This is the FAQ for the Exim Message Transport Agent. Thanks to the many people who provided the original information. This file would be amazingly cluttered if I tried to list them all. Suggestions for corrections, improvements, and additions are welcome.
**** This version of the FAQ applies to Exim 2.12 and earlier releases. **** It is out-of-date with respect to the configuration syntax changes **** in release 3.00. It will be updated as soon as possible.
References of the form Cnnn and Fnnn are to the sample configuration and filter files that can be found in the separately distributed directory called config.samples. The primary location is
ftp://ftp.cus.cam.ac.uk/pub/software/programs/exim/config.samples.tar.gz
There are brief descriptions of these files at the end of this document.
The FAQ is divided into the following sections: Debugging, Building exim, Mailbox locking, Routing, Directing, Delivery, UUCP, Performance, Policy controls, Majordomo, Rewriting, Headers, Fetchmail, Perl, Miscellaneous, BSDI, IRIX, Linux, Sun systems, Cookbook, and List of sample configurations.
Philip Hazel <ph10@cus.cam.ac.uk>
Last updated: 04-Jan-1999 (comment about 3.00 added 13-Apr-1999)
A0001: Exim should never crash. The author is always keen to know about crashes, so that they can be diagnosed and fixed. However, before you start sending email, please check that you are running the latest release of Exim, in case the problem has already been fixed. The techniques described below can also be useful in trying to pin down exactly which circumstances caused the crash and what Exim was trying to do at the time. If the crash is reproducable (by a particular message, say) keep a copy of that message. If there is a core file (in Exim's spool directory), see if you can get any information from it.
One thing that has caused crashes in the past has been incorrectly installed DB libraries. In particular, if you are running any version of Berkeley db, it is best to set USE_DB=yes in Local/Makefile before building Exim. This then avoids the use of the "ndbm compatibility interface" via the ndbm.h include file, which has been found to be incorrect on some systems. If you have already built Exim, you can just edit Local/Makefile and run make again to rebuild. Before restarting Exim, delete any existing database files in the spool/db directory.
Q0002: Exim is not working. What is wrong?A0002: Exactly how is it not working? Check the more specific questions in the other sections of this FAQ. Some general techniques for debugging are:
1. Look for information in Exim's log files. These are in the "log" directory in Exim's spool directory, unless you have configured a different path for them. Serious operational problems are reported in paniclog.
2. If the problem involves the delivery of one or more messages, try forcing a delivery with the -d option, to cause Exim to output debugging information. For example:
exim -d -M 0z6CXU-0005RR-00
On its own, -d produces a small amount of information. Following it with a number increases the amount given: -d9 gives the maximum amount of general information; -d10 gives in addition details of the interpretation of filter files, and -d11 or higher also turns on the debugging option for DNS lookups. The output is written to the standard error stream.
3. If the problem involves incoming SMTP mail, try using the -bh option to simulate an incoming connection from a specific host, for example:
exim -bh 10.9.8.7
This goes through the motions of an SMTP session, without actually accepting a message. Information about various policy checks is output. You will need to know how to pretend to be an SMTP client.
4. If the problem involves lack of recognition or incorrect handling of local addresses, try using the -bt option with debugging turned on, to see how Exim is handling the address. For example,
exim -d2 -bt z6abc
will show you how it would handle the local part "z6abc". Increase the debug level to -d9 for more information.
Q0003: What does the error "Child process of address_pipe transport returned 69 from command xxx" mean?A0003: The most common meaning of exit code 69 is "unavailable", and this often means that when Exim tried to exec the command xxx, it failed. One cause of this might be incorrect permissions on the file containing the command.
Q0004: My virtual domain setup isn't working. How can I debug it?A0004: You can use an exim command with -d (or -d2, -d3 ... -d9) to get it to show you how it is processing addresses. You don't actually need to send a message; use the -bt option like this:
exim -d2 -bt localpart@virtualhost
This will show you which directors it is using. If the problem appears to be with the expansion of an option setting, you can use the debug_print option on a director (or router) to get Exim to output the expanded string values as it goes along.
Q0005: Why is Exim giving "421 Unexpected log failure, please try later" when receiving an SMTP message with a large number of recipients?A0005: You are verifying recipients, and your configuration is one that does a different lookup of some sort for each recipient. Exim keeps lookup files open, in case there are several lookups in the same file. Versions of Exim prior to 2.10 did not limit the number of open files used for this purpose, and your operating system's maximum per process has been reached. Exim is trying to log the failure to open a file, but cannot open the log file, for the same reason. If upgrading Exim is not immediately possible, you might be able to increase your operating system's maximum number of open files per process.
A0101: The problem is that libident assumes "struct timeval" refers to DST_NONE, and so it tries to avoid using this structure when DST_NONE isn't defined. Unfortunately it doesn't make this change everywhere it should, and so it blows up. The problem has been seen on NetBSD and some versions of the Linux C library. An easy, albeit not particularly neat, fix is to add -DDST_NONE to LIBIDENTCFLAGS for systems that are afflicted like this - there's not a lot else you can do without modifying libident. The value of DST_NONE is never used, so defining it to be empty should be harmless.
Q0102: When I ran make I got the error "undefined reference to dbopen".A0102: Either:
(A) This means you (or the default configuration for your operating system) have configured Exim to use Berkeley DB version 1.xx and it has not been given access to the DB library (where dbopen should be found). You may need something like DBMLIB=-ldb in Local/Makefile. Berkeley DB is one of several alternative DBM libraries that Exim can make use of. For a discussion of DBM issues, see the file doc/dbm.discuss.txt in the Exim distribution.
(B) You are running on a version of Linux which has a problem in its libraries. This effect isn't fully understood. It has been seen with the libraries used in Caldera OpenLinux Base 1.1.
Q0103: I can't get Exim to compile with Berkeley DB version 2.x.A0103: Have you set USE_DB=yes in Local/Makefile? This causes Exim to use the native interface to the DBM library instead of the compatibility interface, which needs a header called ndbm.h that may not exist on your system.
Q0104: I'm getting an "undefined symbol" error for hosts_ctl when I try to build Exim.A0104: You should either remove the definition of USE_TCP_WRAPPERS or add -lwrap to your EXTRALIBS setting.
Q0105: I'm about to upgrade to a new Exim release. Do I need to ensure the spool is empty, or take any other special action?A0105: No. New releases are made backwards compatible with old spool files and "hints" databases so that upgrading can be done on a running system. All that should be necessary is to install a new binary and then HUP the daemon if you are running one.
Q0106: What does the error "install-info: command not found" mean?A0106: You have set INFO_DIRECTORY in your Local/Makefile, and Exim is trying to install the Texinfo documentation, but cannot find the command called install-info. If you have a version of Texinfo prior to 3.9, you should upgrade. Otherwise, check your installation of Texinfo to see why the install-info command is not available.
A0201: Your configuration specifies that local mailboxes are all held in single directory, via configuration lines like these (taken from the default configuration):
local_delivery:
driver = appendfile
file = /var/mail/${local_part}
and the permissions on the directory probably look like this:
drwxrwxr-x 3 root mail 512 Jul 9 13:48 /var/mail/
Using the default configuration, Exim runs as the local user when doing a local delivery, and it uses a lock file to prevent any other process from updating the mailbox while it is writing to it. With those permissions the delivery process, running as the user, is unable to create a lock file in the /var/mail directory. There are two solutions to this problem:
(A) Set the "write" and "sticky bit" permissions on the directory, so that it looks like this:
drwxrwxrwt 3 root mail 512 Jul 9 13:48 /var/mail/
The "w" allows any user to create new files in the directory, but the "t" bit means that only the creator of a file is able to remove it. This is the same setting as is normally used with the /tmp directory.
(B) Arrange to run the local_delivery transport under a specific group by changing the configuration to read
local_delivery:
driver = appendfile
file = /var/mail/${local_part}
group = mail
The delivery process still runs under the user's uid, but with the group set to "mail". The group permission on the directory allows the process to create and remove the lock file.
The choice between (A) and (B) is up to the administrator. If the second solution is used, users can empty their mailboxes by updating them, but cannot delete them.
If your problem involves mail to root, see also A0507.
Q0202: I am experiencing mailbox locking problems with Sun's mailtool used over a network.A0202: See A9705 in the Sun-specific section below.
A0301: It means exactly what it says. Exim has tried to route a domain that it thinks is not local, and when it looked it up in the DNS, the lowest numbered MX record pointed at the local host.
(A) If the domain is meant to be handled as a local domain, then there is a problem with the setting of the local_domains configuration option. If you have not set this, then only the name of the local host is treated as a local domain. If, for example, your host is called myhost.mydomain.com and you want it to handle mail for the domain mydomain.com as well as for its own name, you must set
local_domains = myhost.mydomain.com:mydomain.com
or, if you want to be more general, you could use
local_domains = *.mydomain.com:mydomain.com
If you have a large number of individual local domains, you should investigate storing them in a file and setting local_domains to do a lookup.
All the domains in local_domains are treated as synonymous by default. If you want to specify different handling for different domains, you can either use domains options, to restrict certain directors to certain domains, or use the $domain expansion variable in director options to vary the value according to the domain, for example, setting the name of an alias file to /etc/aliases/$domain.
(B) If the domain is one for which the local host is providing a forwarding service (called "mail hubbing"), possibly as part of a firewall, then you need to set up a router to tell Exim where to send messages addressed to it, since the DNS directs them to the local host. The routers section of your configuration file should look something like this:
hubbed_hosts:
driver = domainlist
transport = remote_smtp
route_list = see discussion below
other_hosts:
driver = lookuphost
transport = remote_smtp
Note that the domainlist router must come first so that it can pick off a hubbed host before it gets to the lookuphost router. The contents of the route_list option depend on how many hosts you are hubbing for, and how their names are related to the domain name. Suppose the local host is a firewall, and all the domains in *.foo.bar have MX records pointing to it, and each domain corresponds to a host of the same name. Then the setting could be
route_list = "*.foo.bar $domain byname"
If there isn't a convenient connection between the domain names and the host names, then you either have to list each domain separately, or use a lookup expansion to look up the host from the domain, or put the routing information in a file and use the route_file option.
(C) If neither (A) nor (B) is the case, then the lowest numbered MX record for the domain should not be pointing to your host. You should arrange to get the DNS mended.
Q0302: How do I configure Exim to send all non-local mail to a gateway host?A0302: Replace the lookuphost router in the default configuration with the following:
send_to_gateway:
driver = domainlist
transport = remote_smtp
route_list = "* gate.way.host byname"
This uses gethostbyname() to find the gateway's IP address. You could alternatively have "bydns" to do a DNS lookup. If there are several hosts you can send to, you can specify them as a colon-separated list. See also Q0402.
Q0303: How do I configure Exim to send all non-local mail to a central server if it cannot be immediately delivered by my host? I don't want to have queued mail waiting on my host.A0303: Add to the remote_smtp transport the following:
fallback_hosts = central.server.name(s)
If there are several names, they must be separated by colons.
Q0304: How can I arrange for messages submitted by (for example) Majordomo to be routed specially?A0304: See A0404.
Q0305: How do I arrange for all incoming email for *@some.domain to go into one pop3 mail account? The customer doesn't want to add a list of specific local parts to the system.A0305: Set up a special transport that writes to the mailbox like this:
special_transport:
driver = appendfile
file = /pop/mailbox
envelope_to_add
return_path_add
delivery_date_add
user = exim
The file will be written as the user "exim". Then arrange to route all mail for that domain to that transport, with a router like this:
special_router:
driver = domainlist
transport = special_transport
route_list = "some.domain"
Alternatively, you could make some.domain a local domain, and use a smartuser director instead.
Q0306: The route_list setting ^foo$:^bar$ $domain byname in a domainlist router does not work.A0306: The first thing in a route_list item is a single pattern, not a list of patterns. You need to write that as ^(foo|bar)$ $domain byname. Alternatively, you could use several items and write
route_list = "foo $domain byname; bar $domain byname"
Note the semicolon separator. This is because the second thing in each item can be a list - of hosts.
Q0307: I'm getting "permission denied" when Exim attempts to check a require_files option.A0307: See A0410 below.
Q0308: I have a domain for which some local parts must be delivered locally, but the remainder are to be treated like any other remote addresses.A0308: The way to do this is not to include the domain in local_domains, so that addresses initially get passed to the routers. The first router should be definied like this:
special_local:
driver = domainlist
local_parts = whatever...
domains = whatever...
route_list = * localhost byname
self = local
That will pick off those addresses with matching local parts and domains, and hand them to the directors, because of the self = local setting. Any other addresses will fall through to the other routers and be handled as normal remote addresses.
Q0309: For certain domains, I don't want Exim to use MX records. Instead, I want it just to look up the hosts' A records. I tried using mx_domains_except in the smtp router, but it didn't work.A0309: The mx_domains_except option works only as an exception list to the mx_domains option, which lists domains for which there must be an MX record (an A record is no good). You can achieve what you want using either a lookuphost or a domainlist router:
(1) Using lookuphost:
special_domains:
driver = lookuphost
transport = remote_smtp
domains = list:of:domains:you:want:to:do:this:for
gethostbyname
(2) Using domainlist:
special_domains:
driver = domainlist
transport = remote_smtp
domains = list:of:domains:you:want:to:do:this:for
route_list = * * byname
If the list of domains is actually a lookup in a file, you can dispense with domains in the domainlist case, and put the lookup into the route_list option.
Q0310: How can I configure Exim on a firewall machine so that if mail arrives addressed to a domain whose MX points to the firewall, it is forwarded to the internal mail server?A0310: As your first router, have the standard lookuphost router from the default configuration, with the added option
self = fail_soft
This will handle all domains whose lowest numbered MX records do not point to your host. If it hits a domain whose lowest numbered MX does point to your host, the "self" option comes into play. That setting causes it to pass the address on to the next router. (The default causes it to generate an error.)
As your second (and last) router, set up a domainlist router that sends everything to your internal mail server. That is, use an option of the form
route_list = * internal.server byname
Q0311: How can I arrange that messages larger than some limit are handled by
a special router?
A0311: If you are using Exim 2.10 or greater, you can use a condition option on the router of the form
condition = ${if >{$message_size}{100K}{yes}{no}}
Earlier versions of Exim do not have numerical comparison operators, though you can use tricks like
condition = ${if eq {${substr_5:$message_size}}{}{no}{yes}}
Q0312: If a DNS lookup returns no MX records why doesn't Exim just bin the
message?
A0312: If a DNS lookup returns no MXs, Exim looks for an A record, in accordance with the rules that are defined in the RFCs. If you want to break the rules, you can set mx_domains in the lookuphost router, but you will cut yourself off from those sites (and there still seem to be plenty) who do not set up MX records.
Q0313: When a DNS lookup for MX records fails to complete, why doesn't Exim send the messsage to the host defined by the A record?A0313: The RFCs are quite clear on this. Only if it is known that there are no MX records is an MTA allowed to make use of the A record. When an MX lookup fails to complete, Exim does not know whether there are any MX records or not. There seem to be some nameservers (or some configurations of some nameservers) that give a "server fail" error when asked for a non-existent MX record. Exim uses standard resolver calls, which unfortunately do not distinguish between this case and a timeout, so all Exim can do is try again later.
Q0314: Can you specify a list of domains to explicitly reject?A0314: Use a router like this:
reject_domains:
driver = domainlist
self = fail_hard
domains = list:of:domains:to:reject
route_list = * localhost byname
Q0315: Is it possible to use a conditional expression for the host item in a
route_list for the domainlist router? I tried the following, but it
doesn't work:
route_list = "* ${if match{$header_from:}{.*\\.usa\\.net\\$} \
{<smarthost1>}{<smarthost2>} bydns_a"
A0315: The problem is that the second item in the route_list contains white space, which means that it gets terminated prematurely. To avoid this, you must put the second item in quotes, and because the whole item is already in quotes, you have to escape them like this:
route_list = "* \"${if match{$header_from:}{.*\\.usa\\.net\\$} \
{<smarthost1>}{<smarthost2>}\" bydns_a"
Q0316: I send all external mail to a smart host, but this means that bad
addresses also get passed to the smart host. Can I avoid this?
A0316: If you are receiving the mail via SMTP, then you can use verification to weed out the bad addresses. Set no_verify on the router which sends everything to your smart host, and insert a new router with verify_only that does general routing using DNS lookups (e.g. the default lookuphost router), or any other verification you want. Then set receiver_verify so that addresses are accepted only if they verify successfully.
A0401: Adding an asterisk to a search type causes Exim to look up "*" when the normal lookup fails. So if your director is something like this:
virtual:
driver = aliasfile
domains = virt.dom.ain
file = /usr/lib/aliases.virt
search_type = lsearch
no_more
you should change "lsearch" to "lsearch*", and put this in the alias file:
*: postmaster@virt.dom.ain
This solution has the feature that if there are several unknown addresses in the same message, only one copy gets sent to the postmaster, because of Exim's normal de-duplication rules.
You can get separate deliveries for each unknown address only if you can direct them to a specific transport, by using a smartuser director like this:
virtual:
driver = aliasfile
domains = virt.dom.ain
file = /usr/lib/aliases.virt
search_type = lsearch
default_virtual:
driver = smartuser
domains = virt.dom.ain
transport = special_delivery
new_address = postmaster@virt.dom.ain
no_more
If an address in the virtual domain is not matched by the normal alias lookup, then it gets picked up by the smartuser and passed to the transport with a new address. There is no checking for duplicates, so if there is more than one address that passes through this mechanism, multiple copies get delivered. In order to distinguish them, the envelope_to_add option can be set on the transport, to cause the insertion of an Envelope-To: header containing the original recipient address.
Q0402: How do I configure Exim to send all messages to a central server?A0402: This implies that you are not doing any local deliveries at all. Set
local_domains =
in the configuration file. This specifies that there are no local domains (by default your host name is set up as a local domain). Then all addresses are non-local - A0302 tells you how to deal with them.
Q0403: How do I configure Exim to send messages for unknown local users to a central server?A0403: At the end of the directors section of the configuration, insert the following director:
unknown:
driver = smartuser
transport = unknown_transport
Then somewhere in the transports section of the configuration insert
unknown_transport:
driver = smtp
hosts = server.host.name
A colon-separated list of hosts may be given. They are tried in order. By default, the IP address of any host is found by looking in the DNS and doing MX processing (so really it is a domain list rather than a host list). If you don't want MX processing, set the "gethostbyname" option:
unknown_transport:
driver = smtp
hosts = server.host.name
gethostbyname
This calls the gethostbyname() function to find IP addresses. Depending on your operating system and configuration, this usually consults /etc/hosts and possibly other sources of information, as well as, or instead of, the DNS.
If you want to change the recipient address when doing this, you can use the new_address option on the smartuser director. For example, if the address is user@foo.bar.com and the setting is
new_address = $local_part@bar.com
The message is sent to the server with the envelope recipient changed to user@bar.com. However, this does not make any changes to the message's headers.
Q0404: How can I arrange for messages submitted by (for example) Majordomo to be handled specially?A0404: You can use the condition option on a director or router, with a setting such as
condition = "${if and {eq {$sender_host_address}{}} \
{eq {$sender_ident}{majordom}} {yes}{no}}"
This first tests for a locally-submitted message, by ensuring there is no sending host address, and then it checks the identity of the user that ran the submitting process.
Q0405: On a host that accepts mail for several domains, do I have to use fully qualified names in /etc/aliases or do I have to set up an alias file for each domain?A0405: You can do it either way. If you use a single file, you must set include_domains on the aliasfile director. If you use a separate file for each domain you can use a single director with an option such as
file = /etc/aliases/$domain
(as in C007), or you can have several different directors, each one with
domains = domain1:domain2:...
so that each one processes certain domains only. That way you could have several domains sharing an alias file. All of this assumes that you want have different aliases for each domain. If all the domain names are in effect just synonyms, you don't need to do anything other than ensure they all match something in local_domains.
Q0406: Some of my users are using the .forward to pipe to a shell command which appends to the user's INBOX. How can I forbid this?A0406: If you allow your users to run shells in pipes, you cannot control which commands they run or which files they write to. However, you should point out to them that writing to an INBOX by arbitrary commands is not interlocked with the MTA and MUAs, and is liable to mess up the contents of the file.
If a user simply wants to choose a specific file for the delivery of messages, this can be done by putting a file name in a .forward file rather than using a pipe, or by using the "save" command in an Exim filter file.
You can set forbid_pipe on the forwardfile director, but that will prevent them from running any pipe commands at all. Alternatively, you can restrict which commands they may run in their pipes by setting the allow_commands and/or restrict_to_path options in the address_pipe transport.
Q0407: How can I arrange for a default value when using a query-style lookup such as LDAP or NIS+ to handle aliases?A0407: Using the queries option for the aliasfile driver should do what you want. You can supply a second query which gets obeyed when the first query fails. For example,
queries = "\
ldap:://x.y.z/l=yvr?aliasaddress?sub?(&(mail=$local_part@$domain)):\
ldap:://x.y.z/l=yvr?aliasaddress?sub?(&(mail=default@$domain))"
Q0408: If I don't fully qualify the addresses in a virtual domain's alias file
then mail to aliases which also match the local domain get delivered to
the local domain.
For example, if the alias file for foobar.com is
foo: joe@some.place.com
postmaster: foo
then mail sent to postmaster@foobar.com is not delivered to joe@some.place.com but instead goes to foo@localdomain.com.
A0408: Set the qualify_preserve_domain option on the aliasfile director.
Q0409: We've got users who chmod their home to 750, and home is NFS-mounted without root privilege, so Exim cannot access ~user/.forward.A0409: Set the seteuid option on the forwardfile director so that Exim "becomes" the user before trying to read the file. However, if your operating system does not support the seteuid() function, you cannot do this. In that circumstance, if you cannot persuade your users to make their .forward files world readable, you can set the ignore_eacces option, which causes Exim to ignore unreadable files.
Q0410: I'm getting "permission denied" when Exim tries to check a for the existence of a user's .procmailrc file using require_files.A0410: Exim is running under its own uid (or root if there isn't an Exim uid) when it checks require_files. You can cause it to change to a specific uid by putting an item not containing any / characters at the start of the require_files list. In this case you probably want a director along these lines:
procmail:
driver = localuser
require_files = ${local_part}:${home}/.procmailrc
transport = procmail_pipe
Q0411: How can I deliver mail into different directories for each virtual
domain, doing user lookups not against /etc/passwd but against
/etc/passwd.domain?
A0411: See configuration sample C009.
Q0412: I want mail for any local part at certain virtual domains to go to a single address for each domain.A0412: One way to to this is
virtual:
driver = smartuser
domains = lsearch;/etc/virtual
new_address = ${lookup{$domain}lsearch{/etc/virtual}{$value}fail}
The /etc/virtual file contains a list of domains and the addresses to which their mail should be sent. For example:
domain1: postmaster@some.where.else
domain2: joe@xyz.plc
etc.
If the number of domains is large, using a DBM or cdb file would be more efficient.
Q0413: How can I make Exim look in the alias NIS map instead of /etc/aliases?A0413: The default configuration does not use NIS (many hosts don't run it). You should change the system_aliases director to
system_aliases:
driver = aliasfile
file = mail.aliases
search_type = nis
If you want to use /etc/aliases as well as NIS, put this director (with a different name) before or after the default one, depending on which data source you want to take precedence.
Q0414: What does the error message "error in forward file (filtering not enabled): missing or malformed local part ..." mean?A0414: If you are trying to use an Exim filter, you have forgotten to enable the facility, which is disabled by default. In the forwardfile director (in the Exim configuration file) you need to set
filter = true
to allow a .forward file to be used as an Exim filter. If you are not trying to use an Exim filter, then you have put a malformed address in the .forward file.
Q0415: Exim isn't recognizing certain forms of local address.A0415: (1) Try using the -bt option with debugging turned on, to see how Exim is handling the addresses. For example,
exim -d2 -bt z6abc
will show you how it would handle the local part "z6abc". Increase the debug level to -d9 for more information.
(2) If the local user names contain capital letters, that is probably the cause of your problem. Setting up such user names is a bad idea. By default, everything is lowercased before the final delivery for the sake of alias matching and user name matching, because people who type email addresses often get the case wrong. You can stop this by setting
locally_caseless = false
but then incoming addresses are recognized only in the correct case. See also A0424.
Q0416: I have a domain for which some local parts must be delivered locally, but the remainder are to be treated like any other remote addresses.A0416: See A0308.
Q0417: What I really need is the ability to obtain the result of a pipe command so that I can filter externally and redirect internally. Is this possible?A0417: This is not possible. The result of a pipe command is not available to a filter, because it doesn't run any deliveries while filtering. It just sets up deliveries. They all happen later. If you want to run pipes and examine their results, you need to set up a single delivery to a delivery agent such as procmail which provides this kind of facility.
Q0418: When I set a suffix on one of my directors, it doesn't get stripped when checking the local_parts option. Why is this?A0418: The test on local parts and domains is done early on, and only if they match is supplementary processing such as prefix and suffix recognition done. There is a section of the manual called "Skipping directors" which gives details. If you want to ignore a prefix or suffix in the initial test of the local part, you can do so by replacing local_parts with a setting of the condition option. For example, suppose you wanted to look up the basic local part in a file, and run the director if it is found:
condition = "${if lookup{\
${if match{$local_part}{^(.*)-request}{$1}{$local_part}}\
}lsearch{/some/file}{yes}}"
The key that is looked up is the second line, which uses a regular expression to strip "-request" from the local part if it is present.
Q0419: Why will Exim deliver a message locally to any username that is longer than 8 characters as long as the first 8 characters match one of the local usernames?A0419: The problem is in your operating system. Exim just calls the getpwnam() function to test a local part for being a local login name. It does not presume to guess the maximum length of user name for the underlying operating system. Some operating systems correctly reject names that are longer than the maximum length; yours is apparently deficient in this regard.
Q0420: Why am I seeing the error "bad mode (100664) for /home/test/.forward (userforward director)"? I've looked through the documentation and FAQ but can't see anything to suggest that exim has to do anything other than read the .forward file.A0420: For security, Exim checks for mode bits that shouldn't be set, by default 022. You can change this by setting the "modemask" option of the forwardfile director.
Q0421: How can I arrange that messages larger than some limit are handled by a special director?A0421: See A0311.
Q0422: When a user's .forward file is syntactially invalid, Exim defers delivery of all messages to that user, which sometimes include the user's own test messages. Can it be told to ignore the .forward file and/or inform the user of the error?A0422: Setting skip_syntax_errors on the forwardfile director causes syntax errors to be skipped. When dealing with users' .forward files it is best to combine this with a setting of syntax_errors_to in order to send a message about the error to the user. However, to avoid an infinite cascade of messages, you have to be able to send to an address that bypasses .forward file processing. This can be done by including a director like this one
real_localuser:
driver = localuser
transport = local_delivery
prefix = real-
before the forwardfile director. This will do an ordinary local delivery without .forward processing, if the local part is prefixed by "real-". You can then set something like the following options on the forwardfile director:
skip_syntax_errors
syntax_errors_to = real-$local_part@$domain
syntax_errors_text = "\
This is an automatically generated message. An error has been \
found\nin your .forward file. Details of the error are reported \
below. While\nthis error persists, messages addressed to you will \
get delivered into\nyour normal mailbox and you will receive a \
copy of this message for\neach one."
A final tidying setting to go with this is a rewriting rule that changes "real-username" into just "username" in the headers of the message:
^real-([^@]+)@your\.dom\.ain$ $1@your.dom.ain h
This means that users won't ever see the "real-" prefix, unless they look at the Envelope-To header.
Q0423: I have some users on my system with upper case letters in their login names, but these are not recognized.A0423: See A0415.
Q0424: I have unset locally_caseless because my users have upper case letters in their login names, but incoming mail now has to use the correct case. Can I relax this somehow?A0424: If you really have to live with caseful user names but want incoming local parts to be caseless, then you have to maintain a file, indexed by the lower case forms, that gives the correct case for each login, like this:
admin: Admin
steven: Steven
mcdonald: McDonald
lamanch: LaManche
...
and at the start of your directors, put one like this:
set_case_director:
driver = smartuser
new_address = "${lookup{${lc:$local_part}}lsearch{/the/file}\
{$value@$domain}fail}"
For efficiency, you should also set the new_director option to cause processing of the changed address to begin at the next director. If you are otherwise using the default configuration, then the setting would be
new_director = system_aliases
If there are lots of users, then a DBM or cdb file would be more efficient than lsearch. If you are handling several domains, then you will have to extend this configuration to cope appropriately.
A0501: Whenever Exim does a local delivery, it runs a process under a specific user and group id (uid and gid). For deliveries into mailboxes, and to pipes and files set up by .forwarding, it normally picks up the uid/gid of the receiving user. However, if an address is directed to a pipe or a file by some other means, such an entry in the system alias file of the form
majordomo: |/local/mail/majordomo ...
then Exim has to be told what uid/gid to use for the delivery. This can be done either on the director that handled the address, or on the transport that actually does the delivery. If a pipe is going to run a setuid program, then it doesn't matter what uid Exim starts it out with, and so the most straightforward thing is to put
user = exim
on either the director or the transport. A setting on the transport overrides a setting on the director, so if the same transport is being used with several directors, you should set the user on it only if you want the same uid to be used in all cases.
With no other configuration, the transports used for file and pipe deliveries are the ones called address_file and address_pipe. You can specify different transports by setting, for example,
pipe_transport = special_pipe_transport
on the aliasfile director. Then you can set up special_pipe_transport
special_pipe_transport:
driver = pipe
user = ????
which will be used only for pipe deliveries from that one director. What you put for the ???? is up to you, and depends on the particular circumstances.
Q0502: Exim won't deliver to a host with no MX record.A0502: Are you sure there really is no MX record? Sometimes a typo results in a malformed MX record in the zone file, in which case the DNS resolver gives a SERVFAIL error rather than NXDOMAIN. Exim has to treat this as a temporary error, so it can't go on to look for an A record. You can check for this state using one of the DNS interrogation commands, such as "dig".
Is there a wildcard MX record for your domain? Is the search_parents option on in your lookuphost router? (Prior to Exim version 1.80 this was the default; it was changed because of this problem.) If the answer to both these questions is "yes", then that is the cause of the problem. When the DNS resolver fails to find the MX record, it tries adding on your domain if search_parents is true, and thereby finds your wildcard MX record. For example:
. There is a wildcard MX record for *.a.b.c.
. There is a host called x.y.z that has an A record and no MX record.
. Somebody on a machine m.a.b.c domain tries to mail to user@x.y.z.
. Exim calls the DNS to look for an MX record for x.y.z.
. The DNS doesn't find any MX record. Because search_parents is true, it then tries searching the current host's parent domain, so it looks for x.y.z.a.b.c and picks up the wildcard MX record.
Setting search_parents false makes this case work while retaining the wildcard MX record. However, anybody on the machine m.a.b.c who mails to user@n.a (expecting it to go to user@n.a.b.c) now has a problem.
Q0503: How should Exim be configured when it is acting as a temporary storage system for a domain on a dial-up host?A0503: Exim isn't really designed for this, but... The lowest-numbered MX record for the domain should be pointing to your host. You should set a large retry time for that domain, so that Exim doesn't keep trying to deliver when the host is off line. When the host comes online, the waiting messages have to be kicked somehow. This can be done by calling Exim with the -R option, or via the SMTP ETRN command. See the manual chapter entitled "Intermittently connected hosts".
Q0504: I would like to deliver mail addressed to a given domain normally, but also to generate a message to the envelope sender.A0504: If the domain is a local one, you can do this with an "unseen" smartuser director and an autoreply transport, along the following lines:
# Transport
warning_t:
driver = autoreply
file = /usr/local/mail/warning.txt
file_expand
from = postmaster@your.domain
to = $sender_address
user = exim
subject = "Re: Your mail to ${local_part}@${domain}"
# Director
auto_warning_d:
driver = smartuser
domains = <domains you want to do this for>
condition = ${if eq{$sender_address}{}{no}{yes}}
transport = warning_t
no_verify
unseen
Note the use of the condition option to avoid attempting to send a message when there is no sender (that is, when the incoming message is a delivery error report). You can of course extend this to include other conditions. If you want to log the sending of messages, you can add
log = /some/file
to the transport and also make use of the "once" option if you want to send only one message to each sender.
Q0505: Exim keeps crashing with segmentation errors (signal 11 or 139) during delivery. This seems to happen when it is about to contact a remote host or when a delivery is deferred.A0505: This could be a problem with Exim's databases. Check that your DBM library is correctly installed. In particular, if you have installed a second DBM library onto a system that already had one, check that its version of ndbm.h is being seen first. For example, if the new version is in /usr/local/include, check that there isn't another version in /usr/include. If you are using Berkeley db, you can set USE_DB=yes in your Local/Makefile to avoid using ndbm.h altogether. This is particularly relevant for version 2 of Berkeley db, because no ndbm.h file is distributed with it.
Q0506: Whenever Exim tries to do a local delivery, it gives a permission denied error for the .forward file, like this:
1998-08-10 16:55:32 0z5y2W-0000B8-00 == xxxx@yyy.zzz <xxxx@yyy.zz>
D=userforward defer (-1): failed to open /home/xxxx/.forward
(userforward director): Permission denied (euid=1234 egid=101)
A0506: Have you remembered to make Exim setuid root?
Q0507: I have installed Exim, but now I can't mail to root any more. Why is this?A0507: Most people set up root as an alias for the manager of the machine. If you haven't done this, Exim will attempt to deliver to root as if it were a normal user. This isn't really a good idea because the delivery process would run as root. Exim has a trigger guard in the option
never_users = root
in the default configuration file. This prevents it from running as root when doing any local deliveries. If you really want to run local deliveries as root, remove this line, but it would be better to create an alias for root instead.
Q0508: How can I stop undeliverable bounce messages (e.g. to routeable, but undeliverable, spammer senders) from clogging up the queue for days?A0508: Set ignore_errmsg_errors to drop them immediately, or set ignore_errmsg_ errors_after to specify a (short) time to keep them for. I use 12h so that I notice them, but they go away relatively quickly.
Q0509: How can mails that are being routed through directors other than localuser be delivered under the uid of the recipient?A0509: A0501 contains background information on this. If you are using, say, an alias file to direct messages to specific mailboxes, then you can use the "user" option on either the aliasfile director or the appendfile transport to set the uid. What you put in the setting depends on how the required uid is to be found. It could be looked up in a file or computed somehow from the local part, for example.
Q0510: I want to use MMDF-style mailboxes. How can I get Exim to append the ctrl-A characters that separate indvidual emails?A0510: Set the suffix option in the appendfile transport. In fact, for MMDF mailboxes you need a prefix as well as a suffix to get it working right, so your transport should contain these settings:
prefix = "\001\001\001\001\n"
suffix = "\001\001\001\001\n"
Q0511: I have an ISDN connection and would like a way of running the queue
automatically when it is up.
A0511: The following shell commands test for the interface being up and then run the queue:
ifconfig ppp0 | fgrep UP >/dev/null
if [ $? -eq 0 ] ; then exim -q ; fi
You could put these commands into a script which runs them at regular intervals. You might want to use -qq instead of -q.
With Linux, the script /etc/ppp/ip-up is run after a ISDN connection or a more general PPP connection has been established. If you are using Linux, you could put the call to exim in that script.
Q0512: If a user's mailbox is over quota, is there a way for me to set it up so that the mail bounces to the sender and is NOT stored in the mail queue?A0512: In the retry section of the configuration, put
*@your.dom.ain quota
That is, provide no retry timings for over quota errors. They will then bounce immediately. Alternatively, you can set up retries for a short time only, or use something like this:
*@your.dom.ain quota_7d
*@your.dom.ain quota F,2h,15m; F,3d,1h
which bounces immediately if the user's mailbox hasn't been read for 7 days, but otherwise tries for up to 3 days after the first quota failure.
Q0513: I'm using tmail to do local deliveries, but when I turned on the use_crlf option on the pipe transport (tmail prefers \r\n terminations) message bodies started to vanish.A0513: You need to unset the prefix option (or change it so that its default \n terminator becomes \r\n). For example, the transport could be:
local_delivery_mbx:
driver = pipe
command = "/usr/local/bin/tmail ${local_part}"
user = exim
current_directory = /
use_crlf
prefix =
The reason for this is as follows: tmail uses the line terminator on the first line it sees to determine whether lines are \r\n or \n. If the latter, it moans to stderr and changes subsequent \n terminators to \r\n. The default setting of the prefix option is "From ...\n", and this is unaffected by the use_crlf option. If you don't change this, tmail sees the first line terminated by \n and prepends \r to the \n terminator on all subsequent lines. However, if use_crlf is set, Exim makes all other lines \r\n terminated leading to doubled \r\r\n lines and corrupt mbx mailboxes.
Q0514: What does the message "Unable to get root to set uid and gid for local delivery to xxx: uid=yyy euid=zzz" mean?A0514: Have you remembered to make Exim setuid root? It needs root privilege if it is to do any local deliveries, because it does them "as the user".
Q0515: I upgraded to 2.04 and now my Envelope-To: header for my virtual domains is gone. Any idea how to get it back?A0515: Read paragraph 1 of README-UPDATE-FROM-1.92. Add envelope_to_add to your transports for your virtual domains. You may also want to set return_path_add and delivery_date_add.
Q0516: The Exim log records the arrival of a message, and then "Completed", without logging any deliveries. What's going on?A0516: This is unlikely in current versions of Exim, because more logging has been added. In versions before 2.053, one scenario is that the message was addressed to some user who has set up an Exim filter containing the command "seen finish", which discards a message without doing any deliveries. (In current versions of Exim this is logged as "discarded".) More information can be obtained by setting
log_received_recipients
so that next time you can see to whom it is addressed. Another possibility, prior to version 2.053, was that the message was injected using the -t option, but all the addresses in the message were also on the command line. See A5020 for more detail. Current versions of Exim generate a bounce message in this case.
Q0517: When I activate "return receipt" for example in Netscape Mailbox sending options, then I get an error message from Exim... something like "not supported". Can I activate delivery confirmations?A0517: Exim does not support any kind of delivery notification.
(1) You can configure it to recognize headers such as "Return-receipt-to:" if you wish.
(2) Some people want MSN (message status notification). Such services are implemented in MUAs, and don't impact on the MTA at all.
(3) I investigated the RFCs which describe the DSN (delivery status notification) system, and there is even a bit of code in there (excluded by #ifdef) for handling some of the data. However, I was unable to specify any sensible way of actually doing anything with the data. There were comments on the mailing list at the time; many people, including me, conclude that DSN is in practice unworkable. The killer problem is with forwarding and aliasing. Do you propagate the DSN data with the generated addresses? Do you send back a "reached end of the DSN world" or "expanded" message? Do you do this differently for different kinds of aliasing/forwarding? For a user who has a .forward file with a single address in, this might seem easy - just propagate the data. But what if there are several forwardings? If you propagate the DSN data, the sender may get back several DSN messages - and should the sender really know about the detail of the receiver's forwarding arrangements? There isn't really any way to distinguish between a .forward file that is forwarding and one that is a mini mailing list. And so on, and so on. There are so many questions that don't have obvious answers.
Q0518: When I dial up to collect mail from my ISP, only the first 10 messages get delivered immediately; the remainder just sit on the queue until a queue runner process finds them.A0518: Your ISP is delivering all the messages in a single SMTP session. Exim limits the number of immediate delivery processes it will create as a result of a single SMTP connection, in order to avoid creating a zillion processes on systems that can have many incoming connections. In your situation, you should probably set smtp_accept_queue_per_connection to some number larger than 10.
Q0519: My ISP's mail server is rejecting bounce messages from Exim, complaining that they have no sender. The SMTP trace does indeed show that the sender address is "<>". Why is the Sender on the bounce message empty?A0519: Because the RFCs say it must be. Your ISP is at fault. Send them this extract from RFC 1123 section 5.3.3 ("Reliable Mail Receipt"):
If there is a delivery failure after acceptance of a message, the receiver-SMTP MUST formulate and mail a notification message. This notification MUST be sent using a null ("<>") reverse path in the envelope; see Section 3.6 of RFC-821. The recipient of this notification SHOULD be the address from the envelope return path (or the Return-Path: line). However, if this address is null ("<>"), the receiver-SMTP MUST NOT send a notification. If the address is an explicit source route, it SHOULD be stripped down to its final hop.
A0601: There are several possibilities. One straightforward way is to set up a domainlist router which matches the UUCP domains and routes to a suitable transport. Sample configuration C003 is such a configuration, while C004 shows another way to do it, by defining the domains as local and using a smartuser director.
If all the domains whose MX records point to the local host are either local domains or UUCP domains, you can do without the domainlist router altogether, by making use of the "self" option. This means that only the DNS has to be updated when a UUCP domain is added or removed.
For example, this router routes to remote hosts over SMTP using a DNS lookup with default options, but if the MX for a domain points at the local host, Exim continues on to the next router.
lookuphost:
driver = lookuphost
transport = smtp
self = fail_soft
The next router can just send everything to a suitable UUCP transport:
uucp:
driver = domainlist
transport = uux_transport
route_list = "* $domain"
This assumes that the transport can determine the UUCP host name from the domain name.
Q0602: How can I get Exim to handle "bang path" addresses?A0602: In general, you can't (Exim is an Internet mailer and recognizes only RFC 822 addresses) but some restricted kinds of bang path can be dealt with by appropriate rewriting - but please note the warning below.
Exim treats a bang path address as an unqualified local part, and so will qualify it with your domain. A rule such as
^([^!]+)!(.+)@your\.domain$ $2@$1
turns a!b@your.domain into b@a. You can also use a repeating rule to turn multi-component paths into the "percent hack" notation with a rule such as
^([^!]+)!([^@%]+)(.+)$ $2%$1$3 R
which turns a!b@c into b%a@c and a!b!c@d first into b!c%a@d and then, because of the R flag, into c%b%a@d. The R flag causes repetition up to 10 times.
See also sample configuration C002, which contains some more sophisticated rewriting rules.
WARNING: If you install a general rewriting rule like the above, you are opening yourself up to the possibility of unwanted relaying. A host that is not permitted to relay through your system could send a message with an SMTP command line such as
RCPT TO:<victim-host!victim-user@your.domain>
and this would be accepted because it is addressed to your domain. However, the rewriting then converts the address, and the message does in fact get relayed. One way round this, if all your bang path messages are passed to Exim via SMTP, is to use the "S" rewriting flag. This applies a rewriting rule to incoming SMTP addresses as soon as they are received, before checking for qualification, relaying, etc. So a rule such as
^([^!]+)!(.+)$ $2@$1 S
rewrites simple two-component bang paths before the result is checked for relaying. However, this does not rewrite addresses in the headers of the message.
Q0603: We see something strange on our system in regards to mail comming in via rmail from a UUCP link. The sender is being set to mailmaster instead of the real sender.A0603: If mailmaster is the user that is running rmail, you need to include that user in the trusted_users configuration option. Only trusted users are permitted to specify senders when mail is passed to Exim via the command line.
A0701: There doesn't seem to be any significant performance hit using a flat queue on Solaris systems, so there is no need to do this for them. On the other hand, there is a known performance problem on Linux filing systems, where split_spool_directory can make a significant difference. ???? Other operating systems ????
Q0702: How well does Exim scale?A0702: Although the author did not specifically set out to write a high- performance MTA, Exim does seem to be fairly efficient. The biggest server at the University of Cambridge (a large Sun box) goes over 100,000 deliveries per day on busy days (it has over 20,000 users). There was a report of a mailing list exploder that sometimes handles over 100,000 deliveries a day on a big Linux box, the record being 177,000 deliveries (791MB in total). Up to 13,000 deliveries an hour have been reported.
The mailing list archive contains some messages on this topic, from which these quotes are taken:
"... Canada's largest internet provider, uses Exim on all of our mail machines, and we're absolutely delighted with it. It brought life back into one of our machines plagued with backlogs and high load averages. Here's just an example of how much email our largest mail server (quad SS1000) is seeing ... " [230,911 deliveries in a day: 4,475MB]
"... Exim has to ... do gethostbyname()s and RBL lookups on all of the incoming mail servers, and he runs from inetd (TCP Wrappers connected). All the same, it seems to me that he runs as fast as lightning on our SCO 5.0.4 box (1 Pentium 166) - far faster than MMDF which I (and many customers) had before."
A0801: There are several different options that can be used to block incoming SMTP messages according to different criteria. The following are the most commonly used:
(1) Set sender_verify; this causes rejection of any message whose envelope sender cannot be successfully routed. This is mainly a check on the existence of remote domains, though it the domain is a local one, the local part also gets checked. Unfortunately, error mesages do not have envelope sender addresses, so cannot be checked in this way. See the headers_sender_verify options for ways of checking header addresses.
(2) If you want to block all mail from specific hosts or IP networks, set sender_host_reject_recipients or sender_net_reject_recipients (or both). The _recipients form of the options is more likely to prevent the remote hosts from keeping on trying. For example:
sender_net_reject_recipients = 209.12.111.0/24
If you have many such net blocks, they can be put in a file which is named in the option.
(3) If you want to block mail from specific envelope sender addresses, one convenient way is to organize a file of local parts indexed by domain names, for example
x.y.z creditrepair:^betterlovelife[0-9]+$:...
p.q.r *
This would block creditrepair@x.y.z, any local part starting with betterlovelife and ending with digits in the x.y.z domain, and all addresses in the p.q.r domain. You refer to the file in the Exim configuration as follows:
sender_reject_recipients = @@lsearch*;/name/of/the/file
If the file is big, you can convert it into a DBM or cdb file and use a faster lookup method. The asterisk on the end of the search type causes a lookup for "*" if the domain is not found; that is, it permits a default list of local parts that are blocked at any domain that is not specifically listed. If you use this, you probably also want to end each local part list with ">*" (except those that consist of "*"). This causes Exim to check the default list of local parts if none of the specific ones for a domain are matched. So, the file above could become
* yourfriend:a.friend:...
x.y.z creditrepair:^betterlovelife[0-9]+$:>*
p.q.r *
If you are using an lsearch file, putting the * entry first saves a bit of processing.
(4) If you want to allow mail to postmaster through the blocks, you can set
recipients_reject_except = postmaster@your.domain
this overrides any of the policy controls that cause rejection by recipient.
Q0802: I don't want to block spam entirely; how can I inspect each message before deciding whether to deliver it or not?A0802: This can be done by using a system filter. See the sample configuration F003.
Q0803: How can I test that my spam blocks are working?A0803: The -bh option allows you to run a testing SMTP session as if from a given IP address. For example,
exim -bh 192.203.178.39
In addition to the normal SMTP replies, it outputs commentary about which tests have succeeded or failed.
Q0804: How can I test that Exim is correctly configured to use the Realtime Blocking List (RBL)?A0804: The -bh option allows you to run a testing SMTP session as if from a given address. You need to know a blocked IP address with which to test. Such a testing address is kindly provided by Russell Nelson:
linux.crynwr.com [192.203.178.39]
You can also send mail to nelson@linux.crynwr.com from the server whose RBL block you are testing. The robot that receives that email will attempt to send a piece of test email in reply. If your RBL block didn't work, you get a message to that effect. Regardless of whether the RBL block succeeds or not it emails you the results of the SMTP conversation from a host that is not on the RBL, so you can see how your server looks from the view of someone on the RBL.
Q0805: How can I use tcpwrappers in conjunction with Exim?A0805: Exim's own control facilities can do all that tcpwrappers can do. However, if you are already using tcpwrappers for other things it might be convenient to include Exim controls in the same place.
First of all, ensure that Exim is built to call the tcpwrappers library, by including USE_TCPWRAPPERS=yes in Local/Makefile. You also need to ensure that the header file tcpd.h is available at compile time, and the libwrap.a library is available at link time, typically by including it in EXTRALIBS. You may need to copy these two files from the tcpwrappers build directory to, for example, /usr/local/include and /usr/local/lib, respectively. Then you could reference them by
CFLAGS=-I/usr/local/include
EXTRALIBS=-L/usr/local/lib -lwrap
in Local/Makefile. There are two ways to make use of the functionality, depending on how you have tcpwrappers set up. If you have it set up to use only one file, you ought to have something like:
/etc/hosts.allow:
exim : <client_list> : <allow_or_deny>
For example:
exim : LOCAL 192.168.0. .friendly.domain special.host : ALLOW
exim : ALL : DENY
This allows connections from local hosts (chiefly `localhost'), from the subnet 192.168.0.0/24, from all hosts in *.friendly.domain, and from a specific host called special.host. All other connections are denied. If you have tcpwrappers set up to use two files, use the following:
/etc/hosts.allow:
exim : <client_list>
/etc/hosts.deny:
exim : <client_list>
Read the hosts_access(5) man page for more ways of specifying clients, including ports, etc., and on logging connections.
Q0806: How can I get POP-auth-before-relay support in Exim?A0806: See http://cc.ysu.edu/~doug/exim-pop.tar.Z which has some scripts for this, courtesy of Doug S <doug@cc.ysu.edu>.
Q0807: I have one or two cases where my machine correctly rejects messages, but the remote machine is quite persistent, and keeps trying over and over.A0807: It is an unfortunate fact that a number of SMTP clients, in violation of the SMTP RFC, do not treat a permanent error code that is given after the MAIL FROM command or the DATA portion of the transaction as a permanent error. Consequently they keep resending the message. Failing checks on a message's headers (the headers_... options) necessarily result in an error code after the data has been received.
Q0808: I am seeing the error "no valid sender in message headers: return path is <>" in the reject log. Isn't <> a valid return path for error messages?A0808: It is indeed valid. The complaint here is about the contents of the message's headers, not the return path. You must have set the headers_sender_verify option. Check the From:, Reply-to: and Sender: headers that were logged with the error. You can use Exim's -bv option to find out why verification of those addresses failed.
Q0809: Let's say that we want to run a mail server that does not care if you have proper reverse DNS. If you include sender_host_reject lines in your config file, Exim will always reject connections from such hosts. How can this be avoided?A0809: Put +allow_unknown as an item in your host list, for example:
sender_host_reject = +allow_unknown:abc.def.zz:pqr.stu.yy
This will allow any host without reverse DNS to bypass the checks. Note that it means that the owner of abc.def.zz (for example) can trivially get round your block simply by deleting the PTR record for abc.def.zz.
Q0810: Is there a way to prevent lookups in the RBL for local hosts?A0810: Check out the rbl_except_nets option.
Q0811: How can I set up the sender_reject option in my config file so I can reject mail by matching regular expressions?A0811: You must either put the regular expressions directly in the option setting, or use an @@ type of search. If the regular expressions match the domain as well as the local part, then the former approach is the only possible one. For example:
sender_reject_recipients = ^.*\.spam\.com$ : ^.*@[0-9]+\.com$
If you are using version 2.10 of Exim or later, the first of those regular expressions can be rewritten to execute much more efficiently by using lookbehinds and once-only subpatterns:
sender_reject_recipients = ^(?>.*$)(?<=\.spam\.com)
See the manual section entitled "Address lists" for a description of the @@ type of split domain/local part lookup. See also A0801.
Q0812: Normally sender_reject_recipients works fine, but addresses that have some uppercase letters in them seem to come through.A0812: Although host and domain names are case-insensitive, the RFCs about mail specify that local parts are case sensitive, so when Exim is looking up a sender address in sender_reject_recipients, it has to do so using the caseful form. (In principle, user@domain and USER@domain might be different people. Silly, I know, but that's the rule. It causes a lot of grief.)
If you are using exim_dbmbuild to create DBM files for sender rejection, then you need to use the -nolc option if you want to stop it lowercasing the keys. This doesn't of course, help when you block User@domain and mail comes in with the sender USER@domain.
This is a long-standing problem to which I don't really have a good answer. However, there is something you can do. If you convert to using an @@-style lookup for sender_reject_recipients (see the manual section "Address lists" for details), then
(1) The domain is looked up in a case-insensitive manner.
(2) You can use case-insensitive regular expression matches for the individual local parts if you want to.
Q0813: I want to accept some sender addresses, even though they do not verify. There doesn't seem to be a sender_verify_except option, so how can I do this?A0813: Set up a special director or router to ensure that those addresses do verify, using verify_only and verify_sender so that it is not used during delivery or recipient verification. For example, here is a router which verifies the address root@somedomain.com:
verify_exceptions:
driver = domainlist
verify_only
verify_sender
domains = some.domain.com
local_parts = root
route_list = * localhost byname
transport = remote_smtp
self = send
Q0814: If I have both host and net settings, for example, both
receiver_unqualified_hosts and receiver_unqualified_nets, does the order
I given them in the configuration file matter?
A0814: No. The order of checking is not related to the order they appear in the configuration.
Q0815: I have set sender_net_accept_relay and sender_host_accept_relay, but my host still refuses to relay from matching hosts.A0815: (A) Did you remember to HUP or restart the Exim daemon after changing the configuration?
(B) Did you remember to remove the default setting
sender_host_reject_relay = *
which rejects everything? Note that "reject" options always act as exception lists to "accept" options, not the other way round.
You can get information as to what options Exim is checking by using the -bh option to test how it would handle mail from a specific host.
Q0816: How can I run customized verification checks on incoming addresses?A0816: If you can implement your checks in Perl, then you can use Exim's facility for running an embedded Perl interpreter. For example, if you want to run special checks on local addresses, you could install this as your first director:
private_verify:
driver = smartuser
condition = ${perl{verify}{$local_part}{$domain}}
verify_only
transport = appendfile
If you want this to be the only means of verification, you can set no_verify on all the other directors. Otherwise, if this director fails to verify, the address gets passed on to those that follow.
The setting of a transport is necessary because without it, a smartuser director requires a setting of new_address, and behaves as a kind of aliasing director. It doesn't matter which transport is referenced.
The verify_sender and verify_recipient options can be used to restrict the director to sender or recipient verification only, and if necessary you could have two different directors, one for senders and one for recipients.
If the result of the expansion of condition is not "no", "false" or "0", then address verification succeeds, because the director itself matches any address. The expansion of condition causes the Perl subroutine called "verify" to be run, with two arguments, the local part and the domain. The subroutine must be provided in Perl code that is referenced by the perl_startup option. See the chapter on embedded Perl for details.
Remote addresses can be handled in a similar way by using a domainlist router that matches all domains.
Starting up a Perl interpreter is not cheap. On a busy system you should first make sure that there isn't some way of using Exim's own facilities for doing what you want before going down this road.
A0901: There's a separate web page covering this at
http://www.netmaster.ca/exim/majordomo.html
This is a a brief outline:
(1) Install majordomo with default configuration.
(2) Obey the commands
mv /usr/lib/sendmail /usr/lib/real-sendmail
ln -s /path/to/exim-binary /usr/lib/sendmail
You've probably done this already if you've got Exim up and running.
(3) In the Exim configuration, set
trusted_users = ...:majordom:...
That should be all you need to get it working, since Exim is pretty much sendmail compatible. Optional extras:
(4) Put the -outgoing aliases on a separate director that only majordomo can send to, for security. This may not be needed if you use something less obvious than "outgoing" and use something like
| ... resend -l list list-outgoing,nobody
(5) In the Exim configuration set remote_max_parallel to a value greater than 1.
Somewhere in the Majordomo docs or FAQ it mentions using batchmail or other additional programs to improve the performance of large lists. They are not needed with Exim, and their use can actually make things worse.
Q0902: I have set $mailer in majordomo.cf, but it still isn't setting the sender correctly in the messages it sends.A0902: Make sure you have got the quoting correct in the $mailer setting. For example,
$mailer = "$sendmail_command -oi -oee -f$sender\@lists.mydomain.de";
is not correct. It needs three backslashes, not one, and the $ at the start of $sender has to be escaped with a backslash.
A1001: If you set up a rewriting rule in the following form:
*@*.your.domain $1@your.domain
then Exim will rewrite all addresses in the envelope and the headers, removing anything between "@" and "your.domain". This applies to all messages that Exim processes. If you want to rewrite sender addresses only, the the rule should be
*@*.your.domain $1@your.domain Ffrs
This applies the rule only to the envelope "From" address and to the From:, Reply-to:, and Sender: headers.
Q1002: I have Exim configured to remove the hostname portion of the domain on outgoing mail, and yet the hostname is present when the mail gets delivered.A1002: Check the DNS record for your domain. If the MX record points to a CNAME record instead of to an A record, MTAs are liable to rewrite addresses, changing your domain name to its "canonical" form, as obtained from the CNAME record.
Q1003: I want to rewrite local addresses in mail that goes to the outside world, but not for messages that remain within the local intranet.A1003: Exim wasn't really designed to handle this kind of split world. Because it keeps only one copy of a message, and does all the rewriting at the time of reception, a standard configuration cannot handle this kind of rewriting in a message that has both internal and external recipients.
However, what can be done is to split off a copy of the message to be sent to all external recipients, and do the rewriting on that. This can be achieved by running two differently-configured versions of Exim, either on a single host, or on two different hosts. If you have a gateway or firewall machine, that is the natural place to run the rewriting version.
On a single machine, the following is one way of handling this:
(1) Set up the normal configuration (in the configuration file whose name is screwed into the binary) such that it does local deliveries as required, but forwards a copy of the message for non-local recipients to a different incarnation of Exim via a private SMTP port. For example, use this transport and router:
# Transport to send SMTP using port 26
internal_smtp:
driver = smtp
service = 26
# Router to send everything the internal_smtp transport
pass_remotes:
driver = domainlist
transport = internal_smtp
route_list = * localhost byname
self = send
This should be the only router. Because of the self = send setting, Exim will transport the messages, even though it knows it is going to the local host.
(2) Set up a different configuration file for the rewriting version of Exim. This need do no local deliveries, so it needs no local domains or directors, and as it accepts mail only from the local host, there is no need for any spam-blocking or other policy controls. However, it does need to have its own spool area. The main part of the configuration could be like this:
local_domains =
local_interfaces = 127.0.0.1
sender_host_accept = 127.0.0.1
spool_directory = /var/spool/exim-external
end
The directors section can be completely empty (apart from the line saying "end"), while the routers section should be as in a normal configuration, as it is going to control external delivery.
The rule(s) for rewriting your internal addresses into external ones should be in this configuration. This is one example of what might be done:
*@*.your.domain "\
${lookup{$1}cdb{/etc/$2/mail.handles.cdb}{$value}fail}"
which looks up each local part in a per-host file to obtain the externally-visible address, including (in this example) the domain.
(3) You have to arrange for a daemon to be listening on port 26, and to be using the alternate configuration file. It is necessary to do this as root so that Exim retains its privilege after reading a non-standard configuration. A command such as
exim -C /etc/exim-configure2 -bd -oX 26
could be used in a suitable system start-up file. Alternatively you could set up inetd to run Exim with the -C option for incoming connections on port 26.
The net result of all of this is that when a message has one or more external recipients, a copy of it is sent via port 26 to the second version of Exim, which rewrites any internal addresses and does the external deliveries. The cost of this is that the message has to be copied and spooled twice, and you have two different Exim queues to manage. Note that if the "external" Exim has to send a delivery failure message, it will use the rewritten sender address.
Q1004: I'm using this rewriting rule to change login names into "friendly" names, but if mail comes in for an upper case login name, it doesn't get rewritten.
*@my.domain ${lookup{$1}dbm{/usr/lib/exim/longforms}\
{$value}fail}@my.domain bcfrtFT
The longforms database has entries of the form:
ano23: A.N.Other
A1004: Replace $1 in your rule by ${lc:$1} to force the local part to lower case before it is used as a lookup key.
A1101: To the remote_smtp transport, add something like
headers_add = "${if and{\
{eq{$domain}{spec.dom}}\
{matches{$h_subject:}{whatever}}}\
{Content-Type: text/html; charset=\"us-ascii\"} fail }"
This example shows a Content-Type header, but you can have anything you like, and multiple headers can be inserted by using \n to separate them.
Q1102: Is it possible to have Exim add a header to only certain local_parts of outgoing mail?A1102: Only if you arrange for each such local part to receive its own private copy of the mail. See max_rcpt in the SMTP transport. Then you could use conditions in an expansion string to add or not add a header.
A1201: Put "localhost" in a list of local domains, that is, add it to the local_domains option in your Exim configuration file.
Q1202: Fetchmail is passing on bounce messages to Exim with the sender address set to <@some.domain> which causes Exim to complain, because there is no local part.A1202: This was a fetchmail problem which has been fixed. Ideally, you should upgrade to the current fetchmail release. If you cannot do this, there is some Exim magic that might help. The 'S' rewriting flag allows rewriting of envelope addresses to be done as soon as they are received in the SMTP protocol, before any kind of checking or other processing is done. This is specifically provided for installations that have to cope with mangled addresses coming in over SMTP.
A1301: If you are using BSDI, see Q9401.
A5001: This is an error that occurs when Exim is trying to find out the all the IP addresses on all of the local host's interfaces. If you have lots of virtual interfaces, this can occur if there are more than around 250 of them. The solution is to set the option local_interfaces to list just those IP addresses that you want to use for making and receiving SMTP connections.
Q5002: How can I arrange to allow a limited set of users to perform a limited set of Exim administration functions? I don't want to put them all in the exim group.A5002: See http://www.chiark.greenend.org.uk/~ian/userv/. Using userv you can arrange (for example) for certain users to be able to invoke mailq or runq or other preset commands as exim (or any other user, as configured) with only userv configuration. If you want to check the particular Exim options available you can easily do it with shell or Perl scripts and userv configuration, and provided you know how to do argument `unparsing' properly in shell or Perl it will be secure.
Q5003: How can I test for a message's size being greater or less than a given value in an expansion string?A5003: This isn't straightforward in versions of Exim prior to 2.10, because there were no arithmetic operators in expansion strings. In version 2.10 or later you can write, straightforwardly,
${if > {$message_size}{10K} {yes} {no}}
In earlier versions, low cunning can be used to achieve certain kinds of test. For example, to test if the message size is less than or equal to 1000000:
${if eq{${expand:\$\{substr_-1000000_$message_size:x\}}} {} {yes} {no}}
Q5004: I want to "tail" the Exim log, but I have a number of other logs I also
want to "tail", and the number of tailing windows is getting to be a
nuisance.
A5004: Look for a program called 'xtail' (despite its name, it's not an X-windows application). It allows you to do multiple tails, even of entire directories.
Q5005: I would like to have Exim log information written to syslog.A5005: Exim doesn't support this at present, but you could run
tail -f /var/spool/exim/mainlog | logger -t exim -p facility.level
or a similar command.
Q5006: What does the error "Failed to create spool file" mean?A5006: Exim has been unable to create a file in its spool area in which to store an incoming message. This is most likely to be either a permissions problem in the file hierarchy, or a problem with the uid under which Exim is running, though it could be something more drastic such as your disc being full. Check that you have defined the spool directory correctly by running
exim -bP spool_directory
and examining the output. Check the mode of this directory. It should look like this, assuming you are running Exim as user `exim':
drwxr-x--- 6 exim exim 512 Jul 16 12:29 /var/spool/exim
If there are any subdirectories already in existence, they should have the same permissions, owner, and group. Check also that you haven't got incorrect permissions on superior directories (for example, /var/spool). Check that you have set up the exim binary to be setuid root. It should look like this:
-rwsr-xr-x 1 root xxx 502780 Jul 16 14:16 exim
Q5007: Exim keeps crashing with segmentation errors (signal 11 or 139).
A5007: This might be a problem with the db library. See Q0505.
Q5008: Exim's databases keep getting corrupted.A5008: See Q0505.
Q5009: I've been using an autoreply director to try and mimic a bounce message, but I can't get it to have an envelope from of <>.A5009: You haven't, by any chance, put "exim" in the list of never_users, have you?
Q5010: I see entries in the log that mention two different IP addresses for the same connection. Why is this? For example:
H=tip-mp8-ncs-13.stanford.edu ([36.173.0.189]) [36.173.0.156]
A5010: The actual IP address from which the call came is the final one. Whenever there's something in parentheses in a host name, it is what the host quoted as the domain part of an SMTP HELO or EHLO command. So in this case, the client, despite being 36.173.0.156, issued the command
HELO [36.173.0.189]
when it sent your server the message. This is, of course, very misleading.
Q5011: How can I persuade Exim to accept ETRN commands without the leading # character?A5011: Set the option
smtp_etrn_command = /usr/lib/sendmail -R $domain
This causes Exim to run that command, with $domain replaced by the argument of ETRN. The default action of Exim is to require the # sign in order to be RFC-compliant, and to run the equivalent of
smtp_etrn_command = /usr/lib/sendmail -R ${substr_1:$domain}
which uses the argument without the leading # as the value for the -R option. You aren't restricted to running Exim with the -R option, of course. You can specify any command you like, with any number of arguments. In particular, you can pass over the IP address of the caller via $sender_host_address. However, if you make use of expansion strings in the arguments, each one must be entirely contained in a single argument. For example, if you want to remove the first character of the ETRN argument when it is @ or #, you could use
smtp_etrn_command = "/usr/lib/sendmail -R \
\"${if match {$domain}{^[@#]}{${substr_1:$domain}}{$domain}}\""
The internal quotes are necessary because of the white space inside the expansion string.
Q5012: I've recently noticed that emails I send with a Bcc: line are being delivered to their final destination with the Bcc: line still present.A5012: Exim removes Bcc lines only if you call it with the -t option (i.e. when it is acting partly as an MUA). It does not remove Bcc lines that are present in incoming SMTP mail or command-line mail that does not use -t. Indeed, it should not remove them. From RFC 822:
5.3. BCC / RESENT-BCC
This field contains the identity of additional recipients of the message. The contents of this field are not included in copies of the message sent to the primary and secondary recipients. Some systems may choose to include the text of the "Bcc" field only in the author(s)'s copy, while others may also include it in the text sent to all those indicated in the "Bcc" list.
Only the initiating software (i.e. the MUA) can tell what to do with Bcc; any MTA software has to leave it alone.
Q5013: I used gv v3.5.8 (ghostview) to try printing spec.ps. After every printed page, the printer ejects a blank sheet. Is this something to do with using "letter" rather than A4 paper?A5013: This seems to be an effect of using ghostview. Although the PostScript is generated for A4 pages, the size of the page images is such that they should fit on a letter page (they are shorter than would normally be used on A4 paper). If the PostScript file is sent directly to a PostScript printer, there is no problem. An alternative is to get hold of the "psutils" toolset, which is available from
ftp://ftp.dcs.ed.ac.uk/pub/psutils/psutils.tar.gz
It contains utilities for extracting pages (which can be useful for double-sided printing) and for resizing pages. If you resize from A4 to letter the text shrinks a bit, but should then be printable via ghostview.
Q5014: I would like to have a separate queue per domain for hosts which dial in to collect their mail.A5014: Exim isn't really designed for this kind of operation. The only way to do this would be to cause it to send those messages to a differently configured version of Exim with its own spool area. This could be done via a pipe or SMTP to a private port. The main Exim, listening on port 25, would then be configured to run an appropriate command to prod one of the others when it received ETRN, by means of the etrn_command option.
You could probably manage this with a single Exim binary and a number of different configuration files, passed to the special versions using the -C option. For this application they could all run as exim, since no root privilege would be needed.
An alternative approach would be to get Exim to deliver mail for such hosts in batch SMTP format into some directory, and have the ETRN run something to pass such messages to the dialled-in host.
Q5015: A short time after I start Exim I see a <defunct> process. What is causing this?A5015: Your system must be lightly loaded as far as mail is concerned. The daemon sets off a queue runner process when it is started, but it only tidies up completed child processes when it wakes up for some other reason. When there's nothing much going on, you occasionally see <defunct> processes like this waiting to be dealt with. This is perfectly normal.
Q5016: On a reboot, or a restart of the mail system, I see the message "Mailer daemons: exim abandoned: unknown, malformed, or incomplete option -bz sendmail". What does this mean?A5016: -bz is a Sendmail option requesting it to create a "configuration freeze file". Exim has no such concept and so does not support the option. You probably have a line like
/usr/lib/sendmail -bz
in some start-up script (e.g. /etc/init.d/mail) immedately before
/usr/lib/sendmail -bd -q15m
The first of these lines should be commented out.
Q5017: I would like to restrict e-mail usage for some users to the local machine, ideally on a group basis.A5017: See A9802
Q5018: Whenever exim restarts it takes up to 3-5 minutes to start responding on the SMTP port. Why is this?A5018: Something else is hanging onto port 25 and not releasing it. One place to look is /etc/inetd.conf in case for any reason an SMTP stream is configured there.
Q5019: Why aren't there any man pages for Exim? I don't always carry my printed documentation.A5019: As well as plain ASCII text, the Exim documentation is provided in two online forms - texinfo and HTML - which have a certain amount of built- in indexing for ease of finding your way around. There are no man pages because the author of Exim hasn't the time (or desire :-) to maintain yet another documentation format. Besides, it is hard to know how to split the Exim manual up.
There is a contributed man page for a previous version of Exim in
ftp://ftp.cus.cam.ac.uk/pub/software/programs/exim/Contrib/doc/exim.8
This was written by a previous maintainer of the Debian GNU/Linux Exim package. You can view a nicely formated version at:
http://dwww.jimpick.com/cgi-bin/dwww?type=man&location=/usr/man/man8/exim.8.gz
This contains some introductory text and the command line options only.
Q5020: When I send a message using the -t command line option, Exim sends only to the addresses within the message, not to those on the command line.A5020: By default Exim operates according to the Sendmail documentation, and interprets addresses on the command line as addresses not to send to. You can set
extract_addresses_remove_arguments = false
to change this behaviour. There is some confusion in the Sendmail community about the interpretation of recipient addresses on the command line if the -t option is used.
Here is an except from one version of the sendmail documentation
-t Read message for recipients. To:, Cc:, and Bcc: lines will be scanned for recipient addresses. The Bcc: line will be deleted before transmission. Any addresses in the argument list will be suppressed, that is, they will not receive copies even if listed in the message header.
Earlier versions of the sendmail documentation are ambiguous (unlike the snippet above). Obviously the code and documentation streams resolved the ambiguity differently.
Q5021: If I set up, for example, local_domains = *customer.com, then it matches "customer.com" and "abc.customer.com" as required, but it also matches "noncustomer.com", which is wrong. How can I get round this?A5021: (1) You have to specify two entries in the list:
local_domains = customer.com : *.customer.com
because * in a domain list matches any characters, including "." and including a null sequence.
(2) Alternatively, you could use a regular expression:
local_domains = ^(.+\.|)customer\.com$
but that probably will not be as efficient.
(3) If you have lots of local domains, you could put them into a file to be searched (using lsearch, dbm, cdb, or whatever) and use a partial search such as
local_domains = partial-dbm;/list/of/domains
If the file contains the key *.customer.com then the desired effect is achieved, because partial lookups do operate on a component basis. See the section entitled "Partial matching in domain lists". It is a bit confusing that "*" is used in this context, because its meaning is not the same as when it appears directly in a domain list.
Q5022: I want to match all local domains of the form *.oyoy.org but want a few exceptions. For instance I don't want foo.oyoy.org or bar.oyoy.org to be treated as local. What is the best way to do this?A5022: (1) You can use a regular expression:
local_domains = ^.*(?<!^foo|^bar)\.oyoy\.org$
An alternative formulation that is more efficient in execution (because it doesn't backtrack for .* in cases that don't match) is
local_domains = ^(?>.*$)(?<=\.oyoy\.org)(?<!^(foo|bar)\.oyoy\.org)
If you are using an earlier version of Exim in which the regular expression library does not have lookbehind support (versions prior to 2.051, but after 1.735):
local_domains = ^(?!(foo|bar)\.oyoy\.org$).+\.oyoy\.org$
If you are using a version of Exim that is earlier than 1.735, consider upgrading!
(2) If the number of exceptions is too great to make this a comfortable approach, there is an alternative way of doing this. Do not put anything (related to these domains) in local_domains. Instead, put the list of exceptions into a file, and set up an initial router like this:
oyoy_domains:
driver = domainlist
self = local
domains = *.oyoy.org
except_domains = lsearch;/list/of/exceptions
route_list = * localhost byname
The domains and except_domains options cause the router to run for those domains you want to be local. It routes them to the local host, and the "self" option tells Exim that anything routed to the local host should be passed to the directors.
Q5023: I can't seem to find a pre-built version of Exim anywhere. The machine is a Sparc 5 running Solaris 2.6.A5023: The problem is that there are a number of build-time options, requiring the answer to questions like:
. Which DBM library do you have? (On Solaris probably ndbm, but no easy default on some other systems.)
. Which uid/gid do you want to use for Exim?
. Where do you want the configuration file to be? (Many different answers, even on the same OS, depending on local policy.)
. Ditto for the binaries.
. Which optional bits of Exim do you want to include?
... and so on. One could impose a set of values, but I suspect they would probably please nobody.
Q5024: Is there a Win NT version of Exim available?A5024: A long time ago somebody took a copy of the Exim source with the aim of trying to port it to NT. However, I never heard anything more.
Q5025: Does Exim support Delivery Status Notificaion (DSN), Message Status Notification (MSN), or any other form of delivery acknowledgement?A5025: See A0517.
Q5026: What does "Exim" stand for?A5026: Originally, it was "EXperimental Internet Mailer", which was the best I could come up with when I was starting out. At that point it was experimental - I wanted to see if the ideas I had for extending Smail's approach actually worked. Then somebody discovered about it and wanted to start using it, and told other people about it...
Q5027: What does the log message "no immediate delivery: more than 10 messages received in one connection" mean?A5027: See A0518.
Q5028: Although I haven't set check_spool_space, Exim is still checking the amount of space on the spool for incoming SMTP messages that use the SIZE option. Can I suppress this?A5028: The RFC for the SIZE option says
If the server currently lacks sufficient resources to accept a message of the indicated size, but may be able to accept the message at a later time, it responds with code "452 insufficient system storage".
and that is what Exim is trying to implement. This is entirely independent from check_spool_space, which says "don't accept any mail if there is less than so much space in the spool partition", though the code is optimised to do both checks at the same time if required. However, you can suppress the SIZE check if you want to, by unsetting smtp_check_spool_space.
A9401: You probably compiled perl5 yourself, without looking into
/usr/src/contrib/perl5/perl5.004_02/hints/bsdos.sh
first. The problem is that the command
perl5 -MExtUtils::Embed -e ldopts
doesn't give you sufficient flags to link something with libperl. Since 5.004_02 the hints/bsdos.sh file has changed to adapt to the changes between BSDI 3.1 and 4.0, but it is still not entirely right.
The solution is, when you compile perl, change the "ccdlflags" variable in config.sh to:
-rdynamic -Wl,-rpath,/usr/local/lib/perl5/5.00502/i386-bsdos/CORE
(or something similar). Alternatively, you can run ./Configure and answering the question "Any special flags to pass to cc to use dynamic loading?" with the above line. It is not known what -rdynamic means (it's not apparently documented in any man page), but that's what BSDI guys did to compile perl5 which comes with BSDI 4.0 distribution.
A9501: This problem was fixed in Exim release 2.03. If you are running an earlier version you should use the local_interfaces option to specify all your IP addresses explicitly.
A9601: This has been seen in cases where Exim has been incorrectly built with a muddled combination of an ndbm.h include file and a non-matching DBM library.
Faults like this have also been seen on systems with faulty motherboards. You could try to compile the Linux kernel 10 times - if the compile process stops with signal 11, your hardware is to blame.
Q9602: Exim has created a directory called build-Linux-libc5-i386 but is trying to reference build-Linux-libc5-i386-linux while building.A9602: You have several shells installed, which are setting conflicting values in the HOSTTYPE environment variable that is used to construct the name of the build directory. One way round this is to run this command:
ln -s build-Linux-libc5-i386-linux build-Linux-libc5-i386
Q9603: I want to use logrotate which is standard with RH5.2 Linux to rotate
my mail logs. Anyone worked out the logrotate config file that will
do this?
A9603: Here's one suggestion:
/var/log/exim/main.log {
create 644 exim exim
rotate 4
compress
delaycompress
}
The sleep is added to allow things to close the log file prior to compression. You also need similar entries for the panic log and the reject log, of course.
A9701: Make sure you are liking with the GNU ld linker and not the system version of ld.
Q9702: How can I get rid of spurious ^M characters in messages sent from CDE dtmail?A9702: CDE dtmail passes messages to Exim via the command line interface with lines terminated by CRLF, instead of the Unix convention of just LF. As Exim is an 8-bit clean program it treats the CR as just another data character. Exim has a command line option called -dropcr which causes it to ignore all CR characters in an incoming non-SMTP message. You should configure dtmail to add this option to the command it uses to call Exim. ???? Details of how to do this ????
Q9703: On SunOS 4 Exim crashes when looking up domains in the DNS that have more than 10 A records.A9703: There are Sun library patches to fix this. It is not Exim's problem. For 4.13_U1 the patch is 101558-xx; for 4.1.3 the patch is 100891-xx. From the README: 1054748 ftp, ping dump core when connecting to a host with multiple DNS A records.
An alternative is to build another resolver library - such as the ones that are part of the bind distribution - and explicitly link against those.
Q9704: The menu in eximon isn't working on my Sun system.A9704: With OpenWindows, if the numlock key is pressed (so that the numeric pad is working) then some menus don't work. This appears to be true for the console and (some) remote X-window servers. The details of this have never been tracked down.
Q9705: I am experiencing mailbox locking problems with Sun's mailtool used over a network.A9705: Under the "Expert" settings of mailtool is a option to turn on "Use network aware mail file locking". By default dtmail has this set, but mailtool doesn't. You should set it. The help info on dtmail has this to say about it:
"Mailer tries to prevent two different instances of itself from opening the same mail file at the same time through a technique that detects this access when both instances of Mailer and the file are all on the same machine. A network-aware mail file locking protocol is available that uses ToolTalk to coordinate instances of Mailer running from more than one machine, or mail files accessed over the network. Mailer can only change this option when first opening a mail file."
If you are using the SunOS4 version of mailtool, this apparently doesn't work. The only thing which does seem to work it getting the user to hit the "done" button to make it release the lock.
Q9706: Exim has been crashing on my Solaris x86 system, apparently while running DBM functions.A9706: The use of ndbm with gcc has caused problems on x86 Solaris systems. Try changing one or the other; using either db 1.85 with gcc, or Sun's WS compiler with ndbm, has fixed this in the past.
Q9707: The exiwhat utility isn't working for me on a Solaris 2 system.A9707: Have you got /usr/ucb on your path? If so, it is probably picking up the wrong version of the ps command. The exiwhat script is built on Solaris to expect the normal Solaris version of ps.
Q9708: How do I stop Sun's dtcm from hanging?A9708: From qmail's FAQ: "There is a novice programming error in dtcm, known as ``failure to close the output side of the pipe in the child.'' Sun has, at the time of this writing, not yet provided a patch."
Q9709: I want Exim to use only the resolver (i.e. ignore /etc/hosts), but don't want to alter the nsswitch.conf file in Solaris 2.A9709: You need to rebuild Exim after fiddling with OS/os.h-SunOS5:
#define gethostbyaddr res_gethostbyaddr
#define gethostbyname res_gethostbyname
#define endhostent res_endhostent
#define endnetent res_endnetent
#define gethostent res_gethostent
#define getnetbyaddr res_getnetbyaddr
#define getnetbyname res_getnetbyname
#define getnetent res_getnetent
#define sethostent res_sethostent
#define setnetent res_setnetent
Exim uses gethostbyname and gethostbyaddr only, but may use others in the future. Note that -lnsl is still needed in the Makefile as it contains code used by the NIS lookup and also the inet_addr function that Exim uses.
A9801: (1) add partial-lsearch;/etc/mail/tpc.domains to local_domains; /etc/mail/tpc.domains is a text file with lines in this format:
9.3.5.1.0.8.1.tpc.int.
This sample line indicates that we accept faxes destined for 1(801)539-*.
(2) Set up the following transport:
tpc:
driver = pipe
command = "/usr/local/tpc/tpcmailer.pl ${local_part}@${domain} \
${sender_address}"
pipe_as_creator
/usr/local/tpc/tpcmailer.pl is the mail processing script that can be obtained from the TPC distribution.
(3) Set up the following director:
tpc_director:
driver = smartuser
transport = tpc
domains = "partial-lsearch;/etc/mail/tpc.domains"
Of course, there are other things to do as well before your system is a functioning TPC server.
Q9802: How do I configure Exim so that it sends mail to the outside world only from a restricted list of our local users?A9802: There are several possible ways that this can be done.
(A) You can restrict the senders directly by putting a setting such as this one on all the drivers that route to the outside (usually this is just the final lookuphost router):
senders = ":^[^@]+@(?!${rxquote:your.domain}\\$):\
lsearch;/permitted/senders"
The first item in this list is empty, to match the empty sender. This is necessary because bounce messages have null senders. The second item is a regular expression that matches any address whose domain is not your domain. This caters for cases when mail from an external user has arrived for a local user who has forwarding set up to some outside address.
If the first two items do not match (that is, the address is in your domain) the sender is looked up in a file of permitted senders; each item in the file must be a complete address, including the domain. If the sender is unacceptable, an "unrouteable mail domain" error will occur because the router won't run, and there are no more to try.
(B) If your local users are in many domains, it may be easier to use a condition option to test the domain and local part independently, along these lines:
condition = "\
${lookup{${domain:$sender_address}}lsearch{/domain/list}\
{\
${lookup{${local_part:$sender_address}}lsearch\
{/permitted/senders}{yes}{no}}\
}\
{yes}}"
Obviously other means of testing the domain and local part could be substituted, for example, by having separate files of valid local parts for each local domain.
(C) If your local users are logged in to your host, you could use a special group for those that are permitted to mail to the world. Assuming your groups are defined in /etc/group you could arrange to look up the group in that file and then check that the sender was in the group,using something along these lines:
condition = "\
${lookup{groupname}lsearch{/etc/group}\
{${if match {$value}\
{[:,]${rxquote:${local_part:$sender_address}}(,|\\\$)}\
{yes}{no}}}{no}}"
This is checking the local part of the sender; a alternative might be to check $sender_ident. However, you should really also check that $sender_host_address is either unset or set to 127.0.0.1 or your IP address, so you check only locally-originated mail.
A block like this does not prevent a logged in user from sending mail by telnetting to another host's SMTP port, or indeed from installing a private version of Exim to do the job for her.
(D) On a gateway server that has no local users and so receives all the mail via SMTP from client hosts, you could use a rewriting rule to rewrite sender addresses in your local domain from a table of legal local parts, replacing any illegal addresses with an address such as unknown@your.domain. If this is combined with sender_verify=true it causes messages from users that are not in the table to be refused, assuming that the gateway is capable of verifying the local part of user@your.domain.
Q9803: How do I configure Exim to run with SmartList?A9803: This is what was done for Exim's own mailing list, using SmartList/ procmail 3.11pre7. It runs as its own user - trying to manage mailing lists under your own ID can be hard work. Smartlist is installed into /var/spool/slist, and there is an slist user defined. Each list appears as a directory under /var/spool/slist (as per usual for Smarlist). Exim is configured like this:
# slist added to list of trusted users so it can
# manipulate sender addresses
trusted_users = exim:slist
# in transports, a list transport is defined:
list_transport:
driver = pipe
command = "/var/spool/slist/.bin/flist \
${local_part}${local_part_suffix}"
current_directory = /var/spool/slist
home_directory = /var/spool/slist
user = slist
group = slist
# in directors a list director is defined:
list_director:
driver = smartuser
suffix = -request
suffix_optional
except_local_parts = .bin:.etc
require_files = /var/spool/slist/${local_part}/rc.init
transport = list_transport
and thats it - no aliases, no special handling of out lists etc. What you do need is to ensure that choplist is used for distribution (that is, do not uncomment the alt_sendmail entry which is blank).
A couple of other things are forced - for example since the list runs in its own domain the domain value is forced to exim.org.
Then everything else is basic SmartList configuration - and that's moderately well documented. A confirmation stage on signup was added - now when you subscribe you are sent a confirmation which you must return before the system subscribes you (this prevents people subscribing their "friends" and makes sure that the addresses really do work). The confirm package is available at:
ftp://ftp.fatfree.com/confirm-1.1.tar.gz
and was written by Michelle Dick.
Q9804: How do I configure Exim to minic PP's "tripnote" facility?A9804: See C005.
Q9805: How do I configure Exim to handle local parts with extensions?A9805: See C010.
Q9806: How do I configure Exim so that only a restricted list of users can receive mail from external domains?A9806: See C013.
Q9807: I have someuser@mydomain.com that I only want certain users to be able to mail to. How do I accomplish this?A9807: This is a transport:
bounce:
driver = autoreply
from = postmaster@mydomain.com
to = $sender_address
user = exim
subject = "Re: Your mail to ${local_part}"
text = "You are not allowed to mail to ${local_part}."
This is a director that should come before all the others:
special_user:
driver = smartuser
local_parts = someuser
transport = bounce
except_senders = :lsearch;/list/of/permitted/senders
Note that leading ":" in except_senders. It allows the null sender <> to be valid. This is necessary, since bounce messages have null senders. All other permitted senders must be in the file as complete addresses, including a domain.
Q9808: A site for which I provide secondary MX is down for some time. Is there a way to run the queue for that destination separately from the main queue?A9808: No, because Exim does not have the concept of "the queue for that destination". It simply has a single pool of messages awaiting delivery (and some of them may have several destinations). The best approach to this is to arrange for all messages for the site to be saved somewhere other than the main spool, either on a separate dedicated MTA, or in BSMTP files. There is an example of the latter approach in C014.
Q9809: How do I implement VERP (Variable Envelope Return Paths) in Exim?A9809: See C017.
Each sample configuration is held in a separate file in the config.samples directory. Those with names of the form Cnnn are Exim configurations; those with names of the form Fnnn are filter file fragments.
C001: "This config will support delivery across multiple systems using NIS to look up delivery addresses from the mail.aliases database."
C002: "Although exim not intended for use in UUCP environment (it doesn't know anything about bang!path addresses), I'm successfully using it for delivering mail to UUCP clients."
C003: "I've read down through Q0601 and your request for UUCP examples. Here's how I'm doing it." (This example uses routers.)
C004: "Here's a BSMTP over UUCP [configuration] - the transport is Taylor/GNU UUCP - which takes the long option types." (This example uses directors.)
C005: "I am using a virus scanner program that is invoked by a pipe, scans the mail and re-invokes Exim to do the delivery. The pipe is invoking a perl script that tries to unpack and MIME, zip and other archives and then applies the McAfee scanner on the results."
C006: "This is how I have configured a PP-inspired vacationnote, there is (was?) such a feature in PP. The user makes a file "tripnote" in his/her home directory, the message is passed to the sender once with a short leading text."
C007: "If I host a domain foo.dom on my machine as a virtual domain I expect it to be completely virtual and separate from other mail domains that end up on my machine."
C008: "And of course it is possible to do a very interesting solution to this [virtual domains] using LDAP."
C009: "These are suggested parts of a configuration for looking up users in /etc/passwd.domain rather than in /etc/passwd ..."
C010: "One of our customers is looking for us to support addresses of the form username+extension@domain.com, primarily for use with procmail."
C011: "Thanks to Philip and others I now have my ISP style config built and therefore am posting the final configuration fragments to the list in case anyone else wants to do a similar thing."
C012: "I've written a small chapter how-to configure Exim for use with UUCP (mostly condensed from the exim-user mailing list plus some experimenting) and would be glad if it could be included in the Exim documentation."
C013: "I've take some tips from the FAQ about permitting only certain users to send to external mail and came up with my own for the receiving part."
C014: "If I have a situation where a site I MX for has a known outage I stash all their mail into a directory in BSMTP format."
C015: "This approach to virtual domains has helped me a great deal, and is so easy to maintain (add and modify as appropriate)."
C016: "Herewith my configuration." (A complete configuration, including simple virtual domains, along the lines of C015).
C017: "I have gotten the new VERP feature of Exim 2.054 working in test, along with some supporting programs to handle bounces that do come back."
F001: "I thought that the rest of the list may be interested in reviewing our filter as a starting point for their own system message filter."
F002: "... program which refused mail from unknown addresses until they mailed me promising not to spam me ... since I'd already thought through how to do it in Exim, and knew it'd be slightly easier than falling out of bed, I went ahead and did it."
F003: "Here's four checks installed in our system wide filter that knock out a lot of otherwise hard to detect rubbish."