..edf8f4abf 100644
--- a/test/confs/0219
+++ b/test/confs/0219
@@ -1,13 +1,8 @@
 # Exim test configuration 0219
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0220 b/test/confs/0220
index ef71838ac..36cf87223 100644
--- a/test/confs/0220
+++ b/test/confs/0220
@@ -1,13 +1,8 @@
 # Exim test configuration 0220
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0221 b/test/confs/0221
index 8cf29a197..f7855a678 100644
--- a/test/confs/0221
+++ b/test/confs/0221
@@ -1,13 +1,8 @@
 # Exim test configuration 0221
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0222 b/test/confs/0222
index f2ed82213..e69bbb3d0 100644
--- a/test/confs/0222
+++ b/test/confs/0222
@@ -1,13 +1,8 @@
 # Exim test configuration 0222
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0223 b/test/confs/0223
index 640b98cd1..e42df517e 100644
--- a/test/confs/0223
+++ b/test/confs/0223
@@ -1,12 +1,7 @@
 # Exim test configuration 0223
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0224 b/test/confs/0224
index 10b429e49..d1c425b47 100644
--- a/test/confs/0224
+++ b/test/confs/0224
@@ -1,12 +1,7 @@
 # Exim test configuration 0224
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0225 b/test/confs/0225
index 5a2cacef7..3139eea5b 100644
--- a/test/confs/0225
+++ b/test/confs/0225
@@ -1,12 +1,7 @@
 # Exim test configuration 0225
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0226 b/test/confs/0226
index b7117f257..0b6eeff74 100644
--- a/test/confs/0226
+++ b/test/confs/0226
@@ -1,12 +1,7 @@
 # Exim test configuration 0226
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0227 b/test/confs/0227
index 8aaf7a881..ed988ac85 100644
--- a/test/confs/0227
+++ b/test/confs/0227
@@ -1,13 +1,8 @@
 # Exim test configuration 0227
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -31,6 +26,8 @@ check_recipient:
          !verify   = recipient/callout=no_cache
   deny    hosts    = V4NET.0.0.5
          !verify   = sender/callout=no_cache/check_postmaster
+  deny    hosts    = V4NET.0.0.6
+         !verify   = sender/callout=no_cache
   require verify   = sender
   accept  domains  = +local_domains
   deny    message  = relay not permitted
diff --git a/test/confs/0228 b/test/confs/0228
index 4253c38e0..19f6cb7cd 100644
--- a/test/confs/0228
+++ b/test/confs/0228
@@ -1,13 +1,8 @@
 # Exim test configuration 0228
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0229 b/test/confs/0229
index 0a299bfda..5389f97bc 100644
--- a/test/confs/0229
+++ b/test/confs/0229
@@ -1,13 +1,8 @@
 # Exim test configuration 0229
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0230 b/test/confs/0230
index c5fc9584c..c26b45758 100644
--- a/test/confs/0230
+++ b/test/confs/0230
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -37,7 +32,7 @@ check_recipient:
 
 begin routers
 
-.ifdef RT
+.ifdef OPT
 to_server:
   driver = manualroute
   transport = remote
diff --git a/test/confs/0231 b/test/confs/0231
index c8dcbd2c9..d0adf3907 100644
--- a/test/confs/0231
+++ b/test/confs/0231
@@ -1,13 +1,8 @@
 # Exim test configuration 0231
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0232 b/test/confs/0232
index 9c9f55851..59e1ae918 100644
--- a/test/confs/0232
+++ b/test/confs/0232
@@ -1,13 +1,8 @@
 # Exim test configuration 0232
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0233 b/test/confs/0233
index 0fb615de7..77dcca3b2 100644
--- a/test/confs/0233
+++ b/test/confs/0233
@@ -1,13 +1,8 @@
 # Exim test configuration 0233
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0234 b/test/confs/0234
index 65df41a31..5d34833ac 100644
--- a/test/confs/0234
+++ b/test/confs/0234
@@ -1,13 +1,8 @@
 # Exim test configuration 0234
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0235 b/test/confs/0235
index 42cd93491..704767568 100644
--- a/test/confs/0235
+++ b/test/confs/0235
@@ -1,13 +1,8 @@
 # Exim test configuration 0235
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0236 b/test/confs/0236
index 05a544f13..e44fb46cd 100644
--- a/test/confs/0236
+++ b/test/confs/0236
@@ -1,13 +1,8 @@
 # Exim test configuration 0236
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0237 b/test/confs/0237
index a70f84f4d..be2f5abd2 100644
--- a/test/confs/0237
+++ b/test/confs/0237
@@ -1,12 +1,7 @@
 # Exim test configuration 0237
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0238 b/test/confs/0238
index b66c2160a..15aa22052 100644
--- a/test/confs/0238
+++ b/test/confs/0238
@@ -1,12 +1,7 @@
 # Exim test configuration 0238
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0239 b/test/confs/0239
index 7d7194dcd..f4b1a68ba 100644
--- a/test/confs/0239
+++ b/test/confs/0239
@@ -1,12 +1,7 @@
 # Exim test configuration 0239
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0240 b/test/confs/0240
index beaf6c985..bb4519ef8 100644
--- a/test/confs/0240
+++ b/test/confs/0240
@@ -1,12 +1,7 @@
 # Exim test configuration 0240
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0241 b/test/confs/0241
index 224c94a96..e7d92078b 100644
--- a/test/confs/0241
+++ b/test/confs/0241
@@ -1,6 +1,7 @@
 # Exim test configuration 0241
 
 exim_path = EXIM_PATH/junk
+keep_environment =
 host_lookup_order = bydns
 spool_directory = DIR/spool
 log_file_path = DIR/spool/log/%slog
diff --git a/test/confs/0242 b/test/confs/0242
index 3d4e6d825..fc2dd70ba 100644
--- a/test/confs/0242
+++ b/test/confs/0242
@@ -1,13 +1,8 @@
 # Exim test configuration 0242
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0243 b/test/confs/0243
index 5f9811084..7396045ba 100644
--- a/test/confs/0243
+++ b/test/confs/0243
@@ -1,13 +1,8 @@
 # Exim test configuration 0243
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0244 b/test/confs/0244
index 6dd6b0cfe..668627e7a 100644
--- a/test/confs/0244
+++ b/test/confs/0244
@@ -1,13 +1,8 @@
 # Exim test configuration 0244
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0245 b/test/confs/0245
index d2050c7a3..13cb7038e 100644
--- a/test/confs/0245
+++ b/test/confs/0245
@@ -1,13 +1,8 @@
 # Exim test configuration 0245
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0246 b/test/confs/0246
index 9aad3e1a6..fb959527d 100644
--- a/test/confs/0246
+++ b/test/confs/0246
@@ -1,13 +1,8 @@
 # Exim test configuration 0246
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0247 b/test/confs/0247
index bab6c9220..38e171019 100644
--- a/test/confs/0247
+++ b/test/confs/0247
@@ -1,13 +1,8 @@
 # Exim test configuration 0247
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0248 b/test/confs/0248
index c91d4602d..517a2f665 100644
--- a/test/confs/0248
+++ b/test/confs/0248
@@ -1,13 +1,8 @@
 # Exim test configuration 0248
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0249 b/test/confs/0249
index c9425d8d6..1d7491be6 100644
--- a/test/confs/0249
+++ b/test/confs/0249
@@ -1,13 +1,8 @@
 # Exim test configuration 0249
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0250 b/test/confs/0250
index da0fb2e5d..80030ecd5 100644
--- a/test/confs/0250
+++ b/test/confs/0250
@@ -1,13 +1,8 @@
 # Exim test configuration 0250
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0251 b/test/confs/0251
index a6945ccca..180620f11 100644
--- a/test/confs/0251
+++ b/test/confs/0251
@@ -2,14 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0252 b/test/confs/0252
index c5d6fb6aa..28ce3419f 100644
--- a/test/confs/0252
+++ b/test/confs/0252
@@ -1,13 +1,8 @@
 # Exim test configuration 0252
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0253 b/test/confs/0253
index 00a4b60d8..cd2c777de 100644
--- a/test/confs/0253
+++ b/test/confs/0253
@@ -1,13 +1,8 @@
 # Exim test configuration 0253
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0254 b/test/confs/0254
index f072c649e..45f5784bc 100644
--- a/test/confs/0254
+++ b/test/confs/0254
@@ -1,13 +1,8 @@
 # Exim test configuration 0254
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0255 b/test/confs/0255
index 341f704d4..e01c41baf 100644
--- a/test/confs/0255
+++ b/test/confs/0255
@@ -2,14 +2,9 @@
 
 OPTION=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0256 b/test/confs/0256
index 2e02fef4b..c5d5d4b4e 100644
--- a/test/confs/0256
+++ b/test/confs/0256
@@ -1,13 +1,8 @@
 # Exim test configuration 0256
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0257 b/test/confs/0257
index f2403a368..f61689380 100644
--- a/test/confs/0257
+++ b/test/confs/0257
@@ -1,13 +1,8 @@
 # Exim test configuration 0257
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0258 b/test/confs/0258
index de433734b..720cc4073 100644
--- a/test/confs/0258
+++ b/test/confs/0258
@@ -1,13 +1,8 @@
 # Exim test configuration 0258
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0259 b/test/confs/0259
index e5a42dd4a..6b9bc29ab 100644
--- a/test/confs/0259
+++ b/test/confs/0259
@@ -1,14 +1,9 @@
 # Exim test configuration 0259
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 rfc1413_query_timeout = 5s
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0260 b/test/confs/0260
index 442ab2880..6366cd0ad 100644
--- a/test/confs/0260
+++ b/test/confs/0260
@@ -1,13 +1,8 @@
 # Exim test configuration 0260
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0261 b/test/confs/0261
index e39db4670..30ec087fd 100644
--- a/test/confs/0261
+++ b/test/confs/0261
@@ -1,13 +1,8 @@
 # Exim test configuration 0261
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0262 b/test/confs/0262
index 92e65f428..dc6a1d4af 100644
--- a/test/confs/0262
+++ b/test/confs/0262
@@ -1,13 +1,8 @@
 # Exim test configuration 0262
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0263 b/test/confs/0263
index ac5599967..53b0064e7 100644
--- a/test/confs/0263
+++ b/test/confs/0263
@@ -1,13 +1,8 @@
 # Exim test configuration 0263
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0264 b/test/confs/0264
index 3d9505e88..792b304dd 100644
--- a/test/confs/0264
+++ b/test/confs/0264
@@ -1,13 +1,8 @@
 # Exim test configuration 0264
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0265 b/test/confs/0265
index 586805b78..b26583a41 100644
--- a/test/confs/0265
+++ b/test/confs/0265
@@ -1,13 +1,8 @@
 # Exim test configuration 0265
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0266 b/test/confs/0266
index 9fe2dfe26..d1e944dc2 100644
--- a/test/confs/0266
+++ b/test/confs/0266
@@ -1,13 +1,8 @@
 # Exim test configuration 0266
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0267 b/test/confs/0267
index 1e335bee3..bb134441b 100644
--- a/test/confs/0267
+++ b/test/confs/0267
@@ -1,13 +1,8 @@
 # Exim test configuration 0267
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0268 b/test/confs/0268
index 858397a25..e1e0be848 100644
--- a/test/confs/0268
+++ b/test/confs/0268
@@ -1,13 +1,8 @@
 # Exim test configuration 0268
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0269 b/test/confs/0269
index ce735dbe5..8aca95bd1 100644
--- a/test/confs/0269
+++ b/test/confs/0269
@@ -1,13 +1,8 @@
 # Exim test configuration 0269
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0270 b/test/confs/0270
index 117579e84..86f81d837 100644
--- a/test/confs/0270
+++ b/test/confs/0270
@@ -1,13 +1,8 @@
 # Exim test configuration 0270
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0271 b/test/confs/0271
index 47aa77b8d..93c27241d 100644
--- a/test/confs/0271
+++ b/test/confs/0271
@@ -1,13 +1,8 @@
 # Exim test configuration 0271
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0272 b/test/confs/0272
index 42ae1a614..f3788f15c 100644
--- a/test/confs/0272
+++ b/test/confs/0272
@@ -1,13 +1,8 @@
 # Exim test configuration 0272
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0273 b/test/confs/0273
index b60b66271..0a12a6762 100644
--- a/test/confs/0273
+++ b/test/confs/0273
@@ -1,13 +1,8 @@
 # Exim test configuration 0273
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0274 b/test/confs/0274
index cd76881c4..2eb7bb60b 100644
--- a/test/confs/0274
+++ b/test/confs/0274
@@ -1,13 +1,8 @@
 # Exim test configuration 0274
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0275 b/test/confs/0275
index 2e62a907c..3734e03ea 100644
--- a/test/confs/0275
+++ b/test/confs/0275
@@ -1,13 +1,8 @@
 # Exim test configuration 0275
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0276 b/test/confs/0276
index db4afafdc..257cf4593 100644
--- a/test/confs/0276
+++ b/test/confs/0276
@@ -1,13 +1,8 @@
 # Exim test configuration 0276
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0277 b/test/confs/0277
index eeb79e6c7..8e1bdc375 100644
--- a/test/confs/0277
+++ b/test/confs/0277
@@ -1,13 +1,8 @@
 # Exim test configuration 0277
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0278 b/test/confs/0278
index 255ecef34..a7adb29ec 100644
--- a/test/confs/0278
+++ b/test/confs/0278
@@ -1,13 +1,8 @@
 # Exim test configuration 0278
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0279 b/test/confs/0279
index d8ec85dc2..f4334f479 100644
--- a/test/confs/0279
+++ b/test/confs/0279
@@ -1,13 +1,8 @@
 # Exim test configuration 0279
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0280 b/test/confs/0280
index 3552582b0..40187df77 100644
--- a/test/confs/0280
+++ b/test/confs/0280
@@ -1,13 +1,8 @@
 # Exim test configuration 0280
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0281 b/test/confs/0281
index 19e2e5527..277328ed4 100644
--- a/test/confs/0281
+++ b/test/confs/0281
@@ -1,13 +1,8 @@
 # Exim test configuration 0281
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0282 b/test/confs/0282
index a77ac9ab5..2660c7f7d 100644
--- a/test/confs/0282
+++ b/test/confs/0282
@@ -1,13 +1,8 @@
 # Exim test configuration 0282
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0283 b/test/confs/0283
index 93107d6db..31d9339a2 100644
--- a/test/confs/0283
+++ b/test/confs/0283
@@ -1,13 +1,8 @@
 # Exim test configuration 0283
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0284 b/test/confs/0284
index 5ba209af5..d38f38390 100644
--- a/test/confs/0284
+++ b/test/confs/0284
@@ -1,13 +1,8 @@
 # Exim test configuration 0284
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0285 b/test/confs/0285
index 65095f0c0..f0871a565 100644
--- a/test/confs/0285
+++ b/test/confs/0285
@@ -1,13 +1,8 @@
 # Exim test configuration 0285
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0286 b/test/confs/0286
index b720a80c2..8ec70bfbb 100644
--- a/test/confs/0286
+++ b/test/confs/0286
@@ -1,13 +1,8 @@
 # Exim test configuration 0286
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0287 b/test/confs/0287
index 08a87a3f4..d3f08a205 100644
--- a/test/confs/0287
+++ b/test/confs/0287
@@ -1,13 +1,8 @@
 # Exim test configuration 0287
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0288 b/test/confs/0288
index 0e9136bf3..12c308baf 100644
--- a/test/confs/0288
+++ b/test/confs/0288
@@ -1,14 +1,9 @@
 # Exim test configuration 0288
 # serialize_hosts option on smtp transport
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0289 b/test/confs/0289
index 66734518a..8cd201862 100644
--- a/test/confs/0289
+++ b/test/confs/0289
@@ -1,14 +1,9 @@
 # Exim test configuration 0289
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0290 b/test/confs/0290
index 57e328216..5ccb8451f 100644
--- a/test/confs/0290
+++ b/test/confs/0290
@@ -3,27 +3,22 @@
 FOOBAR=
 FOO=inc1
 BAR=.include "DIR/aux-fixed/TESTNUM.inc2"
-RT = receive_timeout = 1s
+OPT = receive_timeout = 1s
 INC=
 
 C1=#
 C2=#
 C1C2 this should be a comment
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
 FOOBAR  .include DIR/aux-fixed/TESTNUM.FOO
-RT
+OPT
 INC
 
 remote_sort_domains = a:b:c
diff --git a/test/confs/0291 b/test/confs/0291
index 8eb6af279..406c54faa 100644
--- a/test/confs/0291
+++ b/test/confs/0291
@@ -1,14 +1,9 @@
 # Exim test configuration 0291
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0292 b/test/confs/0292
index a388ebd3a..6e70a7925 100644
--- a/test/confs/0292
+++ b/test/confs/0292
@@ -1,14 +1,9 @@
 # Exim test configuration 0292
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0293 b/test/confs/0293
index 84f79b88a..0512860f4 100644
--- a/test/confs/0293
+++ b/test/confs/0293
@@ -1,14 +1,9 @@
 # Exim test configuration 0293
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0294 b/test/confs/0294
index 6b8a6112e..6e17b832d 100644
--- a/test/confs/0294
+++ b/test/confs/0294
@@ -1,14 +1,9 @@
 # Exim test configuration 0294
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0295 b/test/confs/0295
index ea16f79d7..997b83c6b 100644
--- a/test/confs/0295
+++ b/test/confs/0295
@@ -1,14 +1,9 @@
 # Exim test configuration 0295
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0296 b/test/confs/0296
index fe7531502..e62a3d1a1 100644
--- a/test/confs/0296
+++ b/test/confs/0296
@@ -1,13 +1,8 @@
 # Exim test configuration 0296
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0297 b/test/confs/0297
index 8e692b690..b07fc54cb 100644
--- a/test/confs/0297
+++ b/test/confs/0297
@@ -1,13 +1,8 @@
 # Exim test configuration 0297
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0298 b/test/confs/0298
index 47228e6af..3ca06f87f 100644
--- a/test/confs/0298
+++ b/test/confs/0298
@@ -1,13 +1,8 @@
 # Exim test configuration 0298
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0299 b/test/confs/0299
index 619132bc7..5d648b85d 100644
--- a/test/confs/0299
+++ b/test/confs/0299
@@ -1,13 +1,8 @@
 # Exim test configuration 0299
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0300 b/test/confs/0300
index cf47c2b79..814f8ee0f 100644
--- a/test/confs/0300
+++ b/test/confs/0300
@@ -3,14 +3,9 @@
 DELAY=0s
 PAH=127.0.0.1
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0301 b/test/confs/0301
index 493f5a0dd..2ce525c01 100644
--- a/test/confs/0301
+++ b/test/confs/0301
@@ -1,13 +1,8 @@
 # Exim test configuration 0301
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0302 b/test/confs/0302
index 41c7af7fe..81aadbba1 100644
--- a/test/confs/0302
+++ b/test/confs/0302
@@ -1,13 +1,8 @@
 # Exim test configuration 0302
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0303 b/test/confs/0303
index 7670b60b6..b96063e96 100644
--- a/test/confs/0303
+++ b/test/confs/0303
@@ -1,13 +1,8 @@
 # Exim test configuration 0303
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0304 b/test/confs/0304
index 7f1e658bd..6c899aaec 100644
--- a/test/confs/0304
+++ b/test/confs/0304
@@ -1,13 +1,8 @@
 # Exim test configuration 0304
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0305 b/test/confs/0305
index ceb51a82a..33e97ef6a 100644
--- a/test/confs/0305
+++ b/test/confs/0305
@@ -1,13 +1,8 @@
 # Exim test configuration 0305
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0306 b/test/confs/0306
index 2526d9df1..6d6d9658a 100644
--- a/test/confs/0306
+++ b/test/confs/0306
@@ -1,13 +1,8 @@
 # Exim test configuration 0306
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0307 b/test/confs/0307
index 5e664452b..3252b4615 100644
--- a/test/confs/0307
+++ b/test/confs/0307
@@ -1,13 +1,8 @@
 # Exim test configuration 0307
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0308 b/test/confs/0308
index cf90b6e23..dd2f6dd50 100644
--- a/test/confs/0308
+++ b/test/confs/0308
@@ -1,13 +1,8 @@
 # Exim test configuration 0308
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0309 b/test/confs/0309
index 2f7ccf0c3..4d6449009 100644
--- a/test/confs/0309
+++ b/test/confs/0309
@@ -1,13 +1,8 @@
 # Exim test configuration 0309
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0310 b/test/confs/0310
index 45eab9213..0f324da1d 100644
--- a/test/confs/0310
+++ b/test/confs/0310
@@ -1,13 +1,8 @@
 # Exim test configuration 0310
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0311 b/test/confs/0311
index 5f7a791dd..99082cb7f 100644
--- a/test/confs/0311
+++ b/test/confs/0311
@@ -1,13 +1,8 @@
 # Exim test configuration 0311
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0312 b/test/confs/0312
index 78a56c03e..dad5d083c 100644
--- a/test/confs/0312
+++ b/test/confs/0312
@@ -1,13 +1,8 @@
 # Exim test configuration 0312
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0313 b/test/confs/0313
index 64e061215..7849526db 100644
--- a/test/confs/0313
+++ b/test/confs/0313
@@ -1,12 +1,7 @@
 # Exim test configuration 0313
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0314 b/test/confs/0314
index d9a066075..9dd0295a5 100644
--- a/test/confs/0314
+++ b/test/confs/0314
@@ -1,15 +1,13 @@
 # Exim test configuration 0314
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+LOG_SELECTOR=
+
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
-host_reject_connection = V4NET.0.0.1
+log_selector = LOG_SELECTOR
+host_reject_connection = 127.0.0.1
 
 # End
diff --git a/test/confs/0315 b/test/confs/0315
index afa292ddc..fed3ceca1 100644
--- a/test/confs/0315
+++ b/test/confs/0315
@@ -1,12 +1,7 @@
 # Exim test configuration 0315
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0316 b/test/confs/0316
index 1a6238b8c..22fea04ca 100644
--- a/test/confs/0316
+++ b/test/confs/0316
@@ -1,12 +1,7 @@
 # Exim test configuration 0316
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0317 b/test/confs/0317
index 2c3e66198..754231606 100644
--- a/test/confs/0317
+++ b/test/confs/0317
@@ -1,12 +1,7 @@
 # Exim test configuration 0317
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0318 b/test/confs/0318
index e57fe8eee..51633d997 100644
--- a/test/confs/0318
+++ b/test/confs/0318
@@ -1,12 +1,7 @@
 # Exim test configuration 0318
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0319 b/test/confs/0319
index 8a279a521..aaa21d730 100644
--- a/test/confs/0319
+++ b/test/confs/0319
@@ -1,12 +1,7 @@
 # Exim test configuration 0319
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0320 b/test/confs/0320
index e9191ee35..6f287a89c 100644
--- a/test/confs/0320
+++ b/test/confs/0320
@@ -1,12 +1,7 @@
 # Exim test configuration 0320
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0321 b/test/confs/0321
index 6ea0bcfe9..624202e65 100644
--- a/test/confs/0321
+++ b/test/confs/0321
@@ -1,12 +1,7 @@
 # Exim test configuration 0321
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0322 b/test/confs/0322
index 2901010ad..396b0c653 100644
--- a/test/confs/0322
+++ b/test/confs/0322
@@ -1,20 +1,11 @@
 # Exim test configuration 0322
 
-LS=
+.include DIR/aux-var/std_conf_prefix
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
-log_selector = LS
-
 # ----- Routers -----
 
 begin routers
diff --git a/test/confs/0323 b/test/confs/0323
index 253f8372c..554ccbaf8 100644
--- a/test/confs/0323
+++ b/test/confs/0323
@@ -1,13 +1,8 @@
 # Exim test configuration 0323
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0324 b/test/confs/0324
index e1353ccc1..129e5df4c 100644
--- a/test/confs/0324
+++ b/test/confs/0324
@@ -1,13 +1,8 @@
 # Exim test configuration 0324
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0325 b/test/confs/0325
index 4d145d851..e81e63b42 100644
--- a/test/confs/0325
+++ b/test/confs/0325
@@ -1,13 +1,8 @@
 # Exim test configuration 0325
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0326 b/test/confs/0326
index 5081f88a2..8f44d3c34 100644
--- a/test/confs/0326
+++ b/test/confs/0326
@@ -1,13 +1,8 @@
 # Exim test configuration 0326
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0327 b/test/confs/0327
index 28922ed73..481aaa7ae 100644
--- a/test/confs/0327
+++ b/test/confs/0327
@@ -1,13 +1,8 @@
 # Exim test configuration 0327
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0328 b/test/confs/0328
index 48d29a4a3..76f898552 100644
--- a/test/confs/0328
+++ b/test/confs/0328
@@ -1,13 +1,8 @@
 # Exim test configuration 0328
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0329 b/test/confs/0329
index 1d853fa91..f9d5bcbb5 100644
--- a/test/confs/0329
+++ b/test/confs/0329
@@ -1,13 +1,8 @@
 # Exim test configuration 0329
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0330 b/test/confs/0330
index 9d53d7a79..78701a9c5 100644
--- a/test/confs/0330
+++ b/test/confs/0330
@@ -1,12 +1,7 @@
 # Exim test configuration 0330
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0331 b/test/confs/0331
index 934030529..48ddf9037 100644
--- a/test/confs/0331
+++ b/test/confs/0331
@@ -1,12 +1,7 @@
 # Exim test configuration 0331
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0332 b/test/confs/0332
index bf16c2ea7..4fe3b3fd4 100644
--- a/test/confs/0332
+++ b/test/confs/0332
@@ -1,13 +1,8 @@
 # Exim test configuration 0332
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0333 b/test/confs/0333
index 388987333..419229285 100644
--- a/test/confs/0333
+++ b/test/confs/0333
@@ -1,13 +1,8 @@
 # Exim test configuration 0333
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0334 b/test/confs/0334
index a04081e52..553763b0a 100644
--- a/test/confs/0334
+++ b/test/confs/0334
@@ -1,13 +1,8 @@
 # Exim test configuration 0334
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0335 b/test/confs/0335
index e78f4ebe1..6529028d5 100644
--- a/test/confs/0335
+++ b/test/confs/0335
@@ -1,13 +1,8 @@
 # Exim test configuration 0335
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0336 b/test/confs/0336
index d85ab8489..8ec447591 100644
--- a/test/confs/0336
+++ b/test/confs/0336
@@ -1,13 +1,8 @@
 # Exim test configuration 0336
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0337 b/test/confs/0337
index 026d4f724..7dedf5fe1 100644
--- a/test/confs/0337
+++ b/test/confs/0337
@@ -1,13 +1,8 @@
 # Exim test configuration 0337
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0338 b/test/confs/0338
index 1ea147be3..d373f477c 100644
--- a/test/confs/0338
+++ b/test/confs/0338
@@ -1,13 +1,8 @@
 # Exim test configuration 0338
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0339 b/test/confs/0339
index 8048352fd..843dd0222 100644
--- a/test/confs/0339
+++ b/test/confs/0339
@@ -1,13 +1,8 @@
 # Exim test configuration 0339
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0340 b/test/confs/0340
index a824813ac..a4b49d8ad 100644
--- a/test/confs/0340
+++ b/test/confs/0340
@@ -1,13 +1,8 @@
 # Exim test configuration 0340
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0341 b/test/confs/0341
index f873809e2..726793390 100644
--- a/test/confs/0341
+++ b/test/confs/0341
@@ -2,14 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0342 b/test/confs/0342
index b0053226a..dba9020f4 100644
--- a/test/confs/0342
+++ b/test/confs/0342
@@ -1,13 +1,8 @@
 # Exim test configuration 0342
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0343 b/test/confs/0343
index 2dc7d6e49..c613da449 100644
--- a/test/confs/0343
+++ b/test/confs/0343
@@ -1,13 +1,8 @@
 # Exim test configuration 0343
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0344 b/test/confs/0344
index 591294deb..0b29b0629 100644
--- a/test/confs/0344
+++ b/test/confs/0344
@@ -1,13 +1,8 @@
 # Exim test configuration 0344
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0345 b/test/confs/0345
index d57ba1100..99bdce0b4 100644
--- a/test/confs/0345
+++ b/test/confs/0345
@@ -1,12 +1,7 @@
 # Exim test configuration 0345
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0346 b/test/confs/0346
index 9d648dcde..1c4b51c50 100644
--- a/test/confs/0346
+++ b/test/confs/0346
@@ -1,12 +1,7 @@
 # Exim test configuration 0346
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0347 b/test/confs/0347
index 506524279..993b3fd1f 100644
--- a/test/confs/0347
+++ b/test/confs/0347
@@ -1,12 +1,7 @@
 # Exim test configuration 0347
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0348 b/test/confs/0348
index 651a94fe4..60f8d208b 100644
--- a/test/confs/0348
+++ b/test/confs/0348
@@ -2,13 +2,8 @@
 
 RETRY=G,1,20m,1.5
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0349 b/test/confs/0349
index ff3bd857e..f11957d2e 100644
--- a/test/confs/0349
+++ b/test/confs/0349
@@ -1,12 +1,7 @@
 # Exim test configuration 0349
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0350 b/test/confs/0350
index a3d606946..09bd635db 100644
--- a/test/confs/0350
+++ b/test/confs/0350
@@ -1,13 +1,8 @@
 # Exim test configuration 0350
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0351 b/test/confs/0351
index 0c306f5c0..b00ee7497 100644
--- a/test/confs/0351
+++ b/test/confs/0351
@@ -1,12 +1,7 @@
 # Exim test configuration 0351
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0352 b/test/confs/0352
index e3e9555f3..aaa980941 100644
--- a/test/confs/0352
+++ b/test/confs/0352
@@ -1,12 +1,7 @@
 # Exim test configuration 0352
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0353 b/test/confs/0353
index 566cb284c..fb53d6d69 100644
--- a/test/confs/0353
+++ b/test/confs/0353
@@ -1,12 +1,7 @@
 # Exim test configuration 0353
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0354 b/test/confs/0354
index b1b92692d..03ea43f83 100644
--- a/test/confs/0354
+++ b/test/confs/0354
@@ -1,12 +1,7 @@
 # Exim test configuration 0354
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0355 b/test/confs/0355
index 7523892a9..78b1484c7 100644
--- a/test/confs/0355
+++ b/test/confs/0355
@@ -1,12 +1,7 @@
 # Exim test configuration 0355
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0356 b/test/confs/0356
index 12dc13ab8..c6e9e94a1 100644
--- a/test/confs/0356
+++ b/test/confs/0356
@@ -2,13 +2,8 @@
 
 MESSAGE_LOGS =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0357 b/test/confs/0357
index 45ca7d320..07f3fc857 100644
--- a/test/confs/0357
+++ b/test/confs/0357
@@ -1,12 +1,7 @@
 # Exim test configuration 0357
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0358 b/test/confs/0358
index d6665da51..24611d0fb 100644
--- a/test/confs/0358
+++ b/test/confs/0358
@@ -1,12 +1,7 @@
 # Exim test configuration 0358
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0359 b/test/confs/0359
index 1975cf378..6b6b8c093 100644
--- a/test/confs/0359
+++ b/test/confs/0359
@@ -1,12 +1,7 @@
 # Exim test configuration 0359
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0360 b/test/confs/0360
index b24010459..d226449a8 100644
--- a/test/confs/0360
+++ b/test/confs/0360
@@ -1,12 +1,7 @@
 # Exim test configuration 0360
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0361 b/test/confs/0361
index 275ae21a4..f9007ec0c 100644
--- a/test/confs/0361
+++ b/test/confs/0361
@@ -1,12 +1,7 @@
 # Exim test configuration 0361
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0362 b/test/confs/0362
index 15ea70fbe..6588f609f 100644
--- a/test/confs/0362
+++ b/test/confs/0362
@@ -1,12 +1,7 @@
 # Exim test configuration 0362
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0363 b/test/confs/0363
index bddeb243e..c43040876 100644
--- a/test/confs/0363
+++ b/test/confs/0363
@@ -1,12 +1,7 @@
 # Exim test configuration 0363
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0364 b/test/confs/0364
index 706618d1b..e15bc9127 100644
--- a/test/confs/0364
+++ b/test/confs/0364
@@ -1,12 +1,7 @@
 # Exim test configuration 0364
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0365 b/test/confs/0365
index dbe113d28..0bd6cc161 100644
--- a/test/confs/0365
+++ b/test/confs/0365
@@ -3,13 +3,8 @@
 DETAILS=false
 SELECTOR=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0366 b/test/confs/0366
index ec639aee7..de5d9cfc8 100644
--- a/test/confs/0366
+++ b/test/confs/0366
@@ -2,13 +2,8 @@
 
 HOSTS_MAX_TRY=5
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0367 b/test/confs/0367
index bf743c883..2d69a07ab 100644
--- a/test/confs/0367
+++ b/test/confs/0367
@@ -1,12 +1,7 @@
 # Exim test configuration 0367
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0368 b/test/confs/0368
index 08fffb406..fee202781 100644
--- a/test/confs/0368
+++ b/test/confs/0368
@@ -1,13 +1,8 @@
 # Exim test configuration 0368
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0369 b/test/confs/0369
index 7829414f1..511c541f6 100644
--- a/test/confs/0369
+++ b/test/confs/0369
@@ -1,13 +1,8 @@
 # Exim test configuration 0369
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0370 b/test/confs/0370
index 63aad00be..315a56872 100644
--- a/test/confs/0370
+++ b/test/confs/0370
@@ -1,13 +1,8 @@
 # Exim test configuration 0370
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0371 b/test/confs/0371
index 680377fcd..eb4d07fb8 100644
--- a/test/confs/0371
+++ b/test/confs/0371
@@ -1,12 +1,7 @@
 # Exim test configuration 0371
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0372 b/test/confs/0372
index 6e457e7f5..983d596a1 100644
--- a/test/confs/0372
+++ b/test/confs/0372
@@ -2,14 +2,9 @@
 
 STRICT=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0373 b/test/confs/0373
index 9f672ced0..10d64b782 100644
--- a/test/confs/0373
+++ b/test/confs/0373
@@ -1,13 +1,8 @@
 # Exim test configuration 0373
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0374 b/test/confs/0374
index 87b3e182d..652a5062b 100644
--- a/test/confs/0374
+++ b/test/confs/0374
@@ -1,13 +1,8 @@
 # Exim test configuration 0374
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0375 b/test/confs/0375
index 229230209..06b16f383 100644
--- a/test/confs/0375
+++ b/test/confs/0375
@@ -1,13 +1,8 @@
 # Exim test configuration 0375
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0376 b/test/confs/0376
index de6feb6d1..6162c2c9d 100644
--- a/test/confs/0376
+++ b/test/confs/0376
@@ -2,14 +2,9 @@
 
 PEX=10s
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0377 b/test/confs/0377
index 362ec37f1..bd3391b3a 100644
--- a/test/confs/0377
+++ b/test/confs/0377
@@ -1,13 +1,8 @@
 # Exim test configuration 0377
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0378 b/test/confs/0378
index 8046c87f8..3e4d85a81 100644
--- a/test/confs/0378
+++ b/test/confs/0378
@@ -1,13 +1,8 @@
 # Exim test configuration 0378
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0379 b/test/confs/0379
index 6dae00b93..2f1216b1f 100644
--- a/test/confs/0379
+++ b/test/confs/0379
@@ -1,13 +1,8 @@
 # Exim test configuration 0379
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0380 b/test/confs/0380
index 4b478d3d4..90d1f933b 100644
--- a/test/confs/0380
+++ b/test/confs/0380
@@ -1,13 +1,8 @@
 # Exim test configuration 0380
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0381 b/test/confs/0381
index 02a84a85c..0a9d8dc20 100644
--- a/test/confs/0381
+++ b/test/confs/0381
@@ -1,13 +1,8 @@
 # Exim test configuration 0381
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0382 b/test/confs/0382
index 3dae69dd4..d27b8e3f7 100644
--- a/test/confs/0382
+++ b/test/confs/0382
@@ -1,13 +1,8 @@
 # Exim test configuration 0382
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0383 b/test/confs/0383
index 51d8f8f37..ea2f1dc28 100644
--- a/test/confs/0383
+++ b/test/confs/0383
@@ -1,13 +1,8 @@
 # Exim test configuration 0383
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0384 b/test/confs/0384
index 0287358c0..80450a7e8 100644
--- a/test/confs/0384
+++ b/test/confs/0384
@@ -1,13 +1,8 @@
 # Exim test configuration 0384
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0385 b/test/confs/0385
index 39689c556..f66e6b818 100644
--- a/test/confs/0385
+++ b/test/confs/0385
@@ -1,13 +1,8 @@
 # Exim test configuration 0385
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0386 b/test/confs/0386
index b466066a3..5eecfcc98 100644
--- a/test/confs/0386
+++ b/test/confs/0386
@@ -1,13 +1,8 @@
 # Exim test configuration 0386
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0387 b/test/confs/0387
index 4193a139f..b8ed35ccc 100644
--- a/test/confs/0387
+++ b/test/confs/0387
@@ -1,13 +1,8 @@
 # Exim test configuration 0387
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0388 b/test/confs/0388
index 38166b449..9a7be305d 100644
--- a/test/confs/0388
+++ b/test/confs/0388
@@ -1,13 +1,8 @@
 # Exim test configuration 0388
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0389 b/test/confs/0389
index fabc15179..f2439bf58 100644
--- a/test/confs/0389
+++ b/test/confs/0389
@@ -1,13 +1,8 @@
 # Exim test configuration 0389
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0390 b/test/confs/0390
index 5b88cd7b2..972e925d9 100644
--- a/test/confs/0390
+++ b/test/confs/0390
@@ -1,13 +1,8 @@
 # Exim test configuration 0390
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0391 b/test/confs/0391
index a2ee5ef9d..4ab5cfddd 100644
--- a/test/confs/0391
+++ b/test/confs/0391
@@ -1,13 +1,8 @@
 # Exim test configuration 0391
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0392 b/test/confs/0392
index ae809d52f..e76c86772 100644
--- a/test/confs/0392
+++ b/test/confs/0392
@@ -1,13 +1,8 @@
 # Exim test configuration 0392
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0393 b/test/confs/0393
index d83857170..c029d0d71 100644
--- a/test/confs/0393
+++ b/test/confs/0393
@@ -2,13 +2,8 @@
 
 FILTER=/bin/cat
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0394 b/test/confs/0394
index 7e6511964..c1a556357 100644
--- a/test/confs/0394
+++ b/test/confs/0394
@@ -2,13 +2,8 @@
 
 OPT=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0395 b/test/confs/0395
index 4e00be813..b7fc3fd58 100644
--- a/test/confs/0395
+++ b/test/confs/0395
@@ -2,13 +2,8 @@
 
 TRUSTED=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0396 b/test/confs/0396
index 2dac89ab9..ef2ad8a55 100644
--- a/test/confs/0396
+++ b/test/confs/0396
@@ -1,12 +1,7 @@
 # Exim test configuration 0396
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0397 b/test/confs/0397
index 50403df7a..0fe3e8ee2 100644
--- a/test/confs/0397
+++ b/test/confs/0397
@@ -1,6 +1,7 @@
 # Exim test configuration 0397
 
 exim_path = EXIM_PATH
+keep_environment =
 host_lookup_order = bydns
 spool_directory = DIR/spool
 gecos_pattern = ""
diff --git a/test/confs/0398 b/test/confs/0398
index 0bed7ddbb..9fbe1b8da 100644
--- a/test/confs/0398
+++ b/test/confs/0398
@@ -1,12 +1,7 @@
 # Exim test configuration 0398
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0399 b/test/confs/0399
index 38da70b6c..5584e509c 100644
--- a/test/confs/0399
+++ b/test/confs/0399
@@ -1,12 +1,7 @@
 # Exim test configuration 0399
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0400 b/test/confs/0400
index 2c44a2b74..1a8a8e43b 100644
--- a/test/confs/0400
+++ b/test/confs/0400
@@ -2,13 +2,8 @@
 
 DATA=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0401 b/test/confs/0401
index bd9a15c82..b8c105983 100644
--- a/test/confs/0401
+++ b/test/confs/0401
@@ -1,12 +1,7 @@
 # Exim test configuration 0401
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0402 b/test/confs/0402
index 9e9ccf956..57e027c03 100644
--- a/test/confs/0402
+++ b/test/confs/0402
@@ -1,12 +1,7 @@
 # Exim test configuration 0402
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0403 b/test/confs/0403
index bdc84841a..26d1cd6fe 100644
--- a/test/confs/0403
+++ b/test/confs/0403
@@ -1,12 +1,7 @@
 # Exim test configuration 0403
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0404 b/test/confs/0404
index e9b23f0f0..9d0dc5c90 100644
--- a/test/confs/0404
+++ b/test/confs/0404
@@ -1,12 +1,7 @@
 # Exim test configuration 0404
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0405 b/test/confs/0405
index d1f77cd82..edf720c48 100644
--- a/test/confs/0405
+++ b/test/confs/0405
@@ -2,13 +2,8 @@
 
 UTF8=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0406 b/test/confs/0406
index 37b6bab07..1c1ec205f 100644
--- a/test/confs/0406
+++ b/test/confs/0406
@@ -1,12 +1,7 @@
 # Exim test configuration 0406
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0407 b/test/confs/0407
index 364786199..616b80a13 100644
--- a/test/confs/0407
+++ b/test/confs/0407
@@ -3,13 +3,8 @@
 HEADER_MAXSIZE=
 HEADER_LINE_MAXSIZE=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0408 b/test/confs/0408
index 6df40fa9e..903b4ca7c 100644
--- a/test/confs/0408
+++ b/test/confs/0408
@@ -1,12 +1,7 @@
 # Exim test configuration 0408
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0409 b/test/confs/0409
index c077da26b..3cc072b20 100644
--- a/test/confs/0409
+++ b/test/confs/0409
@@ -2,13 +2,8 @@
 
 BANNER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0410 b/test/confs/0410
index 8fb017178..904073d3b 100644
--- a/test/confs/0410
+++ b/test/confs/0410
@@ -1,12 +1,7 @@
 # Exim test configuration 0410
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0411 b/test/confs/0411
index c2c238507..fa24e9fd0 100644
--- a/test/confs/0411
+++ b/test/confs/0411
@@ -1,12 +1,7 @@
 # Exim test configuration 0411
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0412 b/test/confs/0412
index 9a38058d7..f8b9c69ff 100644
--- a/test/confs/0412
+++ b/test/confs/0412
@@ -1,12 +1,7 @@
 # Exim test configuration 0412
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0413 b/test/confs/0413
index e0d4fa329..118dbcfe9 100644
--- a/test/confs/0413
+++ b/test/confs/0413
@@ -1,12 +1,7 @@
 # Exim test configuration 0413
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0414 b/test/confs/0414
index 9d269d959..c0fbeffdb 100644
--- a/test/confs/0414
+++ b/test/confs/0414
@@ -1,12 +1,7 @@
 # Exim test configuration 0414
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0415 b/test/confs/0415
index aceaacc46..06459597f 100644
--- a/test/confs/0415
+++ b/test/confs/0415
@@ -4,13 +4,8 @@ ARG1=40M
 ARG2=1.0
 VALUE=0
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0416 b/test/confs/0416
index 2290da4b3..752ba0495 100644
--- a/test/confs/0416
+++ b/test/confs/0416
@@ -1,12 +1,7 @@
 # Exim test configuration 0416
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0417 b/test/confs/0417
index f759e63d6..41c5ed975 100644
--- a/test/confs/0417
+++ b/test/confs/0417
@@ -2,13 +2,8 @@
 
 RETURN_ERROR_DETAILS = false
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0418 b/test/confs/0418
index b44214388..3ab5740c0 100644
--- a/test/confs/0418
+++ b/test/confs/0418
@@ -1,12 +1,7 @@
 # Exim test configuration 0418
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0419 b/test/confs/0419
index 9fcf361db..39f634c63 100644
--- a/test/confs/0419
+++ b/test/confs/0419
@@ -1,12 +1,7 @@
 # Exim test configuration 0419
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0420 b/test/confs/0420
index 38cf50c22..a115c7249 100644
--- a/test/confs/0420
+++ b/test/confs/0420
@@ -1,19 +1,16 @@
 # Exim test configuration 0420
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
 primary_hostname = mail.test.ex
 qualify_domain = test.ex
 
+queue_only
 acl_smtp_rcpt = accept
+acl_smtp_data =	accept logwrite = h: <$h_Received:>
 
 received_header_text = ${if eq{$sender_address}{x@y}{}{Received: some text}}
 
diff --git a/test/confs/0421 b/test/confs/0421
index a65df5fdd..6d12ce20b 100644
--- a/test/confs/0421
+++ b/test/confs/0421
@@ -1,12 +1,7 @@
 # Exim test configuration 0421
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0422 b/test/confs/0422
index 5ad06071e..14255d621 100644
--- a/test/confs/0422
+++ b/test/confs/0422
@@ -1,12 +1,7 @@
 # Exim test configuration 0422
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0423 b/test/confs/0423
index 30ba84b82..3effe6cc4 100644
--- a/test/confs/0423
+++ b/test/confs/0423
@@ -1,12 +1,7 @@
 # Exim test configuration 0423
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0424 b/test/confs/0424
index 902f9ccb8..2ce709db0 100644
--- a/test/confs/0424
+++ b/test/confs/0424
@@ -1,12 +1,7 @@
 # Exim test configuration 0424
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0425 b/test/confs/0425
index 5c4378fea..6c9383a41 100644
--- a/test/confs/0425
+++ b/test/confs/0425
@@ -1,12 +1,7 @@
 # Exim test configuration 0425
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0426 b/test/confs/0426
index f50d54067..fbac9ecfd 100644
--- a/test/confs/0426
+++ b/test/confs/0426
@@ -1,12 +1,7 @@
 # Exim test configuration 0426
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0427 b/test/confs/0427
index 95e6b5264..cdbc8ae3e 100644
--- a/test/confs/0427
+++ b/test/confs/0427
@@ -1,12 +1,7 @@
 # Exim test configuration 0427
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0428 b/test/confs/0428
index 0fb20a14a..38601f30b 100644
--- a/test/confs/0428
+++ b/test/confs/0428
@@ -1,12 +1,7 @@
 # Exim test configuration 0428
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0429 b/test/confs/0429
index 3dbf4fcb2..49df93001 100644
--- a/test/confs/0429
+++ b/test/confs/0429
@@ -1,13 +1,8 @@
 # Exim test configuration 0429
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0430 b/test/confs/0430
index b38f3057b..552b0d010 100644
--- a/test/confs/0430
+++ b/test/confs/0430
@@ -3,14 +3,9 @@
 LIST=
 SELF=freeze
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0431 b/test/confs/0431
index 33b3631c3..7590fa9d4 100644
--- a/test/confs/0431
+++ b/test/confs/0431
@@ -2,14 +2,9 @@
 
 AFFIX=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0432 b/test/confs/0432
index ffb97452f..e8e6e3552 100644
--- a/test/confs/0432
+++ b/test/confs/0432
@@ -1,13 +1,8 @@
 # Exim test configuration 0432
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0433 b/test/confs/0433
index 4513f6db0..55fb85e96 100644
--- a/test/confs/0433
+++ b/test/confs/0433
@@ -4,14 +4,9 @@ PORT=
 IFACE=
 
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0434 b/test/confs/0434
index 5616b9cee..0d77fa095 100644
--- a/test/confs/0434
+++ b/test/confs/0434
@@ -2,14 +2,9 @@
 
 ELI=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0435 b/test/confs/0435
index b251a0120..21148174f 100644
--- a/test/confs/0435
+++ b/test/confs/0435
@@ -1,13 +1,8 @@
 # Exim test configuration 0435
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0436 b/test/confs/0436
index 9c24f1ff5..2fcaef961 100644
--- a/test/confs/0436
+++ b/test/confs/0436
@@ -1,13 +1,8 @@
 # Exim test configuration 0436
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0437 b/test/confs/0437
index 7e0583d79..d0ea77ea1 100644
--- a/test/confs/0437
+++ b/test/confs/0437
@@ -1,6 +1,7 @@
 # Exim test configuration 0437
 
 exim_path = EXIM_PATH
+keep_environment =
 host_lookup_order = bydns
 primary_hostname = myhost.test.ex
 
diff --git a/test/confs/0438 b/test/confs/0438
index 58d617824..bf1b55061 100644
--- a/test/confs/0438
+++ b/test/confs/0438
@@ -1,13 +1,8 @@
 # Exim test configuration 0438
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0439 b/test/confs/0439
index c63503634..feb42f596 100644
--- a/test/confs/0439
+++ b/test/confs/0439
@@ -1,13 +1,8 @@
 # Exim test configuration 0439
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0440 b/test/confs/0440
index 6a61c130a..2bef8c961 100644
--- a/test/confs/0440
+++ b/test/confs/0440
@@ -1,13 +1,8 @@
 # Exim test configuration 0440
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0441 b/test/confs/0441
index 3e10aa309..71153a7fe 100644
--- a/test/confs/0441
+++ b/test/confs/0441
@@ -1,13 +1,8 @@
 # Exim test configuration 0441
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0442 b/test/confs/0442
index 29ecc1568..2e1b17dee 100644
--- a/test/confs/0442
+++ b/test/confs/0442
@@ -2,14 +2,9 @@
 
 BAD=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0443 b/test/confs/0443
index bd5dad286..154c8edba 100644
--- a/test/confs/0443
+++ b/test/confs/0443
@@ -1,13 +1,8 @@
 # Exim test configuration 0443
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0444 b/test/confs/0444
index f6dff0169..2c103ff69 100644
--- a/test/confs/0444
+++ b/test/confs/0444
@@ -1,13 +1,8 @@
 # Exim test configuration 0444
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0445 b/test/confs/0445
index 32d3c6544..f42606b12 100644
--- a/test/confs/0445
+++ b/test/confs/0445
@@ -1,13 +1,8 @@
 # Exim test configuration 0445
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0446 b/test/confs/0446
index 8adfcc6b1..90e8a0245 100644
--- a/test/confs/0446
+++ b/test/confs/0446
@@ -1,13 +1,8 @@
 # Exim test configuration 0446
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0447 b/test/confs/0447
index 112978f88..57b992d1b 100644
--- a/test/confs/0447
+++ b/test/confs/0447
@@ -2,14 +2,9 @@
 
 INSERT=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0448 b/test/confs/0448
index cccf16498..f18f8f539 100644
--- a/test/confs/0448
+++ b/test/confs/0448
@@ -1,13 +1,8 @@
 # Exim test configuration 0448
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0449 b/test/confs/0449
index 2d8c2f51e..d08da8341 100644
--- a/test/confs/0449
+++ b/test/confs/0449
@@ -1,13 +1,8 @@
 # Exim test configuration 0449
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0450 b/test/confs/0450
index 409098d30..2dff861a1 100644
--- a/test/confs/0450
+++ b/test/confs/0450
@@ -2,14 +2,9 @@
 
 EXTRA=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0451 b/test/confs/0451
index 6ae4d3c5e..7d25049d4 100644
--- a/test/confs/0451
+++ b/test/confs/0451
@@ -1,13 +1,8 @@
 # Exim test configuration 0451
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0452 b/test/confs/0452
index a8531320b..a94295a98 100644
--- a/test/confs/0452
+++ b/test/confs/0452
@@ -1,13 +1,8 @@
 # Exim test configuration 0452
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0453 b/test/confs/0453
index e4294aeb2..3ecc86591 100644
--- a/test/confs/0453
+++ b/test/confs/0453
@@ -2,14 +2,9 @@
 
 LIMIT=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0454 b/test/confs/0454
index bb4e8b79e..359d0d917 100644
--- a/test/confs/0454
+++ b/test/confs/0454
@@ -1,13 +1,8 @@
 # Exim test configuration 0454
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0455 b/test/confs/0455
index d6688d932..390c28a95 100644
--- a/test/confs/0455
+++ b/test/confs/0455
@@ -2,13 +2,8 @@
 
 HOSTS_MAX_TRY=4
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0456 b/test/confs/0456
index da9814360..362d6b549 100644
--- a/test/confs/0456
+++ b/test/confs/0456
@@ -2,13 +2,8 @@
 
 HOSTS_MAX_TRY=4
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0457 b/test/confs/0457
index c3538607e..866950e9a 100644
--- a/test/confs/0457
+++ b/test/confs/0457
@@ -1,12 +1,7 @@
 # Exim test configuration 0457
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0458 b/test/confs/0458
index bb6e4fcb3..e964cb0c7 100644
--- a/test/confs/0458
+++ b/test/confs/0458
@@ -1,13 +1,8 @@
 # Exim test configuration 0458
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0459 b/test/confs/0459
index f16dc0b3c..46d037557 100644
--- a/test/confs/0459
+++ b/test/confs/0459
@@ -1,13 +1,8 @@
 # Exim test configuration 0459
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0460 b/test/confs/0460
index aa53b9722..52628ab25 100644
--- a/test/confs/0460
+++ b/test/confs/0460
@@ -1,13 +1,8 @@
 # Exim test configuration 0460
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0461 b/test/confs/0461
index c78c2a94a..30abd50a9 100644
--- a/test/confs/0461
+++ b/test/confs/0461
@@ -5,14 +5,9 @@ ROUTE_DATA=V4NET.0.0.1
 RETRY1=1s
 RETRY2=2s
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0462 b/test/confs/0462
index 9e602a57f..36d18412d 100644
--- a/test/confs/0462
+++ b/test/confs/0462
@@ -2,14 +2,9 @@
 
 SELECTOR=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0463 b/test/confs/0463
index 187ea46fe..8be1d95c1 100644
--- a/test/confs/0463
+++ b/test/confs/0463
@@ -1,13 +1,8 @@
 # Exim test configuration 0463
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0464 b/test/confs/0464
index 8a484ee8f..21e41cb08 100644
--- a/test/confs/0464
+++ b/test/confs/0464
@@ -1,13 +1,8 @@
 # Exim test configuration 0464
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0465 b/test/confs/0465
index 877e04487..9fc5579df 100644
--- a/test/confs/0465
+++ b/test/confs/0465
@@ -1,15 +1,10 @@
 # Exim test configuration 0465
 
-STD=
+OPT=
+
+.include DIR/aux-var/std_conf_prefix
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -17,7 +12,7 @@ acl_smtp_rcpt = accept
 acl_smtp_data = check_data
 queue_only
 trusted_users = CALLER
-STD
+OPT
 
 
 begin acl
diff --git a/test/confs/0466 b/test/confs/0466
index 8cd7d6036..880a41e33 100644
--- a/test/confs/0466
+++ b/test/confs/0466
@@ -1,13 +1,8 @@
 # Exim test configuration 0466
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0467 b/test/confs/0467
index 3d031a65d..147aca64e 100644
--- a/test/confs/0467
+++ b/test/confs/0467
@@ -2,14 +2,9 @@
 
 SRV=smtp
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0468 b/test/confs/0468
index 0baf45ba6..c04a04e61 100644
--- a/test/confs/0468
+++ b/test/confs/0468
@@ -2,14 +2,9 @@
 
 SRV=smtp
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0469 b/test/confs/0469
index 51f5bdfcb..a008dde00 100644
--- a/test/confs/0469
+++ b/test/confs/0469
@@ -2,14 +2,9 @@
 
 SRV=smtp
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0470 b/test/confs/0470
index aff710724..a0f0b5027 100644
--- a/test/confs/0470
+++ b/test/confs/0470
@@ -2,14 +2,9 @@
 
 SRV=smtp
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0471 b/test/confs/0471
index bc6fd509f..f7e0a9f0b 100644
--- a/test/confs/0471
+++ b/test/confs/0471
@@ -1,13 +1,8 @@
 # Exim test configuration 0471
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0472 b/test/confs/0472
index b27bc6d8f..09d563329 100644
--- a/test/confs/0472
+++ b/test/confs/0472
@@ -2,14 +2,9 @@
 
 FUSER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0473 b/test/confs/0473
index e9ea69db6..6dd6b8898 100644
--- a/test/confs/0473
+++ b/test/confs/0473
@@ -3,13 +3,8 @@
 USE_SENDER = ,use_sender
 ACL_RCPT = acl_rcpt
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0474 b/test/confs/0474
index 5a6ddc528..35b4805e5 100644
--- a/test/confs/0474
+++ b/test/confs/0474
@@ -1,12 +1,7 @@
 # Exim test configuration 0474
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0475 b/test/confs/0475
index 048c69118..dfca55c78 100644
--- a/test/confs/0475
+++ b/test/confs/0475
@@ -1,12 +1,7 @@
 # Exim test configuration 0475
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0476 b/test/confs/0476
index 084184aad..fd6106b16 100644
--- a/test/confs/0476
+++ b/test/confs/0476
@@ -1,12 +1,7 @@
 # Exim test configuration 0476
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0477 b/test/confs/0477
index 650552bb3..04d836591 100644
--- a/test/confs/0477
+++ b/test/confs/0477
@@ -1,12 +1,7 @@
 # Exim test configuration 0477
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0478 b/test/confs/0478
index f3e11de23..d9fd0a5ce 100644
--- a/test/confs/0478
+++ b/test/confs/0478
@@ -2,13 +2,8 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0479 b/test/confs/0479
index 048edebd8..bfb9b8613 100644
--- a/test/confs/0479
+++ b/test/confs/0479
@@ -1,12 +1,7 @@
 # Exim test configuration 0479
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0480 b/test/confs/0480
index 0c0f2ca11..6c2b688ec 100644
--- a/test/confs/0480
+++ b/test/confs/0480
@@ -6,13 +6,8 @@ IP3=V4NET.0.0.3
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0481 b/test/confs/0481
index de976c5b5..ae1b78819 100644
--- a/test/confs/0481
+++ b/test/confs/0481
@@ -1,13 +1,8 @@
 # Exim test configuration 0481
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0482 b/test/confs/0482
index 20b06d88b..ba29b81db 100644
--- a/test/confs/0482
+++ b/test/confs/0482
@@ -1,13 +1,8 @@
 # Exim test configuration 0482
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0483 b/test/confs/0483
index 530253b15..e9c1f09e5 100644
--- a/test/confs/0483
+++ b/test/confs/0483
@@ -1,13 +1,8 @@
 # Exim test configuration 0483
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0484 b/test/confs/0484
index 3837a20ff..65ca274f2 100644
--- a/test/confs/0484
+++ b/test/confs/0484
@@ -1,13 +1,8 @@
 # Exim test configuration 0484
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0485 b/test/confs/0485
index 4b8a0dbb3..ad31830e0 100644
--- a/test/confs/0485
+++ b/test/confs/0485
@@ -1,13 +1,8 @@
 # Exim test configuration 0485
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0486 b/test/confs/0486
index 7104bb7f5..40c995112 100644
--- a/test/confs/0486
+++ b/test/confs/0486
@@ -1,13 +1,8 @@
 # Exim test configuration 0486
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0487 b/test/confs/0487
index 8776d80f1..a9c1babc0 100644
--- a/test/confs/0487
+++ b/test/confs/0487
@@ -1,13 +1,8 @@
 # Exim test configuration 0487
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0488 b/test/confs/0488
index e687e95e9..de7a7af29 100644
--- a/test/confs/0488
+++ b/test/confs/0488
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0489 b/test/confs/0489
index 7148b9cff..878565d21 100644
--- a/test/confs/0489
+++ b/test/confs/0489
@@ -1,13 +1,8 @@
 # Exim test configuration 0489
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0490 b/test/confs/0490
index 0252d2dec..ca3c1c2fe 100644
--- a/test/confs/0490
+++ b/test/confs/0490
@@ -1,13 +1,8 @@
 # Exim test configuration 0490
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0491 b/test/confs/0491
index 8a0f0e819..c7d3eaec0 100644
--- a/test/confs/0491
+++ b/test/confs/0491
@@ -3,14 +3,9 @@
 UL=abc@xyz
 REWRITE=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0492 b/test/confs/0492
index 0271d3b85..a939fe125 100644
--- a/test/confs/0492
+++ b/test/confs/0492
@@ -1,13 +1,8 @@
 # Exim test configuration 0492
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0493 b/test/confs/0493
index 314fe92a4..dd38fbc49 100644
--- a/test/confs/0493
+++ b/test/confs/0493
@@ -1,13 +1,8 @@
 # Exim test configuration 0493
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0494 b/test/confs/0494
index 98a9c3109..8027cf482 100644
--- a/test/confs/0494
+++ b/test/confs/0494
@@ -1,13 +1,8 @@
 # Exim test configuration 0494
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0495 b/test/confs/0495
index bb7c5e332..5bfec709f 100644
--- a/test/confs/0495
+++ b/test/confs/0495
@@ -1,13 +1,8 @@
 # Exim test configuration 0495
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0496 b/test/confs/0496
index c30833d24..351cd802a 100644
--- a/test/confs/0496
+++ b/test/confs/0496
@@ -1,13 +1,8 @@
 # Exim test configuration 0496
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0497 b/test/confs/0497
index af8fc81dd..2154c3c2c 100644
--- a/test/confs/0497
+++ b/test/confs/0497
@@ -1,13 +1,8 @@
 # Exim test configuration 0497
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0498 b/test/confs/0498
index f55a0ab75..c26f43a8a 100644
--- a/test/confs/0498
+++ b/test/confs/0498
@@ -1,13 +1,8 @@
 # Exim test configuration 0498
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0499 b/test/confs/0499
index ff6d2aaea..b7a0b7980 100644
--- a/test/confs/0499
+++ b/test/confs/0499
@@ -1,13 +1,8 @@
 # Exim test configuration 0499
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0500 b/test/confs/0500
index f07b20893..f3b225c66 100644
--- a/test/confs/0500
+++ b/test/confs/0500
@@ -1,13 +1,8 @@
 # Exim test configuration 0500
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0501 b/test/confs/0501
index 5e18c7f73..f3085e839 100644
--- a/test/confs/0501
+++ b/test/confs/0501
@@ -1,13 +1,8 @@
 # Exim test configuration 0501
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0502 b/test/confs/0502
index a6ff74c40..d1314891d 100644
--- a/test/confs/0502
+++ b/test/confs/0502
@@ -2,14 +2,9 @@
 
 LAST=accept message = Your message here
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0503 b/test/confs/0503
index 6dccd559a..aab6cdb54 100644
--- a/test/confs/0503
+++ b/test/confs/0503
@@ -2,14 +2,9 @@
 
 MSIZE=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0504 b/test/confs/0504
index 86f599d95..b2dadfcb3 100644
--- a/test/confs/0504
+++ b/test/confs/0504
@@ -1,13 +1,8 @@
 # Exim test configuration 0504
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0505 b/test/confs/0505
index 27ed59835..99b64bfa3 100644
--- a/test/confs/0505
+++ b/test/confs/0505
@@ -4,14 +4,9 @@ ACL=
 CONTROL=
 RECIPIENT=acl_smtp_rcpt=accept
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0506 b/test/confs/0506
index 22fdaa181..d20db5f2f 100644
--- a/test/confs/0506
+++ b/test/confs/0506
@@ -3,14 +3,9 @@
 ALLOW=allow_filter
 FORBID=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0507 b/test/confs/0507
index da500daf8..6449e056a 100644
--- a/test/confs/0507
+++ b/test/confs/0507
@@ -2,14 +2,9 @@
 
 ERROR_DETAILS=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0508 b/test/confs/0508
index c81919e7e..17a1dec10 100644
--- a/test/confs/0508
+++ b/test/confs/0508
@@ -1,13 +1,8 @@
 # Exim test configuration 0508
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0509 b/test/confs/0509
index c45f52d68..bc3dc50a8 100644
--- a/test/confs/0509
+++ b/test/confs/0509
@@ -1,13 +1,8 @@
 # Exim test configuration 0509
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0510 b/test/confs/0510
index 2a7ee7d6e..c73a1b402 100644
--- a/test/confs/0510
+++ b/test/confs/0510
@@ -1,13 +1,8 @@
 # Exim test configuration 0510
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/0511 b/test/confs/0511
index 685b1955b..1ecc19998 100644
--- a/test/confs/0511
+++ b/test/confs/0511
@@ -1,13 +1,8 @@
 # Exim test configuration 0511
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0512 b/test/confs/0512
index 202acb29f..15e424a51 100644
--- a/test/confs/0512
+++ b/test/confs/0512
@@ -2,14 +2,9 @@
 
 HARDLIMIT=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0513 b/test/confs/0513
index ea76f3447..d449a81ea 100644
--- a/test/confs/0513
+++ b/test/confs/0513
@@ -2,14 +2,9 @@
 
 HARDLIMIT=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0514 b/test/confs/0514
index d52a76950..36a2ac3d2 100644
--- a/test/confs/0514
+++ b/test/confs/0514
@@ -1,13 +1,8 @@
 # Exim test configuration 0514
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0515 b/test/confs/0515
index ad262e774..c3f57ba2c 100644
--- a/test/confs/0515
+++ b/test/confs/0515
@@ -1,13 +1,8 @@
 # Exim test configuration 0515
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0516 b/test/confs/0516
index 2d5ea226a..78ebfd121 100644
--- a/test/confs/0516
+++ b/test/confs/0516
@@ -1,13 +1,8 @@
 # Exim test configuration 0516
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0517 b/test/confs/0517
index 52663742a..cbb2d4dbb 100644
--- a/test/confs/0517
+++ b/test/confs/0517
@@ -2,14 +2,9 @@
 
 ERROR_DETAILS=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0518 b/test/confs/0518
index 979f99adf..c413faa95 100644
--- a/test/confs/0518
+++ b/test/confs/0518
@@ -1,13 +1,8 @@
 # Exim test configuration 0518
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0519 b/test/confs/0519
index 943c91818..e6dbb0090 100644
--- a/test/confs/0519
+++ b/test/confs/0519
@@ -1,13 +1,8 @@
 # Exim test configuration 0519
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0520 b/test/confs/0520
index f850c7c2f..1106fd896 100644
--- a/test/confs/0520
+++ b/test/confs/0520
@@ -1,13 +1,8 @@
 # Exim test configuration 0520
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0521 b/test/confs/0521
index fb47004fd..8c9c70042 100644
--- a/test/confs/0521
+++ b/test/confs/0521
@@ -1,13 +1,8 @@
 # Exim test configuration 0521
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0522 b/test/confs/0522
index 77f60c86a..4909db849 100644
--- a/test/confs/0522
+++ b/test/confs/0522
@@ -2,14 +2,9 @@
 
 TIMEOUTDEFER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0523 b/test/confs/0523
index c3d9e6dc5..9415855d7 100644
--- a/test/confs/0523
+++ b/test/confs/0523
@@ -1,13 +1,8 @@
 # Exim test configuration 0523
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0524 b/test/confs/0524
index 0d73654b2..a94122c38 100644
--- a/test/confs/0524
+++ b/test/confs/0524
@@ -1,13 +1,8 @@
 # Exim test configuration 0524
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0525 b/test/confs/0525
index 04a0211f4..a6e429172 100644
--- a/test/confs/0525
+++ b/test/confs/0525
@@ -1,13 +1,8 @@
 # Exim test configuration 0525
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0526 b/test/confs/0526
index e4fabf60c..e2e927667 100644
--- a/test/confs/0526
+++ b/test/confs/0526
@@ -1,13 +1,8 @@
 # Exim test configuration 0526
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0527 b/test/confs/0527
index 57d51952e..2932f6907 100644
--- a/test/confs/0527
+++ b/test/confs/0527
@@ -1,13 +1,8 @@
 # Exim test configuration 0527
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0528 b/test/confs/0528
index a8de7aec8..e7313a5ca 100644
--- a/test/confs/0528
+++ b/test/confs/0528
@@ -1,13 +1,8 @@
 # Exim test configuration 0528
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0529 b/test/confs/0529
index 282047f9f..09e81d06e 100644
--- a/test/confs/0529
+++ b/test/confs/0529
@@ -1,13 +1,8 @@
 # Exim test configuration 0529
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0530 b/test/confs/0530
index c919cb658..9eeb4cc9f 100644
--- a/test/confs/0530
+++ b/test/confs/0530
@@ -1,13 +1,8 @@
 # Exim test configuration 0530
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0531 b/test/confs/0531
index a66723188..2f72810cf 100644
--- a/test/confs/0531
+++ b/test/confs/0531
@@ -1,13 +1,8 @@
 # Exim test configuration 0531
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0532 b/test/confs/0532
index 4d45c2fd3..e50c5de0e 100644
--- a/test/confs/0532
+++ b/test/confs/0532
@@ -2,14 +2,9 @@
 
 CONNECTCOND=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0533 b/test/confs/0533
index b0a3347b6..1dbc83b61 100644
--- a/test/confs/0533
+++ b/test/confs/0533
@@ -1,13 +1,8 @@
 # Exim test configuration 0533
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0534 b/test/confs/0534
index d2bc84a76..db19f253a 100644
--- a/test/confs/0534
+++ b/test/confs/0534
@@ -1,13 +1,8 @@
 # Exim test configuration 0534
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0535 b/test/confs/0535
index 58cb1c425..004f795f5 100644
--- a/test/confs/0535
+++ b/test/confs/0535
@@ -1,13 +1,8 @@
 # Exim test configuration 0535
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0536 b/test/confs/0536
index 0582f6fb1..e451f81fe 100644
--- a/test/confs/0536
+++ b/test/confs/0536
@@ -2,14 +2,9 @@
 
 FORBID_SMTP_CODE = false
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0537 b/test/confs/0537
index 7a2ac9276..2498dc3ce 100644
--- a/test/confs/0537
+++ b/test/confs/0537
@@ -2,15 +2,10 @@
 
 TRUSTED=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +smtp_mailauth
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0538 b/test/confs/0538
index 6fbeeb23a..9081aa572 100644
--- a/test/confs/0538
+++ b/test/confs/0538
@@ -1,13 +1,8 @@
 # Exim test configuration 0538
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0539 b/test/confs/0539
index e70a452f1..2ca8e253a 100644
--- a/test/confs/0539
+++ b/test/confs/0539
@@ -1,13 +1,8 @@
 # Exim test configuration 0539
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0540 b/test/confs/0540
index b5e183638..7ebbdd2b4 100644
--- a/test/confs/0540
+++ b/test/confs/0540
@@ -1,13 +1,8 @@
 # Exim test configuration 0540
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0541 b/test/confs/0541
index d1b8f601b..73e8284d9 100644
--- a/test/confs/0541
+++ b/test/confs/0541
@@ -1,13 +1,8 @@
 # Exim test configuration 0541
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0542 b/test/confs/0542
index 1f22fe0d5..ca824d5c1 100644
--- a/test/confs/0542
+++ b/test/confs/0542
@@ -1,13 +1,8 @@
 # Exim test configuration 0542
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0543 b/test/confs/0543
index dcfcd303a..88e74e58f 100644
--- a/test/confs/0543
+++ b/test/confs/0543
@@ -1,12 +1,7 @@
 # Exim test configuration 0543
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0544 b/test/confs/0544
index b5c9d73cf..09949a3fa 100644
--- a/test/confs/0544
+++ b/test/confs/0544
@@ -1,12 +1,7 @@
 # Exim test configuration 0544
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0545 b/test/confs/0545
index 86501e32c..a78236a4a 100644
--- a/test/confs/0545
+++ b/test/confs/0545
@@ -1,12 +1,7 @@
 # Exim test configuration 0545
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0546 b/test/confs/0546
index 7de92304c..2d5cae7b3 100644
--- a/test/confs/0546
+++ b/test/confs/0546
@@ -3,13 +3,8 @@
 HELO_MSG=One line
 RCPT_MSG=RCPT is OK
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0547 b/test/confs/0547
index e8e8eedd4..5d172447e 100644
--- a/test/confs/0547
+++ b/test/confs/0547
@@ -2,14 +2,9 @@
 
 MAXNM = 100
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0548 b/test/confs/0548
index faa1ffad3..3e1f0ebfc 100644
--- a/test/confs/0548
+++ b/test/confs/0548
@@ -2,13 +2,8 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0549 b/test/confs/0549
index fd07a54ed..f3da5f486 100644
--- a/test/confs/0549
+++ b/test/confs/0549
@@ -1,13 +1,8 @@
 # Exim test configuration 0549
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0550 b/test/confs/0550
index f35ca9f67..caf3ceda7 100644
--- a/test/confs/0550
+++ b/test/confs/0550
@@ -1,13 +1,8 @@
 # Exim test configuration 0550
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0551 b/test/confs/0551
index 102f4ceeb..1b4465bdd 100644
--- a/test/confs/0551
+++ b/test/confs/0551
@@ -1,19 +1,14 @@
 # Exim test configuration 0551
 
-LS=+pid
+LOG_SELECTOR=+pid
+
+.include DIR/aux-var/std_conf_prefix
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
-log_selector = LS
+log_selector = LOG_SELECTOR
 
 # ----- Routers -----
 
diff --git a/test/confs/0552 b/test/confs/0552
index 9653e807e..c4c2f5e98 100644
--- a/test/confs/0552
+++ b/test/confs/0552
@@ -3,14 +3,9 @@
 DDF=
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0553 b/test/confs/0553
index 36c5c8748..c9ceaa59e 100644
--- a/test/confs/0553
+++ b/test/confs/0553
@@ -3,14 +3,9 @@
 DCF =
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0554 b/test/confs/0554
index fc7c986a6..cbcd357a9 100644
--- a/test/confs/0554
+++ b/test/confs/0554
@@ -1,13 +1,8 @@
 # Exim test configuration 0554
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0555 b/test/confs/0555
index 2dbfa9da1..c86050fa6 100644
--- a/test/confs/0555
+++ b/test/confs/0555
@@ -2,14 +2,9 @@
 
 FAKE=fakereject
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0556 b/test/confs/0556
index 81fc19593..965d68120 100644
--- a/test/confs/0556
+++ b/test/confs/0556
@@ -5,14 +5,9 @@ ACL_RCPT=accept
 ACL_PREDATA=accept
 PAH=127.0.0.1
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0557 b/test/confs/0557
index 3c5d55197..9b7dec2e6 100644
--- a/test/confs/0557
+++ b/test/confs/0557
@@ -1,18 +1,13 @@
 # Exim test configuration 0557
 
-X=
-Y=
+FAKE=
+OPT=
 HOSTS=
 HAI=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -24,8 +19,8 @@ begin routers
 r1:
   driver = manualroute
   route_list = * HOSTS
-X host_find_failed = ignore
-Y host_all_ignored = HAI
+FAKE host_find_failed = ignore
+OPT  host_all_ignored = HAI
   no_more
   self = send
   transport = t1
diff --git a/test/confs/0558 b/test/confs/0558
index 13159ad37..c163cf37c 100644
--- a/test/confs/0558
+++ b/test/confs/0558
@@ -1,13 +1,8 @@
 # Exim test configuration 0558
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0559 b/test/confs/0559
index e97c8bb41..7f0107b15 100644
--- a/test/confs/0559
+++ b/test/confs/0559
@@ -1,13 +1,8 @@
 # Exim test configuration 0559
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0560 b/test/confs/0560
index edea9c30b..da6e7decd 100644
--- a/test/confs/0560
+++ b/test/confs/0560
@@ -1,13 +1,8 @@
 # Exim test configuration 0560
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0561 b/test/confs/0561
index c36031cf8..5ccf4dcc3 100644
--- a/test/confs/0561
+++ b/test/confs/0561
@@ -2,14 +2,9 @@
 
 QOLL=true
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0562 b/test/confs/0562
index 3b478c1c9..d79c8bb07 100644
--- a/test/confs/0562
+++ b/test/confs/0562
@@ -1,13 +1,8 @@
 # Exim test configuration 0562
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0563 b/test/confs/0563
index 62249b8ca..c03254821 100644
--- a/test/confs/0563
+++ b/test/confs/0563
@@ -1,8 +1,10 @@
 # Exim test configuration 0563
 
+exim_path = EXIM_PATH
 tls_advertise_hosts =
 qualify_domain = testexim.test.ex
 localpartlist aliases = joe:sam:tom
+keep_environment =
 
 begin routers
 
diff --git a/test/confs/0564 b/test/confs/0564
index d9530e69a..6a23896ef 100644
--- a/test/confs/0564
+++ b/test/confs/0564
@@ -1,11 +1,13 @@
 # Exim test configuration 0564
 
 exim_path = EXIM_PATH
+keep_environment =
 host_lookup_order = bydns
 spool_directory = DIR/spool
 log_file_path = DIR/spool/log/%slog
 gecos_pattern = ""
 gecos_name = CALLER_NAME
+chunking_advertise_hosts =
 tls_advertise_hosts =
 
 # ----- Main settings -----
diff --git a/test/confs/0565 b/test/confs/0565
index 397536342..0d053a080 100644
--- a/test/confs/0565
+++ b/test/confs/0565
@@ -1,13 +1,8 @@
 # Exim test configuration 0565
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0566 b/test/confs/0566
index e4433f8f8..cc661f78b 100644
--- a/test/confs/0566
+++ b/test/confs/0566
@@ -1,14 +1,9 @@
 # Exim test configuration 0566
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +8bitmime
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/0567 b/test/confs/0567
index e6850b8bd..267566561 100644
--- a/test/confs/0567
+++ b/test/confs/0567
@@ -2,14 +2,9 @@
 
 CONNECTCOND=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0569 b/test/confs/0569
index e6ab3f692..3d562b6e7 100644
--- a/test/confs/0569
+++ b/test/confs/0569
@@ -1,13 +1,8 @@
 # Exim test configuration 0569
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0570 b/test/confs/0570
index eb7218138..1c2ca0a25 100644
--- a/test/confs/0570
+++ b/test/confs/0570
@@ -3,13 +3,8 @@
 
 OPTION =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0571 b/test/confs/0571
index 64383cdd8..cf4881a0a 100644
--- a/test/confs/0571
+++ b/test/confs/0571
@@ -2,14 +2,9 @@
 
 LOG_SELECTOR=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0572 b/test/confs/0572
index 2cce49c38..23da35a09 100644
--- a/test/confs/0572
+++ b/test/confs/0572
@@ -2,14 +2,9 @@
 
 OPT =
 
-exim_path = EXIM_PATH
-hide host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -28,7 +23,7 @@ my_main_router:
   route_list = * 127.0.0.1
   self = send
   transport = my_smtp
-  debug_print = router_name <$router_name>
+  hide debug_print = router_name <$router_name>
   no_more
 
 
@@ -40,7 +35,6 @@ my_smtp:
   driver = smtp
   interface = HOSTIPV4
   port = PORT_S
-  hide socks_proxy = 127.0.0.1 port=PORT_D OPT
   debug_print = transport_name <$transport_name>
 
 
diff --git a/test/confs/0573 b/test/confs/0573
index c3c7a6bea..3c2b1aae1 100644
--- a/test/confs/0573
+++ b/test/confs/0573
@@ -1,13 +1,8 @@
 # Exim test configuration 0573
 
-exim_path = EXIM_PATH
-hide host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0574 b/test/confs/0574
new file mode 100644
index 000000000..9afc55247
--- /dev/null
+++ b/test/confs/0574
@@ -0,0 +1,28 @@
+# Exim test configuration 0574
+
+.include DIR/aux-var/std_conf_prefix
+
+primary_hostname = myhost.test.ex
+
+# ----- Main settings -----
+
+acl_smtp_mail = chk_mail
+acl_smtp_rcpt = chk_rcpt
+acl_smtp_data = chk_data
+
+queue_only
+
+# ----- ACL -----
+
+begin acl
+
+chk_mail:
+  accept control = debug/tag=_1
+
+chk_rcpt:
+  accept control = debug/kill
+
+chk_data:
+  accept control = debug/tag=_2/opts=+all
+
+# End
diff --git a/test/confs/0575 b/test/confs/0575
new file mode 100644
index 000000000..e99bba917
--- /dev/null
+++ b/test/confs/0575
@@ -0,0 +1,13 @@
+# Exim test configuration 0575
+
+.include DIR/aux-var/std_conf_prefix
+
+
+# ----- Main settings -----
+
+primary_hostname = mail.test.ex
+qualify_domain = test.ex
+
+acl_smtp_rcpt = accept
+
+# End
diff --git a/test/confs/0576 b/test/confs/0576
new file mode 100644
index 000000000..b75b67804
--- /dev/null
+++ b/test/confs/0576
@@ -0,0 +1,39 @@
+# Exim test configuration 0576
+
+SERVER =
+
+.include DIR/aux-var/std_conf_prefix
+
+log_selector = +received_recipients +sender_on_delivery
+
+acl_smtp_rcpt = rcpt
+queue_only
+queue_run_in_order
+
+#---------------
+
+begin acl
+
+rcpt:
+  accept
+    queue = ${if eq {normal}{$local_part} {} {$local_part}}
+    logwrite = using queue '$queue_name'
+
+#---------------
+
+begin routers
+
+all:
+  driver = accept
+  transport = dump
+
+#---------------
+
+begin transports
+
+dump:
+  driver = pipe
+  command = true
+
+# End
+
diff --git a/test/confs/0600 b/test/confs/0600
index 671925956..29bc5bf1a 100644
--- a/test/confs/0600
+++ b/test/confs/0600
@@ -1,13 +1,8 @@
 # Exim test configuration 0600
 # utf8clean:string
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/0601 b/test/confs/0601
index abcaf1c58..faf44ce98 100644
--- a/test/confs/0601
+++ b/test/confs/0601
@@ -2,6 +2,7 @@
 # udpsend
 
 exim_path = EXIM_PATH
+keep_environment =
 spool_directory = DIR/spool
 log_file_path = DIR/spool/log/%slog
 tls_advertise_hosts =
diff --git a/test/confs/0602 b/test/confs/0602
index 92ab4669c..12a789d12 100644
--- a/test/confs/0602
+++ b/test/confs/0602
@@ -1,11 +1,6 @@
 # Exim test configuration 0602
 
-exim_path = EXIM_PATH
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
 
 # ----- Main settings -----
 
diff --git a/test/confs/0603 b/test/confs/0603
index 76bd41c55..baa3ea08c 100644
--- a/test/confs/0603
+++ b/test/confs/0603
@@ -7,16 +7,10 @@ untrusted_set_sender = *
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-#primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 rfc1413_query_timeout = 0s
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
 log_selector = +sender_on_delivery
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -49,7 +43,8 @@ send_to_server:
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
-  interface = ${if eq {$sender_address_domain}{dustybelt.tld} {127.0.0.1}{127.0.0.2}}
+  # assumes that HOSTIPV4 can send to 127.0.0.1
+  interface = ${if eq {$sender_address_domain}{dustybelt.tld} {127.0.0.1}{HOSTIPV4}}
 
 # ----- Retry -----
 
diff --git a/test/confs/0604 b/test/confs/0604
index 6dcfba358..ec5195511 100644
--- a/test/confs/0604
+++ b/test/confs/0604
@@ -6,16 +6,10 @@ untrusted_set_sender = *
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-#primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 rfc1413_query_timeout = 0s
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
 log_selector = +sender_on_delivery
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -48,7 +42,8 @@ send_to_server:
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
-  interface = ${if eq {$sender_address_domain}{dustybelt.tld} {127.0.0.1}{127.0.0.2}}
+  # assumes that HOSTIPV4 can sent to 127.0.0.1
+  interface = ${if eq {$sender_address_domain}{dustybelt.tld} {127.0.0.1}{HOSTIPV4}}
 
 # ----- Retry -----
 
diff --git a/test/confs/0605 b/test/confs/0605
index 44ccb63c7..2b5185c57 100644
--- a/test/confs/0605
+++ b/test/confs/0605
@@ -1,12 +1,6 @@
 # Exim test configuration 0605
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
 
 # ----- Main settings -----
 
diff --git a/test/confs/0606 b/test/confs/0606
index bb94edb29..25706976a 100644
--- a/test/confs/0606
+++ b/test/confs/0606
@@ -1,12 +1,6 @@
 # Exim test configuration 0606
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
 
 slow_lookup_log = 1000
 
diff --git a/test/confs/0607 b/test/confs/0607
index 932ae4c67..03c052316 100644
--- a/test/confs/0607
+++ b/test/confs/0607
@@ -2,13 +2,7 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
 
 log_selector = +received_recipients +sender_on_delivery
 
diff --git a/test/confs/0608 b/test/confs/0608
index b88f32e12..0ca40c770 100644
--- a/test/confs/0608
+++ b/test/confs/0608
@@ -1,13 +1,8 @@
 # Exim test configuration 0608
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0609 b/test/confs/0609
index 2b2f25d2b..e1ec0853e 100644
--- a/test/confs/0609
+++ b/test/confs/0609
@@ -3,14 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0610 b/test/confs/0610
index a68b4ebee..0567d8aaf 100644
--- a/test/confs/0610
+++ b/test/confs/0610
@@ -2,16 +2,10 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-#primary_hostname = myhost.test.ex
+.include DIR/aux-var/std_conf_prefix
+
 rfc1413_query_timeout = 0s
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
 log_selector = +sender_on_delivery
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -54,7 +48,7 @@ t2:
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
-  interface = 127.0.0.2
+  interface = HOSTIPV4
 
 # ----- Retry -----
 
diff --git a/test/confs/0611 b/test/confs/0611
index b52639198..4f6f490d3 100644
--- a/test/confs/0611
+++ b/test/confs/0611
@@ -4,12 +4,14 @@
 SERVER=
 
 exim_path = EXIM_PATH
+keep_environment =
 host_lookup_order = bydns
 primary_hostname = myhost.test.ex
 spool_directory = DIR/spool
 gecos_pattern = ""
 gecos_name = CALLER_NAME
 tls_advertise_hosts =
+chunking_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0612 b/test/confs/0612
index 3439ecb84..44f2e74d6 100644
--- a/test/confs/0612
+++ b/test/confs/0612
@@ -1,14 +1,9 @@
 # Exim test configuration 0612
 # log_defer_output on pipe transport
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0613 b/test/confs/0613
index a5ec4f856..5094759eb 100644
--- a/test/confs/0613
+++ b/test/confs/0613
@@ -1,14 +1,9 @@
 # Exim test configuration 0613
 # manualroute, hosts_randomize and multiple recipients
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0614 b/test/confs/0614
index 2b2361747..d19be4e74 100644
--- a/test/confs/0614
+++ b/test/confs/0614
@@ -1,14 +1,9 @@
 # Exim test configuration 0614
 # hosts_connection_nolog versus sender_host lists caching
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/0900 b/test/confs/0900
new file mode 100644
index 000000000..e02380f73
--- /dev/null
+++ b/test/confs/0900
@@ -0,0 +1,120 @@
+# Exim test configuration 0900
+SERVER=
+SRV=
+LIST=
+ALLOW=
+
+exim_path = EXIM_PATH
+keep_environment =
+host_lookup_order = bydns
+spool_directory = DIR/spool
+log_file_path = DIR/spool/log/SERVER%slog
+gecos_pattern = ""
+gecos_name = CALLER_NAME
+chunking_advertise_hosts = *
+tls_advertise_hosts = ${if eq {SRV}{tls} {*}}
+
+
+# ----- Main settings -----
+
+primary_hostname = testhost.test.ex
+domainlist local_domains = @ : test.ex
+
+acl_smtp_rcpt = check_recipient
+acl_smtp_data_prdr = check_prdr
+acl_smtp_data = check_data
+trusted_users = CALLER
+queue_only
+smtp_receive_timeout = 2s
+log_selector = +received_recipients
+
+.ifdef _OPT_MAIN_TLS_CERTIFICATE
+tls_certificate = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
+tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
+.endif
+
+ALLOW
+
+# ----- ACL -----
+
+begin acl
+
+check_recipient:
+  accept hosts = :
+  accept domains = +local_domains
+  deny   message = relay not permitted
+
+check_prdr:
+  accept local_parts = good
+  deny
+
+check_data:
+  warn   message = X-acl-message-linecount: $message_linecount
+  accept
+
+# ----- Routers -----
+
+begin routers
+
+to_server:
+  driver = accept
+  condition =	${if !eq {SERVER}{server}}
+  transport =	remote_smtp${if eq {OPT}{dkim} {_dkim}}
+  errors_to =	""
+
+fail_remote_domains:
+  driver = redirect
+  domains = ! +local_domains
+  data = :fail: unrouteable mail domain "$domain"
+
+localuser:
+  driver = accept
+  check_local_user
+  transport = local_delivery
+  headers_add = X-local-user: uid=$local_user_uid gid=$local_user_gid
+
+
+# ----- Transports -----
+
+begin transports
+
+local_delivery:
+  driver = appendfile
+  delivery_date_add
+  envelope_to_add
+  file = DIR/test-mail/$local_part
+  headers_add = "X-body-linecount: $body_linecount\n\
+                 X-message-linecount: $message_linecount\n\
+                 X-received-count: $received_count"
+  return_path_add
+
+remote_smtp:
+  driver = smtp
+  hosts =	127.0.0.1
+  port =	PORT_S
+  allow_localhost
+  command_timeout = 2s
+  final_timeout = 2s
+
+remote_smtp_dkim:
+  driver = smtp
+  hosts =	127.0.0.1
+  port =	PORT_S
+  allow_localhost
+  command_timeout = 2s
+  final_timeout = 2s
+
+.ifdef OPT
+  dkim_domain =		test.ex
+  dkim_selector =	sel
+  dkim_private_key =	DIR/aux-fixed/dkim/dkim.private
+.ifndef HEADERS_MAXSIZE
+  dkim_sign_headers =	LIST
+.endif
+.endif
+
+# ----- Retry -----
+
+begin retry
+* * F,30m,5m;
+# End
diff --git a/test/confs/0901 b/test/confs/0901
new file mode 120000
index 000000000..1bb987150
--- /dev/null
+++ b/test/confs/0901
@@ -0,0 +1 @@
+0900
\ No newline at end of file
diff --git a/test/confs/0902 b/test/confs/0902
new file mode 120000
index 000000000..1bb987150
--- /dev/null
+++ b/test/confs/0902
@@ -0,0 +1 @@
+0900
\ No newline at end of file
diff --git a/test/confs/1000 b/test/confs/1000
index b05acde77..f27d4ff6f 100644
--- a/test/confs/1000
+++ b/test/confs/1000
@@ -2,14 +2,9 @@
 
 HL=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/1001 b/test/confs/1001
index 49d367d7b..e4ed6779b 100644
--- a/test/confs/1001
+++ b/test/confs/1001
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/1002 b/test/confs/1002
index 8210a10f3..f0a4518f3 100644
--- a/test/confs/1002
+++ b/test/confs/1002
@@ -1,13 +1,8 @@
 # Exim test configuration 1002
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/1003 b/test/confs/1003
index 386ebb30c..bdbd2e6c3 100644
--- a/test/confs/1003
+++ b/test/confs/1003
@@ -2,14 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/1005 b/test/confs/1005
index d19571b82..35767932d 100644
--- a/test/confs/1005
+++ b/test/confs/1005
@@ -1,12 +1,7 @@
 # Exim test configuration 1005
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/1006 b/test/confs/1006
index e053d1b09..f46fba932 100644
--- a/test/confs/1006
+++ b/test/confs/1006
@@ -3,14 +3,9 @@
 SERVER=
 D6=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/1007 b/test/confs/1007
index 2bcd150a9..3f354f9c9 100644
--- a/test/confs/1007
+++ b/test/confs/1007
@@ -4,14 +4,9 @@ PORT=
 IFACE=
 
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/1008 b/test/confs/1008
index cc76315ef..e3307044f 100644
--- a/test/confs/1008
+++ b/test/confs/1008
@@ -1,12 +1,7 @@
 # Exim test configuration 1008
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/1009 b/test/confs/1009
index 99b78d9c1..af6e27642 100644
--- a/test/confs/1009
+++ b/test/confs/1009
@@ -1,12 +1,7 @@
 # Exim test configuration 1009
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/1010 b/test/confs/1010
index fde1f7539..2f2456bc2 100644
--- a/test/confs/1010
+++ b/test/confs/1010
@@ -1,13 +1,8 @@
 # Exim test configuration 1010
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2000 b/test/confs/2000
index 7a2d34b2f..9ca325f2a 100644
--- a/test/confs/2000
+++ b/test/confs/2000
@@ -2,13 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2001 b/test/confs/2001
index e2572df3a..9ab4cc384 100644
--- a/test/confs/2001
+++ b/test/confs/2001
@@ -3,13 +3,9 @@
 OPTION=
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2002 b/test/confs/2002
index 76e6f1eec..535be91eb 100644
--- a/test/confs/2002
+++ b/test/confs/2002
@@ -1,13 +1,9 @@
 # Exim test configuration 2002
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
+
 timezone = UTC
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/2003 b/test/confs/2003
index 8631514b8..c3eece620 100644
--- a/test/confs/2003
+++ b/test/confs/2003
@@ -1,12 +1,8 @@
 # Exim test configuration 2003
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2004 b/test/confs/2004
index 2979685ec..4cd622cef 100644
--- a/test/confs/2004
+++ b/test/confs/2004
@@ -1,12 +1,8 @@
 # Exim test configuration 2004
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2005 b/test/confs/2005
index 5b57b60ff..110bbef22 100644
--- a/test/confs/2005
+++ b/test/confs/2005
@@ -1,12 +1,8 @@
 # Exim test configuration 2005
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2006 b/test/confs/2006
index 8c1a13da2..63ed36a4e 100644
--- a/test/confs/2006
+++ b/test/confs/2006
@@ -1,12 +1,8 @@
 # Exim test configuration 2006
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2007 b/test/confs/2007
index 5bdf76f03..7b58b73ee 100644
--- a/test/confs/2007
+++ b/test/confs/2007
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2008 b/test/confs/2008
index 4bad74a1b..83b30502a 100644
--- a/test/confs/2008
+++ b/test/confs/2008
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 
 # ----- Main settings -----
diff --git a/test/confs/2009 b/test/confs/2009
index 66fadea29..59139f27e 100644
--- a/test/confs/2009
+++ b/test/confs/2009
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2010 b/test/confs/2010
index 34383c25a..2cedb89cf 100644
--- a/test/confs/2010
+++ b/test/confs/2010
@@ -4,13 +4,9 @@ SERVER =
 TIMES =
 HOSTS = 127.0.0.1 : HOSTIPV4
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2012 b/test/confs/2012
index 59265d407..8fbc55595 100644
--- a/test/confs/2012
+++ b/test/confs/2012
@@ -3,13 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 FX = DIR/aux-fixed
 S1 = FX/exim-ca/example.com/server1.example.com
diff --git a/test/confs/2013 b/test/confs/2013
index 331dd09ef..ebd253691 100644
--- a/test/confs/2013
+++ b/test/confs/2013
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2014 b/test/confs/2014
index 562e916fd..f9e2e6a22 100644
--- a/test/confs/2014
+++ b/test/confs/2014
@@ -2,13 +2,9 @@
 
 CRL=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2015 b/test/confs/2015
index 734c2834a..e17fc29e9 100644
--- a/test/confs/2015
+++ b/test/confs/2015
@@ -1,12 +1,8 @@
 # Exim test configuration 2015
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2016 b/test/confs/2016
index ef6e14463..b14e1f300 100644
--- a/test/confs/2016
+++ b/test/confs/2016
@@ -1,12 +1,7 @@
 # Exim test configuration 2016
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/2017 b/test/confs/2017
index 26b257cd5..a699f2d78 100644
--- a/test/confs/2017
+++ b/test/confs/2017
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2018 b/test/confs/2018
index 4afe33b96..58c1219e5 100644
--- a/test/confs/2018
+++ b/test/confs/2018
@@ -1,12 +1,8 @@
 # Exim test configuration 2018
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2019 b/test/confs/2019
index 798eb73d7..fdc030c23 100644
--- a/test/confs/2019
+++ b/test/confs/2019
@@ -1,12 +1,8 @@
 # Exim test configuration 2019
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2020 b/test/confs/2020
deleted file mode 100644
index 7bde46415..000000000
--- a/test/confs/2020
+++ /dev/null
@@ -1,51 +0,0 @@
-# Exim test configuration 2020
-
-SERVER=
-
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-
-# ----- Main settings -----
-
-acl_smtp_rcpt = accept
-
-log_selector = +tls_peerdn
-
-queue_only
-queue_run_in_order
-
-tls_advertise_hosts = *
-
-
-# ----- Routers -----
-
-begin routers
-
-abc:
-  driver = accept
-  transport = t1
-
-
-# ----- Transports -----
-
-begin transports
-
-t1:
-  driver = smtp
-  hosts = 127.0.0.1
-  allow_localhost
-  port = PORT_D
-
-
-# ----- Retry -----
-
-begin retry
-
-* * F,1d,1d
-
-# End
diff --git a/test/confs/2020 b/test/confs/2020
new file mode 120000
index 000000000..5ec250ecd
--- /dev/null
+++ b/test/confs/2020
@@ -0,0 +1 @@
+2120
\ No newline at end of file
diff --git a/test/confs/2021 b/test/confs/2021
index 97b98d6ad..ccd201719 100644
--- a/test/confs/2021
+++ b/test/confs/2021
@@ -3,14 +3,9 @@
 REQUIRE=#
 TRYCLEAR=#
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2022 b/test/confs/2022
index d11dd5e9e..47892ceb5 100644
--- a/test/confs/2022
+++ b/test/confs/2022
@@ -1,12 +1,8 @@
 # Exim test configuration 2022
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2023 b/test/confs/2023
index 849840404..9f1630929 100644
--- a/test/confs/2023
+++ b/test/confs/2023
@@ -1,12 +1,8 @@
 # Exim test configuration 2023
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2024 b/test/confs/2024
index 438899444..64502d56b 100644
--- a/test/confs/2024
+++ b/test/confs/2024
@@ -3,13 +3,9 @@
 CERT=DIR/aux-fixed/cert1
 TVC=/dev/null
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2025 b/test/confs/2025
index ccb56dcb2..feaa815a1 100644
--- a/test/confs/2025
+++ b/test/confs/2025
@@ -2,13 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2026 b/test/confs/2026
index 38900bb53..7da11a528 100644
--- a/test/confs/2026
+++ b/test/confs/2026
@@ -1,6 +1,7 @@
 # Exim test configuration 2026
 
 exim_path = EXIM_PATH
+keep_environment =
 host_lookup_order = bydns
 primary_hostname = myhost.test.ex
 spool_directory = DIR/spool
diff --git a/test/confs/2027 b/test/confs/2027
index bd15ea944..cc47218fb 100644
--- a/test/confs/2027
+++ b/test/confs/2027
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2028 b/test/confs/2028
index 38c14f249..68ca077be 100644
--- a/test/confs/2028
+++ b/test/confs/2028
@@ -2,13 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2029 b/test/confs/2029
index b98cf7348..40c56f0c2 100644
--- a/test/confs/2029
+++ b/test/confs/2029
@@ -1,12 +1,8 @@
 # Exim test configuration 2029
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2030 b/test/confs/2030
index e89e1c99f..e2ee0e223 100644
--- a/test/confs/2030
+++ b/test/confs/2030
@@ -3,14 +3,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
 
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/2031 b/test/confs/2031
index 5791316c1..38713735b 100644
--- a/test/confs/2031
+++ b/test/confs/2031
@@ -3,14 +3,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
 
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/2032 b/test/confs/2032
index 002c31391..9f69adca2 100644
--- a/test/confs/2032
+++ b/test/confs/2032
@@ -1,12 +1,8 @@
 # Exim test configuration 2032 (close copy of 2002)
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2033 b/test/confs/2033
index 9ed671172..73dcde61e 100644
--- a/test/confs/2033
+++ b/test/confs/2033
@@ -3,13 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 FX = DIR/aux-fixed
 S1 = FX/exim-ca/example.com/server1.example.com
diff --git a/test/confs/2034 b/test/confs/2034
new file mode 120000
index 000000000..6d0f5c2f1
--- /dev/null
+++ b/test/confs/2034
@@ -0,0 +1 @@
+2006
\ No newline at end of file
diff --git a/test/confs/2051 b/test/confs/2051
new file mode 120000
index 000000000..cde0a73c4
--- /dev/null
+++ b/test/confs/2051
@@ -0,0 +1 @@
+2151
\ No newline at end of file
diff --git a/test/confs/2052 b/test/confs/2052
new file mode 100644
index 000000000..fd1f4d1c0
--- /dev/null
+++ b/test/confs/2052
@@ -0,0 +1,67 @@
+# Exim test configuration 2052
+# as per 2000 but with TCP Fast Open
+
+SERVER=
+
+.include DIR/aux-var/tls_conf_prefix
+
+primary_hostname = myhost.test.ex
+
+# ----- Main settings -----
+
+acl_smtp_rcpt = accept
+
+log_selector =  +tls_peerdn
+
+queue_only
+queue_run_in_order
+
+tls_advertise_hosts = *
+# needed to force generation
+tls_dhparam = historic
+
+# Set certificate only if server
+
+tls_certificate = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
+tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
+
+tls_verify_hosts = *
+tls_verify_certificates = ${if eq {SERVER}{server}{DIR/aux-fixed/cert2}fail}
+
+
+# ----- Routers -----
+
+begin routers
+
+client:
+  driver = accept
+  condition = ${if eq {SERVER}{server}{no}{yes}}
+  retry_use_local_part
+  transport = send_to_server
+
+
+# ----- Transports -----
+
+begin transports
+
+send_to_server:
+  driver = smtp
+  allow_localhost
+  hosts = 127.0.0.1
+  port = PORT_D
+  hosts_try_fastopen = *
+  tls_certificate = DIR/aux-fixed/cert2
+  tls_privatekey = DIR/aux-fixed/cert2
+  tls_verify_certificates = DIR/aux-fixed/cert2
+  tls_try_verify_hosts =
+
+
+# ----- Retry -----
+
+
+begin retry
+
+* * F,5d,10s
+
+
+# End
diff --git a/test/confs/2090 b/test/confs/2090
new file mode 120000
index 000000000..1bb987150
--- /dev/null
+++ b/test/confs/2090
@@ -0,0 +1 @@
+0900
\ No newline at end of file
diff --git a/test/confs/2091 b/test/confs/2091
new file mode 120000
index 000000000..1bb987150
--- /dev/null
+++ b/test/confs/2091
@@ -0,0 +1 @@
+0900
\ No newline at end of file
diff --git a/test/confs/2100 b/test/confs/2100
index dc8ec61ac..bce339b19 100644
--- a/test/confs/2100
+++ b/test/confs/2100
@@ -2,14 +2,13 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
+.ifdef _HAVE_TLS
+# that was purely to trigger the lazy-create of builtin macros
+.endif
 # ----- Main settings -----
 
 acl_smtp_rcpt = accept
diff --git a/test/confs/2101 b/test/confs/2101
index a8de8c06d..a0e1fe46f 100644
--- a/test/confs/2101
+++ b/test/confs/2101
@@ -3,13 +3,9 @@
 OPTION=
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2102 b/test/confs/2102
index 1de92e962..4223430a3 100644
--- a/test/confs/2102
+++ b/test/confs/2102
@@ -1,13 +1,9 @@
 # Exim test configuration 2102
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
+
 timezone = UTC
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/2103 b/test/confs/2103
index a9bc0ea7f..a9daf05b7 100644
--- a/test/confs/2103
+++ b/test/confs/2103
@@ -1,12 +1,8 @@
 # Exim test configuration 2103
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2104 b/test/confs/2104
index 610a5b722..7cd35f0e2 100644
--- a/test/confs/2104
+++ b/test/confs/2104
@@ -1,12 +1,8 @@
 # Exim test configuration 2104
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2105 b/test/confs/2105
index ec364a3c3..c77c1547f 100644
--- a/test/confs/2105
+++ b/test/confs/2105
@@ -1,12 +1,8 @@
 # Exim test configuration 2105
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2106 b/test/confs/2106
index d8c685eb5..56d8d6a3d 100644
--- a/test/confs/2106
+++ b/test/confs/2106
@@ -1,12 +1,8 @@
 # Exim test configuration 2106
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2107 b/test/confs/2107
index b1e1967b7..9487445cc 100644
--- a/test/confs/2107
+++ b/test/confs/2107
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2108 b/test/confs/2108
index 0388d0cc6..f09213be9 100644
--- a/test/confs/2108
+++ b/test/confs/2108
@@ -2,14 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
 
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/2109 b/test/confs/2109
index 3e151936f..8703d1967 100644
--- a/test/confs/2109
+++ b/test/confs/2109
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2110 b/test/confs/2110
index db6864863..72754a6d9 100644
--- a/test/confs/2110
+++ b/test/confs/2110
@@ -3,13 +3,9 @@
 SERVER =
 HOSTS = 127.0.0.1 : HOSTIPV4
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2111 b/test/confs/2111
index 9abfc7a1a..0d99a23bc 100644
--- a/test/confs/2111
+++ b/test/confs/2111
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
@@ -52,6 +48,6 @@ send_to_server:
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_require_ciphers = IDEA-CBC-MD5 \
-    ${if eq{$host_address}{127.0.0.1}{:DES-CBC3-SHA:RSA_ARCFOUR_SHA}}
+    ${if eq{$host_address}{127.0.0.1}{:AES256-SHA:RSA_ARCFOUR_SHA}}
 
 # End
diff --git a/test/confs/2112 b/test/confs/2112
index 18b2fd780..aab264820 100644
--- a/test/confs/2112
+++ b/test/confs/2112
@@ -3,13 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 FX = DIR/aux-fixed
 S1 = FX/exim-ca/example.com/server1.example.com
diff --git a/test/confs/2113 b/test/confs/2113
index d9ac50447..f2c49c9b8 100644
--- a/test/confs/2113
+++ b/test/confs/2113
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2114 b/test/confs/2114
index a2b1c526f..398e2135d 100644
--- a/test/confs/2114
+++ b/test/confs/2114
@@ -2,13 +2,9 @@
 
 CRL=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2115 b/test/confs/2115
index 8142100aa..ab1f6dcdd 100644
--- a/test/confs/2115
+++ b/test/confs/2115
@@ -1,12 +1,8 @@
 # Exim test configuration 2115
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2116 b/test/confs/2116
index fbfb6dc56..d57d3a112 100644
--- a/test/confs/2116
+++ b/test/confs/2116
@@ -1,12 +1,7 @@
 # Exim test configuration 2116
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/2117 b/test/confs/2117
index 8bf80f2b8..b6a557667 100644
--- a/test/confs/2117
+++ b/test/confs/2117
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2118 b/test/confs/2118
index 7ddc16140..d3e77201d 100644
--- a/test/confs/2118
+++ b/test/confs/2118
@@ -1,12 +1,8 @@
 # Exim test configuration 2118
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2119 b/test/confs/2119
index 7d382d9ac..26ae4c1bc 100644
--- a/test/confs/2119
+++ b/test/confs/2119
@@ -1,12 +1,8 @@
 # Exim test configuration 2119
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2120 b/test/confs/2120
index c0225e819..1288d7f12 100644
--- a/test/confs/2120
+++ b/test/confs/2120
@@ -2,13 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
+.include DIR/aux-var/tls_conf_prefix
+
+primary_hostname = thishost.test.ex
 
 # ----- Main settings -----
 
@@ -37,7 +33,7 @@ begin transports
 
 t1:
   driver = smtp
-  hosts = 127.0.0.1
+  hosts = thishost.test.ex
   allow_localhost
   port = PORT_D
 
diff --git a/test/confs/2121 b/test/confs/2121
index c9a28c987..573ea379a 100644
--- a/test/confs/2121
+++ b/test/confs/2121
@@ -3,14 +3,9 @@
 REQUIRE=#
 TRYCLEAR=#
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2122 b/test/confs/2122
index 510efdaab..154603d5d 100644
--- a/test/confs/2122
+++ b/test/confs/2122
@@ -1,12 +1,8 @@
 # Exim test configuration 2122
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2123 b/test/confs/2123
index 6170caaa8..8c89e9aae 100644
--- a/test/confs/2123
+++ b/test/confs/2123
@@ -1,12 +1,8 @@
 # Exim test configuration 2123
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2124 b/test/confs/2124
index 930f4b6d5..70d7435a5 100644
--- a/test/confs/2124
+++ b/test/confs/2124
@@ -3,13 +3,9 @@
 CERT=DIR/aux-fixed/cert1
 TVC=/dev/null
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2125 b/test/confs/2125
index 20f8e1dfa..be2fe1be3 100644
--- a/test/confs/2125
+++ b/test/confs/2125
@@ -2,13 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
@@ -22,7 +18,7 @@ queue_run_in_order
 tls_advertise_hosts = *
 
 tls_require_ciphers = ${if eq{$sender_host_address}{HOSTIPV4}\
-                      {AES}{!AES:3DES}}
+                      {AES256}{AES128}}
 
 # Set certificate only if server
 
@@ -50,7 +46,7 @@ send_to_server:
   allow_localhost
   hosts = HOSTIPV4 : 127.0.0.1
   hosts_require_tls = HOSTIPV4
-  tls_require_ciphers = DES-CBC3-SHA
+  tls_require_ciphers = AES128-SHA
   port = PORT_D
   tls_try_verify_hosts = :
 
diff --git a/test/confs/2126 b/test/confs/2126
index 3ea1d9c47..9f0af7cf6 100644
--- a/test/confs/2126
+++ b/test/confs/2126
@@ -2,13 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2127 b/test/confs/2127
index 786134cae..b177444e9 100644
--- a/test/confs/2127
+++ b/test/confs/2127
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2128 b/test/confs/2128
index 3aa44e8ce..ecdb68be0 100644
--- a/test/confs/2128
+++ b/test/confs/2128
@@ -2,13 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2130 b/test/confs/2130
index 6354b7cc3..379d2c98a 100644
--- a/test/confs/2130
+++ b/test/confs/2130
@@ -3,14 +3,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
 
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/2131 b/test/confs/2131
index 3d83099d1..43db2ac1c 100644
--- a/test/confs/2131
+++ b/test/confs/2131
@@ -3,14 +3,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
 
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/2132 b/test/confs/2132
index 11dc3ce21..7fb561bdc 100644
--- a/test/confs/2132
+++ b/test/confs/2132
@@ -1,12 +1,8 @@
 # Exim test configuration 2132 (close copy of 2102)
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2133 b/test/confs/2133
index 064a97acf..ff4350809 100644
--- a/test/confs/2133
+++ b/test/confs/2133
@@ -3,13 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 FX = DIR/aux-fixed
 S1 = FX/exim-ca/example.com/server1.example.com
diff --git a/test/confs/2149 b/test/confs/2149
index 1d649e952..072e8e438 100644
--- a/test/confs/2149
+++ b/test/confs/2149
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2150 b/test/confs/2150
index 3b27f41c9..f6b5263fa 100644
--- a/test/confs/2150
+++ b/test/confs/2150
@@ -1,12 +1,8 @@
 # Exim test configuration 2150
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/2151 b/test/confs/2151
new file mode 100644
index 000000000..f64cdd50e
--- /dev/null
+++ b/test/confs/2151
@@ -0,0 +1,43 @@
+# Exim test configuration 2151
+
+.include DIR/aux-var/tls_conf_prefix
+
+
+# ----- Main settings -----
+
+acl_smtp_rcpt = acl_rcpt
+callout_random_local_part = $primary_hostname--testing
+trusted_users = CALLER
+
+tls_advertise_hosts = 127.0.0.1 : HOSTIPV4
+
+tls_certificate = DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
+tls_privatekey = DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
+
+# ----- ACL -----
+
+begin acl
+
+acl_rcpt:
+  accept   verify  = recipient/callout=1s,use_sender
+
+# ----- Routers -----
+
+begin routers
+
+callout:
+  driver = manualroute
+  transport = smtp
+  route_data = 127.0.0.1
+  self = send
+
+
+# ----- Transports -----
+
+begin transports
+
+smtp:
+  driver = smtp
+  port = PORT_S
+
+# End
diff --git a/test/confs/2152 b/test/confs/2152
new file mode 100644
index 000000000..a8b6c15f1
--- /dev/null
+++ b/test/confs/2152
@@ -0,0 +1,68 @@
+# Exim test configuration 2152
+# as per 2100 but with TCP Fast Open
+
+SERVER=
+
+.include DIR/aux-var/tls_conf_prefix
+
+primary_hostname = myhost.test.ex
+
+.ifdef _HAVE_TLS
+# that was purely to trigger the lazy-create of builtin macros
+.endif
+# ----- Main settings -----
+
+acl_smtp_rcpt = accept
+
+log_selector =  +tls_peerdn
+
+queue_only
+queue_run_in_order
+
+tls_advertise_hosts = *
+
+# Set certificate only if server
+
+tls_certificate = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
+tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
+
+tls_verify_hosts = *
+tls_verify_certificates = ${if eq {SERVER}{server}{DIR/aux-fixed/cert2}fail}
+
+
+# ----- Routers -----
+
+begin routers
+
+client:
+  driver = accept
+  condition = ${if eq {SERVER}{server}{no}{yes}}
+  retry_use_local_part
+  transport = send_to_server
+
+
+# ----- Transports -----
+
+begin transports
+
+send_to_server:
+  driver = smtp
+  allow_localhost
+  hosts = 127.0.0.1
+  port = PORT_D
+  hosts_try_fastopen = *
+  tls_certificate = DIR/aux-fixed/cert2
+  tls_privatekey = DIR/aux-fixed/cert2
+  tls_verify_certificates = DIR/aux-fixed/cert2
+  tls_try_verify_hosts = :
+
+
+# ----- Retry -----
+
+
+begin retry
+
+* * F,5d,10s
+
+
+# End
diff --git a/test/confs/2190 b/test/confs/2190
new file mode 120000
index 000000000..1bb987150
--- /dev/null
+++ b/test/confs/2190
@@ -0,0 +1 @@
+0900
\ No newline at end of file
diff --git a/test/confs/2191 b/test/confs/2191
new file mode 120000
index 000000000..1bb987150
--- /dev/null
+++ b/test/confs/2191
@@ -0,0 +1 @@
+0900
\ No newline at end of file
diff --git a/test/confs/2200 b/test/confs/2200
index c57c8c796..904ccfb18 100644
--- a/test/confs/2200
+++ b/test/confs/2200
@@ -1,14 +1,9 @@
 # Exim test configuration 2200
 # Check for dnsdb cache TTL handling
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2201 b/test/confs/2201
index b60439e29..dce78ed7a 100644
--- a/test/confs/2201
+++ b/test/confs/2201
@@ -1,13 +1,8 @@
 # Exim test configuration 2201
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2202 b/test/confs/2202
index e2cf9d421..825be913e 100644
--- a/test/confs/2202
+++ b/test/confs/2202
@@ -2,14 +2,9 @@
 
 CONNECTCOND=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2250 b/test/confs/2250
index 96513bd23..a355bfcdf 100644
--- a/test/confs/2250
+++ b/test/confs/2250
@@ -1,12 +1,7 @@
 # Exim test configuration 2250
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # End
diff --git a/test/confs/2300 b/test/confs/2300
index d8bc1b26f..bc4f4fbc6 100644
--- a/test/confs/2300
+++ b/test/confs/2300
@@ -1,13 +1,8 @@
 # Exim test configuration 2300
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2400 b/test/confs/2400
index 69ef73c6b..b7ad9a800 100644
--- a/test/confs/2400
+++ b/test/confs/2400
@@ -1,13 +1,8 @@
 # Exim test configuration 2400
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2500 b/test/confs/2500
index 1eabf09e4..72bb374ec 100644
--- a/test/confs/2500
+++ b/test/confs/2500
@@ -1,13 +1,8 @@
 # Exim test configuration 2500
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2501 b/test/confs/2501
index 655a3712d..b485b0102 100644
--- a/test/confs/2501
+++ b/test/confs/2501
@@ -1,13 +1,8 @@
 # Exim test configuration 2501
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2600 b/test/confs/2600
index c84d54fec..566e260f2 100644
--- a/test/confs/2600
+++ b/test/confs/2600
@@ -1,13 +1,8 @@
 # Exim test configuration 2600
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2700 b/test/confs/2700
index bb001681d..34e3b11ea 100644
--- a/test/confs/2700
+++ b/test/confs/2700
@@ -1,13 +1,8 @@
 # Exim test configuration 2700
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/2800 b/test/confs/2800
new file mode 100644
index 000000000..607fcf5c7
--- /dev/null
+++ b/test/confs/2800
@@ -0,0 +1,9 @@
+# Exim test configuration 2800
+
+.include DIR/aux-var/std_conf_prefix
+
+primary_hostname = myhost.test.ex
+
+# ----- Main settings -----
+
+# End
diff --git a/test/confs/3000 b/test/confs/3000
index 80c6019a1..9789808fb 100644
--- a/test/confs/3000
+++ b/test/confs/3000
@@ -1,14 +1,9 @@
 # Exim test configuration 3000
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3001 b/test/confs/3001
index 6e047f440..bc0e7e771 100644
--- a/test/confs/3001
+++ b/test/confs/3001
@@ -1,2 +1,7 @@
+# exim test configuration 3001
+exim_path = EXIM_PATH
 tls_advertise_hosts =
-perl_startup = sub taint_flag { ${^TAINT} ? 'ON' : 'OFF' }
+spool_directory = DIR/spool
+perl_startup = $| = 1; \
+	print "Environment visible in Perl:\n"; \
+	print map { "$_=$ENV{$_}\n" } sort keys %ENV;
diff --git a/test/confs/3002 b/test/confs/3002
index 653d38d04..9b668f002 100644
--- a/test/confs/3002
+++ b/test/confs/3002
@@ -1,3 +1,8 @@
+# exim test configuration 3002
+exim_path = EXIM_PATH
+keep_environment = ^FOO\d : BAR
+add_environment = ADDED1=added1 : ADDED2=added2
 tls_advertise_hosts =
-perl_startup = sub taint_flag { ${^TAINT} ? 'ON' : 'OFF' }
-perl_taintmode = yes
+perl_startup = $| = 1; \
+	print "Environment visible in Perl:\n"; \
+	print map { "$_=$ENV{$_}\n" } sort keys %ENV;
diff --git a/test/confs/3011 b/test/confs/3011
new file mode 100644
index 000000000..f584ff517
--- /dev/null
+++ b/test/confs/3011
@@ -0,0 +1,5 @@
+# exim test configuration 3011
+exim_path = EXIM_PATH
+tls_advertise_hosts =
+spool_directory = DIR/spool
+perl_startup = sub taint_flag { ${^TAINT} ? 'ON' : 'OFF' }
diff --git a/test/confs/3012 b/test/confs/3012
new file mode 100644
index 000000000..505e49f94
--- /dev/null
+++ b/test/confs/3012
@@ -0,0 +1,7 @@
+# exim test configuration 3012
+exim_path = EXIM_PATH
+keep_environment = ^FOO\d : BAR
+add_environment = ADDED1=added1 : ADDED2=added2
+tls_advertise_hosts =
+perl_startup = sub taint_flag { ${^TAINT} ? 'ON' : 'OFF' }
+perl_taintmode = yes
diff --git a/test/confs/3100 b/test/confs/3100
index 3eb114882..9f39fcf53 100644
--- a/test/confs/3100
+++ b/test/confs/3100
@@ -1,14 +1,9 @@
 # Exim test configuration 3100
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3200 b/test/confs/3200
index 105676976..c3cd41aac 100644
--- a/test/confs/3200
+++ b/test/confs/3200
@@ -1,13 +1,8 @@
 # Exim test configuration 3200
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3201 b/test/confs/3201
index 478102c38..0593fac66 100644
--- a/test/confs/3201
+++ b/test/confs/3201
@@ -1,13 +1,8 @@
 # Exim test configuration 3201
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/3202 b/test/confs/3202
index b24085c8c..442f8e85e 100644
--- a/test/confs/3202
+++ b/test/confs/3202
@@ -1,13 +1,8 @@
 # Exim test configuration 3202
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3203 b/test/confs/3203
index affd4078d..2c9d28bf9 100644
--- a/test/confs/3203
+++ b/test/confs/3203
@@ -1,13 +1,8 @@
 # Exim test configuration 3203
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3204 b/test/confs/3204
index c1574aeb4..b3b77be38 100644
--- a/test/confs/3204
+++ b/test/confs/3204
@@ -1,13 +1,8 @@
 # Exim test configuration 3204
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3205 b/test/confs/3205
index c53bca0fd..b5ac52727 100644
--- a/test/confs/3205
+++ b/test/confs/3205
@@ -1,13 +1,8 @@
 # Exim test configuration 3205
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3206 b/test/confs/3206
index 670777b4a..e4085ad6c 100644
--- a/test/confs/3206
+++ b/test/confs/3206
@@ -1,14 +1,9 @@
 # Exim test configuration 3206
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3207 b/test/confs/3207
index ba7446d28..6880dcf90 100644
--- a/test/confs/3207
+++ b/test/confs/3207
@@ -1,14 +1,9 @@
 # Exim test configuration 3207
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3208 b/test/confs/3208
index 015215d8e..46266e4c8 100644
--- a/test/confs/3208
+++ b/test/confs/3208
@@ -1,14 +1,9 @@
 # Exim test configuration 3208
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3209 b/test/confs/3209
index d78fcf3c8..d5a442ddb 100644
--- a/test/confs/3209
+++ b/test/confs/3209
@@ -1,14 +1,9 @@
 # Exim test configuration 3209
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
 qualify_domain = test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3210 b/test/confs/3210
index ffd6a1fbb..61e9f2b36 100644
--- a/test/confs/3210
+++ b/test/confs/3210
@@ -1,13 +1,8 @@
 # Exim test configuration 3210
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3211 b/test/confs/3211
index 063cebc45..96035debd 100644
--- a/test/confs/3211
+++ b/test/confs/3211
@@ -1,13 +1,8 @@
 # Exim test configuration 3211
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3212 b/test/confs/3212
index 35bf4d38b..f52bae994 100644
--- a/test/confs/3212
+++ b/test/confs/3212
@@ -1,13 +1,8 @@
 # Exim test configuration 3212
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3213 b/test/confs/3213
index 5d658e71e..5752f91ed 100644
--- a/test/confs/3213
+++ b/test/confs/3213
@@ -1,13 +1,8 @@
 # Exim test configuration 3213
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3300 b/test/confs/3300
index 2dbf0b67f..792ccc574 100644
--- a/test/confs/3300
+++ b/test/confs/3300
@@ -1,13 +1,8 @@
 # Exim test configuration 3300
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3400 b/test/confs/3400
index cf896819f..6b817c2f4 100644
--- a/test/confs/3400
+++ b/test/confs/3400
@@ -1,13 +1,8 @@
 # Exim test configuration 3400
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3401 b/test/confs/3401
index 058e3f554..afcd48251 100644
--- a/test/confs/3401
+++ b/test/confs/3401
@@ -1,14 +1,9 @@
 # Exim test configuration 3401
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +smtp_mailauth
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/3402 b/test/confs/3402
index 0f35779f0..d22aa99a7 100644
--- a/test/confs/3402
+++ b/test/confs/3402
@@ -1,13 +1,8 @@
 # Exim test configuration 3402
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3403 b/test/confs/3403
index 47827809f..813b3b941 100644
--- a/test/confs/3403
+++ b/test/confs/3403
@@ -1,13 +1,8 @@
 # Exim test configuration 3403
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3404 b/test/confs/3404
index 2a235ed95..a76581de2 100644
--- a/test/confs/3404
+++ b/test/confs/3404
@@ -1,13 +1,8 @@
 # Exim test configuration 3404
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3405 b/test/confs/3405
index 90576fc5e..e9c7b7ea3 100644
--- a/test/confs/3405
+++ b/test/confs/3405
@@ -1,13 +1,8 @@
 # Exim test configuration 3405
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3406 b/test/confs/3406
index b2515ee56..17debde22 100644
--- a/test/confs/3406
+++ b/test/confs/3406
@@ -1,13 +1,8 @@
 # Exim test configuration 3406
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3407 b/test/confs/3407
index 8d8b50b89..11f7659e6 100644
--- a/test/confs/3407
+++ b/test/confs/3407
@@ -2,13 +2,8 @@
 
 OPTION=server_condition = xxx
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/3408 b/test/confs/3408
index 7a28404c4..14f5c6249 100644
--- a/test/confs/3408
+++ b/test/confs/3408
@@ -1,12 +1,7 @@
 # Exim test configuration 3408
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/3409 b/test/confs/3409
index dd3b8d2ed..bfa01a576 100644
--- a/test/confs/3409
+++ b/test/confs/3409
@@ -1,12 +1,7 @@
 # Exim test configuration 3409
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/3410 b/test/confs/3410
index 8beadb7f2..39435d18c 100644
--- a/test/confs/3410
+++ b/test/confs/3410
@@ -1,13 +1,8 @@
 # Exim test configuration 3410
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3411 b/test/confs/3411
index 3f721d797..44feae7bd 100644
--- a/test/confs/3411
+++ b/test/confs/3411
@@ -1,13 +1,8 @@
 # Exim test configuration 3411
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3412 b/test/confs/3412
index 1bdb9d8e2..c0a1c5509 100644
--- a/test/confs/3412
+++ b/test/confs/3412
@@ -1,13 +1,8 @@
 # Exim test configuration 3412
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3413 b/test/confs/3413
index c0eae2022..7329ddccc 100644
--- a/test/confs/3413
+++ b/test/confs/3413
@@ -1,13 +1,8 @@
 # Exim test configuration 3413
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3414 b/test/confs/3414
index 8e0c93c4a..5d0f93c46 100644
--- a/test/confs/3414
+++ b/test/confs/3414
@@ -1,21 +1,23 @@
 # Exim test configuration 3414
 
 ACL=
-S=
+OPT=
 
 exim_path = EXIM_PATH
+keep_environment =
 host_lookup_order = bydns
 primary_hostname = myhost.test.ex
 spool_directory = DIR/spool
 log_file_path = DIR/spool/log/%slog
 gecos_pattern = ""
 gecos_name = CALLER_NAME
+chunking_advertise_hosts =
 tls_advertise_hosts =
 
 # ----- Main settings -----
 
 acl_smtp_mail = mail
-S acl_smtp_mailauth=ACL
+OPT acl_smtp_mailauth=ACL
 
 
 # ----- ACLs -----
diff --git a/test/confs/3415 b/test/confs/3415
index 31503df48..37c7629f5 100644
--- a/test/confs/3415
+++ b/test/confs/3415
@@ -4,14 +4,9 @@ SERVER=
 SUBMISSION_OPTIONS=
 AUTH_ID_DOMAIN=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3416 b/test/confs/3416
index 1888371ac..930a2240f 100644
--- a/test/confs/3416
+++ b/test/confs/3416
@@ -1,14 +1,9 @@
 # Exim test configuration 3416
 # Recipient callout with AUTH
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3450 b/test/confs/3450
index 26a277a98..facc8b8ee 100644
--- a/test/confs/3450
+++ b/test/confs/3450
@@ -1,12 +1,8 @@
 # Exim test configuration 3450
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3451 b/test/confs/3451
index 052469d14..d66253992 100644
--- a/test/confs/3451
+++ b/test/confs/3451
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3452 b/test/confs/3452
index 6e411f521..5971c0804 100644
--- a/test/confs/3452
+++ b/test/confs/3452
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3453 b/test/confs/3453
index 0a2a068a7..8d8a008eb 100644
--- a/test/confs/3453
+++ b/test/confs/3453
@@ -2,13 +2,9 @@
 
 REMEMBER=false
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3454 b/test/confs/3454
index 727a71d86..4561c58f7 100644
--- a/test/confs/3454
+++ b/test/confs/3454
@@ -1,12 +1,8 @@
 # Exim test configuration 3454
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3455 b/test/confs/3455
index cf7caed4f..bfa30b445 100644
--- a/test/confs/3455
+++ b/test/confs/3455
@@ -2,13 +2,9 @@
 
 HOSTS_AVOID_TLS=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3460 b/test/confs/3460
index 59da15cb8..7e104c7c9 100644
--- a/test/confs/3460
+++ b/test/confs/3460
@@ -1,12 +1,8 @@
 # Exim test configuration 3460
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3461 b/test/confs/3461
index c93abddd7..b4843b488 100644
--- a/test/confs/3461
+++ b/test/confs/3461
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3462 b/test/confs/3462
index f21651e5e..33fabbc04 100644
--- a/test/confs/3462
+++ b/test/confs/3462
@@ -2,13 +2,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3463 b/test/confs/3463
index 1933b8a48..ab15af225 100644
--- a/test/confs/3463
+++ b/test/confs/3463
@@ -2,13 +2,9 @@
 
 REMEMBER=false
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3464 b/test/confs/3464
index 79f0df297..eba6aa6eb 100644
--- a/test/confs/3464
+++ b/test/confs/3464
@@ -1,12 +1,8 @@
 # Exim test configuration 3464
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3465 b/test/confs/3465
index 9486f5016..dfe6b9921 100644
--- a/test/confs/3465
+++ b/test/confs/3465
@@ -2,13 +2,9 @@
 
 HOSTS_AVOID_TLS=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/3500 b/test/confs/3500
index 87e57fc88..68cf703be 100644
--- a/test/confs/3500
+++ b/test/confs/3500
@@ -1,13 +1,8 @@
 # Exim test configuration 3500
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3501 b/test/confs/3501
index a596e8f33..c63e76739 100644
--- a/test/confs/3501
+++ b/test/confs/3501
@@ -1,13 +1,8 @@
 # Exim test configuration 3501
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3600 b/test/confs/3600
index 3e491386b..f6d4f8605 100644
--- a/test/confs/3600
+++ b/test/confs/3600
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/3700 b/test/confs/3700
index 1565b5f79..94bd26ebd 100644
--- a/test/confs/3700
+++ b/test/confs/3700
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
 
+primary_hostname = myhost.test.ex
 log_selector = +received_recipients +outgoing_port
 
 # ----- Main settings -----
diff --git a/test/confs/4000 b/test/confs/4000
index f5c2d3961..c8ad7f8aa 100644
--- a/test/confs/4000
+++ b/test/confs/4000
@@ -1,14 +1,9 @@
 # Exim test configuration 4000
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +subject
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 
 # ----- Main settings -----
diff --git a/test/confs/4001 b/test/confs/4001
index 61ad4c927..85e68a587 100644
--- a/test/confs/4001
+++ b/test/confs/4001
@@ -1,14 +1,9 @@
 # Exim test configuration 4001
 # Content-scan: f-protd interface
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 av_scanner = f-protd : localhost4 PORT_S
 
diff --git a/test/confs/4002 b/test/confs/4002
index c7d27b811..dde49c3b2 100644
--- a/test/confs/4002
+++ b/test/confs/4002
@@ -1,15 +1,10 @@
 # Exim test configuration 4002
 # Content-scan: aveserver interface
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +subject
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 av_scanner = aveserver : DIR/eximdir/aveserver_sock
 
diff --git a/test/confs/4003 b/test/confs/4003
index 380e3a474..fbcf3021c 100644
--- a/test/confs/4003
+++ b/test/confs/4003
@@ -1,15 +1,10 @@
 # Exim test configuration 4002
 # Content-scan: fsecure interface
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +subject
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 av_scanner = fsecure : DIR/eximdir/fsec_sock
 
diff --git a/test/confs/4004 b/test/confs/4004
index be674b502..9bc22ce2e 100644
--- a/test/confs/4004
+++ b/test/confs/4004
@@ -1,15 +1,10 @@
 # Exim test configuration 4002
 # Content-scan: sophie interface
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +subject
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 av_scanner = sophie : DIR/eximdir/sophie_sock
 
diff --git a/test/confs/4005 b/test/confs/4005
index cd715d5e6..0ebb2be7b 100644
--- a/test/confs/4005
+++ b/test/confs/4005
@@ -4,15 +4,10 @@
 OPT=
 CONTROL=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +subject
+primary_hostname = myhost.test.ex
 
 #XXX we need an additional test for tcp-connected clamd
 av_scanner = clamd : DIR/eximdir/clam_sock CONTROL
diff --git a/test/confs/4006 b/test/confs/4006
index c3d2a3142..3efca602c 100644
--- a/test/confs/4006
+++ b/test/confs/4006
@@ -1,15 +1,10 @@
 # Exim test configuration 4006
 # Content-scan: avast interface
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +subject
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 av_scanner = avast : DIR/eximdir/avast_sock : OPTION
 
diff --git a/test/confs/4007 b/test/confs/4007
index f0792722b..55bfcfafb 100644
--- a/test/confs/4007
+++ b/test/confs/4007
@@ -1,15 +1,10 @@
 # Exim test configuration 4007
 # Content-scan: cmsline interface
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +subject
-tls_advertise_hosts =
+primary_hostname = myhost.test.ex
 
 av_scanner = cmdline : DIR/aux-fixed/TESTNUM.script -o OPT %s : found in file : ^(\S*)
 
diff --git a/test/confs/4008 b/test/confs/4008
index 463167503..a3bb87f73 100644
--- a/test/confs/4008
+++ b/test/confs/4008
@@ -1,15 +1,10 @@
 # Exim test configuration 4008
 # Content-scan: rspamd interface
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +subject
+primary_hostname = myhost.test.ex
 
 spamd_address = 127.0.0.1 11333 variant=rspamd
 
diff --git a/test/confs/4009 b/test/confs/4009
index 8b86f7ed6..dd21a2183 100644
--- a/test/confs/4009
+++ b/test/confs/4009
@@ -3,15 +3,13 @@
 
 OPT= 127.0.0.1 7833
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 log_selector = +subject
+primary_hostname = myhost.test.ex
+
+# we need to set the sender
+trusted_users = CALLER
 
 spamd_address = OPT
 
diff --git a/test/confs/4010 b/test/confs/4010
index 94dc25b0f..f01baf3cf 100644
--- a/test/confs/4010
+++ b/test/confs/4010
@@ -1,14 +1,9 @@
 # Exim test configuration 0568:  ACL regex=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
 rfc1413_query_timeout = 0s
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/4020 b/test/confs/4020
index acc447718..8dfd46888 100644
--- a/test/confs/4020
+++ b/test/confs/4020
@@ -2,14 +2,9 @@
 
 OPT =
 
-exim_path = EXIM_PATH
-hide host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/4028 b/test/confs/4028
index 3174e7543..4a1f682a9 100644
--- a/test/confs/4028
+++ b/test/confs/4028
@@ -4,13 +4,9 @@
 OPT =
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/4029 b/test/confs/4029
index ae4e71850..467d74d8d 100644
--- a/test/confs/4029
+++ b/test/confs/4029
@@ -4,13 +4,9 @@
 OPT =
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/4100 b/test/confs/4100
index b5d938321..2a45bf908 100644
--- a/test/confs/4100
+++ b/test/confs/4100
@@ -1,12 +1,7 @@
 # Exim test configuration 4100
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/4200 b/test/confs/4200
index 2237b5c99..681319353 100644
--- a/test/confs/4200
+++ b/test/confs/4200
@@ -1,10 +1,6 @@
 # Exim test configuration 4200
 
-exim_path = EXIM_PATH
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
 
 # ----- Main settings -----
 
diff --git a/test/confs/4201 b/test/confs/4201
index 980f1d8fa..e12e13828 100644
--- a/test/confs/4201
+++ b/test/confs/4201
@@ -6,13 +6,8 @@ CONTROL =
 INSERT =
 SUB =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/4211 b/test/confs/4211
index 085fecc72..bcd5a4fd1 100644
--- a/test/confs/4211
+++ b/test/confs/4211
@@ -4,12 +4,7 @@
 OPTION = *
 CONTROL =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
 
 # ----- Main settings -----
 
diff --git a/test/confs/4221 b/test/confs/4221
index 085fecc72..bcd5a4fd1 100644
--- a/test/confs/4221
+++ b/test/confs/4221
@@ -4,12 +4,7 @@
 OPTION = *
 CONTROL =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
 
 # ----- Main settings -----
 
diff --git a/test/confs/4500 b/test/confs/4500
index cb98407cc..bf4f1f6ad 100644
--- a/test/confs/4500
+++ b/test/confs/4500
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/4503 b/test/confs/4503
index ccff509da..47f4b74c9 100644
--- a/test/confs/4503
+++ b/test/confs/4503
@@ -3,14 +3,9 @@
 SERVER=
 OPT=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/4509 b/test/confs/4509
new file mode 120000
index 000000000..1bb987150
--- /dev/null
+++ b/test/confs/4509
@@ -0,0 +1 @@
+0900
\ No newline at end of file
diff --git a/test/confs/4700 b/test/confs/4700
index 6a532b6a0..96f3beac1 100644
--- a/test/confs/4700
+++ b/test/confs/4700
@@ -1,12 +1,7 @@
 # Exim test configuration 0211
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/4800 b/test/confs/4800
index 0fff2b87c..876e81d94 100644
--- a/test/confs/4800
+++ b/test/confs/4800
@@ -1,4 +1,7 @@
+# exim test configuration 4800
+exim_path = EXIM_PATH
 tls_advertise_hosts =
+keep_environment =
 
 begin routers
   dnslookup:
diff --git a/test/confs/4801 b/test/confs/4801
index 26ac21982..9a09b0289 100644
--- a/test/confs/4801
+++ b/test/confs/4801
@@ -1,4 +1,7 @@
+# exim test configuration 4801
+exim_path = EXIM_PATH
 tls_advertise_hosts =
+keep_environment =
 
 begin routers
   dnslookup:
diff --git a/test/confs/4802 b/test/confs/4802
index 0fff2b87c..b37eba738 100644
--- a/test/confs/4802
+++ b/test/confs/4802
@@ -1,3 +1,6 @@
+# exim test configuration 4802
+exim_path = EXIM_PATH
+keep_environment =
 tls_advertise_hosts =
 
 begin routers
diff --git a/test/confs/4803 b/test/confs/4803
index c23d89b6e..bb2afffad 100644
--- a/test/confs/4803
+++ b/test/confs/4803
@@ -1,3 +1,6 @@
+# exim test configuration 4803
+exim_path = EXIM_PATH
+keep_environment =
 tls_advertise_hosts =
 dns_trust_aa = *
 
diff --git a/test/confs/4804 b/test/confs/4804
new file mode 100644
index 000000000..a891d14dc
--- /dev/null
+++ b/test/confs/4804
@@ -0,0 +1,44 @@
+# Exim test configuration 4804
+
+SERVER=
+OPT=
+
+.include DIR/aux-var/std_conf_prefix
+
+timezone = UTC
+primary_hostname = myhost.test.ex
+
+# ----- Main settings -----
+
+acl_smtp_rcpt = accept
+
+log_selector = OPT
+
+# ------ ACL ------
+
+begin acl
+
+# ----- Routers -----
+
+begin routers
+
+server:
+  condition = ${if eq {SERVER}{server} {yes}{no}}
+  driver = redirect
+  data = :blackhole:
+
+client:
+  driver = dnslookup
+  dnssec_request_domains = *
+  self = send
+  transport = send_to_server
+
+# ----- Transports -----
+
+begin transports
+
+send_to_server:
+  driver = smtp
+  port = PORT_D
+
+# End
diff --git a/test/confs/4950 b/test/confs/4950
index 752b66aad..6ddee035e 100644
--- a/test/confs/4950
+++ b/test/confs/4950
@@ -1,12 +1,7 @@
 # Exim test configuration 4950
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5000 b/test/confs/5000
index 2ceeb06a8..e3328c6a1 100644
--- a/test/confs/5000
+++ b/test/confs/5000
@@ -1,13 +1,8 @@
 # Exim test configuration 5000
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5001 b/test/confs/5001
index a5475fd85..db8c7dc1f 100644
--- a/test/confs/5001
+++ b/test/confs/5001
@@ -1,12 +1,7 @@
 # Exim test configuration 5001
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5002 b/test/confs/5002
index 021166431..81edaab2a 100644
--- a/test/confs/5002
+++ b/test/confs/5002
@@ -1,13 +1,8 @@
 # Exim test configuration 5002
 
-exim_path = EXIM_PATH
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5003 b/test/confs/5003
index cdfaec5da..763567326 100644
--- a/test/confs/5003
+++ b/test/confs/5003
@@ -1,12 +1,7 @@
 # Exim test configuration 5003
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5004 b/test/confs/5004
index 3596fabaf..75c4eaef9 100644
--- a/test/confs/5004
+++ b/test/confs/5004
@@ -1,12 +1,7 @@
 # Exim test configuration 5004
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5005 b/test/confs/5005
index 6fa97f152..d5d497a06 100644
--- a/test/confs/5005
+++ b/test/confs/5005
@@ -2,14 +2,9 @@
 
 QUOTA=500
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/5006 b/test/confs/5006
index 107d025dd..385d4fe08 100644
--- a/test/confs/5006
+++ b/test/confs/5006
@@ -1,13 +1,8 @@
 # Exim test configuration 5006
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/5007 b/test/confs/5007
index eab0c2013..98f70ee6d 100644
--- a/test/confs/5007
+++ b/test/confs/5007
@@ -2,14 +2,9 @@
 
 QUOTA=500
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/5008 b/test/confs/5008
index adfbecde3..027ba7a54 100644
--- a/test/confs/5008
+++ b/test/confs/5008
@@ -2,14 +2,9 @@
 
 QUOTA_FILECOUNT=0
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/5009 b/test/confs/5009
index f5983a1cb..a632dd223 100644
--- a/test/confs/5009
+++ b/test/confs/5009
@@ -2,14 +2,9 @@
 
 SUB=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/5050 b/test/confs/5050
index 6bff7fe14..462d7dcf2 100644
--- a/test/confs/5050
+++ b/test/confs/5050
@@ -1,12 +1,7 @@
 # Exim test configuration 5050
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5100 b/test/confs/5100
index 908a021a9..61a371176 100644
--- a/test/confs/5100
+++ b/test/confs/5100
@@ -2,14 +2,9 @@
 
 IGNORE_QUOTA=FALSE
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5101 b/test/confs/5101
index 5de00516c..1dbe3e466 100644
--- a/test/confs/5101
+++ b/test/confs/5101
@@ -1,13 +1,8 @@
 # Exim test configuration 5101
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5102 b/test/confs/5102
index bc33185c7..eaa742b83 100644
--- a/test/confs/5102
+++ b/test/confs/5102
@@ -1,13 +1,8 @@
 # Exim test configuration 5102
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5103 b/test/confs/5103
index d9ed330fa..7212fb30e 100644
--- a/test/confs/5103
+++ b/test/confs/5103
@@ -1,13 +1,8 @@
 # Exim test configuration 5103
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5200 b/test/confs/5200
index a6f70518e..cafd2fb5e 100644
--- a/test/confs/5200
+++ b/test/confs/5200
@@ -1,12 +1,7 @@
 # Exim test configuration 5200
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5201 b/test/confs/5201
index 4fa69d0ce..f273d92fa 100644
--- a/test/confs/5201
+++ b/test/confs/5201
@@ -1,12 +1,7 @@
 # Exim test configuration 5201
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5202 b/test/confs/5202
index 6f5f7e679..19855fff3 100644
--- a/test/confs/5202
+++ b/test/confs/5202
@@ -1,12 +1,7 @@
 # Exim test configuration 5202
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5203 b/test/confs/5203
index 99864f5fa..40f4c8370 100644
--- a/test/confs/5203
+++ b/test/confs/5203
@@ -1,12 +1,7 @@
 # Exim test configuration 5203
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5204 b/test/confs/5204
index 2393a5778..5f379b8f1 100644
--- a/test/confs/5204
+++ b/test/confs/5204
@@ -2,14 +2,9 @@
 
 COMMAND_USER=EXIMUSER
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5205 b/test/confs/5205
index fc32d2bdb..efa2de121 100644
--- a/test/confs/5205
+++ b/test/confs/5205
@@ -1,12 +1,7 @@
 # Exim test configuration 5205
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5206 b/test/confs/5206
index 4f9606596..37e89e65f 100644
--- a/test/confs/5206
+++ b/test/confs/5206
@@ -1,12 +1,7 @@
 # Exim test configuration 5206
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5207 b/test/confs/5207
index 018f1fc7d..bfd32bb3b 100644
--- a/test/confs/5207
+++ b/test/confs/5207
@@ -1,13 +1,8 @@
 # Exim test configuration 5207
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5208 b/test/confs/5208
index 5a6276e46..e32dcfc94 100644
--- a/test/confs/5208
+++ b/test/confs/5208
@@ -3,14 +3,9 @@
 LIST=
 SELF=freeze
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5209 b/test/confs/5209
index 334313bb0..b3df43085 100644
--- a/test/confs/5209
+++ b/test/confs/5209
@@ -1,13 +1,8 @@
 # Exim test configuration 5209
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5300 b/test/confs/5300
index e68f9aaff..1ba89388b 100644
--- a/test/confs/5300
+++ b/test/confs/5300
@@ -2,14 +2,9 @@
 
 ALLOW=true
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5301 b/test/confs/5301
index 0579db202..f727ebca0 100644
--- a/test/confs/5301
+++ b/test/confs/5301
@@ -2,14 +2,9 @@
 
 D6=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5400 b/test/confs/5400
index 2a2d45860..9be13fea6 100644
--- a/test/confs/5400
+++ b/test/confs/5400
@@ -1,15 +1,17 @@
 # Exim test configuration 5400
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+# any options on the cutthrough_delivery contol
+CONTROL=
+
+# optional verify-callout
+OPT=
+
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 log_selector = +received_recipients
+queue_only
 
 # ----- Main settings -----
 
@@ -23,7 +25,9 @@ acl_smtp_rcpt = ar
 begin acl
 
 ar:
-	accept control = cutthrough_delivery
+  accept
+	control = cutthrough_deliveryCONTROL
+	OPT
 	logwrite = rcpt for $local_part@$domain
 
 # ----- Routers -----
@@ -44,6 +48,7 @@ all:
   transport = ${if eq {special_tpt}{$local_part} {smtp2}{smtp}}
   headers_remove = X-hdr-rtr
   headers_add =    X-hdr-rtr-new: $h_X-hdr-rtr:+++
+  errors_to =	   ""
   no_more
 
 
diff --git a/test/confs/5401 b/test/confs/5401
index 3ee414c85..0d93fe5bc 100644
--- a/test/confs/5401
+++ b/test/confs/5401
@@ -1,13 +1,8 @@
 # Exim test configuration 5401
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
@@ -21,7 +16,7 @@ begin acl
 
 acl_rcpt:
     accept	control = cutthrough_delivery
-    		verify = recipient
+    		verify = recipient/callout=use_sender
 
 
 # ----- Routers -----
diff --git a/test/confs/5402 b/test/confs/5402
deleted file mode 120000
index 8f6811b7e..000000000
--- a/test/confs/5402
+++ /dev/null
@@ -1 +0,0 @@
-5400
\ No newline at end of file
diff --git a/test/confs/5402 b/test/confs/5402
new file mode 100644
index 000000000..0984e0cc9
--- /dev/null
+++ b/test/confs/5402
@@ -0,0 +1,47 @@
+# Exim test configuration 5402
+
+.include DIR/aux-var/std_conf_prefix
+
+primary_hostname = myhost.test.ex
+
+# ----- Main settings -----
+
+domainlist local_domains = test.ex : *.test.ex
+
+acl_smtp_rcpt = acl_rcpt
+
+# ----- ACLs -------
+
+begin acl
+
+acl_rcpt:
+.ifdef OPT
+    warn	control = cutthrough_delivery
+.endif
+    accept	verify = recipient/callout=use_sender
+
+
+# ----- Routers -----
+
+begin routers
+
+all:
+  driver = manualroute
+  domains = ! +local_domains
+  route_list = * 127.0.0.1
+  self = send
+  transport = smtp
+  no_more
+
+
+# ----- Transports -----
+
+begin transports
+
+smtp:
+  driver = smtp
+  interface = HOSTIPV4
+  port = PORT_S
+
+
+# End
diff --git a/test/confs/5403 b/test/confs/5403
new file mode 100644
index 000000000..a4576a5aa
--- /dev/null
+++ b/test/confs/5403
@@ -0,0 +1,64 @@
+# Exim test configuration 5403
+
+.include DIR/aux-var/std_conf_prefix
+
+primary_hostname = myhost.test.ex
+
+log_selector = +received_recipients
+
+# ----- Main settings -----
+
+domainlist local_domains = test.ex : *.test.ex
+
+acl_smtp_rcpt = ar
+
+
+# ----- ACLs -----
+
+begin acl
+
+ar:
+  warn	control =	cutthrough_delivery
+	logwrite =	rcpt for $local_part@$domain
+  warn	condition =	${if eq {verify}{$local_part}}
+	verify =	recipient/callout=use_sender
+  accept
+
+# ----- Routers -----
+
+begin routers
+
+dns:
+  driver = dnslookup
+  domains = localhost.test.ex : localhost4.test.ex : thishost.test.ex
+  self = send
+  transport = smtp
+
+all:
+  driver = manualroute
+  domains = ! +local_domains
+  route_list = special.com HOSTIPV4 ; * 127.0.0.1
+  self = send
+  transport = ${if eq {special_tpt}{$local_part} {smtp2}{smtp}}
+  headers_remove = X-hdr-rtr
+  headers_add =    X-hdr-rtr-new: $h_X-hdr-rtr:+++
+  no_more
+
+
+# ----- Transports -----
+
+begin transports
+
+smtp:
+  driver = smtp
+  interface = HOSTIPV4
+  port = PORT_S
+  headers_add =  ${if def:h_X-hdr-rtr {X-hdr-tpt-new: new} {}}
+
+smtp2:
+  driver = smtp
+  interface = HOSTIPV4
+  port = PORT_S
+
+
+# End
diff --git a/test/confs/5404 b/test/confs/5404
new file mode 120000
index 000000000..8f6811b7e
--- /dev/null
+++ b/test/confs/5404
@@ -0,0 +1 @@
+5400
\ No newline at end of file
diff --git a/test/confs/5405 b/test/confs/5405
new file mode 120000
index 000000000..8f6811b7e
--- /dev/null
+++ b/test/confs/5405
@@ -0,0 +1 @@
+5400
\ No newline at end of file
diff --git a/test/confs/5410 b/test/confs/5410
index 735b52932..96ec87496 100644
--- a/test/confs/5410
+++ b/test/confs/5410
@@ -1,12 +1,8 @@
 # Exim test configuration 5410
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/5420 b/test/confs/5420
index f8379c7bd..44a1fdee4 100644
--- a/test/confs/5420
+++ b/test/confs/5420
@@ -1,12 +1,8 @@
 # Exim test configuration 5420
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/5500 b/test/confs/5500
index f1a088d42..1b25be1f8 100644
--- a/test/confs/5500
+++ b/test/confs/5500
@@ -3,14 +3,9 @@
 
 LOG_SELECTOR=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5510 b/test/confs/5510
index b3bddcd1a..ab42b242e 100644
--- a/test/confs/5510
+++ b/test/confs/5510
@@ -3,14 +3,9 @@
 
 LOG_SELECTOR=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5590 b/test/confs/5590
new file mode 120000
index 000000000..1bb987150
--- /dev/null
+++ b/test/confs/5590
@@ -0,0 +1 @@
+0900
\ No newline at end of file
diff --git a/test/confs/5591 b/test/confs/5591
new file mode 120000
index 000000000..1bb987150
--- /dev/null
+++ b/test/confs/5591
@@ -0,0 +1 @@
+0900
\ No newline at end of file
diff --git a/test/confs/5600 b/test/confs/5600
index 2dc1090df..b65a2797e 100644
--- a/test/confs/5600
+++ b/test/confs/5600
@@ -3,13 +3,9 @@
 
 CRL=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = server1.example.com
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
@@ -31,7 +27,7 @@ tls_verify_hosts = HOSTIPV4
 tls_try_verify_hosts = *
 tls_verify_certificates = DIR/aux-fixed/cert2
 tls_crl = CRL
-tls_ocsp_file = OCSP
+tls_ocsp_file = RETURN
 
 
 # ------ ACL ------
diff --git a/test/confs/5601 b/test/confs/5601
index 785f0c64f..3309870a3 100644
--- a/test/confs/5601
+++ b/test/confs/5601
@@ -4,12 +4,14 @@
 SERVER =
 
 exim_path = EXIM_PATH
+keep_environment  = ^EXIM_TESTHARNESS_DISABLE_[O]CSPVALIDITYCHECK$
 host_lookup_order = bydns
-primary_hostname = server1.example.com
 spool_directory = DIR/spool
 log_file_path = DIR/spool/log/SERVER%slog
 gecos_pattern = ""
 gecos_name = CALLER_NAME
+chunking_advertise_hosts =
+primary_hostname = server1.example.com
 
 
 # ----- Main settings -----
@@ -37,7 +39,7 @@ tls_privatekey = ${if eq {SERVER}{server}\
 {DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key}\
 fail}
 
-tls_ocsp_file = OCSP
+tls_ocsp_file = RETURN
 
 
 # ------ ACL ------
diff --git a/test/confs/5610 b/test/confs/5610
new file mode 100644
index 000000000..b65a2797e
--- /dev/null
+++ b/test/confs/5610
@@ -0,0 +1,73 @@
+# Exim test configuration 5600
+# OCSP stapling, server
+
+CRL=
+
+.include DIR/aux-var/tls_conf_prefix
+
+primary_hostname = server1.example.com
+
+# ----- Main settings -----
+
+acl_smtp_connect = check_connect
+acl_smtp_mail = check_mail
+acl_smtp_rcpt = check_recipient
+
+log_selector = +tls_peerdn
+
+queue_only
+queue_run_in_order
+
+tls_advertise_hosts = *
+
+tls_certificate = DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
+tls_privatekey = DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
+
+tls_verify_hosts = HOSTIPV4
+tls_try_verify_hosts = *
+tls_verify_certificates = DIR/aux-fixed/cert2
+tls_crl = CRL
+tls_ocsp_file = RETURN
+
+
+# ------ ACL ------
+
+begin acl
+
+check_connect:
+  accept   logwrite = acl_conn: ocsp in status: $tls_in_ocsp \
+    (${listextract {${eval:$tls_in_ocsp+1}} \
+		{notreq:notresp:vfynotdone:failed:verified}})
+
+check_mail:
+  accept   logwrite = acl_mail: ocsp in status: $tls_in_ocsp \
+    (${listextract {${eval:$tls_in_ocsp+1}} \
+		{notreq:notresp:vfynotdone:failed:verified}})
+
+check_recipient:
+  deny     message = certificate not verified: peerdn=$tls_peerdn
+         ! verify = certificate
+  accept
+
+
+# ----- Routers -----
+
+begin routers
+
+abc:
+  driver = accept
+  retry_use_local_part
+  transport = local_delivery
+
+
+# ----- Transports -----
+
+begin transports
+
+local_delivery:
+  driver = appendfile
+  file = DIR/test-mail/$local_part
+  headers_add = TLS: cipher=$tls_cipher peerdn=$tls_peerdn
+  user = CALLER
+
+# End
diff --git a/test/confs/5611 b/test/confs/5611
new file mode 100644
index 000000000..3309870a3
--- /dev/null
+++ b/test/confs/5611
@@ -0,0 +1,152 @@
+# Exim test configuration 5601
+# OCSP stapling, client
+
+SERVER =
+
+exim_path = EXIM_PATH
+keep_environment  = ^EXIM_TESTHARNESS_DISABLE_[O]CSPVALIDITYCHECK$
+host_lookup_order = bydns
+spool_directory = DIR/spool
+log_file_path = DIR/spool/log/SERVER%slog
+gecos_pattern = ""
+gecos_name = CALLER_NAME
+chunking_advertise_hosts =
+primary_hostname = server1.example.com
+
+
+# ----- Main settings -----
+
+domainlist local_domains = test.ex : *.test.ex
+
+acl_smtp_rcpt = check_recipient
+acl_smtp_data = check_data
+
+log_selector = +tls_peerdn
+remote_max_parallel = 1
+
+tls_advertise_hosts = *
+
+# Set certificate only if server
+
+tls_certificate = ${if eq {SERVER}{server}\
+{DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem}\
+fail\
+}
+
+#{DIR/aux-fixed/exim-ca/example.com/CA/CA.pem}\
+
+tls_privatekey = ${if eq {SERVER}{server}\
+{DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key}\
+fail}
+
+tls_ocsp_file = RETURN
+
+
+# ------ ACL ------
+
+begin acl
+
+check_recipient:
+  accept  domains = +local_domains
+  deny    message = relay not permitted
+
+check_data:
+  warn	  condition   = ${if def:h_X-TLS-out:}
+	  logwrite = client claims: $h_X-TLS-out:
+  accept
+
+# ----- Routers -----
+
+begin routers
+
+client:
+  driver = accept
+  condition = ${if eq {SERVER}{server}{no}{yes}}
+  retry_use_local_part
+  transport = send_to_server${if eq{$local_part}{nostaple}{1} \
+				{${if eq{$local_part}{norequire} {2} \
+				{${if eq{$local_part}{smtps} {4}{3}}} \
+			     }}}
+
+server:
+  driver = redirect
+  data = :blackhole:
+  #retry_use_local_part
+  #transport = local_delivery
+
+
+# ----- Transports -----
+
+begin transports
+
+local_delivery:
+  driver = appendfile
+  file = DIR/test-mail/$local_part
+  headers_add = TLS: cipher=$tls_cipher peerdn=$tls_peerdn
+  user = CALLER
+
+send_to_server1:
+  driver = smtp
+  allow_localhost
+  hosts = HOSTIPV4
+  port = PORT_D
+  tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
+  tls_verify_cert_hostnames =
+  hosts_require_tls = *
+  hosts_request_ocsp = :
+  headers_add = X-TLS-out: ocsp status $tls_out_ocsp \
+    (${listextract {${eval:$tls_out_ocsp+1}} \
+		{notreq:notresp:vfynotdone:failed:verified}})
+
+send_to_server2:
+  driver = smtp
+  allow_localhost
+  hosts = HOSTIPV4
+  port = PORT_D
+  tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
+  tls_verify_cert_hostnames =
+  hosts_require_tls = *
+# note no ocsp mention here
+  headers_add = X-TLS-out: ocsp status $tls_out_ocsp \
+    (${listextract {${eval:$tls_out_ocsp+1}} \
+		{notreq:notresp:vfynotdone:failed:verified}})
+
+send_to_server3:
+  driver = smtp
+  allow_localhost
+  hosts = 127.0.0.1
+  port = PORT_D
+  helo_data = helo.data.changed
+  tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
+  tls_verify_cert_hostnames =
+  hosts_require_tls =  *
+  hosts_require_ocsp = *
+  headers_add = X-TLS-out: ocsp status $tls_out_ocsp \
+    (${listextract {${eval:$tls_out_ocsp+1}} \
+		{notreq:notresp:vfynotdone:failed:verified}})
+
+send_to_server4:
+  driver = smtp
+  allow_localhost
+  hosts = 127.0.0.1
+  port = PORT_D
+  helo_data = helo.data.changed
+  tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
+  tls_verify_cert_hostnames =
+  protocol =           smtps
+  hosts_require_tls =  *
+  hosts_require_ocsp = *
+  headers_add = X-TLS-out: ocsp status $tls_out_ocsp \
+    (${listextract {${eval:$tls_out_ocsp+1}} \
+		{notreq:notresp:vfynotdone:failed:verified}})
+
+
+# ----- Retry -----
+
+
+begin retry
+
+* * F,5d,1s
+
+
+# End
diff --git a/test/confs/5650 b/test/confs/5650
index bf4462be3..ef73220fd 100644
--- a/test/confs/5650
+++ b/test/confs/5650
@@ -3,13 +3,9 @@
 
 CRL=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = server1.example.com
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
@@ -27,7 +23,7 @@ tls_advertise_hosts = *
 tls_certificate = DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
 tls_privatekey = DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
 tls_crl = CRL
-tls_ocsp_file = OCSP
+tls_ocsp_file = OPT
 
 #tls_verify_hosts = HOSTIPV4
 #tls_try_verify_hosts = *
diff --git a/test/confs/5651 b/test/confs/5651
index cffa4107c..5803c3ce9 100644
--- a/test/confs/5651
+++ b/test/confs/5651
@@ -3,14 +3,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = server1.example.com
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
+.include DIR/aux-var/tls_conf_prefix
 
+primary_hostname = server1.example.com
 
 # ----- Main settings -----
 
@@ -34,7 +29,7 @@ tls_privatekey = ${if eq {SERVER}{server}\
 fail}
 
 # from cmdline define
-tls_ocsp_file = OCSP
+tls_ocsp_file = OPT
 
 
 # ------ ACL ------
diff --git a/test/confs/5700 b/test/confs/5700
index db1aa2a6e..031e690b3 100644
--- a/test/confs/5700
+++ b/test/confs/5700
@@ -1,12 +1,7 @@
 # Exim test configuration 5700
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/5710 b/test/confs/5710
index 354d3935b..e61fadc5e 100644
--- a/test/confs/5710
+++ b/test/confs/5710
@@ -3,13 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 timezone = UTC
 
 # ----- Main settings -----
diff --git a/test/confs/5720 b/test/confs/5720
index e2ef60bdd..2de47bd82 100644
--- a/test/confs/5720
+++ b/test/confs/5720
@@ -3,13 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 timezone = UTC
 
 # ----- Main settings -----
diff --git a/test/confs/5730 b/test/confs/5730
index 7ed8ad4b7..625decec7 100644
--- a/test/confs/5730
+++ b/test/confs/5730
@@ -3,13 +3,9 @@
 
 SERVER =
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = server1.example.com
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 
 # ----- Main settings -----
@@ -34,7 +30,7 @@ tls_privatekey = ${if eq {SERVER}{server}\
 fail}
 
 # from cmdline define
-tls_ocsp_file = OCSP
+tls_ocsp_file = OPT
 
 
 # ------ ACL ------
diff --git a/test/confs/5740 b/test/confs/5740
index e20a8b601..ccc907c82 100644
--- a/test/confs/5740
+++ b/test/confs/5740
@@ -4,12 +4,14 @@
 SERVER =
 
 exim_path = EXIM_PATH
+keep_environment = ^EXIM_TESTHARNESS_DISABLE_[O]CSPVALIDITYCHECK$
 host_lookup_order = bydns
-primary_hostname = server1.example.com
 spool_directory = DIR/spool
 log_file_path = DIR/spool/log/SERVER%slog
 gecos_pattern = ""
 gecos_name = CALLER_NAME
+chunking_advertise_hosts =
+primary_hostname = server1.example.com
 
 
 # ----- Main settings -----
@@ -37,7 +39,7 @@ tls_privatekey = ${if eq {SERVER}{server}\
 {DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key}\
 fail}
 
-tls_ocsp_file = OCSP
+tls_ocsp_file = RETURN
 
 
 # ------ ACL ------
diff --git a/test/confs/5800 b/test/confs/5800
index 6d1b1ac52..aa75b21a1 100644
--- a/test/confs/5800
+++ b/test/confs/5800
@@ -1,11 +1,9 @@
 # Exim test configuration 5800
 # DANE common
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/5820 b/test/confs/5820
index 1b487026f..6c2f26ce0 100644
--- a/test/confs/5820
+++ b/test/confs/5820
@@ -3,13 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/5840 b/test/confs/5840
index 4f468a384..ac3578dc9 100644
--- a/test/confs/5840
+++ b/test/confs/5840
@@ -3,13 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
@@ -51,6 +47,7 @@ client:
   dnssec_request_domains = *
   self = send
   transport = send_to_server
+  errors_to = ""
 
 server:
   driver = redirect
diff --git a/test/confs/5860 b/test/confs/5860
index d3f6db3c4..94436c344 100644
--- a/test/confs/5860
+++ b/test/confs/5860
@@ -3,13 +3,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/5900 b/test/confs/5900
new file mode 100644
index 000000000..f5766d49f
--- /dev/null
+++ b/test/confs/5900
@@ -0,0 +1,35 @@
+# Exim test configuration 5900
+
+.include DIR/aux-var/std_conf_prefix
+
+
+# ----- Main settings -----
+
+qualify_domain = test.ex
+
+
+# ----- Routers -----
+
+begin routers
+
+scan:
+   driver = accept
+   transport = scan
+
+
+# ----- Transports -----
+
+begin transports
+
+scan:
+  driver = queuefile
+  directory = DIR/test-mail/subdir
+
+# ----- Retry -----
+
+begin retry
+
+* * F,10m,2d
+
+
+# End
diff --git a/test/confs/5901 b/test/confs/5901
new file mode 100644
index 000000000..5d57c1c73
--- /dev/null
+++ b/test/confs/5901
@@ -0,0 +1,35 @@
+# Exim test configuration 5901
+
+.include DIR/aux-var/std_conf_prefix
+
+
+# ----- Main settings -----
+
+qualify_domain = test.ex
+
+
+# ----- Routers -----
+
+begin routers
+
+scan:
+   driver = accept
+   transport = scan
+
+
+# ----- Transports -----
+
+begin transports
+
+scan:
+  driver = queuefile
+  directory = test-mail/subdir
+
+# ----- Retry -----
+
+begin retry
+
+* * F,10m,2d
+
+
+# End
diff --git a/test/confs/5902 b/test/confs/5902
new file mode 100644
index 000000000..ba4acc29f
--- /dev/null
+++ b/test/confs/5902
@@ -0,0 +1,38 @@
+# Exim test configuration 5902
+
+OPT=
+
+.include DIR/aux-var/std_conf_prefix
+
+
+# ----- Main settings -----
+
+qualify_domain = test.ex
+
+# ----- Routers -----
+
+begin routers
+
+scan:
+   driver = accept
+   condition = ${if eq {OPT}{scan} {y}}
+   transport = scan
+
+local:
+   driver = accept
+   transport = local_delivery
+
+# ----- Transports -----
+
+begin transports
+
+scan:
+  driver = queuefile
+  directory = DIR/scanner
+
+local_delivery:
+  driver = appendfile
+  file = DIR/test-mail/$local_part
+  user = CALLER
+
+# End
diff --git a/test/confs/9000 b/test/confs/9000
index 05512bb0d..eba80b812 100644
--- a/test/confs/9000
+++ b/test/confs/9000
@@ -2,14 +2,10 @@
 
 LDAPSERVERS=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
+keep_environment = LDAPTLS_REQCERT
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/9001 b/test/confs/9001
index 6817dbeb5..0518519b8 100644
--- a/test/confs/9001
+++ b/test/confs/9001
@@ -1,13 +1,8 @@
 # Exim test configuration 9001
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/9100 b/test/confs/9100
index e674784ce..a031f44de 100644
--- a/test/confs/9100
+++ b/test/confs/9100
@@ -1,13 +1,8 @@
 # Exim test configuration 9100
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/9200 b/test/confs/9200
index ee4e41030..04f52a9a0 100644
--- a/test/confs/9200
+++ b/test/confs/9200
@@ -2,14 +2,9 @@
 
 SERVERS=localhost/test/ph10/
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/9300 b/test/confs/9300
index de32e9bc7..086b506c6 100644
--- a/test/confs/9300
+++ b/test/confs/9300
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/9350 b/test/confs/9350
index e312ee609..1ac5ebe5f 100644
--- a/test/confs/9350
+++ b/test/confs/9350
@@ -2,13 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
diff --git a/test/confs/9400 b/test/confs/9400
index 855227b31..66ee61edc 100644
--- a/test/confs/9400
+++ b/test/confs/9400
@@ -1,14 +1,9 @@
 # Exim test configuration 9400
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 trusted_users = CALLER
+primary_hostname = myhost.test.ex
 
 # ----- Main settings -----
 
diff --git a/test/confs/9401 b/test/confs/9401
index b69c844de..a01167ecb 100644
--- a/test/confs/9401
+++ b/test/confs/9401
@@ -1,12 +1,7 @@
 # Exim test configuration 9401
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/9402 b/test/confs/9402
index 7e455d146..6c00f1ee0 100644
--- a/test/confs/9402
+++ b/test/confs/9402
@@ -2,14 +2,9 @@
 
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/9450 b/test/confs/9450
index 4e2464f4c..cc2379c88 100644
--- a/test/confs/9450
+++ b/test/confs/9450
@@ -1,13 +1,8 @@
 # Exim test configuration 9450
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/9900 b/test/confs/9900
index 7537ebd63..c042cd39a 100644
--- a/test/confs/9900
+++ b/test/confs/9900
@@ -1,12 +1,7 @@
 # Exim test configuration 9900
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/confs/9901 b/test/confs/9901
index f4c569ff1..23ea43fef 100644
--- a/test/confs/9901
+++ b/test/confs/9901
@@ -3,14 +3,9 @@
 COM=
 SERVER=
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 # ----- Main settings -----
 
diff --git a/test/confs/9902 b/test/confs/9902
index cabbfd5ec..77dc5a243 100644
--- a/test/confs/9902
+++ b/test/confs/9902
@@ -4,13 +4,9 @@
 
 ORDER=
 
-exim_path = EXIM_PATH
+.include DIR/aux-var/std_conf_prefix
+
 primary_hostname = myhost.test.ex
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
 
 
 # ----- Main settings -----
diff --git a/test/confs/9903 b/test/confs/9903
index d2f0fcb85..7ef2c620a 100644
--- a/test/confs/9903
+++ b/test/confs/9903
@@ -1,12 +1,7 @@
 # Exim test configuration 9903
 
-exim_path = EXIM_PATH
-host_lookup_order = bydns
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
-tls_advertise_hosts =
+.include DIR/aux-var/std_conf_prefix
+
 
 # ----- Main settings -----
 
diff --git a/test/dnszones-src/db.test.ex b/test/dnszones-src/db.test.ex
index cde5b4321..6555ec81d 100644
--- a/test/dnszones-src/db.test.ex
+++ b/test/dnszones-src/db.test.ex
@@ -448,7 +448,7 @@ DNSSEC _1225._tcp.dane256ee TLSA  3 1 1 2bb55f418bb03411a5007cecbfcd3ec1c9440431
 ;
 DNSSEC mxdane256ta          MX  1  dane256ta
 DNSSEC dane256ta            A      HOSTIPV4
-DNSSEC _1225._tcp.dane256ta TLSA 2 0 1 882be5ac06deafdc021a69daa457226153bfde6da7914813b0144b0fd31bf7ae
+DNSSEC _1225._tcp.dane256ta TLSA 2 0 1 87712b46e3c444c9a58edaa9dbe34c26b81cefb658a002b267ee3223fd9219cd
 
 
 ; A multiple-return MX where all TLSA lookups defer
diff --git a/test/lib/Exim/Runtest.pm b/test/lib/Exim/Runtest.pm
new file mode 100644
index 000000000..8d22544bf
--- /dev/null
+++ b/test/lib/Exim/Runtest.pm
@@ -0,0 +1,181 @@
+package Exim::Runtest;
+use 5.010;
+use strict;
+use warnings;
+use File::Basename;
+use IO::Socket::INET;
+use Cwd;
+use Carp;
+
+use Exporter;
+our @ISA = qw(Exporter);
+
+our @EXPORT_OK = qw(mailgroup dynamic_socket exim_binary flavour flavours);
+our %EXPORT_TAGS = (
+    all => \@EXPORT_OK,
+);
+
+use List::Util qw'shuffle';
+
+=head1 NAME
+
+Exim::Runtest - helper functions for the runtest script
+
+=head1 SYNOPSIS
+
+ use Exim::Runtest;
+ my $foo = Exim::Runtest::foo('foo');
+
+=head1 DESCRIPTION
+
+The B<Exim::Runtest> module provides some simple functions
+for the F<runtest> script. No functions are exported yet.
+
+=cut
+
+sub mailgroup {
+    my $group = shift // croak "Need a default group name.";
+
+    croak "Need a group *name*, not a numeric group id."
+        if $group =~ /^\d+$/;
+
+    return $group if getgrnam $group;
+
+    my @groups;
+    setgrent or die "setgrent: $!\n";
+    push @groups, $_ while defined($_ = getgrent);
+    endgrent;
+    return (shuffle @groups)[0];
+}
+
+sub dynamic_socket {
+    my $socket;
+    for (my $port = 1024; $port < 65000; $port++) {
+        $socket = IO::Socket::INET->new(
+            LocalHost => '127.0.0.1',
+            LocalPort => $port,
+            Listen => 10,
+            ReuseAddr => 1,
+        ) and return $socket;
+    }
+    croak 'Can not allocate a free port.';
+}
+
+sub exim_binary {
+
+    # two simple cases, absolute path or relative path and executable
+    if (@_) {
+        return @_ if $_[0] =~ /^\//;
+        return Cwd::abs_path(shift), @_ if -x $_[0];
+    }
+
+    # so we're still here, if the simple approach didn't help.
+
+    # if there is '../exim-snapshot/<build-dir>/exim', use this
+    # if there is '../exim4/<build-dir>/exim', use this
+    # if there is '../exim-*.*/<build-dir>/exim', use the one with the highest version
+    #   4.84 < 4.85RC1 < 4.85RC2 < 4.85 < 4.86RC1 < … < 4.86
+    # if there is '../src/<build-dir>', use this
+    #
+
+    my $prefix = '..';  # was intended for testing.
+
+    # get a list of directories having the "scripts/{os,arch}-type"
+    # scripts
+    my @candidates = grep { -x "$_/scripts/os-type" and -x "$_/scripts/arch-type" }
+        "$prefix/exim-snapshot", "$prefix/exim4", # highest priority
+        (reverse sort {                           # list of exim-*.* directories
+        # split version number from RC number
+        my @a = ($a =~ /(\d+\.\d+)(?:RC(\d+))?/);
+        my @b = ($b =~ /(\d+\.\d+)(?:RC(\d+))?/);
+        # if the versions are not equal, we're fine,
+        # but otherwise we've to compare the RC number, where an
+        # empty RC number is better than a non-empty
+        ($a[0] cmp $b[0]) || (defined $a[1] ? defined $b[1] ? $a[1] cmp $b[1] : -1 : 1)
+        } glob "$prefix/exim-*.*"),
+        "$prefix/src";                       # the "normal" source
+
+    # binaries should be found now depending on the os-type and
+    # arch-type in the directories we got above
+    my @binaries = grep { -x }
+        map { ("$_/exim", "$_/exim4") }
+        map {
+            my $os = `$_/scripts/os-type`;
+            my $arch = `$_/scripts/arch-type`;
+            chomp($os, $arch);
+            "$_/build-$os-$arch" . ($ENV{EXIM_BUILD_SUFFIX} ? ".$ENV{EXIM_BUILD_SUFFIX}" : '');
+        } @candidates;
+
+    return $binaries[0], @_;
+}
+
+sub flavour {
+    my $etc = '/etc';
+
+    if (@_) {
+        croak "do not pass a directory, it's for testing only"
+            unless $ENV{HARNESS_ACTIVE};
+        $etc = shift;
+    }
+
+    if (open(my $f, '<', "$etc/os-release")) {
+        local $_ = join '', <$f>;
+        my ($id) = /^ID="?(.*?)"?\s*$/m;
+        my $version = /^VERSION_ID="?(.*?)"?\s*$/m ? $1 : '';
+        return "$id$version";
+    }
+
+    if (open(my $f, '<', "$etc/debian_version")) {
+        chomp(local $_ = <$f>);
+        $_ = int $_;
+        return "debian$_";
+    }
+
+    undef;
+}
+
+sub flavours {
+    my %h = map { /\.(\S+)$/, 1 }
+            glob('stdout/*.*'), glob('stderr/*.*');
+    return sort keys %h;
+}
+
+1;
+
+__END__
+
+=head1 FUNCTIONS
+
+=over
+
+=item B<mailgroup>(I<$default>)
+
+Check if the mailgroup I<$default> exists. Return the checked
+group name or some other random but existing group.
+
+=item B<dynamic_socket>()
+
+Return a dynamically allocated listener socket in the range
+between 1024 and 65534;
+
+=item ($binary, @argv) = B<exim_binary>(I<@argv>)
+
+Find the Exim binary. Consider the first element of I<@argv>
+and remove it from I<@argv>, if it is an executable binary.
+Otherwise search the binary (while honouring C<EXIM_BUILD_SUFFIX>,
+C<../scripts/os-type> and C<../os-arch>) and return the
+the path to the binary and the unmodified I<@argv>.
+
+=item B<flavour>()
+
+Find a hint for the current flavour (Linux distro). It does so by checking
+typical files in the F</etc> directory.
+
+=item B<flavours>()
+
+Return a list of available flavours. It does so by scanning F<stdout/> and
+F<stderr/> for I<flavour> files (extensions after the numerical prefix.
+
+=back
+
+=cut
diff --git a/test/log/0099 b/test/log/0099
index 4b6439219..13a1916c1 100644
--- a/test/log/0099
+++ b/test/log/0099
@@ -25,4 +25,6 @@
 1999-03-02 09:44:33 10HmbC-0005vi-00 no IP address found for host nonexist.test.ex
 1999-03-02 09:44:33 10HmbC-0005vi-00 == userx@nonexist R=all defer (-32): lookup of host "nonexist.test.ex" failed in all router
 1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss for userx@mxt2.test.ex
-1999-03-02 09:44:33 10HmbD-0005vi-00 == userx@mxt2.test.ex R=bydns defer (-32): all relevant MX records point to non-existent hosts
+1999-03-02 09:44:33 10HmbD-0005vi-00 == userx@mxt2.test.ex R=bydns defer (-1): missing MX, or all MXs point to missing A records, and defer requested
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss for userx@mxnonexist.test.ex
+1999-03-02 09:44:33 10HmbE-0005vi-00 == userx@mxnonexist.test.ex R=bydns defer (-1): missing MX, or all MXs point to missing A records, and defer requested
diff --git a/test/log/0137 b/test/log/0137
index f963fb216..30ee4cdd5 100644
--- a/test/log/0137
+++ b/test/log/0137
@@ -1,19 +1,19 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss T="First"
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=smart T=local_delivery
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss T="Second"
 1999-03-02 09:44:33 10HmaY-0005vi-00 == userx@test.ex R=smart T=local_delivery defer (-9): failed to lock mailbox TESTSUITE/test-mail/userx (lock file)
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@test.ex> R=smart T=local_delivery
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss T="Third"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 == userx@test.ex R=smart T=local_delivery_fcntl defer (-9): failed to lock mailbox TESTSUITE/test-mail/userx (fcntl/flock)
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx <userx@test.ex> R=smart T=local_delivery_fcntl
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss T="Fourth"
 1999-03-02 09:44:33 10HmbA-0005vi-00 == userx@test.ex R=smart T=local_delivery_fcntl_blocking defer (-9): failed to lock mailbox TESTSUITE/test-mail/userx (fcntl/flock)
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmbA-0005vi-00 => userx <userx@test.ex> R=smart T=local_delivery_fcntl_blocking
diff --git a/test/log/0196 b/test/log/0196
index dc36d2697..2922e6197 100644
--- a/test/log/0196
+++ b/test/log/0196
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/0211 b/test/log/0211
index 9a5824674..cbf33c612 100644
--- a/test/log/0211
+++ b/test/log/0211
@@ -28,3 +28,7 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 => CALLER <CALLER@test.ex> F=<> R=all T=local_delivery
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 Test: reject ehlo, then close (late, giving time for HELO)
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbB-0005vi-00 H=localhost4.test.ex [127.0.0.1]: Remote host closed connection in response to HELO the.local.host.name (EHLO response was: 550 You are banned)
+1999-03-02 09:44:33 10HmbB-0005vi-00 == userx@domain1 R=others T=smtp defer (-18) H=localhost4.test.ex [127.0.0.1]: Remote host closed connection in response to HELO the.local.host.name (EHLO response was: 550 You are banned)
diff --git a/test/log/0214 b/test/log/0214
index a8d170186..fe0a673c5 100644
--- a/test/log/0214
+++ b/test/log/0214
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=[127.0.0.1] F=<x@y.x> rejected after DATA: malformed address: ;bad@address;bad@address;bad@add may not follow bad@address: failing address in "To:" header begins: bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address
diff --git a/test/log/0217 b/test/log/0217
index 1328a46db..b3cf93c4b 100644
--- a/test/log/0217
+++ b/test/log/0217
@@ -8,49 +8,49 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 CALLER@test.ex: error ignored
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaZ-0005vi-00 == a@test.ex R=client T=send_to_server defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after RCPT TO:<b@test.ex>
-1999-03-02 09:44:33 10HmaZ-0005vi-00 == b@test.ex R=client T=send_to_server defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after RCPT TO:<b@test.ex>
-1999-03-02 09:44:33 10HmaZ-0005vi-00 == c@test.ex R=client T=send_to_server defer (dd): Connection timed out: SMTP timeout after RCPT TO:<b@test.ex>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 == e@test.ex R=client T=send_to_server defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after RCPT TO:<f@test.ex>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 == f@test.ex R=client T=send_to_server defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after RCPT TO:<f@test.ex>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 == g@test.ex R=client T=send_to_server defer (dd): Connection timed out: SMTP timeout after RCPT TO:<f@test.ex>
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbA-0005vi-00 == a@test.ex R=client T=send_to_server defer (-45) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@test.ex>: 451 Temp error
-1999-03-02 09:44:33 10HmbA-0005vi-00 == b@test.ex R=client T=send_to_server defer (-45) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@test.ex>: 451 Temp error
+1999-03-02 09:44:33 10HmbA-0005vi-00 == h@test.ex R=client T=send_to_server defer (-45) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@test.ex>: 451 Temp error
+1999-03-02 09:44:33 10HmbA-0005vi-00 == i@test.ex R=client T=send_to_server defer (-45) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@test.ex>: 451 Temp error
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbB-0005vi-00 ** a@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@test.ex>: 550 Perm error
-1999-03-02 09:44:33 10HmbB-0005vi-00 ** b@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@test.ex>: 550 Perm error
+1999-03-02 09:44:33 10HmbB-0005vi-00 ** j@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@test.ex>: 550 Perm error
+1999-03-02 09:44:33 10HmbB-0005vi-00 ** k@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@test.ex>: 550 Perm error
 1999-03-02 09:44:33 10HmbC-0005vi-00 <= <> R=10HmbB-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbC-0005vi-00 ** CALLER@test.ex R=bounce: just discard
 1999-03-02 09:44:33 10HmbC-0005vi-00 CALLER@test.ex: error ignored
 1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbD-0005vi-00 == a@test.ex R=client T=send_to_server defer (-44) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<a@test.ex>: 451 Temp error 1
-1999-03-02 09:44:33 10HmbD-0005vi-00 == b@test.ex R=client T=send_to_server defer (-44) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<b@test.ex>: 451 Temp error 2
+1999-03-02 09:44:33 10HmbD-0005vi-00 == l@test.ex R=client T=send_to_server defer (-44) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<l@test.ex>: 451 Temp error 1
+1999-03-02 09:44:33 10HmbD-0005vi-00 == m@test.ex R=client T=send_to_server defer (-44) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<m@test.ex>: 451 Temp error 2
 1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbE-0005vi-00 ** a@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<a@test.ex>: 551 Perm error 1
-1999-03-02 09:44:33 10HmbE-0005vi-00 ** b@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<b@test.ex>: 551 Perm error 2
+1999-03-02 09:44:33 10HmbE-0005vi-00 ** n@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<n@test.ex>: 551 Perm error 1
+1999-03-02 09:44:33 10HmbE-0005vi-00 ** o@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<o@test.ex>: 551 Perm error 2
 1999-03-02 09:44:33 10HmbF-0005vi-00 <= <> R=10HmbE-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbF-0005vi-00 ** CALLER@test.ex R=bounce: just discard
 1999-03-02 09:44:33 10HmbF-0005vi-00 CALLER@test.ex: error ignored
 1999-03-02 09:44:33 10HmbF-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbG-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbG-0005vi-00 == a@test.ex R=client T=send_to_server defer (-44) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<a@test.ex>: 451 Temp error 1
-1999-03-02 09:44:33 10HmbG-0005vi-00 ** b@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<b@test.ex>: 551 Perm error 2
+1999-03-02 09:44:33 10HmbG-0005vi-00 == p@test.ex R=client T=send_to_server defer (-44) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<p@test.ex>: 451 Temp error 1
+1999-03-02 09:44:33 10HmbG-0005vi-00 ** q@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<q@test.ex>: 551 Perm error 2
 1999-03-02 09:44:33 10HmbH-0005vi-00 <= <> R=10HmbG-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbH-0005vi-00 ** CALLER@test.ex R=bounce: just discard
 1999-03-02 09:44:33 10HmbH-0005vi-00 CALLER@test.ex: error ignored
 1999-03-02 09:44:33 10HmbH-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbI-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbI-0005vi-00 ** a@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 503 Sorry perm data error
-1999-03-02 09:44:33 10HmbI-0005vi-00 ** b@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 503 Sorry perm data error
+1999-03-02 09:44:33 10HmbI-0005vi-00 ** r@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 503 Sorry perm data error
+1999-03-02 09:44:33 10HmbI-0005vi-00 ** s@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 503 Sorry perm data error
 1999-03-02 09:44:33 10HmbJ-0005vi-00 <= <> R=10HmbI-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbJ-0005vi-00 ** CALLER@test.ex R=bounce: just discard
 1999-03-02 09:44:33 10HmbJ-0005vi-00 CALLER@test.ex: error ignored
 1999-03-02 09:44:33 10HmbJ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbI-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbK-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbK-0005vi-00 == a@test.ex R=client T=send_to_server defer (-46) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 403 Sorry temp data error
-1999-03-02 09:44:33 10HmbK-0005vi-00 == b@test.ex R=client T=send_to_server defer (-46) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 403 Sorry temp data error
+1999-03-02 09:44:33 10HmbK-0005vi-00 == t@test.ex R=client T=send_to_server defer (-46) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 403 Sorry temp data error
+1999-03-02 09:44:33 10HmbK-0005vi-00 == u@test.ex R=client T=send_to_server defer (-46) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 403 Sorry temp data error
 1999-03-02 09:44:33 10HmbL-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 10HmbL-0005vi-00 == yes@test.ex R=client T=send_to_server defer (-46) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 403 Sorry temp data error
 1999-03-02 09:44:33 10HmbL-0005vi-00 ** n00@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<n00@test.ex>: 550 NO
@@ -258,12 +258,12 @@
 1999-03-02 09:44:33 10HmbM-0005vi-00 CALLER@test.ex: error ignored
 1999-03-02 09:44:33 10HmbM-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbN-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbN-0005vi-00 H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to RCPT TO:<c@test.ex>
-1999-03-02 09:44:33 10HmbN-0005vi-00 == a@test.ex R=client T=send_to_server defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to RCPT TO:<c@test.ex>
+1999-03-02 09:44:33 10HmbN-0005vi-00 H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to pipelined RCPT TO:<c@test.ex>
+1999-03-02 09:44:33 10HmbN-0005vi-00 == a@test.ex R=client T=send_to_server defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to pipelined RCPT TO:<c@test.ex>
 1999-03-02 09:44:33 10HmbN-0005vi-00 ** b@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<b@test.ex>: 550 NO
-1999-03-02 09:44:33 10HmbN-0005vi-00 == c@test.ex R=client T=send_to_server defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to RCPT TO:<c@test.ex>
-1999-03-02 09:44:33 10HmbN-0005vi-00 == d@test.ex R=client T=send_to_server defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to RCPT TO:<c@test.ex>
-1999-03-02 09:44:33 10HmbN-0005vi-00 == e@test.ex R=client T=send_to_server defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to RCPT TO:<c@test.ex>
+1999-03-02 09:44:33 10HmbN-0005vi-00 == c@test.ex R=client T=send_to_server defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to pipelined RCPT TO:<c@test.ex>
+1999-03-02 09:44:33 10HmbN-0005vi-00 == d@test.ex R=client T=send_to_server defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to pipelined RCPT TO:<c@test.ex>
+1999-03-02 09:44:33 10HmbN-0005vi-00 == e@test.ex R=client T=send_to_server defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to pipelined RCPT TO:<c@test.ex>
 1999-03-02 09:44:33 10HmbO-0005vi-00 <= <> R=10HmbN-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbO-0005vi-00 ** CALLER@test.ex R=bounce: just discard
 1999-03-02 09:44:33 10HmbO-0005vi-00 CALLER@test.ex: error ignored
diff --git a/test/log/0218 b/test/log/0218
index 4aac50dab..bdbd4141f 100644
--- a/test/log/0218
+++ b/test/log/0218
@@ -9,7 +9,7 @@
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qq
-1999-03-02 09:44:33 10HmaZ-0005vi-00 ** a@test.ex F=<CALLER@test.ex> R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@test.ex>: 550 NO
+1999-03-02 09:44:33 10HmaZ-0005vi-00 ** a@test.ex F=<CALLER@test.ex> R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@test.ex>: 550 NO
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= <> R=10HmaZ-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbA-0005vi-00 H=127.0.0.1 [127.0.0.1] Connection refused
diff --git a/test/log/0282 b/test/log/0282
index 0739b61ed..0f71226c4 100644
--- a/test/log/0282
+++ b/test/log/0282
@@ -1,9 +1,11 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on [127.0.0.1]:1225 [127.0.0.1]:1226 [ip4.ip4.ip4.ip4]:1227
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1]:1111 I=[127.0.0.1]:1225 P=esmtp S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1]:1112 I=[127.0.0.1]:1226 P=esmtp S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=all T=local_delivery
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@test.ex> R=all T=local_delivery
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on [127.0.0.1]:1225 [127.0.0.1]:1226 [ip4.ip4.ip4.ip4]:1227
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1]:1111 I=[127.0.0.1]:1225 P=esmtp S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1]:1112 I=[127.0.0.1]:1226 P=esmtp S=sss
diff --git a/test/log/0287 b/test/log/0287
index 5f49b81e7..3521d8ce2 100644
--- a/test/log/0287
+++ b/test/log/0287
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 ETRN one received from (rhu.barb) [127.0.0.1]
 1999-03-02 09:44:33 ETRN one received from (rhu.barb) [127.0.0.1]
diff --git a/test/log/0300 b/test/log/0300
index 1008e4be4..036ef159c 100644
--- a/test/log/0300
+++ b/test/log/0300
@@ -1,13 +1,15 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "ehlo abcd" H=[127.0.0.1] next input="mail from:<userx@test.ex>\r\n"
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "ehlo abcd" H=[127.0.0.1] next input="mail fr<suppressed>
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(abcd) [127.0.0.1] P=esmtp S=sss
 1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=r1
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(abcd) [127.0.0.1] next input="the message\r\nsecond line\r\n"
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "mail from:<userx@test.ex>" H=(abcd) [127.0.0.1] next input="rcpt to:<userx@test.ex>\r\n"
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "mail from:<userx@test.ex>" H=(abcd) [ip4.ip4.ip4.ip4] next input="rcpt to:<userx@test.ex>\r\n"
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "junk1" H=[ip4.ip4.ip4.ip4] next input="junk2\r\n"
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "rset" H=(abcd) [ip4.ip4.ip4.ip4] next input="quit\r\n"
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(abcd) [127.0.0.1] next input="the mes<suppressed>
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "mail from:<userx@test.ex>" H=(abcd) [127.0.0.1] next input="rcpt to<suppressed>
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "mail from:<userx@test.ex>" H=(abcd) [ip4.ip4.ip4.ip4] next input="rcpt to<suppressed>
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "junk1" H=[ip4.ip4.ip4.ip4] next input="junk2\r<suppressed>
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "rset" H=(abcd) [ip4.ip4.ip4.ip4] next input="quit\r\<suppressed>
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= userx@test.ex H=(dis.able) [127.0.0.1] P=esmtp S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r1
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/0301 b/test/log/0301
index fa5ac5894..3d28c21c9 100644
--- a/test/log/0301
+++ b/test/log/0301
@@ -1,4 +1,6 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(abcd) [127.0.0.1] P=esmtp S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= userx@test.ex H=(abcd) [127.0.0.1] P=esmtp S=sss
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(en.force) [127.0.0.1] next input="the message\r\n"
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(en.force) [127.0.0.1] next input="the mes<suppressed>
diff --git a/test/log/0314 b/test/log/0314
new file mode 100644
index 000000000..90d3e94e4
--- /dev/null
+++ b/test/log/0314
@@ -0,0 +1,5 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 refused connection from [127.0.0.1] (host_reject_connection)
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/0322 b/test/log/0322
index 0c45cc5d2..f76f0695b 100644
--- a/test/log/0322
+++ b/test/log/0322
@@ -7,26 +7,26 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaZ-0005vi-00 H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to RCPT TO:<x@test.ex>
-1999-03-02 09:44:33 10HmaZ-0005vi-00 == x@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to RCPT TO:<x@test.ex>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to pipelined RCPT TO:<x@test.ex>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 == x@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to pipelined RCPT TO:<x@test.ex>
 1999-03-02 09:44:33 10HmaZ-0005vi-00 ** x@test.ex: retry timeout exceeded
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= <> R=10HmaZ-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <CALLER@myhost.test.ex> R=null
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbB-0005vi-00 H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to MAIL FROM:<CALLER@myhost.test.ex>
-1999-03-02 09:44:33 10HmbB-0005vi-00 == x@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to MAIL FROM:<CALLER@myhost.test.ex>
+1999-03-02 09:44:33 10HmbB-0005vi-00 H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to pipelined MAIL FROM:<CALLER@myhost.test.ex>
+1999-03-02 09:44:33 10HmbB-0005vi-00 == x@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to pipelined MAIL FROM:<CALLER@myhost.test.ex>
 1999-03-02 09:44:33 10HmbB-0005vi-00 ** x@test.ex: retry timeout exceeded
 1999-03-02 09:44:33 10HmbC-0005vi-00 <= <> R=10HmbB-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <CALLER@myhost.test.ex> R=null
 1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbD-0005vi-00 H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to RCPT TO:<y@test.ex>
-1999-03-02 09:44:33 10HmbD-0005vi-00 == x@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to RCPT TO:<y@test.ex>
-1999-03-02 09:44:33 10HmbD-0005vi-00 == y@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to RCPT TO:<y@test.ex>
-1999-03-02 09:44:33 10HmbD-0005vi-00 == z@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to RCPT TO:<y@test.ex>
+1999-03-02 09:44:33 10HmbD-0005vi-00 H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to pipelined RCPT TO:<y@test.ex>
+1999-03-02 09:44:33 10HmbD-0005vi-00 == x@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to pipelined RCPT TO:<y@test.ex>
+1999-03-02 09:44:33 10HmbD-0005vi-00 == y@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to pipelined RCPT TO:<y@test.ex>
+1999-03-02 09:44:33 10HmbD-0005vi-00 == z@test.ex R=remote T=smtp defer (-19) H=127.0.0.1 [127.0.0.1]: Malformed SMTP reply (an empty line) in response to pipelined RCPT TO:<y@test.ex>
 1999-03-02 09:44:33 10HmbD-0005vi-00 ** z@test.ex: retry timeout exceeded
 1999-03-02 09:44:33 10HmbD-0005vi-00 ** y@test.ex: retry timeout exceeded
 1999-03-02 09:44:33 10HmbD-0005vi-00 ** x@test.ex: retry timeout exceeded
diff --git a/test/log/0420 b/test/log/0420
new file mode 100644
index 000000000..0052dbebe
--- /dev/null
+++ b/test/log/0420
@@ -0,0 +1,7 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 h: <>
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= x@y H=(client.test.ex) [127.0.0.1] P=smtp S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 h: <some text; Tue, 2 Mar 1999 09:44:33 +0000>
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= a@b H=(client.test.ex) [127.0.0.1] P=smtp S=sss
diff --git a/test/log/0433 b/test/log/0433
index 9a80732d5..44889aa72 100644
--- a/test/log/0433
+++ b/test/log/0433
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 port 1226
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on [127.0.0.1]:1228 port 1225 (IPv4) port 1226 (IPv4)
diff --git a/test/log/0438 b/test/log/0438
index ea3293413..8c7ff1626 100644
--- a/test/log/0438
+++ b/test/log/0438
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/0439 b/test/log/0439
index 05245e7f0..c31d3987f 100644
--- a/test/log/0439
+++ b/test/log/0439
@@ -1,4 +1,6 @@
 1999-03-02 09:44:33 invalid value for message_size_limit: absolute value of integer "8796093022208M" is too large (overflow)
 1999-03-02 09:44:33 invalid message_size_limit: absolute value of integer "8796093022208M" is too large (overflow)
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 invalid message_size_limit: absolute value of integer "8796093022208M" is too large (overflow)
diff --git a/test/log/0454 b/test/log/0454
index 99c870d3a..e27fff213 100644
--- a/test/log/0454
+++ b/test/log/0454
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=smtp S=sss
 1999-03-02 09:44:33 10HmaX-0005vi-00 => xx <userx@test.ex> R=r2 T=t1
diff --git a/test/log/0458 b/test/log/0458
index 7861a8cf1..1defaf1d5 100644
--- a/test/log/0458
+++ b/test/log/0458
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1]:1111 I=[127.0.0.1]:1225 F=<userx@test.ex> rejected RCPT <userx@test.ex>
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1]:1112 I=[127.0.0.1]:1225 F=<userx@test.ex> rejected RCPT <userx@test.ex>
diff --git a/test/log/0460 b/test/log/0460
index b94531bda..fd7e9444f 100644
--- a/test/log/0460
+++ b/test/log/0460
@@ -1,3 +1,6 @@
+**NOTE: The delivery lines in this file have been sorted.
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=esmtp S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=esmtp S=sss
diff --git a/test/log/0461 b/test/log/0461
index 49370d558..840265f82 100644
--- a/test/log/0461
+++ b/test/log/0461
@@ -11,7 +11,7 @@
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] C="250 OK"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbA-0005vi-00 ** userx@test.ex R=r1 T=t1: retry time not reached for any host after a long failure period
+1999-03-02 09:44:33 10HmbA-0005vi-00 ** userx@test.ex R=r1 T=t1: all hosts for 'test.ex' have been failing for a long time (and retry time not reached)
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= <> R=10HmbA-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbB-0005vi-00 => CALLER <CALLER@test.ex> R=r0 T=t2
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
@@ -29,7 +29,7 @@
 1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbE-0005vi-00 ** userx@test.ex R=r1 T=t1: retry time not reached for any host after a long failure period
+1999-03-02 09:44:33 10HmbE-0005vi-00 ** userx@test.ex R=r1 T=t1: all hosts for 'test.ex' have been failing for a long time (and retry time not reached)
 1999-03-02 09:44:33 10HmbF-0005vi-00 <= <> R=10HmbE-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbF-0005vi-00 => CALLER <CALLER@test.ex> R=r0 T=t2
 1999-03-02 09:44:33 10HmbF-0005vi-00 Completed
diff --git a/test/log/0482 b/test/log/0482
index 3e72c8ae2..8b7bb7c59 100644
--- a/test/log/0482
+++ b/test/log/0482
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=(foobar) [127.0.0.1] F=<userx@test.ex> rejected after DATA: unqualified address not permitted: failing address in "From:" header is: userx
diff --git a/test/log/0495 b/test/log/0495
index 17886a809..d55d67923 100644
--- a/test/log/0495
+++ b/test/log/0495
@@ -12,12 +12,12 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 ** b@x.y R=r9 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<b@x.y>: 550 NOTOK
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbB-0005vi-00 ** a@x.y R=r9 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@myhost.test.ex>: 550 BAD MAIL
-1999-03-02 09:44:33 10HmbB-0005vi-00 ** b@x.y R=r9 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@myhost.test.ex>: 550 BAD MAIL
+1999-03-02 09:44:33 10HmbB-0005vi-00 ** a@x.y R=r9 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@myhost.test.ex>: 550 BAD MAIL
+1999-03-02 09:44:33 10HmbB-0005vi-00 ** b@x.y R=r9 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@myhost.test.ex>: 550 BAD MAIL
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbC-0005vi-00 ** a@x.y R=r9 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@myhost.test.ex>: 450 TEMPORARY MAIL FAIL
-1999-03-02 09:44:33 10HmbC-0005vi-00 ** b@x.y R=r9 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@myhost.test.ex>: 450 TEMPORARY MAIL FAIL
+1999-03-02 09:44:33 10HmbC-0005vi-00 ** a@x.y R=r9 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@myhost.test.ex>: 450 TEMPORARY MAIL FAIL
+1999-03-02 09:44:33 10HmbC-0005vi-00 ** b@x.y R=r9 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@myhost.test.ex>: 450 TEMPORARY MAIL FAIL
 1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 10HmbD-0005vi-00 => pm@p.q <postmaster@x.y> R=r9 T=t1 H=127.0.0.1 [127.0.0.1] C="250 OK"
diff --git a/test/log/0497 b/test/log/0497
index 9e55e5d29..8d47ac2b5 100644
--- a/test/log/0497
+++ b/test/log/0497
@@ -27,7 +27,7 @@
 1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbF-0005vi-00 == userx@x.y R=r1 T=t1 defer (-45) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@myhost.test.ex>: 452 temporary error
+1999-03-02 09:44:33 10HmbF-0005vi-00 == userx@x.y R=r1 T=t1 defer (-45) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@myhost.test.ex>: 452 temporary error
 1999-03-02 09:44:33 10HmbF-0005vi-00 ** userx@x.y: retry timeout exceeded
 1999-03-02 09:44:33 10HmbG-0005vi-00 <= <> R=10HmbF-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbG-0005vi-00 => :blackhole: <CALLER@myhost.test.ex> R=r0
@@ -55,8 +55,8 @@
 1999-03-02 09:44:33 10HmbM-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbL-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbN-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbN-0005vi-00 H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to RCPT TO:<userx@x.y>
-1999-03-02 09:44:33 10HmbN-0005vi-00 == userx@x.y R=r1 T=t1 defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to RCPT TO:<userx@x.y>
+1999-03-02 09:44:33 10HmbN-0005vi-00 H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to pipelined RCPT TO:<userx@x.y>
+1999-03-02 09:44:33 10HmbN-0005vi-00 == userx@x.y R=r1 T=t1 defer (-18) H=127.0.0.1 [127.0.0.1]: Remote host closed connection in response to pipelined RCPT TO:<userx@x.y>
 1999-03-02 09:44:33 10HmbN-0005vi-00 ** userx@x.y: retry timeout exceeded
 1999-03-02 09:44:33 10HmbO-0005vi-00 <= <> R=10HmbN-0005vi-00 U=EXIMUSER P=local S=sss
 1999-03-02 09:44:33 10HmbO-0005vi-00 => :blackhole: <CALLER@myhost.test.ex> R=r0
diff --git a/test/log/0502 b/test/log/0502
index 37d82e43b..93673ff90 100644
--- a/test/log/0502
+++ b/test/log/0502
@@ -13,3 +13,10 @@
 1999-03-02 09:44:33 Messages accepted: 
 1999-03-02 09:44:33 Recipients:        
 1999-03-02 09:44:33 Accepted:          
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 Messages received: 
+1999-03-02 09:44:33 Messages accepted: 
+1999-03-02 09:44:33 Recipients:        
+1999-03-02 09:44:33 Accepted:          
diff --git a/test/log/0547 b/test/log/0547
index 3b86d2bd5..34defc347 100644
--- a/test/log/0547
+++ b/test/log/0547
@@ -1,7 +1,9 @@
+1999-03-02 09:44:33 U=CALLER rejected EXPN x@y
+1999-03-02 09:44:33 no MAIL in SMTP connection from CALLER D=0s C=EXPN,QUIT
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 no MAIL in SMTP connection from [127.0.0.1] D=0s
 1999-03-02 09:44:33 no MAIL in SMTP connection from [127.0.0.1] D=0s C=QUIT
 1999-03-02 09:44:33 H=(x.y.z) [127.0.0.1] rejected VRFY a@b.c
 1999-03-02 09:44:33 no MAIL in SMTP connection from (x.y.z) [127.0.0.1] D=0s C=EHLO,VRFY,QUIT
-1999-03-02 09:44:33 U=CALLER rejected EXPN x@y
-1999-03-02 09:44:33 no MAIL in SMTP connection from CALLER D=0s C=EXPN,QUIT
diff --git a/test/log/0549 b/test/log/0549
index dc36d2697..2922e6197 100644
--- a/test/log/0549
+++ b/test/log/0549
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/0552 b/test/log/0552
index d070f9c8c..4ce57b114 100644
--- a/test/log/0552
+++ b/test/log/0552
@@ -1,9 +1,9 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 Accept non-SMTP
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 == userx1@test.ex R=r1 T=t1 defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
-1999-03-02 09:44:33 10HmaX-0005vi-00 == userx2@test.ex R=r1 T=t1 defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
-1999-03-02 09:44:33 10HmaX-0005vi-00 == userx3@test.ex R=r1 T=t1 defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
+1999-03-02 09:44:33 10HmaX-0005vi-00 == userx1@test.ex R=r1 T=t1 defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after pipelined MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
+1999-03-02 09:44:33 10HmaX-0005vi-00 == userx2@test.ex R=r1 T=t1 defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after pipelined MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
+1999-03-02 09:44:33 10HmaX-0005vi-00 == userx3@test.ex R=r1 T=t1 defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after pipelined MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx1@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
diff --git a/test/log/0555 b/test/log/0555
index e223bd466..29d71cd21 100644
--- a/test/log/0555
+++ b/test/log/0555
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-smtp S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 (= CALLER@myhost.test.ex U=CALLER P=local-smtp S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-smtp S=sss
diff --git a/test/log/0556 b/test/log/0556
index 5f1631c5a..1918dc13c 100644
--- a/test/log/0556
+++ b/test/log/0556
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(abcd) [127.0.0.1] next input="Start: sent early ...\r\n"
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/0559 b/test/log/0559
index fcae1cf93..86d88c040 100644
--- a/test/log/0559
+++ b/test/log/0559
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 SMTP connection lost after final dot H=(abcd) [127.0.0.1] P=esmtp
diff --git a/test/log/0561 b/test/log/0561
index 6c79f5a87..36658e8f4 100644
--- a/test/log/0561
+++ b/test/log/0561
@@ -2,25 +2,15 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 no immediate delivery: load average 0.01
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-smtp S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 no immediate delivery: load average 0.01
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 Start queue run: pid=pppp -qq
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 no immediate delivery: load average 0.01
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaY-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 no immediate delivery: load average 0.01
 1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qq
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 Start queue run: pid=pppp -qq
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmbB-0005vi-00 no immediate delivery: load average 0.01
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbB-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaY-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmbC-0005vi-00 no immediate delivery: load average 0.02
 1999-03-02 09:44:33 10HmbA-0005vi-00 => usery@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbC-0005vi-00"
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qq
@@ -28,3 +18,15 @@
 1999-03-02 09:44:33 10HmbD-0005vi-00 no immediate delivery: load average 0.01
 1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-smtp S=sss
 1999-03-02 09:44:33 10HmbE-0005vi-00 no immediate delivery: load average 0.02
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 no immediate delivery: load average 0.01
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaY-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 no immediate delivery: load average 0.01
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbB-0005vi-00 no immediate delivery: load average 0.01
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaY-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 no immediate delivery: load average 0.02
diff --git a/test/log/0562 b/test/log/0562
index 0f19e9cf4..14931e690 100644
--- a/test/log/0562
+++ b/test/log/0562
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 SMTP data timeout (message abandoned) on connection from (abcd) [127.0.0.1] F=<userx@test.ex>
 1999-03-02 09:44:33 NOTQUIT reason: 'data-timeout'
diff --git a/test/log/0570 b/test/log/0570
index 298306cd7..fa76b71f1 100644
--- a/test/log/0570
+++ b/test/log/0570
@@ -1,36 +1,18 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+**NOTE: The delivery lines in this file have been sorted.
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
-1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <usery@domB.ex>: discarded by RCPT ACL
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@primary.test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 => blackhole (RCPT ACL discarded recipients)
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 -> usery@domb.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
-1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <usery@domB.ex>: discarded by RCPT ACL
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaZ-0005vi-00@primary.test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 => blackhole (RCPT ACL discarded recipients)
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 -> usery@domb.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbB-0005vi-00@primary.test.ex
-1999-03-02 09:44:33 10HmbC-0005vi-00 => blackhole (RCPT ACL discarded recipients)
-1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
-1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <usery@domB.ex>: discarded by RCPT ACL
-1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbB-0005vi-00@primary.test.ex
-1999-03-02 09:44:33 10HmbD-0005vi-00 => blackhole (RCPT ACL discarded recipients)
-1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbB-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbC-0005vi-00"
 1999-03-02 09:44:33 10HmbB-0005vi-00 => usery@domb.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbD-0005vi-00"
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
@@ -39,6 +21,44 @@
 1999-03-02 09:44:33 End queue run: pid=pppp
 1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp
+1999-03-02 09:44:33 10HmbE-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbF-0005vi-00"
+1999-03-02 09:44:33 10HmbE-0005vi-00 => usery@domb.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbG-0005vi-00"
+1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp
+1999-03-02 09:44:33 10HmbH-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 Start queue run: pid=pppp
+1999-03-02 09:44:33 10HmbH-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbI-0005vi-00"
+1999-03-02 09:44:33 10HmbH-0005vi-00 => usery@domb.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbJ-0005vi-00"
+1999-03-02 09:44:33 10HmbH-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp
+1999-03-02 09:44:33 10HmbK-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 Start queue run: pid=pppp
+1999-03-02 09:44:33 10HmbK-0005vi-00 -> usery@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbL-0005vi-00"
+1999-03-02 09:44:33 10HmbK-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbL-0005vi-00"
+1999-03-02 09:44:33 10HmbK-0005vi-00 => userz@domc.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbM-0005vi-00"
+1999-03-02 09:44:33 10HmbK-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
+1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <usery@domB.ex>: discarded by RCPT ACL
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@primary.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 => blackhole (RCPT ACL discarded recipients)
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
+1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <usery@domB.ex>: discarded by RCPT ACL
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaZ-0005vi-00@primary.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 => blackhole (RCPT ACL discarded recipients)
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbB-0005vi-00@primary.test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 => blackhole (RCPT ACL discarded recipients)
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
+1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <usery@domB.ex>: discarded by RCPT ACL
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbB-0005vi-00@primary.test.ex
+1999-03-02 09:44:33 10HmbD-0005vi-00 => blackhole (RCPT ACL discarded recipients)
+1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
 1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
 1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbE-0005vi-00@primary.test.ex
 1999-03-02 09:44:33 10HmbF-0005vi-00 => blackhole (RCPT ACL discarded recipients)
@@ -47,12 +67,6 @@
 1999-03-02 09:44:33 10HmbG-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbE-0005vi-00@primary.test.ex
 1999-03-02 09:44:33 10HmbG-0005vi-00 => blackhole (RCPT ACL discarded recipients)
 1999-03-02 09:44:33 10HmbG-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbE-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbF-0005vi-00"
-1999-03-02 09:44:33 10HmbE-0005vi-00 => usery@domb.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbG-0005vi-00"
-1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp
-1999-03-02 09:44:33 10HmbH-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 Start queue run: pid=pppp
 1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
 1999-03-02 09:44:33 10HmbI-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbH-0005vi-00@primary.test.ex
 1999-03-02 09:44:33 10HmbI-0005vi-00 => blackhole (RCPT ACL discarded recipients)
@@ -61,12 +75,6 @@
 1999-03-02 09:44:33 10HmbJ-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbH-0005vi-00@primary.test.ex
 1999-03-02 09:44:33 10HmbJ-0005vi-00 => blackhole (RCPT ACL discarded recipients)
 1999-03-02 09:44:33 10HmbJ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbH-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbI-0005vi-00"
-1999-03-02 09:44:33 10HmbH-0005vi-00 => usery@domb.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbJ-0005vi-00"
-1999-03-02 09:44:33 10HmbH-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp
-1999-03-02 09:44:33 10HmbK-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 Start queue run: pid=pppp
 1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
 1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <usery@domA.ex>: discarded by RCPT ACL
 1999-03-02 09:44:33 10HmbL-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbK-0005vi-00@primary.test.ex
@@ -76,8 +84,3 @@
 1999-03-02 09:44:33 10HmbM-0005vi-00 <= CALLER@test.ex H=localhost (primary.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbK-0005vi-00@primary.test.ex
 1999-03-02 09:44:33 10HmbM-0005vi-00 => blackhole (RCPT ACL discarded recipients)
 1999-03-02 09:44:33 10HmbM-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbK-0005vi-00 => userx@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbL-0005vi-00"
-1999-03-02 09:44:33 10HmbK-0005vi-00 -> usery@doma.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbL-0005vi-00"
-1999-03-02 09:44:33 10HmbK-0005vi-00 => userz@domc.ex R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbM-0005vi-00"
-1999-03-02 09:44:33 10HmbK-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp
diff --git a/test/log/0574 b/test/log/0574
new file mode 100644
index 000000000..f26f757fc
--- /dev/null
+++ b/test/log/0574
@@ -0,0 +1,4 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= tester@test.ex H=(test.ex) [127.0.0.1] P=esmtp S=sss
diff --git a/test/log/0576 b/test/log/0576
new file mode 100644
index 000000000..8c1cb73df
--- /dev/null
+++ b/test/log/0576
@@ -0,0 +1,31 @@
+1999-03-02 09:44:33 using queue ''
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local-smtp S=sss for normal@test.ex
+1999-03-02 09:44:33 using queue 'alternate'
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local-smtp S=sss Q=alternate for alternate@test.ex
+1999-03-02 09:44:33 Start queue run: pid=pppp -qq
+1999-03-02 09:44:33 10HmaX-0005vi-00 => normal <normal@test.ex> F=<CALLER@the.local.host.name> R=all T=dump
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qq
+1999-03-02 09:44:33 Start 'nosuchqueue' queue run: pid=pppp
+1999-03-02 09:44:33 End 'nosuchqueue' queue run: pid=pppp
+1999-03-02 09:44:33 Start 'alternate' queue run: pid=pppp
+1999-03-02 09:44:33 10HmaY-0005vi-00 => alternate <alternate@test.ex> F=<CALLER@the.local.host.name> Q=alternate R=all T=dump
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 End 'alternate' queue run: pid=pppp
+1999-03-02 09:44:33 using queue 'lowpri'
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local-smtp S=sss Q=lowpri for lowpri@test.ex
+1999-03-02 09:44:33 using queue 'alternate'
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local-smtp S=sss Q=alternate for alternate@test.ex
+1999-03-02 09:44:33 Start queue run: pid=pppp
+1999-03-02 09:44:33 10HmbA-0005vi-00 => alternate <alternate@test.ex> F=<CALLER@the.local.host.name> R=all T=dump
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, -qGlowpri/3s, not listening for SMTP
+1999-03-02 09:44:33 Start 'lowpri' queue run: pid=pppp
+1999-03-02 09:44:33 End 'lowpri' queue run: pid=pppp
+1999-03-02 09:44:33 Start 'lowpri' queue run: pid=pppp
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => lowpri <lowpri@test.ex> F=<CALLER@the.local.host.name> Q=lowpri R=all T=dump
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 End 'lowpri' queue run: pid=pppp
diff --git a/test/log/0603 b/test/log/0603
index d8ca112c1..267987616 100644
--- a/test/log/0603
+++ b/test/log/0603
@@ -21,10 +21,9 @@
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 no host name found for IP address 127.0.0.2
-1999-03-02 09:44:33 10HmbD-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmbE-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbC-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmbF-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbB-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmbG-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbC-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmbF-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbB-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmbG-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name
 1999-03-02 09:44:33 10HmbH-0005vi-00 <= peter@dustybelt.tld H=localhost (the.local.host.name) [127.0.0.1] P=esmtp S=sss id=E10HmaY-0005vi-00@the.local.host.name
 1999-03-02 09:44:33 10HmbI-0005vi-00 <= peter@dustybelt.tld H=localhost (the.local.host.name) [127.0.0.1] P=esmtp S=sss id=E10HmbA-0005vi-00@the.local.host.name
diff --git a/test/log/0604 b/test/log/0604
index b72c16983..73912ba56 100644
--- a/test/log/0604
+++ b/test/log/0604
@@ -246,85 +246,84 @@
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 no host name found for IP address 127.0.0.2
-1999-03-02 09:44:33 10HmeA-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeB-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdZ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeC-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdY-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeD-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdX-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeE-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdW-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeF-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdV-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeG-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdU-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeH-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdT-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeI-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdS-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeJ-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdR-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeK-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdQ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeL-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdP-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeM-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdO-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeN-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdN-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeO-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdM-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeP-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdL-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeQ-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdK-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeR-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdJ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeS-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdI-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeT-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdH-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeU-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdG-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeV-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdF-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeW-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdE-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeX-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdD-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeY-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdC-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmeZ-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdB-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfA-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmdA-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfB-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcZ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfC-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcY-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfD-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcX-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfE-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcW-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfF-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcV-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfG-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcU-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfH-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcT-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfI-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcS-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfJ-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcR-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfK-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcQ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfL-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcP-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfM-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcO-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfN-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcN-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfO-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcM-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfP-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcL-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfQ-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcK-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfR-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcJ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfS-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcI-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfT-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcH-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfU-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcG-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfV-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcF-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfW-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcE-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfX-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcD-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfY-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcC-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmfZ-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcB-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgA-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmcA-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgB-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbZ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgC-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbY-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgD-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbX-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgE-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbW-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgF-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbV-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgG-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbU-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgH-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbT-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgI-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbS-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgJ-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbR-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgK-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbQ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgL-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbP-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgM-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbO-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgN-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbN-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgO-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbM-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgP-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbL-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgQ-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbK-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgR-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbJ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgS-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbI-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgT-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbH-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgU-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbG-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgV-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbF-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgW-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbE-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgX-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbD-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgY-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbC-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmgZ-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbB-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmhA-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmbA-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmhB-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name
-1999-03-02 09:44:33 10HmhC-0005vi-00 <= ralph@dustyshoes.tld H=(the.local.host.name) [127.0.0.2] P=esmtp S=sss id=E10HmaY-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeA-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeB-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdZ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeC-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdY-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeD-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdX-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeE-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdW-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeF-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdV-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeG-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdU-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeH-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdT-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeI-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdS-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeJ-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdR-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeK-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdQ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeL-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdP-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeM-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdO-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeN-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdN-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeO-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdM-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeP-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdL-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeQ-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdK-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeR-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdJ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeS-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdI-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeT-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdH-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeU-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdG-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeV-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdF-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeW-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdE-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeX-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdD-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeY-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdC-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmeZ-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdB-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfA-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmdA-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfB-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcZ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfC-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcY-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfD-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcX-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfE-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcW-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfF-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcV-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfG-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcU-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfH-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcT-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfI-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcS-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfJ-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcR-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfK-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcQ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfL-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcP-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfM-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcO-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfN-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcN-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfO-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcM-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfP-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcL-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfQ-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcK-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfR-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcJ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfS-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcI-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfT-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcH-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfU-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcG-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfV-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcF-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfW-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcE-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfX-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcD-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfY-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcC-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmfZ-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcB-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgA-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmcA-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgB-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbZ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgC-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbY-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgD-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbX-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgE-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbW-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgF-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbV-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgG-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbU-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgH-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbT-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgI-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbS-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgJ-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbR-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgK-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbQ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgL-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbP-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgM-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbO-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgN-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbN-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgO-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbM-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgP-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbL-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgQ-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbK-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgR-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbJ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgS-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbI-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgT-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbH-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgU-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbG-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgV-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbF-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgW-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbE-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgX-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbD-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgY-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbC-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmgZ-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbB-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmhA-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbA-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmhB-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name
+1999-03-02 09:44:33 10HmhC-0005vi-00 <= ralph@dustyshoes.tld H=the.local.host.name [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaY-0005vi-00@the.local.host.name
diff --git a/test/log/0608 b/test/log/0608
index 7d807e8f0..a58c807e5 100644
--- a/test/log/0608
+++ b/test/log/0608
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 helo localhost dnssec <no>
 1999-03-02 09:44:33 helo l-sec dnssec <yes>
diff --git a/test/log/0610 b/test/log/0610
index d9e584b6d..c0e5f9e12 100644
--- a/test/log/0610
+++ b/test/log/0610
@@ -10,4 +10,4 @@
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 H=[127.0.0.1] temporarily rejected connection in "connect" ACL
-1999-03-02 09:44:33 H=[127.0.0.2] temporarily rejected connection in "connect" ACL
+1999-03-02 09:44:33 H=[ip4.ip4.ip4.ip4] temporarily rejected connection in "connect" ACL
diff --git a/test/log/0614 b/test/log/0614
index f52733f62..fb4e46837 100644
--- a/test/log/0614
+++ b/test/log/0614
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 SMTP connection from [ip4.ip4.ip4.ip4] (TCP/IP connection count = 1)
 1999-03-02 09:44:33 SMTP connection from [ip4.ip4.ip4.ip4] closed by QUIT
diff --git a/test/log/0900 b/test/log/0900
new file mode 100644
index 000000000..8ce3bcb0f
--- /dev/null
+++ b/test/log/0900
@@ -0,0 +1,11 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= someone@some.domain H=(tester) [127.0.0.1] P=esmtp K S=sss for CALLER@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= someone@some.domain H=(tester) [127.0.0.1] P=esmtp K S=sss for CALLER@test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= someone@some.domain H=(tester) [127.0.0.1] P=esmtp K S=sss for CALLER@test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 SMTP data timeout (message abandoned) on connection from (tester) [127.0.0.1] F=<someone@some.domain>
+1999-03-02 09:44:33 SMTP connection from (tester) [127.0.0.1] lost while reading message data
+1999-03-02 09:44:33 SMTP connection from (tester) [127.0.0.1] lost while reading message data
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= someone@some.domain H=(tester) [127.0.0.1] P=esmtp K S=sss for CALLER@test.ex
+1999-03-02 09:44:33 H=(tester) [127.0.0.1] F=<someone@some.domain> rejected RCPT <dummy@reject.ex>: relay not permitted
diff --git a/test/log/0901 b/test/log/0901
new file mode 100644
index 000000000..92e4ae01a
--- /dev/null
+++ b/test/log/0901
@@ -0,0 +1,38 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for a@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => a@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] K C="250 OK"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for b@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 == b@test.ex R=to_server T=remote_smtp defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after end of data (ddd bytes written)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for c@test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => c@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] K C="250 OK"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for d@test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 ** d@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after end of data: 500 oops
+1999-03-02 09:44:33 10HmbA-0005vi-00 d@test.ex: error ignored
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for e@test.ex
+1999-03-02 09:44:33 10HmbB-0005vi-00 == e@test.ex R=to_server T=remote_smtp defer (-46) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after end of data: 400 not right now
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for p@test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 => p@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] K C="250 OK bdat"
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for q@test.ex
+1999-03-02 09:44:33 10HmbD-0005vi-00 == q@test.ex R=to_server T=remote_smtp defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after pipelined end of data (ddd bytes written)
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for r@test.ex
+1999-03-02 09:44:33 10HmbE-0005vi-00 => r@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] K C="250 OK bdat"
+1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbF-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for s@test.ex
+1999-03-02 09:44:33 10HmbF-0005vi-00 ** s@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined end of data: 550 unacceptable mail-from
+1999-03-02 09:44:33 10HmbF-0005vi-00 s@test.ex: error ignored
+1999-03-02 09:44:33 10HmbF-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbG-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for s1@test.ex
+1999-03-02 09:44:33 10HmbG-0005vi-00 == s1@test.ex R=to_server T=remote_smtp defer (-45) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined end of data: 450 greylisted mail-from
+1999-03-02 09:44:33 10HmbH-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for t@test.ex
+1999-03-02 09:44:33 10HmbH-0005vi-00 ** t@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<t@test.ex>: 550 no such recipient
+1999-03-02 09:44:33 10HmbH-0005vi-00 t@test.ex: error ignored
+1999-03-02 09:44:33 10HmbH-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbI-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for u@test.ex
+1999-03-02 09:44:33 10HmbI-0005vi-00 ** u@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined end of data: 500 oops bdat
+1999-03-02 09:44:33 10HmbI-0005vi-00 u@test.ex: error ignored
+1999-03-02 09:44:33 10HmbI-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbJ-0005vi-00 <= sender@source.dom U=root P=local-bsmtp S=sss for v@test.ex
+1999-03-02 09:44:33 10HmbJ-0005vi-00 == v@test.ex R=to_server T=remote_smtp defer (-46) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined end of data: 400 not right now bdat
diff --git a/test/log/0902 b/test/log/0902
new file mode 100644
index 000000000..53c5697ef
--- /dev/null
+++ b/test/log/0902
@@ -0,0 +1,34 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for a@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => a@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] K C="250 OK bdat"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for d@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 ** d@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after sending data block: 500 oops bdat-nonlast
+1999-03-02 09:44:33 10HmaY-0005vi-00 d@test.ex: error ignored
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for p@test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => p@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] K C="250 OK bdat"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for s@test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 ** s@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined sending data block: 550 unacceptable mail-from
+1999-03-02 09:44:33 10HmbA-0005vi-00 s@test.ex: error ignored
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for t@test.ex
+1999-03-02 09:44:33 10HmbB-0005vi-00 ** t@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<t@test.ex>: 550 no such recipient
+1999-03-02 09:44:33 10HmbB-0005vi-00 t@test.ex: error ignored
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for t1@test.ex t2@test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 ** t1@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<t1@test.ex>: 550 no such recipient
+1999-03-02 09:44:33 10HmbC-0005vi-00 => t2@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] K C="250 OK bdat"
+1999-03-02 09:44:33 10HmbC-0005vi-00 t1@test.ex: error ignored
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for u@test.ex
+1999-03-02 09:44:33 10HmbD-0005vi-00 ** u@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined sending data block: 500 oops nonlast bdat
+1999-03-02 09:44:33 10HmbD-0005vi-00 u@test.ex: error ignored
+1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for v@test.ex
+1999-03-02 09:44:33 10HmbE-0005vi-00 ** v@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after end of data: 500 oops bdat
+1999-03-02 09:44:33 10HmbE-0005vi-00 v@test.ex: error ignored
+1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbF-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for p@test.ex
+1999-03-02 09:44:33 10HmbF-0005vi-00 => p@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] K C="250 OK bdat"
+1999-03-02 09:44:33 10HmbF-0005vi-00 Completed
diff --git a/test/log/1007 b/test/log/1007
index 758316a67..bc6a29644 100644
--- a/test/log/1007
+++ b/test/log/1007
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 (IPv6 and IPv4)
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 (IPv6 and IPv4) port 1226 (IPv6 and IPv4)
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 (IPv6 and IPv4) port 1226 (IPv6 and IPv4) [127.0.0.1]:1228
diff --git a/test/log/2002 b/test/log/2002
index 933905460..112ec8faa 100644
--- a/test/log/2002
+++ b/test/log/2002
@@ -1,3 +1,13 @@
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 Our cert SN: <CN=server1.example.com>
 1999-03-02 09:44:33 Peer did not present a cert
@@ -13,23 +23,15 @@
 1999-03-02 09:44:33 SN  <CN=server2.example.com>
 1999-03-02 09:44:33 IN  <O=example.com,CN=clica Signing Cert>
 1999-03-02 09:44:33 IN/O <example.com>
-1999-03-02 09:44:33 NB  <Nov  1 12:34:38 2012 GMT>
-1999-03-02 09:44:33 NB/i <1351773278>
-1999-03-02 09:44:33 NA  <Jan  1 12:34:38 2038 GMT>
+1999-03-02 09:44:33 NB  <Nov  1 12:34:06 2012 GMT>
+1999-03-02 09:44:33 NB/i <1351773246>
+1999-03-02 09:44:33 NA  <Jan  1 12:34:06 2038 GMT>
 1999-03-02 09:44:33 SA  <RSA-SHA256>
-1999-03-02 09:44:33 SG  <99 09 ea 53 5b f2 51 45 99 71 c4 42 1c 41 59 50 2e 97 5c c6 e2 67 62 f3 5b 67 0c e7 ec eb 34 2b ba 20 d5 2e e3 97 83 c3 9d c6 a8 e8 03 e4 e9 fe 16 01 f1 63 6f 86 59 73 53 72 b5 21 cf 2e ea 1d 59 3a 18 d5 b5 33 20 13 0a c2 4f 49 a1 fd b2 c3 69 ab ff 71 25 cb 34 43 95 59 97 ae 2f ba 6f 45 f9 5a 67 cc 79 62 3b 9e 97 9b e8 f9 7a 9f 5f 2d 4d 82 a4 18 67 05 c2 c1 6c 0b e0 9e b8 b3 b3 37>
+1999-03-02 09:44:33 SG  <71 b2 af 7b 95 28 55 f3 39 e3 8d 32 43 e9 2f 68 28 ef 03 76 3c 3a 6a 7a d7 6e 47 4e 69 25 67 fb 7a eb bc bb 69 9c 3f e8 b7 78 d0 a9 78 0c 7a 46 8d 01 de cc c6 fd 13 be 8d 99 ba 12 ee eb df e9 65 98 4c e9 ff 2e fe 71 5e 11 fe 48 81 66 91 a7 f5 70 8a 9c 63 36 b7 ac 69 95 06 5e 54 9b 53 ff a9 d9 07 34 67 f5 f0 05 f7 16 eb 28 89 8e 98 27 58 5f 61 c3 3f 72 f5 dc 2f b7 67 48 87 18 c6 72>
 1999-03-02 09:44:33 SAN <DNS=server2.example.com>
 1999-03-02 09:44:33 CRU <http://crl.example.com/latest.crl>
-1999-03-02 09:44:33 md5    fingerprint 33728C89BBE99028425D137F7508F74A
-1999-03-02 09:44:33 sha1 fingerprint 1A420D865B90068FB822E71567A456A3578D26AA
-1999-03-02 09:44:33 sha256 fingerprint 7E194665AE12FD9AF8E604427D512E846E75EC96032BF78BAD707426F01CFF17
-1999-03-02 09:44:33 der_b64 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhhbXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDExMjM0MzhaFw0zODAxMDExMjM0MzhaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALoxxS9eRRSkEJF5CmlLToLY3886wsCOc+vuBo+2V69Q7aCC3Wa13UTZ7SVPhliw29gl48Ua7Go5E6E4+6n7SNL+VfuMtNg2zs4BIhXTfiPZ9U2YF77+Y64MFPBxK98F/RB/wjqAiWf5aigaQCSGX7Bf1bb1s3UwCi0M/wXHYj7TAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLmNvbS8wHgYDVR0RBBcwFYITc2VydmVyMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQCZCepTW/JRRZlxxEIcQVlQLpdcxuJnYvNbZwzn7Os0K7og1S7jl4PDncao6APk6f4WAfFjb4ZZc1NytSHPLuodWToY1bUzIBMKwk9Jof2yw2mr/3ElyzRDlVmXri+6b0X5WmfMeWI7npeb6Pl6n18tTYKkGGcFwsFsC+CeuLOzNw==
+1999-03-02 09:44:33 md5    fingerprint 6EF976EBB1B8D9F761FC9B90C0A932F2
+1999-03-02 09:44:33 sha1 fingerprint 937464090D55415838493903E638821D15251017
+1999-03-02 09:44:33 sha256 fingerprint 5D5FAB3264B5DC5101A548BF1F80FED4AF1FEB8108E08EE4BE012CCC0BD39395
+1999-03-02 09:44:33 der_b64 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhhbXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDExMjM0MDZaFw0zODAxMDExMjM0MDZaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKyfVyM2/OEp07jUT275Z443TxznHO7R/gOy2YSg8boviB72gXWcnvPD7JJ19zT4dAX7ycYhJJHvnfurI9sxlbeC12v1Vci9auGtSdyTfiFE6sHj5WG85eRLPyp9Bh10oHF5f5/O8ql5oY6Mp64fgzkQww6adLTJhMXdYum4pYS7AgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wHgYDVR0RBBcwFYITc2VydmVyMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBxsq97lShV8znjjTJD6S9oKO8Ddjw6anrXbkdOaSVn+3rrvLtpnD/ot3jQqXgMekaNAd7Mxv0Tvo2ZuhLu69/pZZhM6f8u/nFeEf5IgWaRp/VwipxjNresaZUGXlSbU/+p2Qc0Z/XwBfcW6yiJjpgnWF9hwz9y9dwvt2dIhxjGcg==
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex H=[ip4.ip4.ip4.ip4] P=smtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=yes DN="CN=server2.example.com" S=sss
-1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/log/2003 b/test/log/2003
index 2d51a6195..1505af3f7 100644
--- a/test/log/2003
+++ b/test/log/2003
@@ -1,7 +1,9 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 H=[ip4.ip4.ip4.ip4] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: unacceptable cipher TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=smtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=abc T=local_delivery
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 H=[ip4.ip4.ip4.ip4] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: unacceptable cipher TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=smtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss
diff --git a/test/log/2004 b/test/log/2004
index c3a2fe070..bf29eba23 100644
--- a/test/log/2004
+++ b/test/log/2004
@@ -1,7 +1,9 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: encryption required
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [ip4.ip4.ip4.ip4] P=esmtp S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=abc T=local_delivery
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: encryption required
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [ip4.ip4.ip4.ip4] P=esmtp S=sss
diff --git a/test/log/2005 b/test/log/2005
index 1cdd5d972..ddb0eaae2 100644
--- a/test/log/2005
+++ b/test/log/2005
@@ -1,4 +1,6 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 H=[127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@remote.test.ex>: encryption required
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 H=[127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@remote.test.ex>: encryption required
diff --git a/test/log/2006 b/test/log/2006
index c34f51d38..ce9a5032b 100644
--- a/test/log/2006
+++ b/test/log/2006
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 SMTP command timeout on TLS connection from [127.0.0.1]
diff --git a/test/log/2013 b/test/log/2013
index d9ff4a344..21fad4866 100644
--- a/test/log/2013
+++ b/test/log/2013
@@ -3,7 +3,7 @@
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 
@@ -16,6 +16,6 @@
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx <userx@test.ex> R=server T=local_delivery
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 => userx <userx@test.ex> R=server T=local_delivery
+1999-03-02 09:44:33 10HmbA-0005vi-00 => usery <usery@test.ex> R=server T=local_delivery
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/log/2014 b/test/log/2014
index a31d93e1c..8af6a484d 100644
--- a/test/log/2014
+++ b/test/log/2014
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from (rhu1.barb) [ip4.ip4.ip4.ip4] (gnutls_handshake): The peer did not send any certificate.
 1999-03-02 09:44:33 H=(rhu2tls.barb) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=
diff --git a/test/log/2015 b/test/log/2015
index 204057a7c..7252550ca 100644
--- a/test/log/2015
+++ b/test/log/2015
@@ -1,4 +1,9 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 SMTP connection from [127.0.0.1] (TCP/IP connection count = 1)
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [127.0.0.1] (gnutls_handshake): timed out
 1999-03-02 09:44:33 SMTP command timeout on connection from (rhu.barb) [127.0.0.1]
+1999-03-02 09:44:33 SMTP connection from [127.0.0.1] (TCP/IP connection count = 1)
+1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [127.0.0.1] (gnutls_handshake): The TLS connection was non-properly terminated.
+1999-03-02 09:44:33 SMTP connection from (rhu.barb) [127.0.0.1] closed by EOF
diff --git a/test/log/2018 b/test/log/2018
index 15eb43fbf..25c51a131 100644
--- a/test/log/2018
+++ b/test/log/2018
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=[127.0.0.1] P=smtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: "You must encrypt"
diff --git a/test/log/2019 b/test/log/2019
index 1ba4ba084..1e96ea105 100644
--- a/test/log/2019
+++ b/test/log/2019
@@ -1,9 +1,11 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTPS on port 1225
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= userx@test.ex H=[ip4.ip4.ip4.ip4] P=smtp X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=yes DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=abc T=local_delivery
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@test.ex> R=abc T=local_delivery
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTPS on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= userx@test.ex H=[ip4.ip4.ip4.ip4] P=smtp X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=yes DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" S=sss
diff --git a/test/log/2020 b/test/log/2020
index 25a01dfb3..2e4a0944b 100644
--- a/test/log/2020
+++ b/test/log/2020
@@ -1,16 +1,15 @@
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
+1999-03-02 09:44:33 Warning: No server certificate defined; will use a selfsigned one.
  Suggested action: either install a certificate or change tls_advertise_hosts option
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@thishost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 Warning: No server certificate defined; will use a selfsigned one.
  Suggested action: either install a certificate or change tls_advertise_hosts option
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@myhost.test.ex R=abc T=t1 H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@thishost.test.ex R=abc T=t1 H=thishost.test.ex [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=Exim Developers,CN=thishost.test.ex" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
 ******** SERVER ********
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
+1999-03-02 09:44:33 Warning: No server certificate defined; will use a selfsigned one.
  Suggested action: either install a certificate or change tls_advertise_hosts option
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 TLS error on connection from localhost (myhost.test.ex) [127.0.0.1] (no TLS server certificate is specified)
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@thishost.test.ex H=localhost (thishost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@thishost.test.ex
diff --git a/test/log/2022 b/test/log/2022
index dc36d2697..2922e6197 100644
--- a/test/log/2022
+++ b/test/log/2022
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/2024 b/test/log/2024
index 117382b5a..f7f6619c0 100644
--- a/test/log/2024
+++ b/test/log/2024
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (certificate verification failed): certificate invalid
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/2026 b/test/log/2026
index 90506c3cd..08255f8a1 100644
--- a/test/log/2026
+++ b/test/log/2026
@@ -1,6 +1,6 @@
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 H=localhost (myhost.test.ex) [127.0.0.1] F=<CALLER@myhost.test.ex> temporarily rejected RCPT <usery@myhost.test.ex>
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaY-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp K S=sss id=E10HmaY-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 no immediate delivery: queued by ACL
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no K S=sss id=E10HmaY-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 no immediate delivery: queued by ACL
diff --git a/test/log/2027 b/test/log/2027
index 25155c96a..18b020a62 100644
--- a/test/log/2027
+++ b/test/log/2027
@@ -3,7 +3,7 @@
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] a TLS session is required but an attempt to start TLS failed
+1999-03-02 09:44:33 10HmaY-0005vi-00 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] TLS error on connection (gnutls_handshake): A TLS fatal alert has been received.
 1999-03-02 09:44:33 10HmaY-0005vi-00 TLS session failure: delivering unencrypted to ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] (not in hosts_require_tls)
 1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/2029 b/test/log/2029
index e4510feb1..6d667ffc6 100644
--- a/test/log/2029
+++ b/test/log/2029
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS error on connection from [127.0.0.1] (recv): The TLS connection was non-properly terminated.
 1999-03-02 09:44:33 10HmaX-0005vi-00 SMTP connection lost after final dot H=[127.0.0.1] P=smtps
diff --git a/test/log/2034 b/test/log/2034
new file mode 100644
index 000000000..33f138ae2
--- /dev/null
+++ b/test/log/2034
@@ -0,0 +1,6 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [127.0.0.1] (gnutls_handshake): timed out
+1999-03-02 09:44:33 SMTP command timeout on connection from (rhu.barb) [127.0.0.1]
+1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [127.0.0.1] (gnutls_handshake): An unexpected TLS packet was received.
diff --git a/test/log/2051 b/test/log/2051
new file mode 100644
index 000000000..baa775c0d
--- /dev/null
+++ b/test/log/2051
@@ -0,0 +1,3 @@
+1999-03-02 09:44:33 H=127.0.0.1 [127.0.0.1] TLS error on connection (gnutls_handshake): timed out
+1999-03-02 09:44:33 TLS session failure: callout unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= s1@test.ex U=CALLER P=local-esmtp S=sss
diff --git a/test/log/2052 b/test/log/2052
new file mode 100644
index 000000000..68c88a330
--- /dev/null
+++ b/test/log/2052
@@ -0,0 +1,13 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 H=127.0.0.1 [127.0.0.1] TLS error on connection (certificate verification failed): certificate invalid
+1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 TLS error on connection from localhost [127.0.0.1] (recv): A TLS fatal alert has been received.: Certificate is bad
+1999-03-02 09:44:33 TLS error on connection from localhost [127.0.0.1] (send): The specified session has been invalidated for some reason.
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
diff --git a/test/log/2090 b/test/log/2090
new file mode 100644
index 000000000..d7415d972
--- /dev/null
+++ b/test/log/2090
@@ -0,0 +1,5 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= someone@some.domain H=(rhu.barb) [127.0.0.1] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no K S=sss for CALLER@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= someone@some.domain H=(rhu.barb) [127.0.0.1] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no K S=sss for CALLER@test.ex
diff --git a/test/log/2091 b/test/log/2091
new file mode 100644
index 000000000..78638261b
--- /dev/null
+++ b/test/log/2091
@@ -0,0 +1,7 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= this-user@testhost.test.ex U=this-user P=local S=sss for other-user@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => other-user@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no K C="250- 351 byte chunk, total 351\\n250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1224
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= <> H=localhost (testhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no K S=sss id=E10HmaX-0005vi-00@testhost.test.ex for other-user@test.ex
diff --git a/test/log/2102 b/test/log/2102
index 838930a82..4257a3b61 100644
--- a/test/log/2102
+++ b/test/log/2102
@@ -1,3 +1,13 @@
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 Our cert SN: <CN=server1.example.com>
 1999-03-02 09:44:33 Peer did not present a cert
@@ -14,25 +24,17 @@
 1999-03-02 09:44:33 SN  <CN=server2.example.com>
 1999-03-02 09:44:33 IN  <CN=clica Signing Cert,O=example.com>
 1999-03-02 09:44:33 IN/O <example.com>
-1999-03-02 09:44:33 NB/r <Nov  1 12:34:38 2012 GMT>
-1999-03-02 09:44:33 NB   <Nov  1 12:34:38 2012 +0000>
-1999-03-02 09:44:33 NB/i <1351773278>
-1999-03-02 09:44:33 NA  <Jan  1 12:34:38 2038 +0000>
+1999-03-02 09:44:33 NB/r <Nov  1 12:34:06 2012 GMT>
+1999-03-02 09:44:33 NB   <Nov  1 12:34:06 2012 +0000>
+1999-03-02 09:44:33 NB/i <1351773246>
+1999-03-02 09:44:33 NA  <Jan  1 12:34:06 2038 +0000>
 1999-03-02 09:44:33 SA  <sha256WithRSAEncryption>
-1999-03-02 09:44:33 SG  <         99:09:ea:53:5b:f2:51:45:99:71:c4:42:1c:41:59:50:2e:97:\n         5c:c6:e2:67:62:f3:5b:67:0c:e7:ec:eb:34:2b:ba:20:d5:2e:\n         e3:97:83:c3:9d:c6:a8:e8:03:e4:e9:fe:16:01:f1:63:6f:86:\n         59:73:53:72:b5:21:cf:2e:ea:1d:59:3a:18:d5:b5:33:20:13:\n         0a:c2:4f:49:a1:fd:b2:c3:69:ab:ff:71:25:cb:34:43:95:59:\n         97:ae:2f:ba:6f:45:f9:5a:67:cc:79:62:3b:9e:97:9b:e8:f9:\n         7a:9f:5f:2d:4d:82:a4:18:67:05:c2:c1:6c:0b:e0:9e:b8:b3:\n         b3:37\n>
+1999-03-02 09:44:33 SG  <         71:b2:af:7b:95:28:55:f3:39:e3:8d:32:43:e9:2f:68:28:ef:\n         03:76:3c:3a:6a:7a:d7:6e:47:4e:69:25:67:fb:7a:eb:bc:bb:\n         69:9c:3f:e8:b7:78:d0:a9:78:0c:7a:46:8d:01:de:cc:c6:fd:\n         13:be:8d:99:ba:12:ee:eb:df:e9:65:98:4c:e9:ff:2e:fe:71:\n         5e:11:fe:48:81:66:91:a7:f5:70:8a:9c:63:36:b7:ac:69:95:\n         06:5e:54:9b:53:ff:a9:d9:07:34:67:f5:f0:05:f7:16:eb:28:\n         89:8e:98:27:58:5f:61:c3:3f:72:f5:dc:2f:b7:67:48:87:18:\n         c6:72\n>
 1999-03-02 09:44:33 SAN <DNS=server2.example.com>
-1999-03-02 09:44:33 OCU <http://oscp/example.com/>
+1999-03-02 09:44:33 OCU <http://oscp.example.com/>
 1999-03-02 09:44:33 CRU <http://crl.example.com/latest.crl>
-1999-03-02 09:44:33 md5    fingerprint 33728C89BBE99028425D137F7508F74A
-1999-03-02 09:44:33 sha1   fingerprint 1A420D865B90068FB822E71567A456A3578D26AA
-1999-03-02 09:44:33 sha256 fingerprint 7E194665AE12FD9AF8E604427D512E846E75EC96032BF78BAD707426F01CFF17
-1999-03-02 09:44:33 der_b64 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhhbXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDExMjM0MzhaFw0zODAxMDExMjM0MzhaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALoxxS9eRRSkEJF5CmlLToLY3886wsCOc+vuBo+2V69Q7aCC3Wa13UTZ7SVPhliw29gl48Ua7Go5E6E4+6n7SNL+VfuMtNg2zs4BIhXTfiPZ9U2YF77+Y64MFPBxK98F/RB/wjqAiWf5aigaQCSGX7Bf1bb1s3UwCi0M/wXHYj7TAgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC9leGFtcGxlLmNvbS8wHgYDVR0RBBcwFYITc2VydmVyMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQCZCepTW/JRRZlxxEIcQVlQLpdcxuJnYvNbZwzn7Os0K7og1S7jl4PDncao6APk6f4WAfFjb4ZZc1NytSHPLuodWToY1bUzIBMKwk9Jof2yw2mr/3ElyzRDlVmXri+6b0X5WmfMeWI7npeb6Pl6n18tTYKkGGcFwsFsC+CeuLOzNw==
+1999-03-02 09:44:33 md5    fingerprint 6EF976EBB1B8D9F761FC9B90C0A932F2
+1999-03-02 09:44:33 sha1   fingerprint 937464090D55415838493903E638821D15251017
+1999-03-02 09:44:33 sha256 fingerprint 5D5FAB3264B5DC5101A548BF1F80FED4AF1FEB8108E08EE4BE012CCC0BD39395
+1999-03-02 09:44:33 der_b64 MIICiDCCAfGgAwIBAgICAMkwDQYJKoZIhvcNAQELBQAwMzEUMBIGA1UEChMLZXhhbXBsZS5jb20xGzAZBgNVBAMTEmNsaWNhIFNpZ25pbmcgQ2VydDAeFw0xMjExMDExMjM0MDZaFw0zODAxMDExMjM0MDZaMB4xHDAaBgNVBAMTE3NlcnZlcjIuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKyfVyM2/OEp07jUT275Z443TxznHO7R/gOy2YSg8boviB72gXWcnvPD7JJ19zT4dAX7ycYhJJHvnfurI9sxlbeC12v1Vci9auGtSdyTfiFE6sHj5WG85eRLPyp9Bh10oHF5f5/O8ql5oY6Mp64fgzkQww6adLTJhMXdYum4pYS7AgMBAAGjgb8wgbwwDgYDVR0PAQH/BAQDAgTwMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vY3JsLmV4YW1wbGUuY29tL2xhdGVzdC5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb3NjcC5leGFtcGxlLmNvbS8wHgYDVR0RBBcwFYITc2VydmVyMi5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBxsq97lShV8znjjTJD6S9oKO8Ddjw6anrXbkdOaSVn+3rrvLtpnD/ot3jQqXgMekaNAd7Mxv0Tvo2ZuhLu69/pZZhM6f8u/nFeEf5IgWaRp/VwipxjNresaZUGXlSbU/+p2Qc0Z/XwBfcW6yiJjpgnWF9hwz9y9dwvt2dIhxjGcg==
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex H=[ip4.ip4.ip4.ip4] P=smtps X=TLSv1:AES256-SHA:256 CV=yes DN="/CN=server2.example.com" S=sss
-1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/log/2103 b/test/log/2103
index 2dc2a36a0..9485414c6 100644
--- a/test/log/2103
+++ b/test/log/2103
@@ -1,7 +1,9 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 H=[ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: unacceptable cipher TLSv1:AES256-SHA:256
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=smtps X=TLSv1:AES256-SHA:256 CV=no S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=abc T=local_delivery
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 H=[ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: unacceptable cipher TLSv1:AES256-SHA:256
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=smtps X=TLSv1:AES256-SHA:256 CV=no S=sss
diff --git a/test/log/2104 b/test/log/2104
index c3a2fe070..bf29eba23 100644
--- a/test/log/2104
+++ b/test/log/2104
@@ -1,7 +1,9 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: encryption required
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [ip4.ip4.ip4.ip4] P=esmtp S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=abc T=local_delivery
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: encryption required
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [ip4.ip4.ip4.ip4] P=esmtp S=sss
diff --git a/test/log/2105 b/test/log/2105
index 1cdd5d972..ddb0eaae2 100644
--- a/test/log/2105
+++ b/test/log/2105
@@ -1,4 +1,6 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 H=[127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@remote.test.ex>: encryption required
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 H=[127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@remote.test.ex>: encryption required
diff --git a/test/log/2106 b/test/log/2106
index c34f51d38..ce9a5032b 100644
--- a/test/log/2106
+++ b/test/log/2106
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 SMTP command timeout on TLS connection from [127.0.0.1]
diff --git a/test/log/2111 b/test/log/2111
index d1093be78..341745b8e 100644
--- a/test/log/2111
+++ b/test/log/2111
@@ -3,7 +3,7 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] TLS error on connection (SSL_connect): error: <<detail omitted>>
 1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
 1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:DES-CBC3-SHA:168 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
@@ -11,4 +11,4 @@
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
 1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:DES-CBC3-SHA:168 CV=yes DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=yes DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" S=sss id=E10HmaX-0005vi-00@myhost.test.ex
diff --git a/test/log/2114 b/test/log/2114
index 6f9896748..3d4219774 100644
--- a/test/log/2114
+++ b/test/log/2114
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
 1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
diff --git a/test/log/2115 b/test/log/2115
index 8bbb8bf60..bb8794be6 100644
--- a/test/log/2115
+++ b/test/log/2115
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 SMTP connection from [127.0.0.1] (TCP/IP connection count = 1)
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [127.0.0.1] (SSL_accept): timed out
diff --git a/test/log/2118 b/test/log/2118
index 314e524a2..a797ddb2c 100644
--- a/test/log/2118
+++ b/test/log/2118
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=[127.0.0.1] P=smtps X=TLSv1:AES256-SHA:256 CV=no S=sss
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: "You must encrypt"
diff --git a/test/log/2119 b/test/log/2119
index 9551633fb..50ba0ab6b 100644
--- a/test/log/2119
+++ b/test/log/2119
@@ -1,9 +1,11 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTPS on port 1225
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= userx@test.ex H=[ip4.ip4.ip4.ip4] P=smtp X=TLSv1:AES256-SHA:256 CV=yes DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=abc T=local_delivery
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@test.ex> R=abc T=local_delivery
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTPS on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= userx@test.ex H=(rhu.barb) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= userx@test.ex H=[ip4.ip4.ip4.ip4] P=smtp X=TLSv1:AES256-SHA:256 CV=yes DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" S=sss
diff --git a/test/log/2120 b/test/log/2120
index 10e2316c0..c70f7d401 100644
--- a/test/log/2120
+++ b/test/log/2120
@@ -1,19 +1,16 @@
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
+1999-03-02 09:44:33 Warning: No server certificate defined; will use a selfsigned one.
  Suggested action: either install a certificate or change tls_advertise_hosts option
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@thishost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 Warning: No server certificate defined; will use a selfsigned one.
  Suggested action: either install a certificate or change tls_advertise_hosts option
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 H=127.0.0.1 [127.0.0.1] TLS error on connection (SSL_connect): error: <<detail omitted>>
-1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@myhost.test.ex R=abc T=t1 H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=Exim Developers/CN=thishost.test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@thishost.test.ex R=abc T=t1 H=thishost.test.ex [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=Exim Developers/CN=thishost.test.ex" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
 ******** SERVER ********
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
+1999-03-02 09:44:33 Warning: No server certificate defined; will use a selfsigned one.
  Suggested action: either install a certificate or change tls_advertise_hosts option
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 TLS error on connection from localhost (myhost.test.ex) [127.0.0.1] (SSL_accept): error: <<detail omitted>>
-1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@thishost.test.ex H=localhost (thishost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@thishost.test.ex
diff --git a/test/log/2122 b/test/log/2122
index dc36d2697..2922e6197 100644
--- a/test/log/2122
+++ b/test/log/2122
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/2124 b/test/log/2124
index 46481910f..ba22aac7f 100644
--- a/test/log/2124
+++ b/test/log/2124
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 [ip4.ip4.ip4.ip4] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
 1999-03-02 09:44:33 TLS error on connection from (rhu.barb) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
diff --git a/test/log/2125 b/test/log/2125
index eb4a638fb..2045a10dc 100644
--- a/test/log/2125
+++ b/test/log/2125
@@ -1,7 +1,7 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] TLS error on connection (SSL_connect): error: <<detail omitted>>
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:DES-CBC3-SHA:168 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES128-SHA:128 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
@@ -9,4 +9,4 @@
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
 1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:DES-CBC3-SHA:168 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES128-SHA:128 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex
diff --git a/test/log/2132 b/test/log/2132
index c1da0f24c..d968a907a 100644
--- a/test/log/2132
+++ b/test/log/2132
@@ -1,3 +1,13 @@
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 Our cert SN: <CN=server2.example.com>
 1999-03-02 09:44:33 Peer did not present a cert
@@ -10,11 +20,3 @@
 1999-03-02 09:44:33 Our cert SN: <CN=server2.example.com>
 1999-03-02 09:44:33 SN  <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@test.ex H=[ip4.ip4.ip4.ip4] P=smtps X=TLSv1:AES256-SHA:256 CV=yes DN="/CN=server1.example.com" S=sss
-1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => CALLER <CALLER@test.ex> R=abc T=local_delivery
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/log/2150 b/test/log/2150
index 01c430781..52dcd14c7 100644
--- a/test/log/2150
+++ b/test/log/2150
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 SMTP connection lost after final dot H=[127.0.0.1] P=smtps
diff --git a/test/log/2151 b/test/log/2151
new file mode 100644
index 000000000..c2cc11363
--- /dev/null
+++ b/test/log/2151
@@ -0,0 +1,3 @@
+1999-03-02 09:44:33 H=127.0.0.1 [127.0.0.1] TLS error on connection (SSL_connect): timed out
+1999-03-02 09:44:33 TLS session failure: callout unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= s1@test.ex U=CALLER P=local-esmtp S=sss
diff --git a/test/log/2152 b/test/log/2152
new file mode 100644
index 000000000..1ed6351ff
--- /dev/null
+++ b/test/log/2152
@@ -0,0 +1,9 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=yes DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" S=sss id=E10HmaX-0005vi-00@myhost.test.ex
diff --git a/test/log/2190 b/test/log/2190
new file mode 100644
index 000000000..11ff67ddb
--- /dev/null
+++ b/test/log/2190
@@ -0,0 +1,5 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= someone@some.domain H=(rhu.barb) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no K S=sss for CALLER@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= someone@some.domain H=(rhu.barb) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no K S=sss for CALLER@test.ex
diff --git a/test/log/2191 b/test/log/2191
new file mode 100644
index 000000000..faa196fe7
--- /dev/null
+++ b/test/log/2191
@@ -0,0 +1,9 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= this-user@testhost.test.ex U=this-user P=local S=sss for other-user@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => other-user@test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no K C="250- 351 byte chunk, total 351\\n250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1224
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= <> H=localhost (testhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no K S=sss id=E10HmaX-0005vi-00@testhost.test.ex for other-user@test.ex
diff --git a/test/log/2201 b/test/log/2201
index d413ddaf3..f1decad00 100644
--- a/test/log/2201
+++ b/test/log/2201
@@ -1,7 +1,9 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= a@shorthost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 Start queue run: pid=pppp
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= a@shorthost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => t@test.ex R=r0 T=remote_delivery H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= a@shorthost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
diff --git a/test/log/3000 b/test/log/3000
index 529c9292d..75f1c67db 100644
--- a/test/log/3000
+++ b/test/log/3000
@@ -1,3 +1,5 @@
 1999-03-02 09:44:33 this is a warning at TESTSUITE/aux-fixed/3000.pl line 25.
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 this is a warning at TESTSUITE/aux-fixed/3000.pl line 25.
diff --git a/test/log/3450 b/test/log/3450
index 427464dd3..82a03b10c 100644
--- a/test/log/3450
+++ b/test/log/3450
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 H=(foobar) [127.0.0.1] rejected AUTH plain AHVzZXJ4AHNlY3JldA==: STARTTLS required before AUTH
diff --git a/test/log/3453 b/test/log/3453
index ea3293413..8c7ff1626 100644
--- a/test/log/3453
+++ b/test/log/3453
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/3454 b/test/log/3454
index 27d8866d4..d047667e7 100644
--- a/test/log/3454
+++ b/test/log/3454
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from [127.0.0.1] (recv): The TLS connection was non-properly terminated.
 1999-03-02 09:44:33 TLS error on connection from [127.0.0.1] (send): The specified session has been invalidated for some reason.
diff --git a/test/log/3455 b/test/log/3455
index f64dbff30..445ff3e93 100644
--- a/test/log/3455
+++ b/test/log/3455
@@ -1,12 +1,14 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpsa X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no A=plain:userx S=sss id=E10HmaX-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userz@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no A=plain C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpa A=login:usery S=sss id=E10HmaX-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userz@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] A=login C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpsa X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no A=plain:userx S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpa A=login:usery S=sss id=E10HmaX-0005vi-00@myhost.test.ex
diff --git a/test/log/3460 b/test/log/3460
index 427464dd3..82a03b10c 100644
--- a/test/log/3460
+++ b/test/log/3460
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 H=(foobar) [127.0.0.1] rejected AUTH plain AHVzZXJ4AHNlY3JldA==: STARTTLS required before AUTH
diff --git a/test/log/3463 b/test/log/3463
index ea3293413..8c7ff1626 100644
--- a/test/log/3463
+++ b/test/log/3463
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/3464 b/test/log/3464
index e513a61dd..2063b33ba 100644
--- a/test/log/3464
+++ b/test/log/3464
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 no MAIL in SMTP connection from [127.0.0.1] D=0s X=TLSv1:AES256-SHA:256 CV=no C=EHLO,STARTTLS,AUTH
 1999-03-02 09:44:33 no MAIL in SMTP connection from (foobar) [127.0.0.1] D=0s A=plain:userx X=TLSv1:AES256-SHA:256 CV=no C=EHLO,STARTTLS,EHLO,AUTH,QUIT
diff --git a/test/log/3465 b/test/log/3465
index 3ee4fc492..bfa1f38cd 100644
--- a/test/log/3465
+++ b/test/log/3465
@@ -1,12 +1,14 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpsa X=TLSv1:AES256-SHA:256 CV=no A=plain:userx S=sss id=E10HmaX-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userz@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no A=plain C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpa A=login:usery S=sss id=E10HmaX-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userz@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] A=login C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpsa X=TLSv1:AES256-SHA:256 CV=no A=plain:userx S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpa A=login:usery S=sss id=E10HmaX-0005vi-00@myhost.test.ex
diff --git a/test/log/4009 b/test/log/4009
index abb15e9a4..32535f5ac 100644
--- a/test/log/4009
+++ b/test/log/4009
@@ -1,17 +1,17 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 spam acl condition: spamd: failed to connect to any address for 127.0.0.2: Connection refused
-1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmbA-0005vi-00 spam acl condition: spamd: failed to connect to any address for ip4.ip4.ip4.ip4: Connection refused
+1999-03-02 09:44:33 10HmbA-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
diff --git a/test/log/4010 b/test/log/4010
index 1ab5847e6..c1176fee6 100644
--- a/test/log/4010
+++ b/test/log/4010
@@ -1,6 +1,6 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 (= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4015 b/test/log/4015
index c522ef82f..144eaf7d3 100644
--- a/test/log/4015
+++ b/test/log/4015
@@ -1,5 +1,5 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 spam acl condition: spamd: failed to connect to any address for ::1: Connection refused
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
diff --git a/test/log/4201 b/test/log/4201
index 5a2740c87..2643dd9ec 100644
--- a/test/log/4201
+++ b/test/log/4201
@@ -1,15 +1,17 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com U=CALLER P=utf8local-esmtp S=sss for usery@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => usery@test.ex F=<他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= someone@some.domain H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= ليهمابتكلموشعربي؟@czech.Pročprostěnemluvíčesky.com H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com U=CALLER P=utf8local-esmtp S=sss for usery@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name for usery@test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => usery@test.ex F=<他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= someone@some.domain H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= ليهمابتكلموشعربي؟@czech.Pročprostěnemluvíčesky.com H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for usery@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
-1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <usery@test.ex> R=localuser
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <usery@test.ex> R=localuser
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
diff --git a/test/log/4202 b/test/log/4202
index f2b796de0..e99860fd5 100644
--- a/test/log/4202
+++ b/test/log/4202
@@ -1,16 +1,18 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= user.dontcare@test1.com U=CALLER P=local S=sss for userx@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= user.dontcare@test1.com H=localhost (the.local.host.name) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for userx@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex F=<user.dontcare@test1.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= user.dontcare@test1.com U=CALLER P=local S=sss for user.他们为什么不说中文@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= user.dontcare@test1.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name for user.他们为什么不说中文@test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => user.他们为什么不说中文@test.ex F=<user.dontcare@test1.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= 他们为什么不说中文@test1.com U=CALLER P=local S=sss for userx@test.ex
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= 他们为什么不说中文@test1.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmbB-0005vi-00@the.local.host.name for userx@test.ex
 1999-03-02 09:44:33 10HmbB-0005vi-00 => userx@test.ex F=<他们为什么不说中文@test1.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbC-0005vi-00"
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= user.dontcare@test1.com H=localhost (the.local.host.name) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for userx@test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= user.dontcare@test1.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name for user.他们为什么不说中文@test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= 他们为什么不说中文@test1.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmbB-0005vi-00@the.local.host.name for userx@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4203 b/test/log/4203
index b71e770be..a1acf570e 100644
--- a/test/log/4203
+++ b/test/log/4203
@@ -1,4 +1,3 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local U=CALLER P=utf8local-esmtp S=sss for userz@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 ** userz@test.ex F=<यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1]: utf8 support required but not offered for forwarding
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= <> R=10HmaX-0005vi-00 U=EXIMUSER P=local S=sss for यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local
@@ -8,3 +7,6 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 => TESTSUITE/test-mail/यहलोगहिन्दीक्योंनहींबोलसकतेहैं <यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local> F=<> R=bounces T=local_delivery
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qfl
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/4204 b/test/log/4204
index 22fcd8816..0dd1f89a6 100644
--- a/test/log/4204
+++ b/test/log/4204
@@ -1,13 +1,17 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com U=CALLER P=utf8local-esmtp S=sss for userQ@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for userQ@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userq@test.ex <userQ@test.ex> F=<세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com U=CALLER P=utf8local-esmtp S=sss for userR@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name for userR@test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => userr@test.ex <userR@test.ex> F=<세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 U=CALLER F=<CALLER@spanish.PorquénopuedensimplementehablarenEspañol.local> rejected RCPT <userS@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+1999-03-02 09:44:33 U=CALLER F=<CALLER@vietnamese.TạisaohọkhôngthểchỉnóitiếngViệt.local> rejected RCPT <userT@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for userQ@test.ex
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name for userR@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userQ@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
@@ -15,5 +19,3 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 U=CALLER F=<CALLER@spanish.PorquénopuedensimplementehablarenEspañol.local> rejected RCPT <userS@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
-1999-03-02 09:44:33 U=CALLER F=<CALLER@vietnamese.TạisaohọkhôngthểchỉnóitiếngViệt.local> rejected RCPT <userT@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
diff --git a/test/log/4205 b/test/log/4205
index caa52bd9d..a73c38c51 100644
--- a/test/log/4205
+++ b/test/log/4205
@@ -1,8 +1,10 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userU@test.ex U=CALLER P=utf8local-esmtp S=sss for user.γλυκύρριζα@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= userU@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.γλυκύρριζα@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => user.γλυκύρριζα@test.ex F=<userU@test.ex> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= userU@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.γλυκύρριζα@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <user.γλυκύρριζα@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4206 b/test/log/4206
index 78a4d1a52..cab609f55 100644
--- a/test/log/4206
+++ b/test/log/4206
@@ -1,13 +1,19 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userV.වැල්_මී@test.ex U=CALLER P=utf8local-esmtp S=sss for user.அதிமதுரம்@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= userV.වැල්_මී@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.அதிமதுரம்@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => user.அதிமதுரம்@test.ex F=<userV.වැල්_මී@test.ex> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= userW@test.ex U=CALLER P=utf8local-esmtp S=sss for user.ഇരട്ടിമധുരം@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= userW@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name for user.ഇരട്ടിമധുരം@test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => user.ഇരട്ടിമധുരം@test.ex F=<userW@test.ex> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 U=CALLER sender verify fail for <userA@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+1999-03-02 09:44:33 U=CALLER F=<userA@test.ex> rejected RCPT <user.यष्टिमधु@test.ex>: Sender verify failed
+1999-03-02 09:44:33 U=CALLER sender verify fail for <userB.જેઠીમધ@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+1999-03-02 09:44:33 U=CALLER F=<userB.જેઠીમધ@test.ex> rejected RCPT <user.ქართული@test.ex>: Sender verify failed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= userV.වැල්_මී@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.அதிமதுரம்@test.ex
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= userW@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name for user.ഇരട്ടിമധുരം@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <user.அதிமதுரம்@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
@@ -15,7 +21,3 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 U=CALLER sender verify fail for <userA@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
-1999-03-02 09:44:33 U=CALLER F=<userA@test.ex> rejected RCPT <user.यष्टिमधु@test.ex>: Sender verify failed
-1999-03-02 09:44:33 U=CALLER sender verify fail for <userB.જેઠીમધ@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
-1999-03-02 09:44:33 U=CALLER F=<userB.જેઠીમધ@test.ex> rejected RCPT <user.ქართული@test.ex>: Sender verify failed
diff --git a/test/log/4207 b/test/log/4207
index f6171fd45..797a2b909 100644
--- a/test/log/4207
+++ b/test/log/4207
@@ -1,8 +1,10 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com U=CALLER P=utf8local-esmtp S=sss for user.세계의모든사람들이한국어를이해한다면얼마나좋을까@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= xn--ihqwcrb4cv8a8dqg056pqjye@hebrew.xn--4dbcagdahymbxekheh6e0a7fei0b.com H=localhost (the.local.host.name) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for xn--user.-f99s29a80cg5i8xgv8fnb734dq4gv6av8eczab60f5jch09a5ea085a0marwd373e180hea90e@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => xn--user.-f99s29a80cg5i8xgv8fnb734dq4gv6av8eczab60f5jch09a5ea085a0marwd373e180hea90e@test.ex <user.세계의모든사람들이한국어를이해한다면얼마나좋을까@test.ex> F=<xn--ihqwcrb4cv8a8dqg056pqjye@hebrew.xn--4dbcagdahymbxekheh6e0a7fei0b.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= xn--ihqwcrb4cv8a8dqg056pqjye@hebrew.xn--4dbcagdahymbxekheh6e0a7fei0b.com H=localhost (the.local.host.name) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for xn--user.-f99s29a80cg5i8xgv8fnb734dq4gv6av8eczab60f5jch09a5ea085a0marwd373e180hea90e@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <xn--user.-f99s29a80cg5i8xgv8fnb734dq4gv6av8eczab60f5jch09a5ea085a0marwd373e180hea90e@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4208 b/test/log/4208
index 73e18635a..117c2ca48 100644
--- a/test/log/4208
+++ b/test/log/4208
@@ -1,2 +1,4 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
diff --git a/test/log/4209 b/test/log/4209
index 0f42fec2a..dd0bbe405 100644
--- a/test/log/4209
+++ b/test/log/4209
@@ -1,17 +1,19 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= 他们为什么不说中文@test1.com U=CALLER P=local S=sss for user.他们为什么不说中文@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= 他们为什么不说中文@test1.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.他们为什么不说中文@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => user.他们为什么不说中文@test.ex F=<他们为什么不说中文@test1.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= 他们为什么不说中文@test1.com U=CALLER P=local S=sss for user.他们为什么不说中文@test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => xn--user.-si1hohvdvf05c4gvj200y0o6f@test.ex <user.他们为什么不说中文@test.ex> F=<xn--ihqwcrb4cv8a8dqg056pqjye@test1.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= 他们为什么不说中文@test1.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtp S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.他们为什么不说中文@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <user.他们为什么不说中文@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= 他们为什么不说中文@test1.com U=CALLER P=local S=sss for user.他们为什么不说中文@test.ex
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= xn--ihqwcrb4cv8a8dqg056pqjye@test1.com H=localhost (the.local.host.name) [127.0.0.1] P=esmtp S=sss id=E10HmaZ-0005vi-00@the.local.host.name for xn--user.-si1hohvdvf05c4gvj200y0o6f@test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => xn--user.-si1hohvdvf05c4gvj200y0o6f@test.ex <user.他们为什么不说中文@test.ex> F=<xn--ihqwcrb4cv8a8dqg056pqjye@test1.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <xn--user.-si1hohvdvf05c4gvj200y0o6f@test.ex> R=localuser
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
diff --git a/test/log/4211 b/test/log/4211
index 3d7441af3..6e475eeb5 100644
--- a/test/log/4211
+++ b/test/log/4211
@@ -1,15 +1,17 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com U=CALLER P=utf8local-esmtp S=sss for usery@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => usery@test.ex F=<他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= someone@some.domain H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= ليهمابتكلموشعربي؟@czech.Pročprostěnemluvíčesky.com H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com U=CALLER P=utf8local-esmtp S=sss for usery@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for usery@test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => usery@test.ex F=<他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbA-0005vi-00"
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= someone@some.domain H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= ليهمابتكلموشعربي؟@czech.Pročprostěnemluvíčesky.com H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for usery@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
-1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <usery@test.ex> R=localuser
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <usery@test.ex> R=localuser
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
diff --git a/test/log/4213 b/test/log/4213
index a52e735fc..e0c0a43d9 100644
--- a/test/log/4213
+++ b/test/log/4213
@@ -1,4 +1,3 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local U=CALLER P=utf8local-esmtp S=sss for userz@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 ** userz@test.ex F=<यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no: utf8 support required but not offered for forwarding
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= <> R=10HmaX-0005vi-00 U=EXIMUSER P=local S=sss for यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local
@@ -8,3 +7,6 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 => TESTSUITE/test-mail/यहलोगहिन्दीक्योंनहींबोलसकतेहैं <यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local> F=<> R=bounces T=local_delivery
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qfl
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/4214 b/test/log/4214
index 53f5bbb7f..97a89fd80 100644
--- a/test/log/4214
+++ b/test/log/4214
@@ -1,13 +1,17 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com U=CALLER P=utf8local-esmtp S=sss for userQ@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for userQ@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userq@test.ex <userQ@test.ex> F=<세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com U=CALLER P=utf8local-esmtp S=sss for userR@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for userR@test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => userr@test.ex <userR@test.ex> F=<세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 U=CALLER F=<CALLER@spanish.PorquénopuedensimplementehablarenEspañol.local> rejected RCPT <userS@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+1999-03-02 09:44:33 U=CALLER F=<CALLER@vietnamese.TạisaohọkhôngthểchỉnóitiếngViệt.local> rejected RCPT <userT@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for userQ@test.ex
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for userR@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userQ@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
@@ -15,5 +19,3 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 U=CALLER F=<CALLER@spanish.PorquénopuedensimplementehablarenEspañol.local> rejected RCPT <userS@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
-1999-03-02 09:44:33 U=CALLER F=<CALLER@vietnamese.TạisaohọkhôngthểchỉnóitiếngViệt.local> rejected RCPT <userT@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
diff --git a/test/log/4215 b/test/log/4215
index 727375938..155008e4a 100644
--- a/test/log/4215
+++ b/test/log/4215
@@ -1,8 +1,10 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userU@test.ex U=CALLER P=utf8local-esmtp S=sss for user.γλυκύρριζα@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= userU@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.γλυκύρριζα@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => user.γλυκύρριζα@test.ex F=<userU@test.ex> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= userU@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.γλυκύρριζα@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <user.γλυκύρριζα@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4216 b/test/log/4216
index ae2171ad3..75941e1d3 100644
--- a/test/log/4216
+++ b/test/log/4216
@@ -1,13 +1,19 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userV.වැල්_මී@test.ex U=CALLER P=utf8local-esmtp S=sss for user.அதிமதுரம்@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= userV.වැල්_මී@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.அதிமதுரம்@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => user.அதிமதுரம்@test.ex F=<userV.වැල්_මී@test.ex> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= userW@test.ex U=CALLER P=utf8local-esmtp S=sss for user.ഇരട്ടിമധുരം@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= userW@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for user.ഇരട്ടിമധുരം@test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => user.ഇരട്ടിമധുരം@test.ex F=<userW@test.ex> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 U=CALLER sender verify fail for <userA@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+1999-03-02 09:44:33 U=CALLER F=<userA@test.ex> rejected RCPT <user.यष्टिमधु@test.ex>: Sender verify failed
+1999-03-02 09:44:33 U=CALLER sender verify fail for <userB.જેઠીમધ@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+1999-03-02 09:44:33 U=CALLER F=<userB.જેઠીમધ@test.ex> rejected RCPT <user.ქართული@test.ex>: Sender verify failed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= userV.වැල්_මී@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.அதிமதுரம்@test.ex
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= userW@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for user.ഇരട്ടിമധുരം@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <user.அதிமதுரம்@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
@@ -15,7 +21,3 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 U=CALLER sender verify fail for <userA@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
-1999-03-02 09:44:33 U=CALLER F=<userA@test.ex> rejected RCPT <user.यष्टिमधु@test.ex>: Sender verify failed
-1999-03-02 09:44:33 U=CALLER sender verify fail for <userB.જેઠીમધ@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
-1999-03-02 09:44:33 U=CALLER F=<userB.જેઠીમધ@test.ex> rejected RCPT <user.ქართული@test.ex>: Sender verify failed
diff --git a/test/log/4221 b/test/log/4221
index 72dcf1539..9e7adca52 100644
--- a/test/log/4221
+++ b/test/log/4221
@@ -1,15 +1,17 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com U=CALLER P=utf8local-esmtp S=sss for usery@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => usery@test.ex F=<他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= someone@some.domain H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= ليهمابتكلموشعربي؟@czech.Pročprostěnemluvíčesky.com H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com U=CALLER P=utf8local-esmtp S=sss for usery@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for usery@test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => usery@test.ex F=<他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbA-0005vi-00"
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= someone@some.domain H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= ليهمابتكلموشعربي؟@czech.Pročprostěnemluvíčesky.com H=(client) [127.0.0.1] P=utf8esmtp S=sss for userx@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= 他们为什么不说中文@hebrew.למההםפשוטלאמדבריםעברית.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for usery@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
-1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <usery@test.ex> R=localuser
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=localuser
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <usery@test.ex> R=localuser
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
diff --git a/test/log/4223 b/test/log/4223
index 4d8763d66..fb5a1defe 100644
--- a/test/log/4223
+++ b/test/log/4223
@@ -1,4 +1,3 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local U=CALLER P=utf8local-esmtp S=sss for userz@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 ** userz@test.ex F=<यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no: utf8 support required but not offered for forwarding
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= <> R=10HmaX-0005vi-00 U=EXIMUSER P=local S=sss for यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local
@@ -8,3 +7,6 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 => TESTSUITE/test-mail/यहलोगहिन्दीक्योंनहींबोलसकतेहैं <यहलोगहिन्दीक्योंनहींबोलसकतेहैं@japanese.なぜみんな日本語を話してくれないのか.local> F=<> R=bounces T=local_delivery
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qfl
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
diff --git a/test/log/4224 b/test/log/4224
index a2e969f25..d58181e24 100644
--- a/test/log/4224
+++ b/test/log/4224
@@ -1,13 +1,17 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com U=CALLER P=utf8local-esmtp S=sss for userQ@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for userQ@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userq@test.ex <userQ@test.ex> F=<세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com U=CALLER P=utf8local-esmtp S=sss for userR@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for userR@test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => userr@test.ex <userR@test.ex> F=<세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 U=CALLER F=<CALLER@spanish.PorquénopuedensimplementehablarenEspañol.local> rejected RCPT <userS@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+1999-03-02 09:44:33 U=CALLER F=<CALLER@vietnamese.TạisaohọkhôngthểchỉnóitiếngViệt.local> rejected RCPT <userT@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for userQ@test.ex
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= 세계의모든사람들이한국어를이해한다면얼마나좋을까@russian.почемужеонинеговорятпорусски.com H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for userR@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userQ@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
@@ -15,5 +19,3 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 U=CALLER F=<CALLER@spanish.PorquénopuedensimplementehablarenEspañol.local> rejected RCPT <userS@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
-1999-03-02 09:44:33 U=CALLER F=<CALLER@vietnamese.TạisaohọkhôngthểchỉnóitiếngViệt.local> rejected RCPT <userT@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
diff --git a/test/log/4225 b/test/log/4225
index de2cda15e..8723ea7ae 100644
--- a/test/log/4225
+++ b/test/log/4225
@@ -1,8 +1,10 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userU@test.ex U=CALLER P=utf8local-esmtp S=sss for user.γλυκύρριζα@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= userU@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.γλυκύρριζα@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => user.γλυκύρριζα@test.ex F=<userU@test.ex> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= userU@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.γλυκύρριζα@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <user.γλυκύρριζα@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4226 b/test/log/4226
index 68197ab8f..d2e4a1c8d 100644
--- a/test/log/4226
+++ b/test/log/4226
@@ -1,13 +1,19 @@
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= userV.වැල්_මී@test.ex U=CALLER P=utf8local-esmtp S=sss for user.அதிமதுரம்@test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= userV.වැල්_මී@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.அதிமதுரம்@test.ex
 1999-03-02 09:44:33 10HmaX-0005vi-00 => user.அதிமதுரம்@test.ex F=<userV.වැල්_මී@test.ex> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= userW@test.ex U=CALLER P=utf8local-esmtp S=sss for user.ഇരട്ടിമധുരം@test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= userW@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for user.ഇരട്ടിമധുരം@test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => user.ഇരട്ടിമധുരം@test.ex F=<userW@test.ex> R=rmt T=rmt_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 U=CALLER sender verify fail for <userA@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+1999-03-02 09:44:33 U=CALLER F=<userA@test.ex> rejected RCPT <user.यष्टिमधु@test.ex>: Sender verify failed
+1999-03-02 09:44:33 U=CALLER sender verify fail for <userB.જેઠીમધ@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+1999-03-02 09:44:33 U=CALLER F=<userB.જેઠીમધ@test.ex> rejected RCPT <user.ქართული@test.ex>: Sender verify failed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= userV.වැල්_මී@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for user.அதிமதுரம்@test.ex
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= userW@test.ex H=localhost (the.local.host.name) [127.0.0.1] P=utf8esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for user.ഇരട്ടിമധുരം@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqff
 1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <user.அதிமதுரம்@test.ex> R=localuser
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
@@ -15,7 +21,3 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqff
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 U=CALLER sender verify fail for <userA@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
-1999-03-02 09:44:33 U=CALLER F=<userA@test.ex> rejected RCPT <user.यष्टिमधु@test.ex>: Sender verify failed
-1999-03-02 09:44:33 U=CALLER sender verify fail for <userB.જેઠીમધ@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
-1999-03-02 09:44:33 U=CALLER F=<userB.જેઠીમધ@test.ex> rejected RCPT <user.ქართული@test.ex>: Sender verify failed
diff --git a/test/log/4503 b/test/log/4503
index cd14c8693..53781b966 100644
--- a/test/log/4503
+++ b/test/log/4503
@@ -1,27 +1,27 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaX-0005vi-00 => a@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => a@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => b@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] C="250 OK id=10HmbB-0005vi-00"
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => c@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => b@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbB-0005vi-00 => c@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 DKIM: d=test.ex s=sel c=relaxed/relaxed a=rsa-sha256 b=1024 [verification succeeded]
+1999-03-02 09:44:33 10HmaY-0005vi-00 signer: test.ex bits: 1024 h=From
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <a@test.ex> R=server_dump
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbA-0005vi-00 DKIM: d=test.ex s=sel c=relaxed/relaxed a=rsa-sha256 b=1024 [verification succeeded]
-1999-03-02 09:44:33 10HmbA-0005vi-00 signer: test.ex bits: 1024 h=From
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <a@test.ex> R=server_dump
+1999-03-02 09:44:33 10HmbA-0005vi-00 signer: test.ex bits: 1024 h=From:From
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaZ-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <b@test.ex> R=server_dump
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbB-0005vi-00 DKIM: d=test.ex s=sel c=relaxed/relaxed a=rsa-sha256 b=1024 [verification succeeded]
-1999-03-02 09:44:33 10HmbB-0005vi-00 signer: test.ex bits: 1024 h=From:From
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaY-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <b@test.ex> R=server_dump
-1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbC-0005vi-00 DKIM: d=test.ex s=sel c=relaxed/relaxed a=rsa-sha256 b=1024 [verification succeeded]
-1999-03-02 09:44:33 10HmbC-0005vi-00 signer: test.ex bits: 1024 h=From:Message-Id:Sender:Date:Reply-To:Subject:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaZ-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 signer: test.ex bits: 1024 h=Date:Sender:Message-Id:From:Reply-To:Subject:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbB-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <c@test.ex> R=server_dump
 1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
diff --git a/test/log/4509 b/test/log/4509
new file mode 100644
index 000000000..052569fa9
--- /dev/null
+++ b/test/log/4509
@@ -0,0 +1,13 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= sender@testhost.test.ex U=sender P=local S=sss for a@test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => a@test.ex R=to_server T=remote_smtp_dkim H=127.0.0.1 [127.0.0.1] K C="250- 661 byte chunk, total 661\\n250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= sender@testhost.test.ex U=sender P=local S=sss for b@test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => b@test.ex R=to_server T=remote_smtp_dkim H=127.0.0.1 [127.0.0.1] K C="250- 8520 byte chunk, total 8848\\n250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1224
+1999-03-02 09:44:33 10HmaY-0005vi-00 DKIM: d=test.ex s=sel c=relaxed/relaxed a=rsa-sha256 b=1024 [verification succeeded]
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= <> H=localhost (testhost.test.ex) [127.0.0.1] P=esmtp K S=sss id=E10HmaX-0005vi-00@testhost.test.ex for a@test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 DKIM: d=test.ex s=sel c=relaxed/relaxed a=rsa-sha256 b=1024 [verification succeeded]
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= <> H=localhost (testhost.test.ex) [127.0.0.1] P=esmtp K S=sss id=E10HmaZ-0005vi-00@testhost.test.ex for b@test.ex
diff --git a/test/log/4804 b/test/log/4804
new file mode 100644
index 000000000..6f450eb2e
--- /dev/null
+++ b/test/log/4804
@@ -0,0 +1,21 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 => nologging@l-sec.test.ex R=client T=send_to_server H=l-sec.test.ex [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => withlogging@l-sec.test.ex R=client T=send_to_server H=l-sec.test.ex DS [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbB-0005vi-00 => withlogging@thishost.test.ex R=client T=send_to_server H=thishost.test.ex [127.0.0.1] C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <nologging@l-sec.test.ex> R=server
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaZ-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <withlogging@l-sec.test.ex> R=server
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmbB-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <withlogging@thishost.test.ex> R=server
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
diff --git a/test/log/5400 b/test/log/5400
index f8d7c9e8f..380b4e1e9 100644
--- a/test/log/5400
+++ b/test/log/5400
@@ -1,3 +1,4 @@
+**NOTE: The delivery lines in this file have been sorted.
 1999-03-02 09:44:33 rcpt for userx@domain.com
 1999-03-02 09:44:33 10HmaX-0005vi-00 >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userx@domain.com
@@ -17,22 +18,22 @@
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userx@domain.com
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 rcpt for no@domain.com
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> rejected RCPT <no@domain.com>
 1999-03-02 09:44:33 rcpt for userx@domain.com
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for no@domain.com userx@domain.com
-1999-03-02 09:44:33 10HmbB-0005vi-00 => no@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
-1999-03-02 09:44:33 10HmbB-0005vi-00 -> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userx@domain.com
+1999-03-02 09:44:33 10HmbB-0005vi-00 => userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
 1999-03-02 09:44:33 rcpt for userx@domain.com
 1999-03-02 09:44:33 rcpt for no@domain.com
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userx@domain.com no@domain.com
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> rejected RCPT <no@domain.com>
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userx@domain.com
 1999-03-02 09:44:33 10HmbC-0005vi-00 => userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
-1999-03-02 09:44:33 10HmbC-0005vi-00 -> no@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
 1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 rcpt for userx@domain.com
 1999-03-02 09:44:33 rcpt for special_tpt@domain.com
 1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userx@domain.com special_tpt@domain.com
-1999-03-02 09:44:33 10HmbD-0005vi-00 => userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
 1999-03-02 09:44:33 10HmbD-0005vi-00 => special_tpt@domain.com R=all T=smtp2 H=127.0.0.1 [127.0.0.1] C="250 OK"
+1999-03-02 09:44:33 10HmbD-0005vi-00 => userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
 1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
 1999-03-02 09:44:33 rcpt for userx@domain1.com
 1999-03-02 09:44:33 rcpt for usery@domain2.com
diff --git a/test/log/5401 b/test/log/5401
index 37ad46794..dc4027b47 100644
--- a/test/log/5401
+++ b/test/log/5401
@@ -1,3 +1,8 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> rejected RCPT <no@domain.com>: response to "RCPT TO:<no@domain.com>" from 127.0.0.1 [127.0.0.1] was: 550 No mate
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> rejected RCPT <no@domain.com>: response to "RCPT TO:<no@domain.com>" from 127.0.0.1 [127.0.0.1] was: 550 Not that one
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 => userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/5402 b/test/log/5402
index 9505825f4..add3b3e03 100644
--- a/test/log/5402
+++ b/test/log/5402
@@ -1,4 +1,3 @@
-1999-03-02 09:44:33 rcpt for userx@domain.com
-1999-03-02 09:44:33 10HmaX-0005vi-00 >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userx@domain.com
+1999-03-02 09:44:33 10HmaX-0005vi-00 >> dest@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
diff --git a/test/log/5404 b/test/log/5404
new file mode 100644
index 000000000..9505825f4
--- /dev/null
+++ b/test/log/5404
@@ -0,0 +1,4 @@
+1999-03-02 09:44:33 rcpt for userx@domain.com
+1999-03-02 09:44:33 10HmaX-0005vi-00 >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userx@domain.com
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
diff --git a/test/log/5405 b/test/log/5405
new file mode 100644
index 000000000..ae3ad767d
--- /dev/null
+++ b/test/log/5405
@@ -0,0 +1,23 @@
+1999-03-02 09:44:33 rcpt for usera@domain.com
+1999-03-02 09:44:33 10HmaX-0005vi-00 >> usera@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for usera@domain.com
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 rcpt for userb@domain.com
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userb@domain.com
+1999-03-02 09:44:33 rcpt for userc@domain.com
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userc@domain.com
+1999-03-02 09:44:33 rcpt for userd@domain.com
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected RCPT <userd@domain.com>
+1999-03-02 09:44:33 rcpt for usere@domain.com
+1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER usere@domain.com F=<CALLER@myhost.test.ex> tmp-reject from cutthrough after DATA: R=all T=smtp H=127.0.0.1 [127.0.0.1] C="459 content reject"
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for usere@domain.com
+1999-03-02 09:44:33 rcpt for userf@domain.com
+1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER userf@domain.com F=<CALLER@myhost.test.ex> tmp-reject from cutthrough after DATA: R=all T=smtp H=127.0.0.1 [127.0.0.1] C="459 content reject"
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userf@domain.com
+1999-03-02 09:44:33 rcpt for userg@domain.com
+1999-03-02 09:44:33 10HmbC-0005vi-00 U=CALLER userg@domain.com F=<CALLER@myhost.test.ex> tmp-reject from cutthrough after DATA: R=all T=smtp H=127.0.0.1 [127.0.0.1] C="459 content reject"
+1999-03-02 09:44:33 rcpt for userh@domain.com
+1999-03-02 09:44:33 10HmbD-0005vi-00 >> userh@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss for userh@domain.com
+1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected RCPT <useri@domain.com>: response to "RCPT TO:<useri@domain.com>" from 127.0.0.1 [127.0.0.1] was: 450 not right now
diff --git a/test/log/5410 b/test/log/5410
index 36c0fe50b..805f4d9a7 100644
--- a/test/log/5410
+++ b/test/log/5410
@@ -1,16 +1,18 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmaX-0005vi-00 no immediate delivery: queued by ACL
-1999-03-02 09:44:33 10HmaY-0005vi-00 >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmaX-0005vi-00"
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbA-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 no immediate delivery: queued by ACL
-1999-03-02 09:44:33 10HmbA-0005vi-00 >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbC-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmbB-0005vi-00 no immediate delivery: queued by ACL
-1999-03-02 09:44:33 10HmbC-0005vi-00 >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbB-0005vi-00"
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 no immediate delivery: queued by ACL
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaZ-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 no immediate delivery: queued by ACL
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbB-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 no immediate delivery: queued by ACL
diff --git a/test/log/5420 b/test/log/5420
index 5c7761cbe..a08d4b292 100644
--- a/test/log/5420
+++ b/test/log/5420
@@ -1,16 +1,18 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmaX-0005vi-00 no immediate delivery: queued by ACL
-1999-03-02 09:44:33 10HmaY-0005vi-00 >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmaX-0005vi-00"
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbA-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 no immediate delivery: queued by ACL
-1999-03-02 09:44:33 10HmbA-0005vi-00 >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbC-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmbB-0005vi-00 no immediate delivery: queued by ACL
-1999-03-02 09:44:33 10HmbC-0005vi-00 >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbB-0005vi-00"
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 no immediate delivery: queued by ACL
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmaZ-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 no immediate delivery: queued by ACL
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtp S=sss id=E10HmbB-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 no immediate delivery: queued by ACL
diff --git a/test/log/5500 b/test/log/5500
index 997a32e31..1d445cab5 100644
--- a/test/log/5500
+++ b/test/log/5500
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 prdr_requested: <yes>
 1999-03-02 09:44:33 10HmaY-0005vi-00 PRDR R=<userx@test.ex> acceptance
diff --git a/test/log/5590 b/test/log/5590
new file mode 100644
index 000000000..1959dac0f
--- /dev/null
+++ b/test/log/5590
@@ -0,0 +1,7 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 PRDR R=<bad1@test.ex> refusal
+1999-03-02 09:44:33 10HmaX-0005vi-00 PRDR R=<good@test.ex> acceptance
+1999-03-02 09:44:33 10HmaX-0005vi-00 PRDR R=<bad2@test.ex> refusal
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= someone@some.domain H=(tester) [127.0.0.1] P=esmtp PRDR K S=sss for bad1@test.ex good@test.ex bad2@test.ex
diff --git a/test/log/5591 b/test/log/5591
new file mode 100644
index 000000000..c8cdf557c
--- /dev/null
+++ b/test/log/5591
@@ -0,0 +1,4 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= sender@dom U=root P=local-bsmtp S=sss for usery@testhost.test.ex userz@testhost.test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => usery@testhost.test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] PRDR K C="250 first rcpt was good"
+1999-03-02 09:44:33 10HmaX-0005vi-00 -> userz@testhost.test.ex R=to_server T=remote_smtp H=127.0.0.1 [127.0.0.1] PRDR K C="250 second rcpt was good"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
diff --git a/test/log/5600 b/test/log/5600
index 65ce55118..b2e785562 100644
--- a/test/log/5600
+++ b/test/log/5600
@@ -1,13 +1,11 @@
-1999-03-02 09:44:33 1: Server sends good staple on request
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
 1999-03-02 09:44:33 acl_mail: ocsp in status: 4 (verified)
-1999-03-02 09:44:33 2: Server does not staple an outdated response
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
-1999-03-02 09:44:33 3: Server does not staple a response for a revoked cert
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
-1999-03-02 09:44:33 4: Connection functions when server is prepared to staple but client does not request it
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
diff --git a/test/log/5610 b/test/log/5610
new file mode 100644
index 000000000..b2e785562
--- /dev/null
+++ b/test/log/5610
@@ -0,0 +1,11 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
+1999-03-02 09:44:33 acl_mail: ocsp in status: 4 (verified)
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
diff --git a/test/log/5611 b/test/log/5611
new file mode 100644
index 000000000..f2a03375b
--- /dev/null
+++ b/test/log/5611
@@ -0,0 +1,46 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 => norequire@test.ex R=client T=send_to_server2 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 CV=yes DN="/CN=server1.example.com" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => nostaple@test.ex R=client T=send_to_server1 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 CV=yes DN="/CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbB-0005vi-00 => CALLER@test.ex R=client T=send_to_server3 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=yes DN="/CN=server1.example.com" C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbD-0005vi-00 Received TLS status callback, null content
+1999-03-02 09:44:33 10HmbD-0005vi-00 H=127.0.0.1 [127.0.0.1] TLS error on connection (SSL_connect): error: <<detail omitted>>
+1999-03-02 09:44:33 10HmbD-0005vi-00 == CALLER@test.ex R=client T=send_to_server3 defer (-37) H=127.0.0.1 [127.0.0.1]: failure while setting up TLS session
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbE-0005vi-00 Server certificate revoked; reason: superseded
+1999-03-02 09:44:33 10HmbE-0005vi-00 H=127.0.0.1 [127.0.0.1] TLS error on connection (SSL_connect): error: <<detail omitted>>
+1999-03-02 09:44:33 10HmbE-0005vi-00 == CALLER@test.ex R=client T=send_to_server3 defer (-37) H=127.0.0.1 [127.0.0.1]: failure while setting up TLS session
+1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbF-0005vi-00 Server OSCP dates invalid
+1999-03-02 09:44:33 10HmbF-0005vi-00 H=127.0.0.1 [127.0.0.1] TLS error on connection (SSL_connect): error: <<detail omitted>>
+1999-03-02 09:44:33 10HmbF-0005vi-00 == CALLER@test.ex R=client T=send_to_server3 defer (-37) H=127.0.0.1 [127.0.0.1]: failure while setting up TLS session
+
+******** SERVER ********
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 client claims: ocsp status 1 (notresp)
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@server1.example.com H=the.local.host.name (server1.example.com) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@server1.example.com
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <norequire@test.ex> R=server
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmbA-0005vi-00 client claims: ocsp status 0 (notreq)
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@server1.example.com H=the.local.host.name (server1.example.com) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaZ-0005vi-00@server1.example.com
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <nostaple@test.ex> R=server
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbC-0005vi-00 client claims: ocsp status 4 (verified)
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@server1.example.com H=(helo.data.changed) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbB-0005vi-00@server1.example.com
+1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <CALLER@test.ex> R=server
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 TLS error on connection from (helo.data.changed) [127.0.0.1] (SSL_accept): error: <<detail omitted>>
+1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 TLS error on connection from (helo.data.changed) [127.0.0.1] (SSL_accept): error: <<detail omitted>>
+1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 TLS error on connection from (helo.data.changed) [127.0.0.1] (SSL_accept): error: <<detail omitted>>
+1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
diff --git a/test/log/5650 b/test/log/5650
index b70aebb0e..dfe8f4363 100644
--- a/test/log/5650
+++ b/test/log/5650
@@ -1,17 +1,19 @@
 1999-03-02 09:44:33 1: Server sends good staple on request
+1999-03-02 09:44:33 2: Server does not staple an outdated response
+1999-03-02 09:44:33 3: Server does not staple a response for a revoked cert
+1999-03-02 09:44:33 4: Connection functions when server is prepared to staple but client does not request it
+
+******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
 1999-03-02 09:44:33 acl_mail: ocsp in status: 2 (vfynotdone)
-1999-03-02 09:44:33 2: Server does not staple an outdated response
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
 1999-03-02 09:44:33 TLS error on connection from [ip4.ip4.ip4.ip4] (recv): The TLS connection was non-properly terminated.
 1999-03-02 09:44:33 TLS error on connection from [ip4.ip4.ip4.ip4] (send): The specified session has been invalidated for some reason.
-1999-03-02 09:44:33 3: Server does not staple a response for a revoked cert
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
 1999-03-02 09:44:33 TLS error on connection from [ip4.ip4.ip4.ip4] (recv): The TLS connection was non-properly terminated.
 1999-03-02 09:44:33 TLS error on connection from [ip4.ip4.ip4.ip4] (send): The specified session has been invalidated for some reason.
-1999-03-02 09:44:33 4: Connection functions when server is prepared to staple but client does not request it
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 acl_conn: ocsp in status: 0 (notreq)
diff --git a/test/log/5700 b/test/log/5700
index 37eace605..6c21ac007 100644
--- a/test/log/5700
+++ b/test/log/5700
@@ -41,7 +41,7 @@
 1999-03-02 09:44:33 10HmaZ-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
 1999-03-02 09:44:33 10HmaZ-0005vi-00 H=127.0.0.1 [127.0.0.1]: SMTP timeout after EHLO the.local.host.name: Connection timed out
 1999-03-02 09:44:33 10HmaZ-0005vi-00 event msg:host:defer
-1999-03-02 09:44:33 10HmaZ-0005vi-00 . host deferral ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> errno <110> errstr <SMTP timeout after EHLO the.local.host.name: Connection timed out> router <others> transport <smtp>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . host deferral ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> errno <EEE> errstr <SMTP timeout after EHLO the.local.host.name: Connection timed out> router <others> transport <smtp>
 1999-03-02 09:44:33 10HmaZ-0005vi-00 == userx@domain1 R=others T=smtp defer (dd): Connection timed out H=127.0.0.1 [127.0.0.1]: SMTP timeout after EHLO the.local.host.name
 1999-03-02 09:44:33 10HmaZ-0005vi-00 ** userx@domain1: retry timeout exceeded
 1999-03-02 09:44:33 10HmaZ-0005vi-00 userx@domain1: error ignored
diff --git a/test/log/5710 b/test/log/5710
index d9f047dcf..a894e5d6b 100644
--- a/test/log/5710
+++ b/test/log/5710
@@ -11,11 +11,11 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 SN; <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SNCN<server1.example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 IN  <O=example.com,CN=clica Signing Cert>
-1999-03-02 09:44:33 10HmaX-0005vi-00 NB  <Nov  1 12:34:38 2012 GMT>
-1999-03-02 09:44:33 10HmaX-0005vi-00 NA  <Jan  1 12:34:38 2038 GMT>
+1999-03-02 09:44:33 10HmaX-0005vi-00 NB  <Nov  1 12:34:04 2012 GMT>
+1999-03-02 09:44:33 10HmaX-0005vi-00 NA  <Jan  1 12:34:04 2038 GMT>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SA  <RSA-SHA256>
-1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <3e 56 25 52 5c 4b 79 c7 93 e2 46 ea 42 35 25 27 41 9d ad 29 98 e2 f6 9b 32 bb 1c e9 6a 68 81 ba a7 82 7f 3d f8 d5 4a a6 98 af e4 78 31 bf 41 7a 3b 61 1a c8 f6 9e 77 c6 f1 ea 97 fc 2b c8 50 78 c3 15 33 23 46 63 b9 f3 04 cc 08 68 36 e3 2b cf 52 66 95 9e ef f0 38 c0 7c f4 42 b3 a6 e6 40 52 de 1b 15 1a 5d e7 76 5c 31 ec bc 60 50 03 51 6e 9f 49 bf 28 a2 e7 4d 6d ce 95 06 55 a0 81 21 49>
-1999-03-02 09:44:33 10HmaX-0005vi-00 SAN <DNS=server1.example.com\nDNS=alternatename.server1.example.com\nDNS=*.test.ex\nDNS=alternatename2.server1.example.com>
+1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <21 91 c3 1f 28 45 dd 2c ac d6 38 44 e7 b0 bb de 5a dc 45 1c 46 f1 76 a8 0d bf aa 4f f4 03 5e 1e fb b7 10 16 4d 4e 51 f1 8f b9 e4 38 10 69 02 c1 6b 27 2d 7c 15 f0 b7 0b 4c 51 ab 21 43 36 3e 4e 3a 68 7d 61 15 37 c3 2a b8 3e 34 85 4e 1c 54 55 95 7a 0b 80 70 38 77 d0 bd 4e c4 ca ab af 14 ea a3 24 43 13 eb 27 97 82 11 a2 15 29 3c 15 f2 f8 e9 8d d7 ad 20 b5 77 d7 01 8f 84 95 c1 e8 25 db>
+1999-03-02 09:44:33 10HmaX-0005vi-00 SAN <DNS=alternatename.server1.example.com\nDNS=alternatename2.server1.example.com\nDNS=server1.example.com\nDNS=*.test.ex>
 1999-03-02 09:44:33 10HmaX-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
 1999-03-02 09:44:33 10HmaX-0005vi-00 => bad@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
@@ -33,11 +33,11 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 SN; <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SNCN<server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 IN  <O=example.com,CN=clica Signing Cert>
-1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:38 2012 GMT>
-1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Jan  1 12:34:38 2038 GMT>
+1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:04 2012 GMT>
+1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Jan  1 12:34:04 2038 GMT>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SA  <RSA-SHA256>
-1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <3e 56 25 52 5c 4b 79 c7 93 e2 46 ea 42 35 25 27 41 9d ad 29 98 e2 f6 9b 32 bb 1c e9 6a 68 81 ba a7 82 7f 3d f8 d5 4a a6 98 af e4 78 31 bf 41 7a 3b 61 1a c8 f6 9e 77 c6 f1 ea 97 fc 2b c8 50 78 c3 15 33 23 46 63 b9 f3 04 cc 08 68 36 e3 2b cf 52 66 95 9e ef f0 38 c0 7c f4 42 b3 a6 e6 40 52 de 1b 15 1a 5d e7 76 5c 31 ec bc 60 50 03 51 6e 9f 49 bf 28 a2 e7 4d 6d ce 95 06 55 a0 81 21 49>
-1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <DNS=server1.example.com\nDNS=alternatename.server1.example.com\nDNS=*.test.ex\nDNS=alternatename2.server1.example.com>
+1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <21 91 c3 1f 28 45 dd 2c ac d6 38 44 e7 b0 bb de 5a dc 45 1c 46 f1 76 a8 0d bf aa 4f f4 03 5e 1e fb b7 10 16 4d 4e 51 f1 8f b9 e4 38 10 69 02 c1 6b 27 2d 7c 15 f0 b7 0b 4c 51 ab 21 43 36 3e 4e 3a 68 7d 61 15 37 c3 2a b8 3e 34 85 4e 1c 54 55 95 7a 0b 80 70 38 77 d0 bd 4e c4 ca ab af 14 ea a3 24 43 13 eb 27 97 82 11 a2 15 29 3c 15 f2 f8 e9 8d d7 ad 20 b5 77 d7 01 8f 84 95 c1 e8 25 db>
+1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <DNS=alternatename.server1.example.com\nDNS=alternatename2.server1.example.com\nDNS=server1.example.com\nDNS=*.test.ex>
 1999-03-02 09:44:33 10HmaY-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/log/5720 b/test/log/5720
index b3ab23119..c71096f8b 100644
--- a/test/log/5720
+++ b/test/log/5720
@@ -11,10 +11,10 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 SN; <CN=clica CA;O=example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SNO <example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 IN  <CN=clica CA,O=example.com>
-1999-03-02 09:44:33 10HmaX-0005vi-00 NB  <Nov  1 12:34:37 2012 +0000>
-1999-03-02 09:44:33 10HmaX-0005vi-00 NA  <Jan  1 12:34:37 2038 +0000>
+1999-03-02 09:44:33 10HmaX-0005vi-00 NB  <Nov  1 12:34:02 2012 +0000>
+1999-03-02 09:44:33 10HmaX-0005vi-00 NA  <Jan  1 12:34:02 2038 +0000>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SA  <sha256WithRSAEncryption>
-1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <         0d:67:ef:66:a3:71:1b:7c:d9:cc:a8:dd:1e:0f:13:d6:ea:8e:\n         19:b8:63:a7:7e:6b:ab:e4:e2:d3:cb:93:5b:8b:0f:f1:10:c3:\n         94:a1:01:8e:ac:33:f1:54:cd:7f:0c:e2:8c:99:e0:0f:57:a2:\n         eb:1e:d2:25:c0:55:be:74:ea:07:6a:cd:f3:6d:5d:e4:79:8c:\n         89:13:54:d9:72:d1:72:7d:f4:97:d3:81:51:d7:d0:47:07:3e:\n         2d:e9:7d:f8:62:44:2b:8d:1b:6c:c4:13:a8:c8:bd:43:f2:9b:\n         b5:0d:dc:15:ef:e8:d5:9b:04:c3:97:01:a5:65:f7:db:dc:92:\n         fc:66\n>
+1999-03-02 09:44:33 10HmaX-0005vi-00 SG  <         39:c1:60:c7:5b:b4:1a:52:48:74:d3:bc:24:d1:5c:f9:70:cb:\n         99:cf:4f:18:9c:b3:f1:cb:bf:90:f1:20:6d:c1:2a:bf:7b:bd:\n         88:0e:34:af:b0:1c:de:39:c1:ef:2a:c6:7a:12:a4:3d:15:a2:\n         e7:09:c5:e7:f4:ac:de:2e:5f:fc:86:e9:5a:18:8c:54:4b:ff:\n         25:bc:f2:75:f3:17:2e:f9:da:72:bc:dd:8a:c6:19:d5:14:5a:\n         17:98:e0:ea:c0:10:63:26:7b:25:1e:f4:0c:3b:18:67:33:26:\n         2e:6e:31:35:e1:3c:07:6b:d4:59:fa:26:3f:9e:67:2d:54:bf:\n         fc:ae\n>
 1999-03-02 09:44:33 10HmaX-0005vi-00 (no SAN)
 1999-03-02 09:44:33 10HmaX-0005vi-00 (no OCU)
 1999-03-02 09:44:33 10HmaX-0005vi-00 (no CRU)
@@ -36,12 +36,12 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 SN; <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SNO <>
 1999-03-02 09:44:33 10HmaY-0005vi-00 IN  <CN=clica Signing Cert,O=example.com>
-1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:38 2012 +0000>
-1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Jan  1 12:34:38 2038 +0000>
+1999-03-02 09:44:33 10HmaY-0005vi-00 NB  <Nov  1 12:34:04 2012 +0000>
+1999-03-02 09:44:33 10HmaY-0005vi-00 NA  <Jan  1 12:34:04 2038 +0000>
 1999-03-02 09:44:33 10HmaY-0005vi-00 SA  <sha256WithRSAEncryption>
-1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <         3e:56:25:52:5c:4b:79:c7:93:e2:46:ea:42:35:25:27:41:9d:\n         ad:29:98:e2:f6:9b:32:bb:1c:e9:6a:68:81:ba:a7:82:7f:3d:\n         f8:d5:4a:a6:98:af:e4:78:31:bf:41:7a:3b:61:1a:c8:f6:9e:\n         77:c6:f1:ea:97:fc:2b:c8:50:78:c3:15:33:23:46:63:b9:f3:\n         04:cc:08:68:36:e3:2b:cf:52:66:95:9e:ef:f0:38:c0:7c:f4:\n         42:b3:a6:e6:40:52:de:1b:15:1a:5d:e7:76:5c:31:ec:bc:60:\n         50:03:51:6e:9f:49:bf:28:a2:e7:4d:6d:ce:95:06:55:a0:81:\n         21:49\n>
-1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <DNS=alternatename2.server1.example.com;DNS=*.test.ex;DNS=alternatename.server1.example.com;DNS=server1.example.com>
-1999-03-02 09:44:33 10HmaY-0005vi-00 OCU <http://oscp/example.com/>
+1999-03-02 09:44:33 10HmaY-0005vi-00 SG  <         21:91:c3:1f:28:45:dd:2c:ac:d6:38:44:e7:b0:bb:de:5a:dc:\n         45:1c:46:f1:76:a8:0d:bf:aa:4f:f4:03:5e:1e:fb:b7:10:16:\n         4d:4e:51:f1:8f:b9:e4:38:10:69:02:c1:6b:27:2d:7c:15:f0:\n         b7:0b:4c:51:ab:21:43:36:3e:4e:3a:68:7d:61:15:37:c3:2a:\n         b8:3e:34:85:4e:1c:54:55:95:7a:0b:80:70:38:77:d0:bd:4e:\n         c4:ca:ab:af:14:ea:a3:24:43:13:eb:27:97:82:11:a2:15:29:\n         3c:15:f2:f8:e9:8d:d7:ad:20:b5:77:d7:01:8f:84:95:c1:e8:\n         25:db\n>
+1999-03-02 09:44:33 10HmaY-0005vi-00 SAN <DNS=*.test.ex;DNS=server1.example.com;DNS=alternatename2.server1.example.com;DNS=alternatename.server1.example.com>
+1999-03-02 09:44:33 10HmaY-0005vi-00 OCU <http://oscp.example.com/>
 1999-03-02 09:44:33 10HmaY-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/log/5840 b/test/log/5840
index 7823a2ae9..65666a14a 100644
--- a/test/log/5840
+++ b/test/log/5840
@@ -28,45 +28,38 @@
 1999-03-02 09:44:33 10HmbJ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for CALLER@dane.no.2.test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmbH-0005vi-00 H=danelazy.test.ex [ip4.ip4.ip4.ip4]: DANE error: tlsa lookup DEFER
-1999-03-02 09:44:33 10HmbH-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 10HmbH-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
-1999-03-02 09:44:33 10HmbH-0005vi-00 => CALLER@mxdanelazy.test.ex R=client T=send_to_server H=danelazy2.test.ex [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbK-0005vi-00"
-1999-03-02 09:44:33 10HmbH-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbH-0005vi-00 H=danelazy2.test.ex [127.0.0.1]: DANE error: tlsa lookup DEFER
+1999-03-02 09:44:33 10HmbH-0005vi-00 == CALLER@mxdanelazy.test.ex R=client T=send_to_server defer (-36): DANE error: tlsa lookup DEFER
 1999-03-02 09:44:33 10HmbI-0005vi-00 ** CALLER@dane.no.1.test.ex R=client T=send_to_server: DANE error: tlsa lookup FAIL
-1999-03-02 09:44:33 10HmbL-0005vi-00 <= <> R=10HmbI-0005vi-00 U=EXIMUSER P=local S=sss for CALLER@myhost.test.ex
-1999-03-02 09:44:33 10HmbL-0005vi-00 H=myhost.test.ex [V4NET.10.10.10] Network Error
-1999-03-02 09:44:33 10HmbL-0005vi-00 == CALLER@myhost.test.ex R=client T=send_to_server defer (dd): Network Error
+1999-03-02 09:44:33 10HmbI-0005vi-00 CALLER@dane.no.1.test.ex: error ignored
 1999-03-02 09:44:33 10HmbI-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbJ-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
 1999-03-02 09:44:33 10HmbJ-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
-1999-03-02 09:44:33 10HmbJ-0005vi-00 => CALLER@dane.no.2.test.ex R=client T=send_to_server H=dane.no.2.test.ex [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbM-0005vi-00"
+1999-03-02 09:44:33 10HmbJ-0005vi-00 => CALLER@dane.no.2.test.ex R=client T=send_to_server H=dane.no.2.test.ex [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbK-0005vi-00"
 1999-03-02 09:44:33 10HmbJ-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex for CALLER@dane256ee.test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex for CALLER@dane256ee.test.ex
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <CALLER@dane256ee.test.ex> R=server
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex for CALLER@mxdane512ee.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex for CALLER@mxdane512ee.test.ex
 1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <CALLER@mxdane512ee.test.ex> R=server
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbB-0005vi-00@myhost.test.ex for CALLER@mxdane256ta.test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= <> H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbB-0005vi-00@myhost.test.ex for CALLER@mxdane256ta.test.ex
 1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <CALLER@mxdane256ta.test.ex> R=server
 1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbD-0005vi-00@myhost.test.ex for CALLER@thishost.test.ex
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbD-0005vi-00@myhost.test.ex for CALLER@thishost.test.ex
 1999-03-02 09:44:33 10HmbE-0005vi-00 => :blackhole: <CALLER@thishost.test.ex> R=server
 1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmbG-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbF-0005vi-00@myhost.test.ex for CALLER@thishost.test.ex
+1999-03-02 09:44:33 10HmbG-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbF-0005vi-00@myhost.test.ex for CALLER@thishost.test.ex
 1999-03-02 09:44:33 10HmbG-0005vi-00 => :blackhole: <CALLER@thishost.test.ex> R=server
 1999-03-02 09:44:33 10HmbG-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmbK-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbH-0005vi-00@myhost.test.ex for CALLER@mxdanelazy.test.ex
-1999-03-02 09:44:33 10HmbK-0005vi-00 => :blackhole: <CALLER@mxdanelazy.test.ex> R=server
+1999-03-02 09:44:33 10HmbK-0005vi-00 <= <> H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbJ-0005vi-00@myhost.test.ex for CALLER@dane.no.2.test.ex
+1999-03-02 09:44:33 10HmbK-0005vi-00 => :blackhole: <CALLER@dane.no.2.test.ex> R=server
 1999-03-02 09:44:33 10HmbK-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbM-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmbJ-0005vi-00@myhost.test.ex for CALLER@dane.no.2.test.ex
-1999-03-02 09:44:33 10HmbM-0005vi-00 => :blackhole: <CALLER@dane.no.2.test.ex> R=server
-1999-03-02 09:44:33 10HmbM-0005vi-00 Completed
diff --git a/test/log/5900 b/test/log/5900
new file mode 100644
index 000000000..8b273b8a9
--- /dev/null
+++ b/test/log/5900
@@ -0,0 +1,2 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 == userx@test.ex R=scan T=scan defer (2): No such file or directory: scan transport accessing directory: TESTSUITE/test-mail/subdir failed with error: No such file or directory
diff --git a/test/log/5901 b/test/log/5901
new file mode 100644
index 000000000..6a3797abd
--- /dev/null
+++ b/test/log/5901
@@ -0,0 +1,2 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 == userx@test.ex R=scan T=scan defer (-1): scan transport directory: test-mail/subdir is not absolute
diff --git a/test/log/5902 b/test/log/5902
new file mode 100644
index 000000000..6642e4f68
--- /dev/null
+++ b/test/log/5902
@@ -0,0 +1,7 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 => user1 <user1@test.ex> R=scan T=scan
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 Start queue run: pid=pppp
+1999-03-02 09:44:33 10HmaX-0005vi-00 => user1 <user1@test.ex> R=local T=local_delivery
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp
diff --git a/test/mail/0137.userx b/test/mail/0137.userx
index 7dd068d10..c44698254 100644
--- a/test/mail/0137.userx
+++ b/test/mail/0137.userx
@@ -3,6 +3,7 @@ Received: from CALLER by the.local.host.name with local (Exim x.yz)
 	(envelope-from <CALLER@test.ex>)
 	id 10HmaX-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Subject: First
 Transport: local_delivery
 Message-Id: <E10HmaX-0005vi-00@the.local.host.name>
 From: CALLER_NAME <CALLER@test.ex>
@@ -15,6 +16,7 @@ Received: from CALLER by the.local.host.name with local (Exim x.yz)
 	(envelope-from <CALLER@test.ex>)
 	id 10HmaY-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Subject: Second
 Transport: local_delivery
 Message-Id: <E10HmaY-0005vi-00@the.local.host.name>
 From: CALLER_NAME <CALLER@test.ex>
@@ -27,6 +29,7 @@ Received: from CALLER by the.local.host.name with local (Exim x.yz)
 	(envelope-from <CALLER@test.ex>)
 	id 10HmaZ-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Subject: Third
 Transport: local_delivery_fcntl
 Message-Id: <E10HmaZ-0005vi-00@the.local.host.name>
 From: CALLER_NAME <CALLER@test.ex>
@@ -39,6 +42,7 @@ Received: from CALLER by the.local.host.name with local (Exim x.yz)
 	(envelope-from <CALLER@test.ex>)
 	id 10HmbA-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Subject: Fourth
 Transport: local_delivery_fcntl_blocking
 Message-Id: <E10HmbA-0005vi-00@the.local.host.name>
 From: CALLER_NAME <CALLER@test.ex>
diff --git a/test/mail/0461.CALLER b/test/mail/0461.CALLER
index 35a3ff77a..7321dd6db 100644
--- a/test/mail/0461.CALLER
+++ b/test/mail/0461.CALLER
@@ -21,7 +21,7 @@ A message that you sent could not be delivered to one or more of its
 recipients. This is a permanent error. The following address(es) failed:
 
   userx@test.ex
-    retry time not reached for any host after a long failure period
+    all hosts for 'test.ex' have been failing for a long time (and retry time not reached)
 
 --NNNNNNNNNN-eximdsn-MMMMMMMMMM
 Content-type: message/delivery-status
@@ -121,7 +121,7 @@ A message that you sent could not be delivered to one or more of its
 recipients. This is a permanent error. The following address(es) failed:
 
   userx@test.ex
-    retry time not reached for any host after a long failure period
+    all hosts for 'test.ex' have been failing for a long time (and retry time not reached)
 
 --NNNNNNNNNN-eximdsn-MMMMMMMMMM
 Content-type: message/delivery-status
diff --git a/test/mail/2013.userx b/test/mail/2013.userx
index def44beae..a0615146b 100644
--- a/test/mail/2013.userx
+++ b/test/mail/2013.userx
@@ -16,21 +16,3 @@ TLS: cipher=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 peerdn=
 
 Test message 1
 
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from localhost ([127.0.0.1]:1111 helo=myhost.test.ex)
-	by myhost.test.ex with esmtps (TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256)
-	(Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbA-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-Received: from CALLER by myhost.test.ex with local (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaY-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
-From: CALLER_NAME <CALLER@myhost.test.ex>
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-TLS: cipher=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 peerdn=
-
-Test message 2
-
diff --git a/test/mail/2013.usery b/test/mail/2013.usery
new file mode 100644
index 000000000..a93a63d14
--- /dev/null
+++ b/test/mail/2013.usery
@@ -0,0 +1,18 @@
+From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
+Received: from localhost ([127.0.0.1]:1111 helo=myhost.test.ex)
+	by myhost.test.ex with esmtps (TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256)
+	(Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbA-0005vi-00
+	for usery@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Received: from CALLER by myhost.test.ex with local (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaY-0005vi-00
+	for usery@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+TLS: cipher=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 peerdn=
+
+Test message 2
+
diff --git a/test/mail/5902.user1 b/test/mail/5902.user1
new file mode 100644
index 000000000..6cc3901e6
--- /dev/null
+++ b/test/mail/5902.user1
@@ -0,0 +1,10 @@
+From CALLER@test.ex Tue Mar 02 09:44:33 1999
+Received: from CALLER by the.local.host.name with local (Exim x.yz)
+	(envelope-from <CALLER@test.ex>)
+	id 10HmaX-0005vi-00
+	for user1@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmaX-0005vi-00@the.local.host.name>
+From: CALLER_NAME <CALLER@test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+
+
diff --git a/test/msglog/0420.10HmaX-0005vi-00 b/test/msglog/0420.10HmaX-0005vi-00
index b14f9b1e9..518070603 100644
--- a/test/msglog/0420.10HmaX-0005vi-00
+++ b/test/msglog/0420.10HmaX-0005vi-00
@@ -1 +1 @@
-1999-03-02 09:44:33 Received from x@y H=[V4NET.0.0.0] P=smtp S=sss
+1999-03-02 09:44:33 Received from x@y H=(client.test.ex) [127.0.0.1] P=smtp S=sss
diff --git a/test/msglog/0420.10HmaY-0005vi-00 b/test/msglog/0420.10HmaY-0005vi-00
index 6c25e0e5d..532c7a67a 100644
--- a/test/msglog/0420.10HmaY-0005vi-00
+++ b/test/msglog/0420.10HmaY-0005vi-00
@@ -1 +1 @@
-1999-03-02 09:44:33 Received from a@b H=[V4NET.0.0.0] P=smtp S=sss
+1999-03-02 09:44:33 Received from a@b H=(client.test.ex) [127.0.0.1] P=smtp S=sss
diff --git a/test/paniclog/0013 b/test/paniclog/0013
deleted file mode 100644
index 78e7e579a..000000000
--- a/test/paniclog/0013
+++ /dev/null
@@ -1,2 +0,0 @@
-1999-03-02 09:44:33 Exim configuration error in line 15 of TESTSUITE/test-config:
-  extra characters follow string value for relay_hosts
diff --git a/test/paniclog/0148 b/test/paniclog/0148
index bf2bfc0b3..b04330247 100644
--- a/test/paniclog/0148
+++ b/test/paniclog/0148
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 Exim configuration error in line 17 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 12 of TESTSUITE/test-config:
   missing quote at end of string value for hold_domains
diff --git a/test/paniclog/0236 b/test/paniclog/0236
index 66533fed4..0b188c736 100644
--- a/test/paniclog/0236
+++ b/test/paniclog/0236
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 Exim configuration error in line 15 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 10 of TESTSUITE/test-config:
   macro name too long (maximum is 63 characters)
diff --git a/test/paniclog/0290 b/test/paniclog/0290
index 24b6854cc..3d01d63bb 100644
--- a/test/paniclog/0290
+++ b/test/paniclog/0290
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 Exim configuration error in line 27 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 22 of TESTSUITE/test-config:
   .include specifies a non-absolute path "non/absolute"
diff --git a/test/paniclog/0348 b/test/paniclog/0348
index d2c59c2ad..70311339f 100644
--- a/test/paniclog/0348
+++ b/test/paniclog/0348
@@ -1,8 +1,8 @@
-1999-03-02 09:44:33 Exim configuration error in line 25 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
   bad parameters for retry rule
-1999-03-02 09:44:33 Exim configuration error in line 25 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
   bad parameters for retry rule
-1999-03-02 09:44:33 Exim configuration error in line 25 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
   bad parameters for retry rule
-1999-03-02 09:44:33 Exim configuration error in line 25 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
   bad parameters for retry rule
diff --git a/test/paniclog/0415 b/test/paniclog/0415
index bedff5d78..2ed26d3f3 100644
--- a/test/paniclog/0415
+++ b/test/paniclog/0415
@@ -1,20 +1,20 @@
-1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 15 of TESTSUITE/test-config:
   absolute value of integer "4000000M" is too large (overflow)
-1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 15 of TESTSUITE/test-config:
   extra characters follow integer value for check_spool_space
-1999-03-02 09:44:33 Exim configuration error in line 21 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 16 of TESTSUITE/test-config:
   integer "4000000000.123" is too large (overflow)
-1999-03-02 09:44:33 Exim configuration error in line 21 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 16 of TESTSUITE/test-config:
   integer "4000000.123" is too large (overflow)
-1999-03-02 09:44:33 Exim configuration error in line 23 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 18 of TESTSUITE/test-config:
   absolute value of integer "999999999999999999" is too large (overflow)
-1999-03-02 09:44:33 Exim configuration error in line 23 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 18 of TESTSUITE/test-config:
   absolute value of integer "999999999K" is too large (overflow)
-1999-03-02 09:44:33 Exim configuration error in line 23 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 18 of TESTSUITE/test-config:
   absolute value of integer "999999M" is too large (overflow)
-1999-03-02 09:44:33 Exim configuration error in line 23 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 18 of TESTSUITE/test-config:
   extra characters follow integer value for finduser_retries
-1999-03-02 09:44:33 Exim configuration error in line 23 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 18 of TESTSUITE/test-config:
   integer expected for finduser_retries
-1999-03-02 09:44:33 Exim configuration error in line 23 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 18 of TESTSUITE/test-config:
   extra characters follow integer value for finduser_retries
diff --git a/test/paniclog/0439 b/test/paniclog/0439
index 9b990fca5..18974ef51 100644
--- a/test/paniclog/0439
+++ b/test/paniclog/0439
@@ -1,3 +1,5 @@
 1999-03-02 09:44:33 invalid value for message_size_limit: absolute value of integer "8796093022208M" is too large (overflow)
 1999-03-02 09:44:33 invalid message_size_limit: absolute value of integer "8796093022208M" is too large (overflow)
+
+******** SERVER ********
 1999-03-02 09:44:33 invalid message_size_limit: absolute value of integer "8796093022208M" is too large (overflow)
diff --git a/test/paniclog/0442 b/test/paniclog/0442
index 6db126e5a..85904224e 100644
--- a/test/paniclog/0442
+++ b/test/paniclog/0442
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 Exim configuration error in line 43 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 38 of TESTSUITE/test-config:
   failed to open included configuration file /non/existent
diff --git a/test/paniclog/2020 b/test/paniclog/2020
deleted file mode 100644
index e16a6800b..000000000
--- a/test/paniclog/2020
+++ /dev/null
@@ -1,8 +0,0 @@
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
-
-******** SERVER ********
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
diff --git a/test/paniclog/2120 b/test/paniclog/2120
deleted file mode 100644
index e16a6800b..000000000
--- a/test/paniclog/2120
+++ /dev/null
@@ -1,8 +0,0 @@
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
-
-******** SERVER ********
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
diff --git a/test/paniclog/5900 b/test/paniclog/5900
new file mode 100644
index 000000000..70058d78e
--- /dev/null
+++ b/test/paniclog/5900
@@ -0,0 +1 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 == userx@test.ex R=scan T=scan defer (2): No such file or directory: scan transport accessing directory: TESTSUITE/test-mail/subdir failed with error: No such file or directory
diff --git a/test/paniclog/5901 b/test/paniclog/5901
new file mode 100644
index 000000000..111bae495
--- /dev/null
+++ b/test/paniclog/5901
@@ -0,0 +1 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 == userx@test.ex R=scan T=scan defer (-1): scan transport directory: test-mail/subdir is not absolute
diff --git a/test/patchexim b/test/patchexim
index 3052b5dac..9659ba133 100755
--- a/test/patchexim
+++ b/test/patchexim
@@ -1,4 +1,7 @@
-#! /usr/bin/perl -w
+#! /usr/bin/env perl
+
+use strict;
+use warnings;
 
 ###############################################################################
 # This is an auxiliary script that is part of the Exim test suite. It must be #
@@ -10,8 +13,8 @@
 # be copied. The script must be run in the correct current directory.         #
 ###############################################################################
 
-open(IN, "$ARGV[0]") || die "** Failed to open $ARGV[0]: $!\n";
-open(OUT, ">eximdir/exim") || die "** Failed to open eximdir/exim: $!\n";
+open(IN, $ARGV[0]) || die "** Failed to open $ARGV[0]: $!\n";
+open(OUT, '>eximdir/exim') || die "** Failed to open eximdir/exim: $!\n";
 
 while(<IN>)
   {
@@ -23,6 +26,6 @@ while(<IN>)
 close(IN);
 close(OUT);
 
-chmod 04755, "eximdir/exim";
+chmod 04755, 'eximdir/exim';
 
 # End of patchexim script
diff --git a/test/rejectlog/0021 b/test/rejectlog/0021
index edfe63fe9..0f59e2c5d 100644
--- a/test/rejectlog/0021
+++ b/test/rejectlog/0021
@@ -29,6 +29,7 @@ I Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
 F From: ok@test4
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 1999-03-02 09:44:33 H=[10.9.8.7] U=CALLER rejected connection in "connect" ACL
+1999-03-02 09:44:33 H=[10.9.8.7] U=CALLER rejected connection in "connect" ACL
 1999-03-02 09:44:33 H=[10.9.8.8] U=CALLER rejected MAIL <bad@test1>
 1999-03-02 09:44:33 mail accepted "mail from:<ok@test1>" "<ok@test1>"
 1999-03-02 09:44:33 H=[10.9.8.9] U=CALLER rejected connection in "connect" ACL: forcibly dropped
diff --git a/test/rejectlog/0214 b/test/rejectlog/0214
index 614af1fb5..5cdd84c43 100644
--- a/test/rejectlog/0214
+++ b/test/rejectlog/0214
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=[127.0.0.1] F=<x@y.x> rejected after DATA: malformed address: ;bad@address;bad@address;bad@add may not follow bad@address: failing address in "To:" header begins: bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;\n    bad@address;bad@address
 Envelope-from: <x@y.x>
 Envelope-to: <x@test.ex>
diff --git a/test/rejectlog/0300 b/test/rejectlog/0300
index d330f46cd..037f03fdb 100644
--- a/test/rejectlog/0300
+++ b/test/rejectlog/0300
@@ -1,7 +1,9 @@
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "ehlo abcd" H=[127.0.0.1] next input="mail from:<userx@test.ex>\r\n"
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(abcd) [127.0.0.1] next input="the message\r\nsecond line\r\n"
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "mail from:<userx@test.ex>" H=(abcd) [127.0.0.1] next input="rcpt to:<userx@test.ex>\r\n"
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "mail from:<userx@test.ex>" H=(abcd) [ip4.ip4.ip4.ip4] next input="rcpt to:<userx@test.ex>\r\n"
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "junk1" H=[ip4.ip4.ip4.ip4] next input="junk2\r\n"
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "rset" H=(abcd) [ip4.ip4.ip4.ip4] next input="quit\r\n"
+
+******** SERVER ********
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "ehlo abcd" H=[127.0.0.1] next input="mail fr<suppressed>
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(abcd) [127.0.0.1] next input="the mes<suppressed>
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "mail from:<userx@test.ex>" H=(abcd) [127.0.0.1] next input="rcpt to<suppressed>
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "mail from:<userx@test.ex>" H=(abcd) [ip4.ip4.ip4.ip4] next input="rcpt to<suppressed>
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "junk1" H=[ip4.ip4.ip4.ip4] next input="junk2\r<suppressed>
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "rset" H=(abcd) [ip4.ip4.ip4.ip4] next input="quit\r\<suppressed>
 1999-03-02 09:44:33 SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=[127.0.0.1] input="helo abcd\r\n"
diff --git a/test/rejectlog/0301 b/test/rejectlog/0301
index 24a81c867..cc6a4b092 100644
--- a/test/rejectlog/0301
+++ b/test/rejectlog/0301
@@ -1 +1,3 @@
-1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(en.force) [127.0.0.1] next input="the message\r\n"
+
+******** SERVER ********
+1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(en.force) [127.0.0.1] next input="the mes<suppressed>
diff --git a/test/rejectlog/0314 b/test/rejectlog/0314
new file mode 100644
index 000000000..c18fe0b52
--- /dev/null
+++ b/test/rejectlog/0314
@@ -0,0 +1,4 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 refused connection from [127.0.0.1] (host_reject_connection)
+1999-03-02 09:44:33 refused connection from [127.0.0.1] (host_reject_connection)
diff --git a/test/rejectlog/0458 b/test/rejectlog/0458
index 99d003990..05bacb912 100644
--- a/test/rejectlog/0458
+++ b/test/rejectlog/0458
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1]:1111 I=[127.0.0.1]:1225 F=<userx@test.ex> rejected RCPT <userx@test.ex>
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1]:1112 I=[127.0.0.1]:1225 F=<userx@test.ex> rejected RCPT <userx@test.ex>
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1]:1113 I=[127.0.0.1]:1225 rejected MAIL <deny@test.ex>
diff --git a/test/rejectlog/0482 b/test/rejectlog/0482
index f829fb217..9bbdd8691 100644
--- a/test/rejectlog/0482
+++ b/test/rejectlog/0482
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=(foobar) [127.0.0.1] F=<userx@test.ex> rejected after DATA: unqualified address not permitted: failing address in "From:" header is: userx
 Envelope-from: <userx@test.ex>
 Envelope-to: <userx@test.ex>
diff --git a/test/rejectlog/0547 b/test/rejectlog/0547
index e72b967dd..e9e6a30e6 100644
--- a/test/rejectlog/0547
+++ b/test/rejectlog/0547
@@ -1,2 +1,4 @@
-1999-03-02 09:44:33 H=(x.y.z) [127.0.0.1] rejected VRFY a@b.c
 1999-03-02 09:44:33 U=CALLER rejected EXPN x@y
+
+******** SERVER ********
+1999-03-02 09:44:33 H=(x.y.z) [127.0.0.1] rejected VRFY a@b.c
diff --git a/test/rejectlog/0556 b/test/rejectlog/0556
index 2f0d87f1b..29c59daf8 100644
--- a/test/rejectlog/0556
+++ b/test/rejectlog/0556
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was advertised): rejected "data" H=(abcd) [127.0.0.1] next input="Start: sent early ...\r\n"
 1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "mail from:<userx@test.ex>" H=(abcd) [127.0.0.1] next input="rcpt to:<userx@test.ex>\r\n"
 1999-03-02 09:44:33 SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "rcpt to:<userx@test.ex>" H=(abcd) [127.0.0.1] next input="data\r\n"
diff --git a/test/rejectlog/0562 b/test/rejectlog/0562
index 951f79e39..e40415254 100644
--- a/test/rejectlog/0562
+++ b/test/rejectlog/0562
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 SMTP call from [127.0.0.1] dropped: too many unrecognized commands (last was "unknown")
 1999-03-02 09:44:33 H=[127.0.0.1] rejected VRFY foo@bar
 1999-03-02 09:44:33 SMTP call from [127.0.0.1] dropped: too many nonmail commands (last was "vrfy")
diff --git a/test/rejectlog/0570 b/test/rejectlog/0570
index 89a2fcf74..a1acc1559 100644
--- a/test/rejectlog/0570
+++ b/test/rejectlog/0570
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
 1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <usery@domB.ex>: discarded by RCPT ACL
 1999-03-02 09:44:33 H=localhost (primary.test.ex) [127.0.0.1] F=<CALLER@test.ex> RCPT <userx@domA.ex>: discarded by RCPT ACL
diff --git a/test/rejectlog/0610 b/test/rejectlog/0610
index c1384b3de..1cff25686 100644
--- a/test/rejectlog/0610
+++ b/test/rejectlog/0610
@@ -1,4 +1,4 @@
 
 ******** SERVER ********
 1999-03-02 09:44:33 H=[127.0.0.1] temporarily rejected connection in "connect" ACL
-1999-03-02 09:44:33 H=[127.0.0.2] temporarily rejected connection in "connect" ACL
+1999-03-02 09:44:33 H=[ip4.ip4.ip4.ip4] temporarily rejected connection in "connect" ACL
diff --git a/test/rejectlog/0900 b/test/rejectlog/0900
new file mode 100644
index 000000000..4c194b510
--- /dev/null
+++ b/test/rejectlog/0900
@@ -0,0 +1,3 @@
+
+******** SERVER ********
+1999-03-02 09:44:33 H=(tester) [127.0.0.1] F=<someone@some.domain> rejected RCPT <dummy@reject.ex>: relay not permitted
diff --git a/test/rejectlog/2003 b/test/rejectlog/2003
index 97453c156..f4945520b 100644
--- a/test/rejectlog/2003
+++ b/test/rejectlog/2003
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=[ip4.ip4.ip4.ip4] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: unacceptable cipher TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256
diff --git a/test/rejectlog/2004 b/test/rejectlog/2004
index 717896d9c..b5d5dd8f9 100644
--- a/test/rejectlog/2004
+++ b/test/rejectlog/2004
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: encryption required
diff --git a/test/rejectlog/2005 b/test/rejectlog/2005
index 6d89d40c2..f6ad104da 100644
--- a/test/rejectlog/2005
+++ b/test/rejectlog/2005
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=[127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@remote.test.ex>: encryption required
diff --git a/test/rejectlog/2014 b/test/rejectlog/2014
index 95cbff755..3a7e9a6a3 100644
--- a/test/rejectlog/2014
+++ b/test/rejectlog/2014
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=(rhu2tls.barb) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=
 1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock
 1999-03-02 09:44:33 H=[127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock
diff --git a/test/rejectlog/2018 b/test/rejectlog/2018
index 0b2302a20..55415be9a 100644
--- a/test/rejectlog/2018
+++ b/test/rejectlog/2018
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: "You must encrypt"
diff --git a/test/rejectlog/2103 b/test/rejectlog/2103
index 33c5c72e3..dc9db1627 100644
--- a/test/rejectlog/2103
+++ b/test/rejectlog/2103
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=[ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: unacceptable cipher TLSv1:AES256-SHA:256
diff --git a/test/rejectlog/2104 b/test/rejectlog/2104
index 717896d9c..b5d5dd8f9 100644
--- a/test/rejectlog/2104
+++ b/test/rejectlog/2104
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: encryption required
diff --git a/test/rejectlog/2105 b/test/rejectlog/2105
index 6d89d40c2..f6ad104da 100644
--- a/test/rejectlog/2105
+++ b/test/rejectlog/2105
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=[127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@remote.test.ex>: encryption required
diff --git a/test/rejectlog/2114 b/test/rejectlog/2114
index 0fbcb0fcd..895425c5a 100644
--- a/test/rejectlog/2114
+++ b/test/rejectlog/2114
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=
 1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
 1999-03-02 09:44:33 H=[127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" F=<userx@test.ex> rejected RCPT <userx@test.ex>: certificate not verified: peerdn=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
diff --git a/test/rejectlog/2118 b/test/rejectlog/2118
index 0b2302a20..55415be9a 100644
--- a/test/rejectlog/2118
+++ b/test/rejectlog/2118
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=(rhu.barb) [127.0.0.1] F=<userx@test.ex> rejected RCPT <userx@test.ex>: "You must encrypt"
diff --git a/test/rejectlog/3450 b/test/rejectlog/3450
index d7395e725..b2fa6d6df 100644
--- a/test/rejectlog/3450
+++ b/test/rejectlog/3450
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=(foobar) [127.0.0.1] rejected AUTH plain AHVzZXJ4AHNlY3JldA==: STARTTLS required before AUTH
diff --git a/test/rejectlog/3460 b/test/rejectlog/3460
index d7395e725..b2fa6d6df 100644
--- a/test/rejectlog/3460
+++ b/test/rejectlog/3460
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=(foobar) [127.0.0.1] rejected AUTH plain AHVzZXJ4AHNlY3JldA==: STARTTLS required before AUTH
diff --git a/test/rejectlog/4204 b/test/rejectlog/4204
index efd8f1576..555b43e40 100644
--- a/test/rejectlog/4204
+++ b/test/rejectlog/4204
@@ -1,3 +1,5 @@
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 U=CALLER F=<CALLER@spanish.PorquénopuedensimplementehablarenEspañol.local> rejected RCPT <userS@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
 1999-03-02 09:44:33 U=CALLER F=<CALLER@vietnamese.TạisaohọkhôngthểchỉnóitiếngViệt.local> rejected RCPT <userT@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+
+******** SERVER ********
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
diff --git a/test/rejectlog/4206 b/test/rejectlog/4206
index b25c82afe..e2430e4b8 100644
--- a/test/rejectlog/4206
+++ b/test/rejectlog/4206
@@ -1,5 +1,7 @@
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 U=CALLER sender verify fail for <userA@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
 1999-03-02 09:44:33 U=CALLER F=<userA@test.ex> rejected RCPT <user.यष्टिमधु@test.ex>: Sender verify failed
 1999-03-02 09:44:33 U=CALLER sender verify fail for <userB.જેઠીમધ@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
 1999-03-02 09:44:33 U=CALLER F=<userB.જેઠીમધ@test.ex> rejected RCPT <user.ქართული@test.ex>: Sender verify failed
+
+******** SERVER ********
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
diff --git a/test/rejectlog/4208 b/test/rejectlog/4208
index 2bbfb4fc6..939cfe8a9 100644
--- a/test/rejectlog/4208
+++ b/test/rejectlog/4208
@@ -1 +1,3 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
diff --git a/test/rejectlog/4214 b/test/rejectlog/4214
index 85f34c0c1..bf6cb2398 100644
--- a/test/rejectlog/4214
+++ b/test/rejectlog/4214
@@ -1,3 +1,5 @@
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 U=CALLER F=<CALLER@spanish.PorquénopuedensimplementehablarenEspañol.local> rejected RCPT <userS@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
 1999-03-02 09:44:33 U=CALLER F=<CALLER@vietnamese.TạisaohọkhôngthểchỉnóitiếngViệt.local> rejected RCPT <userT@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+
+******** SERVER ********
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
diff --git a/test/rejectlog/4216 b/test/rejectlog/4216
index 9c68237c1..e8d8f00f5 100644
--- a/test/rejectlog/4216
+++ b/test/rejectlog/4216
@@ -1,5 +1,7 @@
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 U=CALLER sender verify fail for <userA@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
 1999-03-02 09:44:33 U=CALLER F=<userA@test.ex> rejected RCPT <user.यष्टिमधु@test.ex>: Sender verify failed
 1999-03-02 09:44:33 U=CALLER sender verify fail for <userB.જેઠીમધ@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
 1999-03-02 09:44:33 U=CALLER F=<userB.જેઠીમધ@test.ex> rejected RCPT <user.ქართული@test.ex>: Sender verify failed
+
+******** SERVER ********
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
diff --git a/test/rejectlog/4224 b/test/rejectlog/4224
index 61373c7c8..e36be9236 100644
--- a/test/rejectlog/4224
+++ b/test/rejectlog/4224
@@ -1,3 +1,5 @@
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 U=CALLER F=<CALLER@spanish.PorquénopuedensimplementehablarenEspañol.local> rejected RCPT <userS@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
 1999-03-02 09:44:33 U=CALLER F=<CALLER@vietnamese.TạisaohọkhôngthểchỉnóitiếngViệt.local> rejected RCPT <userT@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
+
+******** SERVER ********
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
diff --git a/test/rejectlog/4226 b/test/rejectlog/4226
index e09273c2e..dd75f12fb 100644
--- a/test/rejectlog/4226
+++ b/test/rejectlog/4226
@@ -1,5 +1,7 @@
-1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
 1999-03-02 09:44:33 U=CALLER sender verify fail for <userA@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
 1999-03-02 09:44:33 U=CALLER F=<userA@test.ex> rejected RCPT <user.यष्टिमधु@test.ex>: Sender verify failed
 1999-03-02 09:44:33 U=CALLER sender verify fail for <userB.જેઠીમધ@test.ex>: response to "EHLO the.local.host.name" from 127.0.0.1 [127.0.0.1] did not include SMTPUTF8
 1999-03-02 09:44:33 U=CALLER F=<userB.જેઠીમધ@test.ex> rejected RCPT <user.ქართული@test.ex>: Sender verify failed
+
+******** SERVER ********
+1999-03-02 09:44:33 H=localhost (the.local.host.name) [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no F=<> rejected RCPT <the.local.host.name-dddddddd-testing@test.ex>: relay not permitted
diff --git a/test/rejectlog/5400 b/test/rejectlog/5400
new file mode 100644
index 000000000..bc0c95b18
--- /dev/null
+++ b/test/rejectlog/5400
@@ -0,0 +1,2 @@
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> rejected RCPT <no@domain.com>
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> rejected RCPT <no@domain.com>
diff --git a/test/rejectlog/5401 b/test/rejectlog/5401
new file mode 100644
index 000000000..abcc5c6a6
--- /dev/null
+++ b/test/rejectlog/5401
@@ -0,0 +1,2 @@
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> rejected RCPT <no@domain.com>: response to "RCPT TO:<no@domain.com>" from 127.0.0.1 [127.0.0.1] was: 550 No mate
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> rejected RCPT <no@domain.com>: response to "RCPT TO:<no@domain.com>" from 127.0.0.1 [127.0.0.1] was: 550 Not that one
diff --git a/test/rejectlog/5405 b/test/rejectlog/5405
new file mode 100644
index 000000000..7df2e1018
--- /dev/null
+++ b/test/rejectlog/5405
@@ -0,0 +1,2 @@
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected RCPT <userd@domain.com>
+1999-03-02 09:44:33 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected RCPT <useri@domain.com>: response to "RCPT TO:<useri@domain.com>" from 127.0.0.1 [127.0.0.1] was: 450 not right now
diff --git a/test/rejectlog/5500 b/test/rejectlog/5500
index 89372dcfd..6b2ce923e 100644
--- a/test/rejectlog/5500
+++ b/test/rejectlog/5500
@@ -1,3 +1,5 @@
+
+******** SERVER ********
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=(rhu.barb) [127.0.0.1] F=<> rejected after DATA
 Envelope-from: <>
 Envelope-to: <userp@test.ex>
diff --git a/test/runtest b/test/runtest
index 2b19f52e3..fbe30e910 100755
--- a/test/runtest
+++ b/test/runtest
@@ -1,4 +1,6 @@
-#! /usr/bin/perl -w
+#! /usr/bin/env perl
+# We use env, because in some environments of our build farm
+# the Perl 5.010 interpreter is only reachable via $PATH
 
 ###############################################################################
 # This is the controlling script for the "new" test suite for Exim. It should #
@@ -14,18 +16,27 @@
 ###############################################################################
 
 #use strict;
+use 5.010;
+use feature 'state';	# included in 5.010
+use warnings;
+
 use Errno;
 use FileHandle;
 use Socket;
 use Time::Local;
 use Cwd;
 use File::Basename;
+use FindBin qw'$RealBin';
+
+use lib "$RealBin/lib";
+use Exim::Runtest;
+
 use if $ENV{DEBUG} && $ENV{DEBUG} =~ /\bruntest\b/ => ('Smart::Comments' => '####');
 
 
 # Start by initializing some global variables
 
-$testversion = "4.80 (08-May-12)";
+chomp(my $testversion = `git describe --always --dirty 2>&1` || '<unknown>');
 
 # This gets embedded in the D-H params filename, and the value comes
 # from asking GnuTLS for "normal", but there appears to be no way to
@@ -33,29 +44,34 @@ $testversion = "4.80 (08-May-12)";
 # We also clamp it because of NSS interop, see addition of tls_dh_max_bits.
 # This value is correct as of GnuTLS 2.12.18 as clamped by tls_dh_max_bits.
 # normal = 2432   tls_dh_max_bits = 2236
-$gnutls_dh_bits_normal = 2236;
-
-$cf = "bin/cf -exact";
-$cr = "\r";
-$debug = 0;
-$force_continue = 0;
-$force_update = 0;
-$log_failed_filename = "failed-summary.log";
-$more = "less -XF";
-$optargs = "";
-$save_output = 0;
-$server_opts = "";
-$flavour = 'FOO';
-
-$have_ipv4 = 1;
-$have_ipv6 = 1;
-$have_largefiles = 0;
-
-$test_start = 1;
-$test_end = $test_top = 8999;
-$test_special_top = 9999;
-@test_list = ();
-@test_dirs = ();
+my $gnutls_dh_bits_normal = 2236;
+
+my $cf = 'bin/cf -exact';
+my $cr = "\r";
+my $debug = 0;
+my $flavour = do {
+  my $f = Exim::Runtest::flavour() // '';
+  (grep { $f eq $_ } Exim::Runtest::flavours()) ? $f : 'FOO';
+};
+my $force_continue = 0;
+my $force_update = 0;
+my $log_failed_filename = 'failed-summary.log';
+my $log_summary_filename = 'run-summary.log';
+my $more = 'less -XF';
+my $optargs = '';
+my $save_output = 0;
+my $server_opts = '';
+my $valgrind = 0;
+
+my $have_ipv4 = 1;
+my $have_ipv6 = 1;
+my $have_largefiles = 0;
+
+my $test_start = 1;
+my $test_end = $test_top = 8999;
+my $test_special_top = 9999;
+my @test_list = ();
+my @test_dirs = ();
 
 
 # Networks to use for DNS tests. We need to choose some networks that will
@@ -68,26 +84,32 @@ $test_special_top = 9999;
 # are defined, so it is trivially possible to change them should that ever
 # become necessary.
 
-$parm_ipv4_test_net = "224";
-$parm_ipv6_test_net = "ff00";
+my $parm_ipv4_test_net = 224;
+my $parm_ipv6_test_net = 'ff00';
 
 # Port numbers are currently hard-wired
 
-$parm_port_n = 1223;         # Nothing listening on this port
-$parm_port_s = 1224;         # Used for the "server" command
-$parm_port_d = 1225;         # Used for the Exim daemon
-$parm_port_d2 = 1226;        # Additional for daemon
-$parm_port_d3 = 1227;        # Additional for daemon
-$parm_port_d4 = 1228;        # Additional for daemon
+my $parm_port_n = 1223;         # Nothing listening on this port
+my $parm_port_s = 1224;         # Used for the "server" command
+my $parm_port_d = 1225;         # Used for the Exim daemon
+my $parm_port_d2 = 1226;        # Additional for daemon
+my $parm_port_d3 = 1227;        # Additional for daemon
+my $parm_port_d4 = 1228;        # Additional for daemon
+my $dynamic_socket;          # allocated later for PORT_DYNAMIC
+
+# Find a suiteable group name for test (currently only 0001
+# uses a group name. A numeric group id would do
+my $parm_mailgroup = Exim::Runtest::mailgroup('mail');
 
 # Manually set locale
-$ENV{'LC_ALL'} = 'C';
+$ENV{LC_ALL} = 'C';
 
-# In some environments USER does not exists, but we
-# need it for some test(s)
-$ENV{USER} = getpwuid($>)
-  if not exists $ENV{USER};
+# In some environments USER does not exist, but we need it for some test(s)
+$ENV{USER} = getpwuid($>) if not exists $ENV{USER};
 
+my ($parm_configure_owner, $parm_configure_group);
+my ($parm_ipv4, $parm_ipv6);
+my $parm_hostname;
 
 ###############################################################################
 ###############################################################################
@@ -137,6 +159,8 @@ s?\bPORT_S\b?$parm_port_s?g;
 s?\bTESTNUM\b?$_[0]?g;
 s?(\b|_)V4NET([\._])?$1$parm_ipv4_test_net$2?g;
 s?\bV6NET:?$parm_ipv6_test_net:?g;
+s?\bPORT_DYNAMIC\b?$dynamic_socket->sockport()?eg;
+s?\bMAILGROUP\b?$parm_mailgroup?g;
 }
 
 
@@ -348,7 +372,7 @@ $spid = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
 # that are specific to certain file types, though there are also some of those
 # inline too.
 
-while(<IN>)
+LINE: while(<IN>)
   {
 RESET_AFTER_EXTRA_LINE_READ:
   # Custom munges
@@ -426,7 +450,7 @@ RESET_AFTER_EXTRA_LINE_READ:
 
   # File descriptor numbers may vary
   s/^writing data block fd=\d+/writing data block fd=dddd/;
-  s/running as transport filter: write=\d+ read=\d+/running as transport filter: write=dddd read=dddd/;
+  s/(running as transport filter:) fd_write=\d+ fd_read=\d+/$1 fd_write=dddd fd_read=dddd/;
 
 
   # ======== Dumpdb output ========
@@ -436,7 +460,7 @@ RESET_AFTER_EXTRA_LINE_READ:
   if (/^($date)\s+($date)\s+($date)(\s+\*)?\s*$/)
     {
     my($date1,$date2,$date3,$expired) = ($1,$2,$3,$4);
-    $expired = "" if !defined $expired;
+    $expired = '' if !defined $expired;
     my($increment) = date_seconds($date3) - date_seconds($date2);
 
     # We used to use globally unique replacement values, but timing
@@ -528,6 +552,10 @@ RESET_AFTER_EXTRA_LINE_READ:
   s/\bAES256-GCM-SHA384\b/AES256-SHA/g;
   s/\bDHE-RSA-AES256-SHA\b/AES256-SHA/g;
 
+  # LibreSSL
+  # TLSv1:ECDHE-RSA-CHACHA20-POLY1305:256
+  s/\bECDHE-RSA-CHACHA20-POLY1305\b/AES256-SHA/g;
+
   # GnuTLS have seen:
   #   TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256
   #   TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128
@@ -652,6 +680,9 @@ RESET_AFTER_EXTRA_LINE_READ:
   s/waiting for children of \d+/waiting for children of pppp/;
   s/waiting for (\S+) \(\d+\)/waiting for $1 (pppp)/;
 
+  # The spool header file name varies with PID
+  s%^(Writing spool header file: .*/hdr).[0-9]{1,5}%$1.pppp%;
+
   # ======== Port numbers ========
   # Incoming port numbers may vary, but not in daemon startup line.
 
@@ -668,6 +699,10 @@ RESET_AFTER_EXTRA_LINE_READ:
   # Port in host address in spool file output from -Mvh
   s/^-host_address (.*)\.\d+/-host_address $1.9999/;
 
+  if ($dynamic_socket and $dynamic_socket->opened and my $port = $dynamic_socket->sockport) {
+    s/^Connecting to 127\.0\.0\.1 port \K$port/<dynamic port>/;
+  }
+
 
   # ======== Local IP addresses ========
   # The amount of space between "host" and the address in verification output
@@ -859,7 +894,7 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /^SSL info: SSLv2\/v3 write client hello A/;
     next if /^SSL info: SSLv3 read server key exchange A/;
     next if /SSL verify error: depth=0 error=certificate not trusted/;
-    s/SSL3_READ_BYTES/ssl3_read_bytes/;
+    s/SSL3_READ_BYTES/ssl3_read_bytes/i;
 
     # gnutls version variances
     next if /^Error in the pull function./;
@@ -1003,6 +1038,55 @@ RESET_AFTER_EXTRA_LINE_READ:
       while (<IN>) { last if !/^\s/; }
       }
 
+    # remote port numbers vary
+    s/(Connection request from 127.0.0.1 port) \d{1,5}/$1 sssss/;
+
+    # Skip hosts_require_dane checks when the options
+    # are unset, because dane ain't always there.
+
+    next if /in\shosts_require_dane\?\sno\s\(option\sunset\)/x;
+
+    # SUPPORT_PROXY
+    next if /host in hosts_proxy\?/;
+
+    # Experimental_International
+    next if / in smtputf8_advertise_hosts\? no \(option unset\)/;
+
+    # Environment cleaning
+    next if /\w+ in keep_environment\? (yes|no)/;
+
+    # Sizes vary with test hostname
+    s/^cmd buf flush \d+ bytes$/cmd buf flush ddd bytes/;
+
+    # Spool filesystem free space changes on different systems.
+    s/^((?:spool|log) directory space =) -?\d+K (inodes =)\s*-?\d+/$1 nnnnnK $2 nnnnn/;
+
+    # Non-TLS builds have different expansions for received_header_text
+    if (s/(with \$received_protocol)\}\} \$\{if def:tls_cipher \{\(\$tls_cipher\)\n$/$1/)
+      {
+      $_ .= <IN>;
+      s/\s+\}\}(?=\(Exim )/\}\} /;
+      }
+    if (/^  condition: def:tls_cipher$/)
+      {
+      <IN>; <IN>; <IN>; <IN>; <IN>; <IN>;
+      <IN>; <IN>; <IN>; <IN>; <IN>; next;
+      }
+
+    # Not all platforms build with DKIM enabled
+    next if /^PDKIM >> Body data for hash, canonicalized/;
+
+    # Not all platforms support TCP Fast Open, and the compile omits the check
+    if (s/\S+ in hosts_try_fastopen\? no \(option unset\)\n$//)
+      {
+      $_ .= <IN>;
+      s/ \.\.\. >>> / ... /;
+      s/Address family not supported by protocol family/Network Error/;
+      s/Network is unreachable/Network Error/;
+      }
+
+    next if /^(ppppp )?setsockopt FASTOPEN: Protocol not available$/;
+
     # When Exim is checking the size of directories for maildir, it uses
     # the check_dir_size() function to scan directories. Of course, the order
     # of the files that are obtained using readdir() varies from system to
@@ -1024,20 +1108,6 @@ RESET_AFTER_EXTRA_LINE_READ:
         @saved = ();
         }
 
-    # remote port numbers vary
-    s/(Connection request from 127.0.0.1 port) \d{1,5}/$1 sssss/;
-
-    # Skip hosts_require_dane checks when the options
-    # are unset, because dane ain't always there.
-
-    next if /in\shosts_require_dane\?\sno\s\(option\sunset\)/x;
-
-    # SUPPORT_PROXY
-    next if /host in hosts_proxy\?/;
-
-    # Experimental_International
-    next if / in smtputf8_advertise_hosts\? no \(option unset\)/;
-
       # Skip some lines that Exim puts out at the start of debugging output
       # because they will be different in different binaries.
 
@@ -1052,6 +1122,7 @@ RESET_AFTER_EXTRA_LINE_READ:
                 /^log selectors =/ ||
                 /^cwd=/ ||
                 /^Fixed never_users:/ ||
+		/^Configure owner:/ ||
                 /^Size of off_t:/
                 );
 
@@ -1090,11 +1161,22 @@ return $yield;
 #            [2] if there is a C in the prompt and $force_continue is true
 # Returns:   returns the answer
 
-sub interact{
-print $_[0];
-if ($_[1]) { $_ = "u"; print "... update forced\n"; }
-  elsif ($_[2]) { $_ = "c"; print "... continue forced\n"; }
-  else { $_ = <T>; }
+sub interact {
+  my ($prompt, $have_u, $have_c) = @_;
+
+  print $prompt;
+
+  if ($have_u) {
+    print "... update forced\n";
+    return 'u';
+  }
+
+  if ($have_c) {
+    print "... continue forced\n";
+    return 'c';
+  }
+
+  return lc <T>;
 }
 
 
@@ -1114,13 +1196,22 @@ if ($_[1]) { $_ = "u"; print "... update forced\n"; }
 
 
 sub log_failure {
-  my $logfile = shift();
-  my $testno  = shift();
-  my $detail  = shift() || '';
-  if ( open(my $fh, ">>", $logfile) ) {
-    print $fh "Test $testno $detail failed\n";
-    close $fh;
-  }
+  my ($logfile, $testno, $detail) = @_;
+
+  open(my $fh, '>>', $logfile) or return;
+
+  print $fh "Test $testno "
+        . (defined $detail ? "$detail " : '')
+        . "failed\n";
+}
+
+# Computer-readable summary results logfile
+
+sub log_test {
+  my ($logfile, $testno, $resultchar) = @_;
+
+  open(my $fh, '>>', $logfile) or return;
+  print $fh "$testno $resultchar\n";
 }
 
 
@@ -1140,8 +1231,9 @@ sub log_failure {
 #             [4] TRUE if this is a log file whose deliveries must be sorted
 #             [5] optionally, a custom munge command
 #
-# Returns:    0 comparison succeeded or differences to be ignored
-#             1 comparison failed; files may have been updated (=> re-compare)
+# Returns:    0 comparison succeeded
+#             1 comparison failed; differences to be ignored
+#             2 comparison failed; files may have been updated (=> re-compare)
 #
 # Does not return if the user replies "Q" to a prompt.
 
@@ -1167,11 +1259,13 @@ if (! -e $sf_current)
 
   for (;;)
     {
-    print "Continue, Show, or Quit? [Q] ";
-    $_ = $force_continue ? "c" : <T>;
-    tests_exit(1) if /^q?$/i;
-    log_failure($log_failed_filename, $testno, $rf) if (/^c$/i && $force_continue);
-    return 0 if /^c$/i;
+    $_ = interact('Continue, Show, or Quit? [Q] ', undef, $force_continue);
+    tests_exit(1) if /^q?$/;
+    if (/^c$/ && $force_continue) {
+      log_failure($log_failed_filename, $testno, $rf);
+      log_test($log_summary_filename, $testno, 'F') if ($force_continue);
+    }
+    return 1 if /^c$/i;
     last if (/^s$/);
     }
 
@@ -1189,10 +1283,13 @@ if (! -e $sf_current)
   print "\n";
   for (;;)
     {
-    interact("Continue, Update & retry, Quit? [Q] ", $force_update, $force_continue);
-    tests_exit(1) if /^q?$/i;
-    log_failure($log_failed_filename, $testno, $rsf) if (/^c$/i && $force_continue);
-    return 0 if /^c$/i;
+    $_ = interact('Continue, Update & retry, Quit? [Q] ', $force_update, $force_continue);
+    tests_exit(1) if /^q?$/;
+    if (/^c$/ && $force_continue) {
+      log_failure($log_failed_filename, $testno, $rf);
+      log_test($log_summary_filename, $testno, 'F')
+    }
+    return 1 if /^c$/i;
     last if (/^u$/i);
     }
   }
@@ -1203,8 +1300,10 @@ if (! -e $sf_current)
 # was a request to create a saved file. First, create the munged file from any
 # data that does exist.
 
-open(MUNGED, ">$mf") || tests_exit(-1, "Failed to open $mf: $!");
+open(MUNGED, '>', $mf) || tests_exit(-1, "Failed to open $mf: $!");
 my($truncated) = munge($rf, $extra) if -e $rf;
+
+# Append the raw server log, if it is non-empty
 if (defined $rsf && -e $rsf)
   {
   print MUNGED "\n******** SERVER ********\n";
@@ -1234,7 +1333,7 @@ if (-e $sf_current)
     {
     my(@munged, @saved, $i, $j, $k);
 
-    open(MUNGED, "$mf") || tests_exit(-1, "Failed to open $mf: $!");
+    open(MUNGED, $mf) || tests_exit(-1, "Failed to open $mf: $!");
     @munged = <MUNGED>;
     close(MUNGED);
     open(SAVED, $sf_current) || tests_exit(-1, "Failed to open $sf_current: $!");
@@ -1259,7 +1358,7 @@ if (-e $sf_current)
         }
       }
 
-    open(MUNGED, ">$mf") || tests_exit(-1, "Failed to open $mf: $!");
+    open(MUNGED, '>', $mf) || tests_exit(-1, "Failed to open $mf: $!");
     for ($i = 0; $i < @munged; $i++)
       { print MUNGED $munged[$i]; }
     close(MUNGED);
@@ -1271,7 +1370,7 @@ if (-e $sf_current)
     {
     my(@munged, $i, $j);
 
-    open(MUNGED, "$mf") || tests_exit(-1, "Failed to open $mf: $!");
+    open(MUNGED, $mf) || tests_exit(-1, "Failed to open $mf: $!");
     @munged = <MUNGED>;
     close(MUNGED);
 
@@ -1309,13 +1408,16 @@ if (-e $sf_current)
   print "\n";
   for (;;)
     {
-    interact("Continue, Retry, Update current"
-	. ($sf_current ne $sf_flavour  ? "/Save for flavour '$flavour'" : "")
-	. " & retry, Quit? [Q] ", $force_update, $force_continue);
-    tests_exit(1) if /^q?$/i;
-    log_failure($log_failed_filename, $testno, $sf_current) if (/^c$/i && $force_continue);
-    return 0 if /^c$/i;
-    return 1 if /^r$/i;
+    $_ = interact('Continue, Retry, Update current'
+	. ($sf_current ne $sf_flavour  ? "/Save for flavour '$flavour'" : '')
+	. ' & retry, Quit? [Q] ', $force_update, $force_continue);
+    tests_exit(1) if /^q?$/;
+    if (/^c$/ && $force_continue) {
+      log_failure($log_failed_filename, $testno, $sf_current);
+      log_test($log_summary_filename, $testno, 'F')
+    }
+    return 1 if /^c$/i;
+    return 2 if /^r$/i;
     last if (/^[us]$/i);
     }
   }
@@ -1324,23 +1426,23 @@ if (-e $sf_current)
 
 if (-s $mf)
   {
-	my $sf = /^u/i ? $sf_current : $sf_flavour;
-		tests_exit(-1, "Failed to cp $mf $sf") if system("cp '$mf' '$sf'") != 0;
+    my $sf = /^u/i ? $sf_current : $sf_flavour;
+    tests_exit(-1, "Failed to cp $mf $sf") if system("cp '$mf' '$sf'") != 0;
   }
 else
   {
-	# if we deal with a flavour file, we can't delete it, because next time the generic
-	# file would be used again
-	if ($sf_current eq $sf_flavour) {
-		open(FOO, ">$sf_current");
-		close(FOO);
-	}
-	else {
-		tests_exit(-1, "Failed to unlink $sf_current") if !unlink($sf_current);
-	}
+    # if we deal with a flavour file, we can't delete it, because next time the generic
+    # file would be used again
+    if ($sf_current eq $sf_flavour) {
+      open(FOO, ">$sf_current");
+      close(FOO);
+    }
+    else {
+      tests_exit(-1, "Failed to unlink $sf_current") if !unlink($sf_current);
+    }
   }
 
-return 1;
+return 2;
 }
 
 
@@ -1393,21 +1495,39 @@ $munges =
     { 'mail' => '/^(X-(Remote-MTA-(smtp-greeting|helo-response)|Exim-Diagnostic|(body|message)-linecount):|Remote-MTA: X-ip;)/'
     },
 
-    'optional_nossl' =>
+    'optional_config' =>
     { 'stdout' => '/^(
                   dkim_(canon|domain|private_key|selector|sign_headers|strict)
                   |gnutls_require_(kx|mac|protocols)
                   |hosts_(requ(est|ire)|try)_(dane|ocsp)
                   |hosts_(avoid|nopass|require|verify_avoid)_tls
+                  |socks_proxy
                   |tls_[^ ]*
                   )($|[ ]=)/x' },
 
     'sys_bindir' =>
     { 'mainlog' => 's%/(usr/)?bin/%SYSBINDIR/%' },
 
+    'sync_check_data' =>
+    { 'mainlog'   => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/',
+      'rejectlog' => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/'},
+
+    'debuglog_stdout' =>
+    { 'stdout' => 's/^\d\d:\d\d:\d\d\s+\d+ //;
+                  s/Process \d+ is ready for new message/Process pppp is ready for new message/'
+    },
+
+    'timeout_errno' =>		# actual errno differs Solaris vs. Linux
+    { 'mainlog' => 's/(host deferral .* errno) <\d+> /$1 <EEE> /' },
   };
 
 
+sub max {
+  my ($a, $b) = @_;
+  return $a if ($a > $b);
+  return $b;
+}
+
 ##################################################
 #    Subroutine to check the output of a test    #
 ##################################################
@@ -1424,47 +1544,48 @@ $munges =
 #
 # Arguments: Optionally, name of a single custom munge to run.
 # Returns:   0 if the output compared equal
-#            1 if re-run needed (files may have been updated)
+#            1 if comparison failed; differences to be ignored
+#            2 if re-run needed (files may have been updated)
 
 sub check_output{
 my($mungename) = $_[0];
 my($yield) = 0;
 my($munge) = $munges->{$mungename} if defined $mungename;
 
-$yield = 1 if check_file("spool/log/paniclog",
+$yield = max($yield,  check_file("spool/log/paniclog",
                        "spool/log/serverpaniclog",
                        "test-paniclog-munged",
                        "paniclog/$testno", 0,
-		       $munge->{'paniclog'});
+		       $munge->{paniclog}));
 
-$yield = 1 if check_file("spool/log/rejectlog",
+$yield = max($yield,  check_file("spool/log/rejectlog",
                        "spool/log/serverrejectlog",
                        "test-rejectlog-munged",
                        "rejectlog/$testno", 0,
-		       $munge->{'rejectlog'});
+		       $munge->{rejectlog}));
 
-$yield = 1 if check_file("spool/log/mainlog",
+$yield = max($yield,  check_file("spool/log/mainlog",
                        "spool/log/servermainlog",
                        "test-mainlog-munged",
                        "log/$testno", $sortlog,
-		       $munge->{'mainlog'});
+		       $munge->{mainlog}));
 
 if (!$stdout_skip)
   {
-  $yield = 1 if check_file("test-stdout",
+  $yield = max($yield,  check_file("test-stdout",
                        "test-stdout-server",
                        "test-stdout-munged",
                        "stdout/$testno", 0,
-		       $munge->{'stdout'});
+		       $munge->{stdout}));
   }
 
 if (!$stderr_skip)
   {
-  $yield = 1 if check_file("test-stderr",
+  $yield = max($yield,  check_file("test-stderr",
                        "test-stderr-server",
                        "test-stderr-munged",
                        "stderr/$testno", 0,
-		       $munge->{'stderr'});
+		       $munge->{stderr}));
   }
 
 # Compare any delivered messages, unless this test is skipped.
@@ -1502,9 +1623,9 @@ if (! $message_skip)
       }
 
     print ">> COMPARE $mail mail/$testno.$saved_mail\n" if $debug;
-    $yield = 1 if check_file($mail, undef, "test-mail-munged",
+    $yield = max($yield,  check_file($mail, undef, "test-mail-munged",
       "mail/$testno.$saved_mail", 0,
-      $munge->{'mail'});
+      $munge->{mail}));
     delete $expected_mails{"mail/$testno.$saved_mail"};
     }
 
@@ -1517,16 +1638,19 @@ if (! $message_skip)
 
     for (;;)
       {
-      interact("Continue, Update & retry, or Quit? [Q] ", $force_update, $force_continue);
-      tests_exit(1) if /^q?$/i;
-      log_failure($log_failed_filename, $testno, "missing email") if (/^c$/i && $force_continue);
-      last if /^c$/i;
+      $_ = interact('Continue, Update & retry, or Quit? [Q] ', $force_update, $force_continue);
+      tests_exit(1) if /^q?$/;
+      if (/^c$/ && $force_continue) {
+	log_failure($log_failed_filename, $testno, "missing email");
+	log_test($log_summary_filename, $testno, 'F')
+      }
+      last if /^c$/;
 
       # For update, we not only have to unlink the file, but we must also
       # remove it from the @oldmails vector, as otherwise it will still be
       # checked for when we re-run the test.
 
-      if (/^u$/i)
+      if (/^u$/)
         {
         foreach $key (keys %expected_mails)
           {
@@ -1574,9 +1698,9 @@ if (! $msglog_skip)
       ($munged_msglog = $msglog) =~
         s/((?:[^\W_]{6}-){2}[^\W_]{2})
           /new_value($1, "10Hm%s-0005vi-00", \$next_msgid)/egx;
-      $yield = 1 if check_file("spool/msglog/$msglog", undef,
+      $yield = max($yield,  check_file("spool/msglog/$msglog", undef,
         "test-msglog-munged", "msglog/$testno.$munged_msglog", 0,
-        $munge->{'msglog'});
+        $munge->{msglog}));
       delete $expected_msglogs{"$testno.$munged_msglog"};
       }
     }
@@ -1601,11 +1725,14 @@ if (! $msglog_skip)
 
     for (;;)
       {
-      interact("Continue, Update, or Quit? [Q] ", $force_update, $force_continue);
-      tests_exit(1) if /^q?$/i;
-      log_failure($log_failed_filename, $testno, "missing msglog") if (/^c$/i && $force_continue);
-      last if /^c$/i;
-      if (/^u$/i)
+      $_ = interact('Continue, Update, or Quit? [Q] ', $force_update, $force_continue);
+      tests_exit(1) if /^q?$/;
+      if (/^c$/ && $force_continue) {
+	log_failure($log_failed_filename, $testno, "missing msglog");
+	log_test($log_summary_filename, $testno, 'F')
+      }
+      last if /^c$/;
+      if (/^u$/)
         {
         foreach $key (keys %expected_msglogs)
           {
@@ -1680,6 +1807,8 @@ my($commandnameref) = $_[3];
 my($aux_info) = $_[4];
 my($yield) = 1;
 
+our %ENV = map { $_ => $ENV{$_} } grep { /^(?:USER|SHELL|PATH|TERM|EXIM_TEST_.*)$/ } keys %ENV;
+
 if (/^(\d+)\s*$/)                # Handle unusual return code
   {
   my($r) = $_[2];
@@ -1790,8 +1919,16 @@ if (/^dump\s+(\S+)/)
   }
 
 
-# The "echo" command is a way of writing comments to the screen.
+# verbose comments start with ###
+if (/^###\s/) {
+  for my $file (qw(test-stdout test-stderr test-stderr-server test-stdout-server)) {
+    open my $fh, '>>', $file or die "Can't open >>$file: $!\n";
+    say {$fh} $_;
+  }
+  return 0;
+}
 
+# The "echo" command is a way of writing comments to the screen.
 if (/^echo\s+(.*)$/)
   {
   print "$1\n";
@@ -1945,7 +2082,7 @@ if (/^sleep\s+(.*)$/)
 # Various Unix management commands are recognized
 
 if (/^(ln|ls|du|mkdir|mkfifo|touch|cp|cat)\s/ ||
-    /^sudo (rmdir|rm|chown|chmod)\s/)
+    /^sudo\s(rmdir|rm|mv|chown|chmod)\s/)
   {
   run_system("$_ >>test-stdout 2>>test-stderr");
   return 1;
@@ -1966,6 +2103,7 @@ if (/^(ln|ls|du|mkdir|mkfifo|touch|cp|cat)\s/ ||
 # command, triggered by $server_pid being non-zero. The server sends its output
 # to a different file. The variable $server_opts, if not empty, contains
 # options to disable IPv4 or IPv6 if necessary.
+# This works because "server" swallows its stdin before waiting for a connection.
 
 if (/^server\s+(.*)$/)
   {
@@ -2027,7 +2165,7 @@ if (/^(cat)?write\s+(\S+)(?:\s+(.*))?\s*$/)
     while (scalar @sizes > 0)
       {
       ($count,$len,$leadin) = (shift @sizes) =~ /(\d+)x(\d+)(?:=(.*))?/;
-      $leadin = "" if !defined $leadin;
+      $leadin = '' if !defined $leadin;
       $leadin =~ s/_/ /g;
       $len -= length($leadin) + 1;
       while ($count-- > 0)
@@ -2083,12 +2221,12 @@ if (/^client/ || /^(sudo\s+)?perl\b/)
 # not drop privilege when -C and -D options are present. To run the exim
 # command as root, we use sudo.
 
-elsif (/^([A-Z_]+=\S+\s+)?(\d+)?\s*(sudo(?:\s+-u\s+(\w+))?\s+)?exim(_\S+)?\s+(.*)$/)
+elsif (/^((?i:[A-Z\d_]+=\S+\s+)+)?(\d+)?\s*(sudo(?:\s+-u\s+(\w+))?\s+)?exim(_\S+)?\s+(.*)$/)
   {
   $args = $6;
-  my($envset) = (defined $1)? $1      : "";
-  my($sudo)   = (defined $3)? "sudo " . (defined $4 ? "-u $4 ":"")  : "";
-  my($special)= (defined $5)? $5      : "";
+  my($envset) = (defined $1)? $1      : '';
+  my($sudo)   = (defined $3)? "sudo " . (defined $4 ? "-u $4 ":'')  : '';
+  my($special)= (defined $5)? $5      : '';
   $wait_time  = (defined $2)? $2      : 0;
 
   # Return 2 rather than 1 afterwards
@@ -2130,8 +2268,7 @@ elsif (/^([A-Z_]+=\S+\s+)?(\d+)?\s*(sudo(?:\s+-u\s+(\w+))?\s+)?exim(_\S+)?\s+(.*
 
     # Done backwards just in case there are more than 9
 
-    my($i);
-    for ($i = @msglist; $i > 0; $i--) { $args =~ s/\$msg$i/$msglist[$i-1]/g; }
+    for (my $i = @msglist; $i > 0; $i--) { $args =~ s/\$msg$i/$msglist[$i-1]/g; }
     if ( $args =~ /\$msg\d/ )
       {
       tests_exit(-1, "Not enough messages in spool, for test $testno line $lineno\n")
@@ -2144,7 +2281,10 @@ elsif (/^([A-Z_]+=\S+\s+)?(\d+)?\s*(sudo(?:\s+-u\s+(\w+))?\s+)?exim(_\S+)?\s+(.*
 
   $args =~ s/(?:^|\s)-d\S*// if $optargs =~ /(?:^|\s)-d/;
 
-  $cmd = "$envset$sudo$parm_cwd/eximdir/exim$special$optargs " .
+  my $opt_valgrind = $valgrind ? "valgrind --leak-check=yes --suppressions=$parm_cwd/aux-fixed/valgrind.supp " : '';
+
+  $cmd = "$envset$sudo$opt_valgrind" .
+         "$parm_cwd/eximdir/exim$special$optargs " .
          "-DEXIM_PATH=$parm_cwd/eximdir/exim$special " .
          "-C $parm_cwd/test-config $args " .
          ">>test-stdout 2>>test-stderr";
@@ -2193,31 +2333,24 @@ elsif (/^([A-Z_]+=\S+\s+)?(\d+)?\s*(sudo(?:\s+-u\s+(\w+))?\s+)?exim(_\S+)?\s+(.*
     }
   elsif ($cmd =~ /\s-DSERVER=wait:(\d+)\s/)
     {
+
+    # The port and the $dynamic_socket was already allocated while parsing the
+    # script file, where -DSERVER=wait:PORT_DYNAMIC was encountered.
+
     my $listen_port = $1;
-    my $waitmode_sock = new FileHandle;
     if ($debug) { printf ">> wait-mode daemon: $cmd\n"; }
     run_system("sudo mkdir spool/log 2>/dev/null");
     run_system("sudo chown $parm_eximuser:$parm_eximgroup spool/log");
 
-    my ($s_ip,$s_port) = ('127.0.0.1', $listen_port);
-    my $sin = sockaddr_in($s_port, inet_aton($s_ip))
-        or die "** Failed packing $s_ip:$s_port\n";
-    socket($waitmode_sock, PF_INET, SOCK_STREAM, getprotobyname('tcp'))
-        or die "** Unable to open socket $s_ip:$s_port: $!\n";
-    setsockopt($waitmode_sock, SOL_SOCKET, SO_REUSEADDR, 1)
-        or die "** Unable to setsockopt(SO_REUSEADDR): $!\n";
-    bind($waitmode_sock, $sin)
-        or die "** Unable to bind socket ($s_port): $!\n";
-    listen($waitmode_sock, 5);
     my $pid = fork();
     if (not defined $pid) { die "** fork failed: $!\n" }
     if (not $pid) {
       close(STDIN);
-      open(STDIN, "<&", $waitmode_sock) or die "** dup sock to stdin failed: $!\n";
-      close($waitmode_sock);
+      open(STDIN, '<&', $dynamic_socket) or die "** dup sock to stdin failed: $!\n";
+      close($dynamic_socket);
       print "[$$]>> ${cmd}-server\n" if ($debug);
       exec "exec ${cmd}-server";
-      exit(1);
+      die "Can't exec ${cmd}-server: $!\n";
     }
     while (<SCRIPT>) { $lineno++; last if /^\*{4}\s*$/; }   # Ignore any input
     select(undef, undef, undef, 0.3);             # Let the daemon get going
@@ -2276,7 +2409,7 @@ else { tests_exit(-1, "Command unrecognized in line $lineno: $_"); }
 # -DSERVER=server add "-server" to the command, where it will adjoin the name
 # for the stderr file. See comment above about the use of -DSERVER.
 
-$stderrsuffix = ($cmd =~ /\s-DSERVER=server\s/)? "-server" : "";
+$stderrsuffix = ($cmd =~ /\s-DSERVER=server\s/)? "-server" : '';
 print ">> |${cmd}${stderrsuffix}\n" if ($debug);
 open CMD, "|${cmd}${stderrsuffix}" || tests_exit(1, "Failed to run $cmd");
 
@@ -2314,7 +2447,7 @@ return $yield;            # Ran command and waited
 ###############################################################################
 ###############################################################################
 
-# Here beginneth the Main Program ...
+# Here begins the Main Program ...
 
 ###############################################################################
 ###############################################################################
@@ -2327,9 +2460,9 @@ print "Exim tester $testversion\n";
 # we map all (.../bin) to (.../sbin:.../bin)
 $ENV{PATH} = do {
   my %seen = map { $_, 1 } split /:/, $ENV{PATH};
-  join ':' => map { m{(.*)/bin$} 
-                ? ( $seen{"$1/sbin"} ? () : ("$1/sbin"), $_) 
-                : ($_) } 
+  join ':' => map { m{(.*)/bin$}
+                ? ( $seen{"$1/sbin"} ? () : ("$1/sbin"), $_)
+                : ($_) }
       split /:/, $ENV{PATH};
 };
 
@@ -2344,7 +2477,7 @@ umask 022;
 #       Check for the "less" command             #
 ##################################################
 
-$more = "more" if system("which less >/dev/null 2>&1") != 0;
+$more = 'more' if system('which less >/dev/null 2>&1') != 0;
 
 
 
@@ -2353,7 +2486,7 @@ $more = "more" if system("which less >/dev/null 2>&1") != 0;
 ##################################################
 
 print "You need to have sudo access to root to run these tests. Checking ...\n";
-if (system("sudo date >/dev/null") != 0)
+if (system('sudo true >/dev/null') != 0)
   {
   die "** Test for sudo failed: testing abandoned.\n";
   }
@@ -2372,8 +2505,8 @@ else
 # as the path to the binary. If the first argument does not start with a
 # '/' but exists in the file system, it's assumed to be the Exim binary.
 
-$parm_exim = (@ARGV > 0 && (-x $ARGV[0] or $ARGV[0] =~ m?^/?))? Cwd::abs_path(shift @ARGV) : "";
-print "Exim binary is $parm_exim\n" if $parm_exim ne "";
+($parm_exim, @ARGV) = Exim::Runtest::exim_binary(@ARGV);
+print "Exim binary is $parm_exim\n" if $parm_exim ne '';
 
 
 
@@ -2388,7 +2521,7 @@ print "Exim binary is $parm_exim\n" if $parm_exim ne "";
 while (@ARGV > 0 && $ARGV[0] =~ /^-/)
   {
   my($arg) = shift @ARGV;
-  if ($optargs eq "")
+  if ($optargs eq '')
     {
     if ($arg eq "-DEBUG")  { $debug = 1; $cr = "\n"; next; }
     if ($arg eq "-DIFF")   { $cf = "diff -u"; next; }
@@ -2399,6 +2532,7 @@ while (@ARGV > 0 && $ARGV[0] =~ /^-/)
     if ($arg eq "-NOIPV4") { $have_ipv4 = 0; next; }
     if ($arg eq "-NOIPV6") { $have_ipv6 = 0; next; }
     if ($arg eq "-KEEP")   { $save_output = 1; next; }
+    if ($arg eq "-VALGRIND")   { $valgrind = 1; next; }
     if ($arg =~ /^-FLAVOU?R$/) { $flavour = shift; next; }
     }
   $optargs .= " $arg";
@@ -2438,58 +2572,9 @@ $parm_cwd = Cwd::getcwd();
 # takes precedence; otherwise exim-snapshot takes precedence over any numbered
 # releases.
 
-if ($parm_exim eq "")
-  {
-  my($use_srcdir) = "";
-
-  opendir DIR, ".." || die "** Failed to opendir \"..\": $!\n";
-  while ($f = readdir(DIR))
-    {
-    my($srcdir);
-
-    # Try this directory if it is "exim4" or if it is exim-snapshot or exim-n.m
-    # possibly followed by -RCx where n.m is greater than any previously tried
-    # directory. Thus, we should choose the highest version of Exim that has
-    # been compiled.
-
-    if ($f eq "exim4" || $f eq "exim-snapshot" || $f eq 'src')
-      { $srcdir = $f; }
-    else
-      { $srcdir = $f
-        if ($f =~ /^exim-\d+\.\d+(-RC\d+)?$/ && $f gt $use_srcdir); }
-
-    # Look for a build directory with a binary in it. If we find a binary,
-    # accept this source directory.
-
-    if ($srcdir)
-      {
-      opendir SRCDIR, "../$srcdir" ||
-        die "** Failed to opendir \"$cwd/../$srcdir\": $!\n";
-      while ($f = readdir(SRCDIR))
-        {
-        if ($f =~ /^build-/ && -e "../$srcdir/$f/exim")
-          {
-          $use_srcdir = $srcdir;
-          $parm_exim = "$cwd/../$srcdir/$f/exim";
-          $parm_exim =~ s'/[^/]+/\.\./'/';
-          last;
-          }
-        }
-      closedir(SRCDIR);
-      }
-
-    # If we have found "exim4" or "exim-snapshot", that takes precedence.
-    # Otherwise, continue to see if there's a later version.
-
-    last if $use_srcdir eq "exim4" || $use_srcdir eq "exim-snapshot";
-    }
-  closedir(DIR);
-  print "Exim binary found in $parm_exim\n" if $parm_exim ne "";
-  }
-
 # If $parm_exim is still empty, ask the caller
 
-if ($parm_exim eq "")
+if ($parm_exim eq '')
   {
   print "** Did not find an Exim binary to test\n";
   for ($i = 0; $i < 5; $i++)
@@ -2507,7 +2592,7 @@ if ($parm_exim eq "")
       print "** $trybin does not exist\n";
       }
     }
-  die "** Too many tries\n" if $parm_exim eq "";
+  die "** Too many tries\n" if $parm_exim eq '';
   }
 
 
@@ -2527,30 +2612,53 @@ close(IN);
 close(OUT);
 
 print("Probing with config file: $parm_cwd/test-config\n");
-open(EXIMINFO, "$parm_exim -d -C $parm_cwd/test-config -DDIR=$parm_cwd " .
-               "-bP exim_user exim_group 2>&1|") ||
-  die "** Cannot run $parm_exim: $!\n";
-while(<EXIMINFO>)
+
+my $eximinfo = "$parm_exim -d -C $parm_cwd/test-config -DDIR=$parm_cwd -bP exim_user exim_group";
+chomp(my @eximinfo = `$eximinfo 2>&1`);
+die "$0: Can't run $eximinfo\n" if $? == -1;
+
+warn 'Got ' . $?>>8 . " from $eximinfo\n" if $?;
+foreach (@eximinfo)
   {
+  if (my ($version) = /^Exim version (\S+)/) {
+    my $git = `git describe --dirty=-XX --match 'exim-4*'`;
+    if (defined $git and $? == 0) {
+      chomp $git;
+      $version =~ s/^\d+\K\./_/;
+      $git =~ s/^exim-//i;
+      $git =~ s/.*-\Kg([[:xdigit:]]+(?:-XX)?)/$1/;
+      print <<___
+
+*** Version mismatch
+*** Exim binary: $version
+*** Git        : $git
+
+___
+        if not $version eq $git;
+    }
+  }
   $parm_eximuser = $1 if /^exim_user = (.*)$/;
   $parm_eximgroup = $1 if /^exim_group = (.*)$/;
   $parm_trusted_config_list = $1 if /^TRUSTED_CONFIG_LIST:.*?"(.*?)"$/;
-  print "$_" if /wrong owner/;
+  ($parm_configure_owner, $parm_configure_group) = ($1, $2)
+	if /^Configure owner:\s*(\d+):(\d+)/;
+  print if /wrong owner/;
   }
-close(EXIMINFO);
 
-if (defined $parm_eximuser)
-  {
-  if ($parm_eximuser =~ /^\d+$/) { $parm_exim_uid = $parm_eximuser; }
-    else { $parm_exim_uid = getpwnam($parm_eximuser); }
-  }
-else
-  {
-  print "Unable to extract exim_user from binary.\n";
-  print "Check if Exim refused to run; if so, consider:\n";
-  print "  TRUSTED_CONFIG_LIST ALT_CONFIG_PREFIX WHITELIST_D_MACROS\n";
-  die "Failing to get information from binary.\n";
-  }
+if (not defined $parm_eximuser) {
+  die <<XXX, map { "|$_\n" } @eximinfo;
+Unable to extract exim_user from binary.
+Check if Exim refused to run; if so, consider:
+  TRUSTED_CONFIG_LIST ALT_CONFIG_PREFIX WHITELIST_D_MACROS
+If debug permission denied, are you in the exim group?
+Failing to get information from binary.
+Output from $eximinfo:
+XXX
+
+}
+
+if ($parm_eximuser =~ /^\d+$/) { $parm_exim_uid = $parm_eximuser; }
+else { $parm_exim_uid = getpwnam($parm_eximuser); }
 
 if (defined $parm_eximgroup)
   {
@@ -2586,7 +2694,15 @@ else
   die "Unable to check the TRUSTED_CONFIG_LIST, seems to be empty?\n";
   }
 
-open(EXIMINFO, "$parm_exim -bV -C $parm_cwd/test-config -DDIR=$parm_cwd |") ||
+die "CONFIGURE_OWNER ($parm_configure_owner) does not match the user invoking $0 ($>)\n"
+	if $parm_configure_owner != $>;
+
+die "CONFIGURE_GROUP ($parm_configure_group) does not match the group invoking $0 ($))\n"
+	if 0020 & (stat "$parm_cwd/test-config")[2]
+	and $parm_configure_group != $);
+
+
+open(EXIMINFO, "$parm_exim -d-all+transport -bV -C $parm_cwd/test-config -DDIR=$parm_cwd |") ||
   die "** Cannot run $parm_exim: $!\n";
 
 print "-" x 78, "\n";
@@ -2595,7 +2711,7 @@ while (<EXIMINFO>)
   {
   my(@temp);
 
-  if (/^Exim version/) { print; }
+  if (/^(Exim|Library) version/) { print; }
 
   elsif (/^Size of off_t: (\d+)/)
     {
@@ -2653,7 +2769,7 @@ while (<EXIMINFO>)
       if ($k =~ "/")
         {
         @temp = split /\//, $k;
-        $parm_transports{"$temp[0]"} = " ";
+        $parm_transports{$temp[0]} = " ";
         for ($i = 1; $i < @temp; $i++)
           { $parm_transports{"$temp[0]/$temp[$i]"} = " "; }
         }
@@ -2672,7 +2788,7 @@ unlink("$parm_cwd/test-config");
 # These are crude tests. If they aren't good enough, we'll have to improve
 # them, for example by actually passing a message through spamc or clamscan.
 
-if (defined $parm_support{'Content_Scanning'})
+if (defined $parm_support{Content_Scanning})
   {
   my $sock = new FileHandle;
 
@@ -2723,7 +2839,7 @@ if (defined $parm_support{'Content_Scanning'})
       }
     else
       {
-      $parm_running{'SpamAssassin'} = ' ';
+      $parm_running{SpamAssassin} = ' ';
       print "  SpamAssassin (spamd) seems to be running\n";
       }
     }
@@ -2742,11 +2858,11 @@ if (defined $parm_support{'Content_Scanning'})
     print "The clamscan command works";
 
     $test_prefix = $ENV{EXIM_TEST_PREFIX};
-    $test_prefix = "" if !defined $test_prefix;
+    $test_prefix = '' if !defined $test_prefix;
 
     foreach $f ("$test_prefix/etc/clamd.conf",
                 "$test_prefix/usr/local/etc/clamd.conf",
-                "$test_prefix/etc/clamav/clamd.conf", "")
+                "$test_prefix/etc/clamav/clamd.conf", '')
       {
       if (-e $f)
         {
@@ -2757,7 +2873,7 @@ if (defined $parm_support{'Content_Scanning'})
 
     # Read the ClamAV configuration file and find the socket interface.
 
-    if ($clamconf ne "")
+    if ($clamconf ne '')
       {
       my $socket_domain;
       open(IN, "$clamconf") || die "\n** Unable to open $clamconf: $!\n";
@@ -2844,7 +2960,7 @@ if (defined $parm_support{'Content_Scanning'})
           }
         else
           {
-          $parm_running{'ClamAV'} = ' ';
+          $parm_running{ClamAV} = ' ';
           print "  ClamAV seems to be running\n";
           }
         }
@@ -2867,12 +2983,12 @@ if (defined $parm_support{'Content_Scanning'})
 ##################################################
 #       Check for redis                          #
 ##################################################
-if (defined $parm_lookups{'redis'})
+if (defined $parm_lookups{redis})
   {
   if (system("redis-server -v 2>/dev/null >/dev/null") == 0)
     {
     print "The redis-server command works\n";
-    $parm_running{'redis'} = ' ';
+    $parm_running{redis} = ' ';
     }
   else
     {
@@ -2887,21 +3003,21 @@ if (defined $parm_lookups{'redis'})
 # This test suite assumes that Exim has been built with at least the "usual"
 # set of routers, transports, and lookups. Ensure that this is so.
 
-$missing = "";
+$missing = '';
 
-$missing .= "     Lookup: lsearch\n" if (!defined $parm_lookups{'lsearch'});
+$missing .= "     Lookup: lsearch\n" if (!defined $parm_lookups{lsearch});
 
-$missing .= "     Router: accept\n" if (!defined $parm_routers{'accept'});
-$missing .= "     Router: dnslookup\n" if (!defined $parm_routers{'dnslookup'});
-$missing .= "     Router: manualroute\n" if (!defined $parm_routers{'manualroute'});
-$missing .= "     Router: redirect\n" if (!defined $parm_routers{'redirect'});
+$missing .= "     Router: accept\n" if (!defined $parm_routers{accept});
+$missing .= "     Router: dnslookup\n" if (!defined $parm_routers{dnslookup});
+$missing .= "     Router: manualroute\n" if (!defined $parm_routers{manualroute});
+$missing .= "     Router: redirect\n" if (!defined $parm_routers{redirect});
 
-$missing .= "     Transport: appendfile\n" if (!defined $parm_transports{'appendfile'});
-$missing .= "     Transport: autoreply\n" if (!defined $parm_transports{'autoreply'});
-$missing .= "     Transport: pipe\n" if (!defined $parm_transports{'pipe'});
-$missing .= "     Transport: smtp\n" if (!defined $parm_transports{'smtp'});
+$missing .= "     Transport: appendfile\n" if (!defined $parm_transports{appendfile});
+$missing .= "     Transport: autoreply\n" if (!defined $parm_transports{autoreply});
+$missing .= "     Transport: pipe\n" if (!defined $parm_transports{pipe});
+$missing .= "     Transport: smtp\n" if (!defined $parm_transports{smtp});
 
-if ($missing ne "")
+if ($missing ne '')
   {
   print "\n";
   print "** Many features can be included or excluded from Exim binaries.\n";
@@ -2923,8 +3039,8 @@ if ($missing ne "")
 for $prog ("cf", "checkaccess", "client", "client-ssl", "client-gnutls",
            "fakens", "iefbr14", "server")
   {
-  next if ($prog eq "client-ssl" && !defined $parm_support{'OpenSSL'});
-  next if ($prog eq "client-gnutls" && !defined $parm_support{'GnuTLS'});
+  next if ($prog eq "client-ssl" && !defined $parm_support{OpenSSL});
+  next if ($prog eq "client-gnutls" && !defined $parm_support{GnuTLS});
   if (!-e "bin/$prog")
     {
     print "\n";
@@ -2938,9 +3054,9 @@ for $prog ("cf", "checkaccess", "client", "client-ssl", "client-gnutls",
 # have that functionality compiled, we needn't bother.
 
 $dlfunc_deleted = 0;
-if (defined $parm_support{'Expand_dlfunc'} && !-e "bin/loaded")
+if (defined $parm_support{Expand_dlfunc} && !-e 'bin/loaded')
   {
-  delete $parm_support{'Expand_dlfunc'};
+  delete $parm_support{Expand_dlfunc};
   $dlfunc_deleted = 1;
   }
 
@@ -2984,39 +3100,26 @@ else
 # Find this host's IP addresses - there may be many, of course, but we keep
 # one of each type (IPv4 and IPv6).
 
-$parm_ipv4 = "";
-$parm_ipv6 = "";
-
-$local_ipv4 = "";
-$local_ipv6 = "";
-
-open(IFCONFIG, "ifconfig -a|") || die "** Cannot run \"ifconfig\": $!\n";
-while (($parm_ipv4 eq "" || $parm_ipv6 eq "") && ($_ = <IFCONFIG>))
+open(IFCONFIG, '-|', (grep { -x "$_/ip" } split /:/, $ENV{PATH}) ? 'ip address' : 'ifconfig -a')
+  or die "** Cannot run 'ip address' or 'ifconfig -a'\n";
+while (not ($parm_ipv4 and $parm_ipv6) and defined($_ = <IFCONFIG>))
   {
-  my($ip);
-  if ($parm_ipv4 eq "" &&
-      $_ =~ /^\s*inet(?:\saddr)?:?\s?(\d+\.\d+\.\d+\.\d+)\s/i)
+  if (not $parm_ipv4 and /^\s*inet(?:\saddr)?:?\s?(\d+\.\d+\.\d+\.\d+)(?:\/\d+)?\s/i)
     {
-    $ip = $1;
-    next if ($ip =~ /^127\./ || $ip =~ /^10\./);
-    $parm_ipv4 = $ip;
+    next if $1 =~ /^(?:127|10)\./;
+    $parm_ipv4 = $1;
     }
 
-  if ($parm_ipv6 eq "" &&
-      $_ =~ /^\s*inet6(?:\saddr)?:?\s?([abcdef\d:]+)/i)
+  if (not $parm_ipv6 and /^\s*inet6(?:\saddr)?:?\s?([abcdef\d:]+)(?:\/\d+)/i)
     {
-    $ip = $1;
-    next if ($ip eq "::1" || $ip =~ /^fe80/i);
-    $parm_ipv6 = $ip;
+    next if $1 eq '::1' or $1 =~ /^fe80/i;
+    $parm_ipv6 = $1;
     }
   }
 close(IFCONFIG);
 
 # Use private IP addresses if there are no public ones.
 
-$parm_ipv4 = $local_ipv4 if ($parm_ipv4 eq "");
-$parm_ipv6 = $local_ipv6 if ($parm_ipv6 eq "");
-
 # If either type of IP address is missing, we need to set the value to
 # something other than empty, because that wrecks the substitutions. The value
 # is reflected, so use a meaningful string. Set appropriate options for the
@@ -3025,7 +3128,7 @@ $parm_ipv6 = $local_ipv6 if ($parm_ipv6 eq "");
 # of IPV4 or IPv6 can be simulated by command options, which force $have_ipv4
 # and $have_ipv6 false.
 
-if ($parm_ipv4 eq "")
+if (not $parm_ipv4)
   {
   $have_ipv4 = 0;
   $parm_ipv4 = "<no IPv4 address found>";
@@ -3038,23 +3141,23 @@ elsif ($have_ipv4 == 0)
   }
 else
   {
-  $parm_running{"IPv4"} = " ";
+  $parm_running{IPv4} = " ";
   }
 
-if ($parm_ipv6 eq "")
+if (not $parm_ipv6)
   {
   $have_ipv6 = 0;
   $parm_ipv6 = "<no IPv6 address found>";
   $server_opts .= " -noipv6";
-  delete($parm_support{"IPv6"});
+  delete($parm_support{IPv6});
   }
 elsif ($have_ipv6 == 0)
   {
   $parm_ipv6 = "<IPv6 testing disabled>";
   $server_opts .= " -noipv6";
-  delete($parm_support{"IPv6"});
+  delete($parm_support{IPv6});
   }
-elsif (!defined $parm_support{'IPv6'})
+elsif (!defined $parm_support{IPv6})
   {
   $have_ipv6 = 0;
   $parm_ipv6 = "<no IPv6 support in Exim binary>";
@@ -3062,7 +3165,7 @@ elsif (!defined $parm_support{'IPv6'})
   }
 else
   {
-  $parm_running{"IPv6"} = " ";
+  $parm_running{IPv6} = " ";
   }
 
 print "IPv4 address is $parm_ipv4\n";
@@ -3070,7 +3173,7 @@ print "IPv6 address is $parm_ipv6\n";
 
 # For munging test output, we need the reversed IP addresses.
 
-$parm_ipv4r = ($parm_ipv4 !~ /^\d/)? "" :
+$parm_ipv4r = ($parm_ipv4 !~ /^\d/)? '' :
   join(".", reverse(split /\./, $parm_ipv4));
 
 $parm_ipv6r = $parm_ipv6;             # Appropriate if not in use
@@ -3089,8 +3192,16 @@ if ($parm_ipv6 =~ /^[\da-f]/)
 # Find the host name, fully qualified.
 
 chomp($temp = `hostname`);
-$parm_hostname = (gethostbyname($temp))[0];
-$parm_hostname = "no.host.name.found" if $parm_hostname eq "";
+die "'hostname' didn't return anything\n" unless defined $temp and length $temp;
+if ($temp =~ /\./)
+  {
+  $parm_hostname = $temp;
+  }
+else
+  {
+  $parm_hostname = (gethostbyname($temp))[0];
+  $parm_hostname = "no.host.name.found" unless defined $parm_hostname and length $parm_hostname;
+  }
 print "Hostname is $parm_hostname\n";
 
 if ($parm_hostname !~ /\./)
@@ -3145,8 +3256,8 @@ die "** Unable to make patched exim: $!\n"
 # tests_exit(), so that suitable cleaning up can be done when required.
 # Arrange to catch interrupting signals, to assist with this.
 
-$SIG{'INT'} = \&inthandler;
-$SIG{'PIPE'} = \&pipehandler;
+$SIG{INT} = \&inthandler;
+$SIG{PIPE} = \&pipehandler;
 
 # For some tests, we need another copy of the binary that is setuid exim rather
 # than root.
@@ -3167,10 +3278,10 @@ system("sudo cp eximdir/exim eximdir/exim_exim;" .
 ($parm_exim_dir) = $parm_exim =~ m?^(.*)/exim?;
 
 $dbm_build_deleted = 0;
-if (defined $parm_lookups{'dbm'} &&
+if (defined $parm_lookups{dbm} &&
     system("cp $parm_exim_dir/exim_dbmbuild eximdir") != 0)
   {
-  delete $parm_lookups{'dbm'};
+  delete $parm_lookups{dbm};
   $dbm_build_deleted = 1;
   }
 
@@ -3214,6 +3325,11 @@ if ($parm_caller_uid eq $parm_exim_uid) {
   tests_exit(-1, "Exim user ($parm_eximuser,$parm_exim_uid) cannot be "
                 ."the same as caller ($parm_caller,$parm_caller_uid)");
 }
+if ($parm_caller_gid eq $parm_exim_gid) {
+  tests_exit(-1, "Exim group ($parm_eximgroup,$parm_exim_gid) cannot be "
+                ."the same as caller's ($parm_caller) group as it confuses "
+                ."results analysis");
+}
 
 print "The Exim user needs access to the test suite directory. Checking ...";
 
@@ -3273,6 +3389,8 @@ for ($i = 0; $i < @test_dirs; $i++)
 
 # Scan for relevant tests
 
+tests_exit(-1, "Failed to unlink $log_summary_filename")
+  if (-e $log_summary_filename && !unlink($log_summary_filename));
 for ($i = 0; $i < @test_dirs; $i++)
   {
   my($testdir) = $test_dirs[$i];
@@ -3342,7 +3460,6 @@ for ($i = 0; $i < @test_dirs; $i++)
     {
     chomp;
     print "Omitting tests in $testdir (missing $_)\n";
-    next;
     }
 
   # We want the tests from this subdirectory, provided they are in the
@@ -3355,9 +3472,15 @@ for ($i = 0; $i < @test_dirs; $i++)
 
   foreach $test (@testlist)
     {
-    next if $test !~ /^\d{4}(?:\.\d+)?$/;
-    next if $test < $test_start || $test > $test_end;
-    push @test_list, "$testdir/$test";
+    next if ($test !~ /^\d{4}(?:\.\d+)?$/);
+    if (!$wantthis || $test < $test_start || $test > $test_end)
+      {
+      log_test($log_summary_filename, $test, '.');
+      }
+    else
+      {
+      push @test_list, "$testdir/$test";
+      }
     }
   }
 
@@ -3425,8 +3548,8 @@ foreach $basedir ("aux-var", "dnszones")
 
 # Set a user's shell, distinguishable from /bin/sh
 
-symlink("/bin/sh","aux-var/sh");
-$ENV{'SHELL'} = $parm_shell = $parm_cwd . "/aux-var/sh";
+symlink('/bin/sh' => 'aux-var/sh');
+$ENV{SHELL} = $parm_shell = "$parm_cwd/aux-var/sh";
 
 ##################################################
 #     Create fake DNS zones for this host        #
@@ -3479,7 +3602,7 @@ if ($have_ipv6 && $parm_ipv6 ne "::1")
   }
   my(@components) = split /:/, $exp_v6;
   my(@nibbles) = reverse (split /\s*/, shift @components);
-  my($sep) =  "";
+  my($sep) =  '';
 
   $" = ".";
   open(OUT, ">$parm_cwd/dnszones/db.ip6.@nibbles") ||
@@ -3528,13 +3651,18 @@ closedir(DIR);
 # contains ****. We open input from the terminal so that we can read responses
 # to prompts.
 
-open(T, "/dev/tty") || tests_exit(-1, "Failed to open /dev/tty: $!");
+if (not $force_continue) {
+  # runtest needs to interact if we're not in continue
+  # mode. It does so by communicate to /dev/tty
+  open(T, "/dev/tty") or tests_exit(-1, "Failed to open /dev/tty: $!");
+}
+
 
 print "\nPress RETURN to run the tests: ";
 $_ = $force_continue ? "c" : <T>;
 print "\n";
 
-$lasttestdir = "";
+$lasttestdir = '';
 
 foreach $test (@test_list)
   {
@@ -3548,12 +3676,14 @@ foreach $test (@test_list)
   my($docheck) = 1;
   my($thistestdir) = substr($test, 0, -5);
 
+  $dynamic_socket->close() if $dynamic_socket;
+
   if ($lasttestdir ne $thistestdir)
     {
     $gnutls = 0;
     if (-s "scripts/$thistestdir/REQUIRES")
       {
-      my($indent) = "";
+      my($indent) = '';
       print "\n>>> The following tests require: ";
       open(IN, "scripts/$thistestdir/REQUIRES") ||
         tests_exit(-1, "Failed to open scripts/$thistestdir/REQUIRES: $1");
@@ -3597,7 +3727,7 @@ foreach $test (@test_list)
   $stdout_skip = 0;
   $rmfiltertest = 0;
   $is_ipv6test = 0;
-  $TEST_STATE->{munge} = "";
+  $TEST_STATE->{munge} = '';
 
   # Remove the associative arrays used to hold checked mail files and msglogs
 
@@ -3616,6 +3746,7 @@ foreach $test (@test_list)
     if (/^no_stdout_check/)  { $stdout_skip = 1; next; }
     if (/^rmfiltertest/)     { $rmfiltertest = 1; next; }
     if (/^sortlog/)          { $sortlog = 1; next; }
+    if (/\bPORT_DYNAMIC\b/)  { $dynamic_socket = Exim::Runtest::dynamic_socket(); next; }
     }
   # Reset to beginning of file for per test interpreting/processing
   seek(SCRIPT, 0, 0);
@@ -3683,7 +3814,7 @@ foreach $test (@test_list)
 
       if (/^need_move_frozen_messages/)
         {
-        next if defined $parm_support{"move_frozen_messages"};
+        next if defined $parm_support{move_frozen_messages};
         print ">>> move frozen message support is needed for test $testno, " .
           "but is not\n>>> available: skipping\n";
         $docheck = 0;      # don't check output
@@ -3691,22 +3822,23 @@ foreach $test (@test_list)
         last;
         }
 
-      last unless /^(#|\s*$)/;
+      last unless /^(?:#(?!##\s)|\s*$)/;
       }
     last if !defined $_;  # Hit EOF
 
     my($subtest_startline) = $lineno;
 
-    # Now run the command. The function returns 0 if exim was run and waited
-    # for, 1 if any other command was run and waited for, and 2 if a command
+    # Now run the command. The function returns 0 for an inline command,
+    # 1 if a non-exim command was run and waited for, 2 if an exim
+    # command was run and waited for, and 3 if a command
     # was run and not waited for (usually a daemon or server startup).
 
-    my($commandname) = "";
+    my($commandname) = '';
     my($expectrc) = 0;
     my($rc, $run_extra) = run_command($testno, \$subtestno, \$expectrc, \$commandname, $TEST_STATE);
     my($cmdrc) = $?;
 
-$0 = "[runtest $testno]";
+    $0 = "[runtest $testno]";
 
     if ($debug) {
       print ">> rc=$rc cmdrc=$cmdrc\n";
@@ -3760,8 +3892,19 @@ $0 = "[runtest $testno]";
         print "\nshow stdErr, show stdOut, Retry, Continue (without file comparison), or Quit? [Q] ";
         $_ = $force_continue ? "c" : <T>;
         tests_exit(1) if /^q?$/i;
-        log_failure($log_failed_filename, $testno, "exit code unexpected") if (/^c$/i && $force_continue);
-        print "... continue forced\n" if $force_continue;
+	if (/^c$/ && $force_continue) {
+	  log_failure($log_failed_filename, $testno, "exit code unexpected");
+	  log_test($log_summary_filename, $testno, 'F')
+	}
+        if ($force_continue)
+          {
+          print "\nstderr tail:\n";
+          print "===================\n";
+          system("tail -20 test-stderr");
+          print "===================\n";
+          print "... continue forced\n";
+          }
+
         last if /^[rc]$/i;
         if (/^e$/i)
           {
@@ -3799,7 +3942,10 @@ $0 = "[runtest $testno]";
           print "\nShow server stdout, Retry, Continue, or Quit? [Q] ";
           $_ = $force_continue ? "c" : <T>;
           tests_exit(1) if /^q?$/i;
-          log_failure($log_failed_filename, $testno, "exit code unexpected") if (/^c$/i && $force_continue);
+	  if (/^c$/ && $force_continue) {
+	    log_failure($log_failed_filename, $testno, "exit code unexpected");
+	    log_test($log_summary_filename, $testno, 'F')
+	  }
           print "... continue forced\n" if $force_continue;
           last if /^[rc]$/i;
 
@@ -3819,9 +3965,9 @@ $0 = "[runtest $testno]";
   close SCRIPT;
 
   # The script has finished. Check the all the output that was generated. The
-  # function returns 0 if all is well, 1 if we should rerun the test (the files
-  # function returns 0 if all is well, 1 if we should rerun the test (the files
-  # have been updated). It does not return if the user responds Q to a prompt.
+  # function returns 0 for a perfect pass, 1 if imperfect but ok, 2 if we should
+  # rerun the test (the files # have been updated).
+  # It does not return if the user responds Q to a prompt.
 
   if ($retry)
     {
@@ -3832,14 +3978,16 @@ $0 = "[runtest $testno]";
 
   if ($docheck)
     {
-    if (check_output($TEST_STATE->{munge}) != 0)
+    my $rc = check_output($TEST_STATE->{munge});
+    log_test($log_summary_filename, $testno, 'P') if ($rc == 0);
+    if ($rc < 2)
       {
-      print (("#" x 79) . "\n");
-      redo;
+      print ("  Script completed\n");
       }
     else
       {
-      print ("  Script completed\n");
+      print (("#" x 79) . "\n");
+      redo;
       }
     }
   }
@@ -3853,4 +4001,3 @@ tests_exit(-1, "No runnable tests selected") if @test_list == 0;
 tests_exit(0);
 
 # End of runtest script
-# vim: set sw=2 et :
diff --git a/test/scripts/0000-Basic/0001 b/test/scripts/0000-Basic/0001
index 4b5f282ca..78682571d 100644
--- a/test/scripts/0000-Basic/0001
+++ b/test/scripts/0000-Basic/0001
@@ -26,5 +26,6 @@ exim -bP accept_8bitmime \
          tcp_nodelay \
          trusted_users \ 
          unknown_login \
-         warn_message_file
+         warn_message_file \
+         syslog_pid
 ****
diff --git a/test/scripts/0000-Basic/0002 b/test/scripts/0000-Basic/0002
index 35e6f6bf9..c2dcc40d9 100644
--- a/test/scripts/0000-Basic/0002
+++ b/test/scripts/0000-Basic/0002
@@ -23,6 +23,7 @@ primary_hostname: ${primary_hostname}
 qualify_domain: $qualify_domain
 bounce_return_size_limit: ${bounce_return_size_limit}
 spool_directory: $spool_directory
+queue_name: $queue_name
 unknown: ${unknown}
 h_subject: $h_subject:(should be empty)
 h_subject:$h_subject (should be empty)
@@ -131,7 +132,9 @@ addresses: ${addresses:Exim Person <local-part@dom.ain> (that's me), \
            xyz@abc, nullgroupname:;, group: p@q, r@s; }
 addresses: ${addresses:local-part@dom.ain <local-part@dom.ain>}
 
-escape: ${escape:B7·F2ò}
+escape:     ${escape:B7·F2ò}
+excape8bit: ${escape8bit:undisturbed text\ttab\nnewline\ttab\\backslash \176tilde\177DEL\200\x81.}
+
 eval:   ${eval:1+1}
 eval:   ${eval:1+2*3}
 eval:   ${eval:(1+2)*3}
@@ -629,6 +632,10 @@ ${extract{}{X=3}}
 ${extract{ }{X=3}}
 ${extract{ 2 }{ }{a b c}}
 
+${map{a,1:b,2:c,3}{${extract{1}{,}{$item}{$value}{}}}}
+${map{a,1:b,2:c,3}{${extract{1}{,}{$item}{$value}{failcase}{bogus_argument}}}}
+${map{a,1:b,2:c,3}{${extract{1}{,}{$item}{$value}fail}}}
+
 # Translation
 
 abcdea aaa xyz ${tr{abcdea}{aaa}{xyz}}
diff --git a/test/scripts/0000-Basic/0021 b/test/scripts/0000-Basic/0021
index 8fbf94837..16c5c3b80 100644
--- a/test/scripts/0000-Basic/0021
+++ b/test/scripts/0000-Basic/0021
@@ -24,6 +24,8 @@ Test message 5.
 ****
 exim -bs -oMa 10.9.8.7
 ****
+exim -DLOG_SELECTOR=-connection_reject -bs -oMa 10.9.8.7
+****
 exim -d-all+acl+lists -bs -oMa 10.9.8.8
 mail from:<bad@test1>
 mail from:<ok@test1>
diff --git a/test/scripts/0000-Basic/0041 b/test/scripts/0000-Basic/0041
index 3495375cb..0f8cdb3b5 100644
--- a/test/scripts/0000-Basic/0041
+++ b/test/scripts/0000-Basic/0041
@@ -2,6 +2,8 @@
 exim -bh 1.1.1.1
 vrfy userx@test.ex
 vrfy hardfail@test.ex
+vrfy unqual
+vrfy
 expn postmaster
 quit
 ****
diff --git a/test/scripts/0000-Basic/0099 b/test/scripts/0000-Basic/0099
index c386e1e85..d6655dcf9 100644
--- a/test/scripts/0000-Basic/0099
+++ b/test/scripts/0000-Basic/0099
@@ -38,14 +38,18 @@ Test message
 ****
 dump retry
 #
-# one for a lookup-failure (in manualroute)
+# a lookup-failure (in manualroute)
 exim -odi userx@nonexist
 Test message
 ****
-# one for a lookup-failure (in dnslookup)
+# a lookup-failure (good MX, missing A) in dnslookup, deferred
 exim -odi userx@mxt2.test.ex
 Test message
 ****
+# a lookup-failure (missing MX) in dnslookup, deferred
+exim -odi userx@mxnonexist.test.ex
+Test message
+****
 dump retry
 #
 #
diff --git a/test/scripts/0000-Basic/0137 b/test/scripts/0000-Basic/0137
index 0335afe57..56941941f 100644
--- a/test/scripts/0000-Basic/0137
+++ b/test/scripts/0000-Basic/0137
@@ -1,10 +1,12 @@
 # mailbox locking
 exim -odi userx
+Subject: First
 Transport: local_delivery
 First message.
 ****
 exim_lock -v test-mail/userx
 exim -odi userx
+Subject: Second
 Transport: local_delivery
 Second message
 ****
@@ -12,6 +14,7 @@ exim -qf
 ****
 exim_lock -v -fcntl test-mail/userx
 exim -odi userx
+Subject: Third
 Transport: local_delivery_fcntl
 Third message
 ****
@@ -19,6 +22,7 @@ exim -qf
 ****
 exim_lock -v -fcntl test-mail/userx
 exim -odi userx
+Subject: Fourth
 Transport: local_delivery_fcntl_blocking
 Fourth message
 ****
diff --git a/test/scripts/0000-Basic/0206 b/test/scripts/0000-Basic/0206
index 6f9968f96..64afd8014 100644
--- a/test/scripts/0000-Basic/0206
+++ b/test/scripts/0000-Basic/0206
@@ -1,12 +1,16 @@
 # timeout_frozen_after with ignore_bounce_errors_after
 sudo exim -odi -f unknown@test.ex nonexist@test.ex freeze@test.ex
 ****
-sleep 1
+# that gave us a frozen bounce, and a deferred message (with one undelivered addr)
 sudo exim -Mf $msg1
 ****
+# now 2 frozen, one of which is a bounce
+# check that ignore_bounce_errors_after finishes off the frozen bounce (only)
+millisleep 2500
 exim -qf
 ****
 sleep 3
+# check that timeout_frozen_after finishes off the (remaining) frozen
 exim -q
 ****
 no_msglog_check
diff --git a/test/scripts/0000-Basic/0211 b/test/scripts/0000-Basic/0211
index f8750d2e8..dbe41c723 100644
--- a/test/scripts/0000-Basic/0211
+++ b/test/scripts/0000-Basic/0211
@@ -59,3 +59,19 @@ QUIT
 exim -odi userx@domain1 usery@domain2
 Test message 2
 ****
+#
+exim -z "Test: reject ehlo, then close (late, giving time for HELO)"
+****
+sudo rm DIR/spool/db/retry
+server PORT_S
+220 Connected OK
+EHLO
+550 You are banned
+HELO
+****
+exim -odi userx@domain1
+Test message 4
+****
+#
+#
+no_msglog_check
diff --git a/test/scripts/0000-Basic/0217 b/test/scripts/0000-Basic/0217
index c47ae5c9e..a74be606f 100644
--- a/test/scripts/0000-Basic/0217
+++ b/test/scripts/0000-Basic/0217
@@ -36,7 +36,7 @@ RCPT TO
 250 OK
 *sleep 2
 ****
-exim -odi a b c
+exim -odi e f g
 .
 ****
 # Temp error on MAIL
@@ -56,7 +56,7 @@ DATA
 QUIT
 250 OK
 ****
-exim -odi a b
+exim -odi h i
 .
 ****
 # Perm error on MAIL
@@ -76,7 +76,7 @@ DATA
 QUIT
 250 OK
 ****
-exim -odi a b
+exim -odi j k
 .
 ****
 # All get temp errors
@@ -96,7 +96,7 @@ DATA
 QUIT
 250 OK
 ****
-exim -odi a b
+exim -odi l m
 .
 ****
 # All get perm errors
@@ -116,7 +116,7 @@ DATA
 QUIT
 250 OK
 ****
-exim -odi a b
+exim -odi n o
 .
 ****
 # Mixed temp and perm
@@ -136,7 +136,7 @@ DATA
 QUIT
 250 OK
 ****
-exim -odi a b
+exim -odi p q
 .
 ****
 # Perm error on DATA after good recipients
@@ -156,7 +156,7 @@ DATA
 QUIT
 250 OK
 ****
-exim -odi a b
+exim -odi r s
 .
 ****
 # Temp error on DATA after good recipients
@@ -176,7 +176,7 @@ DATA
 QUIT
 250 OK
 ****
-exim -odi a b
+exim -odi t u
 .
 ****
 # Temp error on DATA after good recipients, but in first block of a
diff --git a/test/scripts/0000-Basic/0227 b/test/scripts/0000-Basic/0227
index 59adba788..a67dab2eb 100644
--- a/test/scripts/0000-Basic/0227
+++ b/test/scripts/0000-Basic/0227
@@ -203,6 +203,27 @@ MAIL FROM:<ok@localhost1>
 RCPT TO:<z@remote.domain>
 QUIT
 ****
+#
+server PORT_S
+220 Server ready
+EHLO
+250- wotcher
+250-SIZE
+250 OK
+MAIL FROM
+250 OK
+RCPT TO
+250 OK
+QUIT
+250 OK
+****
+sudo exim -v -bs -oMa V4NET.0.0.6
+EHLO me
+MAIL FROM:<ok@localhost1> SIZE=420000
+RCPT TO:<z@test.ex>
+QUIT
+****
+#
 server PORT_S
 220 Server ready
 LHLO
diff --git a/test/scripts/0000-Basic/0230 b/test/scripts/0000-Basic/0230
index b62e31355..92ef10c51 100644
--- a/test/scripts/0000-Basic/0230
+++ b/test/scripts/0000-Basic/0230
@@ -67,7 +67,7 @@ quit
 #
 exim -DSERVER=server -bd -oX PORT_D
 ****
-sudo exim -DRT -bs -oMa V4NET.9.8.7.1225
+sudo exim -DOPT -bs -oMa V4NET.9.8.7.1225
 mail from:<x@y.x>
 rcpt to:<x@test.ex>
 data
@@ -75,7 +75,7 @@ this is a message
 .
 quit
 ****
-exim -DRT -odi -qf
+exim -DOPT -odi -qf
 ****
 #
 #
diff --git a/test/scripts/0000-Basic/0290 b/test/scripts/0000-Basic/0290
index f2d69e1d0..f4b63aa8e 100644
--- a/test/scripts/0000-Basic/0290
+++ b/test/scripts/0000-Basic/0290
@@ -1,11 +1,11 @@
 # .include and macro tests
 exim -bP local_interfaces message_size_limit recipients_max remote_sort_domains receive_timeout
 ****
-exim -DRT= -bP receive_timeout
+exim -DOPT= -bP receive_timeout
 ****
-exim -DRT -bP receive_timeout
+exim -DOPT -bP receive_timeout
 ****
-exim '-D RT = receive_timeout = 4s ' -bP receive_timeout
+exim '-D OPT = receive_timeout = 4s ' -bP receive_timeout
 ****
 1
 exim -DINC='.include non/absolute' -bP receive_timeout
diff --git a/test/scripts/0000-Basic/0300 b/test/scripts/0000-Basic/0300
index 047dba410..920f12b5d 100644
--- a/test/scripts/0000-Basic/0300
+++ b/test/scripts/0000-Basic/0300
@@ -1,5 +1,6 @@
 # SMTP synchronization checks, with and without PIPELINING
 need_ipv4
+munge sync_check_data
 #
 exim -DSERVER=server -bd -oX PORT_D
 ****
diff --git a/test/scripts/0000-Basic/0301 b/test/scripts/0000-Basic/0301
index 08996c7ef..45a824285 100644
--- a/test/scripts/0000-Basic/0301
+++ b/test/scripts/0000-Basic/0301
@@ -1,5 +1,6 @@
 # SMTP synchronization checks disabled, with and without PIPELINING
 need_ipv4
+munge sync_check_data
 #
 exim -DSERVER=server -bd -oX PORT_D
 ****
diff --git a/test/scripts/0000-Basic/0314 b/test/scripts/0000-Basic/0314
index 6fec248d8..dd3d39906 100644
--- a/test/scripts/0000-Basic/0314
+++ b/test/scripts/0000-Basic/0314
@@ -1,5 +1,17 @@
 # host_reject_connection
-exim -bh V4NET.0.0.1
+need_ipv4
+exim -DSERVER=server -bd -oX PORT_D
 ****
-exim -bh V4NET.0.0.2
+client 127.0.0.1 PORT_D
+??? 554
 ****
+client HOSTIPV4 PORT_D
+??? 220
+****
+killdaemon
+exim -DSERVER=server -DLOG_SELECTOR=-connection_reject -bd -oX PORT_D
+****
+client 127.0.0.1 PORT_D
+??? 554
+****
+killdaemon
diff --git a/test/scripts/0000-Basic/0322 b/test/scripts/0000-Basic/0322
index e317eb784..91fabeeb7 100644
--- a/test/scripts/0000-Basic/0322
+++ b/test/scripts/0000-Basic/0322
@@ -13,8 +13,7 @@ RCPT TO:
 250 Recipient OK
 DATA
 >
-QUIT
-250 OK
+*eof
 ****
 exim -odi x@test.ex
 ****
@@ -29,9 +28,7 @@ MAIL FROM:
 RCPT TO:
 >
 DATA
-550 Failed DATA
-QUIT
-250 OK
+*eof
 ****
 exim -odi x@test.ex
 ****
@@ -46,9 +43,7 @@ MAIL FROM:
 RCPT TO:
 550 Can't send RCPT
 DATA
-550 Can't send DATA
-QUIT
-250 OK
+*eof
 ****
 exim -odi x@test.ex
 ****
@@ -68,9 +63,7 @@ RCPT TO:
 RCPT TO:
 250 Third RCPT OK
 DATA
-550 Failed DATA
-QUIT
-250 OK
+*eof
 ****
 exim -odi x@test.ex y@test.ex z@test.ex
 ****
@@ -109,8 +102,7 @@ RCPT TO:
 250 Recipient OK
 DATA
 >
-QUIT
-250 OK
+*eof
 ****
 exim -odi x@test.ex
 ****
@@ -123,10 +115,7 @@ MAIL FROM:
 250 Sender OK
 RCPT TO:
 >
-DATA
-550 Failed DATA
-QUIT
-250 OK
+*eof
 ****
 exim -odi x@test.ex
 ****
@@ -137,12 +126,7 @@ EHLO
 250 HELP
 MAIL FROM:
 >
-RCPT TO:
-550 Can't send RCPT
-DATA
-550 Can't send DATA
-QUIT
-250 OK
+*eof
 ****
 exim -odi x@test.ex
 ****
@@ -158,12 +142,7 @@ RCPT TO:
 RCPT TO:
 >
 250 Second RCPT malformed
-RCPT TO:
-250 Third RCPT OK
-DATA
-550 Failed DATA
-QUIT
-250 OK
+*eof
 ****
 exim -odi x@test.ex y@test.ex z@test.ex
 ****
diff --git a/test/scripts/0000-Basic/0420 b/test/scripts/0000-Basic/0420
index c61a23d1e..2f7fe4998 100644
--- a/test/scripts/0000-Basic/0420
+++ b/test/scripts/0000-Basic/0420
@@ -1,14 +1,31 @@
 # received_header_text
-exim -d -bh V4NET.0.0.0
+exim -bd -DSERVER=server -oX PORT_D
+****
+#
+client 127.0.0.1 PORT_D
+??? 220
+helo client.test.ex
+??? 250
 mail from:<x@y>
+??? 250
 rcpt to:<x@y>
+??? 250
 data
+??? 354
 Message.
 .
+??? 250
 mail from:<a@b>
+??? 250
 rcpt to:<x@y>
+??? 250
 data
+??? 354
 Message.
 .
+??? 250
 quit
+??? 221
 ****
+#
+killdaemon
diff --git a/test/scripts/0000-Basic/0460 b/test/scripts/0000-Basic/0460
index b91be2084..beb4e00db 100644
--- a/test/scripts/0000-Basic/0460
+++ b/test/scripts/0000-Basic/0460
@@ -45,3 +45,4 @@ QUIT
 killdaemon
 # Wait for delivery process
 sleep 1
+sortlog
diff --git a/test/scripts/0000-Basic/0465 b/test/scripts/0000-Basic/0465
index 03abe164f..de8b6cbdf 100644
--- a/test/scripts/0000-Basic/0465
+++ b/test/scripts/0000-Basic/0465
@@ -7,7 +7,7 @@ quit
 1
 exim -f abc@somewhere. xxx
 ****
-exim -DSTD=strip_trailing_dot -d -bs
+exim -DOPT=strip_trailing_dot -d -bs
 mail from:<>
 rcpt to:<abc@domain.>
 data
@@ -15,7 +15,7 @@ To: abc@domain.
 .
 quit
 ****
-exim -DSTD=strip_trailing_dot -f abc@somewhere. xxx@yyy.
+exim -DOPT=strip_trailing_dot -f abc@somewhere. xxx@yyy.
 ****
 exim -d -bs
 mail from:<>
diff --git a/test/scripts/0000-Basic/0502 b/test/scripts/0000-Basic/0502
index d4b8f0fdb..c22205ca7 100644
--- a/test/scripts/0000-Basic/0502
+++ b/test/scripts/0000-Basic/0502
@@ -23,3 +23,21 @@ exim -bs -DLAST=''
 mail from:<a@b>
 quit
 ****
+#
+# Check the server closes conn after a quit-response
+exim -DSERVER=server -DLAST=accept -bd -oX PORT_D
+****
+client 127.0.0.1 PORT_D
+??? 220
+EHLO test.ex
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250 HELP
+QUIT
+??? 221
+???*eof
+****
+#
+killdaemon
diff --git a/test/scripts/0000-Basic/0551 b/test/scripts/0000-Basic/0551
index afd5c9b05..d11064c00 100644
--- a/test/scripts/0000-Basic/0551
+++ b/test/scripts/0000-Basic/0551
@@ -6,7 +6,7 @@ Message 1
 exim -odi userx@test.ex userz@test.ex
 Message 2
 ****
-exim -DLS= -odi userx@test.ex
+exim -DLOG_SELECTOR= -odi userx@test.ex
 Message 3
 ****
 exigrep userx
diff --git a/test/scripts/0000-Basic/0555 b/test/scripts/0000-Basic/0555
index 947f1692d..c35113603 100644
--- a/test/scripts/0000-Basic/0555
+++ b/test/scripts/0000-Basic/0555
@@ -1,4 +1,4 @@
-# Long lines for fakedefer/fakereject
+# Long response lines for fakedefer/fakereject
 exim -bs
 mail from:<>
 rcpt to:<userx@test.ex>
diff --git a/test/scripts/0000-Basic/0557 b/test/scripts/0000-Basic/0557
index 8e05b4719..02ab466d2 100644
--- a/test/scripts/0000-Basic/0557
+++ b/test/scripts/0000-Basic/0557
@@ -1,16 +1,16 @@
 # host_find_failed=ignore
 1
-exim -DX=# -DY=# -bt userx@test.ex
+exim -DFAKE=# -DOPT=# -bt userx@test.ex
 ****
 1
-exim -DY=# -DHOSTS=a.non.exist -bt userx@test.ex
+exim -DOPT=# -DHOSTS=a.non.exist -bt userx@test.ex
 ****
 1
-exim -DY=# -DHOSTS=a.non.exist:b.non.exist -bt userx@test.ex
+exim -DOPT=# -DHOSTS=a.non.exist:b.non.exist -bt userx@test.ex
 ****
-exim -DY=# -DHOSTS=a.non.exist:127.0.0.1 -bt userx@test.ex
+exim -DOPT=# -DHOSTS=a.non.exist:127.0.0.1 -bt userx@test.ex
 ****
-exim -DY=# -DHOSTS=127.0.0.1:b.non.exist:127.0.0.2 -bt userx@test.ex
+exim -DOPT=# -DHOSTS=127.0.0.1:b.non.exist:127.0.0.2 -bt userx@test.ex
 ****
 1
 exim -DHOSTS=a.non.exist -DHAI=defer -bt userx@test.ex
diff --git a/test/scripts/0000-Basic/0564 b/test/scripts/0000-Basic/0564
index 68fb607ec..26acd66d2 100644
--- a/test/scripts/0000-Basic/0564
+++ b/test/scripts/0000-Basic/0564
@@ -1,9 +1,9 @@
 # testing -bw inetd wait mode
 need_ipv4
 #
-exim -DSERVER=wait:PORT_D -bw
+exim -DSERVER=wait:PORT_DYNAMIC -bw
 ****
-client 127.0.0.1 PORT_D
+client 127.0.0.1 PORT_DYNAMIC
 ??? 220
 ehlo abcd
 ??? 250-
diff --git a/test/scripts/0000-Basic/0570 b/test/scripts/0000-Basic/0570
index ed54afc1d..75ac0cec6 100644
--- a/test/scripts/0000-Basic/0570
+++ b/test/scripts/0000-Basic/0570
@@ -61,6 +61,7 @@ exim -DOPTION='multi_domain=${if eqi {$address_data}{domA.ex} {no}{yes}}' -q
 #
 killdaemon
 no_msglog_check
+sortlog
 #
 #
 ##
diff --git a/test/scripts/0000-Basic/0572 b/test/scripts/0000-Basic/0572
index 05ba658f7..2866a23f1 100644
--- a/test/scripts/0000-Basic/0572
+++ b/test/scripts/0000-Basic/0572
@@ -3,7 +3,7 @@
 # Ought to test a non-priv user, checking "hide", but
 # the testsuite cannot do that...
 #
-munge optional_nossl
+munge optional_config
 exim -bP spool_directory
 ****
 perl -e 'print "\n";'
@@ -26,3 +26,6 @@ perl -e 'print "\n";'
 #
 exim -bP config
 ****
+#
+exim -n -bP config
+****
diff --git a/test/scripts/0000-Basic/0574 b/test/scripts/0000-Basic/0574
new file mode 100644
index 000000000..6784bde56
--- /dev/null
+++ b/test/scripts/0000-Basic/0574
@@ -0,0 +1,37 @@
+# debug logging ACL modifier
+munge debuglog_stdout
+#
+exim -DSERVER=server -bd -oX PORT_D
+****
+#
+client 127.0.0.1 PORT_D
+??? 220
+EHLO test.ex
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250 
+MAIL FROM:<tester@test.ex>
+??? 250
+RCPT TO:<dest@test.ex>
+??? 250
+DATA
+??? 354
+Subject: test
+
+body
+.
+??? 250
+QUIT
+??? 221
+****
+#
+killdaemon
+#
+1
+cat DIR/spool/log/serverdebuglog_1
+#
+cat DIR/spool/log/serverdebuglog_2
+#
+no_msglog_check
diff --git a/test/scripts/0000-Basic/0575 b/test/scripts/0000-Basic/0575
new file mode 100644
index 000000000..e4534af9b
--- /dev/null
+++ b/test/scripts/0000-Basic/0575
@@ -0,0 +1,10 @@
+# -bh and msglog
+# no logfiles, says the docs
+exim -d -bh V4NET.0.0.0
+mail from:<x@y>
+rcpt to:<x@y>
+data
+Message.
+.
+quit
+****
diff --git a/test/scripts/0000-Basic/0576 b/test/scripts/0000-Basic/0576
new file mode 100644
index 000000000..6f01d9aae
--- /dev/null
+++ b/test/scripts/0000-Basic/0576
@@ -0,0 +1,65 @@
+# named queues
+# Exim test configuration 0576
+#
+no_msglog_check
+#
+exim -bs
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO: <normal@test.ex>
+DATA
+Subject: test
+
+foo
+.
+RSET
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO: <alternate@test.ex>
+DATA
+Subject: test
+
+foo
+.
+QUIT
+****
+#
+exim -qq
+****
+#
+exim -qGnosuchqueue
+****
+#
+exim -qGalternate
+****
+#
+#
+#
+exim -DSERVER=server -qGlowpri/3s
+****
+sleep 1
+exim -bs
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO: <lowpri@test.ex>
+DATA
+Subject: test 
+
+foo
+.
+QUIT
+****
+sleep 3
+killdaemon
+#
+# third-party queue transfer
+exim -bs
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO: <alternate@test.ex>
+DATA
+Subject: test
+
+foo
+.
+QUIT
+****
+# 
+sudo mv DIR/spool/alternate/input/* DIR/spool/input/
+exim -q
diff --git a/test/scripts/0000-Basic/0900 b/test/scripts/0000-Basic/0900
new file mode 100644
index 000000000..9e014c43e
--- /dev/null
+++ b/test/scripts/0000-Basic/0900
@@ -0,0 +1,219 @@
+# CHUNKING reception
+exim -DSERVER=server -bd -oX PORT_D
+****
+#
+# plain, small message (no body)
+client 127.0.0.1 PORT_D
+??? 220
+ehlo tester
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250 HELP
+mail from:someone@some.domain
+??? 250
+rcpt to:CALLER@test.ex
+??? 250
+bdat 88 last
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 250-
+??? 250
+quit
+??? 221
+****
+#
+# plain, small message (with body)
+# nonlast 1st bdat, noop, last-bdat(0)
+# immediate followon 2nd message
+client 127.0.0.1 PORT_D
+??? 220
+ehlo tester
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250 
+mail from:someone@some.domain
+??? 250
+rcpt to:CALLER@test.ex
+??? 250
+bdat 100
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyfull test message
+
+1234567890
+??? 250
+noop
+??? 250
+bdat 0 last
+??? 250-
+??? 250
+mail from:someone@some.domain
+??? 250
+rcpt to:CALLER@test.ex
+??? 250
+bdat 10
+To: Susan@bdat 78 last
+??? 250
+random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 250-
+??? 250
+quit
+??? 221
+****
+#
+# not enough data in chunk
+#
+client 127.0.0.1 PORT_D
+??? 220
+ehlo tester
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250 
+mail from:someone@some.domain
+??? 250
+rcpt to:CALLER@test.ex
+??? 250
+bdat 89 last
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 421
+****
+#
+# protocol failure cases
+#
+client 127.0.0.1 PORT_D
+??? 220
+ehlo tester
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250 
+mail from:someone@some.domain
+??? 250
+rcpt to:CALLER@test.ex
+??? 250
+bdat 88
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 250
+bdat 0
+??? 504
+quit
+??? 221
+****
+#
+# followon EHLO and another message
+client 127.0.0.1 PORT_D
+??? 220
+ehlo tester
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250 
+mail from:someone@some.domain
+??? 250
+rcpt to:CALLER@test.ex
+??? 250
+bdat 88
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 250
+data
+??? 503
+RSET
+??? 250
+EHLO tester
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250 
+mail from:someone@some.domain
+??? 250
+rcpt to:CALLER@test.ex
+??? 250
+bdat 88
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 250
+data
+??? 503
+data
+??? 503
+quit
+??? 221
+****
+#
+# plain, small message (no body)
+# pipelined
+client 127.0.0.1 PORT_D
+??? 220
+EHLO tester
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250 HELP
+MAIL FROM:<someone@some.domain>\r\nRCPT TO:<CALLER@test.ex>\r\nBDAT 88 LAST\r\nTo: Susan@random.com\r\nFrom: Sam@random.com\r\nSubject: This is a bodyless test message\r\n
+??? 250
+??? 250
+??? 250-
+??? 250
+quit
+??? 221
+****
+#
+# plain, longer message (xple chunks), RCPT rejected
+# pipelined
+client 127.0.0.1 PORT_D
+??? 220
+EHLO tester
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250 HELP
+MAIL FROM:<someone@some.domain>\r\nRCPT TO:<dummy@reject.ex>\r\nBDAT 86\r\nTo: Susan@random.com\r\nFrom: Sal@random.com\r\nSubject: This is a bodyless test message\r\nBDAT 6 LAST\r\nZZ\r\n
+??? 250
+??? 550
+??? 503-
+??? 503-
+??? 503
+??? 503-
+??? 503-
+??? 503
+quit
+??? 221
+****
+#
+killdaemon
+no_msglog_check
diff --git a/test/scripts/0000-Basic/0901 b/test/scripts/0000-Basic/0901
new file mode 100644
index 000000000..2157e61a8
--- /dev/null
+++ b/test/scripts/0000-Basic/0901
@@ -0,0 +1,387 @@
+# CHUNKING transmission, short messages
+#
+# Start with non-pipelined cases
+#
+# Basic short message
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250 CHUNKING
+MAIL FROM
+250 OK
+RCPT TO
+250 OK
+BDAT 329 LAST
+*data 329
+250 OK
+QUIT
+225 OK
+*eof
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<a@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# Error case: server wrongly expected more data, client gets timeout for data-ack
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250 CHUNKING
+MAIL FROM
+250 good mail cmd
+RCPT TO
+250 acceptable rcpt cmd
+BDAT 329 LAST
+*data 330
+250 OK got that data
+QUIT
+225 OK quitting
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<b@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# Error case: server wrongly expected less data
+# client get the data-ack, sends quit - but server
+# sees a munged quit due to the outstanding data tail
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250 CHUNKING
+MAIL FROM
+250 OK
+RCPT TO
+250 OK
+BDAT 329 LAST
+*data 328
+250 OK
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<c@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# server rejects BDAT cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250 CHUNKING
+MAIL FROM
+250 OK
+RCPT TO
+250 OK
+BDAT 329 LAST
+*data 329
+500 oops
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<d@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# server tmp-rejects BDAT cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250 CHUNKING
+MAIL FROM
+250 OK
+RCPT TO
+250 OK
+BDAT 329 LAST
+*data 329
+400 not right now
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<e@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+#
+###################################################
+#
+# Pipelined cases
+#
+# Basic short message
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 329 LAST
+*data 329
+250 OK mail
+250 OK rcpt
+250 OK bdat
+QUIT
+225 OK
+*eof
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<p@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# Error case: server wrongly expected more data, client gets timeout for data-ack
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 329 LAST
+*data 330
+250 good mail cmd
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<q@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# Error case: server wrongly expected less data
+# client get the data-ack, sends quit - but server
+# sees a munged quit due to the outstanding data tail
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 329 LAST
+*data 328
+250 OK mail
+250 OK rcpt
+250 OK bdat
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<r@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# server rejects MAIL cmd
+# transport coding does not handle the possible RSET-and-another transaction,
+# but always QUITs
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 329 LAST
+*data 329
+550 unacceptable mail-from
+550 rcpt ungood lacking mail-from
+500 bdat ungood lacking mail-from
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<s@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# server tmp-rejects MAIL cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 330 LAST
+*data 330
+450 greylisted mail-from
+550 rcpt ungood lacking mail-from
+500 bdat ungood lacking mail-from
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<s1@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# server rejects RCPT cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 329 LAST
+*data 329
+250 OK mail
+550 no such recipient
+500 oops bdat
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<t@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# server rejects BDAT cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 329 LAST
+*data 329
+250 OK mail
+250 OK rcpt
+500 oops bdat
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<u@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+# server tmp-rejects BDAT cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 329 LAST
+*data 329
+250 OK mail
+250 OK rcpt
+400 not right now bdat
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO test
+MAIL FROM:<sender@source.dom>
+RCPT TO:<v@test.ex>
+DATA
+Subject: foo
+
+data
+.
+QUIT
+****
+#
+#
+no_msglog_check
diff --git a/test/scripts/0000-Basic/0902 b/test/scripts/0000-Basic/0902
new file mode 100644
index 000000000..5be294087
--- /dev/null
+++ b/test/scripts/0000-Basic/0902
@@ -0,0 +1,1100 @@
+# CHUNKING transmission, long messages
+#
+# Start with non-pipelined cases
+#
+# Basic long message
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250 CHUNKING
+MAIL FROM
+250 OK
+RCPT TO
+250 OK
+BDAT 295
+*data 295
+250 OK nonlast bdat
+BDAT 8380 LAST
+*data 8380
+250 OK bdat
+QUIT
+225 OK
+*eof
+****
+sudo exim -odf -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<a@test.ex>
+DATA
+Subject: foo
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+.
+QUIT
+****
+#
+#
+# server rejects BDAT cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250 CHUNKING
+MAIL FROM
+250 OK
+RCPT TO
+250 OK
+BDAT 295
+*data 295
+500 oops bdat-nonlast
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<d@test.ex>
+DATA
+Subject: foo
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+.
+QUIT
+****
+#
+#
+###################################################
+#
+# Pipelined cases
+#
+# Basic long message
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 295
+250 OK mail
+250 OK rcpt
+*data 295
+250 OK nonlast bdat
+BDAT 8380 LAST
+*data 8380
+250 OK bdat
+QUIT
+225 OK
+*eof
+****
+sudo exim -odf -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<p@test.ex>
+DATA
+Subject: foo
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+.
+QUIT
+****
+#
+# server rejects MAIL cmd
+# transport coding does not handle the possible RSET-and-another transaction,
+# but always QUITs
+#
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 295
+*data 295
+550 unacceptable mail-from
+550 rcpt ungood lacking mail-from
+500 bdat (nonlast) ungood lacking mail-from
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<s@test.ex>
+DATA
+Subject: foo
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+.
+QUIT
+****
+#
+# server rejects RCPT cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 295
+*data 295
+250 OK mail
+550 no such recipient
+500 oops nonlast bdat - no rcpt
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<t@test.ex>
+DATA
+Subject: foo
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+.
+QUIT
+****
+#
+# server rejects 1st RCPT cmd of two
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+RCPT TO
+BDAT 279
+*data 279
+250 OK mail
+550 no such recipient
+250 good recipient
+200 OK nonlast bdat
+BDAT 8380 LAST
+*data 8380
+250 OK bdat
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<t1@test.ex>
+RCPT TO:<t2@test.ex>
+DATA
+Subject: foo
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+.
+QUIT
+****
+#
+# server rejects initial BDAT cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 295
+*data 295
+250 OK mail
+250 OK rcpt
+500 oops nonlast bdat
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<u@test.ex>
+DATA
+Subject: foo
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+.
+QUIT
+****
+#
+# server rejects final BDAT cmd
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 295
+*data 295
+250 OK mail
+250 OK rcpt
+250 OK nonlast bdat
+BDAT 8380 LAST
+*data 8380
+500 oops bdat
+QUIT
+225 OK
+****
+sudo exim -odf -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<v@test.ex>
+DATA
+Subject: foo
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+.
+QUIT
+****
+#
+# message with long headers
+server PORT_S
+220 Greetings
+EHLO
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM
+RCPT TO
+BDAT 8191
+250 OK mail
+250 OK rcpt
+*data 8191
+250 OK nonlast bdat
+BDAT 807 LAST
+*data 807
+250 OK bdat
+QUIT
+225 OK
+*eof
+****
+sudo exim -odf -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<p@test.ex>
+DATA
+Subject: foo
+X-long_hdr: 0
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 2
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 3
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 4
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 5
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 6
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 7
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 8
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+ 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+
+body
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+.
+QUIT
+****
+#
+#
+no_msglog_check
diff --git a/test/scripts/2000-GnuTLS/2000 b/test/scripts/2000-GnuTLS/2000
index a1299e574..8717892f2 100644
--- a/test/scripts/2000-GnuTLS/2000
+++ b/test/scripts/2000-GnuTLS/2000
@@ -13,3 +13,16 @@ exim -qf
 ****
 killdaemon
 no_msglog_check
+#
+#
+exim -be
+sha256:   ${sha256:}
+sha256:   ${sha256:abc}
+
+sha3:     ${sha3:}
+sha3:     ${sha3:abc}
+sha3_256: ${sha3_256:}
+sha3_256: ${sha3_256:abc}
+sha3_512: ${sha3_512:}
+sha3_512: ${sha3_512:abc}
+****
diff --git a/test/scripts/2000-GnuTLS/2013 b/test/scripts/2000-GnuTLS/2013
index f3d5719f0..24c2c58fc 100644
--- a/test/scripts/2000-GnuTLS/2013
+++ b/test/scripts/2000-GnuTLS/2013
@@ -5,7 +5,7 @@ exim -DSERVER=server -bd -oX PORT_D
 exim userx@test.ex
 Test message 1
 ****
-exim userx@test.ex
+exim usery@test.ex
 Test message 2
 ****
 exim -qqf -d-all+acl
diff --git a/test/scripts/2000-GnuTLS/2015 b/test/scripts/2000-GnuTLS/2015
index 140af797f..b963e4e06 100644
--- a/test/scripts/2000-GnuTLS/2015
+++ b/test/scripts/2000-GnuTLS/2015
@@ -1,4 +1,4 @@
-# TLS server: timeout after accepting STARTTLS
+# TLS server: timeout or close after accepting STARTTLS
 gnutls
 exim -DSERVER=server -bd -oX PORT_D
 ****
@@ -16,4 +16,16 @@ starttls_wait
 +++ 2
 ??? 421
 ****
+client-gnutls 127.0.0.1 PORT_D
+??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+starttls_wait
+??? 220
+****
 killdaemon
diff --git a/test/scripts/2000-GnuTLS/2020 b/test/scripts/2000-GnuTLS/2020
index bd00740bf..3203ab4ea 100644
--- a/test/scripts/2000-GnuTLS/2020
+++ b/test/scripts/2000-GnuTLS/2020
@@ -1,4 +1,4 @@
-# TLS server: no certificate defined, client sends in clear
+# TLS server: no certificate defined, autogen selfsign used
 gnutls
 exim -DSERVER=server -bd -oX PORT_D
 ****
diff --git a/test/scripts/2000-GnuTLS/2034 b/test/scripts/2000-GnuTLS/2034
new file mode 100644
index 000000000..b03c60d93
--- /dev/null
+++ b/test/scripts/2000-GnuTLS/2034
@@ -0,0 +1,34 @@
+# TLS server: error in TLS session startup
+gnutls
+exim -DSERVER=server -bd -oX PORT_D
+****
+# timeout case
+client 127.0.0.1 PORT_D
+??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+starttls
+??? 220
++++ 3
+****
+#
+# bad TLS negotiation case
+client 127.0.0.1 PORT_D
+??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+starttls
+??? 220
+bogus
+****
+killdaemon
diff --git a/test/scripts/2000-GnuTLS/2051 b/test/scripts/2000-GnuTLS/2051
new file mode 120000
index 000000000..ac5066b61
--- /dev/null
+++ b/test/scripts/2000-GnuTLS/2051
@@ -0,0 +1 @@
+../2100-OpenSSL/2151
\ No newline at end of file
diff --git a/test/scripts/2000-GnuTLS/2052 b/test/scripts/2000-GnuTLS/2052
new file mode 100644
index 000000000..fa76b4849
--- /dev/null
+++ b/test/scripts/2000-GnuTLS/2052
@@ -0,0 +1,22 @@
+# TLS client: TLS setup fails - retry in clear (with fastopen)
+#
+# If all works you'll not see any difference.  To enable in the
+# kernel, 'sudo sh -c "echo 3 > /proc/sys/net/ipv4/tcp_fastopen"'.
+# A packet capture on the loopback interface will show the TFU
+# option on the SYN, but the fast-output SMTP banner will not
+# be seen unless you also deliberately emulate a long path:
+# 'sudo tc qdisc add dev lo root netem delay 100ms'
+#
+# If the client-side is disabled in the kernel, Exim logs
+# will become noisy.
+#
+gnutls
+exim -DSERVER=server -bd -oX PORT_D
+****
+exim CALLER@test.ex
+Testing
+****
+exim -qf
+****
+killdaemon
+no_msglog_check
diff --git a/test/scripts/2000-GnuTLS/2090 b/test/scripts/2000-GnuTLS/2090
new file mode 100644
index 000000000..278f03429
--- /dev/null
+++ b/test/scripts/2000-GnuTLS/2090
@@ -0,0 +1,78 @@
+# TLS server, CHUNKING reception
+gnutls
+exim -DSERVER=server -DSRV=tls -bd -oX PORT_D
+****
+#
+# non-piplined
+client-gnutls 127.0.0.1 PORT_D
+??? 220
+EHLO rhu.barb
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250-STARTTLS
+??? 250 HELP
+STARTTLS
+??? 220
+EHLO rhu.barb
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250 HELP
+MAIL FROM:<someone@some.domain>
+??? 250
+RCPT TO:<CALLER@test.ex>
+??? 250
+BDAT 88 LAST
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 250-
+??? 250
+QUIT
+??? 221
+****
+#
+# pipelined
+client-gnutls 127.0.0.1 PORT_D
+??? 220
+EHLO rhu.barb
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250-STARTTLS
+??? 250 HELP
+STARTTLS
+??? 220
+EHLO rhu.barb
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250 HELP
+MAIL FROM:<someone@some.domain>
+RCPT TO:<CALLER@test.ex>
+BDAT 88 LAST
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 250
+??? 250
+??? 250-
+??? 250
+QUIT
+??? 221
+****
+#
+#
+killdaemon
+no_msglog_check
diff --git a/test/scripts/2000-GnuTLS/2091 b/test/scripts/2000-GnuTLS/2091
new file mode 100644
index 000000000..58e5163c5
--- /dev/null
+++ b/test/scripts/2000-GnuTLS/2091
@@ -0,0 +1,9 @@
+# TLS client, CHUNKING transmission
+gnutls
+exim -DSERVER=server -DSRV=tls -bd -oX PORT_S
+****
+exim -oMt this-user -f this-user -odf other-user@test.ex
+Test message. Contains FF: ÿ
+****
+killdaemon
+no_msglog_check
diff --git a/test/scripts/2100-OpenSSL/2100 b/test/scripts/2100-OpenSSL/2100
index c2b0f8981..27c6c84d6 100644
--- a/test/scripts/2100-OpenSSL/2100
+++ b/test/scripts/2100-OpenSSL/2100
@@ -8,3 +8,9 @@ exim -qf
 ****
 killdaemon
 no_msglog_check
+#
+#
+exim -be
+sha256: ${sha256:}
+sha256: ${sha256:abc}
+****
diff --git a/test/scripts/2100-OpenSSL/2120 b/test/scripts/2100-OpenSSL/2120
index 7e0aa1e0e..53cd81333 100644
--- a/test/scripts/2100-OpenSSL/2120
+++ b/test/scripts/2100-OpenSSL/2120
@@ -1,4 +1,4 @@
-# TLS server: no certificate defined, client sends in clear
+# TLS server: no certificate defined, autogen selfsign used
 exim -DSERVER=server -bd -oX PORT_D
 ****
 exim userx
diff --git a/test/scripts/2100-OpenSSL/2130 b/test/scripts/2100-OpenSSL/2130
index 1de3e4f40..afaa949e0 100644
--- a/test/scripts/2100-OpenSSL/2130
+++ b/test/scripts/2100-OpenSSL/2130
@@ -1,4 +1,4 @@
-# TLS: SNI
+# TLS: client SNI
 #
 exim -DSERVER=server -bd -oX PORT_D
 ****
diff --git a/test/scripts/2100-OpenSSL/2151 b/test/scripts/2100-OpenSSL/2151
new file mode 100644
index 000000000..19dfc6479
--- /dev/null
+++ b/test/scripts/2100-OpenSSL/2151
@@ -0,0 +1,34 @@
+# TLS client: recipient callout - TLS fail, retry in clear
+need_ipv4
+#
+server PORT_S 2
+220 Server ready
+EHLO
+250-wotcher mate
+250-STARTTLS
+250 OK
+STARTTLS
+250
+.
+220 Server ready
+EHLO
+250-wotcher mate
+250-STARTTLS
+250 OK
+MAIL FROM
+250 OK
+RCPT TO
+250 OK
+QUIT
+250 OK
+****
+exim -odq -bs
+ehlo xxxx
+mail from: s1@test.ex
+rcpt to: r1@test.ex
+data
+.
+quit
+****
+no_stdout_check
+no_msglog_check
diff --git a/test/scripts/2100-OpenSSL/2152 b/test/scripts/2100-OpenSSL/2152
new file mode 100644
index 000000000..329e42051
--- /dev/null
+++ b/test/scripts/2100-OpenSSL/2152
@@ -0,0 +1,21 @@
+# TLS client: TLS setup fails - retry in clear (with fastopen)
+#
+# If all works you'll not see any difference.  To enable in the
+# kernel, 'sudo sh -c "echo 3 > /proc/sys/net/ipv4/tcp_fastopen"'.
+# A packet capture on the loopback interface will show the TFU
+# option on the SYN, but the fast-output SMTP banner will not
+# be seen unless you also deliberately emulate a long path:
+# 'sudo tc qdisc add dev lo root netem delay 100ms'
+#
+# If the client-side is disabled in the kernel, Exim logs
+# will become noisy.
+#
+exim -DSERVER=server -bd -oX PORT_D
+****
+exim CALLER@test.ex
+Testing
+****
+exim -qf
+****
+killdaemon
+no_msglog_check
diff --git a/test/scripts/2100-OpenSSL/2190 b/test/scripts/2100-OpenSSL/2190
new file mode 100644
index 000000000..54095d49a
--- /dev/null
+++ b/test/scripts/2100-OpenSSL/2190
@@ -0,0 +1,77 @@
+# TLS server, CHUNKING reception
+exim -DSERVER=server -DSRV=tls -bd -oX PORT_D
+****
+#
+# non-piplined
+client-ssl 127.0.0.1 PORT_D
+??? 220
+EHLO rhu.barb
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250-STARTTLS
+??? 250 HELP
+STARTTLS
+??? 220
+EHLO rhu.barb
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250 HELP
+MAIL FROM:<someone@some.domain>
+??? 250
+RCPT TO:<CALLER@test.ex>
+??? 250
+BDAT 88 LAST
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 250-
+??? 250
+QUIT
+??? 221
+****
+#
+# pipelined
+client-ssl 127.0.0.1 PORT_D
+??? 220
+EHLO rhu.barb
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250-STARTTLS
+??? 250 HELP
+STARTTLS
+??? 220
+EHLO rhu.barb
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250 HELP
+MAIL FROM:<someone@some.domain>
+RCPT TO:<CALLER@test.ex>
+BDAT 88 LAST
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyless test message
+
+??? 250
+??? 250
+??? 250-
+??? 250
+QUIT
+??? 221
+****
+#
+#
+killdaemon
+no_msglog_check
diff --git a/test/scripts/2100-OpenSSL/2191 b/test/scripts/2100-OpenSSL/2191
new file mode 100644
index 000000000..86963f747
--- /dev/null
+++ b/test/scripts/2100-OpenSSL/2191
@@ -0,0 +1,8 @@
+# TLS client, CHUNKING transmission
+exim -DSERVER=server -DSRV=tls -bd -oX PORT_S
+****
+exim -oMt this-user -f this-user -odf other-user@test.ex
+Test message. Contains FF: ÿ
+****
+killdaemon
+no_msglog_check
diff --git a/test/scripts/2800-lmdb/2800 b/test/scripts/2800-lmdb/2800
new file mode 100644
index 000000000..a074ae628
--- /dev/null
+++ b/test/scripts/2800-lmdb/2800
@@ -0,0 +1,11 @@
+# lmdb lookup
+exim -be
+${lookup{first}lmdb{DIR/aux-fixed/TESTNUM.mdb}}
+${lookup{first}lmdb{DIR/aux-fixed/TESTNUM.mdb}{$value}fail}
+${lookup{fail}lmdb{DIR/aux-fixed/TESTNUM.mdb}{$value}{failure value}}
+${lookup{fail}lmdb{DIR/aux-fixed/TESTNUM.mdb}{$value}fail}
+${lookup{second}lmdb{DIR/aux-fixed/TESTNUM.mdb}{$value}fail}
+${extract{A}{${lookup{second}lmdb{DIR/aux-fixed/TESTNUM.mdb}{$value}fail}}}
+${extract{B}{${lookup{second}lmdb{DIR/aux-fixed/TESTNUM.mdb}{$value}fail}}}
+${extract{C}{${lookup{second}lmdb{DIR/aux-fixed/TESTNUM.mdb}{$value}fail}}{$value}fail}
+****
diff --git a/test/scripts/2800-lmdb/REQUIRES b/test/scripts/2800-lmdb/REQUIRES
new file mode 100644
index 000000000..c160c4640
--- /dev/null
+++ b/test/scripts/2800-lmdb/REQUIRES
@@ -0,0 +1 @@
+lookup lmdb
diff --git a/test/scripts/3000-Perl/3001 b/test/scripts/3000-Perl/3001
index 87b32e7cf..c49a5f352 100644
--- a/test/scripts/3000-Perl/3001
+++ b/test/scripts/3000-Perl/3001
@@ -1,3 +1,13 @@
-# Perl w/o taintmode
-exim -be '${perl{taint_flag}}'
+# Environment
+# settings
+FOO=foo FOO1=foo1 FOO2=foo2 BAR=bar BAR1=bar1 BAR2=bar2 exim -bP keep_environment add_environment
 ****
+# result via -bP environment
+FOO=foo FOO1=foo1 FOO2=foo2 BAR=bar BAR1=bar1 BAR2=bar2 exim -bP environment
+****
+# result via -n -bP environment
+FOO=foo FOO1=foo1 FOO2=foo2 BAR=bar BAR1=bar1 BAR2=bar2 exim -n -bP environment
+****
+# result via perl_at_start
+FOO=foo FOO1=foo1 FOO2=foo2 BAR=bar BAR1=bar1 BAR2=bar2 exim -ps -be ''
+***
diff --git a/test/scripts/3000-Perl/3011 b/test/scripts/3000-Perl/3011
new file mode 100644
index 000000000..87b32e7cf
--- /dev/null
+++ b/test/scripts/3000-Perl/3011
@@ -0,0 +1,3 @@
+# Perl w/o taintmode
+exim -be '${perl{taint_flag}}'
+****
diff --git a/test/scripts/3000-Perl/3012 b/test/scripts/3000-Perl/3012
new file mode 120000
index 000000000..3ae81fbb2
--- /dev/null
+++ b/test/scripts/3000-Perl/3012
@@ -0,0 +1 @@
+3011
\ No newline at end of file
diff --git a/test/scripts/3400-plaintext/3414 b/test/scripts/3400-plaintext/3414
index 37528f2ea..edd3a011f 100644
--- a/test/scripts/3400-plaintext/3414
+++ b/test/scripts/3400-plaintext/3414
@@ -1,5 +1,5 @@
 # control of AUTH= on MAIL by ACL
-exim -DS=# -bs
+exim -DOPT=# -bs
 ehlo xxxx
 mail from:<a@b> auth=c@d
 quit
@@ -15,7 +15,7 @@ mail from:<a@b> auth=c@d
 quit
 ****
 # No acl_smtp_mailauth, but authenticated
-exim -DS=# -bs
+exim -DOPT=# -bs
 ehlo xxxx
 auth plain abcd
 mail from:<a@b> auth=c@d
diff --git a/test/scripts/4000-scanning/4008 b/test/scripts/4000-scanning/4008
index 703a7c2aa..e5a7c9492 100644
--- a/test/scripts/4000-scanning/4008
+++ b/test/scripts/4000-scanning/4008
@@ -5,23 +5,23 @@
 munge scanfile_size
 #
 server 11333
-<CHECK RSPAMC/1.3
-<Content-length: 
-<Queue-Id: 
-<From: 
-<Recipient-Number: 1
-<Rcpt: 
+<CHECK RSPAMC/1.3
+<Content-length:
+<Queue-Id:
+<From:
+<Recipient-Number: 1
+<Rcpt:
 <Helo:
 <User:
-<
-<From 
+<
+<From
 <X-Envelope-From
 <X-Envelope-To
-<Received: 
-<	by 
+<Received:
+<	by
 <	(envelope
-<	id 
-<	for 
+<	id
+<	for
 <From:
 <Content-type: text/plain
 <Message-Id:
@@ -29,12 +29,12 @@ server 11333
 <Date:
 <
 <test
->RSPAMD/1.3 0 EX_OK
->Metric: default; True; 15.00 / 15.00 / 0.0
->Action: reject
->Symbol: FAKE_SYMBOL_A(15.00)
->Symbol: FAKE_SYMBOL_B(0.00)
->Message-ID: undef
+>RSPAMD/1.3 0 EX_OK
+>Metric: default; True; 15.00 / 15.00 / 0.0
+>Action: reject
+>Symbol: FAKE_SYMBOL_A(15.00)
+>Symbol: FAKE_SYMBOL_B(0.00)
+>Message-ID: undef
 *eof
 ****
 exim -odi -bs
diff --git a/test/scripts/4000-scanning/4009 b/test/scripts/4000-scanning/4009
index 0fb96ac16..d9849c341 100644
--- a/test/scripts/4000-scanning/4009
+++ b/test/scripts/4000-scanning/4009
@@ -12,14 +12,14 @@ server 7833
 <User:
 <Content-length:
 <
-<From 
+<From
 <X-Envelope-From
 <X-Envelope-To
-<Received: 
-<	by 
+<Received:
+<	by
 <	(envelope
-<	id 
-<	for 
+<	id
+<	for
 <Content-type: text/plain
 <Message-Id:
 <From:
@@ -35,7 +35,7 @@ server 7833
 >similar future email.  If you have any questions, see
 >@@CONTACT_ADDRESS@@ for details.
 >
->Content preview:  test [...] 
+>Content preview:  test [...]
 >
 >Content analysis details:   (4.5 points, 5.0 required)
 >
@@ -50,9 +50,9 @@ server 7833
 >
 *eof
 ****
-exim -odi -bs
+exim -odi -oMt fromuser -bs
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@myhost.test.ex>
 rcpt to:<userx@test.ex>
 data
 Content-type: text/plain
@@ -72,14 +72,14 @@ server 7833
 <User:
 <Content-length:
 <
-<From 
+<From
 <X-Envelope-From
 <X-Envelope-To
-<Received: 
-<	by 
+<Received:
+<	by
 <	(envelope
-<	id 
-<	for 
+<	id
+<	for
 <Content-type: text/plain
 <Message-Id:
 <From:
@@ -95,7 +95,7 @@ server 7833
 >similar future email.  If you have any questions, see
 >@@CONTACT_ADDRESS@@ for details.
 >
->Content preview:  test [...] 
+>Content preview:  test [...]
 >
 >Content analysis details:   (4.5 points, 5.0 required)
 >
@@ -110,9 +110,9 @@ server 7833
 >
 *eof
 ****
-exim -odi -bs -DOPT='127.0.0.1 7833 retry=10s'
+exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=10s'
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@myhost.test.ex>
 rcpt to:<userx@test.ex>
 data
 Content-type: text/plain
@@ -130,14 +130,14 @@ server -i 2 7833
 <User:
 <Content-length:
 <
-<From 
+<From
 <X-Envelope-From
 <X-Envelope-To
-<Received: 
-<	by 
+<Received:
+<	by
 <	(envelope
-<	id 
-<	for 
+<	id
+<	for
 <Content-type: text/plain
 <Message-Id:
 <From:
@@ -153,7 +153,7 @@ server -i 2 7833
 >similar future email.  If you have any questions, see
 >@@CONTACT_ADDRESS@@ for details.
 >
->Content preview:  test [...] 
+>Content preview:  test [...]
 >
 >Content analysis details:   (4.5 points, 5.0 required)
 >
@@ -168,9 +168,9 @@ server -i 2 7833
 >
 *eof
 ****
-exim -odi -bs -DOPT='127.0.0.1 7833 retry=4s'
+exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=4s'
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@myhost.test.ex>
 rcpt to:<userx@test.ex>
 data
 Content-type: text/plain
@@ -189,14 +189,14 @@ server 7833
 <User:
 <Content-length:
 <
-<From 
+<From
 <X-Envelope-From
 <X-Envelope-To
-<Received: 
-<	by 
+<Received:
+<	by
 <	(envelope
-<	id 
-<	for 
+<	id
+<	for
 <Content-type: text/plain
 <Message-Id:
 <From:
@@ -212,7 +212,7 @@ server 7833
 >similar future email.  If you have any questions, see
 >@@CONTACT_ADDRESS@@ for details.
 >
->Content preview:  test [...] 
+>Content preview:  test [...]
 >
 >Content analysis details:   (4.5 points, 5.0 required)
 >
@@ -227,9 +227,9 @@ server 7833
 >
 *eof
 ****
-exim -odi -bs -DOPT='<; 127.0.0.1 7833 ; 127.0.0.2 7834 pri=2 tmo=2s'
+exim -odi -oMt fromuser -bs -DOPT='<; 127.0.0.1 7833 ; HOSTIPV4 7834 pri=2 tmo=2s'
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@myhost.test.ex>
 rcpt to:<userx@test.ex>
 data
 Content-type: text/plain
diff --git a/test/scripts/4015-scan-ipv6/4015 b/test/scripts/4015-scan-ipv6/4015
index 66db933e6..9e4a857be 100644
--- a/test/scripts/4015-scan-ipv6/4015
+++ b/test/scripts/4015-scan-ipv6/4015
@@ -7,14 +7,14 @@ server 7833
 <User:
 <Content-length:
 <
-<From 
+<From
 <X-Envelope-From
 <X-Envelope-To
-<Received: 
-<	by 
+<Received:
+<	by
 <	(envelope
-<	id 
-<	for 
+<	id
+<	for
 <Content-type: text/plain
 <Message-Id:
 <From:
@@ -30,7 +30,7 @@ server 7833
 >similar future email.  If you have any questions, see
 >@@CONTACT_ADDRESS@@ for details.
 >
->Content preview:  test [...] 
+>Content preview:  test [...]
 >
 >Content analysis details:   (4.5 points, 5.0 required)
 >
@@ -45,9 +45,10 @@ server 7833
 >
 *eof
 ****
-exim -odi -bs -DOPT='<; 127.0.0.1 7833 ; ::1 7834 pri=2 tmo=2s'
+# need to trust CALLER to -oMt
+exim -odi -oMt fromuser -bs -DOPT='<; 127.0.0.1 7833 ; ::1 7834 pri=2 tmo=2s'
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@myhost.test.ex>
 rcpt to:<userx@test.ex>
 data
 Content-type: text/plain
diff --git a/test/scripts/4500-Domain-Keys-Identified-Mail/4503 b/test/scripts/4500-Domain-Keys-Identified-Mail/4503
index 45be7c2c6..140e6d6bf 100644
--- a/test/scripts/4500-Domain-Keys-Identified-Mail/4503
+++ b/test/scripts/4500-Domain-Keys-Identified-Mail/4503
@@ -4,21 +4,22 @@ exim -bd -DSERVER=server -oX PORT_D
 ****
 #
 # single header signed
-exim -DOPT=From a@test.ex
+exim -DOPT=From -odf a@test.ex
 From: nobody@example.com
+From: second@example.com
 
 content
 ****
 #
 # single header, oversigned
-exim -DOPT=From:From b@test.ex
+exim -DOPT=From:From -odf b@test.ex
 From: nobody@example.com
 
 content
 ****
 #
 # default header set
-exim -DHEADERS_MAXSIZE=y c@test.ex
+exim -DHEADERS_MAXSIZE=y -odf c@test.ex
 From: nobody@example.com
 
 content
diff --git a/test/scripts/4500-Domain-Keys-Identified-Mail/4509 b/test/scripts/4500-Domain-Keys-Identified-Mail/4509
new file mode 100644
index 000000000..3447fa10b
--- /dev/null
+++ b/test/scripts/4500-Domain-Keys-Identified-Mail/4509
@@ -0,0 +1,111 @@
+# DKIM signing, with CHUNKING
+#
+exim -bd -DSERVER=server -oX PORT_S
+****
+#
+# single header signed, short message
+exim -DOPT=dkim -DLIST=From -odf -oMt sender -f sender a@test.ex
+From: nobody@example.com
+From: second@example.com
+
+content
+****
+#
+# single header signed, long message
+exim -DOPT=dkim -DLIST=From -odf -oMt sender -f sender b@test.ex
+From: nobody@example.com
+From: second@example.com
+
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+
+The very last line
+****
+millisleep 500
+killdaemon
+no_msglog_check
diff --git a/test/scripts/4800-dnssec-dnslookup/4804 b/test/scripts/4800-dnssec-dnslookup/4804
new file mode 100644
index 000000000..ea4f2dec0
--- /dev/null
+++ b/test/scripts/4800-dnssec-dnslookup/4804
@@ -0,0 +1,11 @@
+# dnssec log_selector (client)
+exim -DSERVER=server -bd -oX PORT_D
+****
+exim -DOPT= -odf nologging@l-sec.test.ex
+****
+exim -DOPT=+dnssec -odf withlogging@l-sec.test.ex
+****
+exim -DOPT=+dnssec -odf withlogging@thishost.test.ex
+****
+killdaemon
+no_msglog_check
diff --git a/test/scripts/5400-cutthrough/5400 b/test/scripts/5400-cutthrough/5400
index 109b43928..10406c255 100644
--- a/test/scripts/5400-cutthrough/5400
+++ b/test/scripts/5400-cutthrough/5400
@@ -120,8 +120,7 @@ QUIT
 #
 # cutthrough for 2 recipients in one domain
 # first one denied
-# so we get a 2nd conn with the traditional delivery
-# (for both because it's not a real verify=recipient)
+# so we get a 2nd conn with the traditional delivery for the second
 server PORT_S 2
 220 ESMTP
 EHLO
@@ -140,8 +139,6 @@ MAIL FROM:
 250 Sender OK
 RCPT TO:
 250 ok rcpt-1
-RCPT TO:
-250 ok rcpt-2
 DATA
 354 Send data
 .
@@ -168,8 +165,7 @@ QUIT
 #
 # cutthrough for 2 recipients in one domain
 # second one denied
-# so we get a 2nd conn with the traditional delivery
-# (for both because it's not a real verify=recipient)
+# so we get a 2nd conn with the traditional delivery of the 1st
 server PORT_S 2
 220 ESMTP
 EHLO
@@ -190,8 +186,6 @@ MAIL FROM:
 250 Sender OK
 RCPT TO:
 250 ok rcpt-1
-RCPT TO:
-250 ok rcpt-2
 DATA
 354 Send data
 .
@@ -449,4 +443,5 @@ QUIT
 ****
 #
 #
+sortlog
 # End
diff --git a/test/scripts/5400-cutthrough/5401 b/test/scripts/5400-cutthrough/5401
index d92110ce5..b7837b342 100644
--- a/test/scripts/5400-cutthrough/5401
+++ b/test/scripts/5400-cutthrough/5401
@@ -16,7 +16,7 @@ DATA
 QUIT
 250 OK
 ****
-exim -d-all+acl+transport -bs
+exim -bs -odf
 EHLO myhost.test.ex
 MAIL FROM:<CALLER@myhost.test.ex>
 RCPT TO:<userx@domain.com>
@@ -25,3 +25,86 @@ DATA
 .
 QUIT
 ****
+#
+#
+#
+# cutthrough for denied recipient
+# deny should be reflected to originator
+# as this was a real rcpt-verify
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+550 No mate
+QUIT
+250 OK
+*eof
+****
+exim -bs -odf
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<no@domain.com>
+QUIT
+****
+#
+#
+#
+# cutthrough for 2 recipients in one domain
+# first one denied
+# so we get a 3rd conn with the traditional delivery
+# (for just the second because it was a real verify=recipient)
+server PORT_S 3
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+550 Not that one
+QUIT
+250 OK
+*eof
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+250 ok rcpt-1
+QUIT
+250 OK
+*eof
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+250 ok rcpt-1
+DATA
+354 Send data
+.
+250 OK
+QUIT
+250 OK
+*eof
+****
+#
+# Foregound delivery needed else the following subtest reception logging happens before this ones
+# delivery process logs and terminates; the interlock is only on the parent exim terminating.
+exim -bs -odf
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<no@domain.com>
+RCPT TO:<userx@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+#
+#
diff --git a/test/scripts/5400-cutthrough/5402 b/test/scripts/5400-cutthrough/5402
index dbe7ef3c5..1113c6d32 100644
--- a/test/scripts/5400-cutthrough/5402
+++ b/test/scripts/5400-cutthrough/5402
@@ -1,13 +1,33 @@
-# cutthrough_delivery with MAIL SIZE=
+# cutthrough_delivery vs. recipient-verify cache entry
 need_ipv4
-munge loopback
+#
+# Set up callout cache
 #
 server PORT_S
 220 ESMTP
 EHLO
-250-OK
-250 SIZE 65536
-MAIL FROM:<fred@myhost.test.ex> SIZE=1123
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+250 Recipient OK
+QUIT
+250 OK
+****
+exim -bs -odf
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<dest@domain.com>
+QUIT
+****
+#
+# Send message with cutthrough
+#
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
 250 Sender OK
 RCPT TO:
 250 Recipient OK
@@ -18,13 +38,12 @@ DATA
 QUIT
 250 OK
 ****
-exim -bs
+exim -DOPT=CUTTHROUGH -bs -odf
 EHLO myhost.test.ex
-MAIL FROM:<fred@myhost.test.ex> SIZE=99
-RCPT TO:<userx@domain.com>
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<dest@domain.com>
 DATA
 
 .
 QUIT
 ****
-# End
diff --git a/test/scripts/5400-cutthrough/5403 b/test/scripts/5400-cutthrough/5403
new file mode 100644
index 000000000..ad1b44646
--- /dev/null
+++ b/test/scripts/5400-cutthrough/5403
@@ -0,0 +1,42 @@
+# cutthrough_delivery and -bhc
+need_ipv4
+munge loopback
+no_msglog_check
+#
+# Despite config for cutthrough should not make onward conn
+server -t -2 PORT_S
+****
+exim -bhc 1.2.3.4
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<plain@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+# Onward conn made for r-verify but cleared before DATA
+server PORT_S
+220 server ready
+EHLO
+250 OK
+MAIL
+250 OK
+RCPT
+250 OK
+QUIT
+220 OK
+*eof
+****
+exim -bhc 1.2.3.4
+EHLO myhost.test.ex
+MAIL FROM:<sender@myhost.test.ex>
+RCPT TO:<verify@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+# End
diff --git a/test/scripts/5400-cutthrough/5404 b/test/scripts/5400-cutthrough/5404
new file mode 100644
index 000000000..dbe7ef3c5
--- /dev/null
+++ b/test/scripts/5400-cutthrough/5404
@@ -0,0 +1,30 @@
+# cutthrough_delivery with MAIL SIZE=
+need_ipv4
+munge loopback
+#
+server PORT_S
+220 ESMTP
+EHLO
+250-OK
+250 SIZE 65536
+MAIL FROM:<fred@myhost.test.ex> SIZE=1123
+250 Sender OK
+RCPT TO:
+250 Recipient OK
+DATA
+354 Send data
+.
+250 OK
+QUIT
+250 OK
+****
+exim -bs
+EHLO myhost.test.ex
+MAIL FROM:<fred@myhost.test.ex> SIZE=99
+RCPT TO:<userx@domain.com>
+DATA
+
+.
+QUIT
+****
+# End
diff --git a/test/scripts/5400-cutthrough/5405 b/test/scripts/5400-cutthrough/5405
new file mode 100644
index 000000000..2e7a33388
--- /dev/null
+++ b/test/scripts/5400-cutthrough/5405
@@ -0,0 +1,228 @@
+# cutthrough_delivery tmp-rejects
+need_ipv4
+munge loopback
+#
+# basic operation.  Should deliver in cutthrough mode.
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+250 Recipient OK
+DATA
+354 Send data
+.
+250 OK
+QUIT
+250 OK
+****
+exim -bs
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<usera@domain.com>
+DATA
+
+.
+QUIT
+****
+######################################################
+# RCPT-time
+#
+# temp-reject (at RCPT), default.  Should spool msg.
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+450 not right now
+QUIT
+250 OK
+****
+exim -bs
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<userb@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+# temp-reject (at RCPT), option "spool".  Should spool msg (again).
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+450 not right now
+QUIT
+250 OK
+****
+exim -DCONTROL=/defer=spool -bs
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<userc@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+# temp-reject (at RCPT), option "pass".  Should tmp-rej source, at RCPT.
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+450 not right now
+QUIT
+250 OK
+****
+exim -DCONTROL=/defer=pass -bs
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<userd@domain.com>
+QUIT
+****
+#########################################################
+# DATA-time
+#
+#
+# temp-reject (at DATA-dot), default.  Should spool msg.
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+250 good rcpt
+DATA
+354 Send data
+.
+459 content reject
+QUIT
+250 OK
+****
+exim -bs
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<usere@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+# temp-reject (at DATA-dot), option "spool".  Should spool msg (again).
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+250 good rcpt
+DATA
+354 Send data
+.
+459 content reject
+QUIT
+250 OK
+****
+exim -DCONTROL=/defer=spool -bs
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<userf@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+# temp-reject (at DATA-dot), option "pass".  Should tmp-rej source, at DATA.
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+250 good rcpt
+DATA
+354 Send data
+.
+459 content reject
+QUIT
+250 OK
+****
+exim -DCONTROL=/defer=pass -bs
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<userg@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+#########################################################
+#, Now using a conn opened by a recipient verify
+#
+# basic operation.  Should deliver in cutthrough mode.
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+250 Recipient OK
+DATA
+354 Send data
+.
+250 OK
+QUIT
+250 OK
+****
+exim -DOPT=verify=recipient/callout=use_sender -bs
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<userh@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+# temp-reject (at RCPT), default.  Should tmp-rej, due to the r-verify
+server PORT_S
+220 ESMTP
+EHLO
+250 OK
+MAIL FROM:
+250 Sender OK
+RCPT TO:
+450 not right now
+QUIT
+250 OK
+****
+exim -DOPT=verify=recipient/callout=use_sender -bs
+EHLO myhost.test.ex
+MAIL FROM:<CALLER@myhost.test.ex>
+RCPT TO:<useri@domain.com>
+DATA
+
+.
+QUIT
+****
+#
+no_msglog_check
diff --git a/test/scripts/5500-PRDR/5590 b/test/scripts/5500-PRDR/5590
new file mode 100644
index 000000000..a9722ff81
--- /dev/null
+++ b/test/scripts/5500-PRDR/5590
@@ -0,0 +1,40 @@
+# PRDR and CHUNKING reception
+exim -DALLOW=prdr_enable -DSERVER=server -bd -oX PORT_D
+****
+#
+client 127.0.0.1 PORT_D
+??? 220
+EHLO tester
+??? 250-
+??? 250-SIZE
+??? 250-8BITMIME
+??? 250-PIPELINING
+??? 250-CHUNKING
+??? 250-PRDR
+??? 250 
+MAIL FROM:<someone@some.domain> PRDR
+??? 250
+RCPT TO:<bad1@test.ex>
+??? 250
+RCPT TO:<good@test.ex>
+??? 250
+RCPT TO:<bad2@test.ex>
+??? 250
+BDAT 100 last
+To: Susan@random.com
+From: Sam@random.com
+Subject: This is a bodyfull test message
+
+1234567890
+??? 353
+??? 550
+??? 250
+??? 550
+??? 250
+QUIT
+??? 221
+****
+#
+#
+killdaemon
+no_msglog_check
diff --git a/test/scripts/5500-PRDR/5591 b/test/scripts/5500-PRDR/5591
new file mode 100644
index 000000000..cf2af61b7
--- /dev/null
+++ b/test/scripts/5500-PRDR/5591
@@ -0,0 +1,39 @@
+# PRDR and CHUNKING transmission
+need_ipv4
+no_msglog_check
+#
+# Two recipients, accepted by full PRDR response sequence
+server PORT_S
+220 Server ready
+EHLO
+250-hiya matey
+250-PRDR
+250-CHUNKING
+250 OK
+MAIL FROM:<> PRDR
+250 OK
+RCPT TO
+250 OK
+RCPT TO
+250 OK
+BDAT 285 LAST
+*data 285
+353 prdr responses coming up
+250 first rcpt was good
+250 second rcpt was good
+250 OK, overall
+QUIT
+250 OK
+****
+sudo exim -odi -bS
+EHLO
+MAIL FROM:<sender@dom>
+RCPT TO:<usery>
+RCPT TO:<userz>
+DATA
+Some message text.
+.
+QUIT
+****
+#
+#
diff --git a/test/scripts/5500-PRDR/REQUIRES b/test/scripts/5500-PRDR/REQUIRES
index e69de29bb..bca921eaf 100644
--- a/test/scripts/5500-PRDR/REQUIRES
+++ b/test/scripts/5500-PRDR/REQUIRES
@@ -0,0 +1 @@
+support PRDR
diff --git a/test/scripts/5600-OCSP-OpenSSL/5600 b/test/scripts/5600-OCSP-OpenSSL/5600
index 2e63d0e0a..72fa478e3 100644
--- a/test/scripts/5600-OCSP-OpenSSL/5600
+++ b/test/scripts/5600-OCSP-OpenSSL/5600
@@ -2,11 +2,10 @@
 #
 #
 #
-exim -z '1: Server sends good staple on request'
-****
+# '1: Server sends good staple on request'
 #
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
 client-ssl \
  -ocsp aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem \
@@ -32,11 +31,10 @@ killdaemon
 #
 #
 #
-exim -z '2: Server does not staple an outdated response'
-****
+# '2: Server does not staple an outdated response'
 #
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
 ****
 # XXX test sequence might not be quite right; this is for a server refusal
 # and we're expecting a client refusal.
@@ -58,11 +56,10 @@ killdaemon
 #
 #
 #
-exim -z '3: Server does not staple a response for a revoked cert'
-****
+# '3: Server does not staple a response for a revoked cert'
 #
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
 ****
 client-ssl \
  -ocsp aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem \
@@ -84,11 +81,10 @@ killdaemon
 #
 #
 #
-exim -z '4: Connection functions when server is prepared to staple but client does not request it'
-****
+# '4: Connection functions when server is prepared to staple but client does not request it'
 #
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
 #
 client-ssl \
diff --git a/test/scripts/5600-OCSP-OpenSSL/5601 b/test/scripts/5600-OCSP-OpenSSL/5601
index f06bba7e2..ddcdeed9b 100644
--- a/test/scripts/5600-OCSP-OpenSSL/5601
+++ b/test/scripts/5600-OCSP-OpenSSL/5601
@@ -2,7 +2,7 @@
 #
 #
 # Client works when we request but don't require OCSP stapling and none comes
-exim -bd -oX PORT_D -DSERVER=server -DOCSP=/dev/null
+exim -bd -oX PORT_D -DSERVER=server -DRETURN=/dev/null
 ****
 exim norequire@test.ex
 test message.
@@ -15,7 +15,7 @@ killdaemon
 #
 # Client works when we don't request OCSP stapling
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
 exim nostaple@test.ex
 test message.
@@ -35,20 +35,20 @@ killdaemon
 #
 #
 # Client fails on lack of required stapled info
-exim -bd -oX PORT_D -DSERVER=server -DOCSP=/dev/null
+exim -bd -oX PORT_D -DSERVER=server -DRETURN=/dev/null
 ****
 exim CALLER@test.ex
 test message.
 ****
 sleep 1
 killdaemon
-no_msglog_check
+sudo rm spool/db/retry
 #
 #
 #
 # Client fails on revoked stapled info
 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
 ****
 exim CALLER@test.ex
 test message.
@@ -56,13 +56,14 @@ test message.
 sleep 1
 killdaemon
 millisleep 200
+sudo rm spool/db/retry
 #
 #
 #
 #
 # Client fails on expired stapled info
 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
 ****
 exim CALLER@test.ex
 test message.
@@ -73,3 +74,4 @@ killdaemon
 #
 #
 #
+no_msglog_check
diff --git a/test/scripts/5600-OCSP-OpenSSL/5610 b/test/scripts/5600-OCSP-OpenSSL/5610
new file mode 100644
index 000000000..fccd94486
--- /dev/null
+++ b/test/scripts/5600-OCSP-OpenSSL/5610
@@ -0,0 +1,115 @@
+# OCSP stapling, server, LE variation
+#
+#
+#
+# '1: Server sends good staple on request'
+#
+exim -bd -oX PORT_D -DSERVER=server \
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp
+****
+client-ssl \
+ -ocsp aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem \
+ HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
+??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+starttls
+??? 220
+mail from:<userx@test.ex>
+??? 250
+rcpt to:<userx@test.ex>
+??? 250
+quit
+??? 221
+****
+killdaemon
+#
+#
+#
+# '2: Server does not staple an outdated response'
+#
+exim -bd -oX PORT_D -DSERVER=server \
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.dated.resp
+****
+# XXX test sequence might not be quite right; this is for a server refusal
+# and we're expecting a client refusal.
+client-ssl -ocsp aux-fixed/exim-ca/expired1.example.com/CA.pem HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
+??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+starttls
+??? 220
+****
+killdaemon
+#
+#
+#
+#
+#
+# '3: Server does not staple a response for a revoked cert'
+#
+exim -bd -oX PORT_D -DSERVER=server \
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.revoked.resp
+****
+client-ssl \
+ -ocsp aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem \
+ HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
+??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+starttls
+??? 220
+****
+killdaemon
+#
+#
+#
+#
+#
+# '4: Connection functions when server is prepared to staple but client does not request it'
+#
+exim -bd -oX PORT_D -DSERVER=server \
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp
+****
+#
+client-ssl \
+ HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2
+??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+starttls
+??? 220
+ehlo rhu.barb.tls
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+quit
+****
+killdaemon
+#
+#
+#
+#
+#
diff --git a/test/scripts/5600-OCSP-OpenSSL/5611 b/test/scripts/5600-OCSP-OpenSSL/5611
new file mode 100644
index 000000000..cb8f44fe1
--- /dev/null
+++ b/test/scripts/5600-OCSP-OpenSSL/5611
@@ -0,0 +1,77 @@
+# OCSP stapling, client, LE variation
+#
+#
+# Client works when we request but don't require OCSP stapling and none comes
+exim -bd -oX PORT_D -DSERVER=server -DRETURN=/dev/null
+****
+exim norequire@test.ex
+test message.
+****
+sleep 1
+killdaemon
+#
+#
+#
+#
+# Client works when we don't request OCSP stapling
+exim -bd -oX PORT_D -DSERVER=server \
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp
+****
+exim nostaple@test.ex
+test message.
+****
+millisleep 500
+#
+#
+#
+#
+# Client accepts good stapled info
+exim CALLER@test.ex
+test message.
+****
+sleep 1
+killdaemon
+#
+#
+#
+# Client fails on lack of required stapled info
+exim -bd -oX PORT_D -DSERVER=server -DRETURN=/dev/null
+****
+exim CALLER@test.ex
+test message.
+****
+sleep 1
+killdaemon
+sudo rm spool/db/retry
+#
+#
+#
+# Client fails on revoked stapled info
+EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.revoked.resp
+****
+exim CALLER@test.ex
+test message.
+****
+sleep 1
+killdaemon
+millisleep 200
+sudo rm spool/db/retry
+#
+#
+#
+#
+# Client fails on expired stapled info
+EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.dated.resp
+****
+exim CALLER@test.ex
+test message.
+****
+sleep 1
+killdaemon
+#
+#
+#
+#
+no_msglog_check
diff --git a/test/scripts/5650-OCSP-GnuTLS/5650 b/test/scripts/5650-OCSP-GnuTLS/5650
index 749d87048..f67111424 100644
--- a/test/scripts/5650-OCSP-GnuTLS/5650
+++ b/test/scripts/5650-OCSP-GnuTLS/5650
@@ -6,7 +6,7 @@ exim -z '1: Server sends good staple on request'
 ****
 #
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
 client-gnutls \
  -ocsp aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem \
@@ -36,7 +36,7 @@ exim -z '2: Server does not staple an outdated response'
 ****
 #
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
 ****
 # XXX test sequence might not be quite right; this is for a server refusal
 # and we're expecting a client refusal.
@@ -62,7 +62,7 @@ exim -z '3: Server does not staple a response for a revoked cert'
 ****
 #
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
 ****
 client-gnutls \
  -ocsp aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem \
@@ -88,7 +88,7 @@ exim -z '4: Connection functions when server is prepared to staple but client do
 ****
 #
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
 #
 client-gnutls \
diff --git a/test/scripts/5650-OCSP-GnuTLS/5651 b/test/scripts/5650-OCSP-GnuTLS/5651
index 2015d43b9..dbf802298 100644
--- a/test/scripts/5650-OCSP-GnuTLS/5651
+++ b/test/scripts/5650-OCSP-GnuTLS/5651
@@ -2,7 +2,7 @@
 #
 #
 # Client works when we request but don't require OCSP stapling and none comes
-exim -bd -oX PORT_D -DSERVER=server -DOCSP=""
+exim -bd -oX PORT_D -DSERVER=server -DOPT=""
 ****
 exim norequire@test.ex
 test message.
@@ -15,7 +15,7 @@ killdaemon
 #
 # Client works when we don't request OCSP stapling
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
 exim nostaple@test.ex
 test message.
@@ -35,7 +35,7 @@ killdaemon
 #
 #
 # Client fails on lack of required stapled info
-exim -bd -oX PORT_D -DSERVER=server -DOCSP=""
+exim -bd -oX PORT_D -DSERVER=server -DOPT=""
 ****
 exim CALLER@test.ex
 test message.
@@ -47,8 +47,9 @@ no_msglog_check
 #
 #
 # Client fails on revoked stapled info
+sudo rm DIR/spool/db/retry
 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
 ****
 exim CALLER@test.ex
 test message.
@@ -60,8 +61,9 @@ killdaemon
 #
 #
 # Client fails on expired stapled info
+sudo rm DIR/spool/db/retry
 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
 ****
 exim CALLER@test.ex
 test message.
diff --git a/test/scripts/5700-events/5700 b/test/scripts/5700-events/5700
index 8fb2010f2..1fe31cbfc 100644
--- a/test/scripts/5700-events/5700
+++ b/test/scripts/5700-events/5700
@@ -2,6 +2,7 @@
 # (EXPERIMENTAL_EVENT)
 #
 need_ipv4
+munge timeout_errno
 #
 exim -odq userx@domain1
 A deliverable message
diff --git a/test/scripts/5730-OCSP-GnuTLS-events/5730 b/test/scripts/5730-OCSP-GnuTLS-events/5730
index 6085a361e..d22a1aa1f 100644
--- a/test/scripts/5730-OCSP-GnuTLS-events/5730
+++ b/test/scripts/5730-OCSP-GnuTLS-events/5730
@@ -3,7 +3,7 @@
 #
 #
 # Client works when we request but don't require OCSP stapling and none comes
-exim -bd -oX PORT_D -DSERVER=server -DOCSP=""
+exim -bd -oX PORT_D -DSERVER=server -DOPT=""
 ****
 exim norequire@test.ex
 test message.
@@ -16,7 +16,7 @@ killdaemon
 #
 # Client works when we request but don't require OCSP stapling and some arrives
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
 exim norequire@test.ex
 test message.
@@ -45,33 +45,34 @@ killdaemon
 #
 #
 # Client fails on lack of required stapled info
-exim -bd -oX PORT_D -DSERVER=server -DOCSP=""
+exim -bd -oX PORT_D -DSERVER=server -DOPT=""
 ****
 exim failrequire@test.ex
 test message.
 ****
 sleep 1
 killdaemon
-no_msglog_check
+sudo rm DIR/spool/db/retry
 #
 #
 #
 # Client fails on revoked stapled info
 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
 ****
 exim failrevoked@test.ex
 test message.
 ****
 sleep 1
 killdaemon
+sudo rm DIR/spool/db/retry
 #
 #
 #
 #
 # Client fails on expired stapled info
 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
+ -DOPT=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
 ****
 exim failexpired@test.ex
 test message.
@@ -82,3 +83,4 @@ killdaemon
 #
 #
 #
+no_msglog_check
diff --git a/test/scripts/5740-OCSP-OpenSSL-events/5740 b/test/scripts/5740-OCSP-OpenSSL-events/5740
index 5e385afa3..43c545afa 100644
--- a/test/scripts/5740-OCSP-OpenSSL-events/5740
+++ b/test/scripts/5740-OCSP-OpenSSL-events/5740
@@ -3,7 +3,7 @@
 #
 #
 # Client works when we request but don't require OCSP stapling and none comes
-exim -bd -oX PORT_D -DSERVER=server -DOCSP=/dev/null
+exim -bd -oX PORT_D -DSERVER=server -DRETURN=/dev/null
 ****
 exim norequire@test.ex
 test message.
@@ -16,7 +16,7 @@ killdaemon
 #
 # Client works when we request but don't require OCSP stapling and some arrives
 exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
 exim norequire@test.ex
 test message.
@@ -45,7 +45,7 @@ killdaemon
 #
 #
 # Client fails on lack of required stapled info
-exim -bd -oX PORT_D -DSERVER=server -DOCSP=/dev/null
+exim -bd -oX PORT_D -DSERVER=server -DRETURN=/dev/null
 ****
 exim failrequire@test.ex
 test message.
@@ -53,25 +53,27 @@ test message.
 sleep 1
 killdaemon
 no_msglog_check
+sudo rm -f DIR/spool/db/retry
 #
 #
 #
 # Client fails on revoked stapled info
 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
 ****
 exim failrevoked@test.ex
 test message.
 ****
 sleep 1
 killdaemon
+sudo rm -f DIR/spool/db/retry
 #
 #
 #
 #
 # Client fails on expired stapled info
 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \
- -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
+ -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
 ****
 exim failexpired@test.ex
 test message.
diff --git a/test/scripts/5840-DANE-OpenSSL/5840 b/test/scripts/5840-DANE-OpenSSL/5840
index 143bf615b..d1da54913 100644
--- a/test/scripts/5840-DANE-OpenSSL/5840
+++ b/test/scripts/5840-DANE-OpenSSL/5840
@@ -2,11 +2,11 @@
 #
 exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
 ****
-# TLSA (3 1 1)
+### TLSA (3 1 1)
 exim -odq CALLER@dane256ee.test.ex
 Testing
 ****
-# TLSA (3 1 2)
+### TLSA (3 1 2)
 exim -odq CALLER@mxdane512ee.test.ex
 Testing
 ****
@@ -14,17 +14,17 @@ exim -qf
 ****
 #
 #
-# Recipient callout
+### Recipient callout
 exim -DOPT=callout -bhc 127.0.0.1
 MAIL FROM: <CALLER@myhost.test.ex>
-RCPT TO: <CALLER@dane256ee.test.ex>
+RCPT TO: <rcptuser@dane256ee.test.ex>
 ****
 killdaemon
 #
 #
 exim -DSERVER=server -DDETAILS=ta -bd -oX PORT_D
 ****
-# TLSA (2 0 1)
+### TLSA (2 0 1)
 exim -odq CALLER@mxdane256ta.test.ex
 Testing
 ****
@@ -32,7 +32,7 @@ exim -qf
 ****
 killdaemon
 #
-# A server with a nonverifying cert and no TLSA
+### A server with a nonverifying cert and no TLSA
 # Check we get a non-CV but TLS connection, with try_dane but no require_dane
 exim -DSERVER=server -DDETAILS=no -bd -oX PORT_D
 ****
@@ -43,7 +43,7 @@ exim -qf
 ****
 killdaemon
 #
-# A server with a verifying cert and no TLSA
+### A server with a verifying cert and no TLSA
 # Check we get a CV and TLS connection, with try_dane but no require_dane
 exim -DSERVER=server -DDETAILS=ca -bd -oX PORT_D
 ****
@@ -57,15 +57,15 @@ killdaemon
 #
 exim -DSERVER=server -DDETAILS=ee -bd -oX PORT_D
 ****
-# A server with two MXs for which both TLSA lookups return defer
+### A server with two MXs for which both TLSA lookups return defer
 exim -odq CALLER@mxdanelazy.test.ex
 Testing
 ****
-# A server lacking a TLSA, required
+### A server lacking a TLSA, required
 exim -odq CALLER@dane.no.1.test.ex
 Testing
 ****
-# A server lacking a TLSA, requested only
+### A server lacking a TLSA, requested only
 exim -odq CALLER@dane.no.2.test.ex
 Testing
 ****
diff --git a/test/scripts/5900-queuefile-transport/5900 b/test/scripts/5900-queuefile-transport/5900
new file mode 100644
index 000000000..3d905542d
--- /dev/null
+++ b/test/scripts/5900-queuefile-transport/5900
@@ -0,0 +1,4 @@
+# queuefile transport test non existant directory
+exim -odi userx
+****
+no_msglog_check
diff --git a/test/scripts/5900-queuefile-transport/5901 b/test/scripts/5900-queuefile-transport/5901
new file mode 100644
index 000000000..b0f74f0ab
--- /dev/null
+++ b/test/scripts/5900-queuefile-transport/5901
@@ -0,0 +1,4 @@
+# queuefile transport test relative directory
+exim -odi userx
+****
+no_msglog_check
diff --git a/test/scripts/5900-queuefile-transport/5902 b/test/scripts/5900-queuefile-transport/5902
new file mode 100644
index 000000000..77c1db215
--- /dev/null
+++ b/test/scripts/5900-queuefile-transport/5902
@@ -0,0 +1,23 @@
+# queuefile transport test delivery
+#
+# make a scanner dir for the transport to write into
+mkdir -p DIR/scanner
+sudo chown EXIMUSER:EXIMGROUP DIR/scanner
+#
+# this message should be placed by the queuefile transport in the scanner directory
+exim -DOPT=scan user1
+****
+sleep 1
+# 
+# check it is there
+ls DIR/scanner
+#
+# then re-inject "after scanning" to the default queue and see it gets found
+# it should get an appendfile delivery becase it is from the default queue
+sudo mv DIR/scanner/* DIR/spool/input/
+exim -q
+****
+#
+# tidy up
+sudo rm -fr DIR/scanner
+no_msglog_check
diff --git a/test/scripts/5900-queuefile-transport/REQUIRES b/test/scripts/5900-queuefile-transport/REQUIRES
new file mode 100644
index 000000000..f24c3ba19
--- /dev/null
+++ b/test/scripts/5900-queuefile-transport/REQUIRES
@@ -0,0 +1 @@
+support Experimental_QUEUEFILE
diff --git a/test/src/cf.c b/test/src/cf.c
index 1fce2e351..2b982f10f 100644
--- a/test/src/cf.c
+++ b/test/src/cf.c
@@ -41,6 +41,7 @@ Translated back into C, March 1990! */
 #define version            8
 #define defaultstore  100000     /* default recovery buffer size */
 #define minstore         500     /* minimum recovery buffer size */
+#define SHOWMAX		  20	 /* maximum number of diff lines to display */
 
 /* ----- misc defines ----- */
 
@@ -258,11 +259,11 @@ else if (t1 < 0 && t2 < 0)
   if (echo)
     {
     rule('-', 10);
-    if (-t1-s1 < 21) write_lines(rootline_one, tline_one);
-      else fprintf(f_out, "... <more than 20 lines> ...\n");
+    if (-t1-s1 < SHOWMAX+1) write_lines(rootline_one, tline_one);
+      else fprintf(f_out, "... <more than %d lines> ...\n", SHOWMAX);
     rule('-', 10);
-    if (-t2-s2 < 21) write_lines(rootline_two, tline_two);
-      else fprintf(f_out, "... <more than 20 lines> ...\n");
+    if (-t2-s2 < SHOWMAX+1) write_lines(rootline_two, tline_two);
+      else fprintf(f_out, "... <more than %d lines> ...\n", SHOWMAX);
     }
   }
 
diff --git a/test/src/client.c b/test/src/client.c
index 2bd640205..4a0a1bac4 100644
--- a/test/src/client.c
+++ b/test/src/client.c
@@ -24,6 +24,7 @@ ripped from the openssl ocsp and s_client utilities. */
 #include <netinet/in_systm.h>
 #include <netinet/in.h>
 #include <netinet/ip.h>
+#include <netinet/tcp.h>
 
 #include <netdb.h>
 #include <arpa/inet.h>
@@ -165,40 +166,33 @@ sigalrm_seen = 1;
 /****************************************************************************/
 
 #ifdef HAVE_OPENSSL
+# ifndef DISABLE_OCSP
 
-X509_STORE *
-setup_verify(BIO *bp, char *CAfile, char *CApath)
+static STACK_OF(X509) *
+chain_from_pem_file(const uschar * file)
 {
-        X509_STORE *store;
-        X509_LOOKUP *lookup;
-        if(!(store = X509_STORE_new())) goto end;
-        lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
-        if (lookup == NULL) goto end;
-        if (CAfile) {
-                if(!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM)) {
-                        BIO_printf(bp, "Error loading file %s\n", CAfile);
-                        goto end;
-                }
-        } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
-
-        lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
-        if (lookup == NULL) goto end;
-        if (CApath) {
-                if(!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM)) {
-                        BIO_printf(bp, "Error loading directory %s\n", CApath);
-                        goto end;
-                }
-        } else X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
-
-        ERR_clear_error();
-        return store;
-        end:
-        X509_STORE_free(store);
-        return NULL;
+BIO * bp;
+X509 * x;
+STACK_OF(X509) * sk;
+
+if (!(sk = sk_X509_new_null())) return NULL;
+if (!(bp = BIO_new_file(CS file, "r"))) return NULL;
+while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
+  sk_X509_push(sk, x);
+BIO_free(bp);
+return sk;
+}
+
+
+
+static void
+cert_stack_free(STACK_OF(X509) * sk)
+{
+while (sk_X509_num(sk) > 0) (void) sk_X509_pop(sk);
+sk_X509_free(sk);
 }
 
 
-#ifndef DISABLE_OCSP
 static int
 tls_client_stapling_cb(SSL *s, void *arg)
 {
@@ -206,8 +200,7 @@ const unsigned char *p;
 int len;
 OCSP_RESPONSE *rsp;
 OCSP_BASICRESP *bs;
-char *CAfile = NULL;
-X509_STORE *store = NULL;
+STACK_OF(X509) * sk;
 int ret = 1;
 
 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
@@ -229,15 +222,19 @@ if(!(bs = OCSP_response_get1_basic(rsp)))
   return 0;
   }
 
-CAfile = ocsp_stapling;
-if(!(store = setup_verify(arg, CAfile, NULL)))
+
+if (!(sk = chain_from_pem_file(ocsp_stapling)))
   {
   BIO_printf(arg, "error in cert setup\n");
   return 0;
   }
 
-/* No file of alternate certs, no options */
-if(OCSP_basic_verify(bs, NULL, store, 0) <= 0)
+/* OCSP_basic_verify takes a "store" arg, but does not
+use it for the chain verification, which is all we do
+when OCSP_NOVERIFY is set.  The content from the wire
+(in "bs") and a cert-stack "sk" are all that is used. */
+
+if(OCSP_basic_verify(bs, sk, NULL, OCSP_NOVERIFY) <= 0)
   {
   BIO_printf(arg, "Response Verify Failure\n");
   ERR_print_errors(arg);
@@ -246,10 +243,10 @@ if(OCSP_basic_verify(bs, NULL, store, 0) <= 0)
 else
   BIO_printf(arg, "Response verify OK\n");
 
-X509_STORE_free(store);
+cert_stack_free(sk);
 return ret;
 }
-#endif
+# endif	/*DISABLE_OCSP*/
 
 
 /*************************************************
@@ -861,9 +858,13 @@ while (fgets(CS outbuffer, sizeof(outbuffer), stdin) != NULL)
 
   /* Expect incoming */
 
-  if (strncmp(CS outbuffer, "??? ", 4) == 0)
+  if (  strncmp(CS outbuffer, "???", 3) == 0
+     && (outbuffer[3] == ' ' || outbuffer[3] == '*')
+     )
     {
     unsigned char *lineptr;
+    unsigned exp_eof = outbuffer[3] == '*';
+
     printf("%s\n", outbuffer);
 
     if (*inptr == 0)   /* Refill input buffer */
@@ -885,15 +886,27 @@ while (fgets(CS outbuffer, sizeof(outbuffer), stdin) != NULL)
         }
 
       if (rc < 0)
-        {
+	{
         printf("Read error %s\n", strerror(errno));
-        exit(81)  ;
-        }
+        exit(81);
+	}
       else if (rc == 0)
+	if (exp_eof)
+	  {
+          printf("Expected EOF read\n");
+	  continue;
+	  }
+	else
+	  {
+	  printf("Enexpected EOF read\n");
+	  close(sock);
+	  exit(80);
+	  }
+      else if (exp_eof)
         {
-        printf("Unexpected EOF read\n");
+        printf("Expected EOF not read\n");
         close(sock);
-        exit(80);
+        exit(74);
         }
       else
         {
@@ -1117,6 +1130,8 @@ int rc;
   }
 
 printf("End of script\n");
+shutdown(sock, SHUT_WR);
+while ((rc = read(sock, inbuffer, sizeof(inbuffer))) > 0) ;
 close(sock);
 
 exit(0);
diff --git a/test/src/server.c b/test/src/server.c
index b2f1bc754..26fcaf070 100644
--- a/test/src/server.c
+++ b/test/src/server.c
@@ -28,7 +28,7 @@ on all interfaces, unless the option -noipv6 is given. */
 #include <netinet/ip.h>
 
 #ifdef HAVE_NETINET_IP_VAR_H
-#include <netinet/ip_var.h>
+# include <netinet/ip_var.h>
 #endif
 
 #include <netdb.h>
@@ -61,17 +61,22 @@ typedef struct line {
   char line[1];
 } line;
 
+typedef unsigned BOOL;
+#define FALSE 0
+#define TRUE  1
+
 
 /*************************************************
 *            SIGALRM handler - crash out         *
 *************************************************/
+int tmo_noerror = 0;
 
 static void
 sigalrm_handler(int sig)
 {
 sig = sig;    /* Keep picky compilers happy */
 printf("\nServer timed out\n");
-exit(99);
+exit(tmo_noerror ? 0 : 99);
 }
 
 
@@ -200,7 +205,7 @@ int len = sizeof(accepted);
 /* Sort out the arguments */
 if (argc > 1 && (!strcmp(argv[1], "--help") || !strcmp(argv[1], "-h")))
   {
-  printf("Usage: %s [options]\n", argv[0]);
+  printf("Usage: %s [options] port|socket [connection count]\n", argv[0]);
   puts("Options"
        "\n\t-d       debug"
        "\n\t-i n     n seconds initial delay"
@@ -215,7 +220,10 @@ if (argc > 1 && (!strcmp(argv[1], "--help") || !strcmp(argv[1], "-h")))
 while (na < argc && argv[na][0] == '-')
   {
   if (strcmp(argv[na], "-d") == 0) debug = 1;
-  else if (strcmp(argv[na], "-t") == 0) timeout = atoi(argv[++na]);
+  else if (strcmp(argv[na], "-t") == 0)
+    {
+    if (tmo_noerror = ((timeout = atoi(argv[++na])) < 0)) timeout = -timeout;
+    }
   else if (strcmp(argv[na], "-i") == 0) initial_pause = atoi(argv[++na]);
   else if (strcmp(argv[na], "-noipv4") == 0) use_ipv4 = 0;
   else if (strcmp(argv[na], "-noipv6") == 0) use_ipv6 = 0;
@@ -389,7 +397,6 @@ else
       sin4.sin_addr.s_addr = (S_ADDR_TYPE)INADDR_ANY;
       sin4.sin_port = htons(port);
       if (bind(listen_socket[i], (struct sockaddr *)&sin4, sizeof(sin4)) < 0)
-        {
         if (listen_socket[v6n] < 0 || errno != EADDRINUSE)
           {
           printf("IPv4 socket bind() failed: %s\n", strerror(errno));
@@ -400,7 +407,6 @@ else
           close(listen_socket[i]);
           listen_socket[i] = -1;
           }
-        }
       }
     }
   }
@@ -492,6 +498,11 @@ s = script;
 
 for (count = 0; count < connection_count; count++)
   {
+  struct {
+    int left;
+    BOOL in_use;
+  } content_length = { 0, FALSE };
+
   alarm(timeout);
   if (port <= 0)
     {
@@ -517,8 +528,7 @@ for (count = 0; count < connection_count; count++)
       if (listen_socket[i] > max_socket) max_socket = listen_socket[i];
       }
 
-    lcount = select(max_socket + 1, &select_listen, NULL, NULL, NULL);
-    if (lcount < 0)
+    if ((lcount = select(max_socket + 1, &select_listen, NULL, NULL, NULL)) < 0)
       {
       printf("Select failed\n");
       fflush(stdout);
@@ -527,7 +537,6 @@ for (count = 0; count < connection_count; count++)
 
     accept_socket = -1;
     for (i = 0; i < skn; i++)
-      {
       if (listen_socket[i] > 0 && FD_ISSET(listen_socket[i], &select_listen))
         {
         accept_socket = accept(listen_socket[i],
@@ -535,7 +544,6 @@ for (count = 0; count < connection_count; count++)
         FD_CLR(listen_socket[i], &select_listen);
         break;
         }
-      }
     }
   alarm(0);
 
@@ -568,6 +576,7 @@ for (count = 0; count < connection_count; count++)
               cr.pid, cr.uid, cr.gid);
     --------------*****************/
     }
+  fflush(stdout);
 
   if (dup_accept_socket < 0)
     {
@@ -586,7 +595,7 @@ for (count = 0; count < connection_count; count++)
   doesn't work for other tests (e.g. ident tests) so we have explicit '<' and
   '>' flags for input and output as well as the defaults. */
 
-  for (; s != NULL; s = s->next)
+  for (; s; s = s->next)
     {
     char *ss = s->line;
 
@@ -635,6 +644,38 @@ for (count = 0; count < connection_count; count++)
       sleep(sleepfor);
       }
 
+    /* If the script line starts with "*data " we expect a numeric argument,
+    and we expect to read (and discard) that many data bytes from the input. */
+
+    else if (strncmp(ss, "*data ", 6) == 0)
+      {
+      int dlen = atoi(ss+6);
+      int n;
+
+      alarm(timeout);
+
+      if (!linebuf)
+	while (dlen > 0)
+	  {
+	  n = dlen < sizeof(buffer) ? dlen : sizeof(buffer);
+	  if ((n = read(dup_accept_socket, CS buffer, n)) == 0)
+	    {
+	    printf("Unxpected EOF read from client\n");
+	    s = s->next;
+	    goto END_OFF;
+	    }
+	  dlen -= n;
+	  }
+      else
+	while (dlen-- > 0)
+	  if (fgetc(in) == EOF)
+	    {
+	    printf("Unxpected EOF read from client\n");
+	    s = s->next;
+	    goto END_OFF;
+	    }
+      }
+
     /* Otherwise the script line is the start of an input line we are expecting
     from the client, or "*eof" indicating we expect the client to close the
     connection. Read command line or data lines; the latter are indicated
@@ -672,6 +713,7 @@ for (count = 0; count < connection_count; count++)
 
 	alarm(timeout);
 	n = read(dup_accept_socket, CS buffer+offset, s->len - offset);
+	if (content_length.in_use) content_length.left -= n;
 	if (n == 0)
 	  {
 	  printf("%sxpected EOF read from client\n",
@@ -689,8 +731,9 @@ for (count = 0; count < connection_count; count++)
 	if (data) do
 	  {
 	  n = (read(dup_accept_socket, &c, 1) == 1 && c == '.');
+	  if (content_length.in_use) content_length.left--;
 	  while (c != '\n' && read(dup_accept_socket, &c, 1) == 1)
-	    ;
+            if (content_length.in_use) content_length.left--;
 	  } while (!n);
 	else if (memcmp(ss, buffer, n) != 0)
 	  {
@@ -713,7 +756,8 @@ for (count = 0; count < connection_count; count++)
 	    goto END_OFF;
 	    }
 	  alarm(0);
-	  n = (int)strlen(CS buffer);
+	  n = strlen(CS buffer);
+	  if (content_length.in_use) content_length.left -= (n - offset);
 	  while (n > 0 && isspace(buffer[n-1])) n--;
 	  buffer[n] = 0;
 	  printf("%s\n", buffer);
@@ -727,6 +771,9 @@ for (count = 0; count < connection_count; count++)
 	  break;
 	  }
 	}
+
+	if (sscanf(buffer, "<Content-length: %d", &content_length.left)) content_length.in_use = TRUE;
+	if (content_length.in_use && content_length.left <= 0) shutdown(dup_accept_socket, SHUT_RD);
       }
     }
 
@@ -737,7 +784,7 @@ for (count = 0; count < connection_count; count++)
 
 if (s == NULL) printf("End of script\n");
 
-if (sockname != NULL) unlink(sockname);
+if (sockname) unlink(sockname);
 exit(0);
 }
 
diff --git a/test/stderr/0002 b/test/stderr/0002
index b4f06a104..e7c70cfbf 100644
--- a/test/stderr/0002
+++ b/test/stderr/0002
@@ -1,120 +1,164 @@
 Exim version x.yz ....
 configuration file is TESTSUITE/test-config
 admin user
-expanding: primary_hostname: $primary_hostname
-   result: primary_hostname: myhost.test.ex
-expanding: abcd
-   result: abcd
-expanding: \N^([ab]+)(\w+)$\N
-   result: ^([ab]+)(\w+)$
-condition: match{abcd}{\N^([ab]+)(\w+)$\N}
-   result: true
-expanding: $2$1
-   result: cdab
-expanding: match:  ${if match{abcd}{\N^([ab]+)(\w+)$\N}{$2$1}fail}
-   result: match:  cdab
-expanding: wxyz
-   result: wxyz
-expanding: \N^([ab]+)(\w+)$\N
-   result: ^([ab]+)(\w+)$
-condition: match{wxyz}{\N^([ab]+)(\w+)$\N}
-   result: false
-expanding: $2$1
-   result: 
-skipping: result is not used
+considering: primary_hostname: $primary_hostname
+  expanding: primary_hostname: $primary_hostname
+     result: primary_hostname: myhost.test.ex
+considering: match:  ${if match{abcd}{\N^([ab]+)(\w+)$\N}{$2$1}fail}
+considering: abcd}{\N^([ab]+)(\w+)$\N}{$2$1}fail}
+  expanding: abcd
+     result: abcd
+considering: \N^([ab]+)(\w+)$\N}{$2$1}fail}
+  expanding: \N^([ab]+)(\w+)$\N
+     result: ^([ab]+)(\w+)$
+  condition: match{abcd}{\N^([ab]+)(\w+)$\N}
+     result: true
+considering: $2$1}fail}
+  expanding: $2$1
+     result: cdab
+  expanding: match:  ${if match{abcd}{\N^([ab]+)(\w+)$\N}{$2$1}fail}
+     result: match:  cdab
+considering: match:  ${if match{wxyz}{\N^([ab]+)(\w+)$\N}{$2$1}fail}
+considering: wxyz}{\N^([ab]+)(\w+)$\N}{$2$1}fail}
+  expanding: wxyz
+     result: wxyz
+considering: \N^([ab]+)(\w+)$\N}{$2$1}fail}
+  expanding: \N^([ab]+)(\w+)$\N
+     result: ^([ab]+)(\w+)$
+  condition: match{wxyz}{\N^([ab]+)(\w+)$\N}
+     result: false
+   scanning: $2$1}fail}
+  expanding: $2$1
+     result: 
+   skipping: result is not used
 failed to expand: match:  ${if match{wxyz}{\N^([ab]+)(\w+)$\N}{$2$1}fail}
    error message: "if" failed and "fail" requested
 failure was forced
-expanding: 1
-   result: 1
-expanding: 1
-   result: 1
-condition: eq {1}{1}
-   result: true
-expanding: yes
-   result: yes
-expanding: xx
-   result: xx
-skipping: result is not used
-expanding: /non/exist
-   result: /non/exist
-skipping: result is not used
-expanding: ${lookup{xx}lsearch{/non/exist}}
-   result: 
-skipping: result is not used
-expanding: ${if eq {1}{1}{yes}{${lookup{xx}lsearch{/non/exist}}}}
-   result: yes
-expanding: a.b.c
-   result: a.b.c
-expanding: a.b.c
-   result: a.b.c
+considering: ${if eq {1}{1}{yes}{${lookup{xx}lsearch{/non/exist}}}}
+considering: 1}{1}{yes}{${lookup{xx}lsearch{/non/exist}}}}
+  expanding: 1
+     result: 1
+considering: 1}{yes}{${lookup{xx}lsearch{/non/exist}}}}
+  expanding: 1
+     result: 1
+  condition: eq {1}{1}
+     result: true
+considering: yes}{${lookup{xx}lsearch{/non/exist}}}}
+  expanding: yes
+     result: yes
+   scanning: ${lookup{xx}lsearch{/non/exist}}}}
+   scanning: xx}lsearch{/non/exist}}}}
+  expanding: xx
+     result: xx
+   skipping: result is not used
+   scanning: /non/exist}}}}
+  expanding: /non/exist
+     result: /non/exist
+   skipping: result is not used
+  expanding: ${lookup{xx}lsearch{/non/exist}}
+     result: 
+   skipping: result is not used
+  expanding: ${if eq {1}{1}{yes}{${lookup{xx}lsearch{/non/exist}}}}
+     result: yes
+considering: match_address:   ${if match_address{a.b.c}{a.b.c}{yes}{no}}
+considering: a.b.c}{a.b.c}{yes}{no}}
+  expanding: a.b.c
+     result: a.b.c
+considering: a.b.c}{yes}{no}}
+  expanding: a.b.c
+     result: a.b.c
 LOG: MAIN PANIC
   no @ found in the subject of an address list match: subject="a.b.c" pattern="a.b.c"
-condition: match_address{a.b.c}{a.b.c}
-   result: false
-expanding: yes
-   result: yes
-skipping: result is not used
-expanding: no
-   result: no
-expanding: match_address:   ${if match_address{a.b.c}{a.b.c}{yes}{no}}
-   result: match_address:   no
+  condition: match_address{a.b.c}{a.b.c}
+     result: false
+   scanning: yes}{no}}
+  expanding: yes
+     result: yes
+   skipping: result is not used
+considering: no}}
+  expanding: no
+     result: no
+  expanding: match_address:   ${if match_address{a.b.c}{a.b.c}{yes}{no}}
+     result: match_address:   no
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 Exim version x.yz ....
 configuration file is TESTSUITE/test-config
 admin user
-expanding: -oMa  sender_host_address = $sender_host_address
-   result: -oMa  sender_host_address = V4NET.0.0.1
-expanding:       sender_host_port = $sender_host_port
-   result:       sender_host_port = 1234
-expanding: -oMaa sender_host_authenticated = $sender_host_authenticated
-   result: -oMaa sender_host_authenticated = AAA
-expanding: -oMai authenticated_id = $authenticated_id
-   result: -oMai authenticated_id = philip
-expanding: -oMas authenticated_sender = $authenticated_sender
-   result: -oMas authenticated_sender = xx@yy.zz
-expanding: -oMi  interface_address = $interface_address
-   result: -oMi  interface_address = 1.1.1.1
-expanding:       interface_port = $interface_port
-   result:       interface_port = 99
-expanding: -oMr  received_protocol = $received_protocol
-   result: -oMr  received_protocol = special
-expanding: -oMt  sender_ident = $sender_ident
-   result: -oMt  sender_ident = me
+considering: -oMa  sender_host_address = $sender_host_address
+  expanding: -oMa  sender_host_address = $sender_host_address
+     result: -oMa  sender_host_address = V4NET.0.0.1
+considering:       sender_host_port = $sender_host_port
+  expanding:       sender_host_port = $sender_host_port
+     result:       sender_host_port = 1234
+considering: -oMaa sender_host_authenticated = $sender_host_authenticated
+  expanding: -oMaa sender_host_authenticated = $sender_host_authenticated
+     result: -oMaa sender_host_authenticated = AAA
+considering: -oMai authenticated_id = $authenticated_id
+  expanding: -oMai authenticated_id = $authenticated_id
+     result: -oMai authenticated_id = philip
+considering: -oMas authenticated_sender = $authenticated_sender
+  expanding: -oMas authenticated_sender = $authenticated_sender
+     result: -oMas authenticated_sender = xx@yy.zz
+considering: -oMi  interface_address = $interface_address
+  expanding: -oMi  interface_address = $interface_address
+     result: -oMi  interface_address = 1.1.1.1
+considering:       interface_port = $interface_port
+  expanding:       interface_port = $interface_port
+     result:       interface_port = 99
+considering: -oMr  received_protocol = $received_protocol
+  expanding: -oMr  received_protocol = $received_protocol
+     result: -oMr  received_protocol = special
+considering: -oMt  sender_ident = $sender_ident
+  expanding: -oMt  sender_ident = $sender_ident
+     result: -oMt  sender_ident = me
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 1999-03-02 09:44:33 no host name found for IP address V4NET.11.12.13
 Exim version x.yz ....
 configuration file is TESTSUITE/test-config
 admin user
-expanding: -oMa  sender_host_address = $sender_host_address
-   result: -oMa  sender_host_address = V4NET.0.0.1
-expanding:       sender_host_port = $sender_host_port
-   result:       sender_host_port = 1234
-expanding: -oMaa sender_host_authenticated = $sender_host_authenticated
-   result: -oMaa sender_host_authenticated = AAA
-expanding: -oMai authenticated_id = $authenticated_id
-   result: -oMai authenticated_id = philip
-expanding: -oMas authenticated_sender = $authenticated_sender
-   result: -oMas authenticated_sender = xx@yy.zz
-expanding: -oMi  interface_address = $interface_address
-   result: -oMi  interface_address = 1.1.1.1
-expanding:       interface_port = $interface_port
-   result:       interface_port = 99
-expanding: -oMr  received_protocol = $received_protocol
-   result: -oMr  received_protocol = special
-expanding: black
-   result: black
-expanding: white
-   result: white
-condition: eq{black}{white}
-   result: false
-expanding: $sender_host_name
-   result: 
-skipping: result is not used
-expanding: No
-   result: No
-expanding: ----> No lookup yet: ${if eq{black}{white}{$sender_host_name}{No}}
-   result: ----> No lookup yet: No
+considering: -oMa  sender_host_address = $sender_host_address
+  expanding: -oMa  sender_host_address = $sender_host_address
+     result: -oMa  sender_host_address = V4NET.0.0.1
+considering:       sender_host_port = $sender_host_port
+  expanding:       sender_host_port = $sender_host_port
+     result:       sender_host_port = 1234
+considering: -oMaa sender_host_authenticated = $sender_host_authenticated
+  expanding: -oMaa sender_host_authenticated = $sender_host_authenticated
+     result: -oMaa sender_host_authenticated = AAA
+considering: -oMai authenticated_id = $authenticated_id
+  expanding: -oMai authenticated_id = $authenticated_id
+     result: -oMai authenticated_id = philip
+considering: -oMas authenticated_sender = $authenticated_sender
+  expanding: -oMas authenticated_sender = $authenticated_sender
+     result: -oMas authenticated_sender = xx@yy.zz
+considering: -oMi  interface_address = $interface_address
+  expanding: -oMi  interface_address = $interface_address
+     result: -oMi  interface_address = 1.1.1.1
+considering:       interface_port = $interface_port
+  expanding:       interface_port = $interface_port
+     result:       interface_port = 99
+considering: -oMr  received_protocol = $received_protocol
+  expanding: -oMr  received_protocol = $received_protocol
+     result: -oMr  received_protocol = special
+considering: ----> No lookup yet: ${if eq{black}{white}{$sender_host_name}{No}}
+considering: black}{white}{$sender_host_name}{No}}
+  expanding: black
+     result: black
+considering: white}{$sender_host_name}{No}}
+  expanding: white
+     result: white
+  condition: eq{black}{white}
+     result: false
+   scanning: $sender_host_name}{No}}
+  expanding: $sender_host_name
+     result: 
+   skipping: result is not used
+considering: No}}
+  expanding: No
+     result: No
+  expanding: ----> No lookup yet: ${if eq{black}{white}{$sender_host_name}{No}}
+     result: ----> No lookup yet: No
+considering: -oMs  sender_host_name = $sender_host_name
 looking up host name for V4NET.0.0.1
 IP address lookup yielded "ten-1.test.ex"
 ten-1.test.ex V4NET.0.0.1 mx=-1 sort=xx 
@@ -122,10 +166,11 @@ checking addresses for ten-1.test.ex
   V4NET.0.0.1 OK
 sender_fullhost = ten-1.test.ex [V4NET.0.0.1]
 sender_rcvhost = ten-1.test.ex ([V4NET.0.0.1] ident=me)
-expanding: -oMs  sender_host_name = $sender_host_name
-   result: -oMs  sender_host_name = ten-1.test.ex
-expanding: -oMt  sender_ident = $sender_ident
-   result: -oMt  sender_ident = me
+  expanding: -oMs  sender_host_name = $sender_host_name
+     result: -oMs  sender_host_name = ten-1.test.ex
+considering: -oMt  sender_ident = $sender_ident
+  expanding: -oMt  sender_ident = $sender_ident
+     result: -oMt  sender_ident = me
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 Exim version x.yz ....
 changed uid/gid: forcing real = effective
@@ -182,7 +227,7 @@ host in "<
 deny: condition test succeeded in ACL "connect1"
 end of ACL "connect1": DENY
 SMTP>> 550 Administrative prohibition
-LOG: MAIN REJECT
+LOG: connection_reject MAIN REJECT
   H=ten-1.test.ex [V4NET.0.0.1] rejected connection in "connect" ACL
 search_tidyup called
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -226,7 +271,7 @@ host in "net-lsearch;TESTSUITE/aux-fixed/0002.lsearch"? no (end of list)
 deny: condition test failed in ACL "connect2"
 end of ACL "connect2": implicit DENY
 SMTP>> 550 Administrative prohibition
-LOG: MAIN REJECT
+LOG: connection_reject MAIN REJECT
   H=[V4NET.0.0.2] rejected connection in "connect" ACL
 search_tidyup called
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/0013 b/test/stderr/0013
index 78e7e579a..93af8e7a5 100644
--- a/test/stderr/0013
+++ b/test/stderr/0013
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 Exim configuration error in line 15 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 10 of TESTSUITE/test-config:
   extra characters follow string value for relay_hosts
diff --git a/test/stderr/0022 b/test/stderr/0022
index 6451e758d..75c282029 100644
--- a/test/stderr/0022
+++ b/test/stderr/0022
@@ -26,6 +26,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<warn_empty@test.ex>
 using ACL "warn_empty"
@@ -45,6 +47,7 @@ host in ignore_fromline_hosts? no (option unset)
 search_tidyup called
 >>Headers after rewriting and local additions:
 
+Data file name: TESTSUITE/spool//input//10HmbF-0005vi-00-D
 Data file written for message 10HmbF-0005vi-00
 >>Generated Received: header line
 P Received: from [V4NET.9.8.7]
@@ -92,6 +95,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<warn_log@test.ex>
 using ACL "warn_log"
@@ -114,6 +119,7 @@ host in ignore_fromline_hosts? no (option unset)
 search_tidyup called
 >>Headers after rewriting and local additions:
 
+Data file name: TESTSUITE/spool//input//10HmbG-0005vi-00-D
 Data file written for message 10HmbG-0005vi-00
 >>Generated Received: header line
 P Received: from [V4NET.9.8.7]
@@ -161,6 +167,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<warn_user@test.ex>
 using ACL "warn_user"
@@ -181,6 +189,7 @@ host in ignore_fromline_hosts? no (option unset)
 search_tidyup called
 >>Headers after rewriting and local additions:
 
+Data file name: TESTSUITE/spool//input//10HmbH-0005vi-00-D
 Data file written for message 10HmbH-0005vi-00
 >>Generated Received: header line
 P Received: from [V4NET.9.8.7]
diff --git a/test/stderr/0038 b/test/stderr/0038
index 9f1632db5..8137d8777 100644
--- a/test/stderr/0038
+++ b/test/stderr/0038
@@ -9,6 +9,7 @@
 >>> test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_rcpt"
 >>> processing "warn"
 >>> check ratelimit = 0/1h/strict
@@ -47,6 +48,7 @@ LOG: 10HmaX-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_rcpt"
 >>> processing "warn"
 >>> check ratelimit = 0/1h/strict
@@ -84,6 +86,7 @@ LOG: 10HmaY-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_rcpt"
 >>> processing "warn"
 >>> check ratelimit = 0/1h/per_conn/strict
@@ -122,6 +125,7 @@ LOG: 10HmaZ-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_rcpt"
 >>> processing "warn"
 >>> check ratelimit = 0/1h/per_conn/strict
@@ -159,6 +163,7 @@ LOG: 10HmbA-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_rcpt"
 >>> processing "warn"
 >>> check ratelimit = 0/1h/per_rcpt
@@ -225,6 +230,7 @@ LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_rcpt2"
 >>> processing "warn"
 >>> check ratelimit = 1/1m/per_rcpt/noupdate
diff --git a/test/stderr/0043 b/test/stderr/0043
index 3c6551479..55e719332 100644
--- a/test/stderr/0043
+++ b/test/stderr/0043
@@ -9,6 +9,7 @@
 >>> exim.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
diff --git a/test/stderr/0044 b/test/stderr/0044
index b261277c6..7c3fb0d3f 100644
--- a/test/stderr/0044
+++ b/test/stderr/0044
@@ -9,6 +9,7 @@
 >>> exim.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -56,6 +57,7 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> exim.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
diff --git a/test/stderr/0070 b/test/stderr/0070
index c50f93612..dcfc4286c 100644
--- a/test/stderr/0070
+++ b/test/stderr/0070
@@ -258,6 +258,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> rhubarb in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "rcpt"
 >>> processing "require"
 >>>   message: helo not verified
diff --git a/test/stderr/0079 b/test/stderr/0079
index 1fb29be98..c46c66aa1 100644
--- a/test/stderr/0079
+++ b/test/stderr/0079
@@ -9,6 +9,7 @@
 >>> exim.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
diff --git a/test/stderr/0080 b/test/stderr/0080
index c5a40d7ba..d9ea2bf81 100644
--- a/test/stderr/0080
+++ b/test/stderr/0080
@@ -9,6 +9,7 @@
 >>> exim.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check recipients = postmaster@exim.test.ex
diff --git a/test/stderr/0092 b/test/stderr/0092
index 4cae3dbf7..93f70e59c 100644
--- a/test/stderr/0092
+++ b/test/stderr/0092
@@ -50,30 +50,38 @@ LOG: smtp_connection MAIN
   SMTP connection from [V4NET.0.0.1]
 host in host_lookup? no (option unset)
 set_process_info: pppp handling incoming connection from [V4NET.0.0.1]
-expanding: V4NET.0.0.1
-   result: V4NET.0.0.1
-expanding: $sender_host_address
-   result: V4NET.0.0.1
-condition: eq {V4NET.0.0.1} {$sender_host_address}
-   result: true
-expanding: 2
-   result: 2
-expanding: 30
-   result: 30
-skipping: result is not used
-expanding: ${if eq {V4NET.0.0.1} {$sender_host_address} {2} {30}}s
-   result: 2s
+considering: ${if eq {V4NET.0.0.1} {$sender_host_address} {2} {30}}s
+considering: V4NET.0.0.1} {$sender_host_address} {2} {30}}s
+  expanding: V4NET.0.0.1
+     result: V4NET.0.0.1
+considering: $sender_host_address} {2} {30}}s
+  expanding: $sender_host_address
+     result: V4NET.0.0.1
+  condition: eq {V4NET.0.0.1} {$sender_host_address}
+     result: true
+considering: 2} {30}}s
+  expanding: 2
+     result: 2
+   scanning: 30}}s
+  expanding: 30
+     result: 30
+   skipping: result is not used
+  expanding: ${if eq {V4NET.0.0.1} {$sender_host_address} {2} {30}}s
+     result: 2s
 host in host_reject_connection? no (option unset)
 host in sender_unqualified_hosts? no (option unset)
 host in recipient_unqualified_hosts? no (option unset)
 host in helo_verify_hosts? no (option unset)
 host in helo_try_verify_hosts? no (option unset)
 host in helo_accept_junk_hosts? no (option unset)
-expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
-   result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+considering: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+  expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+     result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:userx@test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:userx@test.ex
 using ACL "check_recipient"
diff --git a/test/stderr/0094 b/test/stderr/0094
index 5ab751696..c0dbb7d26 100644
--- a/test/stderr/0094
+++ b/test/stderr/0094
@@ -109,6 +109,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<userx@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<userx@test.ex>
 using ACL "check_recipient"
diff --git a/test/stderr/0121 b/test/stderr/0121
index b578cce97..97cbca9da 100644
--- a/test/stderr/0121
+++ b/test/stderr/0121
@@ -172,16 +172,21 @@ LOG: 10HmaZ-0005vi-00 H=[127.0.0.1] F=<userx@test.ex> temporarily rejected after
 >>> foo.bar in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> foo.bar in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> foo.bar in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> foo.bar in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> foo.bar in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
diff --git a/test/stderr/0138 b/test/stderr/0138
index 5a69cc1cc..9c30eedec 100644
--- a/test/stderr/0138
+++ b/test/stderr/0138
@@ -9,6 +9,7 @@
 >>> exim.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -56,6 +57,7 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> exim.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
diff --git a/test/stderr/0143 b/test/stderr/0143
index 4be0d5227..3092135fd 100644
--- a/test/stderr/0143
+++ b/test/stderr/0143
@@ -14,22 +14,28 @@ router_name <my_main_router>
 transport_name <my_smtp>
 my_smtp transport entered
   userx@domain.com
+hostlist:
+  127.0.0.1:-1
 checking status of 127.0.0.1
 127.0.0.1 [127.0.0.1]:1111/ip4.ip4.ip4.ip4 status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@domain.com)
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-OK
          250-HELP
          250 AUTH LOGIN
 not using PIPELINING
 not using DSN
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex>
+cmd buf flush ddd bytes
   SMTP<< 250 Sender OK
   SMTP>> RCPT TO:<userx@domain.com>
+cmd buf flush ddd bytes
   SMTP<< 250 Recipient OK
   SMTP>> DATA
+cmd buf flush ddd bytes
   SMTP<< 354 Send data
   SMTP>> writing message and terminating "."
 writing data block fd=dddd size=sss timeout=300
@@ -39,6 +45,8 @@ transport_check_waiting entered
   sequence=1 local_max=500 global_max=-1
 no messages waiting for 127.0.0.1
   SMTP>> QUIT
+cmd buf flush ddd bytes
+  SMTP(close)>>
 Leaving my_smtp transport
 LOG: MAIN
   => userx@domain.com R=my_main_router T=my_smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
diff --git a/test/stderr/0148 b/test/stderr/0148
index 1b5b73a21..789b2a92e 100644
--- a/test/stderr/0148
+++ b/test/stderr/0148
@@ -1,3 +1,3 @@
 LOG: PANIC DIE
-  Exim configuration error in line 17 of TESTSUITE/test-config:
+  Exim configuration error in line 12 of TESTSUITE/test-config:
   missing quote at end of string value for hold_domains
diff --git a/test/stderr/0180 b/test/stderr/0180
index 4fa53882e..7df430b70 100644
--- a/test/stderr/0180
+++ b/test/stderr/0180
@@ -9,6 +9,7 @@
 >>> some.host in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -20,3 +21,4 @@
 >>> some.host in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
diff --git a/test/stderr/0217 b/test/stderr/0217
index 259df4604..9e31fb1d0 100644
--- a/test/stderr/0217
+++ b/test/stderr/0217
@@ -413,6 +413,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 550 NO
   SMTP<< 403 Sorry temp data error
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   == yes@test.ex R=client T=send_to_server defer (-46) H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 403 Sorry temp data error
 LOG: MAIN
@@ -847,6 +848,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => w@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK"
 LOG: MAIN
diff --git a/test/stderr/0218 b/test/stderr/0218
index 4c74ff294..f9f1d6849 100644
--- a/test/stderr/0218
+++ b/test/stderr/0218
@@ -5,6 +5,7 @@ Single queue run
 LOG: queue_run MAIN
   Start queue run: pid=pppp -qq
 queue running combined directories
+looking in TESTSUITE/spool//input
 delivering 10HmaX-0005vi-00 (queue run pid ppppp)
 R: client  (ACL)
 T: send_to_server  (ACL)
@@ -12,6 +13,7 @@ delivering 10HmaY-0005vi-00 (queue run pid ppppp)
 R: client  (ACL)
 T: send_to_server  (ACL)
 queue running combined directories
+looking in TESTSUITE/spool//input
 delivering 10HmaX-0005vi-00 (queue run pid ppppp)
 R: client  (ACL)
 T: send_to_server  (ACL)
@@ -28,6 +30,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 351 Send more
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN
   => a@test.ex F=<CALLER@test.ex> R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK"
 LOG: MAIN
@@ -48,6 +51,7 @@ T: send_to_server  (ACL)
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => b@test.ex F=<CALLER@test.ex> R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK"
 LOG: MAIN
@@ -63,6 +67,7 @@ Single queue run
 LOG: queue_run MAIN
   Start queue run: pid=pppp -qq
 queue running combined directories
+looking in TESTSUITE/spool//input
 delivering 10HmaZ-0005vi-00 (queue run pid ppppp)
 R: client  (ACL)
 T: send_to_server  (ACL)
@@ -70,6 +75,7 @@ delivering 10HmbA-0005vi-00 (queue run pid ppppp)
 R: client  (ACL)
 T: send_to_server  (ACL)
 queue running combined directories
+looking in TESTSUITE/spool//input
 delivering 10HmaZ-0005vi-00 (queue run pid ppppp)
 R: client  (ACL)
 T: send_to_server  (ACL)
@@ -85,8 +91,9 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 503 Unexpected RCPT
   SMTP<< 503 Unexpected DATA
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
-  ** a@test.ex F=<CALLER@test.ex> R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@test.ex>: 550 NO
+  ** a@test.ex F=<CALLER@test.ex> R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@test.ex>: 550 NO
 Exim version x.yz ....
 configuration file is TESTSUITE/test-config
 trusted user
@@ -142,6 +149,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 503 Unexpected DATA
   SMTP>> RSET
   SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN
   ** b@test.ex F=<CALLER@test.ex> R=client T=send_to_server H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<b@test.ex>: 550 Unknown
 Exim version x.yz ....
@@ -169,6 +177,7 @@ T: send_to_server  (ACL)
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => c@test.ex F=<CALLER@test.ex> R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK"
 LOG: MAIN
diff --git a/test/stderr/0227 b/test/stderr/0227
index 7a75ec015..d676f05a7 100644
--- a/test/stderr/0227
+++ b/test/stderr/0227
@@ -9,6 +9,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<ok@localhost>
   SMTP<< 250 OK
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 LOG: smtp_connection MAIN
@@ -26,6 +28,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<bad@localhost>
   SMTP<< 550 Unknown user
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.1] U=root sender verify fail for <bad@localhost>: response to "RCPT TO:<bad@localhost>" from 127.0.0.1 [127.0.0.1] was: 550 Unknown user
 LOG: MAIN REJECT
@@ -43,6 +47,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<uncheckable@localhost1>
   SMTP<< 450 Temporary error
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.1] U=root sender verify defer for <uncheckable@localhost1>: response to "RCPT TO:<uncheckable@localhost1>" from 127.0.0.1 [127.0.0.1] was: 450 Temporary error
 LOG: MAIN REJECT
@@ -58,6 +64,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> MAIL FROM:<>
   SMTP<< 550 Error for <>
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.1] U=root sender verify fail for <uncheckable2@localhost1>: response to "MAIL FROM:<>" from 127.0.0.1 [127.0.0.1] was: 550 Error for <>
 LOG: MAIN REJECT
@@ -74,6 +82,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 550-Multiline error for <>
          550 Here's the second line
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.1] U=root sender verify fail for <uncheckable@localhost1>: response to "MAIL FROM:<>" from 127.0.0.1 [127.0.0.1] was: 550-Multiline error for <>\n550 Here's the second line
 LOG: MAIN REJECT
@@ -91,6 +101,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<z@remote.domain>
   SMTP<< 550 Recipient not liked
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.3] U=root F=<uncheckable@localhost1> rejected RCPT <z@remote.domain>: response to "RCPT TO:<z@remote.domain>" from 127.0.0.1 [127.0.0.1] was: 550 Recipient not liked
 LOG: smtp_connection MAIN
@@ -107,6 +119,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 550-Recipient not liked on two lines
          550 Here's the second
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.3] U=root F=<uncheckable@localhost1> rejected RCPT <z@remote.domain>: response to "RCPT TO:<z@remote.domain>" from 127.0.0.1 [127.0.0.1] was: 550-Recipient not liked on two lines\n550 Here's the second
 LOG: smtp_connection MAIN
@@ -130,6 +144,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<abcd@x.y.z>
   SMTP<< 550 Not liked
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.4] U=root F=<uncheckable@localhost1> rejected after DATA: there is no valid sender in any header line
 LOG: smtp_connection MAIN
@@ -145,6 +161,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<abcd@x.y.z>
   SMTP<< 550 Not liked
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.4] U=root F=<uncheckable@localhost1> rejected after DATA: there is no valid sender in any header line
 LOG: smtp_connection MAIN
@@ -167,6 +185,8 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster@localhost1>
   SMTP<< 250 OK
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.5] U=root F=<ok@localhost1> rejected RCPT <z@remote.domain>: relay not permitted
 LOG: smtp_connection MAIN
@@ -189,6 +209,8 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster@localhost1>
   SMTP<< 550 Don't like postmaster
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.5] U=root sender verify fail for <ok@localhost1>: response to "RCPT TO:<postmaster@localhost1>" from 127.0.0.1 [127.0.0.1] was: 550 Don't like postmaster
 LOG: MAIN REJECT
@@ -197,6 +219,23 @@ LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 LOG: smtp_connection MAIN
   SMTP connection from root
+Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
+  SMTP<< 220 Server ready
+  SMTP>> EHLO myhost.test.ex
+  SMTP<< 250- wotcher
+         250-SIZE
+         250 OK
+  SMTP>> MAIL FROM:<>
+  SMTP<< 250 OK
+  SMTP>> RCPT TO:<ok@localhost1>
+  SMTP<< 250 OK
+  SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
+LOG: smtp_connection MAIN
+  SMTP connection from root closed by QUIT
+LOG: smtp_connection MAIN
+  SMTP connection from root
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 220 Server ready
   SMTP>> LHLO myhost.test.ex
@@ -206,6 +245,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<z@remote.lmtp>
   SMTP<< 550 Recipient not liked
   SMTP>> QUIT
+  SMTP<< 250 OK
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.3] U=root F=<uncheckable@localhost1> rejected RCPT <z@remote.lmtp>: response to "RCPT TO:<z@remote.lmtp>" from 127.0.0.1 [127.0.0.1] was: 550 Recipient not liked
 LOG: smtp_connection MAIN
@@ -214,6 +255,7 @@ LOG: smtp_connection MAIN
   SMTP connection from root
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN REJECT
   H=[V4NET.0.0.1] U=root sender verify defer for <bad@localhost1>: response to "initial connection" from 127.0.0.1 [127.0.0.1] was: connection dropped
 LOG: MAIN REJECT
diff --git a/test/stderr/0236 b/test/stderr/0236
index 193370cc8..f51e4e8cf 100644
--- a/test/stderr/0236
+++ b/test/stderr/0236
@@ -1,3 +1,3 @@
 LOG: PANIC DIE
-  Exim configuration error in line 15 of TESTSUITE/test-config:
+  Exim configuration error in line 10 of TESTSUITE/test-config:
   macro name too long (maximum is 63 characters)
diff --git a/test/stderr/0243 b/test/stderr/0243
index 9b8717fde..dac2ea6e7 100644
--- a/test/stderr/0243
+++ b/test/stderr/0243
@@ -9,6 +9,7 @@
 >>> xxxx in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "deny"
 >>>   message: unrouteable address
diff --git a/test/stderr/0275 b/test/stderr/0275
index bb642b01b..5f76af09a 100644
--- a/test/stderr/0275
+++ b/test/stderr/0275
@@ -127,6 +127,8 @@ DSN: r3 propagating DSN
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   userx@test.ex
@@ -141,6 +143,7 @@ I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -149,11 +152,12 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -179,6 +183,7 @@ DSN: r2 propagating DSN
 DSN: r3 propagating DSN
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -192,7 +197,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -301,7 +306,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> userx@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -330,7 +335,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-userx@test.ex: no retry items
+ userx@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/0276 b/test/stderr/0276
index 2b01713f8..030801927 100644
--- a/test/stderr/0276
+++ b/test/stderr/0276
@@ -14,6 +14,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 250 OK
   SMTP<< 500 NO
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   ** userx@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined DATA: 500 NO
 LOG: MAIN
@@ -47,6 +48,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> DATA
   SMTP<< 500 NO
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   ** userx@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after DATA: 500 NO
 LOG: MAIN
diff --git a/test/stderr/0278 b/test/stderr/0278
index fd5795b04..2d9967293 100644
--- a/test/stderr/0278
+++ b/test/stderr/0278
@@ -78,6 +78,8 @@ DSN: r5 propagating DSN
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   CALLER@test.ex
@@ -92,6 +94,7 @@ I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -100,11 +103,12 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for CALLER@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |CALLER@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -126,6 +130,7 @@ DSN: r4 propagating DSN
 DSN: r5 propagating DSN
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -139,7 +144,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   CALLER@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -203,7 +208,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> CALLER@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -232,7 +237,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-CALLER@test.ex: no retry items
+ CALLER@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/0290 b/test/stderr/0290
index cd1712e9f..da5938424 100644
--- a/test/stderr/0290
+++ b/test/stderr/0290
@@ -1,3 +1,3 @@
 LOG: PANIC DIE
-  Exim configuration error in line 27 of TESTSUITE/test-config:
+  Exim configuration error in line 22 of TESTSUITE/test-config:
   .include specifies a non-absolute path "non/absolute"
diff --git a/test/stderr/0294 b/test/stderr/0294
index 24da1eb2d..c020fda0f 100644
--- a/test/stderr/0294
+++ b/test/stderr/0294
@@ -9,6 +9,8 @@ LOG: smtp_connection MAIN
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<one@z>
 SMTP>> 250 Accepted
@@ -38,6 +40,7 @@ I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: x@y
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local-smtp (Exim x.yz)
@@ -45,7 +48,8 @@ P Received: from CALLER by myhost.test.ex with local-smtp (Exim x.yz)
 	id 10HmaX-0005vi-00; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= x@y U=CALLER P=local-smtp S=sss
@@ -54,6 +58,8 @@ SMTP>> 250 OK id=10HmaX-0005vi-00
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
 rate limit MAIL: delay 1 sec
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<two@z>
 SMTP>> 250 Accepted
@@ -67,6 +73,7 @@ I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
 F From: x@y
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local-smtp (Exim x.yz)
@@ -75,7 +82,8 @@ P Received: from CALLER by myhost.test.ex with local-smtp (Exim x.yz)
 	for two@z; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmaY-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= x@y U=CALLER P=local-smtp S=sss
@@ -83,6 +91,8 @@ SMTP>> 250 OK id=10HmaY-0005vi-00
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
 rate limit MAIL: delay 2 sec
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
@@ -108,6 +118,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<one@z>
 processing "deny"
@@ -154,6 +166,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<one@z>
 processing "deny"
@@ -193,6 +207,8 @@ LOG: smtp_connection MAIN
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<reject@z>
 SMTP>> 550 Administrative prohibition
@@ -222,6 +238,8 @@ SMTP<< rset
 SMTP>> 250 Reset OK
 SMTP<< mail from:<x@y>
 rate limit MAIL: delay 1 sec
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<reject@z>
 SMTP>> 550 Administrative prohibition
@@ -231,6 +249,8 @@ SMTP<< rset
 SMTP>> 250 Reset OK
 SMTP<< mail from:<x@y>
 rate limit MAIL: delay 2 sec
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/0303 b/test/stderr/0303
index 02f42e0a0..0a78b30f0 100644
--- a/test/stderr/0303
+++ b/test/stderr/0303
@@ -26,6 +26,7 @@
 >>>   V4NET.0.0.1 OK
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -69,12 +70,15 @@ sender_rcvhost = [V4NET.2.3.4]
 set_process_info: pppp handling incoming connection from ([V4NET.2.3.4]) [V4NET.2.3.4]
 host in dsn_advertise_hosts? no (option unset)
 host in pipelining_advertise_hosts? yes (matched "*")
+host in chunking_advertise_hosts? no (end of list)
 SMTP>> 250-myhost.test.ex Hello [V4NET.2.3.4] [V4NET.2.3.4]
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
 250 HELP
 SMTP<< mail from:<>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
@@ -90,6 +94,7 @@ search_tidyup called
 search_tidyup called
 >>Headers after rewriting and local additions:
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from [V4NET.2.3.4]
@@ -141,12 +146,15 @@ sender_rcvhost = host.name.tld ([V4NET.2.3.4])
 set_process_info: pppp handling incoming connection from host.name.tld [V4NET.2.3.4]
 host in dsn_advertise_hosts? no (option unset)
 host in pipelining_advertise_hosts? yes (matched "*")
+host in chunking_advertise_hosts? no (end of list)
 SMTP>> 250-myhost.test.ex Hello host.name.tld [V4NET.2.3.4]
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
 250 HELP
 SMTP<< mail from:<>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
@@ -162,6 +170,7 @@ search_tidyup called
 search_tidyup called
 >>Headers after rewriting and local additions:
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from host.name.tld ([V4NET.2.3.4])
diff --git a/test/stderr/0314 b/test/stderr/0314
deleted file mode 100644
index e14297ea5..000000000
--- a/test/stderr/0314
+++ /dev/null
@@ -1,12 +0,0 @@
->>> host in hosts_connection_nolog? no (option unset)
->>> host in host_lookup? no (option unset)
->>> host in host_reject_connection? yes (matched "V4NET.0.0.1")
-LOG: refused connection from [V4NET.0.0.1] (host_reject_connection)
->>> host in hosts_connection_nolog? no (option unset)
->>> host in host_lookup? no (option unset)
->>> host in host_reject_connection? no (end of list)
->>> host in sender_unqualified_hosts? no (option unset)
->>> host in recipient_unqualified_hosts? no (option unset)
->>> host in helo_verify_hosts? no (option unset)
->>> host in helo_try_verify_hosts? no (option unset)
->>> host in helo_accept_junk_hosts? no (option unset)
diff --git a/test/stderr/0317 b/test/stderr/0317
index 8cd90b29b..b71581e68 100644
--- a/test/stderr/0317
+++ b/test/stderr/0317
@@ -3,6 +3,8 @@ configuration file is TESTSUITE/test-config
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 >>Headers received:
 To: x@y.z
@@ -17,6 +19,7 @@ I Message-Id: <E10HmaX-0005vi-00@mail.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by mail.test.ex with local (Exim x.yz)
@@ -24,7 +27,8 @@ P Received: from CALLER by mail.test.ex with local (Exim x.yz)
 	id 10HmaX-0005vi-00; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -35,6 +39,8 @@ configuration file is TESTSUITE/test-config
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 >>Headers received:
 To: x@y.z
@@ -55,6 +61,7 @@ C Resent-cc: pp@qq.rr
 * Resent-bcc: xx@yy.zz
 F Resent-From: CALLER_NAME <CALLER@test.ex>
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by mail.test.ex with local (Exim x.yz)
@@ -62,7 +69,8 @@ P Received: from CALLER by mail.test.ex with local (Exim x.yz)
 	id 10HmaY-0005vi-00; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmaY-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
diff --git a/test/stderr/0348 b/test/stderr/0348
index d2c59c2ad..70311339f 100644
--- a/test/stderr/0348
+++ b/test/stderr/0348
@@ -1,8 +1,8 @@
-1999-03-02 09:44:33 Exim configuration error in line 25 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
   bad parameters for retry rule
-1999-03-02 09:44:33 Exim configuration error in line 25 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
   bad parameters for retry rule
-1999-03-02 09:44:33 Exim configuration error in line 25 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
   bad parameters for retry rule
-1999-03-02 09:44:33 Exim configuration error in line 25 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 20 of TESTSUITE/test-config:
   bad parameters for retry rule
diff --git a/test/stderr/0357 b/test/stderr/0357
index 6073e8c62..9cc0a6bb5 100644
--- a/test/stderr/0357
+++ b/test/stderr/0357
@@ -33,7 +33,7 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-userx@test.ex
+ userx@test.ex
 locking TESTSUITE/spool/db/retry.lockfile
 retry for R:userx@test.ex:<CALLER@test.ex> = * 0 0
 failing_interval=ttt message_age=ttt
@@ -84,7 +84,7 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-userx@test.ex
+ userx@test.ex
 locking TESTSUITE/spool/db/retry.lockfile
 deleted retry information for R:userx@test.ex
 deleted retry information for R:test.ex
@@ -138,7 +138,7 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-userx@test.ex
+ userx@test.ex
 locking TESTSUITE/spool/db/retry.lockfile
 deleted retry information for R:userx@test.ex
 deleted retry information for R:test.ex
@@ -176,7 +176,7 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-userx@test.ex: no retry items
+ userx@test.ex: no retry items
 end of retry processing
 LOG: queue_run MAIN
   End queue run: pid=pppp
diff --git a/test/stderr/0358 b/test/stderr/0358
index 7eec3d43f..6f75cf630 100644
--- a/test/stderr/0358
+++ b/test/stderr/0358
@@ -43,14 +43,14 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-usery@test.ex
+ usery@test.ex
 locking TESTSUITE/spool/db/retry.lockfile
 retry for R:usery@test.ex:<CALLER@test.ex> = * 0 0
 failing_interval=ttt message_age=ttt
 Writing retry data for R:usery@test.ex:<CALLER@test.ex>
   first failed=dddd last try=dddd next try=+1 expired=0
   errno=-44 more_errno=dd,A H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<usery@test.ex>: 451 Temporary error
-userx@test.ex
+ userx@test.ex
 retry for R:userx@test.ex:<CALLER@test.ex> = * 0 0
 failing_interval=ttt message_age=ttt
 Writing retry data for R:userx@test.ex:<CALLER@test.ex>
@@ -121,7 +121,7 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-usery@test.ex
+ usery@test.ex
 locking TESTSUITE/spool/db/retry.lockfile
 deleted retry information for R:usery@test.ex
 deleted retry information for R:test.ex
@@ -130,7 +130,7 @@ failing_interval=ttt message_age=ttt
 Writing retry data for R:usery@test.ex:<CALLER@test.ex>
   first failed=dddd last try=dddd next try=+2 expired=0
   errno=-44 more_errno=dd,A H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<usery@test.ex>: 451 Temporary error
-userx@test.ex
+ userx@test.ex
 deleted retry information for R:userx@test.ex
 deleted retry information for R:test.ex
 retry for R:userx@test.ex:<CALLER@test.ex> = * 0 0
diff --git a/test/stderr/0361 b/test/stderr/0361
index 43bcdbf84..2506e1cfb 100644
--- a/test/stderr/0361
+++ b/test/stderr/0361
@@ -21,6 +21,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   kilos@recurse.test.ex
@@ -35,6 +37,7 @@ I Message-Id: <E10HmaY-0005vi-00@the.local.host.name>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by the.local.host.name with local (Exim x.yz)
@@ -43,11 +46,12 @@ P Received: from CALLER by the.local.host.name with local (Exim x.yz)
 	for kilos@recurse.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |kilos@recurse.test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaY-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -67,6 +71,7 @@ seeking password data for user "CALLER": cache not available
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaY-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaY-0005vi-00-D
 reading spool file 10HmaY-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -80,7 +85,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   kilos@recurse.test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -116,7 +121,7 @@ rewrite_one_header: type=F:
   From: CALLER_NAME <CALLER@test.ex>
 re-routed to kilos@recurse.test.ex.test.ex
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -155,7 +160,7 @@ routed by r3 router
   envelope to: kilos@recurse.test.ex.test.ex
   transport: <none>
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -203,7 +208,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> kilos@recurse.test.ex.test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
diff --git a/test/stderr/0362 b/test/stderr/0362
index c2b6e25f4..913901e15 100644
--- a/test/stderr/0362
+++ b/test/stderr/0362
@@ -27,6 +27,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<x@a.b.c>
 using ACL "check_rcpt"
diff --git a/test/stderr/0364 b/test/stderr/0364
index f648839f1..d6a49bbf6 100644
--- a/test/stderr/0364
+++ b/test/stderr/0364
@@ -81,7 +81,7 @@ r2 router declined for solik@otherhost.test.ex
 --------> r3 router <--------
 local_part=solik domain=otherhost.test.ex
 checking domains
-checking "condition"
+checking "condition" "${if eq{$address_data}{}{no}{yes}}"...
 processing address_data
 calling r3 router
 rda_interpret (string): $local_part@$original_domain.sub.test.ex
@@ -107,7 +107,7 @@ r2 router declined for solik@otherhost.sub.test.ex
 --------> r3 router <--------
 local_part=solik domain=otherhost.sub.test.ex
 checking domains
-checking "condition"
+checking "condition" "${if eq{$address_data}{}{no}{yes}}"...
 r3 router skipped: condition failure
 --------> r4 router <--------
 local_part=solik domain=otherhost.sub.test.ex
@@ -184,7 +184,7 @@ r2 router declined for xxx@testsub.test.ex
 --------> r3 router <--------
 local_part=xxx domain=testsub.test.ex
 checking domains
-checking "condition"
+checking "condition" "${if eq{$address_data}{}{no}{yes}}"...
 processing address_data
 calling r3 router
 rda_interpret (string): $local_part@$original_domain.sub.test.ex
diff --git a/test/stderr/0371 b/test/stderr/0371
index 534a643f3..1cdf00177 100644
--- a/test/stderr/0371
+++ b/test/stderr/0371
@@ -37,12 +37,15 @@ sender_rcvhost = [V4NET.0.0.0] (helo=something)
 set_process_info: pppp handling incoming connection from (something) [V4NET.0.0.0]
 host in dsn_advertise_hosts? no (option unset)
 host in pipelining_advertise_hosts? yes (matched "*")
+host in chunking_advertise_hosts? no (end of list)
 SMTP>> 250-mail.test.ex Hello something [V4NET.0.0.0]
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
 250 HELP
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 using ACL "mail"
 processing "accept"
 check set acl_c0 = $acl_c0; mail
@@ -75,6 +78,7 @@ search_tidyup called
 search_tidyup called
 >>Headers after rewriting and local additions:
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from [V4NET.0.0.0] (helo=something)
@@ -119,6 +123,8 @@ LOG: MAIN
   VRFY failed for x@y H=(something) [V4NET.0.0.0]
 SMTP>> 550 <x@y> Unrouteable address
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 using ACL "mail"
 processing "accept"
 check set acl_c0 = $acl_c0; mail
diff --git a/test/stderr/0376 b/test/stderr/0376
index 310e1a101..652477e75 100644
--- a/test/stderr/0376
+++ b/test/stderr/0376
@@ -21,9 +21,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<ok@localhost>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for localhost:
   result=1 postmaster=0 random=0
-wrote positive callout cache address record
+wrote positive callout cache address record for ok@localhost
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -59,6 +61,7 @@ callout cache: found domain record for localhost
 callout cache: address record expired for ok@localhost
 interface=NULL port=1224
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... failed: Connection refused
+connect: Connection refused
 LOG: MAIN REJECT
   H=[V4NET.0.0.1] U=root sender verify defer for <ok@localhost>: could not connect to 127.0.0.1 [127.0.0.1]: Connection refused
 created log directory TESTSUITE/spool/log
@@ -90,9 +93,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<bad@localhost>
   SMTP<< 550 REJECTED
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for localhost:
   result=1 postmaster=0 random=0
-wrote negative callout cache address record
+wrote negative callout cache address record for bad@localhost
 LOG: MAIN REJECT
   H=[V4NET.0.0.1] U=root sender verify fail for <bad@localhost>: response to "RCPT TO:<bad@localhost>" from 127.0.0.1 [127.0.0.1] was: 550 REJECTED
 LOG: MAIN REJECT
@@ -142,7 +147,9 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> MAIL FROM:<>
   SMTP<< 550 REJECT MAIL FROM
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for localhost:
   result=3 postmaster=0 random=0
 LOG: MAIN REJECT
   H=[V4NET.0.0.1] U=root sender verify fail for <ok@localhost>: response to "MAIL FROM:<>" from 127.0.0.1 [127.0.0.1] was: 550 REJECT MAIL FROM
@@ -201,9 +208,11 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster@otherhost>
   SMTP<< 550 NOT OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost:
   result=1 postmaster=2 random=0
-wrote positive callout cache address record
+wrote positive callout cache address record for ok@otherhost
 LOG: MAIN REJECT
   H=[V4NET.0.0.2] U=root sender verify fail for <ok@otherhost>: response to "RCPT TO:<postmaster@otherhost>" from 127.0.0.1 [127.0.0.1] was: 550 NOT OK
 LOG: MAIN REJECT
@@ -261,9 +270,11 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster@otherhost2>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost2:
   result=1 postmaster=1 random=0
-wrote positive callout cache address record
+wrote positive callout cache address record for ok@otherhost2
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -308,7 +319,9 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<myhost.test.ex-dddddddd-testing@otherhost3>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost3:
   result=1 postmaster=0 random=1
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
@@ -352,7 +365,9 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<myhost.test.ex-dddddddd-testing@otherhost4>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost4:
   result=1 postmaster=0 random=1
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
@@ -409,9 +424,11 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster@otherhost41>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost41:
   result=1 postmaster=1 random=2
-wrote positive callout cache address record
+wrote positive callout cache address record for ok@otherhost41
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -464,9 +481,11 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster@otherhost21>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost21:
   result=1 postmaster=1 random=0
-wrote positive callout cache address record
+wrote positive callout cache address record for ok@otherhost21
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -494,9 +513,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<ok2@otherhost21>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost21:
   result=1 postmaster=1 random=0
-wrote positive callout cache address record
+wrote positive callout cache address record for ok2@otherhost21
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -529,9 +550,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<ok@otherhost31>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost31:
   result=1 postmaster=0 random=2
-wrote positive callout cache address record
+wrote positive callout cache address record for ok@otherhost31
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -559,9 +582,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<okok@otherhost31>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost31:
   result=1 postmaster=0 random=2
-wrote positive callout cache address record
+wrote positive callout cache address record for okok@otherhost31
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -594,9 +619,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<okokok@otherhost31>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost31:
   result=1 postmaster=0 random=2
-wrote positive callout cache address record
+wrote positive callout cache address record for okokok@otherhost31
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -622,7 +649,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 250 OK
   SMTP>> RCPT TO:<myhost.test.ex-dddddddd-testing@otherhost51>
 SMTP timeout
-wrote callout cache domain record:
+  SMTP(close)>>
+wrote callout cache domain record for otherhost51:
   result=1 postmaster=0 random=0
 LOG: MAIN REJECT
   H=[V4NET.0.0.5] U=root sender verify defer for <okok@otherhost51>: Could not complete sender verify callout
@@ -661,9 +689,11 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster@otherhost52>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost52:
   result=1 postmaster=1 random=0
-wrote positive callout cache address record
+wrote positive callout cache address record for okokok@otherhost52
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -691,9 +721,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<abcd@x.y.z>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for x.y.z:
   result=1 postmaster=0 random=0
-wrote positive callout cache address record
+wrote positive callout cache address record for abcd@x.y.z/<somesender@a.domain>
 LOG: MAIN
   <= ok7@otherhost53 H=[V4NET.0.0.7] U=root P=smtp S=sss
 LOG: smtp_connection MAIN
@@ -722,7 +754,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 250 OK
   SMTP>> RCPT TO:<abcd@x.y.z>
 SMTP timeout
-wrote callout cache domain record:
+  SMTP(close)>>
+wrote callout cache domain record for x.y.z:
   result=1 postmaster=0 random=0
 LOG: MAIN
   <= ok7@otherhost53 H=[V4NET.0.0.8] U=root P=smtp S=sss
@@ -761,9 +794,11 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for otherhost9:
   result=1 postmaster=1 random=0
-wrote positive callout cache address record
+wrote positive callout cache address record for ok@otherhost9
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -803,9 +838,11 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster@test.ex>
   SMTP<< 250 OK
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for test.ex:
   result=1 postmaster=1 random=2
-wrote positive callout cache address record
+wrote positive callout cache address record for z@test.ex/<postmaster@myhost.test.ex>
 LOG: smtp_connection MAIN
   SMTP connection from root closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/0377 b/test/stderr/0377
index ca3949890..848ee3367 100644
--- a/test/stderr/0377
+++ b/test/stderr/0377
@@ -63,7 +63,7 @@ bbbb_0 router skipped: local_parts mismatch
 --------> cccc_2nd_time router <--------
 local_part=cccc domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{no}{yes}}"...
 cccc_2nd_time router skipped: condition failure
 --------> cccc_redirect router <--------
 local_part=cccc domain=myhost.test.ex
@@ -101,7 +101,7 @@ seen_aaaa router skipped: local_parts mismatch
 --------> bbbb router <--------
 local_part=bbbb domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{yes}{no}}"...
 calling bbbb router
 rda_interpret (string): bbbb@$domain, defer_bbbb@$domain
 expanded: bbbb@myhost.test.ex, defer_bbbb@myhost.test.ex
@@ -127,7 +127,7 @@ defer router skipped: local_parts mismatch
 --------> unseen_aaaa router <--------
 local_part=aaaa domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{yes}{no}}"...
 calling unseen_aaaa router
 rda_interpret (string): defer_aaaa@$domain
 expanded: defer_aaaa@myhost.test.ex
@@ -207,7 +207,7 @@ bbbb_0 router skipped: local_parts mismatch
 --------> cccc_2nd_time router <--------
 local_part=cccc domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{no}{yes}}"...
 cccc_2nd_time router skipped: condition failure
 --------> cccc_redirect router <--------
 cccc_redirect router skipped: previously routed cccc@myhost.test.ex
@@ -376,7 +376,7 @@ bbbb_0 router skipped: local_parts mismatch
 --------> cccc_2nd_time router <--------
 local_part=cccc domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{no}{yes}}"...
 calling cccc_2nd_time router
 rda_interpret (string): $local_part@$domain
 expanded: cccc@myhost.test.ex
@@ -406,7 +406,7 @@ seen_aaaa router skipped: local_parts mismatch
 --------> bbbb router <--------
 local_part=bbbb domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{yes}{no}}"...
 bbbb router skipped: condition failure
 --------> bbbb_0 router <--------
 local_part=bbbb domain=myhost.test.ex
@@ -431,7 +431,7 @@ defer router skipped: local_parts mismatch
 --------> unseen_aaaa router <--------
 local_part=aaaa domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{yes}{no}}"...
 unseen_aaaa router skipped: condition failure
 --------> seen_aaaa router <--------
 local_part=aaaa domain=myhost.test.ex
@@ -627,7 +627,7 @@ bbbb_0 router skipped: local_parts mismatch
 --------> cccc_2nd_time router <--------
 local_part=cccc domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{no}{yes}}"...
 calling cccc_2nd_time router
 rda_interpret (string): $local_part@$domain
 expanded: cccc@myhost.test.ex
@@ -657,7 +657,7 @@ seen_aaaa router skipped: local_parts mismatch
 --------> bbbb router <--------
 local_part=bbbb domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{yes}{no}}"...
 bbbb router skipped: condition failure
 --------> bbbb_0 router <--------
 local_part=bbbb domain=myhost.test.ex
@@ -682,7 +682,7 @@ defer router skipped: local_parts mismatch
 --------> unseen_aaaa router <--------
 local_part=aaaa domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{yes}{no}}"...
 unseen_aaaa router skipped: condition failure
 --------> seen_aaaa router <--------
 local_part=aaaa domain=myhost.test.ex
diff --git a/test/stderr/0378 b/test/stderr/0378
index bb7b4a40a..d82f049a7 100644
--- a/test/stderr/0378
+++ b/test/stderr/0378
@@ -35,7 +35,7 @@ defer router skipped: local_parts mismatch
 --------> aaaa_2nd_time router <--------
 local_part=aaaa domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{no}{yes}}"...
 aaaa_2nd_time router skipped: condition failure
 --------> aaaa router <--------
 local_part=aaaa domain=myhost.test.ex
@@ -212,7 +212,7 @@ defer router skipped: local_parts mismatch
 --------> aaaa_2nd_time router <--------
 local_part=aaaa domain=myhost.test.ex
 checking local_parts
-checking "condition"
+checking "condition" "${if first_delivery{no}{yes}}"...
 calling aaaa_2nd_time router
 rda_interpret (string): aaaa@$domain
 expanded: aaaa@myhost.test.ex
diff --git a/test/stderr/0381 b/test/stderr/0381
index d5e9ee6fc..cd98205f2 100644
--- a/test/stderr/0381
+++ b/test/stderr/0381
@@ -28,6 +28,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<notgov@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<x@test.ex>
 using ACL "check_rcpt"
diff --git a/test/stderr/0384 b/test/stderr/0384
index 63ba003cd..1906cbd2d 100644
--- a/test/stderr/0384
+++ b/test/stderr/0384
@@ -10,6 +10,7 @@
 >>> matched host address
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> [1.2.3.4] in helo_lookup_domains? no (end of list)
 >>> verifying EHLO/HELO argument "[1.2.3.4]"
diff --git a/test/stderr/0386 b/test/stderr/0386
index 3232ada03..00094863b 100644
--- a/test/stderr/0386
+++ b/test/stderr/0386
@@ -29,6 +29,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<1@b>
 read ACL from file TESTSUITE/aux-fixed/0386.acl1
@@ -76,6 +78,8 @@ LOG: MAIN REJECT
 SMTP<< rset
 SMTP>> 250 Reset OK
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<1@b>
 using ACL "TESTSUITE/aux-fixed/0386.acl1"
@@ -158,6 +162,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<2@b>
 read ACL from file TESTSUITE/aux-fixed/0386.acl2
@@ -191,6 +197,7 @@ host in ignore_fromline_hosts? no (option unset)
 search_tidyup called
 >>Headers after rewriting and local additions:
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from [V4NET.11.12.13] (ident=CALLER)
@@ -204,11 +211,12 @@ P Received: from [V4NET.11.12.13] (ident=CALLER)
 >>
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |2@b| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= x@y H=[V4NET.11.12.13] U=CALLER P=smtp S=sss
@@ -228,6 +236,7 @@ seeking password data for user "CALLER": using cached result
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=x@y
 sender_fullhost = [V4NET.11.12.13]
@@ -243,7 +252,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   2@b 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -280,7 +289,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> 2@b <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -318,7 +327,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-2@b: no retry items
+ 2@b: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
@@ -340,6 +349,8 @@ smtp_setup_msg entered
 SMTP<< rset
 SMTP>> 250 Reset OK
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<2@b>
 using ACL "TESTSUITE/aux-fixed/0386.acl2"
@@ -368,6 +379,7 @@ host in ignore_fromline_hosts? no (option unset)
 search_tidyup called
 >>Headers after rewriting and local additions:
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from [V4NET.11.12.13] (ident=CALLER)
@@ -381,11 +393,12 @@ P Received: from [V4NET.11.12.13] (ident=CALLER)
 >>
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |2@b| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaY-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= x@y H=[V4NET.11.12.13] U=CALLER P=smtp S=sss
@@ -405,6 +418,7 @@ seeking password data for user "CALLER": using cached result
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaY-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaY-0005vi-00-D
 reading spool file 10HmaY-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=x@y
 sender_fullhost = [V4NET.11.12.13]
@@ -420,7 +434,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   2@b 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -456,7 +470,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> 2@b <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -494,7 +508,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaY-0005vi-00
 Processing retry items
 Succeeded addresses:
-2@b: no retry items
+ 2@b: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/0388 b/test/stderr/0388
index 5f4680130..92b3f23e1 100644
--- a/test/stderr/0388
+++ b/test/stderr/0388
@@ -8,7 +8,7 @@ DSN: r1 propagating DSN
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -75,7 +75,7 @@ changed uid/gid: remote delivery to x@y with transport=smtp
 set_process_info: pppp delivering 10HmaX-0005vi-00 using smtp
 checking status of 127.0.0.1
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -85,23 +85,28 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 220 Server ready
 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250 OK
 127.0.0.1 in hosts_require_auth? no (option unset)
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> RCPT TO:<x@y>
+cmd buf flush ddd bytes
   SMTP<< 451 Temporary error
 LOG: MAIN
   H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<x@y>: 451 Temporary error
 added retry item for R:x@y: errno=-44 more_errno=dd,A flags=0
   SMTP>> QUIT
+cmd buf flush ddd bytes
+  SMTP(close)>>
 set_process_info: pppp delivering 10HmaX-0005vi-00: just tried 127.0.0.1 [127.0.0.1] for x@y: result OK
 address match test: subject=*@127.0.0.1 pattern=*
 127.0.0.1 in "*"? yes (matched "*")
 *@127.0.0.1 in "*"? yes (matched "*")
 checking status of V4NET.0.0.0
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -129,9 +134,9 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-x@y
+ x@y
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/retry: flags=O_RDWR
@@ -159,6 +164,7 @@ dbfn_write: key=T:V4NET.0.0.0:V4NET.0.0.0:1224
 timed out: all retries expired
 LOG: MAIN
   ** x@y: retry timeout exceeded
+closed hints database and lockfile
 end of retry processing
 exec TESTSUITE/eximdir/exim -DEXIM_PATH=TESTSUITE/eximdir/exim -C TESTSUITE/test-config -d=0xebb95ced -odi -odi -t -oem -oi -f <> -E10HmaX-0005vi-00
 Exim version x.yz ....
@@ -174,6 +180,8 @@ DSN: r1 propagating DSN
 originator: uid=EXIM_UID gid=EXIM_GID login=EXIMUSER name=
 sender address = 
 set_process_info: pppp accepting a local non-SMTP message from <>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: 
 search_tidyup called
 >>Headers received:
@@ -201,6 +209,7 @@ T To: CALLER@myhost.test.ex
 I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from EXIMUSER by myhost.test.ex with local (Exim x.yz)
@@ -208,7 +217,8 @@ P Received: from EXIMUSER by myhost.test.ex with local (Exim x.yz)
 	for CALLER@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmaY-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= <> R=10HmaX-0005vi-00 U=EXIMUSER P=local S=sss
@@ -225,7 +235,7 @@ DSN: r1 propagating DSN
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaY-0005vi-00
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/retry: flags=O_RDONLY
@@ -238,6 +248,7 @@ dbfn_read: key=R:CALLER@myhost.test.ex:<>
 no domain retry record
 no address retry record
 CALLER@myhost.test.ex: queued for routing
+closed hints database and lockfile
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 routing CALLER@myhost.test.ex
 --------> r0 router <--------
@@ -268,7 +279,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaY-0005vi-00
 Processing retry items
 Succeeded addresses:
-CALLER@myhost.test.ex: no retry items
+ CALLER@myhost.test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
@@ -279,7 +290,8 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 search_tidyup called
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   Completed
diff --git a/test/stderr/0391 b/test/stderr/0391
index 31fd790e9..783db01c5 100644
--- a/test/stderr/0391
+++ b/test/stderr/0391
@@ -24,6 +24,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<U@W.x.y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<B@a.b.c>
 using ACL "acl_rcpt"
diff --git a/test/stderr/0393 b/test/stderr/0393
index c40aa6f52..dd0887f09 100644
--- a/test/stderr/0393
+++ b/test/stderr/0393
@@ -27,7 +27,7 @@ lock file created
 mailbox TESTSUITE/test-mail/userx is locked
 writing to file TESTSUITE/test-mail/userx
 writing data block fd=dddd size=sss timeout=0
-process pppp running as transport filter: write=dddd read=dddd
+process pppp running as transport filter: fd_write=dddd fd_read=dddd
 writing data block fd=dddd size=sss timeout=0
 process pppp writing to transport filter
 copying from the filter
diff --git a/test/stderr/0396 b/test/stderr/0396
index 24b785652..427b7b43a 100644
--- a/test/stderr/0396
+++ b/test/stderr/0396
@@ -14,6 +14,8 @@ LOG: smtp_connection MAIN
 SMTP>> 220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
diff --git a/test/stderr/0398 b/test/stderr/0398
index 17d580669..7489a19a1 100644
--- a/test/stderr/0398
+++ b/test/stderr/0398
@@ -18,6 +18,8 @@ LOG: smtp_connection MAIN
 SMTP>> 220 mail.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<qq@remote>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<abc@local>
 using ACL "rcpt"
@@ -117,7 +119,7 @@ routed by r2 router
   host 127.0.0.1 [127.0.0.1]
 Attempting full verification using callout
 locking TESTSUITE/spool/db/callout.lockfile
-locked TESTSUITE/spool/db/callout.lockfile
+locked  TESTSUITE/spool/db/callout.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/callout)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/callout: flags=O_RDWR
@@ -125,28 +127,36 @@ dbfn_read: key=remote
 callout cache: found domain record for remote
 dbfn_read: key=qq@remote
 callout cache: no address record found for qq@remote
+closed hints database and lockfile
 interface=NULL port=1224
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 220 Server ready
 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO mail.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250 OK
 127.0.0.1 in hosts_require_auth? no (option unset)
   SMTP>> MAIL FROM:<>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> RCPT TO:<qq@remote>
+cmd buf flush ddd bytes
   SMTP<< 550 Unknown
   SMTP>> QUIT
+cmd buf flush ddd bytes
+  SMTP<< 250 OK
+  SMTP(close)>>
 locking TESTSUITE/spool/db/callout.lockfile
-locked TESTSUITE/spool/db/callout.lockfile
+locked  TESTSUITE/spool/db/callout.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/callout)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/callout: flags=O_RDWR|O_CREAT
 dbfn_write: key=remote
-wrote callout cache domain record:
+wrote callout cache domain record for remote:
   result=1 postmaster=0 random=0
 dbfn_write: key=qq@remote
-wrote negative callout cache address record
+wrote negative callout cache address record for qq@remote
+closed hints database and lockfile
 ----------- end verify ------------
 l_message: $acl_verify_message
 warn: condition test succeeded in ACL "rcpt"
@@ -218,7 +228,7 @@ routed by r2 router
   host 127.0.0.1 [127.0.0.1]
 Attempting full verification using callout
 locking TESTSUITE/spool/db/callout.lockfile
-locked TESTSUITE/spool/db/callout.lockfile
+locked  TESTSUITE/spool/db/callout.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/callout)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/callout: flags=O_RDWR
@@ -227,6 +237,7 @@ callout cache: found domain record for remote
 dbfn_read: key=qq@remote
 callout cache: found address record for qq@remote
 callout cache: address record is negative
+closed hints database and lockfile
 ----------- end verify ------------
 l_message: $acl_verify_message
 warn: condition test succeeded in ACL "rcpt"
diff --git a/test/stderr/0402 b/test/stderr/0402
index c0a03d3ee..9aa1f596e 100644
--- a/test/stderr/0402
+++ b/test/stderr/0402
@@ -19,6 +19,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   CALLER@test.ex
@@ -37,58 +39,111 @@ I Message-Id: <E10HmaX-0005vi-00@mail.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
-condition: def:sender_rcvhost
-   result: false
-expanding: from $sender_rcvhost
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_rcvhost
+     result: false
+   scanning: from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: from $sender_rcvhost
 	
-   result: from 
+     result: from 
 	
-skipping: result is not used
-condition: def:sender_ident
-   result: true
-expanding: $sender_ident
-   result: CALLER
-expanding: from ${quote_local_part:$sender_ident} 
-   result: from CALLER 
-condition: def:sender_helo_name
-   result: false
-expanding: (helo=$sender_helo_name)
+   skipping: result is not used
+considering: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_ident
+     result: true
+considering: from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+considering: $sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: $sender_ident
+     result: CALLER
+  expanding: from ${quote_local_part:$sender_ident} 
+     result: from CALLER 
+  condition: def:sender_helo_name
+     result: false
+   scanning: (helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (helo=$sender_helo_name)
 	
-   result: (helo=)
+     result: (helo=)
 	
-skipping: result is not used
-expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+   skipping: result is not used
+  expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
 	}}
-   result: from CALLER 
-condition: def:received_protocol
-   result: true
-expanding: with $received_protocol
-   result: with local
-condition: def:sender_address
-   result: true
-expanding: (envelope-from <$sender_address>)
+     result: from CALLER 
+  condition: def:received_protocol
+     result: true
+considering: with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: with $received_protocol
+     result: with local
+  condition: def:sender_address
+     result: true
+considering: (envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (envelope-from <$sender_address>)
 	
-   result: (envelope-from <CALLER@test.ex>)
+     result: (envelope-from <CALLER@test.ex>)
 	
-condition: def:received_for
-   result: false
-expanding: 
+  condition: def:received_for
+     result: false
+   scanning: 
+	for $received_for}}
+  expanding: 
 	for $received_for
-   result: 
+     result: 
 	for 
-skipping: result is not used
+   skipping: result is not used
+  expanding: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+     result: Received: from CALLER by mail.test.ex with local (Exim x.yz)
+	(envelope-from <CALLER@test.ex>)
+	id 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by mail.test.ex with local (Exim x.yz)
 	(envelope-from <CALLER@test.ex>)
 	id 10HmaX-0005vi-00; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
-Writing spool header file
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
@@ -101,6 +156,7 @@ DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |rd+CALLER@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |rd+usery@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -126,6 +182,7 @@ seeking password data for user "CALLER": using cached result
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -151,7 +208,7 @@ Delivery address list:
   rd+CALLER@test.ex 
   rd+usery@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -214,8 +271,9 @@ local_part=rd+usery domain=test.ex
 stripped prefix rd+
 checking local_parts
 usery in "usery"? yes (matched "usery")
-expanding: /non-exist/$domain
-   result: /non-exist/test.ex
+considering: /non-exist/$domain
+  expanding: /non-exist/$domain
+     result: /non-exist/test.ex
 calling r5 router
 rda_interpret (string): TESTSUITE/test-mail/junk
 expanded: TESTSUITE/test-mail/junk
@@ -252,8 +310,9 @@ local_part=rd+CALLER domain=test.ex
 stripped prefix rd+
 checking local_parts
 CALLER in "CALLER"? yes (matched "CALLER")
-expanding: /non-exist/$local_part
-   result: /non-exist/CALLER
+considering: /non-exist/$local_part
+  expanding: /non-exist/$local_part
+     result: /non-exist/CALLER
 calling r4 router
 rda_interpret (string): TESTSUITE/test-mail/junk
 expanded: TESTSUITE/test-mail/junk
@@ -284,8 +343,9 @@ r2 router skipped: local_parts mismatch
 local_part=userz domain=test.ex
 checking local_parts
 userz in "userz"? yes (matched "userz")
-expanding: /non-exist/$domain
-   result: /non-exist/test.ex
+considering: /non-exist/$domain
+  expanding: /non-exist/$domain
+     result: /non-exist/test.ex
 calling r3 router
 r3 router called for userz@test.ex
   domain = test.ex
@@ -308,8 +368,9 @@ r1 router skipped: local_parts mismatch
 local_part=usery domain=test.ex
 checking local_parts
 usery in "usery"? yes (matched "usery")
-expanding: /non-exist/$domain
-   result: /non-exist/test.ex
+considering: /non-exist/$domain
+  expanding: /non-exist/$domain
+     result: /non-exist/test.ex
 calling r2 router
 r2 router called for usery@test.ex
   domain = test.ex
@@ -327,8 +388,9 @@ routing CALLER@test.ex
 local_part=CALLER domain=test.ex
 checking local_parts
 CALLER in "CALLER"? yes (matched "CALLER")
-expanding: /non-exist/$local_part
-   result: /non-exist/CALLER
+considering: /non-exist/$local_part
+  expanding: /non-exist/$local_part
+     result: /non-exist/CALLER
 calling r1 router
 r1 router called for CALLER@test.ex
   domain = test.ex
@@ -341,7 +403,7 @@ routed by r1 router
   envelope to: CALLER@test.ex
   transport: t1
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -368,20 +430,22 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> TESTSUITE/test-mail/junk <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
-expanding: /non-exist/$local_part
-   result: /non-exist/usery
+considering: /non-exist/$local_part
+  expanding: /non-exist/$local_part
+     result: /non-exist/usery
 search_tidyup called
 changed uid/gid: local delivery to TESTSUITE/test-mail/junk <TESTSUITE/test-mail/junk> transport=ft1
   uid=CALLER_UID gid=CALLER_GID pid=pppp
   home=/non-exist/usery current=/
 set_process_info: pppp delivering 10HmaX-0005vi-00 to TESTSUITE/test-mail/junk using ft1
 appendfile transport entered
-expanding: $address_file
-   result: TESTSUITE/test-mail/junk
+considering: $address_file
+  expanding: $address_file
+     result: TESTSUITE/test-mail/junk
 appendfile: mode=600 notify_comsat=0 quota=0 warning=0
   file=TESTSUITE/test-mail/junk format=unix
   message_prefix=From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n
@@ -393,16 +457,22 @@ hitch name: TESTSUITE/test-mail/junk.lock.test.ex.dddddddd.pppppppp
 lock file created
 mailbox TESTSUITE/test-mail/junk is locked
 writing to file TESTSUITE/test-mail/junk
-condition: def:return_path
-   result: true
-expanding: $return_path
-   result: CALLER@test.ex
-expanding: MAILER-DAEMON
-   result: MAILER-DAEMON
-skipping: result is not used
-expanding: From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}
+considering: From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}
+
+  condition: def:return_path
+     result: true
+considering: $return_path}{MAILER-DAEMON}} ${tod_bsdinbox}
+
+  expanding: $return_path
+     result: CALLER@test.ex
+   scanning: MAILER-DAEMON}} ${tod_bsdinbox}
+
+  expanding: MAILER-DAEMON
+     result: MAILER-DAEMON
+   skipping: result is not used
+  expanding: From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}
 
-   result: From CALLER@test.ex Tue Mar 02 09:44:33 1999
+     result: From CALLER@test.ex Tue Mar 02 09:44:33 1999
 
 writing data block fd=dddd size=sss timeout=0
 writing data block fd=dddd size=sss timeout=0
@@ -418,7 +488,7 @@ LOG: MAIN
   => TESTSUITE/test-mail/junk <rd+usery@test.ex> R=r5 T=ft1
 --------> TESTSUITE/test-mail/junk <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -428,8 +498,9 @@ changed uid/gid: local delivery to TESTSUITE/test-mail/junk <TESTSUITE/test-mail
   home=/non-exist/CALLER current=/
 set_process_info: pppp delivering 10HmaX-0005vi-00 to TESTSUITE/test-mail/junk using ft1
 appendfile transport entered
-expanding: $address_file
-   result: TESTSUITE/test-mail/junk
+considering: $address_file
+  expanding: $address_file
+     result: TESTSUITE/test-mail/junk
 appendfile: mode=600 notify_comsat=0 quota=0 warning=0
   file=TESTSUITE/test-mail/junk format=unix
   message_prefix=From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n
@@ -441,16 +512,22 @@ hitch name: TESTSUITE/test-mail/junk.lock.test.ex.dddddddd.pppppppp
 lock file created
 mailbox TESTSUITE/test-mail/junk is locked
 writing to file TESTSUITE/test-mail/junk
-condition: def:return_path
-   result: true
-expanding: $return_path
-   result: CALLER@test.ex
-expanding: MAILER-DAEMON
-   result: MAILER-DAEMON
-skipping: result is not used
-expanding: From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}
+considering: From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}
+
+  condition: def:return_path
+     result: true
+considering: $return_path}{MAILER-DAEMON}} ${tod_bsdinbox}
+
+  expanding: $return_path
+     result: CALLER@test.ex
+   scanning: MAILER-DAEMON}} ${tod_bsdinbox}
+
+  expanding: MAILER-DAEMON
+     result: MAILER-DAEMON
+   skipping: result is not used
+  expanding: From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}
 
-   result: From CALLER@test.ex Tue Mar 02 09:44:33 1999
+     result: From CALLER@test.ex Tue Mar 02 09:44:33 1999
 
 writing data block fd=dddd size=sss timeout=0
 writing data block fd=dddd size=sss timeout=0
@@ -466,7 +543,7 @@ LOG: MAIN
   => TESTSUITE/test-mail/junk <rd+CALLER@test.ex> R=r4 T=ft1
 --------> CALLER@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -491,12 +568,13 @@ LOG: MAIN
   => CALLER <CALLER@test.ex> R=r1 T=t1
 --------> usery@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
-expanding: /non-exist/$local_part
-   result: /non-exist/usery
+considering: /non-exist/$local_part
+  expanding: /non-exist/$local_part
+     result: /non-exist/usery
 search_tidyup called
 changed uid/gid: local delivery to usery <usery@test.ex> transport=t1
   uid=CALLER_UID gid=CALLER_GID pid=pppp
@@ -518,12 +596,13 @@ LOG: MAIN
   => usery <usery@test.ex> R=r2 T=t1
 --------> userz@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
-expanding: /$local_part
-   result: /userz
+considering: /$local_part
+  expanding: /$local_part
+     result: /userz
 search_tidyup called
 changed uid/gid: local delivery to userz <userz@test.ex> transport=t2
   uid=CALLER_UID gid=CALLER_GID pid=pppp
@@ -549,15 +628,15 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-userz@test.ex: no retry items
-usery@test.ex: no retry items
-CALLER@test.ex: no retry items
-TESTSUITE/test-mail/junk: no retry items
-rd+CALLER@test.ex: no retry items
-TESTSUITE/test-mail/junk: no retry items
-rd+usery@test.ex: no retry items
-rd+CALLER@test.ex: no retry items
-rd+usery@test.ex: no retry items
+ userz@test.ex: no retry items
+ usery@test.ex: no retry items
+ CALLER@test.ex: no retry items
+ TESTSUITE/test-mail/junk: no retry items
+ rd+CALLER@test.ex: no retry items
+ TESTSUITE/test-mail/junk: no retry items
+ rd+usery@test.ex: no retry items
+ rd+CALLER@test.ex: no retry items
+ rd+usery@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/0403 b/test/stderr/0403
index 96e990bfd..716cabdf2 100644
--- a/test/stderr/0403
+++ b/test/stderr/0403
@@ -11,6 +11,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   userx@test.ex
@@ -25,6 +27,7 @@ I Message-Id: <E10HmaX-0005vi-00@mail.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by mail.test.ex with local (Exim x.yz)
@@ -33,11 +36,12 @@ P Received: from CALLER by mail.test.ex with local (Exim x.yz)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -55,6 +59,7 @@ seeking password data for user "CALLER": cache not available
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -68,7 +73,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -131,7 +136,7 @@ routed by r1 router
   envelope to: userx@test.ex
   transport: <none>
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -150,7 +155,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> TESTSUITE/test-mail/junk <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
diff --git a/test/stderr/0404 b/test/stderr/0404
index 1f791c416..d3d8f4c64 100644
--- a/test/stderr/0404
+++ b/test/stderr/0404
@@ -14,6 +14,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   userx
@@ -125,6 +127,7 @@ I Message-Id: <E10HmaX-0005vi-00@mail.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by mail.test.ex with local (Exim x.yz)
@@ -133,11 +136,12 @@ P Received: from CALLER by mail.test.ex with local (Exim x.yz)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -158,6 +162,7 @@ seeking password data for user "CALLER": using cached result
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -171,7 +176,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -214,7 +219,7 @@ routed by r2 router
   envelope to: userx@test.ex
   transport: <none>
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -233,7 +238,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> >sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex, ... <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -261,6 +266,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = 
 set_process_info: pppp accepting a local non-SMTP message from <>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: 
 search_tidyup called
 >>Headers received:
@@ -286,13 +293,14 @@ I Message-Id: <E10HmaY-0005vi-00@mail.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by mail.test.ex with local (Exim x.yz)
 	id 10HmaY-0005vi-00; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
@@ -1511,6 +1519,7 @@ DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |sender@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |sender@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaY-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= <> R=10HmaX-0005vi-00 U=CALLER P=local S=sss
@@ -1530,6 +1539,7 @@ seeking password data for user "CALLER": using cached result
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaY-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaY-0005vi-00-D
 reading spool file 10HmaY-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=
 sender_local=1 ident=CALLER
@@ -3364,7 +3374,7 @@ Delivery address list:
   sender@test.ex 
   sender@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -17970,7 +17980,7 @@ sender@test.ex is a duplicate address: discarded
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> sender@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -17992,6 +18002,7 @@ lock file created
 mailbox TESTSUITE/test-mail/sender is locked
 writing to file TESTSUITE/test-mail/sender
 writing data block fd=dddd size=sss timeout=0
+flushing headers buffer
 writing data block fd=dddd size=sss timeout=0
 writing data block fd=dddd size=sss timeout=0
 writing data block fd=dddd size=sss timeout=0
@@ -18009,7 +18020,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaY-0005vi-00
 Processing retry items
 Succeeded addresses:
-sender@test.ex: no retry items
+ sender@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
@@ -18044,9 +18055,9 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
->sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex, ...: no retry items
-userx@test.ex: no retry items
-userx@test.ex: no retry items
+ >sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex,sender@test.ex, ...: no retry items
+ userx@test.ex: no retry items
+ userx@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/0408 b/test/stderr/0408
index 67fe44cb5..f3d6d6b1a 100644
--- a/test/stderr/0408
+++ b/test/stderr/0408
@@ -11,6 +11,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   userx@test.ex
@@ -25,6 +27,7 @@ I Message-Id: <E10HmaX-0005vi-00@mail.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by mail.test.ex with local (Exim x.yz)
@@ -33,11 +36,12 @@ P Received: from CALLER by mail.test.ex with local (Exim x.yz)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -55,6 +59,7 @@ seeking password data for user "CALLER": cache not available
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -68,7 +73,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -132,7 +137,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> userx@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -170,7 +175,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-userx@test.ex: no retry items
+ userx@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/0415 b/test/stderr/0415
index 062b67be5..f2c8612e8 100644
--- a/test/stderr/0415
+++ b/test/stderr/0415
@@ -1,30 +1,30 @@
 LOG: PANIC DIE
-  Exim configuration error in line 20 of TESTSUITE/test-config:
+  Exim configuration error in line 15 of TESTSUITE/test-config:
   absolute value of integer "4000000M" is too large (overflow)
 LOG: PANIC DIE
-  Exim configuration error in line 20 of TESTSUITE/test-config:
+  Exim configuration error in line 15 of TESTSUITE/test-config:
   extra characters follow integer value for check_spool_space
 LOG: PANIC DIE
-  Exim configuration error in line 21 of TESTSUITE/test-config:
+  Exim configuration error in line 16 of TESTSUITE/test-config:
   integer "4000000000.123" is too large (overflow)
 LOG: PANIC DIE
-  Exim configuration error in line 21 of TESTSUITE/test-config:
+  Exim configuration error in line 16 of TESTSUITE/test-config:
   integer "4000000.123" is too large (overflow)
 LOG: PANIC DIE
-  Exim configuration error in line 23 of TESTSUITE/test-config:
+  Exim configuration error in line 18 of TESTSUITE/test-config:
   absolute value of integer "999999999999999999" is too large (overflow)
 LOG: PANIC DIE
-  Exim configuration error in line 23 of TESTSUITE/test-config:
+  Exim configuration error in line 18 of TESTSUITE/test-config:
   absolute value of integer "999999999K" is too large (overflow)
 LOG: PANIC DIE
-  Exim configuration error in line 23 of TESTSUITE/test-config:
+  Exim configuration error in line 18 of TESTSUITE/test-config:
   absolute value of integer "999999M" is too large (overflow)
 LOG: PANIC DIE
-  Exim configuration error in line 23 of TESTSUITE/test-config:
+  Exim configuration error in line 18 of TESTSUITE/test-config:
   extra characters follow integer value for finduser_retries
 LOG: PANIC DIE
-  Exim configuration error in line 23 of TESTSUITE/test-config:
+  Exim configuration error in line 18 of TESTSUITE/test-config:
   integer expected for finduser_retries
 LOG: PANIC DIE
-  Exim configuration error in line 23 of TESTSUITE/test-config:
+  Exim configuration error in line 18 of TESTSUITE/test-config:
   extra characters follow integer value for finduser_retries
diff --git a/test/stderr/0420 b/test/stderr/0420
index 1bf978723..045fadc9b 100644
--- a/test/stderr/0420
+++ b/test/stderr/0420
@@ -1,82 +1,2 @@
-Exim version x.yz ....
-changed uid/gid: forcing real = effective
-  uid=uuuu gid=CALLER_GID pid=pppp
-configuration file is TESTSUITE/test-config
-admin user
-changed uid/gid: privilege not needed
-  uid=EXIM_UID gid=EXIM_GID pid=pppp
-originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
-sender address = CALLER@test.ex
-sender_fullhost = [V4NET.0.0.0]
-sender_rcvhost = [V4NET.0.0.0]
-host in hosts_connection_nolog? no (option unset)
-LOG: smtp_connection MAIN
-  SMTP connection from [V4NET.0.0.0]
-host in host_lookup? no (option unset)
-set_process_info: pppp handling incoming connection from [V4NET.0.0.0]
-host in host_reject_connection? no (option unset)
-host in sender_unqualified_hosts? no (option unset)
-host in recipient_unqualified_hosts? no (option unset)
-host in helo_verify_hosts? no (option unset)
-host in helo_try_verify_hosts? no (option unset)
-host in helo_accept_junk_hosts? no (option unset)
-SMTP>> 220 mail.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-smtp_setup_msg entered
-SMTP<< mail from:<x@y>
-SMTP>> 250 OK
-SMTP<< rcpt to:<x@y>
-processing "accept"
-accept: condition test succeeded in inline ACL
-end of inline ACL: ACCEPT
-SMTP>> 250 Accepted
-DSN: orcpt: NULL  flags: 0
-SMTP<< data
-SMTP>> 354 Enter message, ending with "." on a line by itself
-search_tidyup called
-host in ignore_fromline_hosts? no (option unset)
->>Headers received:
 
-search_tidyup called
->>Headers after rewriting and local additions:
-
-Data file written for message 10HmaX-0005vi-00
->>Generated Received: header line
-* Received: ; Tue, 2 Mar 1999 09:44:33 +0000
-calling local_scan(); timeout=300
-local_scan() returned 0 NULL
-LOG: MAIN
-  <= x@y H=[V4NET.0.0.0] P=smtp S=sss
-SMTP>> 250 OK id=10HmaX-0005vi-00
-smtp_setup_msg entered
-SMTP<< mail from:<a@b>
-SMTP>> 250 OK
-SMTP<< rcpt to:<x@y>
-processing "accept"
-accept: condition test succeeded in inline ACL
-end of inline ACL: ACCEPT
-SMTP>> 250 Accepted
-DSN: orcpt: NULL  flags: 0
-SMTP<< data
-SMTP>> 354 Enter message, ending with "." on a line by itself
-search_tidyup called
-host in ignore_fromline_hosts? no (option unset)
->>Headers received:
-
-search_tidyup called
->>Headers after rewriting and local additions:
-
-Data file written for message 10HmaY-0005vi-00
->>Generated Received: header line
-P Received: some text; Tue, 2 Mar 1999 09:44:33 +0000
-calling local_scan(); timeout=300
-local_scan() returned 0 NULL
-LOG: MAIN
-  <= a@b H=[V4NET.0.0.0] P=smtp S=sss
-SMTP>> 250 OK id=10HmaY-0005vi-00
-smtp_setup_msg entered
-SMTP<< quit
-SMTP>> 221 mail.test.ex closing connection
-LOG: smtp_connection MAIN
-  SMTP connection from [V4NET.0.0.0] closed by QUIT
-search_tidyup called
->>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
+******** SERVER ********
diff --git a/test/stderr/0432 b/test/stderr/0432
index 6a7aebe15..f819fb0b2 100644
--- a/test/stderr/0432
+++ b/test/stderr/0432
@@ -49,6 +49,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 using ACL "mail"
 processing "accept"
 check verify = sender/callout=1s,maxwait=1s
@@ -78,7 +80,7 @@ get[host|ipnode]byname[2] looked up these IP addresses:
   name=127.0.0.1 address=127.0.0.1
 Attempting full verification using callout
 locking TESTSUITE/spool/db/callout.lockfile
-locked TESTSUITE/spool/db/callout.lockfile
+locked  TESTSUITE/spool/db/callout.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/callout)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/callout: flags=O_RDWR
@@ -86,28 +88,36 @@ dbfn_read: key=y
 callout cache: no domain record found for y
 dbfn_read: key=x@y
 callout cache: no address record found for x@y
+closed hints database and lockfile
 interface=NULL port=1224
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 220 server ready
 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250 OK
 127.0.0.1 in hosts_require_auth? no (option unset)
   SMTP>> MAIL FROM:<>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> RCPT TO:<x@y>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> QUIT
+cmd buf flush ddd bytes
+  SMTP<< 220 OK
+  SMTP(close)>>
 locking TESTSUITE/spool/db/callout.lockfile
-locked TESTSUITE/spool/db/callout.lockfile
+locked  TESTSUITE/spool/db/callout.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/callout)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/callout: flags=O_RDWR|O_CREAT
 dbfn_write: key=y
-wrote callout cache domain record:
+wrote callout cache domain record for y:
   result=1 postmaster=0 random=0
 dbfn_write: key=x@y
-wrote positive callout cache address record
+wrote positive callout cache address record for x@y
+closed hints database and lockfile
 ----------- end verify ------------
 sender x@y verified ok
 accept: condition test succeeded in ACL "mail"
@@ -145,6 +155,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 using ACL "mail"
 processing "accept"
 check verify = sender/callout=1s,maxwait=1s
@@ -174,7 +186,7 @@ get[host|ipnode]byname[2] looked up these IP addresses:
   name=127.0.0.1 address=127.0.0.1
 Attempting full verification using callout
 locking TESTSUITE/spool/db/callout.lockfile
-locked TESTSUITE/spool/db/callout.lockfile
+locked  TESTSUITE/spool/db/callout.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/callout)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/callout: flags=O_RDWR
@@ -183,6 +195,7 @@ callout cache: found domain record for y
 dbfn_read: key=x@y
 callout cache: found address record for x@y
 callout cache: address record is positive
+closed hints database and lockfile
 ----------- end verify ------------
 sender x@y verified ok
 accept: condition test succeeded in ACL "mail"
@@ -247,16 +260,22 @@ MUNGED: ::1 will be omitted in what follows
 >>>   SMTP<< 220 server ready
 >>> 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
 >>>   SMTP>> EHLO myhost.test.ex
+>>> cmd buf flush 21 bytes
 >>>   SMTP<< 250 OK
 >>> 127.0.0.1 in hosts_require_auth? no (option unset)
 >>>   SMTP>> MAIL FROM:<>
+>>> cmd buf flush 14 bytes
 >>>   SMTP<< 250 OK
 >>>   SMTP>> RCPT TO:<a@b>
+>>> cmd buf flush 15 bytes
 >>>   SMTP<< 250 OK
 >>>   SMTP>> QUIT
->>> wrote callout cache domain record:
+>>> cmd buf flush 6 bytes
+>>>   SMTP<< 220 OK
+>>>   SMTP(close)>>
+>>> wrote callout cache domain record for b:
 >>>   result=1 postmaster=0 random=0
->>> wrote positive callout cache address record
+>>> wrote positive callout cache address record for a@b
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "mail"
 >>> end of ACL "mail": ACCEPT
@@ -287,7 +306,9 @@ MUNGED: ::1 will be omitted in what follows
 >>>   SMTP<< 220 server ready
 >>> 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
 >>>   SMTP>> EHLO myhost.test.ex
+>>> cmd buf flush 21 bytes
 >>> SMTP timeout
+>>>   SMTP(close)>>
 >>> ----------- end verify ------------
 >>> accept: condition test deferred in ACL "mail"
 LOG: H=[1.2.3.4] sender verify defer for <p1@q>: Could not complete sender verify callout
diff --git a/test/stderr/0442 b/test/stderr/0442
index 6db126e5a..85904224e 100644
--- a/test/stderr/0442
+++ b/test/stderr/0442
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 Exim configuration error in line 43 of TESTSUITE/test-config:
+1999-03-02 09:44:33 Exim configuration error in line 38 of TESTSUITE/test-config:
   failed to open included configuration file /non/existent
diff --git a/test/stderr/0462 b/test/stderr/0462
index 0d6d719cf..3db191cd9 100644
--- a/test/stderr/0462
+++ b/test/stderr/0462
@@ -28,9 +28,11 @@ Cutthrough cancelled by presence of postmaster verify
   SMTP>> RCPT TO:<postmaster@localhost>
   SMTP<< 550 NO
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for localhost:
   result=1 postmaster=2 random=0
-wrote positive callout cache address record
+wrote positive callout cache address record for Ok@localhost
 LOG: MAIN REJECT
   H=[V4NET.0.0.1] U=root sender verify fail for <Ok@localhost>: response to "RCPT TO:<postmaster@localhost>" from 127.0.0.1 [127.0.0.1] was: 550 NO
 created log directory TESTSUITE/spool/log
@@ -70,9 +72,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<NOTok@elsewhere>
   SMTP<< 550 NO
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for elsewhere:
   result=1 postmaster=0 random=0
-wrote negative callout cache address record
+wrote negative callout cache address record for NOTok@elsewhere
 LOG: MAIN REJECT
   H=[V4NET.0.0.2] U=root sender verify fail for <NOTok@elsewhere>: response to "RCPT TO:<NOTok@elsewhere>" from 127.0.0.1 [127.0.0.1] was: 550 NO
 LOG: MAIN REJECT
@@ -103,9 +107,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> RCPT TO:<NOTok2@elsewhere>
   SMTP<< 550 NO
   SMTP>> QUIT
-wrote callout cache domain record:
+  SMTP<< 250 OK
+  SMTP(close)>>
+wrote callout cache domain record for elsewhere:
   result=1 postmaster=0 random=0
-wrote negative callout cache address record
+wrote negative callout cache address record for NOTok2@elsewhere
 LOG: MAIN REJECT
   H=[V4NET.0.0.2] U=root F=<NOTok2@elsewhere> rejected RCPT <nocheckpm@test.ex>: Sender verify failed
 LOG: smtp_connection MAIN
diff --git a/test/stderr/0464 b/test/stderr/0464
index cf094ce21..f5615411a 100644
--- a/test/stderr/0464
+++ b/test/stderr/0464
@@ -16,6 +16,8 @@ LOG: smtp_connection MAIN
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<abc@domain1>
 using ACL "rcpt"
diff --git a/test/stderr/0465 b/test/stderr/0465
index f86dc46e8..92250956d 100644
--- a/test/stderr/0465
+++ b/test/stderr/0465
@@ -17,6 +17,8 @@ LOG: smtp_connection MAIN
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<abc@domain.>
 LOG: smtp_syntax_error MAIN
@@ -48,6 +50,8 @@ LOG: smtp_connection MAIN
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<abc@domain.>
 processing "accept"
@@ -69,6 +73,7 @@ T To: abc@domain.
 I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local-smtp (Exim x.yz)
@@ -81,11 +86,12 @@ accept: condition test succeeded in ACL "check_data"
 end of ACL "check_data": ACCEPT
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |abc@domain| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaY-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= <> U=CALLER P=local-smtp S=sss
@@ -117,6 +123,8 @@ LOG: smtp_connection MAIN
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<abc@xyz>
 processing "accept"
@@ -138,6 +146,7 @@ T To: abc@xyz.
 I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local-smtp (Exim x.yz)
diff --git a/test/stderr/0467 b/test/stderr/0467
index ec84ba9c0..8d2018ee7 100644
--- a/test/stderr/0467
+++ b/test/stderr/0467
@@ -30,6 +30,7 @@ Connecting to localhost.test.ex [127.0.0.1]:1224 ... connected
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => x@srv27.test.ex R=r1 T=t1 H=localhost.test.ex [127.0.0.1]:1224 C="250 OK"
 LOG: MAIN
diff --git a/test/stderr/0471 b/test/stderr/0471
index 1c860c21f..bb67be2d4 100644
--- a/test/stderr/0471
+++ b/test/stderr/0471
@@ -8,6 +8,8 @@ changed uid/gid: privilege not needed
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@myhost.test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@myhost.test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   r1@test.ex
@@ -25366,6 +25368,7 @@ I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -25374,11 +25377,12 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for r1@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |r1@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
diff --git a/test/stderr/0473 b/test/stderr/0473
index 257af6c38..ed7bc5359 100644
--- a/test/stderr/0473
+++ b/test/stderr/0473
@@ -20,7 +20,8 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 250 OK
   SMTP>> RCPT TO:<r11@two.test.ex>
 SMTP timeout
-wrote callout cache domain record:
+  SMTP(close)>>
+wrote callout cache domain record for two.test.ex:
   result=1 postmaster=0 random=0
 LOG: MAIN REJECT
   U=CALLER F=<x11@two.test.ex> temporarily rejected RCPT r11@two.test.ex: Could not complete recipient verify callout
@@ -43,6 +44,7 @@ callout cache: no address record found for r11@two.test.ex
 interface=NULL port=1224
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
 SMTP timeout
+  SMTP(close)>>
 LOG: MAIN REJECT
   U=CALLER F=<x11@two.test.ex> temporarily rejected RCPT r11@two.test.ex: Could not complete recipient verify callout
 LOG: smtp_connection MAIN
diff --git a/test/stderr/0476 b/test/stderr/0476
index eaebb34d4..6868a902c 100644
--- a/test/stderr/0476
+++ b/test/stderr/0476
@@ -12,6 +12,8 @@ set_process_info: pppp delivering 10HmaX-0005vi-00 (queue run pid ppppp)
 set_process_info: pppp delivering 10HmaX-0005vi-00 using t1
 t1 transport entered
   userx@test.ex
+hostlist:
+  127.0.0.1:-1
 checking status of 127.0.0.1
 127.0.0.1 [127.0.0.1]:1111 status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@test.ex)
@@ -19,6 +21,7 @@ set_process_info: pppp delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (use
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP<< 220 Server ready
   SMTP>> EHLO the.local.host.name
+cmd buf flush ddd bytes
   SMTP<< 250-server id
          250-PIPELINING
          250 OK
@@ -27,6 +30,7 @@ not using DSN
   SMTP>> MAIL FROM:<CALLER@the.local.host.name>
   SMTP>> RCPT TO:<userx@test.ex>
   SMTP>> DATA
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP<< 550 NO
 Remote host closed connection in response to pipelined DATA
@@ -35,7 +39,9 @@ ok=1 send_quit=1 send_rset=1 continue_more=0 yield=0 first_address is NULL
 transport_check_waiting entered
   sequence=1 local_max=500 global_max=-1
   SMTP>> RSET
+cmd buf flush ddd bytes
 H=127.0.0.1 [127.0.0.1] Remote host closed connection in response to RSET
+  SMTP(close)>>
 set_process_info: pppp delivering 10HmaX-0005vi-00: just tried 127.0.0.1 [127.0.0.1] for userx@test.ex: result OK
 Leaving t1 transport
 set_process_info: pppp delivering 10HmaX-0005vi-00 (just run t1 for userx@test.ex in subprocess)
@@ -63,6 +69,8 @@ set_process_info: pppp delivering 10HmaZ-0005vi-00
 set_process_info: pppp delivering 10HmaZ-0005vi-00 using t1
 t1 transport entered
   CALLER@the.local.host.name
+hostlist:
+  127.0.0.1:-1
 checking status of 127.0.0.1
 127.0.0.1 [127.0.0.1]:1111 status = usable
 delivering 10HmaZ-0005vi-00 to 127.0.0.1 [127.0.0.1] (CALLER@the.local.host.name)
@@ -96,6 +104,8 @@ set_process_info: pppp delivering 10HmaY-0005vi-00 (queue run pid ppppp)
 set_process_info: pppp delivering 10HmaY-0005vi-00 using t1
 t1 transport entered
   usery@test.ex
+hostlist:
+  127.0.0.1:-1
 checking status of 127.0.0.1
 no message retry record
 127.0.0.1 [127.0.0.1]:1111 status = unusable
diff --git a/test/stderr/0479 b/test/stderr/0479
index a5e9f82cc..9386dce11 100644
--- a/test/stderr/0479
+++ b/test/stderr/0479
@@ -30,6 +30,8 @@ sender_rcvhost = [1.2.3.4]
 set_process_info: pppp handling incoming connection from ([1.2.3.4]) [1.2.3.4]
 SMTP>> 250 the.local.host.name Hello [1.2.3.4] [1.2.3.4]
 SMTP<< mail from:<a@b>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<c@d>
 using ACL "rcpt"
diff --git a/test/stderr/0487 b/test/stderr/0487
index c8d720beb..7319b67dd 100644
--- a/test/stderr/0487
+++ b/test/stderr/0487
@@ -22,12 +22,15 @@ smtp_setup_msg entered
 SMTP<< ehlo x.y
  in dsn_advertise_hosts? no (option unset)
  in pipelining_advertise_hosts? yes (matched "*")
+ in chunking_advertise_hosts? no (end of list)
 SMTP>> 250-myhost.test.ex Hello CALLER at x.y
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
 250 HELP
 SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<userx@test.ex>
 processing "accept"
@@ -49,6 +52,7 @@ F From: unqualified
 I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER (helo=x.y)
@@ -58,11 +62,12 @@ P Received: from CALLER (helo=x.y)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= x@y U=CALLER P=local-esmtp S=sss
@@ -83,6 +88,7 @@ seeking password data for user "CALLER": using cached result
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=x@y
 sender_local=0 ident=CALLER
@@ -96,7 +102,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -133,7 +139,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> userx@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -173,7 +179,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-userx@test.ex: no retry items
+ userx@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/0489 b/test/stderr/0489
index 291dda645..d0caddc8e 100644
--- a/test/stderr/0489
+++ b/test/stderr/0489
@@ -4,6 +4,8 @@ trusted user
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name="Phil Q. Hazel"
 sender address = CALLER@myhost.test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   X
@@ -14,6 +16,7 @@ I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: "Phil Q. Hazel" <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -22,7 +25,8 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for X@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
@@ -34,6 +38,8 @@ trusted user
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=John "Jack" Smith
 sender address = CALLER@myhost.test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   X
@@ -44,6 +50,7 @@ I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
 F From: John "Jack" Smith <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -52,7 +59,8 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for X@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmaY-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
@@ -63,6 +71,8 @@ trusted user
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=John "Jack" "Q." Smith
 sender address = CALLER@myhost.test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   X
@@ -73,6 +83,7 @@ I Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
 F From: John "Jack" "Q." Smith <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaZ-0005vi-00-D
 Data file written for message 10HmaZ-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -81,7 +92,8 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for X@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmaZ-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
@@ -92,6 +104,8 @@ trusted user
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name="John (Jack) Q. Smith"
 sender address = CALLER@myhost.test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   X
@@ -102,6 +116,7 @@ I Message-Id: <E10HmbA-0005vi-00@myhost.test.ex>
 F From: "John (Jack) Q. Smith" <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmbA-0005vi-00-D
 Data file written for message 10HmbA-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -110,7 +125,8 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for X@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmbA-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
@@ -121,6 +137,8 @@ trusted user
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=John ("Jack") "Q." Smith
 sender address = CALLER@myhost.test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   X
@@ -131,6 +149,7 @@ I Message-Id: <E10HmbB-0005vi-00@myhost.test.ex>
 F From: John ("Jack") "Q." Smith <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmbB-0005vi-00-D
 Data file written for message 10HmbB-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -139,7 +158,8 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for X@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmbB-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
@@ -150,6 +170,8 @@ trusted user
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name="John (\"Jack\") Q. Smith"
 sender address = CALLER@myhost.test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   X
@@ -160,6 +182,7 @@ I Message-Id: <E10HmbC-0005vi-00@myhost.test.ex>
 F From: "John (\"Jack\") Q. Smith" <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmbC-0005vi-00-D
 Data file written for message 10HmbC-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -168,7 +191,8 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for X@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmbC-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
@@ -179,6 +203,8 @@ trusted user
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name="Phil \"Q Hazel"
 sender address = CALLER@myhost.test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   X
@@ -189,6 +215,7 @@ I Message-Id: <E10HmbD-0005vi-00@myhost.test.ex>
 F From: "Phil \"Q Hazel" <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmbD-0005vi-00-D
 Data file written for message 10HmbD-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -197,7 +224,8 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for X@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmbD-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
@@ -208,6 +236,8 @@ trusted user
 admin user
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name="Phil \"Q" "X." Hazel
 sender address = CALLER@myhost.test.ex
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   X
@@ -218,6 +248,7 @@ I Message-Id: <E10HmbE-0005vi-00@myhost.test.ex>
 F From: "Phil \"Q" "X." Hazel <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmbE-0005vi-00-D
 Data file written for message 10HmbE-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -226,7 +257,8 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for X@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+Renaming spool header file: TESTSUITE/spool//input//10HmbE-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
diff --git a/test/stderr/0495 b/test/stderr/0495
index b00cfd572..bfe9f6218 100644
--- a/test/stderr/0495
+++ b/test/stderr/0495
@@ -1,7 +1,7 @@
 Delivery failed: Connection refused
 Delivery failed: H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after RCPT TO:<b@x.y>: 550 NOTOK
-Delivery failed: H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@myhost.test.ex>: 550 BAD MAIL
-Delivery failed: H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after MAIL FROM:<CALLER@myhost.test.ex>: 450 TEMPORARY MAIL FAIL
+Delivery failed: H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@myhost.test.ex>: 550 BAD MAIL
+Delivery failed: H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after pipelined MAIL FROM:<CALLER@myhost.test.ex>: 450 TEMPORARY MAIL FAIL
 routing file@x.y yielded a local delivery
 routing fail@x.y yielded a failed delivery: forcible fail message
 routing defer@x.y yielded a deferred delivery: forcible defer message
diff --git a/test/stderr/0499 b/test/stderr/0499
index 4592f6469..2ecd699aa 100644
--- a/test/stderr/0499
+++ b/test/stderr/0499
@@ -25,7 +25,7 @@ host_find_bydns yield = HOST_FOUND_LOCAL (3); returned hosts:
   eximtesthost.test.ex ip4.ip4.ip4.ip4 MX=5 
 mxt1.test.ex in "@mx_any"? yes (matched "@mx_any")
 mxt1.test.ex in "+anymx"? yes (matched "+anymx")
-checking "condition"
+checking "condition" "${if match_domain{$domain}{+anymx}{yes}}"...
 DNS lookup of mxt1.test.ex (MX) using fakens
 DNS lookup of mxt1.test.ex (MX) succeeded
 DNS lookup of eximtesthost.test.ex (A) using fakens
diff --git a/test/stderr/0502 b/test/stderr/0502
index 71afc025b..a3b308501 100644
--- a/test/stderr/0502
+++ b/test/stderr/0502
@@ -1 +1,3 @@
 1999-03-02 09:44:33 ACL for QUIT returned ERROR: QUIT or not-QUIT teplevel ACL may not fail ('deny' verb used incorrectly)
+
+******** SERVER ********
diff --git a/test/stderr/0513 b/test/stderr/0513
index 9825070c4..864b2eaa1 100644
--- a/test/stderr/0513
+++ b/test/stderr/0513
@@ -9,6 +9,7 @@
 >>> a.b.c.d in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_rcpt"
 >>> processing "defer"
 >>> check !verify = recipient
diff --git a/test/stderr/0514 b/test/stderr/0514
index 22f78df7e..0c24042f8 100644
--- a/test/stderr/0514
+++ b/test/stderr/0514
@@ -6,6 +6,7 @@ admin user
 changed uid/gid: privilege not needed
   uid=EXIM_UID gid=EXIM_GID pid=pppp
 set_process_info: pppp listing the queue
+looking in TESTSUITE/spool//input
 reading spool file 10HmaX-0005vi-00-H
 user=spaced user uid=CALLER_UID gid=CALLER_GID sender="spaced user"@myhost.test.ex
 sender_local=1 ident=spaced user
diff --git a/test/stderr/0524 b/test/stderr/0524
index 363c8dfd1..8344d34a6 100644
--- a/test/stderr/0524
+++ b/test/stderr/0524
@@ -9,6 +9,7 @@
 >>> csa1.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_mail"
 >>> processing "accept"
 >>>   message: CSA status is $csa_status
@@ -19,6 +20,7 @@
 >>> csa2.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_mail"
 >>> processing "accept"
 >>>   message: CSA status is $csa_status
@@ -37,6 +39,7 @@ LOG: H=(csa2.test.ex) [V4NET.9.8.7] rejected MAIL <>: client SMTP authorization
 >>> csa1.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_mail"
 >>> processing "accept"
 >>>   message: CSA status is $csa_status
@@ -48,6 +51,7 @@ LOG: H=(csa1.test.ex) [V4NET.9.8.8] rejected MAIL <>: client SMTP authorization
 >>> csa2.test.ex in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_mail"
 >>> processing "accept"
 >>>   message: CSA status is $csa_status
diff --git a/test/stderr/0525 b/test/stderr/0525
index 553f8c1ce..a15308559 100644
--- a/test/stderr/0525
+++ b/test/stderr/0525
@@ -14,6 +14,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> DATA
   SMTP<< 354 SEND
   SMTP>> writing message and terminating "."
+  SMTP(close)>>
 LOG: MAIN
   H=127.0.0.1 [127.0.0.1]: SMTP timeout after sending data block (ddd bytes written): Connection timed out
 LOG: MAIN
diff --git a/test/stderr/0529 b/test/stderr/0529
index 49ca6dcaf..a308cc147 100644
--- a/test/stderr/0529
+++ b/test/stderr/0529
@@ -32,17 +32,17 @@ LOG: MAIN
   == TESTSUITE/test-mail/rmbox <x@test.ex> R=r1 T=t1 defer (-22): mailbox is full (MTA-imposed quota exceeded while writing to TESTSUITE/test-mail/rmbox)
 Processing retry items
 Succeeded addresses:
-x@test.ex: no retry items
+ x@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
-TESTSUITE/test-mail/rmbox
+ TESTSUITE/test-mail/rmbox
 locking TESTSUITE/spool/db/retry.lockfile
 retry for T:TESTSUITE/test-mail/rmbox:x@test.ex = *@test.ex -22 0
 failing_interval=ttt message_age=ttt
 Writing retry data for T:TESTSUITE/test-mail/rmbox:x@test.ex
   first failed=dddd last try=dddd next try=+900 expired=0
   errno=-22 more_errno=dd mailbox is full (MTA-imposed quota exceeded while writing to TESTSUITE/test-mail/rmbox)
-x@test.ex: no retry items
+ x@test.ex: no retry items
 end of retry processing
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -76,11 +76,11 @@ LOG: retry_defer MAIN
   == TESTSUITE/test-mail/rmbox <x@test.ex> R=r1 T=t1 defer (-52): Retry time not yet reached
 Processing retry items
 Succeeded addresses:
-x@test.ex: no retry items
+ x@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
-TESTSUITE/test-mail/rmbox: no retry items
-x@test.ex: no retry items
+ TESTSUITE/test-mail/rmbox: no retry items
+ x@test.ex: no retry items
 end of retry processing
 LOG: queue_run MAIN
   End queue run: pid=pppp
diff --git a/test/stderr/0537 b/test/stderr/0537
index a892e736d..c5a8b3e54 100644
--- a/test/stderr/0537
+++ b/test/stderr/0537
@@ -88,6 +88,7 @@ LOG: sender_ident=ident
 >>> end of ACL "connect": ACCEPT
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "mail"
 >>> processing "accept"
 >>> check acl = log
diff --git a/test/stderr/0544 b/test/stderr/0544
index e8b01dfe0..edbfb61f7 100644
--- a/test/stderr/0544
+++ b/test/stderr/0544
@@ -1,50 +1,102 @@
 Exim version x.yz ....
 configuration file is TESTSUITE/test-config
 admin user
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
-condition: def:sender_rcvhost
-   result: false
-expanding: from $sender_rcvhost
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_rcvhost
+     result: false
+   scanning: from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: from $sender_rcvhost
 	
-   result: from 
+     result: from 
 	
-skipping: result is not used
-condition: def:sender_ident
-   result: true
-expanding: $sender_ident
-   result: CALLER
-expanding: from ${quote_local_part:$sender_ident} 
-   result: from CALLER 
-condition: def:sender_helo_name
-   result: false
-expanding: (helo=$sender_helo_name)
+   skipping: result is not used
+considering: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_ident
+     result: true
+considering: from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+considering: $sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: $sender_ident
+     result: CALLER
+  expanding: from ${quote_local_part:$sender_ident} 
+     result: from CALLER 
+  condition: def:sender_helo_name
+     result: false
+   scanning: (helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (helo=$sender_helo_name)
 	
-   result: (helo=)
+     result: (helo=)
 	
-skipping: result is not used
-expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+   skipping: result is not used
+  expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
 	}}
-   result: from CALLER 
-condition: def:received_protocol
-   result: true
-expanding: with $received_protocol
-   result: with local
-condition: def:sender_address
-   result: true
-expanding: (envelope-from <$sender_address>)
+     result: from CALLER 
+  condition: def:received_protocol
+     result: true
+considering: with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: with $received_protocol
+     result: with local
+  condition: def:sender_address
+     result: true
+considering: (envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (envelope-from <$sender_address>)
 	
-   result: (envelope-from <CALLER@test.ex>)
+     result: (envelope-from <CALLER@test.ex>)
 	
-condition: def:received_for
-   result: false
-expanding: 
+  condition: def:received_for
+     result: false
+   scanning: 
+	for $received_for}}
+  expanding: 
 	for $received_for
-   result: 
+     result: 
 	for 
-skipping: result is not used
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
+   skipping: result is not used
+  expanding: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+     result: Received: from CALLER by the.local.host.name with local (Exim x.yz)
+	(envelope-from <CALLER@test.ex>)
+	id 10HmaX-0005vi-00
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
 created log directory TESTSUITE/spool/log
@@ -52,33 +104,43 @@ Exim version x.yz ....
 configuration file is TESTSUITE/test-config
 trusted user
 admin user
-expanding: $domain
-   result: domain1.ex
+considering: $domain
+  expanding: $domain
+     result: domain1.ex
 LOG: MAIN
   == userx@domain1.ex R=smarthost T=smtp defer (-1): domain matches queue_smtp_domains, or -odqs set
 LOG: MAIN
   == userx@domain2.ex R=smarthost T=smtp defer (-1): domain matches queue_smtp_domains, or -odqs set
-expanding: $h_list-id:$h_list-post:$h_list-subscribe:
-   result: 
-expanding: 
-   result: 
-expanding: $h_precedence:
-   result: 
-expanding: (?i)bulk|list|junk
-   result: (?i)bulk|list|junk
-expanding: $h_auto-submitted:
-   result: 
-expanding: (?i)auto-generated|auto-replied
-   result: (?i)auto-generated|auto-replied
-condition: or {{ !eq{$h_list-id:$h_list-post:$h_list-subscribe:}{} }{ match{$h_precedence:}{(?i)bulk|list|junk} }{ match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }}
-   result: false
-expanding: no
-   result: no
-skipping: result is not used
-expanding: yes
-   result: yes
-expanding: ${if or {{ !eq{$h_list-id:$h_list-post:$h_list-subscribe:}{} }{ match{$h_precedence:}{(?i)bulk|list|junk} }{ match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }} {no}{yes}}
-   result: yes
+considering: ${if or {{ !eq{$h_list-id:$h_list-post:$h_list-subscribe:}{} }{ match{$h_precedence:}{(?i)bulk|list|junk} }{ match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }} {no}{yes}}
+considering: $h_list-id:$h_list-post:$h_list-subscribe:}{} }{ match{$h_precedence:}{(?i)bulk|list|junk} }{ match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }} {no}{yes}}
+  expanding: $h_list-id:$h_list-post:$h_list-subscribe:
+     result: 
+considering: } }{ match{$h_precedence:}{(?i)bulk|list|junk} }{ match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }} {no}{yes}}
+  expanding: 
+     result: 
+considering: $h_precedence:}{(?i)bulk|list|junk} }{ match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }} {no}{yes}}
+  expanding: $h_precedence:
+     result: 
+considering: (?i)bulk|list|junk} }{ match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }} {no}{yes}}
+  expanding: (?i)bulk|list|junk
+     result: (?i)bulk|list|junk
+considering: $h_auto-submitted:}{(?i)auto-generated|auto-replied} }} {no}{yes}}
+  expanding: $h_auto-submitted:
+     result: 
+considering: (?i)auto-generated|auto-replied} }} {no}{yes}}
+  expanding: (?i)auto-generated|auto-replied
+     result: (?i)auto-generated|auto-replied
+  condition: or {{ !eq{$h_list-id:$h_list-post:$h_list-subscribe:}{} }{ match{$h_precedence:}{(?i)bulk|list|junk} }{ match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }}
+     result: false
+   scanning: no}{yes}}
+  expanding: no
+     result: no
+   skipping: result is not used
+considering: yes}}
+  expanding: yes
+     result: yes
+  expanding: ${if or {{ !eq{$h_list-id:$h_list-post:$h_list-subscribe:}{} }{ match{$h_precedence:}{(?i)bulk|list|junk} }{ match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }} {no}{yes}}
+     result: yes
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 Exim version x.yz ....
@@ -86,24 +148,32 @@ configuration file is TESTSUITE/test-config
 admin user
 LOG: smtp_connection MAIN
   SMTP connection from CALLER
-expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
-   result: the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-expanding: $sender_helo_name
-   result: ehlo.domain
-expanding: +dlist
-   result: +dlist
-expanding: $domain
-   result: ehlo.domain
-condition: match_domain {$sender_helo_name}{+dlist}
-   result: true
-expanding: ${if match_domain {$sender_helo_name}{+dlist}}
-   result: true
-expanding: domain=$domain/sender_domain=$sender_address_domain
-   result: domain=/sender_domain=sender.domain
-expanding: domain=$domain/sender_domain=$sender_address_domain
-   result: domain=recipient.domain/sender_domain=sender.domain
-expanding: domain=$domain/sender_domain=$sender_address_domain
-   result: domain=recipient.domain/sender_domain=sender.domain
+considering: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+  expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+     result: the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+considering: ${if match_domain {$sender_helo_name}{+dlist}}
+considering: $sender_helo_name}{+dlist}}
+  expanding: $sender_helo_name
+     result: ehlo.domain
+considering: +dlist}}
+  expanding: +dlist
+     result: +dlist
+considering: $domain
+  expanding: $domain
+     result: ehlo.domain
+  condition: match_domain {$sender_helo_name}{+dlist}
+     result: true
+  expanding: ${if match_domain {$sender_helo_name}{+dlist}}
+     result: true
+considering: domain=$domain/sender_domain=$sender_address_domain
+  expanding: domain=$domain/sender_domain=$sender_address_domain
+     result: domain=/sender_domain=sender.domain
+considering: domain=$domain/sender_domain=$sender_address_domain
+  expanding: domain=$domain/sender_domain=$sender_address_domain
+     result: domain=recipient.domain/sender_domain=sender.domain
+considering: domain=$domain/sender_domain=$sender_address_domain
+  expanding: domain=$domain/sender_domain=$sender_address_domain
+     result: domain=recipient.domain/sender_domain=sender.domain
 LOG: smtp_connection MAIN
   SMTP connection from CALLER closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/0554 b/test/stderr/0554
index 5cabbf9ae..460a2c22b 100644
--- a/test/stderr/0554
+++ b/test/stderr/0554
@@ -26,7 +26,7 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-x@y
+ x@y
 locking TESTSUITE/spool/db/retry.lockfile
 retry for R:x@y:<CALLER@myhost.test.ex> = * 0 0
 failing_interval=ttt message_age=ttt
@@ -78,7 +78,7 @@ LOG: MAIN
   => x@y R=r1 T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
 Processing retry items
 Succeeded addresses:
-x@y
+ x@y
 locking TESTSUITE/spool/db/retry.lockfile
 deleted retry information for R:x@y:<CALLER@myhost.test.ex>
 deleted retry information for R:x@y
diff --git a/test/stderr/0557 b/test/stderr/0557
index 8e5906ca8..19fd8c29f 100644
--- a/test/stderr/0557
+++ b/test/stderr/0557
@@ -1,2 +1,2 @@
 LOG: MAIN
-  error in r1 router: no host(s) specified for domain *
+  error in r1 router: no host(s) specified for domain test.ex
diff --git a/test/stderr/0574 b/test/stderr/0574
new file mode 100644
index 000000000..0d94be4e8
--- /dev/null
+++ b/test/stderr/0574
@@ -0,0 +1,3 @@
+cat: TESTSUITE/spool/log/serverdebuglog_1: No such file or directory
+
+******** SERVER ********
diff --git a/test/stderr/0575 b/test/stderr/0575
new file mode 100644
index 000000000..86620a896
--- /dev/null
+++ b/test/stderr/0575
@@ -0,0 +1,63 @@
+Exim version x.yz ....
+changed uid/gid: forcing real = effective
+  uid=uuuu gid=CALLER_GID pid=pppp
+configuration file is TESTSUITE/test-config
+admin user
+changed uid/gid: privilege not needed
+  uid=EXIM_UID gid=EXIM_GID pid=pppp
+originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
+sender address = CALLER@test.ex
+sender_fullhost = [V4NET.0.0.0]
+sender_rcvhost = [V4NET.0.0.0]
+host in hosts_connection_nolog? no (option unset)
+LOG: smtp_connection MAIN
+  SMTP connection from [V4NET.0.0.0]
+host in host_lookup? no (option unset)
+set_process_info: pppp handling incoming connection from [V4NET.0.0.0]
+host in host_reject_connection? no (option unset)
+host in sender_unqualified_hosts? no (option unset)
+host in recipient_unqualified_hosts? no (option unset)
+host in helo_verify_hosts? no (option unset)
+host in helo_try_verify_hosts? no (option unset)
+host in helo_accept_junk_hosts? no (option unset)
+SMTP>> 220 mail.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+smtp_setup_msg entered
+SMTP<< mail from:<x@y>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
+SMTP>> 250 OK
+SMTP<< rcpt to:<x@y>
+processing "accept"
+accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
+SMTP>> 250 Accepted
+DSN: orcpt: NULL  flags: 0
+SMTP<< data
+SMTP>> 354 Enter message, ending with "." on a line by itself
+search_tidyup called
+host in ignore_fromline_hosts? no (option unset)
+>>Headers received:
+
+search_tidyup called
+>>Headers after rewriting and local additions:
+
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
+Data file written for message 10HmaX-0005vi-00
+>>Generated Received: header line
+P Received: from [V4NET.0.0.0]
+	by mail.test.ex with smtp (Exim x.yz)
+	(envelope-from <x@y>)
+	id 10HmaX-0005vi-00
+	for x@y; Tue, 2 Mar 1999 09:44:33 +0000
+calling local_scan(); timeout=300
+local_scan() returned 0 NULL
+LOG: MAIN
+  <= x@y H=[V4NET.0.0.0] P=smtp S=sss
+SMTP>> 250 OK id=10HmaX-0005vi-00
+smtp_setup_msg entered
+SMTP<< quit
+SMTP>> 221 mail.test.ex closing connection
+LOG: smtp_connection MAIN
+  SMTP connection from [V4NET.0.0.0] closed by QUIT
+search_tidyup called
+>>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/2008 b/test/stderr/2008
index cfd510557..dd4abbe40 100644
--- a/test/stderr/2008
+++ b/test/stderr/2008
@@ -27,6 +27,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK id=10HmaZ-0005vi-00
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
 LOG: MAIN
@@ -60,6 +61,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK id=10HmbA-0005vi-00
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 LOG: MAIN
@@ -90,6 +92,7 @@ Connecting to ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4]:1225 ... connected
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => abcd@test.ex R=client T=send_to_server2 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbB-0005vi-00"
 LOG: MAIN
diff --git a/test/stderr/2013 b/test/stderr/2013
index 58d52d2f5..be80161c2 100644
--- a/test/stderr/2013
+++ b/test/stderr/2013
@@ -6,6 +6,7 @@ LOG: queue_run MAIN
 Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
          250-SIZE 52428800
          250-8BITMIME
@@ -13,8 +14,10 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
          250-STARTTLS
          250 HELP
   SMTP>> STARTTLS
+cmd buf flush ddd bytes
   SMTP<< 220 TLS go ahead
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
          250-SIZE 52428800
          250-8BITMIME
@@ -23,17 +26,20 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
   SMTP>> RCPT TO:<userx@test.ex>
   SMTP>> DATA
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP<< 250 Accepted
   SMTP<< 354 Enter message, ending with "." on a line by itself
   SMTP<< 250 OK id=10HmaZ-0005vi-00
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
          250-SIZE 52428800
          250-8BITMIME
          250-PIPELINING
          250-STARTTLS
          250 HELP
+  SMTP(close)>>
 LOG: MAIN
   => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
 LOG: MAIN
@@ -43,23 +49,28 @@ configuration file is TESTSUITE/test-config
 trusted user
 admin user
   SMTP>> STARTTLS
+cmd buf flush ddd bytes
   SMTP<< 220 TLS go ahead
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
          250-SIZE 52428800
          250-8BITMIME
          250-PIPELINING
          250 HELP
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
-  SMTP>> RCPT TO:<userx@test.ex>
+  SMTP>> RCPT TO:<usery@test.ex>
   SMTP>> DATA
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP<< 250 Accepted
   SMTP<< 354 Enter message, ending with "." on a line by itself
   SMTP<< 250 OK id=10HmbA-0005vi-00
   SMTP>> QUIT
+cmd buf flush ddd bytes
+  SMTP(close)>>
 LOG: MAIN
-  => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/2020 b/test/stderr/2020
index e16a6800b..045fadc9b 100644
--- a/test/stderr/2020
+++ b/test/stderr/2020
@@ -1,8 +1,2 @@
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
 
 ******** SERVER ********
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
diff --git a/test/stderr/2108 b/test/stderr/2108
index df110cc5a..1a9bb89c2 100644
--- a/test/stderr/2108
+++ b/test/stderr/2108
@@ -31,6 +31,7 @@ LOG: MAIN
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK id=10HmaZ-0005vi-00
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
 LOG: MAIN
@@ -68,6 +69,7 @@ LOG: MAIN
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK id=10HmbA-0005vi-00
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 LOG: MAIN
@@ -102,6 +104,7 @@ LOG: MAIN
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => abcd@test.ex R=client T=send_to_server2 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbB-0005vi-00"
 LOG: MAIN
diff --git a/test/stderr/2113 b/test/stderr/2113
index 3efab7e3a..2db86789b 100644
--- a/test/stderr/2113
+++ b/test/stderr/2113
@@ -6,6 +6,7 @@ LOG: queue_run MAIN
 Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
          250-SIZE 52428800
          250-8BITMIME
@@ -13,8 +14,10 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
          250-STARTTLS
          250 HELP
   SMTP>> STARTTLS
+cmd buf flush ddd bytes
   SMTP<< 220 TLS go ahead
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
          250-SIZE 52428800
          250-8BITMIME
@@ -23,17 +26,20 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
   SMTP>> RCPT TO:<userx@test.ex>
   SMTP>> DATA
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP<< 250 Accepted
   SMTP<< 354 Enter message, ending with "." on a line by itself
   SMTP<< 250 OK id=10HmaZ-0005vi-00
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
          250-SIZE 52428800
          250-8BITMIME
          250-PIPELINING
          250-STARTTLS
          250 HELP
+  SMTP(close)>>
 LOG: MAIN
   => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
 LOG: MAIN
@@ -43,8 +49,10 @@ configuration file is TESTSUITE/test-config
 trusted user
 admin user
   SMTP>> STARTTLS
+cmd buf flush ddd bytes
   SMTP<< 220 TLS go ahead
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
          250-SIZE 52428800
          250-8BITMIME
@@ -53,11 +61,14 @@ admin user
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
   SMTP>> RCPT TO:<userx@test.ex>
   SMTP>> DATA
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP<< 250 Accepted
   SMTP<< 354 Enter message, ending with "." on a line by itself
   SMTP<< 250 OK id=10HmbA-0005vi-00
   SMTP>> QUIT
+cmd buf flush ddd bytes
+  SMTP(close)>>
 LOG: MAIN
   => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 LOG: MAIN
diff --git a/test/stderr/2120 b/test/stderr/2120
index e16a6800b..045fadc9b 100644
--- a/test/stderr/2120
+++ b/test/stderr/2120
@@ -1,8 +1,2 @@
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
 
 ******** SERVER ********
-1999-03-02 09:44:33 Warning: No server certificate defined; TLS connections will fail.
- Suggested action: either install a certificate or change tls_advertise_hosts option
diff --git a/test/stderr/2202 b/test/stderr/2202
index dbca98bdd..45b039a59 100644
--- a/test/stderr/2202
+++ b/test/stderr/2202
@@ -23,6 +23,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<xx@cioce.test.again.dns>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<a@b>
 using ACL "rcpt"
diff --git a/test/stderr/2600 b/test/stderr/2600
index cc1864aa2..4e9974733 100644
--- a/test/stderr/2600
+++ b/test/stderr/2600
@@ -132,6 +132,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<a@b>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<c@d>
 using ACL "check_recipient"
@@ -226,6 +228,8 @@ host in helo_accept_junk_hosts? no (option unset)
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< mail from:<a@b>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 SMTP>> 250 OK
 SMTP<< rcpt to:<c@d>
 using ACL "check_recipient"
@@ -295,6 +299,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@myhost.test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@myhost.test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@myhost.test.ex
 Recipients:
   userx
@@ -309,6 +315,7 @@ I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -317,11 +324,12 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for userx@myhost.test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@myhost.test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local S=sss
@@ -339,6 +347,7 @@ seeking password data for user "CALLER": cache not available
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@myhost.test.ex
 sender_local=1 ident=CALLER
@@ -352,7 +361,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@myhost.test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -399,7 +408,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> userx@myhost.test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -446,7 +455,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-userx@myhost.test.ex: no retry items
+ userx@myhost.test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/3000 b/test/stderr/3000
index 6859068af..6aea66ac5 100644
--- a/test/stderr/3000
+++ b/test/stderr/3000
@@ -2,34 +2,45 @@
 Exim version x.yz ....
 configuration file is TESTSUITE/test-config
 admin user
-expanding: foo
-   result: foo
-expanding: arg1
-   result: arg1
+considering: ${perl{foo}{arg1}}
+considering: foo}{arg1}}
+  expanding: foo
+     result: foo
+considering: arg1}}
+  expanding: arg1
+     result: arg1
 Starting Perl interpreter
-expanding: ${perl{foo}{arg1}}
-   result: Subroutine foo called with args: arg1
-expanding: foo_undef
-   result: foo_undef
+  expanding: ${perl{foo}{arg1}}
+     result: Subroutine foo called with args: arg1
+considering: ${perl{foo_undef}}
+considering: foo_undef}}
+  expanding: foo_undef
+     result: foo_undef
 failed to expand: ${perl{foo_undef}}
    error message: Perl subroutine "foo_undef" returned undef to force failure
 failure was forced
-expanding: debug_write
-   result: debug_write
-expanding: debug from Perl\n
-   result: debug from Perl
+considering: ${perl{debug_write}{debug from Perl\n}}
+considering: debug_write}{debug from Perl\n}}
+  expanding: debug_write
+     result: debug_write
+considering: debug from Perl\n}}
+  expanding: debug from Perl\n
+     result: debug from Perl
 
 debug from Perl
-expanding: ${perl{debug_write}{debug from Perl\n}}
-   result: Wrote debug
-expanding: log_write
-   result: log_write
-expanding: log from Perl
-   result: log from Perl
+  expanding: ${perl{debug_write}{debug from Perl\n}}
+     result: Wrote debug
+considering: ${perl{log_write}{log from Perl}}
+considering: log_write}{log from Perl}}
+  expanding: log_write
+     result: log_write
+considering: log from Perl}}
+  expanding: log from Perl
+     result: log from Perl
 LOG: MAIN
   log from Perl
-expanding: ${perl{log_write}{log from Perl}}
-   result: Wrote log
+  expanding: ${perl{log_write}{log from Perl}}
+     result: Wrote log
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: smtp_connection MAIN
   SMTP connection from CALLER
@@ -48,6 +59,7 @@ LOG: smtp_connection MAIN
 >>> x.y.z in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_rcpt"
 >>> processing "accept"
 LOG: this is a warning at TESTSUITE/aux-fixed/3000.pl line 25.
diff --git a/test/stderr/3201 b/test/stderr/3201
index 096248f45..10fa6f937 100644
--- a/test/stderr/3201
+++ b/test/stderr/3201
@@ -36,7 +36,7 @@ host in "testdb;fail"? no (end of list)
 deny: condition test failed in ACL "connect1"
 end of ACL "connect1": implicit DENY
 SMTP>> 550 Administrative prohibition
-LOG: MAIN REJECT
+LOG: connection_reject MAIN REJECT
   H=[10.0.0.1] rejected connection in "connect" ACL
 search_tidyup called
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -78,7 +78,7 @@ host in "net-testdb;fail"? no (end of list)
 deny: condition test failed in ACL "connect2"
 end of ACL "connect2": implicit DENY
 SMTP>> 550 Administrative prohibition
-LOG: MAIN REJECT
+LOG: connection_reject MAIN REJECT
   H=[10.0.0.2] rejected connection in "connect" ACL
 search_tidyup called
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/3208 b/test/stderr/3208
index 1eba14049..d25ef58ad 100644
--- a/test/stderr/3208
+++ b/test/stderr/3208
@@ -9,6 +9,7 @@
 >>> remote.host in helo_lookup_domains? no (end of list)
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> test.ex in percent_hack_domains? no (matched "!test.ex")
 >>> using ACL "check_recipient"
 >>> processing "accept"
diff --git a/test/stderr/3400 b/test/stderr/3400
index 6eda31374..541d08d5a 100644
--- a/test/stderr/3400
+++ b/test/stderr/3400
@@ -87,6 +87,7 @@ LOG: H=[10.0.0.2] Warning: accepted ETRN #abcd
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in "10.0.0.1"? yes (matched "10.0.0.1")
 >>> host in auth_advertise_hosts? yes (matched "+auth_hosts")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "check_vrfy"
 >>> processing "deny"
@@ -290,6 +291,7 @@ LOG: H=(test.host) [10.0.0.1] Warning: accepted ETRN #abcd
 >>> host in "10.0.0.4"? no (end of list)
 >>> host in "10.0.0.3 : 10.0.0.4"? yes (matched "10.0.0.3")
 >>> host in auth_advertise_hosts? yes (matched "+auth_relay_hosts")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "warn"
 >>> check hosts = 10.0.0.5
@@ -385,6 +387,7 @@ LOG: H=(test.host) [10.0.0.3] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@cu
 >>> host in "10.0.0.1"? no (end of list)
 >>> host in "10.0.0.4"? yes (matched "10.0.0.4")
 >>> host in auth_advertise_hosts? no (matched "!+relay_hosts")
+>>> host in chunking_advertise_hosts? no (end of list)
 Exim version x.yz ....
 changed uid/gid: forcing real = effective
   uid=uuuu gid=CALLER_GID pid=pppp
@@ -437,6 +440,7 @@ host in "10.0.0.1"? no (end of list)
 host in "10.0.0.4"? no (end of list)
 host in "10.0.0.3 : 10.0.0.4"? no (end of list)
 host in auth_advertise_hosts? yes (matched "10.0.0.5")
+host in chunking_advertise_hosts? no (end of list)
 SMTP>> 250-myhost.test.ex Hello CALLER at testing.testing [10.0.0.5]
 250-SIZE 52428800
 250-8BITMIME
diff --git a/test/stderr/3404 b/test/stderr/3404
index 8d35b6730..361f9fd82 100644
--- a/test/stderr/3404
+++ b/test/stderr/3404
@@ -18,6 +18,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] A=plain C="250 OK"
 LOG: MAIN
@@ -42,6 +43,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] A=plain C="250 OK"
 LOG: MAIN
@@ -70,6 +72,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
   SMTP>> writing message and terminating "."
   SMTP<< 250 OK
   SMTP>> QUIT
+  SMTP(close)>>
 LOG: MAIN
   => userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] A=login C="250 OK"
 LOG: MAIN
diff --git a/test/stderr/3408 b/test/stderr/3408
index 8c6fb8b25..3f53a120a 100644
--- a/test/stderr/3408
+++ b/test/stderr/3408
@@ -10,6 +10,7 @@
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in auth_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -55,6 +56,7 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in auth_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> plain authenticator server_condition:
 >>>   $auth1 = 
 >>>   $auth2 = userx
diff --git a/test/stderr/3410 b/test/stderr/3410
index 2a6c3d5aa..36fbdb425 100644
--- a/test/stderr/3410
+++ b/test/stderr/3410
@@ -17,6 +17,7 @@ LOG: H=[5.6.9.1] F=<x@y> rejected RCPT <x@y>: You must authenticate
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in auth_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> auth1 authenticator server_condition:
 >>>   $auth1 = 
 >>>   $auth2 = userx
@@ -50,6 +51,7 @@ LOG: H=[5.6.10.1] F=<x@y> rejected RCPT <x@y>
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in auth_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> auth1 authenticator server_condition:
 >>>   $auth1 = 
 >>>   $auth2 = userx
@@ -76,6 +78,7 @@ LOG: H=[5.6.10.1] F=<x@y> rejected RCPT <x@y>
 >>> host in dsn_advertise_hosts? no (option unset)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in auth_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> auth2 authenticator server_condition:
 >>>   $auth1 = userx
 >>>   $auth2 = secret
diff --git a/test/stderr/3500 b/test/stderr/3500
index 61225ae7d..9f4a5e087 100644
--- a/test/stderr/3500
+++ b/test/stderr/3500
@@ -12,6 +12,7 @@
 >>> host in "10.0.0.1 : 10.0.0.5"? no (end of list)
 >>> host in "10.0.0.4"? yes (matched "10.0.0.4")
 >>> host in auth_advertise_hosts? no (matched "!+relay_hosts")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -25,6 +26,7 @@
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in "10.0.0.1 : 10.0.0.5"? yes (matched "10.0.0.1")
 >>> host in auth_advertise_hosts? yes (matched "+auth_hosts")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> +++CRAM-MD5 $auth1="tim" $auth2="" $auth3=""
 >>> CRAM-MD5: user name = tim
 >>>           challenge = <1896.697170952@postoffice.reston.mci.net>
@@ -76,6 +78,7 @@ LOG: 10HmaY-0005vi-00 <= userx@some.domain H=(test.host) [10.0.0.1] P=esmtpa A=c
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in "10.0.0.1 : 10.0.0.5"? yes (matched "10.0.0.5")
 >>> host in auth_advertise_hosts? yes (matched "+auth_hosts")
+>>> host in chunking_advertise_hosts? no (end of list)
 >>> +++CRAM-MD5 $auth1="tim" $auth2="" $auth3=""
 >>> CRAM-MD5: user name = tim
 >>>           challenge = <1896.697170952@postoffice.reston.mci.net>
diff --git a/test/stderr/4504 b/test/stderr/4504
new file mode 100644
index 000000000..045fadc9b
--- /dev/null
+++ b/test/stderr/4504
@@ -0,0 +1,2 @@
+
+******** SERVER ********
diff --git a/test/stderr/4509 b/test/stderr/4509
new file mode 100644
index 000000000..045fadc9b
--- /dev/null
+++ b/test/stderr/4509
@@ -0,0 +1,2 @@
+
+******** SERVER ********
diff --git a/test/stderr/5004 b/test/stderr/5004
index 501488711..ad5c9b331 100644
--- a/test/stderr/5004
+++ b/test/stderr/5004
@@ -13,6 +13,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   userx@test.ex
@@ -27,6 +29,7 @@ I Message-Id: <E10HmaX-0005vi-00@mail.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by mail.test.ex with local (Exim x.yz)
@@ -35,11 +38,12 @@ P Received: from CALLER by mail.test.ex with local (Exim x.yz)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -59,6 +63,7 @@ seeking password data for user "CALLER": using cached result
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -72,7 +77,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -110,7 +115,7 @@ routed by r1 router
   envelope to: userx@test.ex
   transport: <none>
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -129,7 +134,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> TESTSUITE/test-mail <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -168,9 +173,9 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-TESTSUITE/test-mail: no retry items
-userx@test.ex: no retry items
-userx@test.ex: no retry items
+ TESTSUITE/test-mail: no retry items
+ userx@test.ex: no retry items
+ userx@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/5005 b/test/stderr/5005
index f55aa9b1f..8b28b7055 100644
--- a/test/stderr/5005
+++ b/test/stderr/5005
@@ -11,6 +11,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   nofile@test.ex
@@ -25,6 +27,7 @@ I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -33,11 +36,12 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for nofile@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |nofile@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -55,6 +59,7 @@ seeking password data for user "CALLER": cache not available
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -68,7 +73,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   nofile@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -105,7 +110,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> nofile@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -162,7 +167,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-nofile@test.ex: no retry items
+ nofile@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
@@ -195,6 +200,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   userx@test.ex
@@ -209,6 +216,7 @@ I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaY-0005vi-00-D
 Data file written for message 10HmaY-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -217,11 +225,12 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaY-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -238,6 +247,7 @@ seeking password data for user "CALLER": cache not available
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaY-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaY-0005vi-00-D
 reading spool file 10HmaY-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -251,7 +261,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -287,7 +297,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> userx@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -346,7 +356,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaY-0005vi-00
 Processing retry items
 Succeeded addresses:
-userx@test.ex: no retry items
+ userx@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
@@ -379,6 +389,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   userx@test.ex
@@ -393,6 +405,7 @@ I Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaZ-0005vi-00-D
 Data file written for message 10HmaZ-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -401,11 +414,12 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaZ-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -422,6 +436,7 @@ seeking password data for user "CALLER": cache not available
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaZ-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaZ-0005vi-00-D
 reading spool file 10HmaZ-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -435,7 +450,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -471,7 +486,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> userx@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -527,9 +542,9 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-userx@test.ex
+ userx@test.ex
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/retry: flags=O_RDWR
@@ -543,13 +558,15 @@ Writing retry data for T:userx@test.ex
   first failed=dddd last try=dddd next try=+86400 expired=0
   errno=-22 more_errno=dd mailbox is full (MTA-imposed quota exceeded while writing to tmp/MAILDIR.myhost.test.ex)
 dbfn_write: key=T:userx@test.ex
+closed hints database and lockfile
 end of retry processing
 delivery deferred: update_spool=1 header_rewritten=0
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaZ-0005vi-00-H
 Size of headers = sss
 end delivery of 10HmaZ-0005vi-00
 search_tidyup called
@@ -570,6 +587,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   userx@test.ex
@@ -584,6 +603,7 @@ I Message-Id: <E10HmbA-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmbA-0005vi-00-D
 Data file written for message 10HmbA-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -592,11 +612,12 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmbA-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -613,6 +634,7 @@ seeking password data for user "CALLER": cache not available
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmbA-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmbA-0005vi-00-D
 reading spool file 10HmbA-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -626,7 +648,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/retry: flags=O_RDONLY
@@ -639,6 +661,7 @@ dbfn_read: key=R:userx@test.ex:<CALLER@test.ex>
 no domain retry record
 no address retry record
 userx@test.ex: queued for routing
+closed hints database and lockfile
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 routing userx@test.ex
 --------> r1 router <--------
@@ -665,13 +688,14 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> userx@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/retry: flags=O_RDONLY
 dbfn_read: key=T:userx@test.ex
 retry record exists: age=ttt (max 1w)
   time to retry = tttt expired = 0
+closed hints database and lockfile
 search_tidyup called
 changed uid/gid: local delivery to userx <userx@test.ex> transport=t1
   uid=CALLER_UID gid=CALLER_GID pid=pppp
@@ -711,9 +735,9 @@ Processing retry items
 Succeeded addresses:
 Failed addresses:
 Deferred addresses:
-userx@test.ex
+ userx@test.ex
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 opened hints database TESTSUITE/spool/db/retry: flags=O_RDWR
@@ -727,13 +751,15 @@ Writing retry data for T:userx@test.ex
   first failed=dddd last try=dddd next try=+86400 expired=0
   errno=-22 more_errno=dd mailbox is full (MTA-imposed quota exceeded while writing to tmp/MAILDIR.myhost.test.ex)
 dbfn_write: key=T:userx@test.ex
+closed hints database and lockfile
 end of retry processing
 delivery deferred: update_spool=1 header_rewritten=0
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmbA-0005vi-00-H
 Size of headers = sss
 end delivery of 10HmbA-0005vi-00
 search_tidyup called
diff --git a/test/stderr/5006 b/test/stderr/5006
index 15e322819..dce0d0050 100644
--- a/test/stderr/5006
+++ b/test/stderr/5006
@@ -11,6 +11,8 @@ getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 originator: uid=CALLER_UID gid=CALLER_GID login=CALLER name=CALLER_NAME
 sender address = CALLER@test.ex
 set_process_info: pppp accepting a local non-SMTP message from <CALLER@test.ex>
+spool directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100 msg_size = 0
+log directory space = nnnnnK inodes = nnnnn check_space = 10240K inodes = 100
 Sender: CALLER@test.ex
 Recipients:
   userx@test.ex
@@ -25,6 +27,7 @@ I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@test.ex>
   Date: Tue, 2 Mar 1999 09:44:33 +0000
 
+Data file name: TESTSUITE/spool//input//10HmaX-0005vi-00-D
 Data file written for message 10HmaX-0005vi-00
 >>Generated Received: header line
 P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
@@ -33,11 +36,12 @@ P Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
-Writing spool header file
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
 DSN: Write SPOOL :-dsn_envid NULL
 DSN: Write SPOOL :-dsn_ret 0
 DSN: Flags :0
 DSN: **** SPOOL_OUT - address: |userx@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
 Size of headers = sss
 LOG: MAIN
   <= CALLER@test.ex U=CALLER P=local S=sss
@@ -55,6 +59,7 @@ seeking password data for user "CALLER": cache not available
 getpwnam() succeeded uid=CALLER_UID gid=CALLER_GID
 set_process_info: pppp delivering specified messages
 set_process_info: pppp delivering 10HmaX-0005vi-00
+Trying spool file TESTSUITE/spool//input//10HmaX-0005vi-00-D
 reading spool file 10HmaX-0005vi-00-H
 user=CALLER uid=CALLER_UID gid=CALLER_GID sender=CALLER@test.ex
 sender_local=1 ident=CALLER
@@ -68,7 +73,7 @@ DSN: set orcpt: NULL  flags: 0
 Delivery address list:
   userx@test.ex 
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 ensuring TESTSUITE/spool/db/retry.lockfile is owned by exim
@@ -105,7 +110,7 @@ search_tidyup called
 >>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
 --------> userx@test.ex <--------
 locking TESTSUITE/spool/db/retry.lockfile
-locked TESTSUITE/spool/db/retry.lockfile
+locked  TESTSUITE/spool/db/retry.lockfile
 EXIM_DBOPEN(TESTSUITE/spool/db/retry)
 returned from EXIM_DBOPEN
 no retry data available
@@ -160,7 +165,7 @@ changed uid/gid: post-delivery tidying
 set_process_info: pppp tidying up after delivering 10HmaX-0005vi-00
 Processing retry items
 Succeeded addresses:
-userx@test.ex: no retry items
+ userx@test.ex: no retry items
 Failed addresses:
 Deferred addresses:
 end of retry processing
diff --git a/test/stderr/5204 b/test/stderr/5204
index b6f852338..e1ed340c0 100644
--- a/test/stderr/5204
+++ b/test/stderr/5204
@@ -269,6 +269,7 @@ host in helo_accept_junk_hosts? no (option unset)
 some.name in helo_lookup_domains? no (end of list)
 host in dsn_advertise_hosts? no (option unset)
 host in pipelining_advertise_hosts? yes (matched "*")
+host in chunking_advertise_hosts? no (end of list)
 processing "accept"
 check verify = recipient
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
diff --git a/test/stderr/5401 b/test/stderr/5401
deleted file mode 100644
index 1b42441d9..000000000
--- a/test/stderr/5401
+++ /dev/null
@@ -1,43 +0,0 @@
-Exim version x.yz ....
-configuration file is TESTSUITE/test-config
-admin user
-LOG: smtp_connection MAIN
-  SMTP connection from CALLER
-using ACL "acl_rcpt"
-processing "accept"
-check control = cutthrough_delivery
-check verify = recipient
------------ end verify ------------
-accept: condition test succeeded in ACL "acl_rcpt"
-end of ACL "acl_rcpt": ACCEPT
------------ start cutthrough setup ------------
-Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
-  SMTP<< 220 ESMTP
-  SMTP>> EHLO myhost.test.ex
-  SMTP<< 250 OK
-  SMTP>> MAIL FROM:<CALLER@myhost.test.ex>
-  SMTP<< 250 Sender OK
-  SMTP>> RCPT TO:<userx@domain.com>
-  SMTP<< 250 Recipient OK
------------ end cutthrough setup ------------
-processing "accept"
-accept: condition test succeeded in inline ACL
-end of inline ACL: ACCEPT
-  SMTP>> DATA
-  SMTP<< 354 Send data
------------ start cutthrough headers send -----------
------------ done cutthrough headers send ------------
-  SMTP>> .
-  SMTP<< 250 OK
-LOG: MAIN
-  >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
-created log directory TESTSUITE/spool/log
-  SMTP>> QUIT
------------ cutthrough shutdown (delivered) ------------
-LOG: MAIN
-  <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-LOG: MAIN
-  Completed
-LOG: smtp_connection MAIN
-  SMTP connection from CALLER closed by QUIT
->>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/5403 b/test/stderr/5403
new file mode 100644
index 000000000..8d6f97c9a
--- /dev/null
+++ b/test/stderr/5403
@@ -0,0 +1,95 @@
+>>> host in hosts_connection_nolog? no (option unset)
+>>> host in host_lookup? no (option unset)
+>>> host in host_reject_connection? no (option unset)
+>>> host in sender_unqualified_hosts? no (option unset)
+>>> host in recipient_unqualified_hosts? no (option unset)
+>>> host in helo_verify_hosts? no (option unset)
+>>> host in helo_try_verify_hosts? no (option unset)
+>>> host in helo_accept_junk_hosts? no (option unset)
+>>> myhost.test.ex in helo_lookup_domains? yes (matched "@")
+>>> looking up host name for 1.2.3.4
+LOG: no host name found for IP address 1.2.3.4
+>>> host in dsn_advertise_hosts? no (option unset)
+>>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
+>>> using ACL "ar"
+>>> processing "warn"
+>>> check control = cutthrough_delivery
+>>> check logwrite = rcpt for $local_part@$domain
+>>>                = rcpt for plain@domain.com
+LOG: rcpt for plain@domain.com
+>>> warn: condition test succeeded in ACL "ar"
+>>> processing "warn"
+>>> check condition = ${if eq {verify}{$local_part}}
+>>>                 = 
+>>> warn: condition test failed in ACL "ar"
+>>> processing "accept"
+>>> accept: condition test succeeded in ACL "ar"
+>>> end of ACL "ar": ACCEPT
+LOG: 10HmaX-0005vi-00 <= CALLER@myhost.test.ex H=(myhost.test.ex) [1.2.3.4] P=esmtp S=sss for plain@domain.com
+>>> host in hosts_connection_nolog? no (option unset)
+>>> host in host_lookup? no (option unset)
+>>> host in host_reject_connection? no (option unset)
+>>> host in sender_unqualified_hosts? no (option unset)
+>>> host in recipient_unqualified_hosts? no (option unset)
+>>> host in helo_verify_hosts? no (option unset)
+>>> host in helo_try_verify_hosts? no (option unset)
+>>> host in helo_accept_junk_hosts? no (option unset)
+>>> myhost.test.ex in helo_lookup_domains? yes (matched "@")
+>>> looking up host name for 1.2.3.4
+LOG: no host name found for IP address 1.2.3.4
+>>> host in dsn_advertise_hosts? no (option unset)
+>>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
+>>> using ACL "ar"
+>>> processing "warn"
+>>> check control = cutthrough_delivery
+>>> check logwrite = rcpt for $local_part@$domain
+>>>                = rcpt for verify@domain.com
+LOG: rcpt for verify@domain.com
+>>> warn: condition test succeeded in ACL "ar"
+>>> processing "warn"
+>>> check condition = ${if eq {verify}{$local_part}}
+>>>                 = true
+>>> check verify = recipient/callout=use_sender
+>>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+>>> routing verify@domain.com
+>>> domain.com in "localhost.test.ex : localhost4.test.ex : thishost.test.ex"? no (end of list)
+>>> domain.com in "test.ex : *.test.ex"? no (end of list)
+>>> domain.com in "! +local_domains"? yes (end of list)
+>>> calling all router
+>>> domain.com in "special.com"? no (end of list)
+>>> domain.com in "*"? yes (matched "*")
+>>> local host found for non-MX address
+>>> fully qualified name = 127.0.0.1
+MUNGED: ::1 will be omitted in what follows
+>>> get[host|ipnode]byname[2] looked up these IP addresses:
+>>>   name=127.0.0.1 address=127.0.0.1
+>>> routed by all router
+>>> Attempting full verification using callout
+>>> callout cache: disabled by no_cache
+>>> interface=ip4.ip4.ip4.ip4 port=1224
+>>> Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
+>>>   SMTP<< 220 server ready
+>>> 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
+>>>   SMTP>> EHLO myhost.test.ex
+>>> cmd buf flush 21 bytes
+>>>   SMTP<< 250 OK
+>>> 127.0.0.1 in hosts_require_auth? no (option unset)
+>>>   SMTP>> MAIL FROM:<sender@myhost.test.ex>
+>>> cmd buf flush 35 bytes
+>>>   SMTP<< 250 OK
+>>>   SMTP>> RCPT TO:<verify@domain.com>
+>>> cmd buf flush 29 bytes
+>>>   SMTP<< 250 OK
+>>> holding verify callout open for cutthrough delivery
+>>> ----------- end verify ------------
+>>> warn: condition test succeeded in ACL "ar"
+>>> processing "accept"
+>>> accept: condition test succeeded in ACL "ar"
+>>> end of ACL "ar": ACCEPT
+>>>   SMTP>> QUIT
+>>>   SMTP<< 220 OK
+>>>   SMTP(close)>>
+>>> ----------- cutthrough shutdown (host-checking mode) ------------
+LOG: 10HmaY-0005vi-00 <= sender@myhost.test.ex H=(myhost.test.ex) [1.2.3.4] P=esmtp S=sss for verify@domain.com
diff --git a/test/stderr/5410 b/test/stderr/5410
index 0f655c416..cb1b31b72 100644
--- a/test/stderr/5410
+++ b/test/stderr/5410
@@ -4,32 +4,40 @@ admin user
  in hosts_connection_nolog? no (option unset)
 LOG: smtp_connection MAIN
   SMTP connection from CALLER
-expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
-   result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+considering: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+  expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+     result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
  in dsn_advertise_hosts? no (option unset)
  in pipelining_advertise_hosts? yes (matched "*")
+ in chunking_advertise_hosts? no (end of list)
  in tls_advertise_hosts? yes (matched "*")
-expanding: SERVER
-   result: SERVER
-expanding: server
-   result: server
-condition: eq {SERVER}{server}
-   result: false
-expanding: queue
-   result: queue
-skipping: result is not used
-expanding: cutthrough
-   result: cutthrough
-expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
-   result: cutthrough
+considering: ${if eq {SERVER}{server}{queue}{cutthrough}}
+considering: SERVER}{server}{queue}{cutthrough}}
+  expanding: SERVER
+     result: SERVER
+considering: server}{queue}{cutthrough}}
+  expanding: server
+     result: server
+  condition: eq {SERVER}{server}
+     result: false
+   scanning: queue}{cutthrough}}
+  expanding: queue
+     result: queue
+   skipping: result is not used
+considering: cutthrough}}
+  expanding: cutthrough
+     result: cutthrough
+  expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
+     result: cutthrough
 using ACL "cutthrough"
 processing "accept"
 check control = cutthrough_delivery
 check verify = recipient
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: userx
+considering: $local_part
+  expanding: $local_part
+     result: userx
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
@@ -37,56 +45,71 @@ end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: userx
+considering: $local_part
+  expanding: $local_part
+     result: userx
 domain.com in "*"? yes (matched "*")
 Connecting to 127.0.0.1 [127.0.0.1]:1225 from ip4.ip4.ip4.ip4 ... connected
-expanding: $primary_hostname
-   result: myhost.test.ex
+considering: $primary_hostname
+  expanding: $primary_hostname
+     result: myhost.test.ex
   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
          250-8BITMIME
          250-PIPELINING
          250-STARTTLS
          250 HELP
-expanding: $address_data
-   result: userx
-expanding: usery
-   result: usery
-condition: eq {$address_data}{usery}
-   result: false
-expanding: *
-   result: *
-skipping: result is not used
-expanding: :
-   result: :
-expanding: ${if eq {$address_data}{usery}{*}{:}}
-   result: :
+considering: ${if eq {$address_data}{usery}{*}{:}}
+considering: $address_data}{usery}{*}{:}}
+  expanding: $address_data
+     result: userx
+considering: usery}{*}{:}}
+  expanding: usery
+     result: usery
+  condition: eq {$address_data}{usery}
+     result: false
+   scanning: *}{:}}
+  expanding: *
+     result: *
+   skipping: result is not used
+considering: :}}
+  expanding: :
+     result: :
+  expanding: ${if eq {$address_data}{usery}{*}{:}}
+     result: :
 127.0.0.1 in hosts_avoid_tls? no (end of list)
-expanding: $address_data
-   result: userx
-expanding: userz
-   result: userz
-condition: eq {$address_data}{userz}
-   result: false
-expanding: *
-   result: *
-skipping: result is not used
-expanding: :
-   result: :
-expanding: ${if eq {$address_data}{userz}{*}{:}}
-   result: :
+considering: ${if eq {$address_data}{userz}{*}{:}}
+considering: $address_data}{userz}{*}{:}}
+  expanding: $address_data
+     result: userx
+considering: userz}{*}{:}}
+  expanding: userz
+     result: userz
+  condition: eq {$address_data}{userz}
+     result: false
+   scanning: *}{:}}
+  expanding: *
+     result: *
+   skipping: result is not used
+considering: :}}
+  expanding: :
+     result: :
+  expanding: ${if eq {$address_data}{userz}{*}{:}}
+     result: :
 127.0.0.1 in hosts_verify_avoid_tls? no (end of list)
   SMTP>> STARTTLS
+cmd buf flush ddd bytes
   SMTP<< 220 TLS go ahead
 127.0.0.1 in hosts_require_ocsp? no (option unset)
 127.0.0.1 in hosts_request_ocsp? yes (matched "*")
 127.0.0.1 in tls_verify_hosts? no (option unset)
 127.0.0.1 in tls_try_verify_hosts? no (end of list)
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
          250-8BITMIME
@@ -94,65 +117,124 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
          250 HELP
 127.0.0.1 in hosts_require_auth? no (option unset)
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> RCPT TO:<userx@domain.com>
+cmd buf flush ddd bytes
   SMTP<< 250 Accepted
+holding verify callout open for cutthrough delivery
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
 end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
-condition: def:sender_rcvhost
-   result: false
-expanding: from $sender_rcvhost
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_rcvhost
+     result: false
+   scanning: from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: from $sender_rcvhost
 	
-   result: from 
+     result: from 
 	
-skipping: result is not used
-condition: def:sender_ident
-   result: true
-expanding: $sender_ident
-   result: CALLER
-expanding: from ${quote_local_part:$sender_ident} 
-   result: from CALLER 
-condition: def:sender_helo_name
-   result: true
-expanding: (helo=$sender_helo_name)
+   skipping: result is not used
+considering: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_ident
+     result: true
+considering: from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+considering: $sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: $sender_ident
+     result: CALLER
+  expanding: from ${quote_local_part:$sender_ident} 
+     result: from CALLER 
+  condition: def:sender_helo_name
+     result: true
+considering: (helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (helo=$sender_helo_name)
 	
-   result: (helo=myhost.test.ex)
+     result: (helo=myhost.test.ex)
 	
-expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+  expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
 	}}
-   result: from CALLER (helo=myhost.test.ex)
+     result: from CALLER (helo=myhost.test.ex)
 	
-condition: def:received_protocol
-   result: true
-expanding: with $received_protocol
-   result: with local-esmtp
-condition: def:sender_address
-   result: true
-expanding: (envelope-from <$sender_address>)
+  condition: def:received_protocol
+     result: true
+considering: with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: with $received_protocol
+     result: with local-esmtp
+  condition: def:sender_address
+     result: true
+considering: (envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (envelope-from <$sender_address>)
 	
-   result: (envelope-from <CALLER@myhost.test.ex>)
+     result: (envelope-from <CALLER@myhost.test.ex>)
 	
-condition: def:received_for
-   result: true
-expanding: 
+  condition: def:received_for
+     result: true
+considering: 
+	for $received_for}}
+  expanding: 
 	for $received_for
-   result: 
+     result: 
+	for userx@domain.com
+  expanding: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+     result: Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaX-0005vi-00
 	for userx@domain.com
 ----------- start cutthrough headers send -----------
 ----------- done cutthrough headers send ------------
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
   SMTP>> .
-  SMTP<< 250 OK id=10HmaX-0005vi-00
+  SMTP<< 250 OK id=10HmaY-0005vi-00
 LOG: MAIN
-  >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmaX-0005vi-00"
+  >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmaY-0005vi-00"
   SMTP>> QUIT
+  SMTP<< 221 myhost.test.ex closing connection
+  SMTP(close)>>
 ----------- cutthrough shutdown (delivered) ------------
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
@@ -167,32 +249,40 @@ admin user
  in hosts_connection_nolog? no (option unset)
 LOG: smtp_connection MAIN
   SMTP connection from CALLER
-expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
-   result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+considering: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+  expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+     result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
  in dsn_advertise_hosts? no (option unset)
  in pipelining_advertise_hosts? yes (matched "*")
+ in chunking_advertise_hosts? no (end of list)
  in tls_advertise_hosts? yes (matched "*")
-expanding: SERVER
-   result: SERVER
-expanding: server
-   result: server
-condition: eq {SERVER}{server}
-   result: false
-expanding: queue
-   result: queue
-skipping: result is not used
-expanding: cutthrough
-   result: cutthrough
-expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
-   result: cutthrough
+considering: ${if eq {SERVER}{server}{queue}{cutthrough}}
+considering: SERVER}{server}{queue}{cutthrough}}
+  expanding: SERVER
+     result: SERVER
+considering: server}{queue}{cutthrough}}
+  expanding: server
+     result: server
+  condition: eq {SERVER}{server}
+     result: false
+   scanning: queue}{cutthrough}}
+  expanding: queue
+     result: queue
+   skipping: result is not used
+considering: cutthrough}}
+  expanding: cutthrough
+     result: cutthrough
+  expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
+     result: cutthrough
 using ACL "cutthrough"
 processing "accept"
 check control = cutthrough_delivery
 check verify = recipient
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: usery
+considering: $local_part
+  expanding: $local_part
+     result: usery
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
@@ -200,96 +290,163 @@ end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: usery
+considering: $local_part
+  expanding: $local_part
+     result: usery
 domain.com in "*"? yes (matched "*")
 Connecting to 127.0.0.1 [127.0.0.1]:1225 from ip4.ip4.ip4.ip4 ... connected
-expanding: $primary_hostname
-   result: myhost.test.ex
+considering: $primary_hostname
+  expanding: $primary_hostname
+     result: myhost.test.ex
   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
          250-8BITMIME
          250-PIPELINING
          250-STARTTLS
          250 HELP
-expanding: $address_data
-   result: usery
-expanding: usery
-   result: usery
-condition: eq {$address_data}{usery}
-   result: true
-expanding: *
-   result: *
-expanding: :
-   result: :
-skipping: result is not used
-expanding: ${if eq {$address_data}{usery}{*}{:}}
-   result: *
+considering: ${if eq {$address_data}{usery}{*}{:}}
+considering: $address_data}{usery}{*}{:}}
+  expanding: $address_data
+     result: usery
+considering: usery}{*}{:}}
+  expanding: usery
+     result: usery
+  condition: eq {$address_data}{usery}
+     result: true
+considering: *}{:}}
+  expanding: *
+     result: *
+   scanning: :}}
+  expanding: :
+     result: :
+   skipping: result is not used
+  expanding: ${if eq {$address_data}{usery}{*}{:}}
+     result: *
 127.0.0.1 in hosts_avoid_tls? yes (matched "*")
 127.0.0.1 in hosts_require_auth? no (option unset)
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> RCPT TO:<usery@domain.com>
+cmd buf flush ddd bytes
   SMTP<< 250 Accepted
+holding verify callout open for cutthrough delivery
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
 end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
-condition: def:sender_rcvhost
-   result: false
-expanding: from $sender_rcvhost
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_rcvhost
+     result: false
+   scanning: from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: from $sender_rcvhost
 	
-   result: from 
+     result: from 
 	
-skipping: result is not used
-condition: def:sender_ident
-   result: true
-expanding: $sender_ident
-   result: CALLER
-expanding: from ${quote_local_part:$sender_ident} 
-   result: from CALLER 
-condition: def:sender_helo_name
-   result: true
-expanding: (helo=$sender_helo_name)
+   skipping: result is not used
+considering: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_ident
+     result: true
+considering: from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+considering: $sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: $sender_ident
+     result: CALLER
+  expanding: from ${quote_local_part:$sender_ident} 
+     result: from CALLER 
+  condition: def:sender_helo_name
+     result: true
+considering: (helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (helo=$sender_helo_name)
 	
-   result: (helo=myhost.test.ex)
+     result: (helo=myhost.test.ex)
 	
-expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+  expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
 	}}
-   result: from CALLER (helo=myhost.test.ex)
+     result: from CALLER (helo=myhost.test.ex)
 	
-condition: def:received_protocol
-   result: true
-expanding: with $received_protocol
-   result: with local-esmtp
-condition: def:sender_address
-   result: true
-expanding: (envelope-from <$sender_address>)
+  condition: def:received_protocol
+     result: true
+considering: with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: with $received_protocol
+     result: with local-esmtp
+  condition: def:sender_address
+     result: true
+considering: (envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (envelope-from <$sender_address>)
 	
-   result: (envelope-from <CALLER@myhost.test.ex>)
+     result: (envelope-from <CALLER@myhost.test.ex>)
 	
-condition: def:received_for
-   result: true
-expanding: 
+  condition: def:received_for
+     result: true
+considering: 
+	for $received_for}}
+  expanding: 
 	for $received_for
-   result: 
+     result: 
+	for usery@domain.com
+  expanding: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+     result: Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaZ-0005vi-00
 	for usery@domain.com
 ----------- start cutthrough headers send -----------
 ----------- done cutthrough headers send ------------
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
   SMTP>> .
-  SMTP<< 250 OK id=10HmaZ-0005vi-00
+  SMTP<< 250 OK id=10HmbA-0005vi-00
 LOG: MAIN
-  >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
+  >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
   SMTP>> QUIT
+  SMTP<< 221 myhost.test.ex closing connection
+  SMTP(close)>>
 ----------- cutthrough shutdown (delivered) ------------
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
@@ -304,32 +461,40 @@ admin user
  in hosts_connection_nolog? no (option unset)
 LOG: smtp_connection MAIN
   SMTP connection from CALLER
-expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
-   result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+considering: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+  expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+     result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
  in dsn_advertise_hosts? no (option unset)
  in pipelining_advertise_hosts? yes (matched "*")
+ in chunking_advertise_hosts? no (end of list)
  in tls_advertise_hosts? yes (matched "*")
-expanding: SERVER
-   result: SERVER
-expanding: server
-   result: server
-condition: eq {SERVER}{server}
-   result: false
-expanding: queue
-   result: queue
-skipping: result is not used
-expanding: cutthrough
-   result: cutthrough
-expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
-   result: cutthrough
+considering: ${if eq {SERVER}{server}{queue}{cutthrough}}
+considering: SERVER}{server}{queue}{cutthrough}}
+  expanding: SERVER
+     result: SERVER
+considering: server}{queue}{cutthrough}}
+  expanding: server
+     result: server
+  condition: eq {SERVER}{server}
+     result: false
+   scanning: queue}{cutthrough}}
+  expanding: queue
+     result: queue
+   skipping: result is not used
+considering: cutthrough}}
+  expanding: cutthrough
+     result: cutthrough
+  expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
+     result: cutthrough
 using ACL "cutthrough"
 processing "accept"
 check control = cutthrough_delivery
 check verify = recipient
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: usery
+considering: $local_part
+  expanding: $local_part
+     result: usery
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
@@ -337,96 +502,163 @@ end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: usery
+considering: $local_part
+  expanding: $local_part
+     result: usery
 domain.com in "*"? yes (matched "*")
 Connecting to 127.0.0.1 [127.0.0.1]:1225 from ip4.ip4.ip4.ip4 ... connected
-expanding: $primary_hostname
-   result: myhost.test.ex
+considering: $primary_hostname
+  expanding: $primary_hostname
+     result: myhost.test.ex
   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
          250-8BITMIME
          250-PIPELINING
          250-STARTTLS
          250 HELP
-expanding: $address_data
-   result: usery
-expanding: usery
-   result: usery
-condition: eq {$address_data}{usery}
-   result: true
-expanding: *
-   result: *
-expanding: :
-   result: :
-skipping: result is not used
-expanding: ${if eq {$address_data}{usery}{*}{:}}
-   result: *
+considering: ${if eq {$address_data}{usery}{*}{:}}
+considering: $address_data}{usery}{*}{:}}
+  expanding: $address_data
+     result: usery
+considering: usery}{*}{:}}
+  expanding: usery
+     result: usery
+  condition: eq {$address_data}{usery}
+     result: true
+considering: *}{:}}
+  expanding: *
+     result: *
+   scanning: :}}
+  expanding: :
+     result: :
+   skipping: result is not used
+  expanding: ${if eq {$address_data}{usery}{*}{:}}
+     result: *
 127.0.0.1 in hosts_avoid_tls? yes (matched "*")
 127.0.0.1 in hosts_require_auth? no (option unset)
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> RCPT TO:<usery@domain.com>
+cmd buf flush ddd bytes
   SMTP<< 250 Accepted
+holding verify callout open for cutthrough delivery
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
 end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
-condition: def:sender_rcvhost
-   result: false
-expanding: from $sender_rcvhost
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_rcvhost
+     result: false
+   scanning: from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: from $sender_rcvhost
 	
-   result: from 
+     result: from 
 	
-skipping: result is not used
-condition: def:sender_ident
-   result: true
-expanding: $sender_ident
-   result: CALLER
-expanding: from ${quote_local_part:$sender_ident} 
-   result: from CALLER 
-condition: def:sender_helo_name
-   result: true
-expanding: (helo=$sender_helo_name)
+   skipping: result is not used
+considering: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_ident
+     result: true
+considering: from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+considering: $sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: $sender_ident
+     result: CALLER
+  expanding: from ${quote_local_part:$sender_ident} 
+     result: from CALLER 
+  condition: def:sender_helo_name
+     result: true
+considering: (helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (helo=$sender_helo_name)
 	
-   result: (helo=myhost.test.ex)
+     result: (helo=myhost.test.ex)
 	
-expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+  expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
 	}}
-   result: from CALLER (helo=myhost.test.ex)
+     result: from CALLER (helo=myhost.test.ex)
 	
-condition: def:received_protocol
-   result: true
-expanding: with $received_protocol
-   result: with local-esmtp
-condition: def:sender_address
-   result: true
-expanding: (envelope-from <$sender_address>)
+  condition: def:received_protocol
+     result: true
+considering: with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: with $received_protocol
+     result: with local-esmtp
+  condition: def:sender_address
+     result: true
+considering: (envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (envelope-from <$sender_address>)
 	
-   result: (envelope-from <CALLER@myhost.test.ex>)
+     result: (envelope-from <CALLER@myhost.test.ex>)
 	
-condition: def:received_for
-   result: true
-expanding: 
+  condition: def:received_for
+     result: true
+considering: 
+	for $received_for}}
+  expanding: 
 	for $received_for
-   result: 
+     result: 
+	for usery@domain.com
+  expanding: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+     result: Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbB-0005vi-00
 	for usery@domain.com
 ----------- start cutthrough headers send -----------
 ----------- done cutthrough headers send ------------
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
   SMTP>> .
-  SMTP<< 250 OK id=10HmbB-0005vi-00
+  SMTP<< 250 OK id=10HmbC-0005vi-00
 LOG: MAIN
-  >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbB-0005vi-00"
+  >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbC-0005vi-00"
   SMTP>> QUIT
+  SMTP<< 221 myhost.test.ex closing connection
+  SMTP(close)>>
 ----------- cutthrough shutdown (delivered) ------------
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
diff --git a/test/stderr/5420 b/test/stderr/5420
index 7f9332965..8ccf0fd6c 100644
--- a/test/stderr/5420
+++ b/test/stderr/5420
@@ -4,32 +4,40 @@ admin user
  in hosts_connection_nolog? no (option unset)
 LOG: smtp_connection MAIN
   SMTP connection from CALLER
-expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
-   result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+considering: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+  expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+     result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
  in dsn_advertise_hosts? no (option unset)
  in pipelining_advertise_hosts? yes (matched "*")
+ in chunking_advertise_hosts? no (end of list)
  in tls_advertise_hosts? yes (matched "*")
-expanding: SERVER
-   result: SERVER
-expanding: server
-   result: server
-condition: eq {SERVER}{server}
-   result: false
-expanding: queue
-   result: queue
-skipping: result is not used
-expanding: cutthrough
-   result: cutthrough
-expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
-   result: cutthrough
+considering: ${if eq {SERVER}{server}{queue}{cutthrough}}
+considering: SERVER}{server}{queue}{cutthrough}}
+  expanding: SERVER
+     result: SERVER
+considering: server}{queue}{cutthrough}}
+  expanding: server
+     result: server
+  condition: eq {SERVER}{server}
+     result: false
+   scanning: queue}{cutthrough}}
+  expanding: queue
+     result: queue
+   skipping: result is not used
+considering: cutthrough}}
+  expanding: cutthrough
+     result: cutthrough
+  expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
+     result: cutthrough
 using ACL "cutthrough"
 processing "accept"
 check control = cutthrough_delivery
 check verify = recipient
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: userx
+considering: $local_part
+  expanding: $local_part
+     result: userx
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
@@ -37,55 +45,70 @@ end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: userx
+considering: $local_part
+  expanding: $local_part
+     result: userx
 domain.com in "*"? yes (matched "*")
 Connecting to 127.0.0.1 [127.0.0.1]:1225 from ip4.ip4.ip4.ip4 ... connected
-expanding: $primary_hostname
-   result: myhost.test.ex
+considering: $primary_hostname
+  expanding: $primary_hostname
+     result: myhost.test.ex
   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
          250-8BITMIME
          250-PIPELINING
          250-STARTTLS
          250 HELP
-expanding: $address_data
-   result: userx
-expanding: usery
-   result: usery
-condition: eq {$address_data}{usery}
-   result: false
-expanding: *
-   result: *
-skipping: result is not used
-expanding: :
-   result: :
-expanding: ${if eq {$address_data}{usery}{*}{:}}
-   result: :
+considering: ${if eq {$address_data}{usery}{*}{:}}
+considering: $address_data}{usery}{*}{:}}
+  expanding: $address_data
+     result: userx
+considering: usery}{*}{:}}
+  expanding: usery
+     result: usery
+  condition: eq {$address_data}{usery}
+     result: false
+   scanning: *}{:}}
+  expanding: *
+     result: *
+   skipping: result is not used
+considering: :}}
+  expanding: :
+     result: :
+  expanding: ${if eq {$address_data}{usery}{*}{:}}
+     result: :
 127.0.0.1 in hosts_avoid_tls? no (end of list)
-expanding: $address_data
-   result: userx
-expanding: userz
-   result: userz
-condition: eq {$address_data}{userz}
-   result: false
-expanding: *
-   result: *
-skipping: result is not used
-expanding: :
-   result: :
-expanding: ${if eq {$address_data}{userz}{*}{:}}
-   result: :
+considering: ${if eq {$address_data}{userz}{*}{:}}
+considering: $address_data}{userz}{*}{:}}
+  expanding: $address_data
+     result: userx
+considering: userz}{*}{:}}
+  expanding: userz
+     result: userz
+  condition: eq {$address_data}{userz}
+     result: false
+   scanning: *}{:}}
+  expanding: *
+     result: *
+   skipping: result is not used
+considering: :}}
+  expanding: :
+     result: :
+  expanding: ${if eq {$address_data}{userz}{*}{:}}
+     result: :
 127.0.0.1 in hosts_verify_avoid_tls? no (end of list)
   SMTP>> STARTTLS
+cmd buf flush ddd bytes
   SMTP<< 220 TLS go ahead
 127.0.0.1 in tls_verify_hosts? no (option unset)
 127.0.0.1 in tls_try_verify_hosts? yes (matched "*")
 127.0.0.1 in tls_verify_cert_hostnames? yes (matched "*")
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
          250-8BITMIME
@@ -93,65 +116,124 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
          250 HELP
 127.0.0.1 in hosts_require_auth? no (option unset)
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> RCPT TO:<userx@domain.com>
+cmd buf flush ddd bytes
   SMTP<< 250 Accepted
+holding verify callout open for cutthrough delivery
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
 end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
-condition: def:sender_rcvhost
-   result: false
-expanding: from $sender_rcvhost
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_rcvhost
+     result: false
+   scanning: from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: from $sender_rcvhost
 	
-   result: from 
+     result: from 
 	
-skipping: result is not used
-condition: def:sender_ident
-   result: true
-expanding: $sender_ident
-   result: CALLER
-expanding: from ${quote_local_part:$sender_ident} 
-   result: from CALLER 
-condition: def:sender_helo_name
-   result: true
-expanding: (helo=$sender_helo_name)
+   skipping: result is not used
+considering: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_ident
+     result: true
+considering: from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+considering: $sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: $sender_ident
+     result: CALLER
+  expanding: from ${quote_local_part:$sender_ident} 
+     result: from CALLER 
+  condition: def:sender_helo_name
+     result: true
+considering: (helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (helo=$sender_helo_name)
 	
-   result: (helo=myhost.test.ex)
+     result: (helo=myhost.test.ex)
 	
-expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+  expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
 	}}
-   result: from CALLER (helo=myhost.test.ex)
+     result: from CALLER (helo=myhost.test.ex)
 	
-condition: def:received_protocol
-   result: true
-expanding: with $received_protocol
-   result: with local-esmtp
-condition: def:sender_address
-   result: true
-expanding: (envelope-from <$sender_address>)
+  condition: def:received_protocol
+     result: true
+considering: with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: with $received_protocol
+     result: with local-esmtp
+  condition: def:sender_address
+     result: true
+considering: (envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (envelope-from <$sender_address>)
 	
-   result: (envelope-from <CALLER@myhost.test.ex>)
+     result: (envelope-from <CALLER@myhost.test.ex>)
 	
-condition: def:received_for
-   result: true
-expanding: 
+  condition: def:received_for
+     result: true
+considering: 
+	for $received_for}}
+  expanding: 
 	for $received_for
-   result: 
+     result: 
+	for userx@domain.com
+  expanding: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+     result: Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaX-0005vi-00
 	for userx@domain.com
 ----------- start cutthrough headers send -----------
 ----------- done cutthrough headers send ------------
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
   SMTP>> .
-  SMTP<< 250 OK id=10HmaX-0005vi-00
+  SMTP<< 250 OK id=10HmaY-0005vi-00
 LOG: MAIN
-  >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmaX-0005vi-00"
+  >> userx@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmaY-0005vi-00"
   SMTP>> QUIT
+  SMTP<< 221 myhost.test.ex closing connection
+  SMTP(close)>>
 ----------- cutthrough shutdown (delivered) ------------
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
@@ -166,32 +248,40 @@ admin user
  in hosts_connection_nolog? no (option unset)
 LOG: smtp_connection MAIN
   SMTP connection from CALLER
-expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
-   result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+considering: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+  expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+     result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
  in dsn_advertise_hosts? no (option unset)
  in pipelining_advertise_hosts? yes (matched "*")
+ in chunking_advertise_hosts? no (end of list)
  in tls_advertise_hosts? yes (matched "*")
-expanding: SERVER
-   result: SERVER
-expanding: server
-   result: server
-condition: eq {SERVER}{server}
-   result: false
-expanding: queue
-   result: queue
-skipping: result is not used
-expanding: cutthrough
-   result: cutthrough
-expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
-   result: cutthrough
+considering: ${if eq {SERVER}{server}{queue}{cutthrough}}
+considering: SERVER}{server}{queue}{cutthrough}}
+  expanding: SERVER
+     result: SERVER
+considering: server}{queue}{cutthrough}}
+  expanding: server
+     result: server
+  condition: eq {SERVER}{server}
+     result: false
+   scanning: queue}{cutthrough}}
+  expanding: queue
+     result: queue
+   skipping: result is not used
+considering: cutthrough}}
+  expanding: cutthrough
+     result: cutthrough
+  expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
+     result: cutthrough
 using ACL "cutthrough"
 processing "accept"
 check control = cutthrough_delivery
 check verify = recipient
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: usery
+considering: $local_part
+  expanding: $local_part
+     result: usery
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
@@ -199,96 +289,163 @@ end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: usery
+considering: $local_part
+  expanding: $local_part
+     result: usery
 domain.com in "*"? yes (matched "*")
 Connecting to 127.0.0.1 [127.0.0.1]:1225 from ip4.ip4.ip4.ip4 ... connected
-expanding: $primary_hostname
-   result: myhost.test.ex
+considering: $primary_hostname
+  expanding: $primary_hostname
+     result: myhost.test.ex
   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
          250-8BITMIME
          250-PIPELINING
          250-STARTTLS
          250 HELP
-expanding: $address_data
-   result: usery
-expanding: usery
-   result: usery
-condition: eq {$address_data}{usery}
-   result: true
-expanding: *
-   result: *
-expanding: :
-   result: :
-skipping: result is not used
-expanding: ${if eq {$address_data}{usery}{*}{:}}
-   result: *
+considering: ${if eq {$address_data}{usery}{*}{:}}
+considering: $address_data}{usery}{*}{:}}
+  expanding: $address_data
+     result: usery
+considering: usery}{*}{:}}
+  expanding: usery
+     result: usery
+  condition: eq {$address_data}{usery}
+     result: true
+considering: *}{:}}
+  expanding: *
+     result: *
+   scanning: :}}
+  expanding: :
+     result: :
+   skipping: result is not used
+  expanding: ${if eq {$address_data}{usery}{*}{:}}
+     result: *
 127.0.0.1 in hosts_avoid_tls? yes (matched "*")
 127.0.0.1 in hosts_require_auth? no (option unset)
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> RCPT TO:<usery@domain.com>
+cmd buf flush ddd bytes
   SMTP<< 250 Accepted
+holding verify callout open for cutthrough delivery
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
 end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
-condition: def:sender_rcvhost
-   result: false
-expanding: from $sender_rcvhost
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_rcvhost
+     result: false
+   scanning: from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: from $sender_rcvhost
 	
-   result: from 
+     result: from 
 	
-skipping: result is not used
-condition: def:sender_ident
-   result: true
-expanding: $sender_ident
-   result: CALLER
-expanding: from ${quote_local_part:$sender_ident} 
-   result: from CALLER 
-condition: def:sender_helo_name
-   result: true
-expanding: (helo=$sender_helo_name)
+   skipping: result is not used
+considering: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_ident
+     result: true
+considering: from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+considering: $sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: $sender_ident
+     result: CALLER
+  expanding: from ${quote_local_part:$sender_ident} 
+     result: from CALLER 
+  condition: def:sender_helo_name
+     result: true
+considering: (helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (helo=$sender_helo_name)
 	
-   result: (helo=myhost.test.ex)
+     result: (helo=myhost.test.ex)
 	
-expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+  expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
 	}}
-   result: from CALLER (helo=myhost.test.ex)
+     result: from CALLER (helo=myhost.test.ex)
 	
-condition: def:received_protocol
-   result: true
-expanding: with $received_protocol
-   result: with local-esmtp
-condition: def:sender_address
-   result: true
-expanding: (envelope-from <$sender_address>)
+  condition: def:received_protocol
+     result: true
+considering: with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: with $received_protocol
+     result: with local-esmtp
+  condition: def:sender_address
+     result: true
+considering: (envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (envelope-from <$sender_address>)
 	
-   result: (envelope-from <CALLER@myhost.test.ex>)
+     result: (envelope-from <CALLER@myhost.test.ex>)
 	
-condition: def:received_for
-   result: true
-expanding: 
+  condition: def:received_for
+     result: true
+considering: 
+	for $received_for}}
+  expanding: 
 	for $received_for
-   result: 
+     result: 
+	for usery@domain.com
+  expanding: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+     result: Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaZ-0005vi-00
 	for usery@domain.com
 ----------- start cutthrough headers send -----------
 ----------- done cutthrough headers send ------------
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
   SMTP>> .
-  SMTP<< 250 OK id=10HmaZ-0005vi-00
+  SMTP<< 250 OK id=10HmbA-0005vi-00
 LOG: MAIN
-  >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
+  >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbA-0005vi-00"
   SMTP>> QUIT
+  SMTP<< 221 myhost.test.ex closing connection
+  SMTP(close)>>
 ----------- cutthrough shutdown (delivered) ------------
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
@@ -303,32 +460,40 @@ admin user
  in hosts_connection_nolog? no (option unset)
 LOG: smtp_connection MAIN
   SMTP connection from CALLER
-expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
-   result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+considering: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+  expanding: $smtp_active_hostname ESMTP Exim $version_number $tod_full
+     result: myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
  in dsn_advertise_hosts? no (option unset)
  in pipelining_advertise_hosts? yes (matched "*")
+ in chunking_advertise_hosts? no (end of list)
  in tls_advertise_hosts? yes (matched "*")
-expanding: SERVER
-   result: SERVER
-expanding: server
-   result: server
-condition: eq {SERVER}{server}
-   result: false
-expanding: queue
-   result: queue
-skipping: result is not used
-expanding: cutthrough
-   result: cutthrough
-expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
-   result: cutthrough
+considering: ${if eq {SERVER}{server}{queue}{cutthrough}}
+considering: SERVER}{server}{queue}{cutthrough}}
+  expanding: SERVER
+     result: SERVER
+considering: server}{queue}{cutthrough}}
+  expanding: server
+     result: server
+  condition: eq {SERVER}{server}
+     result: false
+   scanning: queue}{cutthrough}}
+  expanding: queue
+     result: queue
+   skipping: result is not used
+considering: cutthrough}}
+  expanding: cutthrough
+     result: cutthrough
+  expanding: ${if eq {SERVER}{server}{queue}{cutthrough}}
+     result: cutthrough
 using ACL "cutthrough"
 processing "accept"
 check control = cutthrough_delivery
 check verify = recipient
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: usery
+considering: $local_part
+  expanding: $local_part
+     result: usery
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
@@ -336,96 +501,163 @@ end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
-expanding: $local_part
-   result: usery
+considering: $local_part
+  expanding: $local_part
+     result: usery
 domain.com in "*"? yes (matched "*")
 Connecting to 127.0.0.1 [127.0.0.1]:1225 from ip4.ip4.ip4.ip4 ... connected
-expanding: $primary_hostname
-   result: myhost.test.ex
+considering: $primary_hostname
+  expanding: $primary_hostname
+     result: myhost.test.ex
   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 127.0.0.1 in hosts_avoid_esmtp? no (option unset)
   SMTP>> EHLO myhost.test.ex
+cmd buf flush ddd bytes
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
          250-8BITMIME
          250-PIPELINING
          250-STARTTLS
          250 HELP
-expanding: $address_data
-   result: usery
-expanding: usery
-   result: usery
-condition: eq {$address_data}{usery}
-   result: true
-expanding: *
-   result: *
-expanding: :
-   result: :
-skipping: result is not used
-expanding: ${if eq {$address_data}{usery}{*}{:}}
-   result: *
+considering: ${if eq {$address_data}{usery}{*}{:}}
+considering: $address_data}{usery}{*}{:}}
+  expanding: $address_data
+     result: usery
+considering: usery}{*}{:}}
+  expanding: usery
+     result: usery
+  condition: eq {$address_data}{usery}
+     result: true
+considering: *}{:}}
+  expanding: *
+     result: *
+   scanning: :}}
+  expanding: :
+     result: :
+   skipping: result is not used
+  expanding: ${if eq {$address_data}{usery}{*}{:}}
+     result: *
 127.0.0.1 in hosts_avoid_tls? yes (matched "*")
 127.0.0.1 in hosts_require_auth? no (option unset)
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex>
+cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP>> RCPT TO:<usery@domain.com>
+cmd buf flush ddd bytes
   SMTP<< 250 Accepted
+holding verify callout open for cutthrough delivery
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
 end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
-condition: def:sender_rcvhost
-   result: false
-expanding: from $sender_rcvhost
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_rcvhost
+     result: false
+   scanning: from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: from $sender_rcvhost
 	
-   result: from 
+     result: from 
 	
-skipping: result is not used
-condition: def:sender_ident
-   result: true
-expanding: $sender_ident
-   result: CALLER
-expanding: from ${quote_local_part:$sender_ident} 
-   result: from CALLER 
-condition: def:sender_helo_name
-   result: true
-expanding: (helo=$sender_helo_name)
+   skipping: result is not used
+considering: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  condition: def:sender_ident
+     result: true
+considering: from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+considering: $sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: $sender_ident
+     result: CALLER
+  expanding: from ${quote_local_part:$sender_ident} 
+     result: from CALLER 
+  condition: def:sender_helo_name
+     result: true
+considering: (helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (helo=$sender_helo_name)
 	
-   result: (helo=myhost.test.ex)
+     result: (helo=myhost.test.ex)
 	
-expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+  expanding: ${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
 	}}
-   result: from CALLER (helo=myhost.test.ex)
+     result: from CALLER (helo=myhost.test.ex)
 	
-condition: def:received_protocol
-   result: true
-expanding: with $received_protocol
-   result: with local-esmtp
-condition: def:sender_address
-   result: true
-expanding: (envelope-from <$sender_address>)
+  condition: def:received_protocol
+     result: true
+considering: with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: with $received_protocol
+     result: with local-esmtp
+  condition: def:sender_address
+     result: true
+considering: (envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+  expanding: (envelope-from <$sender_address>)
 	
-   result: (envelope-from <CALLER@myhost.test.ex>)
+     result: (envelope-from <CALLER@myhost.test.ex>)
 	
-condition: def:received_for
-   result: true
-expanding: 
+  condition: def:received_for
+     result: true
+considering: 
+	for $received_for}}
+  expanding: 
 	for $received_for
-   result: 
+     result: 
+	for usery@domain.com
+  expanding: Received: ${if def:sender_rcvhost {from $sender_rcvhost
+	}{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)
+	}}}}by $primary_hostname ${if def:received_protocol {with $received_protocol}} (Exim $version_number)
+	${if def:sender_address {(envelope-from <$sender_address>)
+	}}id $message_exim_id${if def:received_for {
+	for $received_for}}
+     result: Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbB-0005vi-00
 	for usery@domain.com
 ----------- start cutthrough headers send -----------
 ----------- done cutthrough headers send ------------
-expanding: ${tod_full}
-   result: Tue, 2 Mar 1999 09:44:33 +0000
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
   SMTP>> .
-  SMTP<< 250 OK id=10HmbB-0005vi-00
+  SMTP<< 250 OK id=10HmbC-0005vi-00
 LOG: MAIN
-  >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbB-0005vi-00"
+  >> usery@domain.com R=all T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmbC-0005vi-00"
   SMTP>> QUIT
+  SMTP<< 221 myhost.test.ex closing connection
+  SMTP(close)>>
 ----------- cutthrough shutdown (delivered) ------------
 LOG: MAIN
   <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
diff --git a/test/stderr/5610 b/test/stderr/5610
new file mode 100644
index 000000000..045fadc9b
--- /dev/null
+++ b/test/stderr/5610
@@ -0,0 +1,2 @@
+
+******** SERVER ********
diff --git a/test/stderr/5840 b/test/stderr/5840
index 91e80e8ea..97fdca69d 100644
--- a/test/stderr/5840
+++ b/test/stderr/5840
@@ -1,3 +1,6 @@
+### TLSA (3 1 1)
+### TLSA (3 1 2)
+### Recipient callout
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -9,14 +12,14 @@
 >>> processing "accept"
 >>> check verify = recipient/callout
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
->>> routing CALLER@dane256ee.test.ex
+>>> routing rcptuser@dane256ee.test.ex
 >>> calling client router
 >>> dane256ee.test.ex in "*"? yes (matched "*")
 >>> local host found for non-MX address
 >>> routed by client router
 >>> Attempting full verification using callout
 >>> callout cache: no domain record found for dane256ee.test.ex
->>> callout cache: no address record found for CALLER@dane256ee.test.ex
+>>> callout cache: no address record found for rcptuser@dane256ee.test.ex
 >>> interface=NULL port=1225
 >>> Connecting to dane256ee.test.ex [ip4.ip4.ip4.ip4]:1225 ... connected
 MUNGED: ::1 will be omitted in what follows
@@ -26,6 +29,7 @@ MUNGED: ::1 will be omitted in what follows
 >>>   SMTP<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ip4.ip4.ip4.ip4 in hosts_avoid_esmtp? no (option unset)
 >>>   SMTP>> EHLO myhost.test.ex
+>>> cmd buf flush 21 bytes
 >>>   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
 >>>          250-SIZE 52428800
 >>>          250-8BITMIME
@@ -35,11 +39,13 @@ MUNGED: ::1 will be omitted in what follows
 >>> ip4.ip4.ip4.ip4 in hosts_avoid_tls? no (option unset)
 >>> ip4.ip4.ip4.ip4 in hosts_verify_avoid_tls? no (option unset)
 >>>   SMTP>> STARTTLS
+>>> cmd buf flush 10 bytes
 >>>   SMTP<< 220 TLS go ahead
 >>> ip4.ip4.ip4.ip4 in hosts_require_ocsp? no (option unset)
 >>> ip4.ip4.ip4.ip4 in hosts_require_ocsp? no (option unset)
 >>> ip4.ip4.ip4.ip4 in hosts_request_ocsp? no (end of list)
 >>>   SMTP>> EHLO myhost.test.ex
+>>> cmd buf flush 21 bytes
 >>>   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
 >>>          250-SIZE 52428800
 >>>          250-8BITMIME
@@ -47,16 +53,36 @@ MUNGED: ::1 will be omitted in what follows
 >>>          250 HELP
 >>> ip4.ip4.ip4.ip4 in hosts_require_auth? no (option unset)
 >>>   SMTP>> MAIL FROM:<>
+>>> cmd buf flush 14 bytes
 >>>   SMTP<< 250 OK
->>>   SMTP>> RCPT TO:<CALLER@dane256ee.test.ex>
+>>>   SMTP>> RCPT TO:<rcptuser@dane256ee.test.ex>
+>>> cmd buf flush 38 bytes
 >>>   SMTP<< 250 Accepted
 >>>   SMTP>> QUIT
->>> wrote callout cache domain record:
+>>> cmd buf flush 6 bytes
+>>>   SMTP<< 221 myhost.test.ex closing connection
+>>>   SMTP(close)>>
+>>> wrote callout cache domain record for dane256ee.test.ex:
 >>>   result=1 postmaster=0 random=0
->>> wrote positive callout cache address record
+>>> wrote positive callout cache address record for rcptuser@dane256ee.test.ex
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in inline ACL
 >>> end of inline ACL: ACCEPT
 LOG: unexpected disconnection while reading SMTP command from [127.0.0.1]
+### TLSA (2 0 1)
+### A server with a nonverifying cert and no TLSA
+### A server with a verifying cert and no TLSA
+### A server with two MXs for which both TLSA lookups return defer
+### A server lacking a TLSA, required
+### A server lacking a TLSA, requested only
 
 ******** SERVER ********
+### TLSA (3 1 1)
+### TLSA (3 1 2)
+### Recipient callout
+### TLSA (2 0 1)
+### A server with a nonverifying cert and no TLSA
+### A server with a verifying cert and no TLSA
+### A server with two MXs for which both TLSA lookups return defer
+### A server lacking a TLSA, required
+### A server lacking a TLSA, requested only
diff --git a/test/stderr/5900 b/test/stderr/5900
new file mode 100644
index 000000000..70058d78e
--- /dev/null
+++ b/test/stderr/5900
@@ -0,0 +1 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 == userx@test.ex R=scan T=scan defer (2): No such file or directory: scan transport accessing directory: TESTSUITE/test-mail/subdir failed with error: No such file or directory
diff --git a/test/stderr/5901 b/test/stderr/5901
new file mode 100644
index 000000000..111bae495
--- /dev/null
+++ b/test/stderr/5901
@@ -0,0 +1 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 == userx@test.ex R=scan T=scan defer (-1): scan transport directory: test-mail/subdir is not absolute
diff --git a/test/stdout/0001 b/test/stdout/0001
index d9ce2f07b..9238c91fe 100644
--- a/test/stdout/0001
+++ b/test/stdout/0001
@@ -20,3 +20,4 @@ no_tcp_nodelay
 trusted_users = 1234:5678
 unknown_login = unknownlogin
 warn_message_file = /home/exim/test/warnmsg_file
+no_syslog_pid
diff --git a/test/stdout/0002 b/test/stdout/0002
index ab59183a2..b6ca54d48 100644
--- a/test/stdout/0002
+++ b/test/stdout/0002
@@ -14,6 +14,7 @@
 > qualify_domain: myhost.test.ex
 > bounce_return_size_limit: 102400
 > spool_directory: TESTSUITE/spool
+> queue_name: 
 > Failed: unknown variable in "${unknown}"
 > h_subject: (should be empty)
 > h_subject: (should be empty)
@@ -95,8 +96,8 @@
 > 
 > # Operators
 > 
-> Failed: missing or misplaced { or }
-> Failed: missing or misplaced { or }
+> Failed: Not enough arguments for 'acl' (min is 1)
+> Failed: Not enough arguments for 'acl' (min is 1)
 > Failed: error from acl "a_nosuch"
 > acl: (0) [] []
 > acl: (1) [person@dom.ain] []
@@ -121,7 +122,10 @@
 > addresses: local-part@dom.ain:xyz@abc:p@q:r@s
 > addresses: 
 > 
-> escape: B7\267F2\362
+> escape:     B7\267F2\362
+> excape8bit: undisturbed text	tab
+newline	tab\134backslash ~tilde\177DEL\200\201.
+> 
 > eval:   2
 > eval:   7
 > eval:   9
@@ -283,9 +287,9 @@
 > 
 > # Error forms
 > 
-> Failed: missing or misplaced { or }
+> Failed: Not enough arguments for 'hash' (min is 2)
 > Failed: "nonnumber" is not a number (in "hash" expansion)
-> Failed: Too many arguments for "hash" (max is 3)
+> Failed: Too many arguments for 'hash' (max is 3)
 > Failed: "-2" is not a positive number (in "substr" expansion)
 > 
 > # Skipped operators
@@ -357,7 +361,8 @@
 > Failed: unknown variable "post" after "def:"
 > def:h_f n
 > def:h_f n
-> Failed: missing or misplaced { or }
+> Failed: curly-bracket problem in conditional yes/no parsing: 'yes' part did not start with '{'
+ remaining string is ':{y}{n}}'
 > 
 > exists: y
 > exists: n
@@ -591,6 +596,10 @@
 > Failed: first argument of "extract" must not be empty
 > b
 > 
+> a:b:c
+> Failed: missing '}' closing extract inside "map" item
+> a:b:c
+> 
 > # Translation
 > 
 > abcdea aaa xyz zbcdez
@@ -675,7 +684,7 @@
 > 
 > # File insertion
 > 
-> Failed: missing or misplaced { or }
+> Failed: Not enough arguments for 'readfile' (min is 1)
 > abcde
 12345
 
@@ -761,7 +770,8 @@ xyz
 > Failed: unknown condition "xya" inside "and{...}" condition
 > Failed: condition name expected, but found "${lookup{x}lsear" inside "and{...}" condition
 > Failed: missing } at end of string - could be header name not terminated by colon
-> Failed: missing or misplaced { or }
+> Failed: curly-bracket problem in conditional yes/no parsing: did not close with '}'
+ remaining string is ''
 > Failed: missing or misplaced { or } - could be header name not terminated by colon
 > Failed: each subcondition inside an "or{...}" condition must be in its own {}
 > Failed: missing } at end of condition inside "or" group
diff --git a/test/stdout/0021 b/test/stdout/0021
index 5fff92b0a..a48644f83 100644
--- a/test/stdout/0021
+++ b/test/stdout/0021
@@ -1,4 +1,5 @@
 550 Administrative prohibition
+550 Administrative prohibition
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 550 Administrative prohibition
 250 OK
diff --git a/test/stdout/0041 b/test/stdout/0041
index b88c93ac7..6b22865b0 100644
--- a/test/stdout/0041
+++ b/test/stdout/0041
@@ -6,6 +6,8 @@
 220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 252 Administrative prohibition
 599 custom reject
+501 unqual: recipient address must contain a domain
+501 empty address
 550 Administrative prohibition
 221 the.local.host.name closing connection
 
diff --git a/test/stdout/0099 b/test/stdout/0099
index 0f6f7f2fa..e14fa0a35 100644
--- a/test/stdout/0099
+++ b/test/stdout/0099
@@ -41,8 +41,10 @@ first failed = time last try = time2 next try = time2 + 900
   T:thisloop.test.ex:999 dd 65 Connection refused
 first failed = time last try = time2 next try = time2 + 900
 +++++++++++++++++++++++++++
-  R:mxt2.test.ex -32 0 all relevant MX records point to non-existent hosts
-first failed = time last try = time2 next try = time2 + 1800
+  R:mxnonexist.test.ex -1 0 missing MX, or all MXs point to missing A records, and defer requested
+first failed = time last try = time2 next try = time2 + 900
+  R:mxt2.test.ex -1 0 missing MX, or all MXs point to missing A records, and defer requested
+first failed = time last try = time2 next try = time2 + 900
   R:nonexist -32 0 lookup of host "nonexist.test.ex" failed in all router
 first failed = time last try = time2 next try = time2 + 1800
   T:thishost.test.ex:127.0.0.1:999 dd 65 Connection refused
diff --git a/test/stdout/0211 b/test/stdout/0211
index ebe8246b0..93e271c6a 100644
--- a/test/stdout/0211
+++ b/test/stdout/0211
@@ -36,3 +36,10 @@ HELO the.local.host.name
 QUIT
 250 OK
 End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Connected OK
+EHLO the.local.host.name
+550 You are banned
+HELO the.local.host.name
+End of script
diff --git a/test/stdout/0217 b/test/stdout/0217
index 8633a43ee..f08a3fab6 100644
--- a/test/stdout/0217
+++ b/test/stdout/0217
@@ -36,7 +36,7 @@ EHLO myhost.test.ex
 250 PIPELINING
 MAIL FROM:<CALLER@test.ex>
 250 OK
-RCPT TO:<a@test.ex>
+RCPT TO:<e@test.ex>
 250 OK
 *sleep 2
 End of script
@@ -48,9 +48,9 @@ EHLO myhost.test.ex
 250 PIPELINING
 MAIL FROM:<CALLER@test.ex>
 451 Temp error
-RCPT TO:<a@test.ex>
+RCPT TO:<h@test.ex>
 503 No sender given
-RCPT TO:<b@test.ex>
+RCPT TO:<i@test.ex>
 503 No sender given
 DATA
 503 No envelope
@@ -65,9 +65,9 @@ EHLO myhost.test.ex
 250 PIPELINING
 MAIL FROM:<CALLER@test.ex>
 550 Perm error
-RCPT TO:<a@test.ex>
+RCPT TO:<j@test.ex>
 503 No sender given
-RCPT TO:<b@test.ex>
+RCPT TO:<k@test.ex>
 503 No sender given
 DATA
 503 No envelope
@@ -82,9 +82,9 @@ EHLO myhost.test.ex
 250 PIPELINING
 MAIL FROM:<CALLER@test.ex>
 250 OK
-RCPT TO:<a@test.ex>
+RCPT TO:<l@test.ex>
 451 Temp error 1
-RCPT TO:<b@test.ex>
+RCPT TO:<m@test.ex>
 451 Temp error 2
 DATA
 503 No recipients
@@ -99,9 +99,9 @@ EHLO myhost.test.ex
 250 PIPELINING
 MAIL FROM:<CALLER@test.ex>
 250 OK
-RCPT TO:<a@test.ex>
+RCPT TO:<n@test.ex>
 551 Perm error 1
-RCPT TO:<b@test.ex>
+RCPT TO:<o@test.ex>
 551 Perm error 2
 DATA
 503 No recipients
@@ -116,9 +116,9 @@ EHLO myhost.test.ex
 250 PIPELINING
 MAIL FROM:<CALLER@test.ex>
 250 OK
-RCPT TO:<a@test.ex>
+RCPT TO:<p@test.ex>
 451 Temp error 1
-RCPT TO:<b@test.ex>
+RCPT TO:<q@test.ex>
 551 Perm error 2
 DATA
 503 No recipients
@@ -133,9 +133,9 @@ EHLO myhost.test.ex
 250 PIPELINING
 MAIL FROM:<CALLER@test.ex>
 250 OK
-RCPT TO:<a@test.ex>
+RCPT TO:<r@test.ex>
 250 OK
-RCPT TO:<b@test.ex>
+RCPT TO:<s@test.ex>
 250 OK
 DATA
 503 Sorry perm data error
@@ -150,9 +150,9 @@ EHLO myhost.test.ex
 250 PIPELINING
 MAIL FROM:<CALLER@test.ex>
 250 OK
-RCPT TO:<a@test.ex>
+RCPT TO:<t@test.ex>
 250 OK
-RCPT TO:<b@test.ex>
+RCPT TO:<u@test.ex>
 250 OK
 DATA
 403 Sorry temp data error
diff --git a/test/stdout/0227 b/test/stdout/0227
index 46057c824..d63f14e90 100644
--- a/test/stdout/0227
+++ b/test/stdout/0227
@@ -79,6 +79,15 @@
 550 Sender verify failed
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello root at me [V4NET.0.0.6]
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 250 OK
 550-Callout verification failed:
 550 550 Recipient not liked
@@ -238,6 +247,20 @@ End of script
 Listening on port 1224 ... 
 Connection request from [127.0.0.1]
 220 Server ready
+EHLO myhost.test.ex
+250- wotcher
+250-SIZE
+250 OK
+MAIL FROM:<>
+250 OK
+RCPT TO:<ok@localhost1>
+250 OK
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Server ready
 LHLO myhost.test.ex
 250 OK
 MAIL FROM:<>
diff --git a/test/stdout/0314 b/test/stdout/0314
index b6b0ef461..f486d8f65 100644
--- a/test/stdout/0314
+++ b/test/stdout/0314
@@ -1,13 +1,12 @@
-
-**** SMTP testing session as if from host V4NET.0.0.1
-**** but without any ident (RFC 1413) callback.
-**** This is not for real!
-
-554 SMTP service not available
-
-**** SMTP testing session as if from host V4NET.0.0.2
-**** but without any ident (RFC 1413) callback.
-**** This is not for real!
-
-220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-421 the.local.host.name lost input connection
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 554
+<<< 554 SMTP service not available
+End of script
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+??? 220
+<<< 220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 554
+<<< 554 SMTP service not available
+End of script
diff --git a/test/stdout/0322 b/test/stdout/0322
index 7bf7be255..01894f128 100644
--- a/test/stdout/0322
+++ b/test/stdout/0322
@@ -13,7 +13,8 @@ RCPT TO:<x@test.ex>
 250 Recipient OK
 DATA
 >
-Unexpected EOF read from client
+Expected EOF read from client
+End of script
 Listening on port 1224 ... 
 Connection request from [127.0.0.1]
 220 ESMTP
@@ -26,8 +27,8 @@ MAIL FROM:<CALLER@myhost.test.ex>
 RCPT TO:<x@test.ex>
 >
 DATA
-550 Failed DATA
-Unexpected EOF read from client
+Expected EOF read from client
+End of script
 Listening on port 1224 ... 
 Connection request from [127.0.0.1]
 220 ESMTP
@@ -40,8 +41,8 @@ MAIL FROM:<CALLER@myhost.test.ex>
 RCPT TO:<x@test.ex>
 550 Can't send RCPT
 DATA
-550 Can't send DATA
-Unexpected EOF read from client
+Expected EOF read from client
+End of script
 Listening on port 1224 ... 
 Connection request from [127.0.0.1]
 220 ESMTP
@@ -59,8 +60,8 @@ RCPT TO:<y@test.ex>
 RCPT TO:<z@test.ex>
 250 Third RCPT OK
 DATA
-550 Failed DATA
-Unexpected EOF read from client
+Expected EOF read from client
+End of script
 Listening on port 1224 ... 
 Connection request from [127.0.0.1]
 220 ESMTP
@@ -91,7 +92,8 @@ RCPT TO:<x@test.ex>
 250 Recipient OK
 DATA
 >
-Unexpected EOF read from client
+Expected EOF read from client
+End of script
 Listening on port 1224 ... 
 Connection request from [127.0.0.1]
 220 ESMTP
@@ -102,7 +104,8 @@ MAIL FROM:<CALLER@myhost.test.ex>
 250 Sender OK
 RCPT TO:<x@test.ex>
 >
-Unexpected EOF read from client
+Expected EOF read from client
+End of script
 Listening on port 1224 ... 
 Connection request from [127.0.0.1]
 220 ESMTP
@@ -111,7 +114,8 @@ EHLO myhost.test.ex
 250 HELP
 MAIL FROM:<CALLER@myhost.test.ex>
 >
-Unexpected EOF read from client
+Expected EOF read from client
+End of script
 Listening on port 1224 ... 
 Connection request from [127.0.0.1]
 220 ESMTP
@@ -125,4 +129,5 @@ RCPT TO:<x@test.ex>
 RCPT TO:<y@test.ex>
 >
 250 Second RCPT malformed
-Unexpected EOF read from client
+Expected EOF read from client
+End of script
diff --git a/test/stdout/0420 b/test/stdout/0420
index 56c57b692..1d78c1d2d 100644
--- a/test/stdout/0420
+++ b/test/stdout/0420
@@ -1,21 +1,36 @@
-
-**** SMTP testing session as if from host V4NET.0.0.0
-**** but without any ident (RFC 1413) callback.
-**** This is not for real!
-
-220 mail.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250 OK
-250 Accepted
-354 Enter message, ending with "." on a line by itself
-250 OK id=10HmaX-0005vi-00
-
-**** SMTP testing: that is not a real message id!
-
-250 OK
-250 Accepted
-354 Enter message, ending with "." on a line by itself
-250 OK id=10HmaY-0005vi-00
-
-**** SMTP testing: that is not a real message id!
-
-221 mail.test.ex closing connection
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 mail.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> helo client.test.ex
+??? 250
+<<< 250 mail.test.ex Hello client.test.ex [127.0.0.1]
+>>> mail from:<x@y>
+??? 250
+<<< 250 OK
+>>> rcpt to:<x@y>
+??? 250
+<<< 250 Accepted
+>>> data
+??? 354
+<<< 354 Enter message, ending with "." on a line by itself
+>>> Message.
+>>> .
+??? 250
+<<< 250 OK id=10HmaX-0005vi-00
+>>> mail from:<a@b>
+??? 250
+<<< 250 OK
+>>> rcpt to:<x@y>
+??? 250
+<<< 250 Accepted
+>>> data
+??? 354
+<<< 354 Enter message, ending with "." on a line by itself
+>>> Message.
+>>> .
+??? 250
+<<< 250 OK id=10HmaY-0005vi-00
+>>> quit
+??? 221
+<<< 221 mail.test.ex closing connection
+End of script
diff --git a/test/stdout/0502 b/test/stdout/0502
index a0fbe6b00..edb6d3156 100644
--- a/test/stdout/0502
+++ b/test/stdout/0502
@@ -19,3 +19,23 @@
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 250 OK
 221 myhost.test.ex closing connection
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO test.ex
+??? 250-
+<<< 250-myhost.test.ex Hello test.ex [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250 HELP
+<<< 250 HELP
+>>> QUIT
+??? 221
+<<< 221 myhost.test.ex closing connection
+???*eof
+Expected EOF read
+End of script
diff --git a/test/stdout/0547 b/test/stdout/0547
index 7e931992c..418ddc4ba 100644
--- a/test/stdout/0547
+++ b/test/stdout/0547
@@ -61,31 +61,31 @@ End of script
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 550 Administrative prohibition
@@ -100,15 +100,15 @@ End of script
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 250 Reset OK
 250 OK
 214-Commands supported:
-214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 250 Reset OK
 250 OK
 554 Too many nonmail commands
diff --git a/test/stdout/0557 b/test/stdout/0557
index 6a6bde9a4..63e22524b 100644
--- a/test/stdout/0557
+++ b/test/stdout/0557
@@ -1,4 +1,4 @@
-userx@test.ex cannot be resolved at this time: error in r1 router: no host(s) specified for domain *
+userx@test.ex cannot be resolved at this time: error in r1 router: no host(s) specified for domain test.ex
 userx@test.ex cannot be resolved at this time: lookup failed for all hosts in r1 router: host_find_failed=ignore host_all_ignored=defer
 userx@test.ex cannot be resolved at this time: lookup failed for all hosts in r1 router: host_find_failed=ignore host_all_ignored=defer
 userx@test.ex
diff --git a/test/stdout/0564 b/test/stdout/0564
index 6f4f06bdb..33492a729 100644
--- a/test/stdout/0564
+++ b/test/stdout/0564
@@ -1,4 +1,4 @@
-Connecting to 127.0.0.1 port 1225 ... connected
+Connecting to 127.0.0.1 port <dynamic port> ... connected
 ??? 220
 <<< 220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 >>> ehlo abcd
diff --git a/test/stdout/0572 b/test/stdout/0572
index 240a2332a..d50a643b4 100644
--- a/test/stdout/0572
+++ b/test/stdout/0572
@@ -57,6 +57,8 @@ no_hosts_override
 no_hosts_randomize
 hosts_require_auth = 
 hosts_try_auth = 
+hosts_try_chunking = *
+hosts_try_fastopen = 
 hosts_try_prdr = *
 interface = ip4.ip4.ip4.ip4
 keepalive
@@ -68,18 +70,25 @@ protocol = smtp
 retry_include_ip_address
 serialize_hosts = 
 size_addition = 1024
-socks_proxy = 127.0.0.1 port=1225
 
 # Exim Configuration (X)
 # 1 "TESTSUITE/test-config"
 OPT =
+# 5 "TESTSUITE/test-config"
+# 1 "TESTSUITE/aux-var/std_conf_prefix"
+# 1 "TESTSUITE/aux-var/std_conf_prefix"
+# 1 "TESTSUITE/aux-var/tls_conf_prefix"
 exim_path = TESTSUITE/eximdir/exim
-hide host_lookup_order = bydns
-primary_hostname = myhost.test.ex
+keep_environment =
+host_lookup_order = bydns
 spool_directory = TESTSUITE/spool
 log_file_path = TESTSUITE/spool/log/%slog
 gecos_pattern = ""
 gecos_name = CALLER_NAME
+chunking_advertise_hosts =
+# 1 "TESTSUITE/aux-var/std_conf_prefix"
+# 5 "TESTSUITE/test-config"
+primary_hostname = myhost.test.ex
 log_selector = +outgoing_port
 domainlist local_domains = test.ex : *.test.ex
 acl_smtp_rcpt = accept
@@ -91,7 +100,7 @@ begin routers
     route_list = * 127.0.0.1
     self = send
     transport = my_smtp
-    debug_print = router_name <$router_name>
+    hide debug_print = router_name <$router_name>
     no_more
 
 begin transports
@@ -100,5 +109,39 @@ begin transports
     driver = smtp
     interface = ip4.ip4.ip4.ip4
     port = 1224
-    hide socks_proxy = 127.0.0.1 port=1225
     debug_print = transport_name <$transport_name>
+# Exim Configuration (X)
+# 1 "TESTSUITE/test-config"
+OPT =
+# 5 "TESTSUITE/test-config"
+# 1 "TESTSUITE/aux-var/std_conf_prefix"
+# 1 "TESTSUITE/aux-var/std_conf_prefix"
+# 1 "TESTSUITE/aux-var/tls_conf_prefix"
+exim_path = TESTSUITE/eximdir/exim
+keep_environment =
+host_lookup_order = bydns
+spool_directory = TESTSUITE/spool
+log_file_path = TESTSUITE/spool/log/%slog
+gecos_pattern = ""
+gecos_name = CALLER_NAME
+chunking_advertise_hosts =
+# 1 "TESTSUITE/aux-var/std_conf_prefix"
+# 5 "TESTSUITE/test-config"
+primary_hostname = myhost.test.ex
+log_selector = +outgoing_port
+domainlist local_domains = test.ex : *.test.ex
+acl_smtp_rcpt = accept
+begin routers
+my_main_router:
+driver = manualroute
+route_list = * 127.0.0.1
+self = send
+transport = my_smtp
+hide debug_print = router_name <$router_name>
+no_more
+begin transports
+my_smtp:
+driver = smtp
+interface = ip4.ip4.ip4.ip4
+port = 1224
+debug_print = transport_name <$transport_name>
diff --git a/test/stdout/0574 b/test/stdout/0574
new file mode 100644
index 000000000..08aacb17c
--- /dev/null
+++ b/test/stdout/0574
@@ -0,0 +1,62 @@
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO test.ex
+??? 250-
+<<< 250-myhost.test.ex Hello test.ex [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250 
+<<< 250 HELP
+>>> MAIL FROM:<tester@test.ex>
+??? 250
+<<< 250 OK
+>>> RCPT TO:<dest@test.ex>
+??? 250
+<<< 250 Accepted
+>>> DATA
+??? 354
+<<< 354 Enter message, ending with "." on a line by itself
+>>> Subject: test
+>>> 
+>>> body
+>>> .
+??? 250
+<<< 250 OK id=10HmaX-0005vi-00
+>>> QUIT
+??? 221
+<<< 221 myhost.test.ex closing connection
+End of script
+accept: condition test succeeded in ACL "chk_data"
+end of ACL "chk_data": ACCEPT
+calling local_scan(); timeout=300
+local_scan() returned 0 NULL
+considering: ${tod_full}
+  expanding: ${tod_full}
+     result: Tue, 2 Mar 1999 09:44:33 +0000
+Writing spool header file: TESTSUITE/spool//input//hdr.pppp
+DSN: Write SPOOL :-dsn_envid NULL
+DSN: Write SPOOL :-dsn_ret 0
+DSN: Flags :0
+DSN: **** SPOOL_OUT - address: |dest@test.ex| errorsto: |NULL| orcpt: |NULL| dsn_flags: 0
+Renaming spool header file: TESTSUITE/spool//input//10HmaX-0005vi-00-H
+Size of headers = sss
+LOG: MAIN
+  <= tester@test.ex H=(test.ex) [127.0.0.1] P=esmtp S=sss
+SMTP>> 250 OK id=10HmaX-0005vi-00
+search_tidyup called
+Sender: tester@test.ex
+Recipients:
+  dest@test.ex
+Process pppp is ready for new message
+smtp_setup_msg entered
+SMTP<< QUIT
+SMTP>> 221 myhost.test.ex closing connection
+LOG: smtp_connection MAIN
+  SMTP connection from (test.ex) [127.0.0.1] closed by QUIT
+search_tidyup called
+SMTP>>(close on process exit)
diff --git a/test/stdout/0575 b/test/stdout/0575
new file mode 100644
index 000000000..d7ad1f324
--- /dev/null
+++ b/test/stdout/0575
@@ -0,0 +1,14 @@
+
+**** SMTP testing session as if from host V4NET.0.0.0
+**** but without any ident (RFC 1413) callback.
+**** This is not for real!
+
+220 mail.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaX-0005vi-00
+
+**** SMTP testing: that is not a real message id!
+
+221 mail.test.ex closing connection
diff --git a/test/stdout/0576 b/test/stdout/0576
new file mode 100644
index 000000000..527865b62
--- /dev/null
+++ b/test/stdout/0576
@@ -0,0 +1,23 @@
+220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaX-0005vi-00
+250 Reset OK
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaY-0005vi-00
+221 the.local.host.name closing connection
+220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaZ-0005vi-00
+221 the.local.host.name closing connection
+220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmbA-0005vi-00
+221 the.local.host.name closing connection
diff --git a/test/stdout/0610 b/test/stdout/0610
index 24291b53f..7fceba939 100644
--- a/test/stdout/0610
+++ b/test/stdout/0610
@@ -12,5 +12,5 @@
 +++++++++++++++++++++++++++
   T:127.0.0.1:127.0.0.1:1225/127.0.0.1 0 65 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after initial connection: 451 Temporary local problem - please try later
 first failed = time last try = time2 next try = time2 + 10
-  T:127.0.0.1:127.0.0.1:1225/127.0.0.2 0 65 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after initial connection: 451 Temporary local problem - please try later
+  T:127.0.0.1:127.0.0.1:1225/ip4.ip4.ip4.ip4 0 65 H=127.0.0.1 [127.0.0.1]: SMTP error from remote mail server after initial connection: 451 Temporary local problem - please try later
 first failed = time last try = time2 next try = time2 + 10
diff --git a/test/stdout/0900 b/test/stdout/0900
new file mode 100644
index 000000000..70c527c17
--- /dev/null
+++ b/test/stdout/0900
@@ -0,0 +1,298 @@
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo tester
+??? 250-
+<<< 250-testhost.test.ex Hello tester [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250 HELP
+<<< 250 HELP
+>>> mail from:someone@some.domain
+??? 250
+<<< 250 OK
+>>> rcpt to:CALLER@test.ex
+??? 250
+<<< 250 Accepted
+>>> bdat 88 last
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250-
+<<< 250- 88 byte chunk, total 88
+??? 250
+<<< 250 OK id=10HmaX-0005vi-00
+>>> quit
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo tester
+??? 250-
+<<< 250-testhost.test.ex Hello tester [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-CHUNKING
+??? 250 
+<<< 250 HELP
+>>> mail from:someone@some.domain
+??? 250
+<<< 250 OK
+>>> rcpt to:CALLER@test.ex
+??? 250
+<<< 250 Accepted
+>>> bdat 100
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyfull test message
+>>> 
+>>> 1234567890
+??? 250
+<<< 250 100 byte chunk received
+>>> noop
+??? 250
+<<< 250 OK
+>>> bdat 0 last
+??? 250-
+<<< 250- 0 byte chunk, total 100
+??? 250
+<<< 250 OK id=10HmaY-0005vi-00
+>>> mail from:someone@some.domain
+??? 250
+<<< 250 OK
+>>> rcpt to:CALLER@test.ex
+??? 250
+<<< 250 Accepted
+>>> bdat 10
+>>> To: Susan@bdat 78 last
+??? 250
+<<< 250 10 byte chunk received
+>>> random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250-
+<<< 250- 78 byte chunk, total 88
+??? 250
+<<< 250 OK id=10HmaZ-0005vi-00
+>>> quit
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo tester
+??? 250-
+<<< 250-testhost.test.ex Hello tester [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-CHUNKING
+??? 250 
+<<< 250 HELP
+>>> mail from:someone@some.domain
+??? 250
+<<< 250 OK
+>>> rcpt to:CALLER@test.ex
+??? 250
+<<< 250 Accepted
+>>> bdat 89 last
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 421
+<<< 421 testhost.test.ex SMTP incoming data timeout - closing connection.
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo tester
+??? 250-
+<<< 250-testhost.test.ex Hello tester [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-CHUNKING
+??? 250 
+<<< 250 HELP
+>>> mail from:someone@some.domain
+??? 250
+<<< 250 OK
+>>> rcpt to:CALLER@test.ex
+??? 250
+<<< 250 Accepted
+>>> bdat 88
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250
+<<< 250 88 byte chunk received
+>>> bdat 0
+??? 504
+<<< 504 zero size for BDAT command
+>>> quit
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo tester
+??? 250-
+<<< 250-testhost.test.ex Hello tester [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-CHUNKING
+??? 250 
+<<< 250 HELP
+>>> mail from:someone@some.domain
+??? 250
+<<< 250 OK
+>>> rcpt to:CALLER@test.ex
+??? 250
+<<< 250 Accepted
+>>> bdat 88
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250
+<<< 250 88 byte chunk received
+>>> data
+??? 503
+<<< 503 only BDAT permissible after non-LAST BDAT
+>>> RSET
+??? 250
+<<< 250 Reset OK
+>>> EHLO tester
+??? 250-
+<<< 250-testhost.test.ex Hello tester [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-CHUNKING
+??? 250 
+<<< 250 HELP
+>>> mail from:someone@some.domain
+??? 250
+<<< 250 OK
+>>> rcpt to:CALLER@test.ex
+??? 250
+<<< 250 Accepted
+>>> bdat 88
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250
+<<< 250 88 byte chunk received
+>>> data
+??? 503
+<<< 503 only BDAT permissible after non-LAST BDAT
+>>> data
+??? 503
+<<< 503 only RSET accepted now
+>>> quit
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO tester
+??? 250-
+<<< 250-testhost.test.ex Hello tester [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250 HELP
+<<< 250 HELP
+>>> MAIL FROM:<someone@some.domain>\r\nRCPT TO:<CALLER@test.ex>\r\nBDAT 88 LAST\r\nTo: Susan@random.com\r\nFrom: Sam@random.com\r\nSubject: This is a bodyless test message\r\n
+??? 250
+<<< 250 OK
+??? 250
+<<< 250 Accepted
+??? 250-
+<<< 250- 88 byte chunk, total 88
+??? 250
+<<< 250 OK id=10HmbB-0005vi-00
+>>> quit
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO tester
+??? 250-
+<<< 250-testhost.test.ex Hello tester [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250 HELP
+<<< 250 HELP
+>>> MAIL FROM:<someone@some.domain>\r\nRCPT TO:<dummy@reject.ex>\r\nBDAT 86\r\nTo: Susan@random.com\r\nFrom: Sal@random.com\r\nSubject: This is a bodyless test message\r\nBDAT 6 LAST\r\nZZ\r\n
+??? 250
+<<< 250 OK
+??? 550
+<<< 550 relay not permitted
+??? 503-
+<<< 503-All RCPT commands were rejected with this error:
+??? 503-
+<<< 503-relay not permitted
+??? 503
+<<< 503 Valid RCPT command must precede BDAT
+??? 503-
+<<< 503-All RCPT commands were rejected with this error:
+??? 503-
+<<< 503-relay not permitted
+??? 503
+<<< 503 valid RCPT command must precede BDAT
+>>> quit
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
diff --git a/test/stdout/0901 b/test/stdout/0901
new file mode 100644
index 000000000..a19787d12
--- /dev/null
+++ b/test/stdout/0901
@@ -0,0 +1,199 @@
+
+******** SERVER ********
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250 CHUNKING
+MAIL FROM:<>
+250 OK
+RCPT TO:<a@test.ex>
+250 OK
+BDAT 329 LAST
+250 OK
+QUIT
+225 OK
+Expected EOF read from client
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250 CHUNKING
+MAIL FROM:<>
+250 good mail cmd
+RCPT TO:<b@test.ex>
+250 acceptable rcpt cmd
+BDAT 329 LAST
+Unxpected EOF read from client
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250 CHUNKING
+MAIL FROM:<>
+250 OK
+RCPT TO:<c@test.ex>
+250 OK
+BDAT 329 LAST
+250 OK
+
+Comparison failed - bailing out
+Expected: QUIT
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250 CHUNKING
+MAIL FROM:<>
+250 OK
+RCPT TO:<d@test.ex>
+250 OK
+BDAT 329 LAST
+500 oops
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250 CHUNKING
+MAIL FROM:<>
+250 OK
+RCPT TO:<e@test.ex>
+250 OK
+BDAT 329 LAST
+400 not right now
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<p@test.ex>
+BDAT 329 LAST
+250 OK mail
+250 OK rcpt
+250 OK bdat
+QUIT
+225 OK
+Expected EOF read from client
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<q@test.ex>
+BDAT 329 LAST
+Unxpected EOF read from client
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<r@test.ex>
+BDAT 329 LAST
+250 OK mail
+250 OK rcpt
+250 OK bdat
+
+Comparison failed - bailing out
+Expected: QUIT
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<s@test.ex>
+BDAT 329 LAST
+550 unacceptable mail-from
+550 rcpt ungood lacking mail-from
+500 bdat ungood lacking mail-from
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<s1@test.ex>
+BDAT 330 LAST
+450 greylisted mail-from
+550 rcpt ungood lacking mail-from
+500 bdat ungood lacking mail-from
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<t@test.ex>
+BDAT 329 LAST
+250 OK mail
+550 no such recipient
+500 oops bdat
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<u@test.ex>
+BDAT 329 LAST
+250 OK mail
+250 OK rcpt
+500 oops bdat
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<v@test.ex>
+BDAT 329 LAST
+250 OK mail
+250 OK rcpt
+400 not right now bdat
+QUIT
+225 OK
+End of script
diff --git a/test/stdout/0902 b/test/stdout/0902
new file mode 100644
index 000000000..22d02212e
--- /dev/null
+++ b/test/stdout/0902
@@ -0,0 +1,159 @@
+
+******** SERVER ********
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250 CHUNKING
+MAIL FROM:<>
+250 OK
+RCPT TO:<a@test.ex>
+250 OK
+BDAT 295
+250 OK nonlast bdat
+BDAT 8380 LAST
+250 OK bdat
+QUIT
+225 OK
+Expected EOF read from client
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250 CHUNKING
+MAIL FROM:<>
+250 OK
+RCPT TO:<d@test.ex>
+250 OK
+BDAT 295
+500 oops bdat-nonlast
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<p@test.ex>
+BDAT 295
+250 OK mail
+250 OK rcpt
+250 OK nonlast bdat
+BDAT 8380 LAST
+250 OK bdat
+QUIT
+225 OK
+Expected EOF read from client
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<s@test.ex>
+BDAT 295
+550 unacceptable mail-from
+550 rcpt ungood lacking mail-from
+500 bdat (nonlast) ungood lacking mail-from
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<t@test.ex>
+BDAT 295
+250 OK mail
+550 no such recipient
+500 oops nonlast bdat - no rcpt
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<t1@test.ex>
+RCPT TO:<t2@test.ex>
+BDAT 279
+250 OK mail
+550 no such recipient
+250 good recipient
+200 OK nonlast bdat
+BDAT 8380 LAST
+250 OK bdat
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<u@test.ex>
+BDAT 295
+250 OK mail
+250 OK rcpt
+500 oops nonlast bdat
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<v@test.ex>
+BDAT 295
+250 OK mail
+250 OK rcpt
+250 OK nonlast bdat
+BDAT 8380 LAST
+500 oops bdat
+QUIT
+225 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Greetings
+EHLO testhost.test.ex
+250-Hello there
+250-PIPELINING
+250 CHUNKING
+MAIL FROM:<>
+RCPT TO:<p@test.ex>
+BDAT 8191
+250 OK mail
+250 OK rcpt
+250 OK nonlast bdat
+BDAT 807 LAST
+250 OK bdat
+QUIT
+225 OK
+Expected EOF read from client
+End of script
diff --git a/test/stdout/2000 b/test/stdout/2000
new file mode 100644
index 000000000..2279f2e7d
--- /dev/null
+++ b/test/stdout/2000
@@ -0,0 +1,10 @@
+> sha256:   E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
+> sha256:   BA7816BF8F01CFEA414140DE5DAE2223B00361A396177A9CB410FF61F20015AD
+> 
+> Failed: sha3 only supported with GnuTLS 3.5.0 +
+> Failed: sha3 only supported with GnuTLS 3.5.0 +
+> Failed: sha3 only supported with GnuTLS 3.5.0 +
+> Failed: sha3 only supported with GnuTLS 3.5.0 +
+> Failed: sha3 only supported with GnuTLS 3.5.0 +
+> Failed: sha3 only supported with GnuTLS 3.5.0 +
+> 
diff --git a/test/stdout/2002 b/test/stdout/2002
index ec3c1f954..7fd17f029 100644
--- a/test/stdout/2002
+++ b/test/stdout/2002
@@ -94,6 +94,7 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
+A TLS fatal alert has been received.
 Failed to start TLS
 End of script
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
diff --git a/test/stdout/2014 b/test/stdout/2014
index 56c959f20..c7aab62f1 100644
--- a/test/stdout/2014
+++ b/test/stdout/2014
@@ -18,6 +18,7 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 ??? 220
 <<< 220 TLS go ahead
 Attempting to start TLS
+A TLS fatal alert has been received.
 Failed to start TLS
 End of script
 Connecting to 127.0.0.1 port 1225 ... connected
diff --git a/test/stdout/2015 b/test/stdout/2015
index fd6174058..42fe5c0fd 100644
--- a/test/stdout/2015
+++ b/test/stdout/2015
@@ -21,3 +21,23 @@ Connecting to 127.0.0.1 port 1225 ... connected
 ??? 421
 <<< 421 myhost.test.ex: SMTP command timeout - closing connection
 End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-myhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+End of script
diff --git a/test/stdout/2022 b/test/stdout/2022
index c6124c698..3f280e0d5 100644
--- a/test/stdout/2022
+++ b/test/stdout/2022
@@ -23,7 +23,7 @@ Succeeded in starting TLS
 ??? 214-
 <<< 214-Commands supported:
 ??? 214
-<<< 214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+<<< 214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
diff --git a/test/stdout/2034 b/test/stdout/2034
new file mode 100644
index 000000000..94531616d
--- /dev/null
+++ b/test/stdout/2034
@@ -0,0 +1,42 @@
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-myhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
++++ 3
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-myhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+>>> bogus
+End of script
diff --git a/test/stdout/2090 b/test/stdout/2090
new file mode 100644
index 000000000..7bf70310a
--- /dev/null
+++ b/test/stdout/2090
@@ -0,0 +1,110 @@
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250-STARTTLS
+<<< 250-STARTTLS
+??? 250 HELP
+<<< 250 HELP
+>>> STARTTLS
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+Succeeded in starting TLS
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250 HELP
+<<< 250 HELP
+>>> MAIL FROM:<someone@some.domain>
+??? 250
+<<< 250 OK
+>>> RCPT TO:<CALLER@test.ex>
+??? 250
+<<< 250 Accepted
+>>> BDAT 88 LAST
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250-
+<<< 250- 88 byte chunk, total 88
+??? 250
+<<< 250 OK id=10HmaX-0005vi-00
+>>> QUIT
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250-STARTTLS
+<<< 250-STARTTLS
+??? 250 HELP
+<<< 250 HELP
+>>> STARTTLS
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+Succeeded in starting TLS
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250 HELP
+<<< 250 HELP
+>>> MAIL FROM:<someone@some.domain>
+>>> RCPT TO:<CALLER@test.ex>
+>>> BDAT 88 LAST
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250
+<<< 250 OK
+??? 250
+<<< 250 Accepted
+??? 250-
+<<< 250- 88 byte chunk, total 88
+??? 250
+<<< 250 OK id=10HmaY-0005vi-00
+>>> QUIT
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
diff --git a/test/stdout/2100 b/test/stdout/2100
new file mode 100644
index 000000000..effaada83
--- /dev/null
+++ b/test/stdout/2100
@@ -0,0 +1,3 @@
+> sha256: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
+> sha256: BA7816BF8F01CFEA414140DE5DAE2223B00361A396177A9CB410FF61F20015AD
+> 
diff --git a/test/stdout/2102.debian8 b/test/stdout/2102.debian8
index 826b18ccd..e512c398b 100644
--- a/test/stdout/2102.debian8
+++ b/test/stdout/2102.debian8
@@ -106,7 +106,7 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-pppp:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:dddd:SSL alert number 40
+pppp:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:dddd:SSL alert number 40
 Failed to start TLS
 End of script
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
diff --git a/test/stdout/2114.debian8 b/test/stdout/2114.debian8
index 6854fc681..b02d2dd7c 100644
--- a/test/stdout/2114.debian8
+++ b/test/stdout/2114.debian8
@@ -20,7 +20,7 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-pppp:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:dddd:SSL alert number 40
+pppp:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:dddd:SSL alert number 40
 Failed to start TLS
 End of script
 Connecting to 127.0.0.1 port 1225 ... connected
@@ -162,7 +162,7 @@ Key file = aux-fixed/cert1
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-pppp:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:dddd:SSL alert number 48
+pppp:error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:s3_pkt.c:dddd:SSL alert number 48
 Failed to start TLS
 End of script
 Connecting to 127.0.0.1 port 1225 ... connected
@@ -229,7 +229,7 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-pppp:error:14094414:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate revoked:s3_pkt.c:dddd:SSL alert number 44
+pppp:error:14094414:SSL routines:ssl3_read_bytes:sslv3 alert certificate revoked:s3_pkt.c:dddd:SSL alert number 44
 Failed to start TLS
 End of script
 Connecting to 127.0.0.1 port 1225 ... connected
diff --git a/test/stdout/2122 b/test/stdout/2122
index 76433323a..55feb8f41 100644
--- a/test/stdout/2122
+++ b/test/stdout/2122
@@ -37,7 +37,7 @@ Succeeded in starting TLS
 ??? 214-
 <<< 214-Commands supported:
 ??? 214
-<<< 214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+<<< 214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
diff --git a/test/stdout/2122.debian8 b/test/stdout/2122.debian8
index c39410651..c44db97c7 100644
--- a/test/stdout/2122.debian8
+++ b/test/stdout/2122.debian8
@@ -28,7 +28,7 @@ Succeeded in starting TLS
 ??? 214-
 <<< 214-Commands supported:
 ??? 214
-<<< 214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+<<< 214 AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
 >>> quit
 ??? 221
 <<< 221 myhost.test.ex closing connection
diff --git a/test/stdout/2124.debian8 b/test/stdout/2124.debian8
index 0fe2d5f63..c7fef405d 100644
--- a/test/stdout/2124.debian8
+++ b/test/stdout/2124.debian8
@@ -22,7 +22,7 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-pppp:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:dddd:SSL alert number 48
+pppp:error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca:s3_pkt.c:dddd:SSL alert number 48
 Failed to start TLS
 End of script
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
diff --git a/test/stdout/2132.debian8 b/test/stdout/2132.debian8
index 99cee1645..3744d44b9 100644
--- a/test/stdout/2132.debian8
+++ b/test/stdout/2132.debian8
@@ -106,7 +106,7 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-pppp:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:dddd:SSL alert number 40
+pppp:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:s3_pkt.c:dddd:SSL alert number 40
 Failed to start TLS
 End of script
 Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
diff --git a/test/stdout/2190 b/test/stdout/2190
new file mode 100644
index 000000000..c1ee9ffcf
--- /dev/null
+++ b/test/stdout/2190
@@ -0,0 +1,138 @@
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250-STARTTLS
+<<< 250-STARTTLS
+??? 250 HELP
+<<< 250 HELP
+>>> STARTTLS
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSLv3 read server hello A
+SSL info: SSLv3 read server certificate A
+SSL info: SSLv3 read server done A
+SSL info: SSLv3 write client key exchange A
+SSL info: SSLv3 write change cipher spec A
+SSL info: SSLv3 write finished A
+SSL info: SSLv3 flush data
+SSL info: SSLv3 read server session ticket A
+SSL info: SSLv3 read finished A
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250 HELP
+<<< 250 HELP
+>>> MAIL FROM:<someone@some.domain>
+??? 250
+<<< 250 OK
+>>> RCPT TO:<CALLER@test.ex>
+??? 250
+<<< 250 Accepted
+>>> BDAT 88 LAST
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250-
+<<< 250- 88 byte chunk, total 88
+??? 250
+<<< 250 OK id=10HmaX-0005vi-00
+>>> QUIT
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250-STARTTLS
+<<< 250-STARTTLS
+??? 250 HELP
+<<< 250 HELP
+>>> STARTTLS
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSLv3 read server hello A
+SSL info: SSLv3 read server certificate A
+SSL info: SSLv3 read server done A
+SSL info: SSLv3 write client key exchange A
+SSL info: SSLv3 write change cipher spec A
+SSL info: SSLv3 write finished A
+SSL info: SSLv3 flush data
+SSL info: SSLv3 read server session ticket A
+SSL info: SSLv3 read finished A
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250 HELP
+<<< 250 HELP
+>>> MAIL FROM:<someone@some.domain>
+>>> RCPT TO:<CALLER@test.ex>
+>>> BDAT 88 LAST
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250
+<<< 250 OK
+??? 250
+<<< 250 Accepted
+??? 250-
+<<< 250- 88 byte chunk, total 88
+??? 250
+<<< 250 OK id=10HmaY-0005vi-00
+>>> QUIT
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
diff --git a/test/stdout/2190.debian8 b/test/stdout/2190.debian8
new file mode 100644
index 000000000..2bb8156ce
--- /dev/null
+++ b/test/stdout/2190.debian8
@@ -0,0 +1,120 @@
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250-STARTTLS
+<<< 250-STARTTLS
+??? 250 HELP
+<<< 250 HELP
+>>> STARTTLS
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250 HELP
+<<< 250 HELP
+>>> MAIL FROM:<someone@some.domain>
+??? 250
+<<< 250 OK
+>>> RCPT TO:<CALLER@test.ex>
+??? 250
+<<< 250 Accepted
+>>> BDAT 88 LAST
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250-
+<<< 250- 88 byte chunk, total 88
+??? 250
+<<< 250 OK id=10HmaX-0005vi-00
+>>> QUIT
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250-STARTTLS
+<<< 250-STARTTLS
+??? 250 HELP
+<<< 250 HELP
+>>> STARTTLS
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> EHLO rhu.barb
+??? 250-
+<<< 250-testhost.test.ex Hello rhu.barb [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250 HELP
+<<< 250 HELP
+>>> MAIL FROM:<someone@some.domain>
+>>> RCPT TO:<CALLER@test.ex>
+>>> BDAT 88 LAST
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyless test message
+>>> 
+??? 250
+<<< 250 OK
+??? 250
+<<< 250 Accepted
+??? 250-
+<<< 250- 88 byte chunk, total 88
+??? 250
+<<< 250 OK id=10HmaY-0005vi-00
+>>> QUIT
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
diff --git a/test/stdout/2800 b/test/stdout/2800
new file mode 100644
index 000000000..30e14b09d
--- /dev/null
+++ b/test/stdout/2800
@@ -0,0 +1,9 @@
+> data for first
+> data for first
+> failure value
+> Failed: "lookup" failed and "fail" requested
+> A=1 B=2
+> 1
+> 2
+> Failed: "extract" failed and "fail" requested
+> 
diff --git a/test/stdout/3000 b/test/stdout/3000
index ad21103b3..ca7b094e6 100644
--- a/test/stdout/3000
+++ b/test/stdout/3000
@@ -10,9 +10,9 @@
 > Failed: syntax error in Exim::expand_string argument: unknown variable name "notexists" at TESTSUITE/aux-fixed/3000.pl line 9.
 
 > 
-> Failed: missing or misplaced { or }
+> Failed: Not enough arguments for 'perl' (min is 1)
 > Subroutine foo called with args: 1 2 3 4 5 6 7 8
-> Failed: Too many arguments for "perl" (max is 9)
+> Failed: Too many arguments for 'perl' (max is 9)
 > 
 > 42
 > 30
diff --git a/test/stdout/3001 b/test/stdout/3001
index 6506cb3d7..58d5d0e37 100644
--- a/test/stdout/3001
+++ b/test/stdout/3001
@@ -1 +1,4 @@
-OFF
+keep_environment = 
+add_environment = 
+Environment visible in Perl:
+
diff --git a/test/stdout/3002 b/test/stdout/3002
index 76371f28f..8ba67bb34 100644
--- a/test/stdout/3002
+++ b/test/stdout/3002
@@ -1 +1,19 @@
-ON
+keep_environment = ^FOO\d : BAR
+add_environment = ADDED1=added1 : ADDED2=added2
+ADDED1=added1
+ADDED2=added2
+BAR=bar
+FOO1=foo1
+FOO2=foo2
+ADDED1
+ADDED2
+BAR
+FOO1
+FOO2
+Environment visible in Perl:
+ADDED1=added1
+ADDED2=added2
+BAR=bar
+FOO1=foo1
+FOO2=foo2
+
diff --git a/test/stdout/3011 b/test/stdout/3011
new file mode 100644
index 000000000..6506cb3d7
--- /dev/null
+++ b/test/stdout/3011
@@ -0,0 +1 @@
+OFF
diff --git a/test/stdout/3012 b/test/stdout/3012
new file mode 100644
index 000000000..76371f28f
--- /dev/null
+++ b/test/stdout/3012
@@ -0,0 +1 @@
+ON
diff --git a/test/stdout/3450.debian8 b/test/stdout/3450.debian8
new file mode 100644
index 000000000..bddcb4deb
--- /dev/null
+++ b/test/stdout/3450.debian8
@@ -0,0 +1,76 @@
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo foobar
+??? 250-
+<<< 250-myhost.test.ex Hello foobar [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-AUTH PLAIN
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> auth plain AHVzZXJ4AHNlY3JldA==
+??? 235
+<<< 235 Authentication succeeded
+>>> quit
+??? 221
+<<< 221 myhost.test.ex closing connection
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo foobar
+??? 250-
+<<< 250-myhost.test.ex Hello foobar [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-AUTH PLAIN
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> auth plain AHVzZXJ4AHNlY3JldA==
+??? 503
+<<< 503 STARTTLS required before AUTH
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> ehlo foobar
+??? 250-
+<<< 250-myhost.test.ex Hello foobar [127.0.0.1]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-AUTH PLAIN
+??? 250
+<<< 250 HELP
+>>> auth plain AHVzZXJ4AHNlY3JldA==
+??? 235
+<<< 235 Authentication succeeded
+>>> quit
+??? 221
+<<< 221 myhost.test.ex closing connection
+End of script
diff --git a/test/stdout/3454.debian8 b/test/stdout/3454.debian8
new file mode 100644
index 000000000..66dc56386
--- /dev/null
+++ b/test/stdout/3454.debian8
@@ -0,0 +1,80 @@
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo foobar
+??? 250-myhost
+<<< 250-myhost.test.ex Hello foobar [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-AUTH
+<<< 250-AUTH PLAIN
+??? 250-STARTTLS
+<<< 250-STARTTLS
+??? 250 HELP
+<<< 250 HELP
+>>> starttls
+??? 220 TLS
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> auth plain AHVzZXJ4AHNlY3JldA==
+??? 503
+<<< 503 AUTH command used when not advertised
+End of script
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo foobar
+??? 250-myhost
+<<< 250-myhost.test.ex Hello foobar [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-AUTH
+<<< 250-AUTH PLAIN
+??? 250-STARTTLS
+<<< 250-STARTTLS
+??? 250 HELP
+<<< 250 HELP
+>>> starttls
+??? 220 TLS
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> ehlo foobar
+??? 250-myhost
+<<< 250-myhost.test.ex Hello foobar [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-AUTH
+<<< 250-AUTH PLAIN
+??? 250 HELP
+<<< 250 HELP
+>>> auth plain AHVzZXJ4AHNlY3JldA==
+??? 235
+<<< 235 Authentication succeeded
+>>> quit
+??? 221
+<<< 221 myhost.test.ex closing connection
+End of script
diff --git a/test/stdout/4009 b/test/stdout/4009
index 93fec0c60..5c16c636a 100644
--- a/test/stdout/4009
+++ b/test/stdout/4009
@@ -1,5 +1,5 @@
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello CALLER at test.ex
+250-myhost.test.ex Hello fromuser at test.ex
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
@@ -10,7 +10,7 @@
 250 OK id=10HmaX-0005vi-00
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello CALLER at test.ex
+250-myhost.test.ex Hello fromuser at test.ex
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
@@ -21,7 +21,7 @@
 250 OK id=10HmaY-0005vi-00
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello CALLER at test.ex
+250-myhost.test.ex Hello fromuser at test.ex
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
@@ -32,7 +32,7 @@
 250 OK id=10HmaZ-0005vi-00
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello CALLER at test.ex
+250-myhost.test.ex Hello fromuser at test.ex
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
@@ -51,16 +51,16 @@ Connection request from [127.0.0.1]
 <Content-length: ddd
 <
 <From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <CALLER@myhost.test.ex>
+<X-Envelope-From: <fromuser@myhost.test.ex>
 <X-Envelope-To: userx@test.ex
-<Received: from CALLER (helo=test.ex)
+<Received: from fromuser (helo=test.ex)
 <	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <CALLER@myhost.test.ex>)
+<	(envelope-from <fromuser@myhost.test.ex>)
 <	id 10HmaX-0005vi-00
 <	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 <Content-type: text/plain
 <Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
-<From: CALLER_NAME <CALLER@myhost.test.ex>
+<From: fromuser@myhost.test.ex
 <Date: Tue, 2 Mar 1999 09:44:33 +0000
 <
 <test
@@ -95,16 +95,16 @@ Connection request from [127.0.0.1]
 <Content-length: ddd
 <
 <From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <CALLER@myhost.test.ex>
+<X-Envelope-From: <fromuser@myhost.test.ex>
 <X-Envelope-To: userx@test.ex
-<Received: from CALLER (helo=test.ex)
+<Received: from fromuser (helo=test.ex)
 <	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <CALLER@myhost.test.ex>)
+<	(envelope-from <fromuser@myhost.test.ex>)
 <	id 10HmaY-0005vi-00
 <	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 <Content-type: text/plain
 <Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
-<From: CALLER_NAME <CALLER@myhost.test.ex>
+<From: fromuser@myhost.test.ex
 <Date: Tue, 2 Mar 1999 09:44:33 +0000
 <
 <test
@@ -140,16 +140,16 @@ Connection request from [127.0.0.1]
 <Content-length: ddd
 <
 <From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <CALLER@myhost.test.ex>
+<X-Envelope-From: <fromuser@myhost.test.ex>
 <X-Envelope-To: userx@test.ex
-<Received: from CALLER (helo=test.ex)
+<Received: from fromuser (helo=test.ex)
 <	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <CALLER@myhost.test.ex>)
+<	(envelope-from <fromuser@myhost.test.ex>)
 <	id 10HmaZ-0005vi-00
 <	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 <Content-type: text/plain
 <Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
-<From: CALLER_NAME <CALLER@myhost.test.ex>
+<From: fromuser@myhost.test.ex
 <Date: Tue, 2 Mar 1999 09:44:33 +0000
 <
 <test
@@ -184,16 +184,16 @@ Connection request from [127.0.0.1]
 <Content-length: ddd
 <
 <From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <CALLER@myhost.test.ex>
+<X-Envelope-From: <fromuser@myhost.test.ex>
 <X-Envelope-To: userx@test.ex
-<Received: from CALLER (helo=test.ex)
+<Received: from fromuser (helo=test.ex)
 <	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <CALLER@myhost.test.ex>)
+<	(envelope-from <fromuser@myhost.test.ex>)
 <	id 10HmbA-0005vi-00
 <	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 <Content-type: text/plain
 <Message-Id: <E10HmbA-0005vi-00@myhost.test.ex>
-<From: CALLER_NAME <CALLER@myhost.test.ex>
+<From: fromuser@myhost.test.ex
 <Date: Tue, 2 Mar 1999 09:44:33 +0000
 <
 <test
diff --git a/test/stdout/4015 b/test/stdout/4015
index a1d7f2ea7..7e1d83e89 100644
--- a/test/stdout/4015
+++ b/test/stdout/4015
@@ -1,5 +1,5 @@
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello CALLER at test.ex
+250-myhost.test.ex Hello fromuser at test.ex
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
@@ -15,19 +15,19 @@ Listening on port 7833 ...
 Connection request from [127.0.0.1]
 <REPORT SPAMC/1.2
 <User: nobody
-<Content-length: 479
+<Content-length: 465
 <
 <From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <CALLER@myhost.test.ex>
+<X-Envelope-From: <fromuser@myhost.test.ex>
 <X-Envelope-To: userx@test.ex
-<Received: from CALLER (helo=test.ex)
+<Received: from fromuser (helo=test.ex)
 <	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <CALLER@myhost.test.ex>)
+<	(envelope-from <fromuser@myhost.test.ex>)
 <	id 10HmaX-0005vi-00
 <	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 <Content-type: text/plain
 <Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
-<From: CALLER_NAME <CALLER@myhost.test.ex>
+<From: fromuser@myhost.test.ex
 <Date: Tue, 2 Mar 1999 09:44:33 +0000
 <
 <test
diff --git a/test/stdout/4201 b/test/stdout/4201
index 8b89b2bd3..5a110f292 100644
--- a/test/stdout/4201
+++ b/test/stdout/4201
@@ -28,7 +28,7 @@ Connecting to 127.0.0.1 port 1225 ... connected
 >>> body
 >>> .
 ??? 250
-<<< 250 OK id=10HmaX-0005vi-00
+<<< 250 OK id=10HmaZ-0005vi-00
 >>> QUIT
 ??? 221
 <<< 221 the.local.host.name closing connection
@@ -63,7 +63,7 @@ Connecting to 127.0.0.1 port 1225 ... connected
 >>> body
 >>> .
 ??? 250
-<<< 250 OK id=10HmaY-0005vi-00
+<<< 250 OK id=10HmbA-0005vi-00
 >>> QUIT
 ??? 221
 <<< 221 the.local.host.name closing connection
@@ -78,5 +78,5 @@ End of script
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmaZ-0005vi-00
+250 OK id=10HmaX-0005vi-00
 221 the.local.host.name closing connection
diff --git a/test/stdout/4211 b/test/stdout/4211
index a0e463dc2..2dc813509 100644
--- a/test/stdout/4211
+++ b/test/stdout/4211
@@ -30,7 +30,7 @@ Connecting to 127.0.0.1 port 1225 ... connected
 >>> body
 >>> .
 ??? 250
-<<< 250 OK id=10HmaX-0005vi-00
+<<< 250 OK id=10HmaZ-0005vi-00
 >>> QUIT
 ??? 221
 <<< 221 the.local.host.name closing connection
@@ -67,7 +67,7 @@ Connecting to 127.0.0.1 port 1225 ... connected
 >>> body
 >>> .
 ??? 250
-<<< 250 OK id=10HmaY-0005vi-00
+<<< 250 OK id=10HmbA-0005vi-00
 >>> QUIT
 ??? 221
 <<< 221 the.local.host.name closing connection
@@ -83,5 +83,5 @@ End of script
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmaZ-0005vi-00
+250 OK id=10HmaX-0005vi-00
 221 the.local.host.name closing connection
diff --git a/test/stdout/4221 b/test/stdout/4221
index a0e463dc2..2dc813509 100644
--- a/test/stdout/4221
+++ b/test/stdout/4221
@@ -30,7 +30,7 @@ Connecting to 127.0.0.1 port 1225 ... connected
 >>> body
 >>> .
 ??? 250
-<<< 250 OK id=10HmaX-0005vi-00
+<<< 250 OK id=10HmaZ-0005vi-00
 >>> QUIT
 ??? 221
 <<< 221 the.local.host.name closing connection
@@ -67,7 +67,7 @@ Connecting to 127.0.0.1 port 1225 ... connected
 >>> body
 >>> .
 ??? 250
-<<< 250 OK id=10HmaY-0005vi-00
+<<< 250 OK id=10HmbA-0005vi-00
 >>> QUIT
 ??? 221
 <<< 221 the.local.host.name closing connection
@@ -83,5 +83,5 @@ End of script
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmaZ-0005vi-00
+250 OK id=10HmaX-0005vi-00
 221 the.local.host.name closing connection
diff --git a/test/stdout/5400 b/test/stdout/5400
index 20de2df09..9fae04fb5 100644
--- a/test/stdout/5400
+++ b/test/stdout/5400
@@ -50,7 +50,7 @@
 250-PIPELINING
 250 HELP
 250 OK
-250 Accepted
+550 Administrative prohibition
 250 Accepted
 354 Enter message, ending with "." on a line by itself
 250 OK id=10HmbB-0005vi-00
@@ -63,7 +63,7 @@
 250 HELP
 250 OK
 250 Accepted
-250 Accepted
+550 Administrative prohibition
 354 Enter message, ending with "." on a line by itself
 250 OK id=10HmbC-0005vi-00
 221 myhost.test.ex closing connection
@@ -255,18 +255,17 @@ Connection request from [ip4.ip4.ip4.ip4]
 220 ESMTP
 EHLO myhost.test.ex
 250 OK
-MAIL FROM:<CALLER@myhost.test.ex>
+MAIL FROM:<>
 250 Sender OK
-RCPT TO:<no@domain.com>
-250 ok rcpt-1
 RCPT TO:<userx@domain.com>
-250 ok rcpt-2
+250 ok rcpt-1
 DATA
 354 Send data
 Received: from CALLER (helo=myhost.test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbB-0005vi-00; Tue, 2 Mar 1999 09:44:33 +0000
+	id 10HmbB-0005vi-00
+	for userx@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
 Message-Id: <E10HmbB-0005vi-00@myhost.test.ex>
 From: CALLER_NAME <CALLER@myhost.test.ex>
 Date: Tue, 2 Mar 1999 09:44:33 +0000
@@ -296,18 +295,17 @@ Connection request from [ip4.ip4.ip4.ip4]
 220 ESMTP
 EHLO myhost.test.ex
 250 OK
-MAIL FROM:<CALLER@myhost.test.ex>
+MAIL FROM:<>
 250 Sender OK
 RCPT TO:<userx@domain.com>
 250 ok rcpt-1
-RCPT TO:<no@domain.com>
-250 ok rcpt-2
 DATA
 354 Send data
 Received: from CALLER (helo=myhost.test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbC-0005vi-00; Tue, 2 Mar 1999 09:44:33 +0000
+	id 10HmbC-0005vi-00
+	for userx@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
 Message-Id: <E10HmbC-0005vi-00@myhost.test.ex>
 From: CALLER_NAME <CALLER@myhost.test.ex>
 Date: Tue, 2 Mar 1999 09:44:33 +0000
@@ -347,7 +345,7 @@ Connection request from [ip4.ip4.ip4.ip4]
 220 ESMTP
 EHLO myhost.test.ex
 250 OK
-MAIL FROM:<CALLER@myhost.test.ex>
+MAIL FROM:<>
 250 Sender OK
 RCPT TO:<userx@domain.com>
 250 ok rcpt-1
@@ -372,7 +370,7 @@ Connection request from [ip4.ip4.ip4.ip4]
 220 ESMTP
 EHLO myhost.test.ex
 250 OK
-MAIL FROM:<CALLER@myhost.test.ex>
+MAIL FROM:<>
 250 Sender OK
 RCPT TO:<special_tpt@domain.com>
 250 ok rcpt-2
@@ -448,7 +446,7 @@ Connection request from [ip4.ip4.ip4.ip4]
 220 ESMTP
 EHLO myhost.test.ex
 250 OK
-MAIL FROM:<CALLER@myhost.test.ex>
+MAIL FROM:<>
 250 Sender OK
 RCPT TO:<userx@domain.com>
 250 ok rcpt-1
@@ -473,7 +471,7 @@ Connection request from [ip4.ip4.ip4.ip4]
 220 ESMTP
 EHLO myhost.test.ex
 250 OK
-MAIL FROM:<CALLER@myhost.test.ex>
+MAIL FROM:<>
 250 Sender OK
 RCPT TO:<usery@special.com>
 250 ok rcpt-2
diff --git a/test/stdout/5401 b/test/stdout/5401
index 1ceb0bffb..c0089f856 100644
--- a/test/stdout/5401
+++ b/test/stdout/5401
@@ -9,6 +9,29 @@
 354 Enter message, ending with "." on a line by itself
 250 OK id=10HmaX-0005vi-00
 221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+550-Callout verification failed:
+550 550 No mate
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+550-Callout verification failed:
+550 550 Not that one
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaY-0005vi-00
+221 myhost.test.ex closing connection
 
 ******** SERVER ********
 Listening on port 1224 ... 
@@ -36,3 +59,66 @@ Date: Tue, 2 Mar 1999 09:44:33 +0000
 QUIT
 250 OK
 End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<no@domain.com>
+550 No mate
+QUIT
+250 OK
+Expected EOF read from client
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<no@domain.com>
+550 Not that one
+QUIT
+250 OK
+Expected EOF read from client
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<userx@domain.com>
+250 ok rcpt-1
+QUIT
+250 OK
+Expected EOF read from client
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<userx@domain.com>
+250 ok rcpt-1
+DATA
+354 Send data
+Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaY-0005vi-00
+	for userx@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+
+.
+250 OK
+QUIT
+250 OK
+Expected EOF read from client
+End of script
diff --git a/test/stdout/5402 b/test/stdout/5402
index aa2bdcaab..1aa55964e 100644
--- a/test/stdout/5402
+++ b/test/stdout/5402
@@ -6,6 +6,15 @@
 250 HELP
 250 OK
 250 Accepted
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
 354 Enter message, ending with "." on a line by itself
 250 OK id=10HmaX-0005vi-00
 221 myhost.test.ex closing connection
@@ -15,11 +24,22 @@ Listening on port 1224 ...
 Connection request from [ip4.ip4.ip4.ip4]
 220 ESMTP
 EHLO myhost.test.ex
-250-OK
-250 SIZE 65536
-MAIL FROM:<fred@myhost.test.ex> SIZE=ssss
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<dest@domain.com>
+250 Recipient OK
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
 250 Sender OK
-RCPT TO:<userx@domain.com>
+RCPT TO:<dest@domain.com>
 250 Recipient OK
 DATA
 354 Send data
@@ -27,11 +47,10 @@ Received: from CALLER (helo=myhost.test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
 	id 10HmaX-0005vi-00
-	for userx@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
+	for dest@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
 Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 From: CALLER_NAME <CALLER@myhost.test.ex>
 Date: Tue, 2 Mar 1999 09:44:33 +0000
-X-hdr-rtr-new: +++
 
 .
 250 OK
diff --git a/test/stdout/5403 b/test/stdout/5403
new file mode 100644
index 000000000..f9bcde823
--- /dev/null
+++ b/test/stdout/5403
@@ -0,0 +1,55 @@
+
+**** SMTP testing session as if from host 1.2.3.4
+**** but without any ident (RFC 1413) callback.
+**** This is not for real!
+
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello myhost.test.ex [1.2.3.4]
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaX-0005vi-00
+
+**** SMTP testing: that is not a real message id!
+
+221 myhost.test.ex closing connection
+
+**** SMTP testing session as if from host 1.2.3.4
+**** but without any ident (RFC 1413) callback.
+**** This is not for real!
+
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello myhost.test.ex [1.2.3.4]
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaY-0005vi-00
+
+**** SMTP testing: that is not a real message id!
+
+221 myhost.test.ex closing connection
+
+******** SERVER ********
+Listening on port 1224 ... 
+Server timed out
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 server ready
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<sender@myhost.test.ex>
+250 OK
+RCPT TO:<verify@domain.com>
+250 OK
+QUIT
+220 OK
+Expected EOF read from client
+End of script
diff --git a/test/stdout/5404 b/test/stdout/5404
new file mode 100644
index 000000000..aa2bdcaab
--- /dev/null
+++ b/test/stdout/5404
@@ -0,0 +1,40 @@
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaX-0005vi-00
+221 myhost.test.ex closing connection
+
+******** SERVER ********
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250-OK
+250 SIZE 65536
+MAIL FROM:<fred@myhost.test.ex> SIZE=ssss
+250 Sender OK
+RCPT TO:<userx@domain.com>
+250 Recipient OK
+DATA
+354 Send data
+Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaX-0005vi-00
+	for userx@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+X-hdr-rtr-new: +++
+
+.
+250 OK
+QUIT
+250 OK
+End of script
diff --git a/test/stdout/5405 b/test/stdout/5405
new file mode 100644
index 000000000..14bfdabdd
--- /dev/null
+++ b/test/stdout/5405
@@ -0,0 +1,280 @@
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaX-0005vi-00
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaY-0005vi-00
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaZ-0005vi-00
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+450 not right now
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmbA-0005vi-00
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmbB-0005vi-00
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+459 content reject
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmbD-0005vi-00
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at myhost.test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+451 Could not complete recipient verify callout
+503-All RCPT commands were rejected with this error:
+503-Could not complete recipient verify callout
+503 Valid RCPT command must precede DATA
+500 unrecognized command
+500 unrecognized command
+221 myhost.test.ex closing connection
+
+******** SERVER ********
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<usera@domain.com>
+250 Recipient OK
+DATA
+354 Send data
+Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaX-0005vi-00
+	for usera@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+X-hdr-rtr-new: +++
+
+.
+250 OK
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<userb@domain.com>
+450 not right now
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<userc@domain.com>
+450 not right now
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<userd@domain.com>
+450 not right now
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<usere@domain.com>
+250 good rcpt
+DATA
+354 Send data
+Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbA-0005vi-00
+	for usere@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmbA-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+X-hdr-rtr-new: +++
+
+.
+459 content reject
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<userf@domain.com>
+250 good rcpt
+DATA
+354 Send data
+Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbB-0005vi-00
+	for userf@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmbB-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+X-hdr-rtr-new: +++
+
+.
+459 content reject
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<userg@domain.com>
+250 good rcpt
+DATA
+354 Send data
+Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbC-0005vi-00
+	for userg@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmbC-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+X-hdr-rtr-new: +++
+
+.
+459 content reject
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<userh@domain.com>
+250 Recipient OK
+DATA
+354 Send data
+Received: from CALLER (helo=myhost.test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbD-0005vi-00
+	for userh@domain.com; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmbD-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+X-hdr-rtr-new: +++
+
+.
+250 OK
+QUIT
+250 OK
+End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 ESMTP
+EHLO myhost.test.ex
+250 OK
+MAIL FROM:<CALLER@myhost.test.ex>
+250 Sender OK
+RCPT TO:<useri@domain.com>
+450 not right now
+QUIT
+250 OK
+End of script
diff --git a/test/stdout/5410 b/test/stdout/5410
index edf01f8ba..365fe2502 100644
--- a/test/stdout/5410
+++ b/test/stdout/5410
@@ -8,7 +8,7 @@
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmaY-0005vi-00
+250 OK id=10HmaX-0005vi-00
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 250-myhost.test.ex Hello CALLER at myhost.test.ex
@@ -20,7 +20,7 @@
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmbA-0005vi-00
+250 OK id=10HmaZ-0005vi-00
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 250-myhost.test.ex Hello CALLER at myhost.test.ex
@@ -32,5 +32,5 @@
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmbC-0005vi-00
+250 OK id=10HmbB-0005vi-00
 221 myhost.test.ex closing connection
diff --git a/test/stdout/5420 b/test/stdout/5420
index edf01f8ba..365fe2502 100644
--- a/test/stdout/5420
+++ b/test/stdout/5420
@@ -8,7 +8,7 @@
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmaY-0005vi-00
+250 OK id=10HmaX-0005vi-00
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 250-myhost.test.ex Hello CALLER at myhost.test.ex
@@ -20,7 +20,7 @@
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmbA-0005vi-00
+250 OK id=10HmaZ-0005vi-00
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 250-myhost.test.ex Hello CALLER at myhost.test.ex
@@ -32,5 +32,5 @@
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmbC-0005vi-00
+250 OK id=10HmbB-0005vi-00
 221 myhost.test.ex closing connection
diff --git a/test/stdout/5590 b/test/stdout/5590
new file mode 100644
index 000000000..1c22145fb
--- /dev/null
+++ b/test/stdout/5590
@@ -0,0 +1,50 @@
+Connecting to 127.0.0.1 port 1225 ... connected
+??? 220
+<<< 220 testhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> EHLO tester
+??? 250-
+<<< 250-testhost.test.ex Hello tester [127.0.0.1]
+??? 250-SIZE
+<<< 250-SIZE 52428800
+??? 250-8BITMIME
+<<< 250-8BITMIME
+??? 250-PIPELINING
+<<< 250-PIPELINING
+??? 250-CHUNKING
+<<< 250-CHUNKING
+??? 250-PRDR
+<<< 250-PRDR
+??? 250 
+<<< 250 HELP
+>>> MAIL FROM:<someone@some.domain> PRDR
+??? 250
+<<< 250 OK, PRDR Requested
+>>> RCPT TO:<bad1@test.ex>
+??? 250
+<<< 250 Accepted
+>>> RCPT TO:<good@test.ex>
+??? 250
+<<< 250 Accepted
+>>> RCPT TO:<bad2@test.ex>
+??? 250
+<<< 250 Accepted
+>>> BDAT 100 last
+>>> To: Susan@random.com
+>>> From: Sam@random.com
+>>> Subject: This is a bodyfull test message
+>>> 
+>>> 1234567890
+??? 353
+<<< 353 PRDR content analysis beginning
+??? 550
+<<< 550 PRDR R=<bad1@test.ex> refusal
+??? 250
+<<< 250 PRDR R=<good@test.ex> acceptance
+??? 550
+<<< 550 PRDR R=<bad2@test.ex> refusal
+??? 250
+<<< 250 id=10HmaX-0005vi-00 message accepted for some recipients
+>>> QUIT
+??? 221
+<<< 221 testhost.test.ex closing connection
+End of script
diff --git a/test/stdout/5591 b/test/stdout/5591
new file mode 100644
index 000000000..4794b4a60
--- /dev/null
+++ b/test/stdout/5591
@@ -0,0 +1,24 @@
+
+******** SERVER ********
+Listening on port 1224 ... 
+Connection request from [127.0.0.1]
+220 Server ready
+EHLO testhost.test.ex
+250-hiya matey
+250-PRDR
+250-CHUNKING
+250 OK
+MAIL FROM:<> PRDR
+250 OK
+RCPT TO:<usery@testhost.test.ex>
+250 OK
+RCPT TO:<userz@testhost.test.ex>
+250 OK
+BDAT 285 LAST
+353 prdr responses coming up
+250 first rcpt was good
+250 second rcpt was good
+250 OK, overall
+QUIT
+250 OK
+End of script
diff --git a/test/stdout/5610 b/test/stdout/5610
new file mode 100644
index 000000000..d2d28dce6
--- /dev/null
+++ b/test/stdout/5610
@@ -0,0 +1,188 @@
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/cert2
+Key file = aux-fixed/cert2
+??? 220
+<<< 220 server1.example.com ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSLv3 read server hello A
+SSL info: SSLv3 read server certificate A
+Response verify OK
+SSL info: SSLv3 read server certificate request A
+SSL info: SSLv3 read server done A
+SSL info: SSLv3 write client certificate A
+SSL info: SSLv3 write client key exchange A
+SSL info: SSLv3 write certificate verify A
+SSL info: SSLv3 write change cipher spec A
+SSL info: SSLv3 write finished A
+SSL info: SSLv3 flush data
+SSL info: SSLv3 read server session ticket A
+SSL info: SSLv3 read finished A
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> mail from:<userx@test.ex>
+??? 250
+<<< 250 OK
+>>> rcpt to:<userx@test.ex>
+??? 250
+<<< 250 Accepted
+>>> quit
+??? 221
+<<< 221 server1.example.com closing connection
+End of script
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/cert2
+Key file = aux-fixed/cert2
+??? 220
+<<< 220 server1.example.com ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+no response received
+SSL info: SSLv3 read server hello A
+SSL info: SSLv3 read server certificate A
+SSL info: SSLv3 read server certificate request A
+SSL info: SSLv3 read server done A
+SSL info: SSLv3 write client certificate A
+SSL info: SSLv3 write client key exchange A
+SSL info: SSLv3 write certificate verify A
+SSL info: SSLv3 write change cipher spec A
+SSL info: SSLv3 write finished A
+SSL info: SSLv3 flush data
+SSL info: SSLv3 read server session ticket A
+SSL info: SSLv3 read finished A
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+End of script
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/cert2
+Key file = aux-fixed/cert2
+??? 220
+<<< 220 server1.example.com ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+no response received
+SSL info: SSLv3 read server hello A
+SSL info: SSLv3 read server certificate A
+SSL info: SSLv3 read server certificate request A
+SSL info: SSLv3 read server done A
+SSL info: SSLv3 write client certificate A
+SSL info: SSLv3 write client key exchange A
+SSL info: SSLv3 write certificate verify A
+SSL info: SSLv3 write change cipher spec A
+SSL info: SSLv3 write finished A
+SSL info: SSLv3 flush data
+SSL info: SSLv3 read server session ticket A
+SSL info: SSLv3 read finished A
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+End of script
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/cert2
+Key file = aux-fixed/cert2
+??? 220
+<<< 220 server1.example.com ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSLv3 read server hello A
+SSL info: SSLv3 read server certificate A
+SSL info: SSLv3 read server certificate request A
+SSL info: SSLv3 read server done A
+SSL info: SSLv3 write client certificate A
+SSL info: SSLv3 write client key exchange A
+SSL info: SSLv3 write certificate verify A
+SSL info: SSLv3 write change cipher spec A
+SSL info: SSLv3 write finished A
+SSL info: SSLv3 flush data
+SSL info: SSLv3 read server session ticket A
+SSL info: SSLv3 read finished A
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> ehlo rhu.barb.tls
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb.tls [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250
+<<< 250 HELP
+>>> quit
+End of script
diff --git a/test/stdout/5610.debian8 b/test/stdout/5610.debian8
new file mode 100644
index 000000000..039f5152f
--- /dev/null
+++ b/test/stdout/5610.debian8
@@ -0,0 +1,140 @@
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/cert2
+Key file = aux-fixed/cert2
+??? 220
+<<< 220 server1.example.com ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+Response verify OK
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> mail from:<userx@test.ex>
+??? 250
+<<< 250 OK
+>>> rcpt to:<userx@test.ex>
+??? 250
+<<< 250 Accepted
+>>> quit
+??? 221
+<<< 221 server1.example.com closing connection
+End of script
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/cert2
+Key file = aux-fixed/cert2
+??? 220
+<<< 220 server1.example.com ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+no response received
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+End of script
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/cert2
+Key file = aux-fixed/cert2
+??? 220
+<<< 220 server1.example.com ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+no response received
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+End of script
+Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
+Certificate file = aux-fixed/cert2
+Key file = aux-fixed/cert2
+??? 220
+<<< 220 server1.example.com ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+>>> ehlo rhu.barb
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250-
+<<< 250-STARTTLS
+??? 250
+<<< 250 HELP
+>>> starttls
+??? 220
+<<< 220 TLS go ahead
+Attempting to start TLS
+SSL info: before/connect initialization
+SSL info: before/connect initialization
+SSL info: SSL negotiation finished successfully
+SSL info: SSL negotiation finished successfully
+SSL connection using AES256-SHA
+Succeeded in starting TLS
+>>> ehlo rhu.barb.tls
+??? 250-
+<<< 250-server1.example.com Hello rhu.barb.tls [ip4.ip4.ip4.ip4]
+??? 250-
+<<< 250-SIZE 52428800
+??? 250-
+<<< 250-8BITMIME
+??? 250-
+<<< 250-PIPELINING
+??? 250
+<<< 250 HELP
+>>> quit
+End of script
diff --git a/test/stdout/5840 b/test/stdout/5840
index 0829c56fc..1d94564ad 100644
--- a/test/stdout/5840
+++ b/test/stdout/5840
@@ -1,3 +1,6 @@
+### TLSA (3 1 1)
+### TLSA (3 1 2)
+### Recipient callout
 
 **** SMTP testing session as if from host 127.0.0.1
 **** but without any ident (RFC 1413) callback.
@@ -7,3 +10,20 @@
 250 OK
 250 Accepted
 421 myhost.test.ex lost input connection
+### TLSA (2 0 1)
+### A server with a nonverifying cert and no TLSA
+### A server with a verifying cert and no TLSA
+### A server with two MXs for which both TLSA lookups return defer
+### A server lacking a TLSA, required
+### A server lacking a TLSA, requested only
+
+******** SERVER ********
+### TLSA (3 1 1)
+### TLSA (3 1 2)
+### Recipient callout
+### TLSA (2 0 1)
+### A server with a nonverifying cert and no TLSA
+### A server with a verifying cert and no TLSA
+### A server with two MXs for which both TLSA lookups return defer
+### A server lacking a TLSA, required
+### A server lacking a TLSA, requested only
diff --git a/test/stdout/5902 b/test/stdout/5902
new file mode 100644
index 000000000..8da182d51
--- /dev/null
+++ b/test/stdout/5902
@@ -0,0 +1,2 @@
+10HmaX-0005vi-00-D
+10HmaX-0005vi-00-H
diff --git a/test/t/00-basic.t b/test/t/00-basic.t
new file mode 100644
index 000000000..0612a20af
--- /dev/null
+++ b/test/t/00-basic.t
@@ -0,0 +1,51 @@
+use Test::More;
+use Test::Pod::Coverage;
+use Test::Exception;
+
+use lib 'lib';
+use_ok 'Exim::Runtest', qw(:all) or BAIL_OUT 'Can not load the module';
+
+can_ok 'Exim::Runtest', qw(mailgroup dynamic_socket exim_binary flavour flavours);
+pod_coverage_ok 'Exim::Runtest' => 'docs complete';
+
+subtest 'mailgroup' => sub {
+    my $group = getgrgid $(;
+    ok $group => 'got a group name';
+    note "use group $group";
+
+    is mailgroup($group), $group => 'group names match';
+    ok $group = mailgroup('non existing group') => 'cope with unknown group';
+    note "got random group: $group";
+
+    ok getgrnam($group) => 'got an existing group';
+
+    dies_ok { mailgroup(22) } 'dies on numeric group';
+    dies_ok { mailgroup() } 'dies on missing default group';
+};
+
+subtest 'dynamic_socket' => sub {
+    ok my $socket = dynamic_socket() => 'got a socket';
+    note "got socket on port @{[$socket->sockport]}";
+    isa_ok $socket => 'IO::Socket::INET';
+    cmp_ok $socket->sockport(), '>=', 1024 => 'port is >= 1024';
+    $socket->close;
+};
+
+subtest 'exim_binary' => sub {
+    my @argv1 = qw(/bin/sh a b);
+    my @argv2 = qw(t/samples/foo a b);
+    chomp(my $cwd = `pwd`); # don't use Cwd, as we use Cwd in the tested module already
+    is_deeply [exim_binary(@argv1)], \@argv1 => 'got the binary as abs path from argv';
+    is_deeply [exim_binary(@argv2)], ["$cwd/t/samples/foo", @argv2[1,$#argv2]] => 'got the binary as rel path from argv';
+};
+
+subtest 'flavour' => sub {
+    is flavour('t/samples/debian8+os-release/etc'), 'debian8' => 'got flavour debian8 from os-release';
+    is flavour('t/samples/debian8+debian-version/etc'), 'debian8' => 'got flavour debian8 from debian_version';
+    is flavour('t/samples/debian.sid/etc'), 'debian' => 'got flavour debian from debian sid w/o VERSION_ID';
+    is flavour('t/samples/fedora24/etc'), 'fedora24' => 'got flavour fedora24 from os-release';
+    is flavour('t/samples/empty'), undef()           => 'got empty flavour (undef)';
+    is_deeply [flavours()], ['debian8'] => 'got available flavours';
+};
+
+done_testing;
diff --git a/test/t/README b/test/t/README
new file mode 100644
index 000000000..1ad8ce39b
--- /dev/null
+++ b/test/t/README
@@ -0,0 +1,2 @@
+This is the testsuite to test the testsuite. The tests should be run by
+calling `prove` or `prove -v`.
diff --git a/test/t/samples/debian.sid/etc/os-release b/test/t/samples/debian.sid/etc/os-release
new file mode 100644
index 000000000..959aa161b
--- /dev/null
+++ b/test/t/samples/debian.sid/etc/os-release
@@ -0,0 +1,6 @@
+PRETTY_NAME="Debian GNU/Linux stretch/sid"
+NAME="Debian GNU/Linux"
+ID=debian
+HOME_URL="https://www.debian.org/"
+SUPPORT_URL="https://www.debian.org/support"
+BUG_REPORT_URL="https://bugs.debian.org/"
diff --git a/test/t/samples/debian8+debian-version/etc/debian_version b/test/t/samples/debian8+debian-version/etc/debian_version
new file mode 100644
index 000000000..48c26da3e
--- /dev/null
+++ b/test/t/samples/debian8+debian-version/etc/debian_version
@@ -0,0 +1 @@
+8.6
diff --git a/test/t/samples/debian8+os-release/etc/debian_version b/test/t/samples/debian8+os-release/etc/debian_version
new file mode 100644
index 000000000..48c26da3e
--- /dev/null
+++ b/test/t/samples/debian8+os-release/etc/debian_version
@@ -0,0 +1 @@
+8.6
diff --git a/test/t/samples/debian8+os-release/etc/os-release b/test/t/samples/debian8+os-release/etc/os-release
new file mode 100644
index 000000000..120c51b08
--- /dev/null
+++ b/test/t/samples/debian8+os-release/etc/os-release
@@ -0,0 +1,8 @@
+PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
+NAME="Debian GNU/Linux"
+VERSION_ID="8"
+VERSION="8 (jessie)"
+ID=debian
+HOME_URL="http://www.debian.org/"
+SUPPORT_URL="http://www.debian.org/support"
+BUG_REPORT_URL="https://bugs.debian.org/"
diff --git a/test/t/samples/empty/.dir b/test/t/samples/empty/.dir
new file mode 100644
index 000000000..e69de29bb
diff --git a/test/t/samples/fedora24/etc/os-release b/test/t/samples/fedora24/etc/os-release
new file mode 100644
index 000000000..f962ae641
--- /dev/null
+++ b/test/t/samples/fedora24/etc/os-release
@@ -0,0 +1,14 @@
+NAME=Fedora
+VERSION="24 (Twenty Four)"
+ID=fedora
+VERSION_ID=24
+PRETTY_NAME="Fedora 24 (Twenty Four)"
+ANSI_COLOR="0;34"
+CPE_NAME="cpe:/o:fedoraproject:fedora:24"
+HOME_URL="https://fedoraproject.org/"
+BUG_REPORT_URL="https://bugzilla.redhat.com/"
+REDHAT_BUGZILLA_PRODUCT="Fedora"
+REDHAT_BUGZILLA_PRODUCT_VERSION=24
+REDHAT_SUPPORT_PRODUCT="Fedora"
+REDHAT_SUPPORT_PRODUCT_VERSION=24
+PRIVACY_POLICY_URL=https://fedoraproject.org/wiki/Legal:PrivacyPolicy
diff --git a/test/t/samples/foo b/test/t/samples/foo
new file mode 100755
index 000000000..0e748db3f
--- /dev/null
+++ b/test/t/samples/foo
@@ -0,0 +1,2 @@
+# this file solely exists to be tested as
+# an executable from one of the tests in t/
diff --git a/test/t/samples/src/.directory b/test/t/samples/src/.directory
new file mode 100644
index 000000000..e69de29bb