I've changed
```
domainlist local_domains = mydomain.com : mail.mydomain.com : @
domainlist relay_to_domains = *
hostlist relay_from_hosts = 127.0.0.1 : localhost
to
domainlist local_domains = mydomain.com : mail.mydomain.com : @
domainlist relay_to_domains = *.mydomain.com
hostlist relay_from_hosts = 127.0.0.1 : localhost
```
but i don't think i've seen any improvement. Below is the log after the change
Sep 26 13:50:19 RPi1B2 exim[20865]: 2019-09-26 19:20:19 exim 4.92.2 daemon started: pid=20865, -q15m, listening for SMTP on port 25 (IPv6 and IPv4) port 587 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4)
Sep 26 13:50:19 RPi1B2 exim[20868]: 2019-09-26 19:20:19 Start queue run: pid=20868
Sep 26 13:50:19 RPi1B2 sudo[20822]: pam_unix(sudo:session): session closed for user root
Sep 26 13:50:21 RPi1B2 exim[20882]: 2019-09-26 19:20:21 1iDU2w-0005NR-PJ Message is frozen
Sep 26 13:50:21 RPi1B2 exim[20883]: 2019-09-26 19:20:21 1iDU29-0005IG-LL Message is frozen
Sep 26 13:50:21 RPi1B2 exim[20884]: 2019-09-26 19:20:21 1iDU25-0005IB-PA Message is frozen
Sep 26 13:50:21 RPi1B2 exim[20885]: 2019-09-26 19:20:21 1iDU1G-00058v-AU Message is frozen
Sep 26 13:50:21 RPi1B2 exim[20886]: 2019-09-26 19:20:21 1iDU0Y-00058J-4s Message is frozen
Sep 26 13:50:21 RPi1B2 exim[20887]: 2019-09-26 19:20:21 1iDU0U-00058E-Ro Message is frozen
Sep 26 13:50:21 RPi1B2 exim[20888]: 2019-09-26 19:20:21 1iDTyf-000559-IS Message is frozen
Sep 26 13:50:23 RPi1B2 exim[20881]: 2019-09-26 19:20:23 dovecot_login authenticator failed for (User) [45.142.195.150]: 435 Unable to authenticate at present: authentication socket connection error
Sep 26 13:50:23 RPi1B2 exim[20881]: 2019-09-26 19:20:23 dovecot_login authenticator failed for (User) [45.142.195.150]: 435 Unable to authenticate at present: authentication socket connection error
Sep 26 13:50:26 RPi1B2 exim[20895]: 2019-09-26 19:20:26 1iCT23-0004Cd-Hg H=mx-aol.mail.gm0.yahoodns.net [67.195.204.75]: SMTP error from remote mail server after pipelined MAIL FROM:<jamesgambora3@???> SIZE=2617: 421 4.7.0 [TSS04] Messages from 175.101.146.135 temporarily deferred due to user complaints - 4.16.55.1; see https://help.yahoo.com/kb/postmaster/SLN3434.html
Sep 26 13:50:26 RPi1B2 exim[20894]: 2019-09-26 19:20:26 1iCT23-0004Cd-Hg H=mta6.am0.yahoodns.net [67.195.204.73]: SMTP error from remote mail server after pipelined MAIL FROM:<jamesgambora3@???> SIZE=2617: 421 4.7.0 [TSS04] Messages from 175.101.146.135 temporarily deferred due to user complaints - 4.16.55.1; see https://help.yahoo.com/kb/postmaster/SLN3434.html
...
...
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg == lizjensenbeach@??? R=dnslookup T=remote_smtp defer (-45) H=mx-aol.mail.gm0.yahoodns.net [98.136.96.93]: SMTP error from remote mail server after pipelined MAIL FROM:<jamesgambora3@???> SIZE=2617: 421 4.7.0 [TSS04] Messages from 175.101.146.135 temporarily deferred due to user complaints - 4.16.55.1; see https://help.yahoo.com/kb/postmaster/SLN3434.html
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0058 page 36968: illegal page type or format
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0061 PANIC: Invalid argument
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0060 PANIC: fatal region error detected; run recovery
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0060 PANIC: fatal region error detected; run recovery
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0060 PANIC: fatal region error detected; run recovery
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0060 PANIC: fatal region error detected; run recovery
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0060 PANIC: fatal region error detected; run recovery
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0060 PANIC: fatal region error detected; run recovery
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0060 PANIC: fatal region error detected; run recovery
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB1581 File handles still open at environment close
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB1582 Open file handle: /var/spool/exim/db/retry
Sep 26 13:50:36 RPi1B2 exim[20889]: 2019-09-26 19:20:36 1iCT23-0004Cd-Hg Berkeley DB error: BDB0060 PANIC: fatal region error detected; run recovery
Sep 26 13:50:42 RPi1B2 exim[20900]: 2019-09-26 19:20:42 1iCSuw-0004Ca-Mw H=mx1.mail.icloud.com [17.178.102.82]: SMTP error from remote mail server after RCPT TO:<ststewar@???>: 450 4.2.2 <ststewar@???>: user is overquota
Sep 26 13:50:43 RPi1B2 exim[20899]: 2019-09-26 19:20:43 1iCSuw-0004Ca-Mw H=gmail-smtp-in.l.google.com [172.217.194.26]: SMTP error from remote mail server after pipelined end of data: 421-4.7.0 [175.101.146.135 15] Our system has detected that this message is\n421-4.7.0 suspicious due to the very low reputation of the sending IP address.\n421-4.7.0 To protect our users from spam, mail sent from your IP address has\n421-4.7.0 been temporarily rate limited. Please visit\n421 4.7.0 https://support.google.com/mail/answer/188131 for more information. s88si2125861pjc.30 - gsmtp
Sep 26 13:50:45 RPi1B2 exim[20900]: 2019-09-26 19:20:45 1iCSuw-0004Ca-Mw H=mx1.mail.icloud.com [17.57.8.134]: SMTP error from remote mail server after RCPT TO:<ststewar@???>: 450 4.2.2 <ststewar@???>: user is overquota
Sep 26 13:50:46 RPi1B2 exim[20899]: 2019-09-26 19:20:46 1iCSuw-0004Ca-Mw H=alt1.gmail-smtp-in.l.google.com [173.194.202.27]: SMTP error from remote mail server after pipelined end of data: 421-4.7.0 [175.101.146.135 15] Our system has detected that this message is\n421-4.7.0 suspicious due to the very low reputation of the sending IP address.\n421-4.7.0 To protect our users from spam, mail sent from your IP address has\n421-4.7.0 been temporarily rate limited. Please visit\n421 4.7.0 https://support.google.com/mail/answer/188131 for more information. 11si2264823pfn.70 - gsmtp
... Necktwi
> On 25-Sep-2019, at 8:42 PM, Graeme Fowler via Exim-users <exim-users@???> wrote:
>
> On 25 Sep 2019, at 15:43, necktwi via Exim-users <exim-users@???> wrote:
>> How to run recovery? I tried rm -rf /var/spool/exim/db/* and started the exim
>
> That’s one perfectly valid way, although there are others specific to the Berkeley DB tools you have installed (or can install).
>
> However:
>
>> These messages are being flooded every second! How did info@??? pipeline mail to yahoo from my server? I didn't send any mail to any gmail user and how come my exim server is pipelining a request to gmail server every second?
>
> You need to look at your logs in more detail, for the lines containing ‘ <= ‘. That’ll show from where the messages are arriving.
>
> It’s almost certainly going to be one of the following in decreasing order of likelihood but increasing seriousness:
>
> 1. Compromised account using SMTP Auth
> 2. Compromised account using webmail
> 3. Configuration allowing open relay
> 4. Configuration allowing relay from a box which has been compromised
> 5. Compromised account running arbitrary code on your box
>
> Graeme
> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/
