My guess was wrong.
But I found that it happens with one specific email. Here is the link to
file in .eml for analysis.
https://mega.nz/#!so0jgZIT!CZCQoGc-EPSpQo0z1WjGzfalI6KN7SWnY-5d-wPt-eg
Max Kostikov via Exim-users писал 2017-12-28 14:26:
> According to quick analysis, it happens somewhere in this section of
> Exim config which comes directly after DMARC checks
>
> warn !verify = header_syntax
> !hosts = +relay_from_hosts
> ...
>
> I'll try to isolate this rule to see what happens.
--
With best regards,
Max Kostikov
BBM: 24CA5DF8 | W:
https://kostikov.co
