Docs: Change default for hosts_try_dane to *

[users/jgh/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 118b7b5669d0d204e4647e713bb547e2cc2abfe9..e48b3539fbd7fc76db5ab683999e2f1bffa3a8c5 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -6262,9 +6262,6 @@ Two remote transports and four local transports are defined.
 remote_smtp:
   driver = smtp
   message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
 remote_smtp:
   driver = smtp
   message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}

-.ifdef _HAVE_DANE
-  hosts_try_dane = *
-.endif

 .ifdef _HAVE_PRDR
   hosts_try_prdr = *
 .endif
 .ifdef _HAVE_PRDR
   hosts_try_prdr = *
 .endif


@@ -7331,7 +7328,7 @@ with the lookup.
 With &"strict"& a response from the DNS resolver that
 is not labelled as authenticated data
 is treated as equivalent to a temporary DNS error.
 With &"strict"& a response from the DNS resolver that
 is not labelled as authenticated data
 is treated as equivalent to a temporary DNS error.

-The default is &"never"&.
+The default is &"lax"&.

 
 See also the &$lookup_dnssec_authenticated$& variable.
 
 
 See also the &$lookup_dnssec_authenticated$& variable.
 


@@ -9377,7 +9374,7 @@ If the ACL returns defer the result is a forced-fail.  Otherwise the expansion f
 .cindex headers "authentication-results:"
 .cindex authentication "expansion item"
 This item returns a string suitable for insertion as an
 .cindex headers "authentication-results:"
 .cindex authentication "expansion item"
 This item returns a string suitable for insertion as an

-&'Authentication-Results"'&
+&'Authentication-Results:'&

 header line.
 The given <&'authserv-id'&> is included in the result; typically this
 will be a domain name identifying the system performing the authentications.
 header line.
 The given <&'authserv-id'&> is included in the result; typically this
 will be a domain name identifying the system performing the authentications.


@@ -16459,6 +16456,8 @@ and from which pipeline early-connection (before MAIL) SMTP
 commands are acceptable.
 When used, the pipelining saves on roundtrip times.
 
 commands are acceptable.
 When used, the pipelining saves on roundtrip times.
 

+See also the &%hosts_pipe_connect%& smtp transport option.
+

 Currently the option name &"X_PIPE_CONNECT"& is used.
 .wen
 
 Currently the option name &"X_PIPE_CONNECT"& is used.
 .wen
 


@@ -17736,7 +17735,14 @@ larger prime than requested.
 The value of this option is expanded and indicates the source of DH parameters
 to be used by Exim.
 
 The value of this option is expanded and indicates the source of DH parameters
 to be used by Exim.
 

-&*Note: The Exim Maintainers strongly recommend using a filename with site-generated
+.new
+This option is ignored for GnuTLS version 3.6.0 and later.
+The library manages parameter negotiation internally.
+.wen
+
+&*Note: The Exim Maintainers strongly recommend,
+for other TLS library versions,
+using a filename with site-generated

 local DH parameters*&, which has been supported across all versions of Exim.  The
 other specific constants available are a fallback so that even when
 "unconfigured", Exim can offer Perfect Forward Secrecy in older ciphersuites in TLS.
 local DH parameters*&, which has been supported across all versions of Exim.  The
 other specific constants available are a fallback so that even when
 "unconfigured", Exim can offer Perfect Forward Secrecy in older ciphersuites in TLS.


@@ -17832,18 +17838,29 @@ Certificate Authority.
 
 Usable for GnuTLS 3.4.4 or 3.3.17 or OpenSSL 1.1.0 (or later).
 
 
 Usable for GnuTLS 3.4.4 or 3.3.17 or OpenSSL 1.1.0 (or later).
 

-For GnuTLS 3.5.6 or later the expanded value of this option can be a list
+.new
+For OpenSSL 1.1.0 or later, and
+.wen
+for GnuTLS 3.5.6 or later the expanded value of this option can be a list

 of files, to match a list given for the &%tls_certificate%& option.
 The ordering of the two lists must match.
 
 .new
 The file(s) should be in DER format,
 of files, to match a list given for the &%tls_certificate%& option.
 The ordering of the two lists must match.
 
 .new
 The file(s) should be in DER format,

-except for GnuTLS 3.6.3 or later when an optional filetype prefix
-can be used.  The prefix must be one of "DER" or "PEM", followed by
+except for GnuTLS 3.6.3 or later
+or for OpenSSL,
+when an optional filetype prefix can be used.
+The prefix must be one of "DER" or "PEM", followed by

 a single space.  If one is used it sets the format for subsequent
 files in the list; the initial format is DER.
 a single space.  If one is used it sets the format for subsequent
 files in the list; the initial format is DER.

-When a PEM format file is used it may contain multiple proofs,
-for multiple certificate chain element proofs under TLS1.3.
+If multiple proofs are wanted, for multiple chain elements
+(this only works under TLS1.3)
+they must be coded as a combined OCSP response.
+
+Although GnuTLS will accept PEM files with multiple separate
+PEM blobs (ie. separate OCSP responses), it sends them in the
+TLS Certificate record interleaved with the certificates of the chain;
+although a GnuTLS client is happy with that, an OpenSSL client is not.

 .wen
 
 .option tls_on_connect_ports main "string list" unset
 .wen
 
 .option tls_on_connect_ports main "string list" unset


@@ -18362,7 +18379,7 @@ or for any deliveries caused by this router. You should not set this option
 unless you really, really know what you are doing. See also the generic
 transport option of the same name.
 
 unless you really, really know what you are doing. See also the generic
 transport option of the same name.
 

-.option dnssec_request_domains routers "domain list&!!" unset
+.option dnssec_request_domains routers "domain list&!!" *

 .cindex "MX record" "security"
 .cindex "DNSSEC" "MX lookup"
 .cindex "security" "MX lookup"
 .cindex "MX record" "security"
 .cindex "DNSSEC" "MX lookup"
 .cindex "security" "MX lookup"


@@ -24551,7 +24568,7 @@ See the &%search_parents%& option in chapter &<<CHAPdnslookup>>& for more
 details.
 
 
 details.
 
 

-.option dnssec_request_domains smtp "domain list&!!" unset
+.option dnssec_request_domains smtp "domain list&!!" *

 .cindex "MX record" "security"
 .cindex "DNSSEC" "MX lookup"
 .cindex "security" "MX lookup"
 .cindex "MX record" "security"
 .cindex "DNSSEC" "MX lookup"
 .cindex "security" "MX lookup"


@@ -24730,6 +24747,8 @@ When used, the pipelining saves on roundtrip times.
 It also turns SMTP into a client-first protocol
 so combines well with TCP Fast Open.
 
 It also turns SMTP into a client-first protocol
 so combines well with TCP Fast Open.
 

+See also the &%pipelining_connect_advertise_hosts%& main option.
+

 Note:
 When the facility is used, the transport &%helo_data%& option
 will be expanded before the &$sending_ip_address$& variable
 Note:
 When the facility is used, the transport &%helo_data%& option
 will be expanded before the &$sending_ip_address$& variable


@@ -29033,7 +29052,8 @@ If DANE is requested and useable (see above) the following transport options are
 If DANE is not usable, whether requested or not, and CA-anchored
 verification evaluation is wanted, the above variables should be set appropriately.
 
 If DANE is not usable, whether requested or not, and CA-anchored
 verification evaluation is wanted, the above variables should be set appropriately.
 

-Currently the (router or transport options) &%dnssec_request_domains%& must be active and &%dnssec_require_domains%& is ignored.
+The router and transport option &%dnssec_request_domains%& must not be
+set to "never" and &%dnssec_require_domains%& is ignored.

 
 If verification was successful using DANE then the "CV" item in the delivery log line will show as "CV=dane".
 
 
 If verification was successful using DANE then the "CV" item in the delivery log line will show as "CV=dane".
 


@@ -40504,10 +40524,11 @@ defines the location of a text file of valid
 top level domains the opendmarc library uses
 during domain parsing. Maintained by Mozilla,
 the most current version can be downloaded
 top level domains the opendmarc library uses
 during domain parsing. Maintained by Mozilla,
 the most current version can be downloaded

-from a link at &url(http://publicsuffix.org/list/).
+from a link at &url(https://publicsuffix.org/list/, currently pointing
+at https://publicsuffix.org/list/public_suffix_list.dat)

 See also util/renew-opendmarc-tlds.sh script.
 See also util/renew-opendmarc-tlds.sh script.

-The default for the option is currently
-/etc/exim/opendmarc.tlds
+The default for the option is /etc/exim/opendmarc.tlds.
+

 
 The &%dmarc_history_file%& option, if set
 .oindex &%dmarc_history_file%&
 
 The &%dmarc_history_file%& option, if set
 .oindex &%dmarc_history_file%&


@@ -41028,7 +41049,9 @@ Events have names which correspond to the point in process at which they fire.
 The name is placed in the variable &$event_name$& and the event action
 expansion must check this, as it will be called for every possible event type.
 
 The name is placed in the variable &$event_name$& and the event action
 expansion must check this, as it will be called for every possible event type.
 

+.new

 The current list of events is:
 The current list of events is:

+.wen

 .display
 &`dane:fail              after    transport  `& per connection
 &`msg:complete           after    main       `& per message
 .display
 &`dane:fail              after    transport  `& per connection
 &`msg:complete           after    main       `& per message


@@ -41042,6 +41065,7 @@ The current list of events is:
 &`tcp:close              after    transport  `& per connection
 &`tls:cert               before   both       `& per certificate in verification chain
 &`smtp:connect           after    transport  `& per connection
 &`tcp:close              after    transport  `& per connection
 &`tls:cert               before   both       `& per certificate in verification chain
 &`smtp:connect           after    transport  `& per connection

+&`smtp:ehlo              after    transport  `& per connection

 .endd
 New event types may be added in future.
 
 .endd
 New event types may be added in future.
 


@@ -41068,6 +41092,7 @@ with the event type:
 &`msg:host:defer       `& error string
 &`tls:cert             `& verification chain depth
 &`smtp:connect         `& smtp banner
 &`msg:host:defer       `& error string
 &`tls:cert             `& verification chain depth
 &`smtp:connect         `& smtp banner

+&`smtp:ehlo            `& smtp ehlo response

 .endd
 
 The :defer events populate one extra variable: &$event_defer_errno$&.
 .endd
 
 The :defer events populate one extra variable: &$event_defer_errno$&.