[exim-cvs] cvs commit: exim/exim-doc/doc-docbook HowItWorks.…

  Modified files:
    exim-doc/doc-docbook HowItWorks.txt Markup.txt spec.xfpt x2man 
  Log:
  Update reference manual for the 4.63 release.
  Revision  Changes    Path
  1.5       +2 -1      exim/exim-doc/doc-docbook/HowItWorks.txt
  1.3       +5 -1      exim/exim-doc/doc-docbook/Markup.txt
  1.11      +512 -318  exim/exim-doc/doc-docbook/spec.xfpt
  1.4       +10 -0     exim/exim-doc/doc-docbook/x2man
  Index: HowItWorks.txt
  ===================================================================
  RCS file: /home/cvs/exim/exim-doc/doc-docbook/HowItWorks.txt,v
  retrieving revision 1.4
  retrieving revision 1.5
  diff -u -r1.4 -r1.5
  --- HowItWorks.txt    4 Apr 2006 14:03:49 -0000    1.4
  +++ HowItWorks.txt    31 Jul 2006 13:19:36 -0000    1.5
  @@ -1,4 +1,4 @@
  -$Cambridge: exim/exim-doc/doc-docbook/HowItWorks.txt,v 1.4 2006/04/04 14:03:49 ph10 Exp $
  +$Cambridge: exim/exim-doc/doc-docbook/HowItWorks.txt,v 1.5 2006/07/31 13:19:36 ph10 Exp $
  Index: Markup.txt
  ===================================================================
  RCS file: /home/cvs/exim/exim-doc/doc-docbook/Markup.txt,v
  retrieving revision 1.2
  retrieving revision 1.3
  diff -u -r1.2 -r1.3
  --- Markup.txt    4 Apr 2006 14:03:49 -0000    1.2
  +++ Markup.txt    31 Jul 2006 13:19:36 -0000    1.3
  @@ -1,4 +1,4 @@
  -$Cambridge: exim/exim-doc/doc-docbook/Markup.txt,v 1.2 2006/04/04 14:03:49 ph10 Exp $
  +$Cambridge: exim/exim-doc/doc-docbook/Markup.txt,v 1.3 2006/07/31 13:19:36 ph10 Exp $
  Index: spec.xfpt
  ===================================================================
  RCS file: /home/cvs/exim/exim-doc/doc-docbook/spec.xfpt,v
  retrieving revision 1.10
  retrieving revision 1.11
  diff -u -r1.10 -r1.11
  --- spec.xfpt    24 Jul 2006 11:55:15 -0000    1.10
  +++ spec.xfpt    31 Jul 2006 13:19:36 -0000    1.11
  @@ -1,4 +1,4 @@
  -. $Cambridge: exim/exim-doc/doc-docbook/spec.xfpt,v 1.10 2006/07/24 11:55:15 fanf2 Exp $
  +. $Cambridge: exim/exim-doc/doc-docbook/spec.xfpt,v 1.11 2006/07/31 13:19:36 ph10 Exp $
   .
   . /////////////////////////////////////////////////////////////////////////////
   . This is the primary source of the Exim Manual. It is an xfpt document that is
  @@ -18,8 +18,8 @@
   . /////////////////////////////////////////////////////////////////////////////
  @@ -106,14 +106,14 @@
   <bookinfo>
   <title>Specification of the Exim Mail Transfer Agent</title>
   <titleabbrev>The Exim MTA</titleabbrev>
  -<date>27 April 2006</date>
  +<date>27 July 2006</date>
   <author><firstname>Philip</firstname><surname>Hazel</surname></author>
   <authorinitials>PH</authorinitials>
   <affiliation><orgname>University of Cambridge Computing Service</orgname></affiliation>
   <address>New Museums Site, Pembroke Street, Cambridge CB2 3QH, England</address>
   <revhistory><revision>
  -  <revnumber>4.62</revnumber>
  -  <date>27 April 2006</date>
  +  <revnumber>4.63</revnumber>
  +  <date>27 July 2006</date>
     <authorinitials>PH</authorinitials>
   </revision></revhistory>
   <copyright><year>2006</year><holder>University of Cambridge</holder></copyright>
  @@ -410,11 +410,19 @@
   .row &'exim-announce@???'&   "moderated, low volume announcements list"
   .endtable
   The next two lines are concerned with &'ident'& callbacks, as defined by RFC
   1413 (hence their names):
  -.new
   .code
   rfc1413_hosts = *
   rfc1413_query_timeout = 5s
   .endd
  -.wen
   These settings cause Exim to make ident callbacks for all incoming SMTP calls.
   You can limit the hosts to which these calls are made, or change the timeout
   that is used. If you set the timeout to zero, all ident calls are disabled.
  @@ -5308,48 +5370,45 @@
   authenticators, though it does include some nearly complete commented-out
   examples described in &<<SECTdefconfauth>>&. This means that no client can in
   fact authenticate until you complete the authenticator definitions.
  +.new
  +.code
  +require message = relay not permitted
  +        domains = +local_domains : +relay_domains
  +.endd
  +This statement rejects the address if its domain is neither a local domain nor
  +one of the domains for which this host is a relay.
  +.code
  +require verify = recipient
  +.endd
  +This statement requires the recipient address to be verified; if verification
  +fails, the address is rejected.
   .code
   # deny    message     = rejected because $sender_host_address \
   #                       is in a black list at $dnslist_domain\n\
   #                       $dnslist_text
   #         dnslists    = black.list.example
   #
  -# warn    message     = X-Warning: $sender_host_address is \
  -#                       in a black list at $dnslist_domain
  +# warn    dnslists    = black.list.example
  +#         add_header  = X-Warning: $sender_host_address is in \
  +#                       a black list at $dnslist_domain
   #         log_message = found in $dnslist_domain
  -#         dnslists    = black.list.example
   .endd
   These commented-out lines are examples of how you could configure Exim to check
   sending hosts against a DNS black list. The first statement rejects messages
  -from blacklisted hosts, whereas the second merely inserts a warning header
  +from blacklisted hosts, whereas the second just inserts a warning header
   line.
   .code
  -accept  domains       = +local_domains
  -        endpass
  -        verify        = recipient
  -.endd
  -This statement accepts the incoming recipient address if its domain is one of
  -the local domains, but only if the address can be verified. Verification of
  -local addresses normally checks both the local part and the domain. The
  -&%endpass%& line needs some explanation: if the condition above &%endpass%&
  -fails, that is, if the address is not in a local domain, control is passed to
  -the next ACL statement. However, if the condition below &%endpass%& fails, that
  -is, if a recipient in a local domain cannot be verified, access is denied and
  -the recipient is rejected.
  -.code
  -accept  domains       = +relay_to_domains
  -        endpass
  -        verify        = recipient
  -.endd
  -This statement accepts the incoming recipient address if its domain is one of
  -the domains for which this host is a relay, but again, only if the address can
  -be verified.
  -.code
  -deny    message       = relay not permitted
  -.endd
  -The final statement denies access, giving a specific error message. Reaching
  -the end of the ACL also causes access to be denied, but with the generic
  -message &"administrative prohibition"&.
  +# require verify = csa
  +.endd
  +This commented-out line is an example of how you could turn on client SMTP
  +authorization (CSA) checking. Such checks do DNS lookups for special SRV
  +records.
  +.code
  +accept
  +.endd
  +The final statement in the first ACL unconditionally accepts any recipient
  +address that has successfully passed all the previous tests.
  +.wen
   .code
   acl_check_data:
   .endd
  @@ -6001,16 +6060,21 @@
   &*Warning 2*&: In a host list, you must always use &(net-iplsearch)& so that
   the implicit key is the host's IP address rather than its name (see section
   &<<SECThoslispatsikey>>&).
  -
   .next
  +.new
   .cindex "linear search"
   .cindex "lookup" "lsearch"
   .cindex "lsearch lookup type"
  +.cindex "case sensitivity" "in lsearch lookup"
   &(lsearch)&: The given file is a text file that is searched linearly for a
   line beginning with the search key, terminated by a colon or white space or the
  -end of the line. The first occurrence that is found in the file is used. White
  -space between the key and the colon is permitted. The remainder of the line,
  -with leading and trailing white space removed, is the data. This can be
  +end of the line. The search is case-insensitive; that is, upper and lower case
  +letters are treated as the same. The first occurrence of the key that is found
  +in the file is used.
  +.wen
  +
  +White space between the key and the colon is permitted. The remainder of the
  +line, with leading and trailing white space removed, is the data. This can be
   continued onto subsequent lines by starting them with any amount of white
   space, but only a single space character is included in the data at such a
   junction. If the data begins with a colon, the key must be terminated by a
  @@ -6054,8 +6118,12 @@
   that for &(wildlsearch)&, each key in the file is string-expanded before being
   used, whereas for &(nwildlsearch)&, no expansion takes place.
   . ==== As this is a nested list, any displays it contains must be indented
   . ==== as otherwise they are too far to the left.
  @@ -6078,6 +6146,15 @@
   .code
       ^\d+\.a\.b        data for <digits>.a.b
   .endd
  +.new
  +The case-insensitive flag is set at the start of compiling the regular
  +expression, but it can be turned off by using &`(-i)`& at an appropriate point.
  +For example, to make the entire pattern case-sensitive:
  +.code
  +    ^(?-i)\d+\.a\.b        data for <digits>.a.b
  +.endd
  +.wen
  +
   If the regular expression contains white space or colon characters, you must
   either quote it (see &(lsearch)& above), or represent these characters in other
   ways. For example, &`\s`& can be used for white space and &`\x3A`& for a
  @@ -6124,9 +6201,9 @@
   are given in the supplied query. The resulting data is the contents of the
   records. See section &<<SECTdnsdb>>&.
   .next
  -.cindex "Interbase lookup type"
  -.cindex "lookup" "Interbase"
  -&(ibase)&: This does a lookup in an Interbase database.
  +.cindex "InterBase lookup type"
  +.cindex "lookup" "InterBase"
  +&(ibase)&: This does a lookup in an InterBase database.
   .next
   .cindex "LDAP" "lookup type"
   .cindex "lookup" "LDAP"
  @@ -6426,9 +6503,9 @@
   ${lookup dnsdb{mx=a.b.example}{$value}fail}
   .endd
   If the lookup succeeds, the result is placed in &$value$&, which in this case
  -is used on its own as the result. If the lookup succeeds, the &`fail`& keyword
  -causes a &'forced expansion failure'& &-- see section &<<SECTforexpfai>>& for
  -an explanation of what this means.
  +is used on its own as the result. If the lookup &new("does not succeed,") the
  +&`fail`& keyword causes a &'forced expansion failure'& &-- see section
  +&<<SECTforexpfai>>& for an explanation of what this means.
   The supported DNS record types are A, CNAME, MX, NS, PTR, SRV, and TXT, and,
   when Exim is compiled with IPv6 support, AAAA (and A6 if that is also
  @@ -6743,16 +6820,21 @@
   spaces. If a value contains spaces it must be enclosed in double quotes, and
   when double quotes are used, backslash is interpreted in the usual way inside
   them. The following names are recognized:
  +.new
   .display
   &`DEREFERENCE`&  set the dereferencing parameter
   &`NETTIME    `&  set a timeout for a network operation
   &`USER       `&  set the DN, for authenticating the LDAP bind
   &`PASS       `&  set the password, likewise
  +&`REFERRALS  `&  set the referrals parameter
   &`SIZE       `&  set the limit for the number of entries returned
   &`TIME       `&  set the maximum waiting time for a query
   .endd
   The value of the DEREFERENCE parameter must be one of the words &"never"&,
  -&"searching"&, &"finding"&, or &"always"&.
  +&"searching"&, &"finding"&, or &"always"&. The value of the REFERRALS parameter
  +must be &"follow"& (the default) or &"nofollow"&. The latter stops the LDAP
  +library from trying to follow referrals issued by the LDAP server.
  +.wen
  @@ -8710,7 +8795,6 @@
   .cindex "expansion" "inserting from a socket"
   .cindex "socket" "use of in expansion"
   .cindex "&%readsocket%& expansion item"
  -.new
   This item inserts data from a Unix domain or Internet socket into the expanded
   string. The minimal way of using it uses just two arguments, as in these
   examples:
  @@ -8733,18 +8817,15 @@
   (unless it is an empty string) and reads from the socket until an end-of-file
   is read. A timeout of 5 seconds is applied. Additional, optional arguments
   extend what can be done. Firstly, you can vary the timeout. For example:
  -.wen
   .code
  -${readsocket{/socket/name}{request-string}{3s}}
  +${readsocket{/socket/name}{request string}{3s}}
   .endd
   A fourth argument allows you to change any newlines that are in the data
   that is read, in the same way as for &%readfile%& (see above). This example
   turns them into spaces:
  -.new
   .code
  -${readsocket{inet:127.0.0.1:3294}{request-string}{3s}{ }}
  +${readsocket{inet:127.0.0.1:3294}{request string}{3s}{ }}
   .endd
  -.wen
   As with all expansions, the substrings are expanded before the processing
   happens. Errors in these sub-expansions cause the expansion to fail. In
   addition, the following errors can occur:
  @@ -8754,7 +8835,7 @@
   .next
   Failure to connect the socket;
   .next
  -Failure to write the request-string;
  +Failure to write the request string;
   .next
   Timeout on reading from the socket.
   .endlist
  @@ -8763,16 +8844,14 @@
   you supply a fifth substring, it is expanded and used when any of the above
   errors occurs. For example:
   .code
  -${readsocket{/socket/name}{request-string}{3s}{\n}\
  +${readsocket{/socket/name}{request string}{3s}{\n}\
     {socket failure}}
   .endd
  -.new
   You can test for the existence of a Unix domain socket by wrapping this
   expansion in &`${if exists`&, but there is a race condition between that test
   and the actual opening of the socket, so it is safer to use the fifth argument
   if you want to be absolutely sure of avoiding an expansion error for a
   non-existent Unix domain socket, or a failure to connect to an Internet socket.
  -.wen
  +.vitem &*${rxquote:*&<&'string'&>&*}*&
  +.cindex "quoting" "in regular expressions"
  +.cindex "regular expressions" "quoting"
  +.cindex "&%rxquote%& expansion item"
  +The &%rxquote%& operator inserts a backslash before any non-alphanumeric
  +characters in its argument. This is useful when substituting the values of
  +variables or headers inside regular expressions.
  +
  +
   .vitem &*${sha1:*&<&'string'&>&*}*&
   .cindex "SHA-1 hash"
   .cindex "expansion" "SHA-1 hashing"
  @@ -9643,8 +9724,15 @@
     ${if match_ip{$sender_host_address}{lsearch;/some/file}...
     ${if match_ip{$sender_host_address}{net-lsearch;/some/file}...
   .endd
  +.new
   You do need to specify the &`net-`& prefix if you want to specify a
  -specific address mask, for example, by using &`net24-`&.
  +specific address mask, for example, by using &`net24-`&. However, unless you
  +are combining a &%match_ip%& condition with others, it is usually neater to use
  +an expansion lookup such as:
  +.code
  +  ${lookup{${mask:$sender_host_address/24}}lsearch{/some/file}...
  +.endd
  +.wen
   .endlist ilist
   Exim does not automatically look up every calling host's name. If you want
   maximum efficiency, you should arrange your configuration so that it avoids
  @@ -11738,7 +11863,9 @@
   .table2
   .row &%acl_not_smtp%&                "ACL for non-SMTP messages"
   .row &%acl_not_smtp_mime%&           "ACL for non-SMTP MIME parts"
  +.new
   .row &%acl_not_smtp_start%&          "ACL for start of non-SMTP message"
  +.wen
   .row &%acl_smtp_auth%&               "ACL for AUTH"
   .row &%acl_smtp_connect%&            "ACL for connection"
   .row &%acl_smtp_data%&               "ACL for DATA"
  @@ -11904,7 +12031,7 @@
   .row &%check_rfc2047_length%&        "check length of RFC 2047 &""encoded &&&
                                         words""&"
   .row &%delivery_date_remove%&        "from incoming messages"
  -.row &%envelope_to_remote%&          "from incoming messages"
  +.row &%envelope_to_remove%&          "from incoming messages"
   .row &%extract_addresses_remove_arguments%& "affects &%-t%& processing"
   .row &%headers_charset%&             "default for translations"
   .row &%qualify_domain%&              "default for senders"
  @@ -12001,11 +12128,13 @@
   messages. It operates in exactly the same way as &%acl_smtp_mime%& operates for
   SMTP messages.
  -.section "Retry rules"
  +.section "Format of retry rules"
   .cindex "retry" "rules"
   Each retry rule occupies one line and consists of three or four parts,
   separated by white space: a pattern, an error name, an optional list of sender
  @@ -21622,9 +21769,10 @@
   The pattern is any single item that may appear in an address list (see section
   &<<SECTaddresslist>>&). It is in fact processed as a one-item address list,
   which means that it is expanded before being tested against the address that
  -has been delayed. Address list processing treats a plain domain name as if it
  -were preceded by &"*@"&, which makes it possible for many retry rules to start
  -with just a domain. For example,
  +has been delayed. &new("A negated address list item is permitted.") Address
  +list processing treats a plain domain name as if it were preceded by &"*@"&,
  +which makes it possible for many retry rules to start with just a domain. For
  +example,
   .code
   lookingglass.fict.example        *  F,24h,30m;
   .endd
  @@ -22052,7 +22200,6 @@
  @@ -22572,10 +22718,16 @@
     public_name = PLAIN
     server_prompts = :
     server_condition = \
  -    ${if and {{eq{$auth2}{username}}{eq{$auth3}{mysecret}}}\
  -      {yes}{no}}
  +    ${if and {{eq{$auth2}{username}}{eq{$auth3}{mysecret}}}}
     server_set_id = $auth2
   .endd
  +.new
  +Note that the default result strings from &%if%& (&"true"& or an empty string)
  +are exactly what we want here, so they need not be specified. Obviously, if the
  +password contains expansion-significant characters such as dollar, backslash,
  +or closing brace, they have to be escaped.
  +.wen
  +
   The &%server_prompts%& setting specifies a single, empty prompt (empty items at
   the end of a string list are ignored). If all the data comes as part of the
   AUTH command, as is commonly the case, the prompt is not used. This
  @@ -22610,10 +22762,12 @@
   comparison (see &%crypteq%& in chapter &<<CHAPexpand>>&). Here is a example of
   this approach, where the passwords are looked up in a DBM file. &*Warning*&:
   This is an incorrect example:
  +.new
   .code
   server_condition = \
  -  ${if eq{$auth3}{${lookup{$auth2}dbm{/etc/authpwd}}}{yes}{no}}
  +  ${if eq{$auth3}{${lookup{$auth2}dbm{/etc/authpwd}}}}
   .endd
  +.wen
   The expansion uses the user name (&$auth2$&) as the key to look up a password,
   which it then compares to the supplied password (&$auth3$&). Why is this example
   incorrect? It works fine for existing users, but consider what happens if a
  @@ -22621,16 +22775,17 @@
   strings are given for the lookup, it yields an empty string. Thus, to defeat
   the authentication, all a client has to do is to supply a non-existent user
   name and an empty password. The correct way of writing this test is:
  +.new
   .code
   server_condition = ${lookup{$auth2}dbm{/etc/authpwd}\
  -  {${if eq{$value}{$auth3}{yes}{no}}}{no}}
  +  {${if eq{$value}{$auth3}}} {false}}
   .endd
   In this case, if the lookup succeeds, the result is checked; if the lookup
  -fails, authentication fails. If &%crypteq%& is being used instead of &%eq%&,
  -the first example is in fact safe, because &%crypteq%& always fails if its
  -second argument is empty. However, the second way of writing the test makes the
  -logic clearer.
  -
  +fails, &"false"& is returned and authentication fails. If &%crypteq%& is being
  +used instead of &%eq%&, the first example is in fact safe, because &%crypteq%&
  +always fails if its second argument is empty. However, the second way of
  +writing the test makes the logic clearer.
  +.wen
   .section "The LOGIN authentication mechanism"
  @@ -22646,8 +22801,7 @@
     public_name = LOGIN
     server_prompts = User Name : Password
     server_condition = \
  -    ${if and {{eq{$auth1}{username}}{eq{$auth2}{mysecret}}}\
  -      {yes}{no}}
  +    ${if and {{eq{$auth1}{username}}{eq{$auth2}{mysecret}}}}
     server_set_id = $auth1
   .endd
   Because of the way plaintext operates, this authenticator accepts data supplied
  @@ -22668,7 +22822,7 @@
     server_condition = ${if ldapauth \
       {user="cn=${quote_ldap_dn:$auth1},ou=people,o=example.org" \
       pass=${quote:$auth2} \
  -    ldap://ldap.example.org/}{yes}{no}}
  +    ldap://ldap.example.org/}}
     server_set_id = uid=$auth1,ou=people,o=example.org
   .endd
   Note the use of the &%quote_ldap_dn%& operator to correctly quote the DN for
  @@ -23652,13 +23806,15 @@
   .cindex "STARTTLS" "ACL for"
   .cindex "VRFY" "ACL for"
   .cindex "SMTP connection" "ACL for"
  -.cindex "non-smtp message" "ACL for"
  +.cindex "non-smtp message" "ACLs for"
   .cindex "MIME parts" "ACL for"
   .table2 140pt
   .row &~&%acl_not_smtp%&         "ACL for non-SMTP messages"
  +.new
   .row &~&%acl_not_smtp_mime%&    "ACL for non-SMTP MIME parts"
   .row &~&%acl_not_smtp_start%&   "ACL at start of non-SMTP message"
  +.wen
   .row &~&%acl_smtp_auth%&        "ACL for AUTH"
   .row &~&%acl_smtp_connect%&     "ACL for start of SMTP connection"
   .row &~&%acl_smtp_data%&        "ACL after DATA is complete"
  @@ -23688,22 +23844,46 @@
   testing as possible at RCPT time.
   When a message is accepted, the current values of all the ACL variables are
   preserved with the message and are subsequently made available at delivery
  -time. The ACL variables are set by modifier called &%set%&. For example:
  +time. The ACL variables are set by a modifier called &%set%&. For example:
   .code
   accept hosts = whatever
          set acl_m4 = some value
  @@ -24192,7 +24376,7 @@
   .vitem &*decode&~=&~*&<&'location'&>
   .cindex "&%decode%&" "ACL condition"
  @@ -25523,35 +25714,30 @@
   message. For example:
   .code
   # Log all senders' rates
  -warn
  -  ratelimit = 0 / 1h / strict
  -  log_message = Sender rate $sender_rate / $sender_rate_period
  +warn ratelimit = 0 / 1h / strict
  +     log_message = Sender rate $sender_rate / $sender_rate_period
   # Slow down fast senders; note the need to truncate $sender_rate
   # at the decimal point.
  -warn
  -  ratelimit = 100 / 1h / per_rcpt / strict
  -  delay     = ${eval: ${sg{$sender_rate}{[.].*}{}} - \
  -                $sender_rate_limit }s
  +warn ratelimit = 100 / 1h / per_rcpt / strict
  +     delay     = ${eval: ${sg{$sender_rate}{[.].*}{}} - \
  +                   $sender_rate_limit }s
   # Keep authenticated users under control
  -deny
  -  authenticated = *
  -  ratelimit = 100 / 1d / strict / $authenticated_id
  +deny authenticated = *
  +     ratelimit = 100 / 1d / strict / $authenticated_id
   # System-wide rate limit
  -defer
  -  message = Sorry, too busy. Try again later.
  -  ratelimit = 10 / 1s / $primary_hostname
  +defer message = Sorry, too busy. Try again later.
  +     ratelimit = 10 / 1s / $primary_hostname
   # Restrict incoming rate from each host, with a default
   # set using a macro and special cases looked up in a table.
  -defer
  -  message = Sender rate exceeds $sender_rate_limit \
  -            messages per $sender_rate_period
  -  ratelimit = ${lookup {$sender_host_address} \
  -                cdb {DB/ratelimits.cdb} \
  -                {$value} {RATELIMIT} }
  +defer message = Sender rate exceeds $sender_rate_limit \
  +               messages per $sender_rate_period
  +     ratelimit = ${lookup {$sender_host_address} \
  +                   cdb {DB/ratelimits.cdb} \
  +                   {$value} {RATELIMIT} }
   .endd
   &*Warning*&: If you have a busy server with a lot of &%ratelimit%& tests,
   especially with the &%per_rcpt%& option, you may suffer from a performance
  @@ -26080,10 +26266,10 @@
   Here is a longer, commented example of the use of the &%spam%&
   condition:
  +.new
   .code
   # put headers in all messages (no matter if spam or not)
  -warn  message = X-Spam-Score: $spam_score ($spam_bar)
  -      spam = nobody:true
  -warn  message = X-Spam-Report: $spam_report
  -      spam = nobody:true
  +warn  spam = nobody:true
  +      add_header = X-Spam-Score: $spam_score ($spam_bar)
  +      add_header = X-Spam-Report: $spam_report
   # add second subject line with *SPAM* marker when message
   # is over threshold
  -warn  message = Subject: *SPAM* $h_Subject:
  -      spam = nobody
  +warn  spam = nobody
  +      add_header = Subject: *SPAM* $h_Subject:
   # reject spam at high scores (> 12)
   deny  message = This message scored $spam_score spam points.
         spam = nobody:true
         condition = ${if >{$spam_score_int}{120}{1}{0}}
   .endd
  +.wen
   Unless your host is doing nothing but mailing list deliveries, you should
   probably use a separate transport for the VERP deliveries, so as not to use
  -extra resources for the others. This can easily be done by expanding the
  -&%transport%& option in the router:
  +extra resources in making one-per-recipient copies for other deliveries. This
  +can easily be done by expanding the &%transport%& option in the router:
  +.wen
   .code
   dnslookup:
     driver = dnslookup
  @@ -30723,7 +30917,7 @@
   &` received_sender            `&  sender on <= lines
   &`*rejected_header            `&  header contents on reject log
   &`*retry_defer                `&  &"retry time not reached"&
  -&` return_path_on_delivery    `&  put return path on => and *\ lines
  +&` return_path_on_delivery    `&  put return path on => and ** lines
   &` sender_on_delivery         `&  add sender to => lines
   &`*sender_verify_fail         `&  sender verification failures
   &`*size_reject                `&  rejection because too big
  @@ -30906,10 +31100,10 @@
   necessarily the same as the outgoing return path.
   .next
   .cindex "log" "sender verify failure"
  -&%sender_verify_failure%&: If this selector is unset, the separate log line
  -that gives details of a sender verification failure is not written. Log lines
  -for the rejection of SMTP commands contain just &"sender verify failed"&, so
  -some detail is lost.
  +&%sender_verify_fail%&: If this selector is unset, the separate log line that
  +gives details of a sender verification failure is not written. Log lines for
  +the rejection of SMTP commands contain just &"sender verify failed"&, so some
  +detail is lost.
   .next
   .cindex "log" "size rejection"
   &%size_reject%&: A log line is written whenever a message is rejected because
  Index: x2man
  ===================================================================
  RCS file: /home/cvs/exim/exim-doc/doc-docbook/x2man,v
  retrieving revision 1.3
  retrieving revision 1.4
  diff -u -r1.3 -r1.4
  --- x2man    4 Apr 2006 14:03:49 -0000    1.3
  +++ x2man    31 Jul 2006 13:19:36 -0000    1.4
  @@ -1,6 +1,6 @@
   #! /usr/bin/perl -w