[exim] Exim installation problems

Kezdőlap
Üzenet törlése
Válasz az üzenetre
Szerző: Han Ndlo
Dátum:  
Címzett: exim-users
Tárgy: [exim] Exim installation problems
Hi to every one

I have installed exim4 on my debian 3.1 (updated)
systerm. i am building a server for a school that has
about 100 computers and it has to send recieve mail to
a smarthost = and the 100 client machines must be able
to send and recieve mail from the server am building

i have split config file = no
smarhost = yes

I have been up and down sites and used Google to the
serious limit But i still have these the following
problems and need serious help:


1) i can send a message to a client and they recieve
it correctly but if i try send mail form the client
machine i get the following error:

H=clientmachine(192.168.x.x)F=<client1@???>
rejected RCPT <test@???>: relay not permitted


2)if i try and send mail from the server am building
using the smarthost i get the error:

test@??? R-smarthost defer (-36) host lookup for
mail.mysmarthost.com did not complete (DNS timeout) -
test@??? routing defer (-51): retry time not
reached

i am sorry because will attach my update.conf.conf and
my exim4.conf.template which tend to be LONG

PLease help me

=============================================
update.conf.conf
=================
dc_eximconfig_configtype='smarthost'
dc_other_hostnames='blk.mango.zw'
dc_local_interfaces='192.168.10.50'
dc_readhost='192.168.10.130'
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets='192.168.10.0/24'
dc_smarthost='192.168.10.130'
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname='false'
dc_mailname_in_oh='true'
=============================================


=============================================
#####################################################
### main/01_exim4-config_listmacrosdefs
#####################################################

######################################################################
#      Runtime configuration file for Exim 4 (Debian
Packaging)      #
######################################################################


######################################################################
# /etc/exim4/exim4.conf.template is only used with the
non-split
# configuration scheme.
#
/etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs
is only used
# with the split configuration scheme.
# If you find this comment anywhere else, somebody
copied it there.
# Documentation about the Debian exim4 configuration
scheme can be
# found in /usr/share/doc/exim4-base/README.Debian.gz.
#
# Strings like DEBCONFsomethingDEBCONF are replaced by
installation
# dependent values by update-exim4.conf, the script
which builds the
# actual configuration from the templates.
######################################################################

######################################################################
#                    MAIN CONFIGURATION SETTINGS      
              #
######################################################################


# Just for reference and scripts.
# On Debian systems, the main binary is installed as
exim4 to avoid
# conflicts with the exim 3 packages.
exim_path = /usr/sbin/exim4

# Macro defining the main configuration directory.
# We do not use absolute paths.
.ifndef CONFDIR
CONFDIR = /etc/exim4
.endif

# This sets a macro DC_minimaldns if
dc_minimaldns=true. If
# dc_minimaldns=false, this expands to an empty line.
.ifndef DC_minimaldns
DEBCONFminimaldnsDEBCONF
.endif

# Create other macros from Debconf. Macros created
here are used in
# other places in exim config.
.ifndef DC_visiblename
DC_visiblename=DEBCONFvisiblenameDEBCONF
.endif

# Create domain and host lists for relay control
# '@' refers to 'the name of the local host'

# List of domains considered local for exim. Domains
not listed here
# need to be deliverable remotely.
.ifndef MAIN_LOCAL_DOMAINS
MAIN_LOCAL_DOMAINS = DEBCONFlocal_domainsDEBCONF
.endif
domainlist local_domains = MAIN_LOCAL_DOMAINS

# List of recipient domains to relay _to_. Use this
list if you're -
# for example - fallback MX or mail gateway for
domains.
.ifndef MAIN_RELAY_TO_DOMAINS
MAIN_RELAY_TO_DOMAINS = DEBCONFrelay_domainsDEBCONF
.endif
domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS

# List of sender networks (IP addresses) to
_unconditionally_ relay
# _for_. If you intend to be SMTP AUTH server, you do
not need to enter
# anything here.
.ifndef MAIN_RELAY_NETS
MAIN_RELAY_NETS = DEBCONFrelay_netsDEBCONF
.endif
hostlist relay_from_hosts = MAIN_RELAY_NETS


# Specify the domain you want to be added to all
unqualified addresses
# here. Unqualified addresses are accepted only from
local callers by
# default. The recipient_unqualified_hosts option can
be used to permit
# unqualified addresses from remote sources.
# If qualify_domain is not set, the primary_hostname
value is used for
# qualification.
# The ifdef bracket makes sure that an empty debconf
value is correctly
# translated to "unset".
.ifdef DC_visiblename
qualify_domain = DC_visiblename
.endif

# only used for satellite-system
.ifndef DCreadhost
DCreadhost = DEBCONFreadhostDEBCONF
.endif

#for satellite and smarthost-systems
.ifndef DCsmarthost
DCsmarthost = DEBCONFsmarthostDEBCONF
.endif

# listen on all all interfaces?
.ifdef MAIN_LOCAL_INTERFACES
local_interfaces = MAIN_LOCAL_INTERFACES
.else
DEBCONFlistenonpublicDEBCONF
.endif

.ifndef LOCAL_DELIVERY
# The default transport, set in
/etc/exim4/update-exim4.conf.conf,
# defaulting to mail_spool. See
CONFDIR/conf.d/transport/ for possibilities
LOCAL_DELIVERY=DEBCONFlocaldeliveryDEBCONF
.endif

# The gecos field in /etc/passwd holds not only the
name. see passwd(5).
gecos_pattern = ^([^,:]*)
gecos_name = $1


# define a macro DCconfig_smarthost,
DCconfig_satellite, etc. we need this
# for .ifdef ... .endif
.ifndef DCconfig_satellite
.ifndef DCconfig_internet
.ifndef DCconfig_local
.ifndef DCconfig_smarthost
DCconfig_DEBCONFconfigtypeDEBCONF = 1
.endif
.endif
.endif
.endif


# define macros to be used in
acl/30_exim4-config_check_rcpt to check
# recipient local parts for strange characters.

# This macro definition really should be in
# acl/30_exim4-config_check_rcpt but cannot be there
due to
# http://www.exim.org/bugzilla/show_bug.cgi?id=101 as
of exim 4.62.

# These macros are documented in
acl/30_exim4-config_check_rcpt,
# can be changed here or overridden by a locally added
configuration
# file as described in README.Debian chapter 2.1.2

.ifndef CHECK_RCPT_LOCAL_LOCALPARTS
CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
.endif

.ifndef CHECK_RCPT_REMOTE_LOCALPARTS
CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] :
^.*/\\.\\./
.endif

# always log tls_peerdn as we use TLS for outgoing
connects by default
.ifndef MAIN_LOG_SELECTOR
MAIN_LOG_SELECTOR = +tls_peerdn
.endif
#####################################################
### end main/01_exim4-config_listmacrosdefs
#####################################################
#####################################################
### main/02_exim4-config_options
#####################################################

### main/02_exim4-config_options
#################################


# Defines the access control list that is run when an
# SMTP MAIL command is received.
#
.ifndef MAIN_ACL_CHECK_MAIL
MAIN_ACL_CHECK_MAIL = acl_check_mail
.endif
acl_smtp_mail = MAIN_ACL_CHECK_MAIL


# Defines the access control list that is run when an
# SMTP RCPT command is received.
#
.ifndef MAIN_ACL_CHECK_RCPT
MAIN_ACL_CHECK_RCPT = acl_check_rcpt
.endif
acl_smtp_rcpt = MAIN_ACL_CHECK_RCPT


# Defines the access control list that is run when an
# SMTP DATA command is received.
#
.ifndef MAIN_ACL_CHECK_DATA
MAIN_ACL_CHECK_DATA = acl_check_data
.endif
acl_smtp_data = MAIN_ACL_CHECK_DATA


# Message size limit. The default (used when
MESSAGE_SIZE_LIMIT
# is unset) is 50 MB
.ifdef MESSAGE_SIZE_LIMIT
message_size_limit = MESSAGE_SIZE_LIMIT
.endif


# If you are running exim4-daemon-heavy or a custom
version of Exim that
# was compiled with the content-scanning extension,
you can cause incoming
# messages to be automatically scanned for viruses.
You have to modify the
# configuration in two places to set this up. The
first of them is here,
# where you define the interface to your scanner. This
example is typical
# for ClamAV; see the manual for details of what to
set for other virus
# scanners. The second modification is in the
acl_check_data access
# control list.

# av_scanner = clamd:/tmp/clamd


# For spam scanning, there is a similar option that
defines the interface to
# SpamAssassin. You do not need to set this if you are
using the default, which
# is shown in this commented example. As for virus
scanning, you must also
# modify the acl_check_data access control list to
enable spam scanning.

# spamd_address = 127.0.0.1 783

# Domain used to qualify unqualified recipient
addresses
# If this option is not set, the qualify_domain value
is used.
# qualify_recipient = <value of qualify_domain>


# Allow Exim to recognize addresses of the form
"user@???",
# where the domain part is a "domain literal" (an IP
address) instead
# of a named domain. The RFCs require this facility,
but it is disabled
# in the default config since it is seldomly used and
frequently abused.
# Domain literal support also needs a special router,
which is automatically
# enabled if you use the enable macro
MAIN_ALLOW_DOMAIN_LITERALS.
.ifdef MAIN_ALLOW_DOMAIN_LITERALS
allow_domain_literals
.endif


# Do a reverse DNS lookup on all incoming IP calls, in
order to get the
# true host name. If you feel this is too expensive,
the networks for
# which a lookup is done can be listed here.
.ifndef DC_minimaldns
.ifndef MAIN_HOST_LOOKUP
MAIN_HOST_LOOKUP = *
.endif
host_lookup = MAIN_HOST_LOOKUP
.endif


# In a minimaldns setup, update-exim4.conf guesses the
hostname and
# dumps it here to avoid DNS lookups being done at
Exim run time.
DEBCONF_hardcode_primary_hostname_DEBCONF

# The settings below, which are actually the same as
the defaults in the
# code, cause Exim to make RFC 1413 (ident) callbacks
for all incoming SMTP
# calls. You can limit the hosts to which these calls
are made, and/or change
# the timeout that is used. If you set the timeout to
zero, all RFC 1413 calls
# are disabled. RFC 1413 calls are cheap and can
provide useful information
# for tracing problem messages, but some hosts and
firewalls are
# misconfigured to drop the requests instead of either
answering or
# rejecting them. This can result in a timeout instead
of an immediate refused
# connection, leading to delays on starting up SMTP
sessions. (The default was
# reduced from 30s to 5s for release 4.61.)
# rfc1413_hosts = *
# rfc1413_query_timeout = 5s


# By default, exim forces a Sender: header containing
the local
# account name at the local host name in all locally
submitted messages
# that don't have the local account name at the local
host name in the
# From: header, deletes any Sender: header present in
the submitted
# message and forces the envelope sender of all
locally submitted
# messages to the local account name at the local host
name.
# The following settings allow local users to specify
their own envelope sender
# in a locally submitted message. Sender: headers
existing in a locally
# submitted message are not removed, and no automatic
Sender: headers
# are added. These settings are fine for most hosts.
# If you run exim on a classical multi-user systems
where all users
# have local mailboxes that can be reached via SMTP
from the Internet
# with the local FQDN as the domain part of the
address, you might want
# to disable the following three lines for
traceability reasons.
.ifndef MAIN_FORCE_SENDER
local_from_check = false
local_sender_retain = true
untrusted_set_sender = *
.endif


# By default, Exim expects all envelope addresses to
be fully qualified, that
# is, they must contain both a local part and a
domain. Configure exim
# to accept unqualified addresses from certain hosts.
When this is done,
# unqualified addresses are qualified using the
settings of qualify_domain
# and/or qualify_recipient (see above).
# sender_unqualified_hosts = <unset>
# recipient_unqualified_hosts = <unset>


# Configure Exim to support the "percent hack" for
certain domains.
# The "percent hack" is the feature by which mail
addressed to x%y@z
# (where z is one of the domains listed) is locally
rerouted to x@y
# and sent on. If z is not one of the "percent hack"
domains, x%y is
# treated as an ordinary local part. The percent hack
is rarely needed
# nowadays but frequently abused. You should not
enable it unless you
# are sure that you really need it.
# percent_hack_domains = <unset>


# Bounce handling
.ifndef MAIN_IGNORE_BOUNCE_ERRORS_AFTER
MAIN_IGNORE_BOUNCE_ERRORS_AFTER = 2d
.endif
ignore_bounce_errors_after =
MAIN_IGNORE_BOUNCE_ERRORS_AFTER

.ifndef MAIN_TIMEOUT_FROZEN_AFTER
MAIN_TIMEOUT_FROZEN_AFTER = 7d
.endif
timeout_frozen_after = MAIN_TIMEOUT_FROZEN_AFTER

.ifndef MAIN_FREEZE_TELL
MAIN_FREEZE_TELL = postmaster
.endif
freeze_tell = MAIN_FREEZE_TELL


# Define spool directory
.ifndef SPOOLDIR
SPOOLDIR = /var/spool/exim4
.endif
spool_directory = SPOOLDIR


# trusted users can set envelope-from to arbitrary
values
.ifndef MAIN_TRUSTED_USERS
MAIN_TRUSTED_USERS = uucp
.endif
trusted_users = MAIN_TRUSTED_USERS
.ifdef MAIN_TRUSTED_GROUPS
trusted_groups = MAIN_TRUSTED_GROUPS
.endif


# users in admin group can do many other things
# admin_groups = <unset>


# SMTP Banner. The example includes the Debian version
in the SMTP dialog
# MAIN_SMTP_BANNER = "${primary_hostname} ESMTP Exim
${version_number} (Debian package
DEBCONFpackageversionDEBCONF) ${tod_full}"
# smtp_banner = $smtp_active_hostname ESMTP Exim
$version_number $tod_full
#####################################################
### end main/02_exim4-config_options
#####################################################
#####################################################
### main/03_exim4-config_tlsoptions
#####################################################

### main/03_exim4-config_tlsoptions
#################################

# TLS/SSL configuration.
# See /usr/share/doc/exim4-base/README.Debian.gz for
explanations.


.ifdef MAIN_TLS_ENABLE
# Defines what hosts to 'advertise' STARTTLS
functionality to. The
# default, *, will advertise to all hosts that connect
with EHLO.
.ifndef MAIN_TLS_ADVERTISE_HOSTS
MAIN_TLS_ADVERTISE_HOSTS = *
.endif
tls_advertise_hosts = MAIN_TLS_ADVERTISE_HOSTS


# Full paths to Certificate and Private Key. The
Private Key file
# must be kept 'secret' and should be owned by
root.Debian-exim mode
# 640 (-rw-r-----). exim-gencert takes care of these
prerequisites.
# Normally, exim4 looks for certificate and key in
different files:
#   MAIN_TLS_CERTIFICATE - path to certificate file,
#                          CONFDIR/exim.crt if unset
#   MAIN_TLS_PRIVATEKEY  - path to private key file
#                          CONFDIR/exim.key if unset
# You can also configure exim to look for certificate
and key in the
# same file, set MAIN_TLS_CERTKEY to that file to
enable. This takes
# precedence over all other settings regarding
certificate and key file.
.ifdef MAIN_TLS_CERTKEY
tls_certificate = MAIN_TLS_CERTKEY
.else
.ifndef MAIN_TLS_CERTIFICATE
MAIN_TLS_CERTIFICATE = CONFDIR/exim.crt
.endif
tls_certificate = MAIN_TLS_CERTIFICATE


.ifndef MAIN_TLS_PRIVATEKEY
MAIN_TLS_PRIVATEKEY = CONFDIR/exim.key
.endif
tls_privatekey = MAIN_TLS_PRIVATEKEY
.endif

# Pointer to the CA Certificates against which client
certificates are
# checked. This is controlled by the
`tls_verify_hosts' and
# `tls_try_verify_hosts' lists below.
# If you want to check server certificates, you need
to add an
# tls_verify_certificates statement to the smtp
transport.
# /etc/ssl/certs/ca-certificates.crt is generated by
# the "ca-certificates" package's
update-ca-certificates(8) command.
.ifndef MAIN_TLS_VERIFY_CERTIFICATES
MAIN_TLS_VERIFY_CERTIFICATES = ${if
exists{/etc/ssl/certs/ca-certificates.crt}\

{/etc/ssl/certs/ca-certificates.crt}\
                    {/dev/null}}
.endif
tls_verify_certificates = MAIN_TLS_VERIFY_CERTIFICATES



# A list of hosts which are constrained by
`tls_verify_certificates'. A host
# that matches `tls_verify_host' must present a
certificate that is
# verifyable through `tls_verify_certificates' in
order to be accepted as an
# SMTP client. If it does not, the connection is
aborted.
.ifdef MAIN_TLS_VERIFY_HOSTS
tls_verify_hosts = MAIN_TLS_VERIFY_HOSTS
.endif

# A weaker form of checking: if a client matches
`tls_try_verify_hosts' (but
# not `tls_verify_hosts'), request a certificate and
check it against
# `tls_verify_certificates' but do not abort the
connection if there is no
# certificate or if the certificate presented does not
match. (This
# condition can be tested for in ACLs through `verify
= certificate')
.ifndef MAIN_TLS_TRY_VERIFY_HOSTS
MAIN_TLS_TRY_VERIFY_HOSTS = *
.endif
tls_try_verify_hosts = MAIN_TLS_TRY_VERIFY_HOSTS

.endif
#####################################################
### end main/03_exim4-config_tlsoptions
#####################################################
#####################################################
### main/90_exim4-config_log_selector
#####################################################

### main/90_exim4-config_log_selector
#################################

# uncomment this for debugging
# MAIN_LOG_SELECTOR == MAIN_LOG_SELECTOR +all -subject
-arguments

.ifdef MAIN_LOG_SELECTOR
log_selector = MAIN_LOG_SELECTOR
.endif
#####################################################
### end main/90_exim4-config_log_selector
#####################################################
#####################################################
### acl/00_exim4-config_header
#####################################################

######################################################################
#                       ACL CONFIGURATION             
              #
#         Specifies access control lists for incoming
SMTP mail      #
######################################################################
begin acl



#####################################################
### end acl/00_exim4-config_header
#####################################################
#####################################################
### acl/20_exim4-config_whitelist_local_deny
#####################################################

### acl/20_exim4-config_whitelist_local_deny
#################################

# This is used to determine whitelisted senders and
hosts.
# It checks for CONFDIR/local_host_whitelist and
# CONFDIR/local_sender_whitelist.
#
# It is meant to be used from some other acl entry.
#
# See exim4-config_files(5) for details.
#
# If the files do not exist, the white list never
matches, which is
# the desired behaviour.

acl_whitelist_local_deny:
  accept
    hosts = ${if exists{CONFDIR/local_host_whitelist}\
                 {CONFDIR/local_host_whitelist}\
                 {}}
  accept
    senders = ${if
exists{CONFDIR/local_sender_whitelist}\
                   {CONFDIR/local_sender_whitelist}\
                   {}}


# This hook allows you to hook in your own ACLs
without having to
# modify this file. If you do it like we suggest,
you'll end up with
# a small performance penalty since there is an
additional file being
# accessed. This doesn't happen if you leave the
macro unset.
.ifdef WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
.include WHITELIST_LOCAL_DENY_LOCAL_ACL_FILE
.endif
#####################################################
### end acl/20_exim4-config_whitelist_local_deny
#####################################################
#####################################################
### acl/30_exim4-config_check_mail
#####################################################

### acl/30_exim4-config_check_mail
#################################

# This access control list is used for every MAIL
command in an incoming
# SMTP message. The tests are run in order until the
address is either
# accepted or denied.
#
acl_check_mail:
  .ifdef CHECK_MAIL_HELO_ISSUED
  deny
    message = no HELO given before MAIL command
    condition = ${if def:sender_helo_name {no}{yes}}
  .endif


accept
#####################################################
### end acl/30_exim4-config_check_mail
#####################################################
#####################################################
### acl/30_exim4-config_check_rcpt
#####################################################

### acl/30_exim4-config_check_rcpt
#################################

# This access control list is used for every RCPT
command in an incoming
# SMTP message. The tests are run in order until the
address is either
# accepted or denied.
#
acl_check_rcpt:

  # Accept if the source is local SMTP (i.e. not over
TCP/IP). We do this by
  # testing for an empty sending host field.
  accept
    hosts = :



# The following section of the ACL is concerned with
local parts that contain
# certain non-alphanumeric characters. Dots in
unusual places are
# handled by this ACL as well.
#
# Non-alphanumeric characters other than dots are
rarely found in genuine
# local parts, but are often tried by people looking
to circumvent
# relaying restrictions. Therefore, although they
are valid in local
# parts, these rules disallow certain
non-alphanumeric characters, as
# a precaution.
#
# Empty components (two dots in a row) are not valid
in RFC 2822, but Exim
# allows them because they have been encountered.
(Consider local parts
# constructed as
"firstinitial.secondinitial.familyname" when applied
to
# a name without a second initial.) However, a local
part starting
# with a dot or containing /../ can cause trouble if
it is used as part of a
# file name (e.g. for a mailing list). This is also
true for local parts that
# contain slashes. A pipe symbol can also be
troublesome if the local part is
# incorporated unthinkingly into a shell command
line.
#
# These ACL components will block recipient
addresses that are valid
# from an RFC2822 point of view. We chose to have
them blocked by
# default for security reasons.
#
# If you feel that your site should have less strict
recipient
# checking, please feel free to change the default
values of the macros
# defined in main/01_exim4-config_listmacrosdefs or
override them from a
# local configuration file.
#
# Two different rules are used. The first one has a
quite strict
# default, and is applied to messages that are
addressed to one of the
# local domains handled by this host.

  # The default value of CHECK_RCPT_LOCAL_LOCALPARTS
is defined in
  # main/01_exim4-config_listmacrosdefs:
  # CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] :
^.*[@%!/|`#&?]
  # This blocks local parts that begin with a dot or
contain a quite
  # broad range of non-alphanumeric characters.
  .ifdef CHECK_RCPT_LOCAL_LOCALPARTS
  deny
    domains = +local_domains
    local_parts = CHECK_RCPT_LOCAL_LOCALPARTS
    message = restricted characters in address
  .endif



# The second rule applies to all other domains, and
its default is
# considerably less strict.

# The default value of CHECK_RCPT_REMOTE_LOCALPARTS
is defined in
# main/01_exim4-config_listmacrosdefs:
# CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] :
^.*[@%!`#&?] : ^.*/\\.\\./

  # It allows local users to send outgoing messages to
sites
  # that use slashes and vertical bars in their local
parts. It blocks
  # local parts that begin with a dot, slash, or
vertical bar, but allows
  # these characters within the local part. However,
the sequence /../ is
  # barred. The use of some other non-alphanumeric
characters is blocked.
  # Single quotes might probably be dangerous as well,
but they're
  # allowed by the default regexps to avoid rejecting
mails to Ireland.
  # The motivation here is to prevent local users (or
local users' malware)
  # from mounting certain kinds of attack on remote
sites.
  .ifdef CHECK_RCPT_REMOTE_LOCALPARTS
  deny
    domains = !+local_domains
    local_parts = CHECK_RCPT_REMOTE_LOCALPARTS
    message = restricted characters in address
  .endif



  # Accept mail to postmaster in any local domain,
regardless of the source,
  # and without verifying the sender.
  #
  accept
    .ifndef CHECK_RCPT_POSTMASTER
    local_parts = postmaster
    .else
    local_parts = CHECK_RCPT_POSTMASTER
    .endif
    domains = +local_domains : +relay_to_domains



  # Deny unless the sender address can be verified.
  #
  # This is disabled by default so that DNSless
systems don't break. If
  # your system can do DNS lookups without delay or
cost, you might want
  # to enable this feature.
  #
  # This feature does not work in smarthost and
satellite setups as
  # with these setups all domains pass verification.
See spec.txt chapter
  # 39.31 with the added information that a
smarthost/satellite setup
  # routes all non-local e-mail to the smarthost.
  .ifdef CHECK_RCPT_VERIFY_SENDER
  deny
    message = Sender verification failed
    !acl = acl_whitelist_local_deny
    !verify = sender
  .endif


  # Verify senders listed in local_sender_callout with
a callout.
  #
  # In smarthost and satellite setups, this causes the
callout to be
  # done to the smarthost. Verification will thus only
be reliable if the
  # smarthost does reject illegal addresses in the
SMTP dialog.
  deny
    !acl = acl_whitelist_local_deny
    senders = ${if
exists{CONFDIR/local_sender_callout}\


{CONFDIR/local_sender_callout}\
                   {}}
    !verify = sender/callout



# Accept if the message comes from one of the hosts
for which we are an
# outgoing relay. It is assumed that such hosts are
most likely to be MUAs,
# so we set control=submission to make Exim treat
the message as a
# submission. It will fix up various errors in the
message, for example, the
# lack of a Date: header line. If you are actually
relaying out out from
# MTAs, you may want to disable this. If you are
handling both relaying from
# MTAs and submissions from MUAs you should probably
split them into two
# lists, and handle them differently.

# Recipient verification is omitted here, because in
many cases the clients
# are dumb MUAs that don't cope well with SMTP error
responses. If you are
# actually relaying out from MTAs, you should
probably add recipient
# verification here.

  # Note that, by putting this test before any DNS
black list checks, you will
  # always accept from these hosts, even if they end
up on a black list. The
  # assumption is that they are your friends, and if
they get onto black
  # list, it is a mistake.
  accept
    hosts = +relay_from_hosts
    control = submission/sender_retain



  # Accept if the message arrived over an
authenticated connection, from
  # any host. Again, these messages are usually from
MUAs, so recipient
  # verification is omitted, and submission mode is
set. And again, we do this
  # check before any black list tests.
  accept
    authenticated = *
    control = submission/sender_retain



  # Insist that any other recipient address that we
accept is either in one of
  # our local domains, or is in a domain for which we
explicitly allow
  # relaying. Any other domain is rejected as being
unacceptable for relaying.
  require
    message = relay not permitted
    domains = +local_domains : +relay_to_domains



  # We also require all accepted addresses to be
verifiable. This check will
  # do local part verification for local domains, but
only check the domain
  # for remote domains.
  require
    verify = recipient



  # Verify recipients listed in local_rcpt_callout
with a callout.
  # This is especially handy for forwarding MX hosts
(secondary MX or
  # mail hubs) of domains that receive a lot of spam
to non-existent
  # addresses.  The only way to check local parts for
remote relay
  # domains is to use a callout (add /callout), but
please read the
  # documentation about callouts before doing this.
  deny
    !acl = acl_whitelist_local_deny
    recipients = ${if
exists{CONFDIR/local_rcpt_callout}\


{CONFDIR/local_rcpt_callout}\
                      {}}
    !verify = recipient/callout



  # CONFDIR/local_sender_blacklist holds a list of
envelope senders that
  # should have their access denied to the local host.
Incoming messages
  # with one of these senders are rejected at RCPT
time.
  #
  # The explicit white lists are honored as well as
negative items in
  # the black list. See exim4-config_files(5) for
details.
  deny
    message = sender envelope address $sender_address
is locally blacklisted here. If you think this is
wrong, get in touch with postmaster
    !acl = acl_whitelist_local_deny
    senders = ${if
exists{CONFDIR/local_sender_blacklist}\
                   {CONFDIR/local_sender_blacklist}\
                   {}}



  # deny bad sites (IP address)
  # CONFDIR/local_host_blacklist holds a list of host
names, IP addresses
  # and networks (CIDR notation)  that should have
their access denied to
  # The local host. Messages coming in from a listed
host will have all
  # RCPT statements rejected.
  #
  # The explicit white lists are honored as well as
negative items in
  # the black list. See
/usr/share/doc/exim4-config/default_acl for details.
  deny
    message = sender IP address $sender_host_address
is locally blacklisted here. If you think this is
wrong, get in touch with postmaster
    !acl = acl_whitelist_local_deny
    hosts = ${if exists{CONFDIR/local_host_blacklist}\
                 {CONFDIR/local_host_blacklist}\
                 {}}



  # Warn if the sender host does not have valid
reverse DNS.
  # 
  # If your system can do DNS lookups without delay or
cost, you might want
  # to enable this.
  # If sender_host_address is defined, it's a remote
call.  If
  # sender_host_name is not defined, then reverse
lookup failed.  Use
  # this instead of !verify = reverse_host_lookup to
catch deferrals
  # as well as outright failures.
  .ifdef CHECK_RCPT_REVERSE_DNS
  warn
    message = X-Host-Lookup-Failed: Reverse DNS lookup
failed for $sender_host_address (${if
eq{$host_lookup_failed}{1}{failed}{deferred}})
     condition = ${if
and{{def:sender_host_address}{!def:sender_host_name}}\
                      {yes}{no}}
  .endif



  # Use spfquery to perform a pair of SPF checks (for
details, see
  # http://www.openspf.org/)
  #
  # This is quite costly in terms of DNS lookups (~6
lookups per mail).  Do not
  # enable if that's an issue.  Also note that if you
enable this, you must
  # install "libmail-spf-query-perl" which provides
the spfquery command.
  # Missing libmail-spf-query-perl will trigger the
"Unexpected error in
  # SPF check" warning.
  .ifdef CHECK_RCPT_SPF
  deny
    message = [SPF] $sender_host_address is not
allowed to send mail from ${if
def:sender_address_domain
{$sender_address_domain}{$sender_helo_name}}.  \
              Please see
http://www.openspf.org/why.html?sender=$sender_address&ip=$sender_host_address
    log_message = SPF check failed.
    condition = ${run{/usr/bin/spfquery --ip
\"$sender_host_address\" --mail-from
\"$sender_address\" --helo \"$sender_helo_name\"}\
                     {no}{${if eq
{$runrc}{1}{yes}{no}}}}


  defer
    message = Temporary DNS error while checking SPF
record.  Try again later.
    condition = ${if eq {$runrc}{5}{yes}{no}}


  warn
    message = Received-SPF: ${if eq
{$runrc}{0}{pass}{${if eq {$runrc}{2}{softfail}\
                                 {${if eq
{$runrc}{3}{neutral}{${if eq {$runrc}{4}{unknown}{${if
eq {$runrc}{6}{none}{error}}}}}}}}}}
    condition = ${if <={$runrc}{6}{yes}{no}}


  warn
    log_message = Unexpected error in SPF check.
    condition = ${if >{$runrc}{6}{yes}{no}}


  # Support for best-guess (see
http://www.openspf.org/developers-guide.html)
  warn
    message = X-SPF-Guess: ${run{/usr/bin/spfquery
--ip \"$sender_host_address\" --mail-from
\"$sender_address\" \ --helo \"$sender_helo_name\"
--guess true}\
                                {pass}{${if eq
{$runrc}{2}{softfail}{${if eq
{$runrc}{3}{neutral}{${if eq {$runrc}{4}{unknown}\
                                {${if eq
{$runrc}{6}{none}{error}}}}}}}}}}
    condition = ${if <={$runrc}{6}{yes}{no}}


  defer
    message = Temporary DNS error while checking SPF
record.  Try again later.
    condition = ${if eq {$runrc}{5}{yes}{no}}
  .endif



  # Check against classic DNS "black" lists (DNSBLs)
which list
  # sender IP addresses
  .ifdef CHECK_RCPT_IP_DNSBLS
  warn
    message = X-Warning: $sender_host_address is
listed at $dnslist_domain ($dnslist_value:
$dnslist_text)
    log_message = $sender_host_address is listed at
$dnslist_domain ($dnslist_value: $dnslist_text)
    dnslists = CHECK_RCPT_IP_DNSBLS
  .endif



  # Check against DNSBLs which list sender domains,
with an option to locally
  # whitelist certain domains that might be
blacklisted.
  #
  # Note: If you define CHECK_RCPT_DOMAIN_DNSBLS, you
must append
  # "/$sender_address_domain" after each domain.  For
example:
  # CHECK_RCPT_DOMAIN_DNSBLS =
rhsbl.foo.org/$sender_address_domain \
  #                            :
rhsbl.bar.org/$sender_address_domain
  .ifdef CHECK_RCPT_DOMAIN_DNSBLS
  warn
    message = X-Warning: $sender_address_domain is
listed at $dnslist_domain ($dnslist_value:
$dnslist_text)
    log_message = $sender_address_domain is listed at
$dnslist_domain ($dnslist_value: $dnslist_text)
    !senders = ${if
exists{CONFDIR/local_domain_dnsbl_whitelist}\


{CONFDIR/local_domain_dnsbl_whitelist}\
                    {}}
    dnslists = CHECK_RCPT_DOMAIN_DNSBLS
  .endif



# This hook allows you to hook in your own ACLs
without having to
# modify this file. If you do it like we suggest,
you'll end up with
# a small performance penalty since there is an
additional file being
# accessed. This doesn't happen if you leave the
macro unset.
.ifdef CHECK_RCPT_LOCAL_ACL_FILE
.include CHECK_RCPT_LOCAL_ACL_FILE
.endif



#############################################################################
# This check is commented out because it is
recognized that not every
# sysadmin will want to do it. If you enable it, the
check performs
# Client SMTP Authorization (csa) checks on the
sending host. These checks
# do DNS lookups for SRV records. The CSA proposal
is currently (May 2005)
# an Internet draft. You can, of course, add
additional conditions to this
# ACL statement to restrict the CSA checks to
certain hosts only.
#
# require verify = csa

#############################################################################


# Accept if the address is in a domain for which we
are an incoming relay,
# but again, only if the recipient can be verified.

  accept
    domains = +relay_to_domains
    endpass
    verify = recipient



# At this point, the address has passed all the
checks that have been
# configured, so we accept it unconditionally.

accept
#####################################################
### end acl/30_exim4-config_check_rcpt
#####################################################
#####################################################
### acl/40_exim4-config_check_data
#####################################################

### acl/40_exim4-config_check_data
#################################

# This ACL is used after the contents of a message
have been received. This
# is the ACL in which you can test a message's headers
or body, and in
# particular, this is where you can invoke external
virus or spam scanners.

acl_check_data:

  # Deny unless the address list headers are
syntactically correct.
  #
  # If you enable this, you might reject legitimate
mail.
  .ifdef CHECK_DATA_VERIFY_HEADER_SYNTAX
  deny
    message = Message headers fail syntax check
    !acl = acl_whitelist_local_deny
    !verify = header_syntax
  .endif



  # require that there is a verifiable sender address
in at least
  # one of the "Sender:", "Reply-To:", or "From:"
header lines.
  .ifdef CHECK_DATA_VERIFY_HEADER_SENDER
  deny
    message = No verifiable sender address in message
headers
    !acl = acl_whitelist_local_deny
    !verify = header_sender
  .endif



# Deny if the message contains malware. Before
enabling this check, you
# must install a virus scanner and set the
av_scanner option in the
# main configuration.
#
# exim4-daemon-heavy must be used for this section
to work.
#
# deny
# malware = *
# message = This message was detected as possible
malware ($malware_name).


  # Add headers to a message if it is judged to be
spam. Before enabling this,
  # you must install SpamAssassin. You also need to
set the spamd_address
  # option in the main configuration.
  #
  # exim4-daemon-heavy must be used for this section
to work.
  #
  # Please note that this is only suiteable as an
example. There are
  # multiple issues with this configuration method.
For example, if you go
  # this way, you'll give your spamassassin daemon
write access to the
  # entire exim spool which might be a security issue
in case of a
  # spamassassin exploit.
  #
  # See the exim docs and the exim wiki for more
suitable examples.
  #
  # warn
  #   spam = Debian-exim:true
  #   message = X-Spam_score: $spam_score\n\
  #             X-Spam_score_int: $spam_score_int\n\
  #             X-Spam_bar: $spam_bar\n\
  #             X-Spam_report: $spam_report



# This hook allows you to hook in your own ACLs
without having to
# modify this file. If you do it like we suggest,
you'll end up with
# a small performance penalty since there is an
additional file being
# accessed. This doesn't happen if you leave the
macro unset.
.ifdef CHECK_DATA_LOCAL_ACL_FILE
.include CHECK_DATA_LOCAL_ACL_FILE
.endif


# accept otherwise
accept
#####################################################
### end acl/40_exim4-config_check_data
#####################################################
#####################################################
### router/00_exim4-config_header
#####################################################

######################################################################
#                      ROUTERS CONFIGURATION          
              #
#               Specifies how addresses are handled   
              #
######################################################################
#     THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS
IMPORTANT!       #
# An address is passed to each router in turn until it
is accepted.  #
######################################################################


begin routers

#####################################################
### end router/00_exim4-config_header
#####################################################
#####################################################
### router/100_exim4-config_domain_literal
#####################################################

### router/100_exim4-config_domain_literal
#################################

# This router handles e-mail addresses in "domain
literal" form like
# <user@???>. The RFCs require this
facility, but it is disabled
# in the default config since it is seldomly used and
frequently abused.
# Domain literal support also needs to be enabled in
the main config,
# which is automatically done if you use the enable
macro
# MAIN_ALLOW_DOMAIN_LITERALS.

.ifdef MAIN_ALLOW_DOMAIN_LITERALS
domain_literal:
debug_print = "R: domain_literal for
$local_part@$domain"
driver = ipliteral
domains = ! +local_domains
transport = remote_smtp
.endif
#####################################################
### end router/100_exim4-config_domain_literal
#####################################################
#####################################################
### router/150_exim4-config_hubbed_hosts
#####################################################

# router/150_exim4-config_hubbed_hosts
#################################

# route specific domains manually.
#
# see exim4-config_files(5) and spec.txt chapter 20.3
through 20.7 for
# more detailed documentation.

hubbed_hosts:
debug_print = "R: hubbed_hosts for $domain"
driver = manualroute
domains = "${if exists{CONFDIR/hubbed_hosts}\

{partial-lsearch;CONFDIR/hubbed_hosts}\
              fail}"
  same_domain_copy_routing = yes
  route_data =
${lookup{$domain}partial-lsearch{CONFDIR/hubbed_hosts}}
  transport = remote_smtp
#####################################################
### end router/150_exim4-config_hubbed_hosts
#####################################################
#####################################################
### router/200_exim4-config_primary
#####################################################


### router/200_exim4-config_primary
#################################
# This file holds the primary router, responsible for
nonlocal mails

.ifdef DCconfig_internet
# configtype=internet
#
# deliver mail to the recipient if recipient domain is
a domain we
# relay for. We do not ignore any target hosts here
since delivering to
# a site local or even a link local address might be
wanted here, and if
# such an address has found its way into the MX record
of such a domain,
# the local admin is probably in a place where that
broken MX record
# could be fixed.

dnslookup_relay_to_domains:
debug_print = "R: dnslookup_relay_to_domains for
$local_part@$domain"
driver = dnslookup
domains = ! +local_domains : +relay_to_domains
transport = remote_smtp
same_domain_copy_routing = yes
no_more

# deliver mail directly to the recipient. This router
is only reached
# for domains that we do not relay for. Since we most
probably can't
# have broken MX records pointing to site local or
link local IP
# addresses fixed, we ignore target hosts pointing to
these addresses.

dnslookup:
  debug_print = "R: dnslookup for $local_part@$domain"
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  same_domain_copy_routing = yes
  # ignore private rfc1918 and APIPA addresses
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 :
192.168.0.0/16 :\
                        172.16.0.0/12 : 10.0.0.0/8 :
169.254.0.0/16 :\
            255.255.255.255
  no_more


.endif


.ifdef DCconfig_local
# configtype=local
#
# Stand-alone system, so generate an error for mail to
a non-local domain
nonlocal:
debug_print = "R: nonlocal for $local_part@$domain"
driver = domainlist
domains = ! +local_domains
allow_fail
data = :fail: Mailing to remote domains not
supported
no_more

.endif


.ifdef DCconfig_smarthost DCconfig_satellite
# configtype=smarthost or configtype=satellite
#
# Send all non-local mail to a single other machine
(smarthost).
#
# This means _ALL_ non-local mail goes to the
smarthost. This will most
# probably not do what you want for domains that are
listed in
# relay_domains. The most typical use for
relay_domains is to control
# relaying for incoming e-mail on secondary MX hosts.
In that case,
# it doesn't make sense to send the mail to the
smarthost since the
# smarthost will probably send the message right back
here, causing a
# loop.
#
# If you want to use a smarthost while being secondary
MX for some
# domains, you'll need to copy the
dnslookup_relay_to_domains router
# here so that mail to relay_domains is handled
separately.

smarthost:
debug_print = "R: smarthost for $local_part@$domain"
driver = manualroute
domains = ! +local_domains
transport = remote_smtp_smarthost
route_list = * mail.mango.zw byname
host_find_failed = defer
same_domain_copy_routing = yes
hosts_randomize
no_more

.endif


# The "no_more" above means that all later routers are
for
# domains in the local_domains list, i.e. just like
Exim 3 directors.
#####################################################
### end router/200_exim4-config_primary
#####################################################
#####################################################
### router/300_exim4-config_real_local
#####################################################

### router/300_exim4-config_real_local
#################################

# This router allows reaching a local user while
avoiding local
# processing. This can be used to inform a user of a
broken .forward
# file, for example. The userforward router does this.

real_local:
debug_print = "R: real_local for
$local_part@$domain"
driver = accept
domains = +local_domains
local_part_prefix = real-
check_local_user
transport = LOCAL_DELIVERY

#####################################################
### end router/300_exim4-config_real_local
#####################################################
#####################################################
### router/400_exim4-config_system_aliases
#####################################################

### router/400_exim4-config_system_aliases
#################################

# This router handles aliasing using a traditional
/etc/aliases file.
#
##### NB You must ensure that /etc/aliases exists. It
used to be the case
##### NB that every Unix had that file, because it
was the Sendmail default.
##### NB These days, there are systems that don't
have it. Your aliases
##### NB file should at least contain an alias for
"postmaster".
#
# This router handles the local part in a
case-insensitive way which
# satisfies the RFCs requirement that postmaster be
reachable regardless
# of case. If you decide to handle /etc/aliases in a
caseful way, you
# need to make arrangements for a caseless postmaster.
#
# Delivery to arbitrary directories, files, and piping
to programs in
# /etc/aliases is disabled per default.
# If that is a problem for you, see
# /usr/share/doc/exim4-base/README.Debian.gz
# for explanation and some workarounds.

system_aliases:
debug_print = "R: system_aliases for
$local_part@$domain"
driver = redirect
domains = +local_domains
allow_fail
allow_defer
data = ${lookup{$local_part}lsearch{/etc/aliases}}
.ifdef SYSTEM_ALIASES_USER
user = SYSTEM_ALIASES_USER
.endif
.ifdef SYSTEM_ALIASES_GROUP
group = SYSTEM_ALIASES_GROUP
.endif
.ifdef SYSTEM_ALIASES_FILE_TRANSPORT
file_transport = SYSTEM_ALIASES_FILE_TRANSPORT
.endif
.ifdef SYSTEM_ALIASES_PIPE_TRANSPORT
pipe_transport = SYSTEM_ALIASES_PIPE_TRANSPORT
.endif
.ifdef SYSTEM_ALIASES_DIRECTORY_TRANSPORT
directory_transport =
SYSTEM_ALIASES_DIRECTORY_TRANSPORT
.endif
#####################################################
### end router/400_exim4-config_system_aliases
#####################################################
#####################################################
### router/500_exim4-config_hubuser
#####################################################

### router/500_exim4-config_hubuser
#################################

.ifdef DCconfig_satellite
# This router is only used for configtype=satellite.
# It takes care to route all mail targetted to
<somelocaluser@???>
# to the host where we read our mail
#
hub_user:
debug_print = "R: hub_user for $local_part@$domain"
driver = redirect
domains = +local_domains
data = ${local_part}@DCreadhost
check_local_user

# Grab the redirected mail and deliver it.
# This is a duplicate of the smarthost router, needed
because
# DCreadhost might end up as part of +local_domains
hub_user_smarthost:
debug_print = "R: hub_user_smarthost for
$local_part@$domain"
driver = manualroute
domains = DCreadhost
transport = remote_smtp_smarthost
route_list = * DCsmarthost byname
host_find_failed = defer
same_domain_copy_routing = yes
check_local_user
.endif


#####################################################
### end router/500_exim4-config_hubuser
#####################################################
#####################################################
### router/600_exim4-config_userforward
#####################################################

### router/600_exim4-config_userforward
#################################

# This router handles forwarding using traditional
.forward files in users'
# home directories. It also allows mail filtering with
a forward file
# starting with the string "# Exim filter" or "# Sieve
filter".
#
# The no_verify setting means that this router is
skipped when Exim is
# verifying addresses. Similarly, no_expn means that
this router is skipped if
# Exim is processing an EXPN command.
#
# The check_ancestor option means that if the forward
file generates an
# address that is an ancestor of the current one, the
current one gets
# passed on instead. This covers the case where A is
aliased to B and B
# has a .forward file pointing to A.
#
# The four transports specified at the end are those
that are used when
# forwarding generates a direct delivery to a
directory, or a file, or to a
# pipe, or sets up an auto-reply, respectively.
#
userforward:
  debug_print = "R: userforward for
$local_part@$domain"
  driver = redirect
  domains = +local_domains
  check_local_user
  file = $home/.forward
  require_files = $local_part:$home/.forward
  no_verify
  no_expn
  check_ancestor
  allow_filter
# forbid_smtp_code = true
  directory_transport = address_directory
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply
  skip_syntax_errors
  syntax_errors_to = real-$local_part@$domain
  syntax_errors_text = \
    This is an automatically generated message. An
error has\n\
    been found in your .forward file. Details of the
error are\n\
    reported below. While this error persists, you
will receive\n\
    a copy of this message for every message that is
addressed\n\
    to you. If your .forward file is a filter file, or
if it is\n\
    a non-filter file containing no valid forwarding
addresses,\n\
    a copy of each incoming message will be put in
your normal\n\
    mailbox. If a non-filter file contains at least
one valid\n\
    forwarding address, forwarding to the valid
addresses will\n\
    happen, and those will be the only deliveries that
occur.


#####################################################
### end router/600_exim4-config_userforward
#####################################################
#####################################################
### router/700_exim4-config_procmail
#####################################################

procmail:
  debug_print = "R: procmail for $local_part@$domain"
  driver = accept
  domains = +local_domains
  check_local_user
  transport = procmail_pipe
  # emulate OR with "if exists"-expansion
  require_files = ${local_part}:\
                  ${if exists{/etc/procmailrc}\


{/etc/procmailrc}{${home}/.procmailrc}}:\
                  +/usr/bin/procmail
  no_verify
  no_expn


#####################################################
### end router/700_exim4-config_procmail
#####################################################
#####################################################
### router/800_exim4-config_maildrop
#####################################################

### router/800_exim4-config_maildrop
#################################

maildrop:
debug_print = "R: maildrop for $local_part@$domain"
driver = accept
domains = +local_domains
check_local_user
transport = maildrop_pipe
require_files =
${local_part}:${home}/.mailfilter:+/usr/bin/maildrop
no_verify
no_expn

#####################################################
### end router/800_exim4-config_maildrop
#####################################################
#####################################################
### router/900_exim4-config_local_user
#####################################################

### router/900_exim4-config_local_user
#################################

# This router matches local user mailboxes. If the
router fails, the error
# message is "Unknown user".

local_user:
debug_print = "R: local_user for
$local_part@$domain"
driver = accept
domains = +local_domains
check_local_user
local_parts = ! root
transport = LOCAL_DELIVERY
cannot_route_message = Unknown user
#####################################################
### end router/900_exim4-config_local_user
#####################################################
#####################################################
### router/mmm_mail4root
#####################################################

### router/mmm_mail4root
#################################
# deliver mail addressed to root to /var/mail/mail as
user mail:mail
# if it was not redirected in /etc/aliases or by other
means
# Exim cannot deliver as root since 4.24
(FIXED_NEVER_USERS)

mail4root:
debug_print = "R: mail4root for $local_part@$domain"
driver = redirect
domains = +local_domains
data = /var/mail/mail
file_transport = address_file
local_parts = root
user = mail
group = mail

#####################################################
### end router/mmm_mail4root
#####################################################
#####################################################
### transport/00_exim4-config_header
#####################################################

######################################################################
#                      TRANSPORTS CONFIGURATION       
              #
######################################################################
#                       ORDER DOES NOT MATTER         
              #
#     Only one appropriate transport is called for
each delivery.    #
######################################################################


# A transport is used only when referenced from a
router that successfully
# handles an address.

begin transports
# SpamAssassin
spamcheck:
    driver = pipe
    command = /usr/local/bin/exim4 -oMr spam-scanned
-bS
    use_bsmtp = true
    transport_filter = /usr/bin/spamc
    home_directory = "/tmp"
    current_directory = "/tmp"
    # must use a privileged user to set
$received_protocol on the way back in!
    user = mail
    group = mail
    log_output = true
    return_fail_output = true
    return_path_add = false
    message_prefix =
    message_suffix =
#no_verify
#check_local_user


# SpamAssassin
#spamcheck_router:
# When to scan a message :
# - it isn't already flagged as spam
# - it isn't already scanned
#driver = pipe
#transport = spamcheck
#no_verify
#check_local_user
#condition = "${if and { {!def:h_X-Spam-Flag:} {!eq
{$received_protocol}{spam-scanned}}} {1}{0}}"
        
#####################################################
### end transport/00_exim4-config_header
#####################################################
#####################################################
### transport/30_exim4-config_address_file
#####################################################

# This transport is used for handling deliveries
directly to files that are
# generated by aliasing or forwarding.
#
address_file:
debug_print = "T: address_file for
$local_part@$domain"
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add

#####################################################
### end transport/30_exim4-config_address_file
#####################################################
#####################################################
### transport/30_exim4-config_address_pipe
#####################################################

# This transport is used for handling pipe deliveries
generated by
# .forward files. If the commands fails and produces
any output on standard
# output or standard error streams, the output is
returned to the sender
# of the message as a delivery error.
address_pipe:
debug_print = "T: address_pipe for
$local_part@$domain"
driver = pipe
return_fail_output

#####################################################
### end transport/30_exim4-config_address_pipe
#####################################################
#####################################################
### transport/30_exim4-config_address_reply
#####################################################

# This transport is used for handling autoreplies
generated by the filtering
# option of the userforward router.
#
address_reply:
debug_print = "T: autoreply for $local_part@$domain"
driver = autoreply

#####################################################
### end transport/30_exim4-config_address_reply
#####################################################
#####################################################
### transport/30_exim4-config_mail_spool
#####################################################

### transport/30_exim4-config_mail_spool

# This transport is used for local delivery to user
mailboxes in traditional
# BSD mailbox format.
#
mail_spool:
debug_print = "T: appendfile for
$local_part@$domain"
driver = appendfile
file = /var/mail/$local_part
delivery_date_add
envelope_to_add
return_path_add
group = mail
mode = 0660
mode_fail_narrower = false

#####################################################
### end transport/30_exim4-config_mail_spool
#####################################################
#####################################################
### transport/30_exim4-config_maildir_home
#####################################################

### transport/30_exim4-config_maildir_home
#################################

# Use this instead of mail_spool if you want to to
deliver to Maildir in
# home-directory - change the definition of
LOCAL_DELIVERY
#
maildir_home:
debug_print = "T: maildir_home for
$local_part@$domain"
driver = appendfile
.ifdef MAILDIR_HOME_MAILDIR_LOCATION
directory = MAILDIR_HOME_MAILDIR_LOCATION
.else
directory = $home/Maildir
.endif
.ifdef MAILDIR_HOME_CREATE_DIRECTORY
create_directory
.endif
.ifdef MAILDIR_HOME_CREATE_FILE
create_file = MAILDIR_HOME_CREATE_FILE
.endif
delivery_date_add
envelope_to_add
return_path_add
maildir_format
.ifdef MAILDIR_HOME_DIRECTORY_MODE
directory_mode = MAILDIR_HOME_DIRECTORY_MODE
.else
directory_mode = 0700
.endif
.ifdef MAILDIR_HOME_MODE
mode = MAILDIR_HOME_MODE
.else
mode = 0600
.endif
mode_fail_narrower = false
# This transport always chdirs to $home before
trying to deliver. If
# $home is not accessible, this chdir fails and
prevents delivery.
# If you are in a setup where home directories might
not be
# accessible, uncomment the current_directory line
below.
# current_directory = /
#####################################################
### end transport/30_exim4-config_maildir_home
#####################################################
#####################################################
### transport/30_exim4-config_maildrop_pipe
#####################################################

maildrop_pipe:
debug_print = "T: maildrop_pipe for
$local_part@$domain"
driver = pipe
path = "/bin:/usr/bin:/usr/local/bin"
command = "/usr/bin/maildrop"
return_path_add
delivery_date_add
envelope_to_add

#####################################################
### end transport/30_exim4-config_maildrop_pipe
#####################################################
#####################################################
### transport/30_exim4-config_procmail_pipe
#####################################################

procmail_pipe:
debug_print = "T: procmail_pipe for
$local_part@$domain"
driver = pipe
path = "/bin:/usr/bin:/usr/local/bin"
command = "/usr/bin/procmail"
return_path_add
delivery_date_add
envelope_to_add

#####################################################
### end transport/30_exim4-config_procmail_pipe
#####################################################
#####################################################
### transport/30_exim4-config_remote_smtp
#####################################################

### transport/30_exim4-config_remote_smtp
#################################
# This transport is used for delivering messages over
SMTP connections.
remote_smtp:
debug_print = "T: remote_smtp for
$local_part@$domain"
driver = smtp
# to disable TLS on outgoing connections, uncomment
this
# hosts_avoid_tls = *
#####################################################
### end transport/30_exim4-config_remote_smtp
#####################################################
#####################################################
### transport/30_exim4-config_remote_smtp_smarthost
#####################################################

### transport/30_exim4-config_remote_smtp_smarthost
#################################

# This transport is used for delivering messages over
SMTP connections
# to a smarthost. The local host tries to authenticate
and does some
# modification in headers and return-path.
# This transport is used for smarthost and satellite
configurations.

remote_smtp_smarthost:
debug_print = "T: remote_smtp_smarthost for
$local_part@$domain"
driver = smtp
hosts_try_auth = ${if exists
{CONFDIR/passwd.client}\

{${extract{1}{:}{DCsmarthost}}}\
                   {}\
            }
  tls_tempfail_tryclear = false
  # to disable TLS on outgoing connections, uncomment
this
  # hosts_avoid_tls = *
  DEBCONFheaders_rewriteDEBCONF
  DEBCONFreturn_pathDEBCONF
#####################################################
### end
transport/30_exim4-config_remote_smtp_smarthost
#####################################################
#####################################################
### transport/35_exim4-config_address_directory
#####################################################
# This transport is used for handling file addresses
generated by alias
# or .forward files if the path ends in "/", which
causes it to be treated
# as a directory name rather than a file name.


address_directory:
debug_print = "T: address_directory for
$local_part@$domain"
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add
check_string = ""
escape_string = ""
maildir_format

#####################################################
### end transport/35_exim4-config_address_directory
#####################################################
#####################################################
### retry/00_exim4-config_header
#####################################################

######################################################################
#                      RETRY CONFIGURATION            
              #
######################################################################


begin retry

#####################################################
### end retry/00_exim4-config_header
#####################################################
#####################################################
### retry/30_exim4-config
#####################################################

### retry/30_exim4-config
#################################

# This single retry rule applies to all domains and
all errors. It specifies
# retries every 15 minutes for 2 hours, then
increasing retry intervals,
# starting at 1 hour and increasing each time by a
factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have
passed since the first
# failed delivery.

# Please note that these rules only limit the
frequenzy of retries, the
# effective retry-time depends on the frequenzy of
queue-running, too.
# See QUEUEINTERVAL in /etc/default/exim4.

# Address or Domain    Error       Retries
# -----------------    -----       -------


*                      *           F,2h,15m;
G,16h,1h,1.5; F,4d,6h


#####################################################
### end retry/30_exim4-config
#####################################################
#####################################################
### rewrite/00_exim4-config_header
#####################################################

######################################################################
#                      REWRITE CONFIGURATION          
              #
######################################################################


begin rewrite

#####################################################
### end rewrite/00_exim4-config_header
#####################################################
#####################################################
### rewrite/31_exim4-config_rewriting
#####################################################

### rewrite/31_exim4-config_rewriting
#################################

# This rewriting rule is particularily useful for
dialup users who
# don't have their own domain, but could be useful for
anyone.
# It looks up the real address of all local users in a
file
*@+local_domains
"${lookup{${local_part}}lsearch{/etc/email-addresses}\
                   {$value}fail}" Ffrs
# identical rewriting rule for /etc/mailname
DEBCONFrewriteemailaddresses_mailnameDEBCONF



#####################################################
### end rewrite/31_exim4-config_rewriting
#####################################################
#####################################################
### auth/00_exim4-config_header
#####################################################

######################################################################
#                   AUTHENTICATION CONFIGURATION      
              #
######################################################################


begin authenticators


#####################################################
### end auth/00_exim4-config_header
#####################################################
#####################################################
### auth/30_exim4-config_examples
#####################################################

### auth/30_exim4-config_examples
#################################

# The examples below are for server side
authentication, when the
# local exim is SMTP server and clients authenticate
to the local exim.

# They allow two styles of plain-text authentication
against an
# CONFDIR/passwd file whose syntax is described in
exim_passwd(5).

# Hosts that are allowed to use AUTH are defined by
the
# auth_advertise_hosts option in the main
configuration. The default is
# "*", which allows authentication to all hosts over
all kinds of
# connections if there is at least one authenticator
defined here.
# Authenticators which rely on unencrypted clear text
passwords don't
# advertise on unencrypted connections by default.
Thus, it might be
# wise to set up TLS to allow encrypted connections.
If TLS cannot be
# used for some reason, you can set
AUTH_SERVER_ALLOW_NOTLS_PASSWORDS to
# advertise unencrypted clear text password based
authenticators on all
# connections. As this is severely reducing security,
using TLS is
# preferred over allowing clear text password based
authenticators on
# unencrypted connections.

# PLAIN authentication has no server prompts. The
client sends its
# credentials in one lump, containing an authorization
ID (which we do not
# use), an authentication ID, and a password. The
latter two appear as
# $auth2 and $auth3 in the configuration and should be
checked against a
# valid username and password. In a real configuration
you would typically
# use $auth2 as a lookup key, and compare $auth3
against the result of the
# lookup, perhaps using the crypteq{}{} condition.

# plain_server:
# driver = plaintext
# public_name = PLAIN
# server_condition = "${if
crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
# server_set_id = $auth2
# server_prompts = :
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
# .endif

# LOGIN authentication has traditional prompts and
responses. There is no
# authorization ID in this mechanism, so unlike PLAIN
the username and
# password are $auth1 and $auth2. Apart from that you
can use the same
# server_condition setting for both authenticators.

# login_server:
# driver = plaintext
# public_name = LOGIN
# server_prompts = "Username:: : Password::"
# server_condition = "${if
crypteq{$auth2}{${extract{1}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
# server_set_id = $auth1
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
# .endif
#
# cram_md5_server:
# driver = cram_md5
# public_name = CRAM-MD5
# server_secret =
${extract{2}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}fail}}}
# server_set_id = $auth1

# Here is an example of CRAM-MD5 authentication
against PostgreSQL:
#
# psqldb_auth_server:
# driver = cram_md5
# public_name = CRAM-MD5
# server_secret = ${lookup pgsql{SELECT pw FROM
users WHERE username =
'${quote_pgsql:$auth1}'}{$value}fail}
# server_set_id = $auth1

# Authenticate against local passwords using sasl2-bin
# Requires exim_uid to be a member of sasl group, see
README.Debian.gz
# plain_saslauthd_server:
# driver = plaintext
# public_name = PLAIN
# server_condition = ${if
saslauthd{{$auth2}{$auth3}}{1}{0}}
# server_set_id = $auth2
# server_prompts = :
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
# .endif
#
# login_saslauthd_server:
# driver = plaintext
# public_name = LOGIN
# server_prompts = "Username:: : Password::"
# # don't send system passwords over unencrypted
connections
# server_condition = ${if
saslauthd{{$auth1}{$auth2}}{1}{0}}
# server_set_id = $auth1
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
# .endif
#
# ntlm_sasl_server:
# driver = cyrus_sasl
# public_name = NTLM
# server_realm = <short main hostname>
# server_set_id = $auth1
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
# .endif
#
# digest_md5_sasl_server:
# driver = cyrus_sasl
# public_name = DIGEST-MD5
# server_realm = <short main hostname>
# server_set_id = $auth1
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
# .endif

# Authentcate against cyrus-sasl
# This is mainly untested, please report any problems
to
# pkg-exim4-users@???.
# cram_md5_sasl_server:
# driver = cyrus_sasl
# public_name = CRAM-MD5
# server_realm = <short main hostname>
# server_set_id = $auth1
#
# plain_sasl_server:
# driver = cyrus_sasl
# public_name = PLAIN
# server_realm = <short main hostname>
# server_set_id = $auth1
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
# .endif
#
# login_sasl_server:
# driver = cyrus_sasl
# public_name = LOGIN
# server_realm = <short main hostname>
# server_set_id = $auth1
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
# .endif

# Authenticate against courier authdaemon

# This is now the (working!) example from
#
http://www.exim.org/eximwiki/FAQ/Policy_controls/Q0730
# Possible pitfall: access rights on
/var/run/courier/authdaemon/socket.
# plain_courier_authdaemon:
#   driver = plaintext
#   public_name = PLAIN
#   server_condition = \
#     ${extract {ADDRESS} \
#              
{${readsocket{/var/run/courier/authdaemon/socket} \
#               {AUTH
${strlen:exim\nlogin\n$auth2\n$auth3\n}\nexim\nlogin\n$auth2\n$auth3\n}
}} \
#               {yes} \
#               fail}
#   server_set_id = $auth2
#   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
#   server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
#   .endif


# login_courier_authdaemon:
#   driver = plaintext
#   public_name = LOGIN
#   server_prompts = Username:: : Password::
#   server_condition = \
#     ${extract {ADDRESS} \
#              
{${readsocket{/var/run/courier/authdaemon/socket} \
#               {AUTH
${strlen:exim\nlogin\n$auth1\n$auth2\n}\nexim\nlogin\n$auth1\n$auth2\n}
}} \
#               {yes} \
#               fail}
#   server_set_id = $auth1
#   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
#   server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
#   .endif


# This one is a bad hack to support the broken version
4.xx of
# Microsoft Outlook Express which violates the RFCs by
demanding
# "250-AUTH=" instead of "250-AUTH ".
# If your list of offered authenticators is other than
PLAIN and LOGIN,
# you need to adapt the public_name line manually.
# It has to be the last authenticator to work and has
not been tested
# well. Use at your own risk.
# See the thread entry point from
#
http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050214/msg00213.html
# for the related discussion on the exim-users mailing
list.
# Thanks to Fred Viles for this great work.

# support_broken_outlook_express_4_server:
# driver = plaintext
# public_name = "\r\n250-AUTH=PLAIN LOGIN"
# server_prompts = User Name : Password
# server_condition = no
# .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
# server_advertise_condition = ${if
eq{$tls_cipher}{}{}{*}}
# .endif

##############
# See /usr/share/doc/exim4-base/README.Debian.gz
##############

# These examples below are the equivalent for client
side authentication.
# They get the passwords from CONFDIR/passwd.client,
whose format is
# defined in exim4_passwd_client(5)

# Because AUTH PLAIN and AUTH LOGIN send the password
in clear, we
# only allow these mechanisms over encrypted
connections by default.
# You can set AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS to
allow unencrypted
# clear text password authentication on all
connections.

cram_md5:
driver = cram_md5
public_name = CRAM-MD5
client_name =
${extract{1}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
client_secret =
${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}

plain:
  driver = plaintext
  public_name = PLAIN
.ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  client_send = "${if !eq{$tls_cipher}{}{\
                     ^${extract{1}{::}\

        
{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}\
             ^${extract{2}{::}\

        
{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}\
           }fail}"
.else
  client_send = "^${extract{1}{::}\


{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}\
                 ^${extract{2}{::}\

        
{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}"
.endif

login:
  driver = plaintext
  public_name = LOGIN
.ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
  # Return empty string if not non-TLS AND looking up
$host in passwd-file
  # yields a non-empty string; fail otherwise.
  client_send = "${if and{\
                          {!eq{$tls_cipher}{}}\
                          {!eq\


{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}\
                                 {$value}fail}}\
                              {}}\
                         }\
                      {}fail}\
                 : ${extract{1}{::}\

        
{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
\
         : ${extract{2}{::}\

        
{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}"
.else
  # Return empty string if looking up $host in
passwd-file yields a
  # non-empty string; fail otherwise.
  client_send = "${if !eq\
                          {${lookup\


{$host}nwildlsearch{CONFDIR/passwd.client}\
                            {$value}fail}}\
                          {}\
                      {}fail}\
                 : ${extract{1}{::}\


{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
\
                 : ${extract{2}{::}\


{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}"
.endif
#####################################################
### end auth/30_exim4-config_examples
#####################################################




____________________________________________________________________________________
Cheap talk?
Check out Yahoo! Messenger's low PC-to-Phone call rates.
http://voice.yahoo.com