---
MACRO:
default: ''
description: This is a Macro definition. Their use is described in section 6.4.
name: MACRO
type: MACRO
accept_8bitmime:
default: 'true'
description: "\n\n\nThis option causes Exim to send 8BITMIME in its response to an SMTP\nEHLO command, and to accept the BODY= parameter on MAIL commands.\nHowever, though Exim is 8-bit clean, it is not a protocol converter, and it\ntakes no steps to do anything special with messages received by this route.\n
\n\nHistorically Exim kept this option off by default, but the maintainers\nfeel that in today\xE2\x80\x99s Internet, this causes more problems than it solves.\nIt now defaults to true.\nA more detailed analysis of the issues is provided by Dan Bernstein:\n
\n"
name: accept_8bitmime
type: boolean
acl_not_smtp:
cpanel_default: acl_not_smtp
default: unset
description: "\n\n\nThis option defines the ACL that is run when a non-SMTP message has been\nread and is on the point of being accepted. See chapter 42 for\nfurther details.\n
"
name: acl_not_smtp
type: string
acl_not_smtp_mime:
cpanel_default: acl_not_smtp_mime
default: unset
description: "\nThis option defines the ACL that is run for individual MIME parts of non-SMTP\nmessages. It operates in exactly the same way as acl_smtp_mime operates for\nSMTP messages.\n
"
name: acl_not_smtp_mime
type: string
acl_not_smtp_start:
default: unset
description: "\n\n\nThis option defines the ACL that is run before Exim starts reading a\nnon-SMTP message. See chapter 42 for further details.\n
"
name: acl_not_smtp_start
type: string
acl_smtp_auth:
default: unset
description: "\n\n\nThis option defines the ACL that is run when an SMTP AUTH command is\nreceived. See chapter 42 for further details.\n
"
name: acl_smtp_auth
type: string
acl_smtp_connect:
cpanel_default: acl_smtp_connect
default: unset
description: "\n\nThis option defines the ACL that is run when an SMTP connection is received.\nSee chapter 42 for further details.\n
"
name: acl_smtp_connect
type: string
acl_smtp_data:
cpanel_default: acl_smtp_data
default: unset
description: "\n\nThis option defines the ACL that is run after an SMTP DATA command has been\nprocessed and the message itself has been received, but before the final\nacknowledgment is sent. See chapter 42 for further details.\n
"
name: acl_smtp_data
type: string
acl_smtp_dkim:
cpanel_default: acl_smtp_dkim
acl_smtp_etrn:
default: unset
description: "\n\nThis option defines the ACL that is run when an SMTP ETRN command is\nreceived. See chapter 42 for further details.\n
"
name: acl_smtp_etrn
type: string
acl_smtp_expn:
default: unset
description: "\n\nThis option defines the ACL that is run when an SMTP EXPN command is\nreceived. See chapter 42 for further details.\n
"
name: acl_smtp_expn
type: string
acl_smtp_helo:
cpanel_default: acl_smtp_helo
default: unset
description: "\n\n\nThis option defines the ACL that is run when an SMTP EHLO or HELO\ncommand is received. See chapter 42 for further details.\n
"
name: acl_smtp_helo
type: string
acl_smtp_mail:
cpanel_default: acl_smtp_mail
default: unset
description: "\n\nThis option defines the ACL that is run when an SMTP MAIL command is\nreceived. See chapter 42 for further details.\n
"
name: acl_smtp_mail
type: string
acl_smtp_mailauth:
default: unset
description: "\n\nThis option defines the ACL that is run when there is an AUTH parameter on\na MAIL command. See chapter 42 for details of ACLs, and chapter\n33 for details of authentication.\n
"
name: acl_smtp_mailauth
type: string
acl_smtp_mime:
cpanel_default: acl_smtp_mime
default: unset
description: "\n\nThis option is available when Exim is built with the content-scanning\nextension. It defines the ACL that is run for each MIME part in a message. See\nsection 43.4 for details.\n
"
name: acl_smtp_mime
type: string
acl_smtp_notquit:
cpanel_default: acl_smtp_notquit
acl_smtp_predata:
default: unset
description: "\nThis option defines the ACL that is run when an SMTP DATA command is\nreceived, before the message itself is received. See chapter 42 for\nfurther details.\n
"
name: acl_smtp_predata
type: string
acl_smtp_quit:
cpanel_default: acl_smtp_quit
default: unset
description: "\n\nThis option defines the ACL that is run when an SMTP QUIT command is\nreceived. See chapter 42 for further details.\n
"
name: acl_smtp_quit
type: string
acl_smtp_rcpt:
cpanel_default: acl_smtp_rcpt
default: unset
description: "\n\nThis option defines the ACL that is run when an SMTP RCPT command is\nreceived. See chapter 42 for further details.\n
"
name: acl_smtp_rcpt
type: string
acl_smtp_starttls:
default: unset
description: "\n\nThis option defines the ACL that is run when an SMTP STARTTLS command is\nreceived. See chapter 42 for further details.\n
"
name: acl_smtp_starttls
type: string
acl_smtp_vrfy:
default: unset
description: "\n\nThis option defines the ACL that is run when an SMTP VRFY command is\nreceived. See chapter 42 for further details.\n
"
name: acl_smtp_vrfy
type: string
add_environment:
cpanel_default: PATH=/usr/local/sbin::/usr/local/bin::/sbin::/bin::/usr/sbin::/usr/bin::/sbin::/bin
default: empty
description: "\n\n\nThis option allows to set individual environment variables that the\ncurrently linked libraries and programs in child processes use. The\ndefault list is empty,\n
"
name: add_environment
type: stringlist
addresslist:
default: ''
description: This is a Named list definition. Their use is described in section 10.5.
name: addresslist
type: addresslist
addresslist secondarymx:
cpanel_default: "*@partial-lsearch;/etc/secondarymx"
admin_groups:
default: unset
description: "\n\nThis option is expanded just once, at the start of Exim\xE2\x80\x99s processing. If the\ncurrent group or any of the supplementary groups of an Exim caller is in this\ncolon-separated list, the caller has admin privileges. If all your system\nprogrammers are in a specific group, for example, you can give them all Exim\nadmin privileges by putting that group in admin_groups. However, this does\nnot permit them to read Exim\xE2\x80\x99s spool files (whose group owner is the Exim gid).\nTo permit this, you have to add individuals to the Exim group.\n
"
name: admin_groups
type: stringlist
allow_domain_literals:
default: 'false'
description: "\n\nIf this option is set, the RFC 2822 domain literal format is permitted in\nemail addresses. The option is not set by default, because the domain literal\nformat is not normally required these days, and few people know about it. It\nhas, however, been exploited by mail abusers.\n
\n\nUnfortunately, it seems that some DNS black list maintainers are using this\nformat to report black listing to postmasters. If you want to accept messages\naddressed to your hosts by IP address, you need to set\nallow_domain_literals true, and also to add @[] to the list of local\ndomains (defined in the named domain list local_domains in the default\nconfiguration). This \xE2\x80\x9Cmagic string\xE2\x80\x9D matches the domain literal form of all\nthe local host\xE2\x80\x99s IP addresses.\n
"
name: allow_domain_literals
type: boolean
allow_mx_to_ip:
default: 'false'
description: "\n\nIt appears that more and more DNS zone administrators are breaking the rules\nand putting domain names that look like IP addresses on the right hand side of\nMX records. Exim follows the rules and rejects this, giving an error message\nthat explains the mis-configuration. However, some other MTAs support this\npractice, so to avoid \xE2\x80\x9CWhy can\xE2\x80\x99t Exim do this?\xE2\x80\x9D complaints,\nallow_mx_to_ip exists, in order to enable this heinous activity. It is not\nrecommended, except when you have no other choice.\n
"
name: allow_mx_to_ip
type: boolean
allow_utf8_domains:
default: 'false'
description: "\n\n\nLots of discussion is going on about internationalized domain names. One\ncamp is strongly in favour of just using UTF-8 characters, and it seems\nthat at least two other MTAs permit this. This option allows Exim users to\nexperiment if they wish.\n
\n\nIf it is set true, Exim\xE2\x80\x99s domain parsing function allows valid\nUTF-8 multicharacters to appear in domain name components, in addition to\nletters, digits, and hyphens. However, just setting this option is not\nenough; if you want to look up these domain names in the DNS, you must also\nadjust the value of dns_check_names_pattern to match the extended form. A\nsuitable setting is:\n
\n\ndns_check_names_pattern = (?i)^(?>(?(1)\\.|())[a-z0-9\\xc0-\\xff]\\\n (?>[-a-z0-9\\x80-\\xff]*[a-z0-9\\x80-\\xbf])?)+$\n
\nAlternatively, you can just disable this feature by setting\n
\n\ndns_check_names_pattern =\n
\nThat is, set the option to an empty string so that no check is done.\n
"
name: allow_utf8_domains
type: boolean
auth_advertise_hosts:
default: "*"
description: "\n\n\nIf any server authentication mechanisms are configured, Exim advertises them in\nresponse to an EHLO command only if the calling host matches this list.\nOtherwise, Exim does not advertise AUTH.\nExim does not accept AUTH commands from clients to which it has not\nadvertised the availability of AUTH. The advertising of individual\nauthentication mechanisms can be controlled by the use of the\nserver_advertise_condition generic authenticator option on the individual\nauthenticators. See chapter 33 for further details.\n
\n\nCertain mail clients (for example, Netscape) require the user to provide a name\nand password for authentication if AUTH is advertised, even though it may\nnot be needed (the host may accept messages from hosts on its local LAN without\nauthentication, for example). The auth_advertise_hosts option can be used\nto make these clients more friendly by excluding them from the set of hosts to\nwhich Exim advertises AUTH.\n
\n\n\nIf you want to advertise the availability of AUTH only when the connection\nis encrypted using TLS, you can make use of the fact that the value of this\noption is expanded, with a setting like this:\n
\n\nauth_advertise_hosts = ${if eq{$tls_cipher}{}{}{*}}\n\n\nIf $tls_cipher is empty, the session is not encrypted, and the result of\nthe expansion is empty, thus matching no hosts. Otherwise, the result of the\nexpansion is *, which matches all hosts.\n
"
name: auth_advertise_hosts
type: hostlist
auto_thaw:
cpanel_default: 7d
default: 0s
description: "\n\n\nIf this option is set to a time greater than zero, a queue runner will try a\nnew delivery attempt on any frozen message, other than a bounce message, if\nthis much time has passed since it was frozen. This may result in the message\nbeing re-frozen if nothing has changed since the last attempt. It is a way of\nsaying \xE2\x80\x9Ckeep on trying, even though there are big problems\xE2\x80\x9D.\n
\n\nNote: This is an old option, which predates timeout_frozen_after and\nignore_bounce_errors_after. It is retained for compatibility, but it is not\nthought to be very useful any more, and its use should probably be avoided.\n
"
name: auto_thaw
type: time
av_scanner:
default: ~
description: "\nThis option is available if Exim is built with the content-scanning extension.\nIt specifies which anti-virus scanner to use. The default value is:\n
\n\nsophie:/var/run/sophie\n
\nIf the value of av_scanner starts with a dollar character, it is expanded\nbefore use. See section 43.1 for further details.\n
"
name: av_scanner
type: string
bi_command:
default: unset
description: "\n\nThis option supplies the name of a command that is run when Exim is called with\nthe -bi option (see chapter 5). The string value is\njust the command name, it is not a complete command line. If an argument is\nrequired, it must come from the -oA command line option.\n
"
name: bi_command
type: string
bounce_message_file:
default: unset
description: "\n\n\nThis option defines a template file containing paragraphs of text to be used\nfor constructing bounce messages. Details of the file\xE2\x80\x99s contents are given in\nchapter 48. See also warn_message_file.\n
"
name: bounce_message_file
type: string
bounce_message_text:
default: unset
description: "\nWhen this option is set, its contents are included in the default bounce\nmessage immediately after \xE2\x80\x9CThis message was created automatically by mail\ndelivery software.\xE2\x80\x9D It is not used if bounce_message_file is set.\n
"
name: bounce_message_text
type: string
bounce_return_body:
default: 'true'
description: "\n\nThis option controls whether the body of an incoming message is included in a\nbounce message when bounce_return_message is true. The default setting\ncauses the entire message, both header and body, to be returned (subject to the\nvalue of bounce_return_size_limit). If this option is false, only the\nmessage header is included. In the case of a non-SMTP message containing an\nerror that is detected during reception, only those header lines preceding the\npoint at which the error was detected are returned.\n\n
"
name: bounce_return_body
type: boolean
bounce_return_message:
default: 'true'
description: "\nIf this option is set false, none of the original message is included in\nbounce messages generated by Exim. See also bounce_return_size_limit and\nbounce_return_body.\n
"
name: bounce_return_message
type: boolean
bounce_return_size_limit:
default: 100K
description: "\n\n\n\nThis option sets a limit in bytes on the size of messages that are returned to\nsenders as part of bounce messages when bounce_return_message is true. The\nlimit should be less than the value of the global message_size_limit and of\nany message_size_limit settings on transports, to allow for the bounce text\nthat Exim generates. If this option is set to zero there is no limit.\n
\n\nWhen the body of any message that is to be included in a bounce message is\ngreater than the limit, it is truncated, and a comment pointing this out is\nadded at the top. The actual cutoff may be greater than the value given, owing\nto the use of buffering for transferring the message in chunks (typically 8K in\nsize). The idea is to save bandwidth on those undeliverable 15-megabyte\nmessages.\n
"
name: bounce_return_size_limit
type: integer
bounce_sender_authentication:
default: unset
description: "\n\n\n\nThis option provides an authenticated sender address that is sent with any\nbounce messages generated by Exim that are sent over an authenticated SMTP\nconnection. A typical setting might be:\n
\n\nbounce_sender_authentication = mailer-daemon@my.domain.example\n
\nwhich would cause bounce messages to be sent using the SMTP command:\n
\n\nMAIL FROM:<> AUTH=mailer-daemon@my.domain.example\n
\nThe value of bounce_sender_authentication must always be a complete email\naddress.\n
"
name: bounce_sender_authentication
type: string
callout_domain_negative_expire:
cpanel_default: 1h
default: 3h
description: "\n\n\nThis option specifies the expiry time for negative callout cache data for a\ndomain. See section 42.43 for details of callout verification, and\nsection 42.45 for details of the caching.\n
"
name: callout_domain_negative_expire
type: time
callout_domain_positive_expire:
default: 7d
description: "\nThis option specifies the expiry time for positive callout cache data for a\ndomain. See section 42.43 for details of callout verification, and\nsection 42.45 for details of the caching.\n
"
name: callout_domain_positive_expire
type: time
callout_negative_expire:
cpanel_default: 1h
default: 2h
description: "\nThis option specifies the expiry time for negative callout cache data for an\naddress. See section 42.43 for details of callout verification, and\nsection 42.45 for details of the caching.\n
"
name: callout_negative_expire
type: time
callout_positive_expire:
default: 24h
description: "\nThis option specifies the expiry time for positive callout cache data for an\naddress. See section 42.43 for details of callout verification, and\nsection 42.45 for details of the caching.\n
"
name: callout_positive_expire
type: time
callout_random_local_part:
default: ~
description: "\nThis option defines the \xE2\x80\x9Crandom\xE2\x80\x9D local part that can be used as part of\ncallout verification. The default value is\n
\n\n$primary_hostname-$tod_epoch-testing\n
\nSee section 42.44 for details of how this value is used.\n
"
name: callout_random_local_part
type: string
check_log_inodes:
default: 0
description: "\n
\n\n\n\nThe four check_... options allow for checking of disk resources before a\nmessage is accepted.\n
\n\n\n\n\n\nWhen any of these options are set, they apply to all incoming messages. If you\nwant to apply different checks to different kinds of message, you can do so by\ntesting the variables $log_inodes, $log_space, $spool_inodes, and\n$spool_space in an ACL with appropriate additional conditions.\n
\n\ncheck_spool_space and check_spool_inodes check the spool partition if\neither value is greater than zero, for example:\n
\n\ncheck_spool_space = 10M\ncheck_spool_inodes = 100\n
\nThe spool partition is the one that contains the directory defined by\nSPOOL_DIRECTORY in Local/Makefile. It is used for holding messages in\ntransit.\n
\n\ncheck_log_space and check_log_inodes check the partition in which log\nfiles are written if either is greater than zero. These should be set only if\nlog_file_path and spool_directory refer to different partitions.\n
\n\nIf there is less space or fewer inodes than requested, Exim refuses to accept\nincoming mail. In the case of SMTP input this is done by giving a 452 temporary\nerror response to the MAIL command. If ESMTP is in use and there was a\nSIZE parameter on the MAIL command, its value is added to the\ncheck_spool_space value, and the check is performed even if\ncheck_spool_space is zero, unless no_smtp_check_spool_space is set.\n
\n\nThe values for check_spool_space and check_log_space are held as a\nnumber of kilobytes. If a non-multiple of 1024 is specified, it is rounded up.\n
\n\nFor non-SMTP input and for batched SMTP input, the test is done at start-up; on\nfailure a message is written to stderr and Exim exits with a non-zero code, as\nit obviously cannot send an error message of any kind.\n
below.\n"
name: check_log_inodes
type: integer
check_log_space:
default: 0
description: "\n
\n\n\n\nThe four check_... options allow for checking of disk resources before a\nmessage is accepted.\n
\n\n\n\n\n\nWhen any of these options are set, they apply to all incoming messages. If you\nwant to apply different checks to different kinds of message, you can do so by\ntesting the variables $log_inodes, $log_space, $spool_inodes, and\n$spool_space in an ACL with appropriate additional conditions.\n
\n\ncheck_spool_space and check_spool_inodes check the spool partition if\neither value is greater than zero, for example:\n
\n\ncheck_spool_space = 10M\ncheck_spool_inodes = 100\n
\nThe spool partition is the one that contains the directory defined by\nSPOOL_DIRECTORY in Local/Makefile. It is used for holding messages in\ntransit.\n
\n\ncheck_log_space and check_log_inodes check the partition in which log\nfiles are written if either is greater than zero. These should be set only if\nlog_file_path and spool_directory refer to different partitions.\n
\n\nIf there is less space or fewer inodes than requested, Exim refuses to accept\nincoming mail. In the case of SMTP input this is done by giving a 452 temporary\nerror response to the MAIL command. If ESMTP is in use and there was a\nSIZE parameter on the MAIL command, its value is added to the\ncheck_spool_space value, and the check is performed even if\ncheck_spool_space is zero, unless no_smtp_check_spool_space is set.\n
\n\nThe values for check_spool_space and check_log_space are held as a\nnumber of kilobytes. If a non-multiple of 1024 is specified, it is rounded up.\n
\n\nFor non-SMTP input and for batched SMTP input, the test is done at start-up; on\nfailure a message is written to stderr and Exim exits with a non-zero code, as\nit obviously cannot send an error message of any kind.\n
below.\n"
name: check_log_space
type: integer
check_rfc2047_length:
cpanel_default: 'false'
default: 'true'
description: "\nRFC 2047 defines a way of encoding non-ASCII characters in headers using a\nsystem of \xE2\x80\x9Cencoded words\xE2\x80\x9D. The RFC specifies a maximum length for an encoded\nword; strings to be encoded that exceed this length are supposed to use\nmultiple encoded words. By default, Exim does not recognize encoded words that\nexceed the maximum length. However, it seems that some software, in violation\nof the RFC, generates overlong encoded words. If check_rfc2047_length is\nset false, Exim recognizes encoded words of any length.\n
"
name: check_rfc2047_length
type: boolean
check_spool_inodes:
default: 0
description: "\n
\n\n\n\nThe four check_... options allow for checking of disk resources before a\nmessage is accepted.\n
\n\n\n\n\n\nWhen any of these options are set, they apply to all incoming messages. If you\nwant to apply different checks to different kinds of message, you can do so by\ntesting the variables $log_inodes, $log_space, $spool_inodes, and\n$spool_space in an ACL with appropriate additional conditions.\n
\n\ncheck_spool_space and check_spool_inodes check the spool partition if\neither value is greater than zero, for example:\n
\n\ncheck_spool_space = 10M\ncheck_spool_inodes = 100\n
\nThe spool partition is the one that contains the directory defined by\nSPOOL_DIRECTORY in Local/Makefile. It is used for holding messages in\ntransit.\n
\n\ncheck_log_space and check_log_inodes check the partition in which log\nfiles are written if either is greater than zero. These should be set only if\nlog_file_path and spool_directory refer to different partitions.\n
\n\nIf there is less space or fewer inodes than requested, Exim refuses to accept\nincoming mail. In the case of SMTP input this is done by giving a 452 temporary\nerror response to the MAIL command. If ESMTP is in use and there was a\nSIZE parameter on the MAIL command, its value is added to the\ncheck_spool_space value, and the check is performed even if\ncheck_spool_space is zero, unless no_smtp_check_spool_space is set.\n
\n\nThe values for check_spool_space and check_log_space are held as a\nnumber of kilobytes. If a non-multiple of 1024 is specified, it is rounded up.\n
\n\nFor non-SMTP input and for batched SMTP input, the test is done at start-up; on\nfailure a message is written to stderr and Exim exits with a non-zero code, as\nit obviously cannot send an error message of any kind.\n
below.\n"
name: check_spool_inodes
type: integer
check_spool_space:
default: 0
description: "\n\n\n\nThe four check_... options allow for checking of disk resources before a\nmessage is accepted.\n
\n\n\n\n\n\nWhen any of these options are set, they apply to all incoming messages. If you\nwant to apply different checks to different kinds of message, you can do so by\ntesting the variables $log_inodes, $log_space, $spool_inodes, and\n$spool_space in an ACL with appropriate additional conditions.\n
\n\ncheck_spool_space and check_spool_inodes check the spool partition if\neither value is greater than zero, for example:\n
\n\ncheck_spool_space = 10M\ncheck_spool_inodes = 100\n
\nThe spool partition is the one that contains the directory defined by\nSPOOL_DIRECTORY in Local/Makefile. It is used for holding messages in\ntransit.\n
\n\ncheck_log_space and check_log_inodes check the partition in which log\nfiles are written if either is greater than zero. These should be set only if\nlog_file_path and spool_directory refer to different partitions.\n
\n\nIf there is less space or fewer inodes than requested, Exim refuses to accept\nincoming mail. In the case of SMTP input this is done by giving a 452 temporary\nerror response to the MAIL command. If ESMTP is in use and there was a\nSIZE parameter on the MAIL command, its value is added to the\ncheck_spool_space value, and the check is performed even if\ncheck_spool_space is zero, unless no_smtp_check_spool_space is set.\n
\n\nThe values for check_spool_space and check_log_space are held as a\nnumber of kilobytes. If a non-multiple of 1024 is specified, it is rounded up.\n
\n\nFor non-SMTP input and for batched SMTP input, the test is done at start-up; on\nfailure a message is written to stderr and Exim exits with a non-zero code, as\nit obviously cannot send an error message of any kind.\n
"
name: check_spool_space
type: integer
chunking_advertise_hosts:
cpanel_default: 198.51.100.1
daemon_smtp_ports:
cpanel_default: "25 : 465 : 587"
default: smtp
description: "\n\n\nThis option specifies one or more default SMTP ports on which the Exim daemon\nlistens. See chapter 13 for details of how it is used. For\nbackward compatibility, daemon_smtp_port (singular) is a synonym.\n
"
name: daemon_smtp_ports
type: string
daemon_startup_retries:
default: 9
description: "\n\nThis option, along with daemon_startup_sleep, controls the retrying done by\nthe daemon at startup when it cannot immediately bind a listening socket\n(typically because the socket is already in use): daemon_startup_retries\ndefines the number of retries after the first failure, and\ndaemon_startup_sleep defines the length of time to wait between retries.\n
"
name: daemon_startup_retries
type: integer
daemon_startup_sleep:
default: 30s
description: "\n
\n\nThis option, along with daemon_startup_sleep, controls the retrying done by\nthe daemon at startup when it cannot immediately bind a listening socket\n(typically because the socket is already in use): daemon_startup_retries\ndefines the number of retries after the first failure, and\ndaemon_startup_sleep defines the length of time to wait between retries.\n
"
name: daemon_startup_sleep
type: time
delay_warning:
default: 24h
description: "\n\n\nWhen a message is delayed, Exim sends a warning message to the sender at\nintervals specified by this option. The data is a colon-separated list of times\nafter which to send warning messages. If the value of the option is an empty\nstring or a zero time, no warnings are sent. Up to 10 times may be given. If a\nmessage has been on the queue for longer than the last time, the last interval\nbetween the times is used to compute subsequent warning times. For example,\nwith\n
\n\ndelay_warning = 4h:8h:24h\n
\nthe first message is sent after 4 hours, the second after 8 hours, and\nthe third one after 24 hours. After that, messages are sent every 16 hours,\nbecause that is the interval between the last two times on the list. If you set\njust one time, it specifies the repeat interval. For example, with:\n
\n\n\nmessages are repeated every six hours. To stop warnings after a given time, set\na very large time at the end of the list. For example:\n
\n\ndelay_warning = 2h:12h:99d\n
\n\nThe string is expanded at the time a warning message might be sent. If all the\ndeferred addresses have the same domain, it is set in $domain during the\nexpansion. Otherwise $domain is empty. If the result of the expansion is a\nforced failure, an empty string, or a string matching any of \xE2\x80\x9C0\xE2\x80\x9D, \xE2\x80\x9Cno\xE2\x80\x9D or\n\xE2\x80\x9Cfalse\xE2\x80\x9D (the comparison being done caselessly) then the warning message is\nnot sent. The default is:\n
\n\ndelay_warning_condition = ${if or {\\\n { !eq{$h_list-id:$h_list-post:$h_list-subscribe:}{} }\\\n { match{$h_precedence:}{(?i)bulk|list|junk} }\\\n { match{$h_auto-submitted:}{(?i)auto-generated|auto-replied} }\\\n } {no}{yes}}\n\nThis suppresses the sending of warnings for messages that contain List-ID:,\nList-Post:, or List-Subscribe: headers, or have \xE2\x80\x9Cbulk\xE2\x80\x9D, \xE2\x80\x9Clist\xE2\x80\x9D or\n\xE2\x80\x9Cjunk\xE2\x80\x9D in a Precedence: header, or have \xE2\x80\x9Cauto-generated\xE2\x80\x9D or\n\xE2\x80\x9Cauto-replied\xE2\x80\x9D in an Auto-Submitted: header.\n
"
name: delay_warning_condition
type: string
deliver_drop_privilege:
default: 'false'
description: "\n\n\nIf this option is set true, Exim drops its root privilege at the start of a\ndelivery process, and runs as the Exim user throughout. This severely restricts\nthe kinds of local delivery that are possible, but is viable in certain types\nof configuration. There is a discussion about the use of root privilege in\nchapter 54.\n
"
name: deliver_drop_privilege
type: boolean
deliver_queue_load_max:
cpanel_default: 18
default: unset
description: "\n\n\nWhen this option is set, a queue run is abandoned if the system load average\nbecomes greater than the value of the option. The option has no effect on\nancient operating systems on which Exim cannot determine the load average.\nSee also queue_only_load and smtp_load_reserve.\n
"
name: deliver_queue_load_max
type: fixedpoint
delivery_date_remove:
default: 'true'
description: "\n\nExim\xE2\x80\x99s transports have an option for adding a Delivery-date: header to a\nmessage when it is delivered, in exactly the same way as Return-path: is\nhandled. Delivery-date: records the actual time of delivery. Such headers\nshould not be present in incoming messages, and this option causes them to be\nremoved at the time the message is received, to avoid any problems that might\noccur when a delivered message is subsequently sent on to some other recipient.\n
"
name: delivery_date_remove
type: boolean
disable_fsync:
default: 'false'
description: "\n\nThis option is available only if Exim was built with the compile-time option\nENABLE_DISABLE_FSYNC. When this is not set, a reference to disable_fsync in\na runtime configuration generates an \xE2\x80\x9Cunknown option\xE2\x80\x9D error. You should not\nbuild Exim with ENABLE_DISABLE_FSYNC or set disable_fsync unless you\nreally, really, really understand what you are doing. No pre-compiled\ndistributions of Exim should ever make this option available.\n
\n\nWhen disable_fsync is set true, Exim no longer calls fsync() to force\nupdated files\xE2\x80\x99 data to be written to disc before continuing. Unexpected events\nsuch as crashes and power outages may cause data to be lost or scrambled.\nHere be Dragons. Beware.\n
"
name: disable_fsync
type: boolean
disable_ipv6:
default: 'false'
description: "\n\nIf this option is set true, even if the Exim binary has IPv6 support, no IPv6\nactivities take place. AAAA records are never looked up, and any IPv6 addresses\nthat are listed in local_interfaces, data for the manualroute router,\netc. are ignored. If IP literals are enabled, the ipliteral router declines\nto handle IPv6 literal addresses.\n
"
name: disable_ipv6
type: boolean
dns_again_means_nonexist:
default: unset
description: "\n\nDNS lookups give a \xE2\x80\x9Ctry again\xE2\x80\x9D response for the DNS errors\n\xE2\x80\x9Cnon-authoritative host not found\xE2\x80\x9D and \xE2\x80\x9CSERVERFAIL\xE2\x80\x9D. This can cause Exim to\nkeep trying to deliver a message, or to give repeated temporary errors to\nincoming mail. Sometimes the effect is caused by a badly set up name server and\nmay persist for a long time. If a domain which exhibits this problem matches\nanything in dns_again_means_nonexist, it is treated as if it did not exist.\nThis option should be used with care. You can make it apply to reverse lookups\nby a setting such as this:\n
\n\ndns_again_means_nonexist = *.in-addr.arpa\n
\nThis option applies to all DNS lookups that Exim does. It also applies when the\ngethostbyname() or getipnodebyname() functions give temporary errors,\nsince these are most likely to be caused by DNS lookup problems. The\ndnslookup router has some options of its own for controlling what happens\nwhen lookups for MX or SRV records give temporary errors. These more specific\noptions are applied after this global option.\n
"
name: dns_again_means_nonexist
type: domainlist
dns_check_names_pattern:
default: ~
description: "\n\nWhen this option is set to a non-empty string, it causes Exim to check domain\nnames for characters that are not allowed in host names before handing them to\nthe DNS resolver, because some resolvers give temporary errors for names that\ncontain unusual characters. If a domain name contains any unwanted characters,\na \xE2\x80\x9Cnot found\xE2\x80\x9D result is forced, and the resolver is not called. The check is\ndone by matching the domain name against a regular expression, which is the\nvalue of this option. The default pattern is\n
\n\ndns_check_names_pattern = \\\n (?i)^(?>(?(1)\\.|())[^\\W_](?>[a-z0-9/-]*[^\\W_])?)+$\n
\nwhich permits only letters, digits, slashes, and hyphens in components, but\nthey must start and end with a letter or digit. Slashes are not, in fact,\npermitted in host names, but they are found in certain NS records (which can be\naccessed in Exim by using a dnsdb lookup). If you set\nallow_utf8_domains, you must modify this pattern, or set the option to an\nempty string.\n
"
name: dns_check_names_pattern
type: string
dns_csa_search_limit:
default: 5
description: "\nThis option controls the depth of parental searching for CSA SRV records in the\nDNS, as described in more detail in section 42.48.\n
"
name: dns_csa_search_limit
type: integer
dns_csa_use_reverse:
default: 'true'
description: "\nThis option controls whether or not an IP address, given as a CSA domain, is\nreversed and looked up in the reverse DNS, as described in more detail in\nsection 42.48.\n
"
name: dns_csa_use_reverse
type: boolean
dns_ipv4_lookup:
default: unset
description: "\n\n\nWhen Exim is compiled with IPv6 support and disable_ipv6 is not set, it\nlooks for IPv6 address records (AAAA records) as well as IPv4 address records\n(A records) when trying to find IP addresses for hosts, unless the host\xE2\x80\x99s\ndomain matches this list.\n
\n\nThis is a fudge to help with name servers that give big delays or otherwise do\nnot work for the AAAA record type. In due course, when the world\xE2\x80\x99s name\nservers have all been upgraded, there should be no need for this option.\n
"
name: dns_ipv4_lookup
type: domainlist
dns_retrans:
default: 0s
description: "\n\nThe options dns_retrans and dns_retry can be used to set the\nretransmission and retry parameters for DNS lookups. Values of zero (the\ndefaults) leave the system default settings unchanged. The first value is the\ntime between retries, and the second is the number of retries. It isn\xE2\x80\x99t\ntotally clear exactly how these settings affect the total time a DNS lookup may\ntake. I haven\xE2\x80\x99t found any documentation about timeouts on DNS lookups; these\nparameter values are available in the external resolver interface structure,\nbut nowhere does it seem to describe how they are used or what you might want\nto set in them.\n
"
name: dns_retrans
type: time
dns_retry:
default: 0
description: "\n
\n\nThe options dns_retrans and dns_retry can be used to set the\nretransmission and retry parameters for DNS lookups. Values of zero (the\ndefaults) leave the system default settings unchanged. The first value is the\ntime between retries, and the second is the number of retries. It isn\xE2\x80\x99t\ntotally clear exactly how these settings affect the total time a DNS lookup may\ntake. I haven\xE2\x80\x99t found any documentation about timeouts on DNS lookups; these\nparameter values are available in the external resolver interface structure,\nbut nowhere does it seem to describe how they are used or what you might want\nto set in them.\n
above.\n\n\n\n
"
name: dns_retry
type: integer
dns_use_edns0:
default: -1
description: "\n\n\nIf this option is set to a non-negative number then Exim will initialise the\nDNS resolver library to either use or not use EDNS0 extensions, overriding\nthe system default. A value of 0 coerces EDNS0 off, a value of 1 coerces EDNS0\non.\n
\n\nIf the resolver library does not support EDNS0 then this option has no effect.\n
"
name: dns_use_edns0
type: integer
domainlist:
default: ''
description: This is a Named list definition. Their use is described in section 10.5.
name: domainlist
type: domainlist
domainlist blocked_domains:
cpanel_default: wildlsearch;/etc/blocked_incoming_email_domains
domainlist local_domains:
cpanel_default: lsearch;/etc/localdomains
domainlist manualmx_domains:
cpanel_default: ${if exists {/etc/manualmx} {lsearch;/etc/manualmx} {} }
domainlist relay_domains:
cpanel_default: "+local_domains : +secondarymx_domains"
domainlist secondarymx_domains:
cpanel_default: lsearch;/etc/secondarymx
domainlist user_domains:
cpanel_default: ${if exists{/etc/userdomains} {lsearch;/etc/userdomains} fail}
drop_cr:
default: 'false'
description: "\nThis is an obsolete option that is now a no-op. It used to affect the way Exim\nhandled CR and LF characters in incoming messages. What happens now is\ndescribed in section 46.2.\n
"
name: drop_cr
type: boolean
dsn_from:
default: ~
description: "\n\n\nThis option can be used to vary the contents of From: header lines in\nbounces and other automatically generated messages (\xE2\x80\x9CDelivery Status\nNotifications\xE2\x80\x9D \xE2\x80\x93 hence the name of the option). The default setting is:\n
\n\ndsn_from = Mail Delivery System \n
\nThe value is expanded every time it is needed. If the expansion fails, a\npanic is logged, and the default value is used.\n
"
name: dsn_from
type: string
envelope_to_remove:
default: 'true'
description: "\n\nExim\xE2\x80\x99s transports have an option for adding an Envelope-to: header to a\nmessage when it is delivered, in exactly the same way as Return-path: is\nhandled. Envelope-to: records the original recipient address from the\nmessages\xE2\x80\x99s envelope that caused the delivery to happen. Such headers should not\nbe present in incoming messages, and this option causes them to be removed at\nthe time the message is received, to avoid any problems that might occur when a\ndelivered message is subsequently sent on to some other recipient.\n
"
name: envelope_to_remove
type: boolean
errors_copy:
default: unset
description: "\n\n\nSetting this option causes Exim to send bcc copies of bounce messages that it\ngenerates to other addresses. Note: This does not apply to bounce messages\ncoming from elsewhere. The value of the option is a colon-separated list of\nitems. Each item consists of a pattern, terminated by white space, followed by\na comma-separated list of email addresses. If a pattern contains spaces, it\nmust be enclosed in double quotes.\n
\n\nEach pattern is processed in the same way as a single item in an address list\n(see section 10.19). When a pattern matches the recipient of\nthe bounce message, the message is copied to the addresses on the list. The\nitems are scanned in order, and once a matching one is found, no further items\nare examined. For example:\n
\n\nerrors_copy = spqr@mydomain postmaster@mydomain.example :\\\n rqps@mydomain hostmaster@mydomain.example,\\\n postmaster@mydomain.example\n
\n\n\nThe address list is expanded before use. The expansion variables $local_part\nand $domain are set from the original recipient of the error message, and if\nthere was any wildcard matching in the pattern, the expansion\n\nvariables $0, $1, etc. are set in the normal way.\n
"
name: errors_copy
type: stringlist
errors_reply_to:
default: unset
description: "\n\nBy default, Exim\xE2\x80\x99s bounce and delivery warning messages contain the header line\n
\n\nFrom: Mail Delivery System qualify-domain>\n
\n\nwhere qualify-domain is the value of the qualify_domain option.\nA warning message that is generated by the quota_warn_message option in an\nappendfile transport may contain its own From: header line that\noverrides the default.\n
\n\nExperience shows that people reply to bounce messages. If the\nerrors_reply_to option is set, a Reply-To: header is added to bounce\nand warning messages. For example:\n
\n\nerrors_reply_to = postmaster@my.domain.example\n
\nThe value of the option is not expanded. It must specify a valid RFC 2822\naddress. However, if a warning message that is generated by the\nquota_warn_message option in an appendfile transport contain its\nown Reply-To: header line, the value of the errors_reply_to option is\nnot used.\n
"
name: errors_reply_to
type: string
exim_group:
default: ~
description: "\n\n\nThis option changes the gid under which Exim runs when it gives up root\nprivilege. The default value is compiled into the binary. The value of this\noption is used only when exim_user is also set. Unless it consists entirely\nof digits, the string is looked up using getgrnam(), and failure causes a\nconfiguration error. See chapter 54 for a discussion of\nsecurity issues.\n
"
name: exim_group
type: string
exim_path:
default: ~
description: "\n\nThis option specifies the path name of the Exim binary, which is used when Exim\nneeds to re-exec itself. The default is set up to point to the file exim in\nthe directory configured at compile time by the BIN_DIRECTORY setting. It\nis necessary to change exim_path if, exceptionally, Exim is run from some\nother place.\nWarning: Do not use a macro to define the value of this option, because\nyou will break those Exim utilities that scan the configuration file to find\nwhere the binary is. (They then use the -bP option to extract option\nsettings such as the value of spool_directory.)\n
"
name: exim_path
type: string
exim_user:
default: ~
description: "\n\n\nThis option changes the uid under which Exim runs when it gives up root\nprivilege. The default value is compiled into the binary. Ownership of the run\ntime configuration file and the use of the -C and -D command line\noptions is checked against the values in the binary, not what is set here.\n
\n\nUnless it consists entirely of digits, the string is looked up using\ngetpwnam(), and failure causes a configuration error. If exim_group is\nnot also supplied, the gid is taken from the result of getpwnam() if it is\nused. See chapter 54 for a discussion of security issues.\n
"
name: exim_user
type: string
extra_local_interfaces:
default: unset
description: "\nThis option defines network interfaces that are to be considered local when\nrouting, but which are not used for listening by the daemon. See section\n13.8 for details.\n
"
name: extra_local_interfaces
type: stringlist
extract_addresses_remove_arguments:
default: 'true'
description: "\n\n\n\nAccording to some Sendmail documentation (Sun, IRIX, HP-UX), if any addresses\nare present on the command line when the -t option is used to build an\nenvelope from a message\xE2\x80\x99s To:, Cc: and Bcc: headers, the command\nline addresses are removed from the recipients list. This is also how Smail\nbehaves. However, other Sendmail documentation (the O\xE2\x80\x99Reilly book) states that\ncommand line addresses are added to those obtained from the header lines. When\nextract_addresses_remove_arguments is true (the default), Exim subtracts\nargument headers. If it is set false, Exim adds rather than removes argument\naddresses.\n
"
name: extract_addresses_remove_arguments
type: boolean
finduser_retries:
default: 0
description: "\n\nOn systems running NIS or other schemes in which user and group information is\ndistributed from a remote system, there can be times when getpwnam() and\nrelated functions fail, even when given valid data, because things time out.\nUnfortunately these failures cannot be distinguished from genuine \xE2\x80\x9Cnot found\xE2\x80\x9D\nerrors. If finduser_retries is set greater than zero, Exim will try that\nmany extra times to find a user or a group, waiting for one second between\nretries.\n
\n\n\nYou should not set this option greater than zero if your user information is in\na traditional /etc/passwd file, because it will cause Exim needlessly to\nsearch the file multiple times for non-existent users, and also cause delay.\n
"
name: finduser_retries
type: integer
freeze_tell:
default: unset
description: "\n\nOn encountering certain errors, or when configured to do so in a system filter,\nACL, or special router, Exim freezes a message. This means that no further\ndelivery attempts take place until an administrator thaws the message, or the\nauto_thaw, ignore_bounce_errors_after, or timeout_frozen_after\nfeature cause it to be processed. If freeze_tell is set, Exim generates a\nwarning message whenever it freezes something, unless the message it is\nfreezing is a locally-generated bounce message. (Without this exception there\nis the possibility of looping.) The warning message is sent to the addresses\nsupplied as the comma-separated value of this option. If several of the\nmessage\xE2\x80\x99s addresses cause freezing, only a single message is sent. If the\nfreezing was automatic, the reason(s) for freezing can be found in the message\nlog. If you configure freezing in a filter or ACL, you must arrange for any\nlogging that you require.\n
"
name: freeze_tell
type: stringlistcommaseparated
gecos_name:
default: unset
description: "\n\n\nSome operating systems, notably HP-UX, use the \xE2\x80\x9Cgecos\xE2\x80\x9D field in the system\npassword file to hold other information in addition to users\xE2\x80\x99 real names. Exim\nlooks up this field for use when it is creating Sender: or From:\nheaders. If either gecos_pattern or gecos_name are unset, the contents\nof the field are used unchanged, except that, if an ampersand is encountered,\nit is replaced by the user\xE2\x80\x99s login name with the first character forced to\nupper case, since this is a convention that is observed on many systems.\n
\n\nWhen these options are set, gecos_pattern is treated as a regular\nexpression that is to be applied to the field (again with & replaced by the\nlogin name), and if it matches, gecos_name is expanded and used as the\nuser\xE2\x80\x99s name.\n
\n\n\nNumeric variables such as $1, $2, etc. can be used in the expansion to\npick up sub-fields that were matched by the pattern. In HP-UX, where the user\xE2\x80\x99s\nname terminates at the first comma, the following can be used:\n
\n\ngecos_pattern = ([^,]*)\ngecos_name = $1\n
\n
\n\n\nSome operating systems, notably HP-UX, use the \xE2\x80\x9Cgecos\xE2\x80\x9D field in the system\npassword file to hold other information in addition to users\xE2\x80\x99 real names. Exim\nlooks up this field for use when it is creating Sender: or From:\nheaders. If either gecos_pattern or gecos_name are unset, the contents\nof the field are used unchanged, except that, if an ampersand is encountered,\nit is replaced by the user\xE2\x80\x99s login name with the first character forced to\nupper case, since this is a convention that is observed on many systems.\n
\n\nWhen these options are set, gecos_pattern is treated as a regular\nexpression that is to be applied to the field (again with & replaced by the\nlogin name), and if it matches, gecos_name is expanded and used as the\nuser\xE2\x80\x99s name.\n
\n\n\nNumeric variables such as $1, $2, etc. can be used in the expansion to\npick up sub-fields that were matched by the pattern. In HP-UX, where the user\xE2\x80\x99s\nname terminates at the first comma, the following can be used:\n
\n\ngecos_pattern = ([^,]*)\ngecos_name = $1\n
\nThis option controls whether GnuTLS is used in compatibility mode in an Exim\nserver. This reduces security slightly, but improves interworking with older\nimplementations of TLS.\n
"
name: gnutls_compat_mode
type: boolean
header_line_maxsize:
default: 0
description: "\n\n\nThis option limits the length of any individual header line in a message, after\nall the continuations have been joined together. Messages with individual\nheader lines that are longer than the limit are rejected. The default value of\nzero means \xE2\x80\x9Cno limit\xE2\x80\x9D.\n
"
name: header_line_maxsize
type: integer
header_maxsize:
default: ~
description: "\n\n\nThis option controls the overall maximum size of a message\xE2\x80\x99s header\nsection. The default is the value of HEADER_MAXSIZE in\nLocal/Makefile; the default for that is 1M. Messages with larger header\nsections are rejected.\n
"
name: header_maxsize
type: integer
headers_charset:
default: ~
description: "\nThis option sets a default character set for translating from encoded MIME\n\xE2\x80\x9Cwords\xE2\x80\x9D in header lines, when referenced by an $h_xxx expansion item. The\ndefault is the value of HEADERS_CHARSET in Local/Makefile. The\nultimate default is ISO-8859-1. For more details see the description of header\ninsertions in section 11.5.\n
"
name: headers_charset
type: string
helo_accept_junk_hosts:
cpanel_default: "*"
default: unset
description: "\n\n\nExim checks the syntax of HELO and EHLO commands for incoming SMTP\nmail, and gives an error response for invalid data. Unfortunately, there are\nsome SMTP clients that send syntactic junk. They can be accommodated by setting\nthis option. Note that this is a syntax check only.
\n\n\nLike helo_try_verify_hosts, this option is obsolete, and retained only for\nbackwards compatibility. For hosts that match this option, Exim checks the host\nname given in the HELO or EHLO in the same way as for\nhelo_try_verify_hosts. If the check fails, the HELO or EHLO command is\nrejected with a 550 error, and entries are written to the main and reject logs.\nIf a MAIL command is received before EHLO or HELO, it is rejected with a 503\nerror.\n
if you want to do semantic checking.\nSee also helo_allow_chars for a way of extending the permitted character\nset.\n"
name: helo_accept_junk_hosts
type: hostlist
helo_allow_chars:
default: unset
description: "\n\n\n\nThis option can be set to a string of rogue characters that are permitted in\nall EHLO and HELO names in addition to the standard letters, digits,\nhyphens, and dots. If you really must allow underscores, you can set\n
\n\n\nNote that the value is one string, not a list.\n
"
name: helo_allow_chars
type: string
helo_lookup_domains:
default: "@:@[]"
description: "\n\n\nIf the domain given by a client in a HELO or EHLO command matches this\nlist, a reverse lookup is done in order to establish the host\xE2\x80\x99s true name. The\ndefault forces a lookup if the client host gives the server\xE2\x80\x99s name or any of\nits IP addresses (in brackets), something that broken clients have been seen to\ndo.\n
"
name: helo_lookup_domains
type: domainlist
helo_try_verify_hosts:
default: unset
description: "\n\n\nBy default, Exim just checks the syntax of HELO and EHLO commands (see\nhelo_accept_junk_hosts and helo_allow_chars). However, some sites like\nto do more extensive checking of the data supplied by these commands. The ACL\ncondition verify = helo is provided to make this possible.\nFormerly, it was necessary also to set this option (helo_try_verify_hosts)\nto force the check to occur. From release 4.53 onwards, this is no longer\nnecessary. If the check has not been done before verify = helo is\nencountered, it is done at that time. Consequently, this option is obsolete.\nIts specification is retained here for backwards compatibility.\n
\n\nWhen an EHLO or HELO command is received, if the calling host matches\nhelo_try_verify_hosts, Exim checks that the host name given in the HELO or\nEHLO command either:\n
\n\n- \n
\nis an IP literal matching the calling address of the host, or\n
\n \n- \n
\n\n\nmatches the host name that Exim obtains by doing a reverse lookup of the\ncalling host address, or\n
\n \n- \n
\nwhen looked up using gethostbyname() (or getipnodebyname() when\navailable) yields the calling host address.\n
\n \n
\n\nHowever, the EHLO or HELO command is not rejected if any of the checks\nfail. Processing continues, but the result of the check is remembered, and can\nbe detected later in an ACL by the verify = helo condition.\n
"
name: helo_try_verify_hosts
type: hostlist
helo_verify_hosts:
default: unset
description: "\n\n\nLike helo_try_verify_hosts, this option is obsolete, and retained only for\nbackwards compatibility. For hosts that match this option, Exim checks the host\nname given in the HELO or EHLO in the same way as for\nhelo_try_verify_hosts. If the check fails, the HELO or EHLO command is\nrejected with a 550 error, and entries are written to the main and reject logs.\nIf a MAIL command is received before EHLO or HELO, it is rejected with a 503\nerror.\n
"
name: helo_verify_hosts
type: hostlist
hold_domains:
default: unset
description: "\n\n\nThis option allows mail for particular domains to be held on the queue\nmanually. The option is overridden if a message delivery is forced with the\n-M, -qf, -Rf or -Sf options, and also while testing or\nverifying addresses using -bt or -bv. Otherwise, if a domain matches an\nitem in hold_domains, no routing or delivery for that address is done, and\nit is deferred every time the message is looked at.\n
\n\nThis option is intended as a temporary operational measure for delaying the\ndelivery of mail while some problem is being sorted out, or some new\nconfiguration tested. If you just want to delay the processing of some\ndomains until a queue run occurs, you should use queue_domains or\nqueue_smtp_domains, not hold_domains.\n
\n\nA setting of hold_domains does not override Exim\xE2\x80\x99s code for removing\nmessages from the queue if they have been there longer than the longest retry\ntime in any retry rule. If you want to hold messages for longer than the normal\nretry times, insert a dummy retry rule with a long retry time.\n
"
name: hold_domains
type: domainlist
host_lookup:
default: unset
description: "\n\nExim does not look up the name of a calling host from its IP address unless it\nis required to compare against some host list, or the host matches\nhelo_try_verify_hosts or helo_verify_hosts, or the host matches this\noption (which normally contains IP addresses rather than host names). The\ndefault configuration file contains\n
\n\n\nwhich causes a lookup to happen for all hosts. If the expense of these lookups\nis felt to be too great, the setting can be changed or removed.\n
\n\nAfter a successful reverse lookup, Exim does a forward lookup on the name it\nhas obtained, to verify that it yields the IP address that it started with. If\nthis check fails, Exim behaves as if the name lookup failed.\n
\n\n\n\nAfter any kind of failure, the host name (in $sender_host_name) remains\nunset, and $host_lookup_failed is set to the string \xE2\x80\x9C1\xE2\x80\x9D. See also\ndns_again_means_nonexist, helo_lookup_domains, and\nverify = reverse_host_lookup in ACLs.\n
"
name: host_lookup
type: hostlist
host_lookup_order:
default: bydns:byaddr
description: "\nThis option specifies the order of different lookup methods when Exim is trying\nto find a host name from an IP address. The default is to do a DNS lookup\nfirst, and then to try a local lookup (using gethostbyaddr() or equivalent)\nif that fails. You can change the order of these lookups, or omit one entirely,\nif you want.\n
\n\nWarning: The \xE2\x80\x9Cbyaddr\xE2\x80\x9D method does not always yield aliases when there are\nmultiple PTR records in the DNS and the IP address is not listed in\n/etc/hosts. Different operating systems give different results in this\ncase. That is why the default tries a DNS lookup first.\n
"
name: host_lookup_order
type: stringlist
host_reject_connection:
default: unset
description: "\n\nIf this option is set, incoming SMTP calls from the hosts listed are rejected\nas soon as the connection is made.\nThis option is obsolete, and retained only for backward compatibility, because\nnowadays the ACL specified by acl_smtp_connect can also reject incoming\nconnections immediately.\n
\n\nThe ability to give an immediate rejection (either by this option or using an\nACL) is provided for use in unusual cases. Many hosts will just try again,\nsometimes without much delay. Normally, it is better to use an ACL to reject\nincoming messages at a later stage, such as after RCPT commands. See\nchapter 42.\n
"
name: host_reject_connection
type: hostlist
hostlist:
default: ''
description: This is a Named list definition. Their use is described in section 10.5.
name: hostlist
type: hostlist
hostlist backupmx_hosts:
cpanel_default: lsearch;/etc/backupmxhosts
hostlist blocked_incoming_email_country_ips:
cpanel_default: ${if exists{/etc/blocked_incoming_email_country_ips} {net-iplsearch;/etc/blocked_incoming_email_country_ips} {} }
hostlist cpanel_mail_netblocks:
cpanel_default: net-iplsearch;/etc/cpanel_mail_netblocks
hostlist greylist_common_mail_providers:
cpanel_default: net-iplsearch;/etc/greylist_common_mail_providers
hostlist greylist_trusted_netblocks:
cpanel_default: net-iplsearch;/etc/greylist_trusted_netblocks
hostlist loopback:
cpanel_default: <; @[]; 127.0.0.0/8 ; 0.0.0.0 ; ::1 ; 0000:0000:0000:0000:0000:ffff:7f00:0000/8
hostlist neighbor_netblocks:
cpanel_default: net-iplsearch;/etc/neighbor_netblocks
hostlist recent_authed_mail_ips:
cpanel_default: net-iplsearch;/etc/recent_authed_mail_ips
hostlist recent_recipient_mail_server_ips:
cpanel_default: net-iplsearch;/etc/recent_recipient_mail_server_ips
hostlist senderverifybypass_hosts:
cpanel_default: net-iplsearch;/etc/senderverifybypasshosts
hostlist skipsmtpcheck_hosts:
cpanel_default: net-iplsearch;/etc/skipsmtpcheckhosts
hostlist spammeripblocks:
cpanel_default: net-iplsearch;/etc/spammeripblocks
hostlist trustedmailhosts:
cpanel_default: lsearch;/etc/trustedmailhosts
hosts_connection_nolog:
default: unset
description: "\n\nThis option defines a list of hosts for which connection logging does not\nhappen, even though the smtp_connection log selector is set. For example,\nyou might want not to log SMTP connections from local processes, or from\n127.0.0.1, or from your local LAN. This option is consulted in the main loop of\nthe daemon; you should therefore strive to restrict its value to a short inline\nlist of IP addresses and networks. To disable logging SMTP connections from\nlocal processes, you must create a host list with an empty item. For example:\n
\n\nhosts_connection_nolog = :\n
\nIf the smtp_connection log selector is not set, this option has no effect.\n
"
name: hosts_connection_nolog
type: hostlist
hosts_treat_as_local:
default: unset
description: "\n\n\nIf this option is set, any host names that match the domain list are treated as\nif they were the local host when Exim is scanning host lists obtained from MX\nrecords\nor other sources. Note that the value of this option is a domain list, not a\nhost list, because it is always used to check host names, not IP addresses.\n
\n\nThis option also applies when Exim is matching the special items\n@mx_any, @mx_primary, and @mx_secondary in a domain list (see\nsection 10.8), and when checking the hosts option in the\nsmtp transport for the local host (see the allow_localhost option in\nthat transport). See also local_interfaces, extra_local_interfaces, and\nchapter 13, which contains a discussion about local network\ninterfaces and recognizing the local host.\n
"
name: hosts_treat_as_local
type: domainlist
ibase_servers:
default: unset
description: "\n\nThis option provides a list of InterBase servers and associated connection data,\nto be used in conjunction with ibase lookups (see section 9.21).\nThe option is available only if Exim has been built with InterBase support.\n
"
name: ibase_servers
type: stringlist
ignore_bounce_errors_after:
cpanel_default: 1d
default: 10w
description: "\n\n\nThis option affects the processing of bounce messages that cannot be delivered,\nthat is, those that suffer a permanent delivery failure. (Bounce messages that\nsuffer temporary delivery failures are of course retried in the usual way.)\n
\n\nAfter a permanent delivery failure, bounce messages are frozen,\nbecause there is no sender to whom they can be returned. When a frozen bounce\nmessage has been on the queue for more than the given time, it is unfrozen at\nthe next queue run, and a further delivery is attempted. If delivery fails\nagain, the bounce message is discarded. This makes it possible to keep failed\nbounce messages around for a shorter time than the normal maximum retry time\nfor frozen messages. For example,\n
\n\nignore_bounce_errors_after = 12h\n
\nretries failed bounce message deliveries after 12 hours, discarding any further\nfailures. If the value of this option is set to a zero time period, bounce\nfailures are discarded immediately. Setting a very long time (as in the default\nvalue) has the effect of disabling this option. For ways of automatically\ndealing with other kinds of frozen message, see auto_thaw and\ntimeout_frozen_after.\n
"
name: ignore_bounce_errors_after
type: time
ignore_fromline_hosts:
default: unset
description: "\n\n\nSome broken SMTP clients insist on sending a UUCP-like \xE2\x80\x9CFrom\xC2\xA0\xE2\x80\x9D line before\nthe headers of a message. By default this is treated as the start of the\nmessage\xE2\x80\x99s body, which means that any following headers are not recognized as\nsuch. Exim can be made to ignore it by setting ignore_fromline_hosts to\nmatch those hosts that insist on sending it. If the sender is actually a local\nprocess rather than a remote host, and is using -bs to inject the messages,\nignore_fromline_local must be set to achieve this effect.\n
"
name: ignore_fromline_hosts
type: hostlist
ignore_fromline_local:
default: 'false'
description: "\n
\n\n\nSome broken SMTP clients insist on sending a UUCP-like \xE2\x80\x9CFrom\xC2\xA0\xE2\x80\x9D line before\nthe headers of a message. By default this is treated as the start of the\nmessage\xE2\x80\x99s body, which means that any following headers are not recognized as\nsuch. Exim can be made to ignore it by setting ignore_fromline_hosts to\nmatch those hosts that insist on sending it. If the sender is actually a local\nprocess rather than a remote host, and is using -bs to inject the messages,\nignore_fromline_local must be set to achieve this effect.\n
above.\n"
name: ignore_fromline_local
type: boolean
keep_environment:
cpanel_default: "X-SOURCE : X-SOURCE-ARGS : X-SOURCE-DIR"
default: unset
description: "\n\n\nThis option contains a string list of environment variables to keep.\nYou have to trust these variables or you have to be sure that\nthese variables do not impose any security risk. Keep in mind that\nduring the startup phase Exim is running with an effective UID 0 in most\ninstallations. As the default value is an empty list, the default\nenvironment for using libraries, running embedded Perl code, or running\nexternal binaries is empty, and does not not even contain PATH or HOME.\n
"
name: keep_environment
type: stringlist
keep_malformed:
default: 4d
description: "\nThis option specifies the length of time to keep messages whose spool files\nhave been corrupted in some way. This should, of course, never happen. At the\nnext attempt to deliver such a message, it gets removed. The incident is\nlogged.\n
"
name: keep_malformed
type: time
ldap_ca_cert_dir:
default: unset
description: "\n\nThis option indicates which directory contains CA certificates for verifying\na TLS certificate presented by an LDAP server.\nWhile Exim does not provide a default value, your SSL library may.\nAnalogous to tls_verify_certificates but as a client-side option for LDAP\nand constrained to be a directory.\n
"
name: ldap_ca_cert_dir
type: string
ldap_ca_cert_file:
default: unset
description: "\n\nThis option indicates which file contains CA certificates for verifying\na TLS certificate presented by an LDAP server.\nWhile Exim does not provide a default value, your SSL library may.\nAnalogous to tls_verify_certificates but as a client-side option for LDAP\nand constrained to be a file.\n
"
name: ldap_ca_cert_file
type: string
ldap_cert_file:
default: unset
description: "\n\nThis option indicates which file contains an TLS client certificate which\nExim should present to the LDAP server during TLS negotiation.\nShould be used together with ldap_cert_key.\n
"
name: ldap_cert_file
type: string
ldap_cert_key:
default: unset
description: "\n\nThis option indicates which file contains the secret/private key to use\nto prove identity to the LDAP server during TLS negotiation.\nShould be used together with ldap_cert_file, which contains the\nidentity to be proven.\n
"
name: ldap_cert_key
type: string
ldap_cipher_suite:
default: unset
description: "\n\nThis controls the TLS cipher-suite negotiation during TLS negotiation with\nthe LDAP server. See 41.4 for more details of the format of\ncipher-suite options with OpenSSL (as used by LDAP client libraries).\n
"
name: ldap_cipher_suite
type: string
ldap_default_servers:
default: unset
description: "\n\nThis option provides a list of LDAP servers which are tried in turn when an\nLDAP query does not contain a server. See section 9.14 for\ndetails of LDAP queries. This option is available only when Exim has been built\nwith LDAP support.\n
"
name: ldap_default_servers
type: stringlist
ldap_require_cert:
default: unset
description: "\n\nThis should be one of the values \"hard\", \"demand\", \"allow\", \"try\" or \"never\".\nA value other than one of these is interpreted as \"never\".\nSee the entry \"TLS_REQCERT\" in your system man page for ldap.conf(5).\nAlthough Exim does not set a default, the LDAP library probably defaults\nto hard/demand.\n
"
name: ldap_require_cert
type: string
ldap_start_tls:
default: 'false'
description: "\n\nIf set, Exim will attempt to negotiate TLS with the LDAP server when\nconnecting on a regular LDAP port. This is the LDAP equivalent of SMTP\xE2\x80\x99s\n\"STARTTLS\". This is distinct from using \"ldaps\", which is the LDAP form\nof SSL-on-connect.\nIn the event of failure to negotiate TLS, the action taken is controlled\nby ldap_require_cert.\n
"
name: ldap_start_tls
type: boolean
ldap_version:
default: unset
description: "\n\nThis option can be used to force Exim to set a specific protocol version for\nLDAP. If it option is unset, it is shown by the -bP command line option as\n-1. When this is the case, the default is 3 if LDAP_VERSION3 is defined in\nthe LDAP headers; otherwise it is 2. This option is available only when Exim\nhas been built with LDAP support.\n
"
name: ldap_version
type: integer
local_from_check:
cpanel_default: 'false'
default: 'true'
description: "\n\n\nWhen a message is submitted locally (that is, not over a TCP/IP connection) by\nan untrusted user, Exim removes any existing Sender: header line, and\nchecks that the From: header line matches the login of the calling user and\nthe domain specified by qualify_domain.\n
\n\nNote: An unqualified address (no domain) in the From: header in a\nlocally submitted message is automatically qualified by Exim, unless the\n-bnq command line option is used.\n
\n\nYou can use local_from_prefix and local_from_suffix to permit affixes\non the local part. If the From: header line does not match, Exim adds a\nSender: header with an address constructed from the calling user\xE2\x80\x99s login\nand the default qualify domain.\n
\n\nIf local_from_check is set false, the From: header check is disabled,\nand no Sender: header is ever added. If, in addition, you want to retain\nSender: header lines supplied by untrusted users, you must also set\nlocal_sender_retain to be true.\n
\n\n\nThese options affect only the header lines in the message. The envelope sender\nis still forced to be the login id at the qualify domain unless\nuntrusted_set_sender permits the user to supply an envelope sender.\n
\n\nFor messages received over TCP/IP, an ACL can specify \xE2\x80\x9Csubmission mode\xE2\x80\x9D to\nrequest similar header line checking. See section 46.16, which\nhas more details about Sender: processing.\n
"
name: local_from_check
type: boolean
local_from_prefix:
default: unset
description: "\nWhen Exim checks the From: header line of locally submitted messages for\nmatching the login id (see local_from_check above), it can be configured to\nignore certain prefixes and suffixes in the local part of the address. This is\ndone by setting local_from_prefix and/or local_from_suffix to\nappropriate lists, in the same form as the local_part_prefix and\nlocal_part_suffix router options (see chapter 15). For\nexample, if\n
\n\nlocal_from_prefix = *-\n
\nis set, a From: line containing\n
\n\nFrom: anything-user@your.domain.example\n
\nwill not cause a Sender: header to be added if user@your.domain.example\nmatches the actual sender address that is constructed from the login name and\nqualify domain.\n
"
name: local_from_prefix
type: string
local_from_suffix:
default: unset
description: "\n
\nWhen Exim checks the From: header line of locally submitted messages for\nmatching the login id (see local_from_check above), it can be configured to\nignore certain prefixes and suffixes in the local part of the address. This is\ndone by setting local_from_prefix and/or local_from_suffix to\nappropriate lists, in the same form as the local_part_prefix and\nlocal_part_suffix router options (see chapter 15). For\nexample, if\n
\n\nlocal_from_prefix = *-\n
\nis set, a From: line containing\n
\n\nFrom: anything-user@your.domain.example\n
\nwill not cause a Sender: header to be added if user@your.domain.example\nmatches the actual sender address that is constructed from the login name and\nqualify domain.\n
above.\n"
name: local_from_suffix
type: string
local_interfaces:
default: ~
description: "\nThis option controls which network interfaces are used by the daemon for\nlistening; they are also used to identify the local host when routing. Chapter\n13 contains a full description of this option and the related\noptions daemon_smtp_ports, extra_local_interfaces,\nhosts_treat_as_local, and tls_on_connect_ports. The default value for\nlocal_interfaces is\n
\n\nlocal_interfaces = 0.0.0.0\n
\nwhen Exim is built without IPv6 support; otherwise it is\n
\n\nlocal_interfaces = <; ::0 ; 0.0.0.0\n
\n\n\nThis timeout applies to the local_scan() function (see chapter\n44). Zero means \xE2\x80\x9Cno timeout\xE2\x80\x9D. If the timeout is exceeded,\nthe incoming message is rejected with a temporary error if it is an SMTP\nmessage. For a non-SMTP message, the message is dropped and Exim ends with a\nnon-zero code. The incident is logged on the main and reject logs.\n
"
name: local_scan_timeout
type: time
local_sender_retain:
default: 'false'
description: "\n\nWhen a message is submitted locally (that is, not over a TCP/IP connection) by\nan untrusted user, Exim removes any existing Sender: header line. If you\ndo not want this to happen, you must set local_sender_retain, and you must\nalso set local_from_check to be false (Exim will complain if you do not).\nSee also the ACL modifier control = suppress_local_fixups. Section\n46.16 has more details about Sender: processing.\n
"
name: local_sender_retain
type: boolean
localhost_number:
default: unset
description: "\n\n\n\nExim\xE2\x80\x99s message ids are normally unique only within the local host. If\nuniqueness among a set of hosts is required, each host must set a different\nvalue for the localhost_number option. The string is expanded immediately\nafter reading the configuration file (so that a number can be computed from the\nhost name, for example) and the result of the expansion must be a number in the\nrange 0\xE2\x80\x9316 (or 0\xE2\x80\x9310 on operating systems with case-insensitive file\nsystems). This is available in subsequent string expansions via the variable\n$localhost_number. When localhost_number is set, the final two\ncharacters of the message id, instead of just being a fractional part of the\ntime, are computed from the time and the local host number as described in\nsection 3.4.\n
"
name: localhost_number
type: string
localpartlist:
default: ''
description: This is a Named list definition. Their use is described in section 10.5.
name: localpartlist
type: localpartlist
localpartlist path_safe_localparts:
cpanel_default: \N^\.*[^./][^/]*$\N
log_file_path:
default: ~
description: "\n\nThis option sets the path which is used to determine the names of Exim\xE2\x80\x99s log\nfiles, or indicates that logging is to be to syslog, or both. It is expanded\nwhen Exim is entered, so it can, for example, contain a reference to the host\nname. If no specific path is set for the log files at compile or run time, they\nare written in a sub-directory called log in Exim\xE2\x80\x99s spool directory.\nChapter 51 contains further details about Exim\xE2\x80\x99s logging, and\nsection 51.1 describes how the contents of log_file_path are\nused. If this string is fixed at your installation (contains no expansion\nvariables) it is recommended that you do not set this option in the\nconfiguration file, but instead supply the path using LOG_FILE_PATH in\nLocal/Makefile so that it is available to Exim for logging errors detected\nearly on \xE2\x80\x93 in particular, failure to read the configuration file.\n
"
name: log_file_path
type: stringlist
log_selector:
cpanel_default: +incoming_port +smtp_connection +all_parents +retry_defer +subject +arguments +received_recipients
default: unset
description: "\n\nThis option can be used to reduce or increase the number of things that Exim\nwrites to its log files. Its argument is made up of names preceded by plus or\nminus characters. For example:\n
\n\nlog_selector = +arguments -retry_defer\n
\nA list of possible names and what they control is given in the chapter on\nlogging, in section 51.15.\n
Note that cPanel will always enable these mandatory options in your configuration.
log_selector = +incoming_port +smtp_connection +all_parents
The following default options will also be enabled except when you specify a negative form.
log_selector = +retry_defer +subject +arguments +received_recipients
\n\n\n\nBy default, the timestamps on log lines are in local time without the\ntimezone. This means that if your timezone changes twice a year, the timestamps\nin log lines are ambiguous for an hour when the clocks go back. One way of\navoiding this problem is to set the timezone to UTC. An alternative is to set\nlog_timezone true. This turns on the addition of the timezone offset to\ntimestamps in log lines. Turning on this option can add quite a lot to the size\nof log files because each line is extended by 6 characters. Note that the\n$tod_log variable contains the log timestamp without the zone, but there is\nanother variable called $tod_zone that contains just the timezone offset.\n
"
name: log_timezone
type: boolean
lookup_open_max:
default: 25
description: "\n\n\n\n\n\nThis option limits the number of simultaneously open files for single-key\nlookups that use regular files (that is, lsearch, dbm, and cdb).\nExim normally keeps these files open during routing, because often the same\nfile is required several times. If the limit is reached, Exim closes the least\nrecently used file. Note that if you are using the ndbm library, it\nactually opens two files for each logical DBM database, though it still counts\nas one for the purposes of lookup_open_max. If you are getting \xE2\x80\x9Ctoo many\nopen files\xE2\x80\x9D errors with NDBM, you need to reduce the value of\nlookup_open_max.\n
"
name: lookup_open_max
type: integer
max_username_length:
default: 0
description: "\n\n\n\nSome operating systems are broken in that they truncate long arguments to\ngetpwnam() to eight characters, instead of returning \xE2\x80\x9Cno such user\xE2\x80\x9D. If\nthis option is set greater than zero, any attempt to call getpwnam() with\nan argument that is longer behaves as if getpwnam() failed.\n
"
name: max_username_length
type: integer
message_body_newlines:
cpanel_default: 'true'
default: 'false'
description: "\n\n\n\n\nBy default, newlines in the message body are replaced by spaces when setting\nthe $message_body and $message_body_end expansion variables. If this\noption is set true, this no longer happens.\n
"
name: message_body_newlines
type: bool
message_body_visible:
cpanel_default: 5000
default: 500
description: "\n\n\n\n\nThis option specifies how much of a message\xE2\x80\x99s body is to be included in the\n$message_body and $message_body_end expansion variables.\n
"
name: message_body_visible
type: integer
message_id_header_domain:
default: unset
description: "\n\nIf this option is set, the string is expanded and used as the right hand side\n(domain) of the Message-ID: header that Exim creates if a\nlocally-originated incoming message does not have one. \xE2\x80\x9CLocally-originated\xE2\x80\x9D\nmeans \xE2\x80\x9Cnot received over TCP/IP.\xE2\x80\x9D\nOtherwise, the primary host name is used.\nOnly letters, digits, dot and hyphen are accepted; any other characters are\nreplaced by hyphens. If the expansion is forced to fail, or if the result is an\nempty string, the option is ignored.\n
"
name: message_id_header_domain
type: string
message_id_header_text:
default: unset
description: "\nIf this variable is set, the string is expanded and used to augment the text of\nthe Message-id: header that Exim creates if a locally-originated incoming\nmessage does not have one. The text of this header is required by RFC 2822 to\ntake the form of an address. By default, Exim uses its internal message id as\nthe local part, and the primary host name as the domain. If this option is set,\nit is expanded, and provided the expansion is not forced to fail, and does not\nyield an empty string, the result is inserted into the header immediately\nbefore the @, separated from the internal message id by a dot. Any characters\nthat are illegal in an address are automatically converted into hyphens. This\nmeans that variables such as $tod_log can be used, because the spaces and\ncolons will become hyphens.\n
"
name: message_id_header_text
type: string
message_logs:
default: 'true'
description: "\n\n\nIf this option is turned off, per-message log files are not created in the\nmsglog spool sub-directory. This reduces the amount of disk I/O required by\nExim, by reducing the number of files involved in handling a message from a\nminimum of four (header spool file, body spool file, delivery journal, and\nper-message log) to three. The other major I/O activity is Exim\xE2\x80\x99s main log,\nwhich is not affected by this option.\n
"
name: message_logs
type: boolean
message_size_limit:
default: 50M
description: "\n\n\n\nThis option limits the maximum size of message that Exim will process. The\nvalue is expanded for each incoming connection so, for example, it can be made\nto depend on the IP address of the remote host for messages arriving via\nTCP/IP. After expansion, the value must be a sequence of decimal digits,\noptionally followed by K or M.\n
\n\nNote: This limit cannot be made to depend on a message\xE2\x80\x99s sender or any\nother properties of an individual message, because it has to be advertised in\nthe server\xE2\x80\x99s response to EHLO. String expansion failure causes a temporary\nerror. A value of zero means no limit, but its use is not recommended. See also\nbounce_return_size_limit.\n
\n\nIncoming SMTP messages are failed with a 552 error if the limit is\nexceeded; locally-generated messages either get a stderr message or a delivery\nfailure message to the sender, depending on the -oe setting. Rejection of\nan oversized message is logged in both the main and the reject logs. See also\nthe generic transport option message_size_limit, which limits the size of\nmessage that an individual transport can process.\n
\n\nIf you use a virus-scanner and set this option to to a value larger than the\nmaximum size that your virus-scanner is configured to support, you may get\nfailures triggered by large mails. The right size to configure for the\nvirus-scanner depends upon what data is passed and the options in use but it\xE2\x80\x99s\nprobably safest to just set it to a little larger than this value. Eg, with a\ndefault Exim message size of 50M and a default ClamAV StreamMaxLength of 10M,\nsome problems may result.\n
\n\nA value of 0 will disable size limit checking; Exim will still advertise the\nSIZE extension in an EHLO response, but without a limit, so as to permit\nSMTP clients to still indicate the message size along with the MAIL verb.\n
"
name: message_size_limit
type: string
move_frozen_messages:
default: 'false'
description: "\n\nThis option, which is available only if Exim has been built with the setting\n
\n\nSUPPORT_MOVE_FROZEN_MESSAGES=yes\n
\nin Local/Makefile, causes frozen messages and their message logs to be\nmoved from the input and msglog directories on the spool to Finput\nand Fmsglog, respectively. There is currently no support in Exim or the\nstandard utilities for handling such moved messages, and they do not show up in\nlists generated by -bp or by the Exim monitor.\n
"
name: move_frozen_messages
type: boolean
mua_wrapper:
default: 'false'
description: "\nSetting this option true causes Exim to run in a very restrictive mode in which\nit passes messages synchronously to a smart host. Chapter 50\ncontains a full description of this facility.\n
"
name: mua_wrapper
type: boolean
mysql_servers:
default: unset
description: "\n\nThis option provides a list of MySQL servers and associated connection data, to\nbe used in conjunction with mysql lookups (see section 9.21). The\noption is available only if Exim has been built with MySQL support.\n
"
name: mysql_servers
type: stringlist
never_users:
cpanel_default: root
default: unset
description: "\nThis option is expanded just once, at the start of Exim\xE2\x80\x99s processing. Local\nmessage deliveries are normally run in processes that are setuid to the\nrecipient, and remote deliveries are normally run under Exim\xE2\x80\x99s own uid and gid.\nIt is usually desirable to prevent any deliveries from running as root, as a\nsafety precaution.\n
\n\nWhen Exim is built, an option called FIXED_NEVER_USERS can be set to a\nlist of users that must not be used for local deliveries. This list is fixed in\nthe binary and cannot be overridden by the configuration file. By default, it\ncontains just the single user name \xE2\x80\x9Croot\xE2\x80\x9D. The never_users runtime option\ncan be used to add more users to the fixed list.\n
\n\nIf a message is to be delivered as one of the users on the fixed list or the\nnever_users list, an error occurs, and delivery is deferred. A common\nexample is\n
\n\nnever_users = root:daemon:bin\n
\nIncluding root is redundant if it is also on the fixed list, but it does no\nharm. This option overrides the pipe_as_creator option of the pipe\ntransport driver.\n
"
name: never_users
type: stringlist
openssl_options:
cpanel_default: +no_sslv2 +no_sslv3 +no_tlsv1 +no_tlsv1_1
default: +no_sslv2
description: "\n\nThis option allows an administrator to adjust the SSL options applied\nby OpenSSL to connections. It is given as a space-separated list of items,\neach one to be +added or -subtracted from the current value.\n
\n\nThis option is only available if Exim is built against OpenSSL. The values\navailable for this option vary according to the age of your OpenSSL install.\nThe \xE2\x80\x9Call\xE2\x80\x9D value controls a subset of flags which are available, typically\nthe bug workaround options. The SSL_CTX_set_options man page will\nlist the values known on your system and Exim should support all the\n\xE2\x80\x9Cbug workaround\xE2\x80\x9D options and many of the \xE2\x80\x9Cmodifying\xE2\x80\x9D options. The Exim\nnames lose the leading \xE2\x80\x9CSSL_OP_\xE2\x80\x9D and are lower-cased.\n
\n\nNote that adjusting the options can have severe impact upon the security of\nSSL as used by Exim. It is possible to disable safety checks and shoot\nyourself in the foot in various unpleasant ways. This option should not be\nadjusted lightly. An unrecognised item will be detected at startup, by\ninvoking Exim with the -bV flag.\n
\n\nHistorical note: prior to release 4.80, Exim defaulted this value to\n\"+dont_insert_empty_fragments\", which may still be needed for compatibility\nwith some clients, but which lowers security by increasing exposure to\nsome now infamous attacks.\n
\n\nAn example:\n
\n\n# Make both old MS and old Eudora happy:\nopenssl_options = -all +microsoft_big_sslv3_buffer \\\n +dont_insert_empty_fragments\n
\nPossible options may include:\n
\n\n- \n
\nall\n
\n \n- \n
\nallow_unsafe_legacy_renegotiation\n
\n \n- \n
\ncipher_server_preference\n
\n \n- \n
\ndont_insert_empty_fragments\n
\n \n- \n
\nephemeral_rsa\n
\n \n- \n
\nlegacy_server_connect\n
\n \n- \n
\nmicrosoft_big_sslv3_buffer\n
\n \n- \n
\nmicrosoft_sess_id_bug\n
\n \n- \n
\nmsie_sslv2_rsa_padding\n
\n \n- \n
\nnetscape_challenge_bug\n
\n \n- \n
\nnetscape_reuse_cipher_change_bug\n
\n \n- \n
\nno_compression\n
\n \n- \n
\nno_session_resumption_on_renegotiation\n
\n \n- \n
\nno_sslv2\n
\n \n- \n
\nno_sslv3\n
\n \n- \n
\nno_ticket\n
\n \n- \n
\nno_tlsv1\n
\n \n- \n
\nno_tlsv1_1\n
\n \n- \n
\nno_tlsv1_2\n
\n \n- \n
\nsingle_dh_use\n
\n \n- \n
\nsingle_ecdh_use\n
\n \n- \n
\nssleay_080_client_dh_bug\n
\n \n- \n
\nsslref2_reuse_cert_type_bug\n
\n \n- \n
\ntls_block_padding_bug\n
\n \n- \n
\ntls_d5_bug\n
\n \n- \n
\ntls_rollback_bug\n
\n \n
"
name: openssl_options
type: stringlist
oracle_servers:
default: unset
description: "\n\nThis option provides a list of Oracle servers and associated connection data,\nto be used in conjunction with oracle lookups (see section 9.21).\nThe option is available only if Exim has been built with Oracle support.\n
"
name: oracle_servers
type: stringlist
percent_hack_domains:
default: unset
description: "\n\n\n\nThe \xE2\x80\x9Cpercent hack\xE2\x80\x9D is the convention whereby a local part containing a\npercent sign is re-interpreted as a new email address, with the percent\nreplaced by @. This is sometimes called \xE2\x80\x9Csource routing\xE2\x80\x9D, though that term is\nalso applied to RFC 2822 addresses that begin with an @ character. If this\noption is set, Exim implements the percent facility for those domains listed,\nbut no others. This happens before an incoming SMTP address is tested against\nan ACL.\n
\n\nWarning: The \xE2\x80\x9Cpercent hack\xE2\x80\x9D has often been abused by people who are\ntrying to get round relaying restrictions. For this reason, it is best avoided\nif at all possible. Unfortunately, a number of less security-conscious MTAs\nimplement it unconditionally. If you are running Exim on a gateway host, and\nrouting mail through to internal MTAs without processing the local parts, it is\na good idea to reject recipient addresses with percent characters in their\nlocal parts. Exim\xE2\x80\x99s default configuration does this.\n
"
name: percent_hack_domains
type: domainlist
perl_at_start:
default: 'false'
description: "\nThis option is available only when Exim is built with an embedded Perl\ninterpreter. See chapter 12 for details of its use.\n
"
name: perl_at_start
type: boolean
perl_startup:
cpanel_default: do '/etc/exim.pl'
default: unset
description: "\nThis option is available only when Exim is built with an embedded Perl\ninterpreter. See chapter 12 for details of its use.\n
"
name: perl_startup
type: string
pgsql_servers:
default: unset
description: "\n\nThis option provides a list of PostgreSQL servers and associated connection\ndata, to be used in conjunction with pgsql lookups (see section\n9.21). The option is available only if Exim has been built with\nPostgreSQL support.\n
"
name: pgsql_servers
type: stringlist
pid_file_path:
default: ~
description: "\n\n\nThis option sets the name of the file to which the Exim daemon writes its\nprocess id. The string is expanded, so it can contain, for example, references\nto the host name:\n
\n\npid_file_path = /var/log/$primary_hostname/exim.pid\n
\nIf no path is set, the pid is written to the file exim-daemon.pid in Exim\xE2\x80\x99s\nspool directory.\nThe value set by the option can be overridden by the -oP command line\noption. A pid file is not written if a \xE2\x80\x9Cnon-standard\xE2\x80\x9D daemon is run by means\nof the -oX option, unless a path is explicitly supplied by -oP.\n
"
name: pid_file_path
type: string
pipelining_advertise_hosts:
default: "*"
description: "\n\nThis option can be used to suppress the advertisement of the SMTP\nPIPELINING extension to specific hosts. See also the no_pipelining\ncontrol in section 42.21. When PIPELINING is not advertised and\nsmtp_enforce_sync is true, an Exim server enforces strict synchronization\nfor each SMTP command and response. When PIPELINING is advertised, Exim assumes\nthat clients will use it; \xE2\x80\x9Cout of order\xE2\x80\x9D commands that are \xE2\x80\x9Cexpected\xE2\x80\x9D do\nnot count as protocol errors (see smtp_max_synprot_errors).\n
"
name: pipelining_advertise_hosts
type: hostlist
preserve_message_logs:
default: 'false'
description: "\n\nIf this option is set, message log files are not deleted when messages are\ncompleted. Instead, they are moved to a sub-directory of the spool directory\ncalled msglog.OLD, where they remain available for statistical or debugging\npurposes. This is a dangerous option to set on systems with any appreciable\nvolume of mail. Use with care!\n
"
name: preserve_message_logs
type: boolean
primary_hostname:
default: ~
description: "\n\n\n\n\nThis specifies the name of the current host. It is used in the default EHLO or\nHELO command for outgoing SMTP messages (changeable via the helo_data\noption in the smtp transport), and as the default for qualify_domain.\nThe value is also used by default in some SMTP response messages from an Exim\nserver. This can be changed dynamically by setting smtp_active_hostname.\n
\n\nIf primary_hostname is not set, Exim calls uname() to find the host\nname. If this fails, Exim panics and dies. If the name returned by uname()\ncontains only one component, Exim passes it to gethostbyname() (or\ngetipnodebyname() when available) in order to obtain the fully qualified\nversion. The variable $primary_hostname contains the host name, whether set\nexplicitly by this option, or defaulted.\n
"
name: primary_hostname
type: string
print_topbitchars:
default: 'false'
description: "\n\n\nBy default, Exim considers only those characters whose codes lie in the range\n32\xE2\x80\x93126 to be printing characters. In a number of circumstances (for example,\nwhen writing log entries) non-printing characters are converted into escape\nsequences, primarily to avoid messing up the layout. If print_topbitchars\nis set, code values of 128 and above are also considered to be printing\ncharacters.\n
\n\nThis option also affects the header syntax checks performed by the\nautoreply transport, and whether Exim uses RFC 2047 encoding of\nthe user\xE2\x80\x99s full name when constructing From: and Sender: addresses (as\ndescribed in section 46.18). Setting this option can cause\nExim to generate eight bit message headers that do not conform to the\nstandards.\n
"
name: print_topbitchars
type: boolean
process_log_path:
default: unset
description: "\n\n\n\nThis option sets the name of the file to which an Exim process writes its\n\xE2\x80\x9Cprocess log\xE2\x80\x9D when sent a USR1 signal. This is used by the exiwhat\nutility script. If this option is unset, the file called exim-process.info\nin Exim\xE2\x80\x99s spool directory is used. The ability to specify the name explicitly\ncan be useful in environments where two different Exims are running, using\ndifferent spool directories.\n
"
name: process_log_path
type: string
prod_requires_admin:
default: 'true'
description: "\n\n\n\nThe -M, -R, and -q command-line options require the caller to be an\nadmin user unless prod_requires_admin is set false. See also\nqueue_list_requires_admin.\n
"
name: prod_requires_admin
type: boolean
qualify_domain:
default: ~
description: "\n\n\nThis option specifies the domain name that is added to any envelope sender\naddresses that do not have a domain qualification. It also applies to\nrecipient addresses if qualify_recipient is not set. Unqualified addresses\nare accepted by default only for locally-generated messages. Qualification is\nalso applied to addresses in header lines such as From: and To: for\nlocally-generated messages, unless the -bnq command line option is used.\n
\n\nMessages from external sources must always contain fully qualified addresses,\nunless the sending host matches sender_unqualified_hosts or\nrecipient_unqualified_hosts (as appropriate), in which case incoming\naddresses are qualified with qualify_domain or qualify_recipient as\nnecessary. Internally, Exim always works with fully qualified envelope\naddresses. If qualify_domain is not set, it defaults to the\nprimary_hostname value.\n
"
name: qualify_domain
type: string
qualify_recipient:
default: ~
description: "\nThis option allows you to specify a different domain for qualifying recipient\naddresses to the one that is used for senders.
\n\n\nThis option specifies the domain name that is added to any envelope sender\naddresses that do not have a domain qualification. It also applies to\nrecipient addresses if qualify_recipient is not set. Unqualified addresses\nare accepted by default only for locally-generated messages. Qualification is\nalso applied to addresses in header lines such as From: and To: for\nlocally-generated messages, unless the -bnq command line option is used.\n
\n\nMessages from external sources must always contain fully qualified addresses,\nunless the sending host matches sender_unqualified_hosts or\nrecipient_unqualified_hosts (as appropriate), in which case incoming\naddresses are qualified with qualify_domain or qualify_recipient as\nnecessary. Internally, Exim always works with fully qualified envelope\naddresses. If qualify_domain is not set, it defaults to the\nprimary_hostname value.\n
above.\n"
name: qualify_recipient
type: string
queue_domains:
default: unset
description: "\n\n\n\nThis option lists domains for which immediate delivery is not required.\nA delivery process is started whenever a message is received, but only those\ndomains that do not match are processed. All other deliveries wait until the\nnext queue run. See also hold_domains and queue_smtp_domains.\n
"
name: queue_domains
type: domainlist
queue_list_requires_admin:
default: 'true'
description: "\n\nThe -bp command-line option, which lists the messages that are on the\nqueue, requires the caller to be an admin user unless\nqueue_list_requires_admin is set false. See also prod_requires_admin.\n
"
name: queue_list_requires_admin
type: boolean
queue_only:
default: 'false'
description: "\n\n\nIf queue_only is set, a delivery process is not automatically started\nwhenever a message is received. Instead, the message waits on the queue for the\nnext queue run. Even if queue_only is false, incoming messages may not get\ndelivered immediately when certain conditions (such as heavy load) occur.\n
\n\nThe -odq command line has the same effect as queue_only. The -odb\nand -odi command line options override queue_only unless\nqueue_only_override is set false. See also queue_only_file,\nqueue_only_load, and smtp_accept_queue.\n
"
name: queue_only
type: boolean
queue_only_file:
default: unset
description: "\n\n\nThis option can be set to a colon-separated list of absolute path names, each\none optionally preceded by \xE2\x80\x9Csmtp\xE2\x80\x9D. When Exim is receiving a message,\nit tests for the existence of each listed path using a call to stat(). For\neach path that exists, the corresponding queueing option is set.\nFor paths with no prefix, queue_only is set; for paths prefixed by\n\xE2\x80\x9Csmtp\xE2\x80\x9D, queue_smtp_domains is set to match all domains. So, for example,\n
\n\nqueue_only_file = smtp/some/file\n
\ncauses Exim to behave as if queue_smtp_domains were set to \xE2\x80\x9C*\xE2\x80\x9D whenever\n/some/file exists.\n
"
name: queue_only_file
type: string
queue_only_load:
cpanel_default: 36
default: unset
description: "\n\n\n\nIf the system load average is higher than this value, incoming messages from\nall sources are queued, and no automatic deliveries are started. If this\nhappens during local or remote SMTP input, all subsequent messages received on\nthe same SMTP connection are queued by default, whatever happens to the load in\nthe meantime, but this can be changed by setting queue_only_load_latch\nfalse.\n
\n\nDeliveries will subsequently be performed by queue runner processes. This\noption has no effect on ancient operating systems on which Exim cannot\ndetermine the load average. See also deliver_queue_load_max and\nsmtp_load_reserve.\n
"
name: queue_only_load
type: fixedpoint
queue_only_load_latch:
default: 'true'
description: "\n\nWhen this option is true (the default), once one message has been queued\nbecause the load average is higher than the value set by queue_only_load,\nall subsequent messages received on the same SMTP connection are also queued.\nThis is a deliberate choice; even though the load average may fall below the\nthreshold, it doesn\xE2\x80\x99t seem right to deliver later messages on the same\nconnection when not delivering earlier ones. However, there are special\ncircumstances such as very long-lived connections from scanning appliances\nwhere this is not the best strategy. In such cases, queue_only_load_latch\nshould be set false. This causes the value of the load average to be\nre-evaluated for each message.\n
"
name: queue_only_load_latch
type: boolean
queue_only_override:
default: 'true'
description: "\n\nWhen this option is true, the -odx command line options override the\nsetting of queue_only or queue_only_file in the configuration file. If\nqueue_only_override is set false, the -odx options cannot be used\nto override; they are accepted, but ignored.\n
"
name: queue_only_override
type: boolean
queue_run_in_order:
default: 'false'
description: "\n\nIf this option is set, queue runs happen in order of message arrival instead of\nin an arbitrary order. For this to happen, a complete list of the entire queue\nmust be set up before the deliveries start. When the queue is all held in a\nsingle directory (the default), a single list is created for both the ordered\nand the non-ordered cases. However, if split_spool_directory is set, a\nsingle list is not created when queue_run_in_order is false. In this case,\nthe sub-directories are processed one at a time (in a random order), and this\navoids setting up one huge list for the whole queue. Thus, setting\nqueue_run_in_order with split_spool_directory may degrade performance\nwhen the queue is large, because of the extra work in setting up the single,\nlarge list. In most situations, queue_run_in_order should not be set.\n
"
name: queue_run_in_order
type: boolean
queue_run_max:
default: 5
description: "\n\nThis controls the maximum number of queue runner processes that an Exim daemon\ncan run simultaneously. This does not mean that it starts them all at once,\nbut rather that if the maximum number are still running when the time comes to\nstart another one, it refrains from starting another one. This can happen with\nvery large queues and/or very sluggish deliveries. This option does not,\nhowever, interlock with other processes, so additional queue runners can be\nstarted by other means, or by killing and restarting the daemon.\n
\n\nSetting this option to zero does not suppress queue runs; rather, it disables\nthe limit, allowing any number of simultaneous queue runner processes to be\nrun. If you do not want queue runs to occur, omit the -qxx setting on\nthe daemon\xE2\x80\x99s command line.\n
"
name: queue_run_max
type: integer
queue_smtp_domains:
default: unset
description: "\n\n\nWhen this option is set, a delivery process is started whenever a message is\nreceived, routing is performed, and local deliveries take place.\nHowever, if any SMTP deliveries are required for domains that match\nqueue_smtp_domains, they are not immediately delivered, but instead the\nmessage waits on the queue for the next queue run. Since routing of the message\nhas taken place, Exim knows to which remote hosts it must be delivered, and so\nwhen the queue run happens, multiple messages for the same host are delivered\nover a single SMTP connection. The -odqs command line option causes all\nSMTP deliveries to be queued in this way, and is equivalent to setting\nqueue_smtp_domains to \xE2\x80\x9C*\xE2\x80\x9D. See also hold_domains and\nqueue_domains.\n
"
name: queue_smtp_domains
type: domainlist
receive_timeout:
default: 0s
description: "\n\nThis option sets the timeout for accepting a non-SMTP message, that is, the\nmaximum time that Exim waits when reading a message on the standard input. If\nthe value is zero, it will wait for ever. This setting is overridden by the\n-or command line option. The timeout for incoming SMTP messages is\ncontrolled by smtp_receive_timeout.\n
"
name: receive_timeout
type: time
received_header_text:
default: ~
description: "\n\n\nThis string defines the contents of the Received: message header that is\nadded to each message, except for the timestamp, which is automatically added\non at the end (preceded by a semicolon). The string is expanded each time it is\nused. If the expansion yields an empty string, no Received: header line is\nadded to the message. Otherwise, the string should start with the text\n\xE2\x80\x9CReceived:\xE2\x80\x9D and conform to the RFC 2822 specification for Received:\nheader lines. The default setting is:\n
\n\nreceived_header_text = Received: \\\n ${if def:sender_rcvhost {from $sender_rcvhost\\n\\t}\\\n {${if def:sender_ident \\\n {from ${quote_local_part:$sender_ident} }}\\\n ${if def:sender_helo_name {(helo=$sender_helo_name)\\n\\t}}}}\\\n by $primary_hostname \\\n ${if def:received_protocol {with $received_protocol}} \\\n ${if def:tls_cipher {($tls_cipher)\\n\\t}}\\\n (Exim $version_number)\\n\\t\\\n ${if def:sender_address \\\n {(envelope-from <$sender_address>)\\n\\t}}\\\n id $message_exim_id\\\n ${if def:received_for {\\n\\tfor $received_for}}\n\nThe reference to the TLS cipher is omitted when Exim is built without TLS\nsupport. The use of conditional expansions ensures that this works for both\nlocally generated messages and messages received from remote hosts, giving\nheader lines such as the following:\n
\n\nReceived: from scrooge.carol.example ([192.168.12.25] ident=root)\nby marley.carol.example with esmtp (Exim 4.00)\n(envelope-from )\nid 16IOWa-00019l-00\nfor chas@dickens.example; Tue, 25 Dec 2001 14:43:44 +0000\nReceived: by scrooge.carol.example with local (Exim 4.00)\nid 16IOWW-000083-00; Tue, 25 Dec 2001 14:43:41 +0000\n
\nUntil the body of the message has been received, the timestamp is the time when\nthe message started to be received. Once the body has arrived, and all policy\nchecks have taken place, the timestamp is updated to the time at which the\nmessage was accepted.\n
"
name: received_header_text
type: string
received_headers_max:
default: 30
description: "\n\n\n\nWhen a message is to be delivered, the number of Received: headers is\ncounted, and if it is greater than this parameter, a mail loop is assumed to\nhave occurred, the delivery is abandoned, and an error message is generated.\nThis applies to both local and remote deliveries.\n
"
name: received_headers_max
type: integer
recipient_unqualified_hosts:
default: unset
description: "\n\n\nThis option lists those hosts from which Exim is prepared to accept unqualified\nrecipient addresses in message envelopes. The addresses are made fully\nqualified by the addition of the qualify_recipient value. This option also\naffects message header lines. Exim does not reject unqualified recipient\naddresses in headers, but it qualifies them only if the message came from a\nhost that matches recipient_unqualified_hosts,\nor if the message was submitted locally (not using TCP/IP), and the -bnq\noption was not set.\n
"
name: recipient_unqualified_hosts
type: hostlist
recipients_max:
default: 0
description: "\n\n\nIf this option is set greater than zero, it specifies the maximum number of\noriginal recipients for any message. Additional recipients that are generated\nby aliasing or forwarding do not count. SMTP messages get a 452 response for\nall recipients over the limit; earlier recipients are delivered as normal.\nNon-SMTP messages with too many recipients are failed, and no deliveries are\ndone.\n
\n\n\nNote: The RFCs specify that an SMTP server should accept at least 100\nRCPT commands in a single message.\n
"
name: recipients_max
type: integer
recipients_max_reject:
default: 'false'
description: "\nIf this option is set true, Exim rejects SMTP messages containing too many\nrecipients by giving 552 errors to the surplus RCPT commands, and a 554\nerror to the eventual DATA command. Otherwise (the default) it gives a 452\nerror to the surplus RCPT commands and accepts the message on behalf of the\ninitial set of recipients. The remote server should then re-send the message\nfor the remaining recipients at a later time.\n
"
name: recipients_max_reject
type: boolean
remote_max_parallel:
cpanel_default: 10
default: 2
description: "\n\nThis option controls parallel delivery of one message to a number of remote\nhosts. If the value is less than 2, parallel delivery is disabled, and Exim\ndoes all the remote deliveries for a message one by one. Otherwise, if a single\nmessage has to be delivered to more than one remote host, or if several copies\nhave to be sent to the same remote host, up to remote_max_parallel\ndeliveries are done simultaneously. If more than remote_max_parallel\ndeliveries are required, the maximum number of processes are started, and as\neach one finishes, another is begun. The order of starting processes is the\nsame as if sequential delivery were being done, and can be controlled by the\nremote_sort_domains option. If parallel delivery takes place while running\nwith debugging turned on, the debugging output from each delivery process is\ntagged with its process id.\n
\n\nThis option controls only the maximum number of parallel deliveries for one\nmessage in one Exim delivery process. Because Exim has no central queue\nmanager, there is no way of controlling the total number of simultaneous\ndeliveries if the configuration allows a delivery attempt as soon as a message\nis received.\n
\n\n\n\nIf you want to control the total number of deliveries on the system, you\nneed to set the queue_only option. This ensures that all incoming messages\nare added to the queue without starting a delivery process. Then set up an Exim\ndaemon to start queue runner processes at appropriate intervals (probably\nfairly often, for example, every minute), and limit the total number of queue\nrunners by setting the queue_run_max parameter. Because each queue runner\ndelivers only one message at a time, the maximum number of deliveries that can\nthen take place at once is queue_run_max multiplied by\nremote_max_parallel.\n
\n\nIf it is purely remote deliveries you want to control, use\nqueue_smtp_domains instead of queue_only. This has the added benefit of\ndoing the SMTP routing before queueing, so that several messages for the same\nhost will eventually get delivered down the same connection.\n
"
name: remote_max_parallel
type: integer
remote_sort_domains:
default: unset
description: "\n\n\nWhen there are a number of remote deliveries for a message, they are sorted by\ndomain into the order given by this list. For example,\n
\n\nremote_sort_domains = *.cam.ac.uk:*.uk\n
\nwould attempt to deliver to all addresses in the cam.ac.uk domain first,\nthen to those in the uk domain, then to any others.\n
"
name: remote_sort_domains
type: domainlist
retry_data_expire:
default: 7d
description: "\n\nThis option sets a \xE2\x80\x9Cuse before\xE2\x80\x9D time on retry information in Exim\xE2\x80\x99s hints\ndatabase. Any older retry data is ignored. This means that, for example, once a\nhost has not been tried for 7 days, Exim behaves as if it has no knowledge of\npast failures.\n
"
name: retry_data_expire
type: time
retry_interval_max:
default: 24h
description: "\n\n\nChapter 32 describes Exim\xE2\x80\x99s mechanisms for controlling the\nintervals between delivery attempts for messages that cannot be delivered\nstraight away. This option sets an overall limit to the length of time between\nretries. It cannot be set greater than 24 hours; any attempt to do so forces\nthe default value.\n
"
name: retry_interval_max
type: time
return_path_remove:
default: 'true'
description: "\n\nRFC 2821, section 4.4, states that an SMTP server must insert a\nReturn-path: header line into a message when it makes a \xE2\x80\x9Cfinal delivery\xE2\x80\x9D.\nThe Return-path: header preserves the sender address as received in the\nMAIL command. This description implies that this header should not be present\nin an incoming message. If return_path_remove is true, any existing\nReturn-path: headers are removed from messages at the time they are\nreceived. Exim\xE2\x80\x99s transports have options for adding Return-path: headers at\nthe time of delivery. They are normally used only for final local deliveries.\n
"
name: return_path_remove
type: boolean
return_size_limit:
default: 100K
description: "\nThis option is an obsolete synonym for bounce_return_size_limit.\n
"
name: return_size_limit
type: integer
rfc1413_hosts:
default: "*"
description: "\n\n\nRFC 1413 identification calls are made to any client host which matches an item\nin the list.\n
"
name: rfc1413_hosts
type: hostlist
rfc1413_query_timeout:
cpanel_default: 0s
default: 5s
description: "\n\n\nThis sets the timeout on RFC 1413 identification calls. If it is set to zero,\nno RFC 1413 calls are ever made.\n
"
name: rfc1413_query_timeout
type: time
sender_unqualified_hosts:
default: unset
description: "\n\n\nThis option lists those hosts from which Exim is prepared to accept unqualified\nsender addresses. The addresses are made fully qualified by the addition of\nqualify_domain. This option also affects message header lines. Exim does\nnot reject unqualified addresses in headers that contain sender addresses, but\nit qualifies them only if the message came from a host that matches\nsender_unqualified_hosts, or if the message was submitted locally (not\nusing TCP/IP), and the -bnq option was not set.\n
"
name: sender_unqualified_hosts
type: hostlist
smtp_accept_keepalive:
default: 'true'
description: "\n\nThis option controls the setting of the SO_KEEPALIVE option on incoming\nTCP/IP socket connections. When set, it causes the kernel to probe idle\nconnections periodically, by sending packets with \xE2\x80\x9Cold\xE2\x80\x9D sequence numbers. The\nother end of the connection should send an acknowledgment if the connection is\nstill okay or a reset if the connection has been aborted. The reason for doing\nthis is that it has the beneficial effect of freeing up certain types of\nconnection that can get stuck when the remote host is disconnected without\ntidying up the TCP/IP call properly. The keepalive mechanism takes several\nhours to detect unreachable hosts.\n
"
name: smtp_accept_keepalive
type: boolean
smtp_accept_max:
cpanel_default: 100
default: 20
description: "\n\n\n\nThis option specifies the maximum number of simultaneous incoming SMTP calls\nthat Exim will accept. It applies only to the listening daemon; there is no\ncontrol (in Exim) when incoming SMTP is being handled by inetd. If the\nvalue is set to zero, no limit is applied. However, it is required to be\nnon-zero if either smtp_accept_max_per_host or smtp_accept_queue is\nset. See also smtp_accept_reserve and smtp_load_reserve.\n
\n\nA new SMTP connection is immediately rejected if the smtp_accept_max limit\nhas been reached. If not, Exim first checks smtp_accept_max_per_host. If\nthat limit has not been reached for the client host, smtp_accept_reserve\nand smtp_load_reserve are then checked before accepting the connection.\n
"
name: smtp_accept_max
type: integer
smtp_accept_max_nonmail:
default: 10
description: "\n\n\nExim counts the number of \xE2\x80\x9Cnon-mail\xE2\x80\x9D commands in an SMTP session, and drops\nthe connection if there are too many. This option defines \xE2\x80\x9Ctoo many\xE2\x80\x9D. The\ncheck catches some denial-of-service attacks, repeated failing AUTHs, or a mad\nclient looping sending EHLO, for example. The check is applied only if the\nclient host matches smtp_accept_max_nonmail_hosts.\n
\n\nWhen a new message is expected, one occurrence of RSET is not counted. This\nallows a client to send one RSET between messages (this is not necessary,\nbut some clients do it). Exim also allows one uncounted occurrence of HELO\nor EHLO, and one occurrence of STARTTLS between messages. After\nstarting up a TLS session, another EHLO is expected, and so it too is not\ncounted. The first occurrence of AUTH in a connection, or immediately\nfollowing STARTTLS is not counted. Otherwise, all commands other than\nMAIL, RCPT, DATA, and QUIT are counted.\n
"
name: smtp_accept_max_nonmail
type: integer
smtp_accept_max_nonmail_hosts:
default: "*"
description: "\nYou can control which hosts are subject to the smtp_accept_max_nonmail\ncheck by setting this option. The default value makes it apply to all hosts. By\nchanging the value, you can exclude any badly-behaved hosts that you have to\nlive with.\n
"
name: smtp_accept_max_nonmail_hosts
type: hostlist
smtp_accept_max_per_connection:
default: 1000
description: "\n\n\nThe value of this option limits the number of MAIL commands that Exim is\nprepared to accept over a single SMTP connection, whether or not each command\nresults in the transfer of a message. After the limit is reached, a 421\nresponse is given to subsequent MAIL commands. This limit is a safety\nprecaution against a client that goes mad (incidents of this type have been\nseen).\n
"
name: smtp_accept_max_per_connection
type: integer
smtp_accept_max_per_host:
default: unset
description: "\n\n\nThis option restricts the number of simultaneous IP connections from a single\nhost (strictly, from a single IP address) to the Exim daemon. The option is\nexpanded, to enable different limits to be applied to different hosts by\nreference to $sender_host_address. Once the limit is reached, additional\nconnection attempts from the same host are rejected with error code 421. This\nis entirely independent of smtp_accept_reserve. The option\xE2\x80\x99s default value\nof zero imposes no limit. If this option is set greater than zero, it is\nrequired that smtp_accept_max be non-zero.\n
\n\nWarning: When setting this option you should not use any expansion\nconstructions that take an appreciable amount of time. The expansion and test\nhappen in the main daemon loop, in order to reject additional connections\nwithout forking additional processes (otherwise a denial-of-service attack\ncould cause a vast number or processes to be created). While the daemon is\ndoing this processing, it cannot accept any other incoming connections.\n
"
name: smtp_accept_max_per_host
type: string
smtp_accept_queue:
default: 0
description: "\n\n\n\nIf the number of simultaneous incoming SMTP connections being handled via the\nlistening daemon exceeds this value, messages received by SMTP are just placed\non the queue; no delivery processes are started automatically. The count is\nfixed at the start of an SMTP connection. It cannot be updated in the\nsubprocess that receives messages, and so the queueing or not queueing applies\nto all messages received in the same connection.\n
\n\nA value of zero implies no limit, and clearly any non-zero value is useful only\nif it is less than the smtp_accept_max value (unless that is zero). See\nalso queue_only, queue_only_load, queue_smtp_domains, and the\nvarious -odx command line options.\n
"
name: smtp_accept_queue
type: integer
smtp_accept_queue_per_connection:
cpanel_default: 30
default: 10
description: "\n\n\nThis option limits the number of delivery processes that Exim starts\nautomatically when receiving messages via SMTP, whether via the daemon or by\nthe use of -bs or -bS. If the value of the option is greater than zero,\nand the number of messages received in a single SMTP session exceeds this\nnumber, subsequent messages are placed on the queue, but no delivery processes\nare started. This helps to limit the number of Exim processes when a server\nrestarts after downtime and there is a lot of mail waiting for it on other\nsystems. On large systems, the default should probably be increased, and on\ndial-in client systems it should probably be set to zero (that is, disabled).\n
"
name: smtp_accept_queue_per_connection
type: integer
smtp_accept_reserve:
default: 0
description: "\n\n\nWhen smtp_accept_max is set greater than zero, this option specifies a\nnumber of SMTP connections that are reserved for connections from the hosts\nthat are specified in smtp_reserve_hosts. The value set in\nsmtp_accept_max includes this reserve pool. The specified hosts are not\nrestricted to this number of connections; the option specifies a minimum number\nof connection slots for them, not a maximum. It is a guarantee that this group\nof hosts can always get at least smtp_accept_reserve connections. However,\nthe limit specified by smtp_accept_max_per_host is still applied to each\nindividual host.\n
\n\nFor example, if smtp_accept_max is set to 50 and smtp_accept_reserve is\nset to 5, once there are 45 active connections (from any hosts), new\nconnections are accepted only from hosts listed in smtp_reserve_hosts,\nprovided the other criteria for acceptance are met.\n
"
name: smtp_accept_reserve
type: integer
smtp_active_hostname:
default: unset
description: "\n\n\n\nThis option is provided for multi-homed servers that want to masquerade as\nseveral different hosts. At the start of an incoming SMTP connection, its value\nis expanded and used instead of the value of $primary_hostname in SMTP\nresponses. For example, it is used as domain name in the response to an\nincoming HELO or EHLO command.\n
\n\n\nThe active hostname is placed in the $smtp_active_hostname variable, which\nis saved with any messages that are received. It is therefore available for use\nin routers and transports when the message is later delivered.\n
\n\nIf this option is unset, or if its expansion is forced to fail, or if the\nexpansion results in an empty string, the value of $primary_hostname is\nused. Other expansion failures cause a message to be written to the main and\npanic logs, and the SMTP command receives a temporary error. Typically, the\nvalue of smtp_active_hostname depends on the incoming interface address.\nFor example:\n
\n\nsmtp_active_hostname = ${if eq{$received_ip_address}{10.0.0.1}\\\n {cox.mydomain}{box.mydomain}}\n\nAlthough $smtp_active_hostname is primarily concerned with incoming\nmessages, it is also used as the default for HELO commands in callout\nverification if there is no remote transport from which to obtain a\nhelo_data value.\n
"
name: smtp_active_hostname
type: string
smtp_banner:
cpanel_default: "\"${primary_hostname} ESMTP Exim ${version_number} \\#${compile_number} ${tod_full} \\n We do not authorize the use of this system to transport unsolicited, \\n and/or bulk e-mail.\""
default: ~
description: "\n\n\n\n\nThis string, which is expanded every time it is used, is output as the initial\npositive response to an SMTP connection. The default setting is:\n
\n\nsmtp_banner = $smtp_active_hostname ESMTP Exim \\\n $version_number $tod_full\n
\nFailure to expand the string causes a panic error. If you want to create a\nmultiline response to the initial SMTP connection, use \xE2\x80\x9C\\n\xE2\x80\x9D in the string at\nappropriate points, but not at the end. Note that the 220 code is not included\nin this string. Exim adds it automatically (several times in the case of a\nmultiline response).\n
"
name: smtp_banner
type: string
smtp_check_spool_space:
default: 'true'
description: "\n\n\n\nWhen this option is set, if an incoming SMTP session encounters the SIZE\noption on a MAIL command, it checks that there is enough space in the\nspool directory\xE2\x80\x99s partition to accept a message of that size, while still\nleaving free the amount specified by check_spool_space (even if that value\nis zero). If there isn\xE2\x80\x99t enough space, a temporary error code is returned.\n
"
name: smtp_check_spool_space
type: boolean
smtp_connect_backlog:
cpanel_default: 50
default: 20
description: "\n\n\n\nThis option specifies a maximum number of waiting SMTP connections. Exim passes\nthis value to the TCP/IP system when it sets up its listener. Once this number\nof connections are waiting for the daemon\xE2\x80\x99s attention, subsequent connection\nattempts are refused at the TCP/IP level. At least, that is what the manuals\nsay; in some circumstances such connection attempts have been observed to time\nout instead. For large systems it is probably a good idea to increase the\nvalue (to 50, say). It also gives some protection against denial-of-service\nattacks by SYN flooding.\n
"
name: smtp_connect_backlog
type: integer
smtp_enforce_sync:
cpanel_default: 'false'
default: 'true'
description: "\n\n\nThe SMTP protocol specification requires the client to wait for a response from\nthe server at certain points in the dialogue. Without PIPELINING these\nsynchronization points are after every command; with PIPELINING they are\nfewer, but they still exist.\n
\n\nSome spamming sites send out a complete set of SMTP commands without waiting\nfor any response. Exim protects against this by rejecting a message if the\nclient has sent further input when it should not have. The error response \xE2\x80\x9C554\nSMTP synchronization error\xE2\x80\x9D is sent, and the connection is dropped. Testing\nfor this error cannot be perfect because of transmission delays (unexpected\ninput may be on its way but not yet received when Exim checks). However, it\ndoes detect many instances.\n
\n\nThe check can be globally disabled by setting smtp_enforce_sync false.\nIf you want to disable the check selectively (for example, only for certain\nhosts), you can do so by an appropriate use of a control modifier in an ACL\n(see section 42.21). See also pipelining_advertise_hosts.\n
"
name: smtp_enforce_sync
type: boolean
smtp_etrn_command:
default: unset
description: "\n\n\nIf this option is set, the given command is run whenever an SMTP ETRN\ncommand is received from a host that is permitted to issue such commands (see\nchapter 42). The string is split up into separate arguments which\nare independently expanded. The expansion variable $domain is set to the\nargument of the ETRN command, and no syntax checking is done on it. For\nexample:\n
\n\nsmtp_etrn_command = /etc/etrn_command $domain \\\n $sender_host_address\n
\nA new process is created to run the command, but Exim does not wait for it to\ncomplete. Consequently, its status cannot be checked. If the command cannot be\nrun, a line is written to the panic log, but the ETRN caller still receives\na 250 success response. Exim is normally running under its own uid when\nreceiving SMTP, so it is not possible for it to change the uid before running\nthe command.\n
"
name: smtp_etrn_command
type: string
smtp_etrn_serialize:
default: 'true'
description: "\n\nWhen this option is set, it prevents the simultaneous execution of more than\none identical command as a result of ETRN in an SMTP connection. See\nsection 47.8 for details.\n
"
name: smtp_etrn_serialize
type: boolean
smtp_load_reserve:
default: unset
description: "\n\nIf the system load average ever gets higher than this, incoming SMTP calls are\naccepted only from those hosts that match an entry in smtp_reserve_hosts.\nIf smtp_reserve_hosts is not set, no incoming SMTP calls are accepted when\nthe load is over the limit. The option has no effect on ancient operating\nsystems on which Exim cannot determine the load average. See also\ndeliver_queue_load_max and queue_only_load.\n
"
name: smtp_load_reserve
type: fixedpoint
smtp_max_synprot_errors:
default: 3
description: "\n\n\nExim rejects SMTP commands that contain syntax or protocol errors. In\nparticular, a syntactically invalid email address, as in this command:\n
\n\n\ncauses immediate rejection of the command, before any other tests are done.\n(The ACL cannot be run if there is no valid address to set up for it.) An\nexample of a protocol error is receiving RCPT before MAIL. If there are\ntoo many syntax or protocol errors in one SMTP session, the connection is\ndropped. The limit is set by this option.\n
\n\n\nWhen the PIPELINING extension to SMTP is in use, some protocol errors are\n\xE2\x80\x9Cexpected\xE2\x80\x9D, for instance, a RCPT command after a rejected MAIL command.\nExim assumes that PIPELINING will be used if it advertises it (see\npipelining_advertise_hosts), and in this situation, \xE2\x80\x9Cexpected\xE2\x80\x9D errors do\nnot count towards the limit.\n
"
name: smtp_max_synprot_errors
type: integer
smtp_max_unknown_commands:
default: 3
description: "\n\n\nIf there are too many unrecognized commands in an incoming SMTP session, an\nExim server drops the connection. This is a defence against some kinds of abuse\nthat subvert web\nclients\ninto making connections to SMTP ports; in these circumstances, a number of\nnon-SMTP command lines are sent first.\n
"
name: smtp_max_unknown_commands
type: integer
smtp_ratelimit_hosts:
default: unset
description: "\n\n\n\nSome sites find it helpful to be able to limit the rate at which certain hosts\ncan send them messages, and the rate at which an individual message can specify\nrecipients.\n
\n\nExim has two rate-limiting facilities. This section describes the older\nfacility, which can limit rates within a single connection. The newer\nratelimit ACL condition can limit rates across all connections. See section\n42.36 for details of the newer facility.\n
\n\nWhen a host matches smtp_ratelimit_hosts, the values of\nsmtp_ratelimit_mail and smtp_ratelimit_rcpt are used to control the\nrate of acceptance of MAIL and RCPT commands in a single SMTP session,\nrespectively. Each option, if set, must contain a set of four comma-separated\nvalues:\n
\n\n- \n
\nA threshold, before which there is no rate limiting.\n
\n \n- \n
\nAn initial time delay. Unlike other times in Exim, numbers with decimal\nfractional parts are allowed here.\n
\n \n- \n
\nA factor by which to increase the delay each time.\n
\n \n- \n
\nA maximum value for the delay. This should normally be less than 5 minutes,\nbecause after that time, the client is liable to timeout the SMTP command.\n
\n \n
\n\nFor example, these settings have been used successfully at the site which\nfirst suggested this feature, for controlling mail from their customers:\n
\n\nsmtp_ratelimit_mail = 2,0.5s,1.05,4m\nsmtp_ratelimit_rcpt = 4,0.25s,1.015,4m\n
\nThe first setting specifies delays that are applied to MAIL commands after\ntwo have been received over a single connection. The initial delay is 0.5\nseconds, increasing by a factor of 1.05 each time. The second setting applies\ndelays to RCPT commands when more than four occur in a single message.\n
"
name: smtp_ratelimit_hosts
type: hostlist
smtp_ratelimit_mail:
default: unset
description: "\n
\n\n\n\nSome sites find it helpful to be able to limit the rate at which certain hosts\ncan send them messages, and the rate at which an individual message can specify\nrecipients.\n
\n\nExim has two rate-limiting facilities. This section describes the older\nfacility, which can limit rates within a single connection. The newer\nratelimit ACL condition can limit rates across all connections. See section\n42.36 for details of the newer facility.\n
\n\nWhen a host matches smtp_ratelimit_hosts, the values of\nsmtp_ratelimit_mail and smtp_ratelimit_rcpt are used to control the\nrate of acceptance of MAIL and RCPT commands in a single SMTP session,\nrespectively. Each option, if set, must contain a set of four comma-separated\nvalues:\n
\n\n- \n
\nA threshold, before which there is no rate limiting.\n
\n \n- \n
\nAn initial time delay. Unlike other times in Exim, numbers with decimal\nfractional parts are allowed here.\n
\n \n- \n
\nA factor by which to increase the delay each time.\n
\n \n- \n
\nA maximum value for the delay. This should normally be less than 5 minutes,\nbecause after that time, the client is liable to timeout the SMTP command.\n
\n \n
\n\nFor example, these settings have been used successfully at the site which\nfirst suggested this feature, for controlling mail from their customers:\n
\n\nsmtp_ratelimit_mail = 2,0.5s,1.05,4m\nsmtp_ratelimit_rcpt = 4,0.25s,1.015,4m\n
\nThe first setting specifies delays that are applied to MAIL commands after\ntwo have been received over a single connection. The initial delay is 0.5\nseconds, increasing by a factor of 1.05 each time. The second setting applies\ndelays to RCPT commands when more than four occur in a single message.\n
above.\n"
name: smtp_ratelimit_mail
type: string
smtp_ratelimit_rcpt:
default: unset
description: "\n
\n\n\n\nSome sites find it helpful to be able to limit the rate at which certain hosts\ncan send them messages, and the rate at which an individual message can specify\nrecipients.\n
\n\nExim has two rate-limiting facilities. This section describes the older\nfacility, which can limit rates within a single connection. The newer\nratelimit ACL condition can limit rates across all connections. See section\n42.36 for details of the newer facility.\n
\n\nWhen a host matches smtp_ratelimit_hosts, the values of\nsmtp_ratelimit_mail and smtp_ratelimit_rcpt are used to control the\nrate of acceptance of MAIL and RCPT commands in a single SMTP session,\nrespectively. Each option, if set, must contain a set of four comma-separated\nvalues:\n
\n\n- \n
\nA threshold, before which there is no rate limiting.\n
\n \n- \n
\nAn initial time delay. Unlike other times in Exim, numbers with decimal\nfractional parts are allowed here.\n
\n \n- \n
\nA factor by which to increase the delay each time.\n
\n \n- \n
\nA maximum value for the delay. This should normally be less than 5 minutes,\nbecause after that time, the client is liable to timeout the SMTP command.\n
\n \n
\n\nFor example, these settings have been used successfully at the site which\nfirst suggested this feature, for controlling mail from their customers:\n
\n\nsmtp_ratelimit_mail = 2,0.5s,1.05,4m\nsmtp_ratelimit_rcpt = 4,0.25s,1.015,4m\n
\nThe first setting specifies delays that are applied to MAIL commands after\ntwo have been received over a single connection. The initial delay is 0.5\nseconds, increasing by a factor of 1.05 each time. The second setting applies\ndelays to RCPT commands when more than four occur in a single message.\n
above.\n"
name: smtp_ratelimit_rcpt
type: string
smtp_receive_timeout:
cpanel_default: 165s
default: 5m
description: "\n\n\nThis sets a timeout value for SMTP reception. It applies to all forms of SMTP\ninput, including batch SMTP. If a line of input (either an SMTP command or a\ndata line) is not received within this time, the SMTP connection is dropped and\nthe message is abandoned.\nA line is written to the log containing one of the following messages:\n
\n\nSMTP command timeout on connection from...\nSMTP data timeout on connection from...\n
\nThe former means that Exim was expecting to read an SMTP command; the latter\nmeans that it was in the DATA phase, reading the contents of a message.\n
\n\n\nThe value set by this option can be overridden by the\n-os command-line option. A setting of zero time disables the timeout, but\nthis should never be used for SMTP over TCP/IP. (It can be useful in some cases\nof local input using -bs or -bS.) For non-SMTP input, the reception\ntimeout is controlled by receive_timeout and -or.\n
"
name: smtp_receive_timeout
type: time
smtp_reserve_hosts:
default: unset
description: "\nThis option defines hosts for which SMTP connections are reserved; see\nsmtp_accept_reserve and smtp_load_reserve above.\n
"
name: smtp_reserve_hosts
type: hostlist
smtp_return_error_details:
default: 'false'
description: "\n\n\nIn the default state, Exim uses bland messages such as\n\xE2\x80\x9CAdministrative prohibition\xE2\x80\x9D when it rejects SMTP commands for policy\nreasons. Many sysadmins like this because it gives away little information\nto spammers. However, some other sysadmins who are applying strict checking\npolicies want to give out much fuller information about failures. Setting\nsmtp_return_error_details true causes Exim to be more forthcoming. For\nexample, instead of \xE2\x80\x9CAdministrative prohibition\xE2\x80\x9D, it might give:\n
\n\n550-Rejected after DATA: '>' missing at end of address:\n550 failing address in \"From\" header is:
\nThis option is available when Exim is compiled with the content-scanning\nextension. It specifies how Exim connects to SpamAssassin\xE2\x80\x99s spamd daemon.\nThe default value is\n
\n\n\nSee section 43.2 for more details.\n
"
name: spamd_address
type: string
split_spool_directory:
cpanel_default: 'yes'
default: 'false'
description: "\n\n\n\nIf this option is set, it causes Exim to split its input directory into 62\nsubdirectories, each with a single alphanumeric character as its name. The\nsixth character of the message id is used to allocate messages to\nsubdirectories; this is the least significant base-62 digit of the time of\narrival of the message.\n
\n\nSplitting up the spool in this way may provide better performance on systems\nwhere there are long mail queues, by reducing the number of files in any one\ndirectory. The msglog directory is also split up in a similar way to the input\ndirectory; however, if preserve_message_logs is set, all old msglog files\nare still placed in the single directory msglog.OLD.\n
\n\nIt is not necessary to take any special action for existing messages when\nchanging split_spool_directory. Exim notices messages that are in the\n\xE2\x80\x9Cwrong\xE2\x80\x9D place, and continues to process them. If the option is turned off\nafter a period of being on, the subdirectories will eventually empty and be\nautomatically deleted.\n
\n\nWhen split_spool_directory is set, the behaviour of queue runner processes\nchanges. Instead of creating a list of all messages in the queue, and then\ntrying to deliver each one in turn, it constructs a list of those in one\nsub-directory and tries to deliver them, before moving on to the next\nsub-directory. The sub-directories are processed in a random order. This\nspreads out the scanning of the input directories, and uses less memory. It is\nparticularly beneficial when there are lots of messages on the queue. However,\nif queue_run_in_order is set, none of this new processing happens. The\nentire queue has to be scanned and sorted before any deliveries can start.\n
"
name: split_spool_directory
type: boolean
spool_directory:
default: ~
description: "\n\nThis defines the directory in which Exim keeps its spool, that is, the messages\nit is waiting to deliver. The default value is taken from the compile-time\nconfiguration setting, if there is one. If not, this option must be set. The\nstring is expanded, so it can contain, for example, a reference to\n$primary_hostname.\n
\n\nIf the spool directory name is fixed on your installation, it is recommended\nthat you set it at build time rather than from this option, particularly if the\nlog files are being written to the spool directory (see log_file_path).\nOtherwise log files cannot be used for errors that are detected early on, such\nas failures in the configuration file.\n
\n\nBy using this option to override the compiled-in path, it is possible to run\ntests of Exim without using the standard spool.\n
"
name: spool_directory
type: string
sqlite_lock_timeout:
default: 5s
description: "\n\nThis option controls the timeout that the sqlite lookup uses when trying to\naccess an SQLite database. See section 9.25 for more details.\n
"
name: sqlite_lock_timeout
type: time
strict_acl_vars:
default: 'false'
description: "\n\nThis option controls what happens if a syntactically valid but undefined ACL\nvariable is referenced. If it is false (the default), an empty string\nis substituted; if it is true, an error is generated. See section\n42.18 for details of ACL variables.\n
"
name: strict_acl_vars
type: boolean
strip_excess_angle_brackets:
default: 'false'
description: "\n\nIf this option is set, redundant pairs of angle brackets round \xE2\x80\x9Croute-addr\xE2\x80\x9D\nitems in addresses are stripped. For example, <> is\ntreated as . If this is in the envelope and the message is\npassed on to another MTA, the excess angle brackets are not passed on. If this\noption is not set, multiple pairs of angle brackets cause a syntax error.\n
"
name: strip_excess_angle_brackets
type: boolean
strip_trailing_dot:
default: 'false'
description: "\n\n\nIf this option is set, a trailing dot at the end of a domain in an address is\nignored. If this is in the envelope and the message is passed on to another\nMTA, the dot is not passed on. If this option is not set, a dot at the end of a\ndomain causes a syntax error.\nHowever, addresses in header lines are checked only when an ACL requests header\nsyntax checking.\n
"
name: strip_trailing_dot
type: boolean
syslog_duplication:
default: 'true'
description: "\n\nWhen Exim is logging to syslog, it writes the log lines for its three\nseparate logs at different syslog priorities so that they can in principle\nbe separated on the logging hosts. Some installations do not require this\nseparation, and in those cases, the duplication of certain log lines is a\nnuisance. If syslog_duplication is set false, only one copy of any\nparticular log line is written to syslog. For lines that normally go to\nboth the main log and the reject log, the reject log version (possibly\ncontaining message header lines) is written, at LOG_NOTICE priority.\nLines that normally go to both the main and the panic log are written at\nthe LOG_ALERT priority.\n
"
name: syslog_duplication
type: boolean
syslog_facility:
default: unset
description: "\n\nThis option sets the syslog \xE2\x80\x9Cfacility\xE2\x80\x9D name, used when Exim is logging to\nsyslog. The value must be one of the strings \xE2\x80\x9Cmail\xE2\x80\x9D, \xE2\x80\x9Cuser\xE2\x80\x9D, \xE2\x80\x9Cnews\xE2\x80\x9D,\n\xE2\x80\x9Cuucp\xE2\x80\x9D, \xE2\x80\x9Cdaemon\xE2\x80\x9D, or \xE2\x80\x9Clocalx\xE2\x80\x9D where x is a digit between 0 and 7.\nIf this option is unset, \xE2\x80\x9Cmail\xE2\x80\x9D is used. See chapter 51 for\ndetails of Exim\xE2\x80\x99s logging.\n
"
name: syslog_facility
type: string
syslog_processname:
default: exim
description: "\n\nThis option sets the syslog \xE2\x80\x9Cident\xE2\x80\x9D name, used when Exim is logging to\nsyslog. The value must be no longer than 32 characters. See chapter\n51 for details of Exim\xE2\x80\x99s logging.\n
"
name: syslog_processname
type: string
syslog_timestamp:
default: 'true'
description: "\n\nIf syslog_timestamp is set false, the timestamps on Exim\xE2\x80\x99s log lines are\nomitted when these lines are sent to syslog. See chapter 51 for\ndetails of Exim\xE2\x80\x99s logging.\n
"
name: syslog_timestamp
type: boolean
system_filter:
cpanel_default: /etc/cpanel_exim_system_filter
default: unset
description: "\n\n\n\nThis option specifies an Exim filter file that is applied to all messages at\nthe start of each delivery attempt, before any routing is done. System filters\nmust be Exim filters; they cannot be Sieve filters. If the system filter\ngenerates any deliveries to files or pipes, or any new mail messages, the\nappropriate system_filter_..._transport option(s) must be set, to define\nwhich transports are to be used. Details of this facility are given in chapter\n45.\n
"
name: system_filter
type: string
system_filter_directory_transport:
default: unset
description: "\n\nThis sets the name of the transport driver that is to be used when the\nsave command in a system message filter specifies a path ending in \xE2\x80\x9C/\xE2\x80\x9D,\nimplying delivery of each message into a separate file in some directory.\nDuring the delivery, the variable $address_file contains the path name.\n
"
name: system_filter_directory_transport
type: string
system_filter_file_transport:
default: unset
description: "\n\nThis sets the name of the transport driver that is to be used when the save\ncommand in a system message filter specifies a path not ending in \xE2\x80\x9C/\xE2\x80\x9D. During\nthe delivery, the variable $address_file contains the path name.\n
"
name: system_filter_file_transport
type: string
system_filter_group:
cpanel_default: cpaneleximfilter
default: unset
description: "\n\nThis option is used only when system_filter_user is also set. It sets the\ngid under which the system filter is run, overriding any gid that is associated\nwith the user. The value may be numerical or symbolic.\n
"
name: system_filter_group
type: string
system_filter_pipe_transport:
default: unset
description: "\n\n\nThis specifies the transport driver that is to be used when a pipe command\nis used in a system filter. During the delivery, the variable $address_pipe\ncontains the pipe command.\n
"
name: system_filter_pipe_transport
type: string
system_filter_reply_transport:
default: unset
description: "\n\nThis specifies the transport driver that is to be used when a mail command\nis used in a system filter.\n
"
name: system_filter_reply_transport
type: string
system_filter_user:
cpanel_default: cpaneleximfilter
default: unset
description: "\n\nIf this option is set to root, the system filter is run in the main Exim\ndelivery process, as root. Otherwise, the system filter runs in a separate\nprocess, as the given user, defaulting to the Exim run-time user.\nUnless the string consists entirely of digits, it\nis looked up in the password data. Failure to find the named user causes a\nconfiguration error. The gid is either taken from the password data, or\nspecified by system_filter_group. When the uid is specified numerically,\nsystem_filter_group is required to be set.\n
\n\nIf the system filter generates any pipe, file, or reply deliveries, the uid\nunder which the filter is run is used when transporting them, unless a\ntransport option overrides.\n
"
name: system_filter_user
type: string
tcp_nodelay:
default: 'true'
description: "\n\n\n\nIf this option is set false, it stops the Exim daemon setting the\nTCP_NODELAY option on its listening sockets. Setting TCP_NODELAY\nturns off the \xE2\x80\x9CNagle algorithm\xE2\x80\x9D, which is a way of improving network\nperformance in interactive (character-by-character) situations. Turning it off\nshould improve Exim\xE2\x80\x99s performance a bit, so that is what happens by default.\nHowever, it appears that some broken clients cannot cope, and time out. Hence\nthis option. It affects only those sockets that are set up for listening by the\ndaemon. Sockets created by the smtp transport for delivering mail always set\nTCP_NODELAY.\n
"
name: tcp_nodelay
type: boolean
timeout_frozen_after:
cpanel_default: 5d
default: 0s
description: "\n\n\nIf timeout_frozen_after is set to a time greater than zero, a frozen\nmessage of any kind that has been on the queue for longer than the given time\nis automatically cancelled at the next queue run. If the frozen message is a\nbounce message, it is just discarded; otherwise, a bounce is sent to the\nsender, in a similar manner to cancellation by the -Mg command line option.\nIf you want to timeout frozen bounce messages earlier than other kinds of\nfrozen message, see ignore_bounce_errors_after.\n
\n\nNote: the default value of zero means no timeouts; with this setting,\nfrozen messages remain on the queue forever (except for any frozen bounce\nmessages that are released by ignore_bounce_errors_after).\n
"
name: timeout_frozen_after
type: time
timezone:
cpanel_default: America/Chicago
default: unset
description: "\n\nThe value of timezone is used to set the environment variable TZ while\nrunning Exim (if it is different on entry). This ensures that all timestamps\ncreated by Exim are in the required timezone. If you want all your timestamps\nto be in UTC (aka GMT) you should set\n
\n\n\nThe default value is taken from TIMEZONE_DEFAULT in Local/Makefile,\nor, if that is not set, from the value of the TZ environment variable when Exim\nis built. If timezone is set to the empty string, either at build or run\ntime, any existing TZ variable is removed from the environment when Exim\nruns. This is appropriate behaviour for obtaining wall-clock time on some, but\nunfortunately not all, operating systems.\n
"
name: timezone
type: string
tls_advertise_hosts:
cpanel_default: "*"
default: unset
description: "\n\n\n\nWhen Exim is built with support for TLS encrypted connections, the availability\nof the STARTTLS command to set up an encrypted session is advertised in\nresponse to EHLO only to those client hosts that match this option. See\nchapter 41 for details of Exim\xE2\x80\x99s support for TLS.\n
"
name: tls_advertise_hosts
type: hostlist
tls_certificate:
cpanel_default: ${if and { {gt{$tls_in_sni}{}} {!match{$tls_in_sni}{/}} } {${if exists {/var/cpanel/ssl/domain_tls/$tls_in_sni/combined} {/var/cpanel/ssl/domain_tls/$tls_in_sni/combined} {${if exists {${sg{/var/cpanel/ssl/domain_tls/$tls_in_sni/combined}{(.+/)[^.]+(.+/combined)}{\$1*\$2}}} {${sg{/var/cpanel/ssl/domain_tls/$tls_in_sni/combined}{(.+/)[^.]+(.+/combined)}{\$1*\$2}}} {/etc/exim.crt} }} }} {/etc/exim.crt} }
default: unset
description: "\n\n\nThe value of this option is expanded, and must then be the absolute path to a\nfile which contains the server\xE2\x80\x99s certificates. The server\xE2\x80\x99s private key is also\nassumed to be in this file if tls_privatekey is unset. See chapter\n41 for further details.\n
\n\nNote: The certificates defined by this option are used only when Exim is\nreceiving incoming messages as a server. If you want to supply certificates for\nuse when sending messages as a client, you must set the tls_certificate\noption in the relevant smtp transport.\n
\n\nIf the option contains $tls_sni and Exim is built against OpenSSL, then\nif the OpenSSL build supports TLS extensions and the TLS client sends the\nServer Name Indication extension, then this option and others documented in\n41.10 will be re-expanded.\n
"
name: tls_certificate
type: string
tls_crl:
default: unset
description: "\n\n\nThis option specifies a certificate revocation list. The expanded value must\nbe the name of a file that contains a CRL in PEM format.\n
\n\nSee 41.10 for discussion of when this option might be re-expanded.\n
\n\n\n
"
name: tls_crl
type: string
tls_dh_max_bits:
default: 2236
description: "\n\nThe number of bits used for Diffie-Hellman key-exchange may be suggested by\nthe chosen TLS library. That value might prove to be too high for\ninteroperability. This option provides a maximum clamp on the value\nsuggested, trading off security for interoperability.\n
\n\nThe value must be at least 1024.\n
\n\nThe value 2236 was chosen because, at time of adding the option, it was the\nhard-coded maximum value supported by the NSS cryptographic library, as used\nby Thunderbird, while GnuTLS was suggesting 2432 bits as normal.\n
\n\nIf you prefer more security and are willing to break some clients, raise this\nnumber.\n
\n\nNote that the value passed to GnuTLS for *generating* a new prime may be a\nlittle less than this figure, because GnuTLS is inexact and may produce a\nlarger prime than requested.\n
"
name: tls_dh_max_bits
type: integer
tls_dhparam:
default: unset
description: "\n\n
\n\nThe value of this option is expanded and indicates the source of DH parameters\nto be used by Exim.\n
\n\nIf it is a filename starting with a /, then it names a file from which DH\nparameters should be loaded. If the file exists, it should hold a PEM-encoded\nPKCS#3 representation of the DH prime. If the file does not exist, for\nOpenSSL it is an error. For GnuTLS, Exim will attempt to create the file and\nfill it with a generated DH prime. For OpenSSL, if the DH bit-count from\nloading the file is greater than tls_dh_max_bits then it will be ignored,\nand treated as though the tls_dhparam were set to \"none\".\n
\n\nIf this option expands to the string \"none\", then no DH parameters will be\nloaded by Exim.\n
\n\nIf this option expands to the string \"historic\" and Exim is using GnuTLS, then\nExim will attempt to load a file from inside the spool directory. If the file\ndoes not exist, Exim will attempt to create it.\nSee section 41.3 for further details.\n
\n\nIf Exim is using OpenSSL and this option is empty or unset, then Exim will load\na default DH prime; the default is the 2048 bit prime described in section\n2.2 of RFC 5114, \"2048-bit MODP Group with 224-bit Prime Order Subgroup\", which\nin IKE is assigned number 23.\n
\n\nOtherwise, the option must expand to the name used by Exim for any of a number\nof DH primes specified in RFC 2409, RFC 3526 and RFC 5114. As names, Exim uses\n\"ike\" followed by the number used by IKE, of \"default\" which corresponds to\n\"ike23\".\n
\n\nThe available primes are:\nike1, ike2, ike5,\nike14, ike15, ike16, ike17, ike18,\nike22, ike23 (aka default) and ike24.\n
\n\nSome of these will be too small to be accepted by clients.\nSome may be too large to be accepted by clients.\n
"
name: tls_dhparam
type: string
tls_on_connect_ports:
cpanel_default: 465
default: unset
description: "\nThis option specifies a list of incoming SSMTP (aka SMTPS) ports that should\noperate the obsolete SSMTP (SMTPS) protocol, where a TLS session is immediately\nset up without waiting for the client to issue a STARTTLS command. For\nfurther details, see section 13.4.\n
"
name: tls_on_connect_ports
type: stringlist
tls_privatekey:
cpanel_default: ${if and { {gt{$tls_in_sni}{}} {!match{$tls_in_sni}{/}} } {${if exists {/var/cpanel/ssl/domain_tls/$tls_in_sni/combined} {/var/cpanel/ssl/domain_tls/$tls_in_sni/combined} {${if exists {${sg{/var/cpanel/ssl/domain_tls/$tls_in_sni/combined}{(.+/)[^.]+(.+/combined)}{\$1*\$2}}} {${sg{/var/cpanel/ssl/domain_tls/$tls_in_sni/combined}{(.+/)[^.]+(.+/combined)}{\$1*\$2}}} {/etc/exim.key} }} }} {/etc/exim.key} }
default: unset
description: "\n\nThe value of this option is expanded, and must then be the absolute path to a\nfile which contains the server\xE2\x80\x99s private key. If this option is unset, or if\nthe expansion is forced to fail, or the result is an empty string, the private\nkey is assumed to be in the same file as the server\xE2\x80\x99s certificates. See chapter\n41 for further details.\n
\n\nSee 41.10 for discussion of when this option might be re-expanded.\n
"
name: tls_privatekey
type: string
tls_remember_esmtp:
default: 'false'
description: "\n\n\nIf this option is set true, Exim violates the RFCs by remembering that it is in\n\xE2\x80\x9Cesmtp\xE2\x80\x9D state after successfully negotiating a TLS session. This provides\nsupport for broken clients that fail to send a new EHLO after starting a\nTLS session.\n
"
name: tls_remember_esmtp
type: boolean
tls_require_ciphers:
cpanel_default: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
default: unset
description: "\n\n\nThis option controls which ciphers can be used for incoming TLS connections.\nThe smtp transport has an option of the same name for controlling outgoing\nconnections. This option is expanded for each connection, so can be varied for\ndifferent clients if required. The value of this option must be a list of\npermitted cipher suites. The OpenSSL and GnuTLS libraries handle cipher control\nin somewhat different ways. If GnuTLS is being used, the client controls the\npreference order of the available ciphers. Details are given in sections\n41.4 and 41.5.\n
"
name: tls_require_ciphers
type: string
tls_try_verify_hosts:
default: unset
description: "\n\n\n
\n\n\nThis option, along with tls_try_verify_hosts, controls the checking of\ncertificates from clients. The expected certificates are defined by\ntls_verify_certificates, which must be set. A configuration error occurs if\neither tls_verify_hosts or tls_try_verify_hosts is set and\ntls_verify_certificates is not set.\n
\n\nAny client that matches tls_verify_hosts is constrained by\ntls_verify_certificates. When the client initiates a TLS session, it must\npresent one of the listed certificates. If it does not, the connection is\naborted. Warning: Including a host in tls_verify_hosts does not require\nthe host to use TLS. It can still send SMTP commands through unencrypted\nconnections. Forcing a client to use TLS has to be done separately using an\nACL to reject inappropriate commands when the connection is not encrypted.\n
\n\nA weaker form of checking is provided by tls_try_verify_hosts. If a client\nmatches this option (but not tls_verify_hosts), Exim requests a\ncertificate and checks it against tls_verify_certificates, but does not\nabort the connection if there is no certificate or if it does not match. This\nstate can be detected in an ACL, which makes it possible to implement policies\nsuch as \xE2\x80\x9Caccept for relay only if a verified certificate has been received,\nbut accept for local delivery if encrypted, even without a verified\ncertificate\xE2\x80\x9D.\n
\n\nClient hosts that match neither of these lists are not asked to present\ncertificates.\n
below.\n"
name: tls_try_verify_hosts
type: hostlist
tls_verify_certificates:
default: unset
description: "\n\n\nThe value of this option is expanded, and must then be the absolute path to\na file containing permitted certificates for clients that\nmatch tls_verify_hosts or tls_try_verify_hosts. Alternatively, if you\nare using OpenSSL, you can set tls_verify_certificates to the name of a\ndirectory containing certificate files. This does not work with GnuTLS; the\noption must be set to the name of a single file if you are using GnuTLS.\n
\n\nThese certificates should be for the certificate authorities trusted, rather\nthan the public cert of individual clients. With both OpenSSL and GnuTLS, if\nthe value is a file then the certificates are sent by Exim as a server to\nconnecting clients, defining the list of accepted certificate authorities.\nThus the values defined should be considered public data. To avoid this,\nuse OpenSSL with a directory.\n
\n\nSee 41.10 for discussion of when this option might be re-expanded.\n
"
name: tls_verify_certificates
type: string
tls_verify_hosts:
default: unset
description: "\n\n\nThis option, along with tls_try_verify_hosts, controls the checking of\ncertificates from clients. The expected certificates are defined by\ntls_verify_certificates, which must be set. A configuration error occurs if\neither tls_verify_hosts or tls_try_verify_hosts is set and\ntls_verify_certificates is not set.\n
\n\nAny client that matches tls_verify_hosts is constrained by\ntls_verify_certificates. When the client initiates a TLS session, it must\npresent one of the listed certificates. If it does not, the connection is\naborted. Warning: Including a host in tls_verify_hosts does not require\nthe host to use TLS. It can still send SMTP commands through unencrypted\nconnections. Forcing a client to use TLS has to be done separately using an\nACL to reject inappropriate commands when the connection is not encrypted.\n
\n\nA weaker form of checking is provided by tls_try_verify_hosts. If a client\nmatches this option (but not tls_verify_hosts), Exim requests a\ncertificate and checks it against tls_verify_certificates, but does not\nabort the connection if there is no certificate or if it does not match. This\nstate can be detected in an ACL, which makes it possible to implement policies\nsuch as \xE2\x80\x9Caccept for relay only if a verified certificate has been received,\nbut accept for local delivery if encrypted, even without a verified\ncertificate\xE2\x80\x9D.\n
\n\nClient hosts that match neither of these lists are not asked to present\ncertificates.\n
"
name: tls_verify_hosts
type: hostlist
trusted_groups:
default: unset
description: "\n\n\nThis option is expanded just once, at the start of Exim\xE2\x80\x99s processing. If this\noption is set, any process that is running in one of the listed groups, or\nwhich has one of them as a supplementary group, is trusted. The groups can be\nspecified numerically or by name. See section 5.2 for\ndetails of what trusted callers are permitted to do. If neither\ntrusted_groups nor trusted_users is set, only root and the Exim user\nare trusted.\n
"
name: trusted_groups
type: stringlist
trusted_users:
default: unset
description: "\n\n\nThis option is expanded just once, at the start of Exim\xE2\x80\x99s processing. If this\noption is set, any process that is running as one of the listed users is\ntrusted. The users can be specified numerically or by name. See section\n5.2 for details of what trusted callers are permitted to do.\nIf neither trusted_groups nor trusted_users is set, only root and the\nExim user are trusted.\n
"
name: trusted_users
type: stringlist
unknown_login:
default: unset
description: "\n\n\nThis is a specialized feature for use in unusual configurations. By default, if\nthe uid of the caller of Exim cannot be looked up using getpwuid(), Exim\ngives up. The unknown_login option can be used to set a login name to be\nused in this circumstance. It is expanded, so values like user$caller_uid\ncan be set. When unknown_login is used, the value of unknown_username\nis used for the user\xE2\x80\x99s real name (gecos field), unless this has been set by the\n-F option.\n
"
name: unknown_login
type: string
unknown_username:
default: unset
description: "\n
\n\n\nThis is a specialized feature for use in unusual configurations. By default, if\nthe uid of the caller of Exim cannot be looked up using getpwuid(), Exim\ngives up. The unknown_login option can be used to set a login name to be\nused in this circumstance. It is expanded, so values like user$caller_uid\ncan be set. When unknown_login is used, the value of unknown_username\nis used for the user\xE2\x80\x99s real name (gecos field), unless this has been set by the\n-F option.\n
"
name: unknown_username
type: string
untrusted_set_sender:
cpanel_default: "*"
default: unset
description: "\n\n\n\n\n\nWhen an untrusted user submits a message to Exim using the standard input, Exim\nnormally creates an envelope sender address from the user\xE2\x80\x99s login and the\ndefault qualification domain. Data from the -f option (for setting envelope\nsenders on non-SMTP messages) or the SMTP MAIL command (if -bs or -bS\nis used) is ignored.\n
\n\nHowever, untrusted users are permitted to set an empty envelope sender address,\nto declare that a message should never generate any bounces. For example:\n
\n\nexim -f '<>' user@domain.example\n
\n\nThe untrusted_set_sender option allows you to permit untrusted users to set\nother envelope sender addresses in a controlled way. When it is set, untrusted\nusers are allowed to set envelope sender addresses that match any of the\npatterns in the list. Like all address lists, the string is expanded. The\nidentity of the user is in $sender_ident, so you can, for example, restrict\nusers to setting senders that start with their login ids\nfollowed by a hyphen\nby a setting like this:\n
\n\nuntrusted_set_sender = ^$sender_ident-\n
\nIf you want to allow untrusted users to set envelope sender addresses without\nrestriction, you can use\n
\n\nuntrusted_set_sender = *\n
\nThe untrusted_set_sender option applies to all forms of local input, but\nonly to the setting of the envelope sender. It does not permit untrusted users\nto use the other options which trusted user can use to override message\nparameters. Furthermore, it does not stop Exim from removing an existing\nSender: header in the message, or from adding a Sender: header if\nnecessary.
\n\nWhen a message is submitted locally (that is, not over a TCP/IP connection) by\nan untrusted user, Exim removes any existing Sender: header line. If you\ndo not want this to happen, you must set local_sender_retain, and you must\nalso set local_from_check to be false (Exim will complain if you do not).\nSee also the ACL modifier control = suppress_local_fixups. Section\n46.16 has more details about Sender: processing.\n
and local_from_check for ways of\noverriding these actions. The handling of the Sender: header is also\ndescribed in section 46.16.\n\n\nThe log line for a message\xE2\x80\x99s arrival shows the envelope sender following\n\xE2\x80\x9C<=\xE2\x80\x9D. For local messages, the user\xE2\x80\x99s login always follows, after \xE2\x80\x9CU=\xE2\x80\x9D. In\n-bp displays, and in the Exim monitor, if an untrusted user sets an\nenvelope sender address, the user\xE2\x80\x99s login is shown in parentheses after the\nsender address.\n
"
name: untrusted_set_sender
type: addresslist
uucp_from_pattern:
default: ~
description: "\n\n\nSome applications that pass messages to an MTA via a command line interface use\nan initial line starting with \xE2\x80\x9CFrom\xC2\xA0\xE2\x80\x9D to pass the envelope sender. In\nparticular, this is used by UUCP software. Exim recognizes such a line by means\nof a regular expression that is set in uucp_from_pattern. When the pattern\nmatches, the sender address is constructed by expanding the contents of\nuucp_from_sender, provided that the caller of Exim is a trusted user. The\ndefault pattern recognizes lines in the following two forms:\n
\n\nFrom ph10 Fri Jan 5 12:35 GMT 1996\nFrom ph10 Fri, 7 Jan 97 14:00:00 GMT\n
\nThe pattern can be seen by running\n
\n\nexim -bP uucp_from_pattern\n
\nIt checks only up to the hours and minutes, and allows for a 2-digit or 4-digit\nyear in the second case. The first word after \xE2\x80\x9CFrom\xC2\xA0\xE2\x80\x9D is matched in the\nregular expression by a parenthesized subpattern. The default value for\nuucp_from_sender is \xE2\x80\x9C$1\xE2\x80\x9D, which therefore just uses this first word\n(\xE2\x80\x9Cph10\xE2\x80\x9D in the example above) as the message\xE2\x80\x99s sender. See also\nignore_fromline_hosts.\n
"
name: uucp_from_pattern
type: string
uucp_from_sender:
default: $1
description: "\n
\n\n\nSome applications that pass messages to an MTA via a command line interface use\nan initial line starting with \xE2\x80\x9CFrom\xC2\xA0\xE2\x80\x9D to pass the envelope sender. In\nparticular, this is used by UUCP software. Exim recognizes such a line by means\nof a regular expression that is set in uucp_from_pattern. When the pattern\nmatches, the sender address is constructed by expanding the contents of\nuucp_from_sender, provided that the caller of Exim is a trusted user. The\ndefault pattern recognizes lines in the following two forms:\n
\n\nFrom ph10 Fri Jan 5 12:35 GMT 1996\nFrom ph10 Fri, 7 Jan 97 14:00:00 GMT\n
\nThe pattern can be seen by running\n
\n\nexim -bP uucp_from_pattern\n
\nIt checks only up to the hours and minutes, and allows for a 2-digit or 4-digit\nyear in the second case. The first word after \xE2\x80\x9CFrom\xC2\xA0\xE2\x80\x9D is matched in the\nregular expression by a parenthesized subpattern. The default value for\nuucp_from_sender is \xE2\x80\x9C$1\xE2\x80\x9D, which therefore just uses this first word\n(\xE2\x80\x9Cph10\xE2\x80\x9D in the example above) as the message\xE2\x80\x99s sender. See also\nignore_fromline_hosts.\n
above.\n"
name: uucp_from_sender
type: string
warn_message_file:
default: unset
description: "\n\n\nThis option defines a template file containing paragraphs of text to be used\nfor constructing the warning message which is sent by Exim when a message has\nbeen on the queue for a specified amount of time, as specified by\ndelay_warning. Details of the file\xE2\x80\x99s contents are given in chapter\n48. See also bounce_message_file.\n
"
name: warn_message_file
type: string
write_rejectlog:
default: 'true'
description: "\n\nIf this option is set false, Exim no longer writes anything to the reject log.\nSee chapter 51 for details of what Exim writes to its logs.\n\n\n
"
name: write_rejectlog
type: boolean