1 ######################################################################
2 # Runtime configuration file for Exim #
3 ######################################################################
6 # This is a default configuration file which will operate correctly in
7 # uncomplicated installations. Please see the manual for a complete list
8 # of all the runtime configuration options that can be included in a
9 # configuration file. There are many more than are mentioned here. The
10 # manual is in the file doc/spec.txt in the Exim distribution as a plain
11 # ASCII file. Other formats (PostScript, Texinfo, HTML, PDF) are available
12 # from the Exim ftp sites. The manual is also online at the Exim web sites.
15 # This file is divided into several parts, all but the first of which are
16 # headed by a line starting with the word "begin". Only those parts that
17 # are required need to be present. Blank lines, and lines starting with #
21 ########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ###########
23 # Whenever you change Exim's configuration file, you *must* remember to #
24 # HUP the Exim daemon, because it will not pick up the new configuration #
25 # until you do. However, any other Exim processes that are started, for #
26 # example, a process started by an MUA in order to send a message, will #
27 # see the new configuration as soon as it is in place. #
29 # You do not need to HUP the daemon for changes in auxiliary files that #
30 # are referenced from this file. They are read every time they are used. #
32 # It is usually a good idea to test a new configuration for syntactic #
33 # correctness before installing it (for example, by running the command #
34 # "exim -C /config/file.new -bV"). #
36 ########### IMPORTANT ########## IMPORTANT ########### IMPORTANT ###########
40 ######################################################################
41 # MAIN CONFIGURATION SETTINGS #
42 ######################################################################
44 # Log more information
45 # log_selector = +all -arguments
46 log_selector = +smtp_confirmation +queue_time
49 # Environment variables
53 # Specify your host's canonical name here. This should normally be the fully
54 # qualified "official" name of your host. If this option is not set, the
55 # uname() function is called to obtain the name. In many cases this does
56 # the right thing and you need not set anything explicitly.
60 # daemon_smtp_ports = 25 : 465
61 # tls_on_connect_ports = 465
63 # The next three settings create two lists of domains and one list of hosts.
64 # These lists are referred to later in this configuration using the syntax
65 # +local_domains, +relay_to_domains, and +relay_from_hosts, respectively. They
66 # are all colon-separated lists:
68 domainlist local_domains = @
69 domainlist relay_to_domains =
70 hostlist relay_from_hosts = 127.0.0.1
72 # If You wish to enable support for STARTTLS, uncomment folowing lines:
74 # tls_certificate = /etc/openssl/mail.crt
75 # tls_privatekey = /etc/openssl/mail.key
76 # tls_advertise_hosts = *
81 # You can use self-signed cerficates (you will need openssl-tools package):
83 # openssl genrsa -out /etc/openssl/mail.key 1024
84 # openssl req -new -x509 -days 365 -key /etc/openssl/mail.key -out /etc/openssl/mail.crt
86 # Most straightforward access control requirements can be obtained by
87 # appropriate settings of the above options. In more complicated situations, you
88 # may need to modify the Access Control List (ACL) which appears later in this
91 # The first setting specifies your local domains, for example:
93 # domainlist local_domains = my.first.domain : my.second.domain
95 # You can use "@" to mean "the name of the local host", as in the default
96 # setting above. This is the name that is specified by primary_hostname,
97 # as specified above (or defaulted). If you do not want to do any local
98 # deliveries, remove the "@" from the setting above. If you want to accept mail
99 # addressed to your host's literal IP address, for example, mail addressed to
100 # "user@[192.168.23.44]", you can add "@[]" as an item in the local domains
101 # list. You also need to uncomment "allow_domain_literals" below. This is not
102 # recommended for today's Internet.
104 # The second setting specifies domains for which your host is an incoming relay.
105 # If you are not doing any relaying, you should leave the list empty. However,
106 # if your host is an MX backup or gateway of some kind for some domains, you
107 # must set relay_to_domains to match those domains. For example:
109 # domainlist relay_to_domains = *.myco.com : my.friend.org
111 # This will allow any host to relay through your host to those domains.
112 # See the section of the manual entitled "Control of relaying" for more
115 # The third setting specifies hosts that can use your host as an outgoing relay
116 # to any other host on the Internet. Such a setting commonly refers to a
117 # complete local network as well as the localhost. For example:
119 # hostlist relay_from_hosts = 127.0.0.1 : 192.168.0.0/16
121 # The "/16" is a bit mask (CIDR notation), not a number of hosts. Note that you
122 # have to include 127.0.0.1 if you want to allow processes on your host to send
123 # SMTP mail by using the loopback address. A number of MUAs use this method of
127 # All three of these lists may contain many different kinds of item, including
128 # wildcarded names, regular expressions, and file lookups. See the reference
129 # manual for details. The lists above are used in the access control list for
130 # incoming messages. The name of this ACL is defined here:
132 acl_smtp_rcpt = acl_check_rcpt
134 # You should not change that setting until you understand how ACLs work.
136 # The following ACL entries are used if you want to do content scanning with
137 # the exiscan-acl patch. When you uncomment one of these lines, you must also
138 # review the respective entries in the ACL section further below.
140 # acl_smtp_mime = acl_check_mime
141 # acl_smtp_data = acl_check_content
143 # This configuration variable defines the virus scanner that is used with
144 # the 'malware' ACL condition of the exiscan acl-patch. If you do not use
145 # virus scanning, leave it commented. Please read doc/exiscan-acl-readme.txt
146 # for a list of supported scanners.
148 # av_scanner = sophie:/var/run/sophie
150 # The following setting is only needed if you use the 'spam' ACL condition
151 # of the exiscan-acl patch. It specifies on which host and port the SpamAssassin
152 # "spamd" daemon is listening. If you do not use this condition, or you use
153 # the default of "127.0.0.1 783", you can omit this option.
155 # spamd_address = 127.0.0.1 783
157 # Specify the domain you want to be added to all unqualified addresses
158 # here. An unqualified address is one that does not contain an "@" character
159 # followed by a domain. For example, "caesar@rome.example" is a fully qualified
160 # address, but the string "caesar" (i.e. just a login name) is an unqualified
161 # email address. Unqualified addresses are accepted only from local callers by
162 # default. See the recipient_unqualified_hosts option if you want to permit
163 # unqualified addresses from remote sources. If this option is not set, the
164 # primary_hostname value is used for qualification.
169 # If you want unqualified recipient addresses to be qualified with a different
170 # domain to unqualified sender addresses, specify the recipient domain here.
171 # If this option is not set, the qualify_domain value is used.
173 # qualify_recipient =
176 # The following line must be uncommented if you want Exim to recognize
177 # addresses of the form "user@[10.11.12.13]" that is, with a "domain literal"
178 # (an IP address) instead of a named domain. The RFCs still require this form,
179 # but it makes little sense to permit mail to be sent to specific hosts by
180 # their IP address in the modern Internet. This ancient format has been used
181 # by those seeking to abuse hosts by using them for unwanted relaying. If you
182 # really do want to support domain literals, uncomment the following line, and
183 # see also the "domain_literal" router below.
185 # allow_domain_literals
188 # No deliveries will ever be run under the uids of these users (a colon-
189 # separated list). An attempt to do so causes a panic error to be logged, and
190 # the delivery to be deferred. This is a paranoic safety catch. There is an
191 # even stronger safety catch in the form of the FIXED_NEVER_USERS setting
192 # in the configuration for building Exim. The list of users that it specifies
193 # is built into the binary, and cannot be changed. The option below just adds
194 # additional users to the list. The default for FIXED_NEVER_USERS is "root",
195 # but just to be absolutely sure, the default here is also "root".
197 # Note that the default setting means you cannot deliver mail addressed to root
198 # as if it were a normal user. This isn't usually a problem, as most sites have
199 # an alias for root that redirects such mail to a human administrator.
204 # The setting below causes Exim to do a reverse DNS lookup on all incoming
205 # IP calls, in order to get the true host name. If you feel this is too
206 # expensive, you can specify the networks for which a lookup is done, or
207 # remove the setting entirely.
211 # Advertise DSN for these hosts
213 dsn_advertise_hosts = *
215 # The settings below (default is 30s) cause Exim to make RFC 1413 (ident)
216 # callbacks for all incoming SMTP calls. You can limit the hosts to which
217 # these calls are made, and/or change # the timeout that is used.
218 # If you set the timeout to zero, all RFC 1413 calls
219 # are disabled. RFC 1413 calls are cheap and can provide useful information
220 # for tracing problem messages, but some hosts and firewalls have problems
221 # with them. This can result in a timeout instead of an immediate refused
222 # connection, leading to delays on starting up an SMTP session.
225 # rfc1413_query_timeout = 3s
228 # By default, Exim expects all envelope addresses to be fully qualified, that
229 # is, they must contain both a local part and a domain. If you want to accept
230 # unqualified addresses (just a local part) from certain hosts, you can specify
231 # these hosts by setting one or both of
233 # sender_unqualified_hosts =
234 # recipient_unqualified_hosts =
236 # to control sender and recipient addresses, respectively. When this is done,
237 # unqualified addresses are qualified using the settings of qualify_domain
238 # and/or qualify_recipient (see above).
241 # If you want Exim to support the "percent hack" for certain domains,
242 # uncomment the following line and provide a list of domains. The "percent
243 # hack" is the feature by which mail addressed to x%y@z (where z is one of
244 # the domains listed) is locally rerouted to x@y and sent on. If z is not one
245 # of the "percent hack" domains, x%y is treated as an ordinary local part. This
246 # hack is rarely needed nowadays; you should not enable it unless you are sure
247 # that you really need it.
249 # percent_hack_domains =
251 # As well as setting this option you will also need to remove the test
252 # for local parts containing % in the ACL definition below.
255 # When Exim can neither deliver a message nor return it to sender, it "freezes"
256 # the delivery error message (aka "bounce message"). There are also other
257 # circumstances in which messages get frozen. They will stay on the queue for
258 # ever unless one of the following options is set.
260 # This option unfreezes frozen bounce messages after two days, tries
261 # once more to deliver them, and ignores any delivery failures.
263 ignore_bounce_errors_after = 2d
265 # This option cancels (removes) frozen messages that are older than a week.
267 timeout_frozen_after = 7d
271 ######################################################################
272 # ACL CONFIGURATION #
273 # Specifies access control lists for incoming SMTP mail #
274 ######################################################################
278 # This access control list is used for every RCPT command in an incoming
279 # SMTP message. The tests are run in order until the address is either
280 # accepted or denied.
284 # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
285 # testing for an empty sending host field.
289 #############################################################################
290 # The following section of the ACL is concerned with local parts that contain
291 # @ or % or ! or / or | or dots in unusual places.
293 # The characters other than dots are rarely found in genuine local parts, but
294 # are often tried by people looking to circumvent relaying restrictions.
295 # Therefore, although they are valid in local parts, these rules lock them
296 # out, as a precaution.
298 # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
299 # allows them because they have been encountered. (Consider local parts
300 # constructed as "firstinitial.secondinitial.familyname" when applied to
301 # someone like me, who has no second initial.) However, a local part starting
302 # with a dot or containing /../ can cause trouble if it is used as part of a
303 # file name (e.g. for a mailing list). This is also true for local parts that
304 # contain slashes. A pipe symbol can also be troublesome if the local part is
305 # incorporated unthinkingly into a shell command line.
307 # Two different rules are used. The first one is stricter, and is applied to
308 # messages that are addressed to one of the local domains handled by this
309 # host. It blocks local parts that begin with a dot or contain @ % ! / or |.
310 # If you have local accounts that include these characters, you will have to
313 deny message = Restricted characters in address
314 domains = +local_domains
315 local_parts = ^[.] : ^.*[@%!|]
317 # The second rule applies to all other domains, and is less strict. This
318 # allows your own users to send outgoing messages to sites that use slashes
319 # and vertical bars in their local parts. It blocks local parts that begin
320 # with a dot, slash, or vertical bar, but allows these characters within the
321 # local part. However, the sequence /../ is barred. The use of @ % and ! is
322 # blocked, as before. The motivation here is to prevent your users (or
323 # your users' viruses) from mounting certain kinds of attack on remote sites.
326 deny message = Restricted characters in address
327 domains = !+local_domains
328 local_parts = ^[.|] : ^.*[@%!] : ^.*/\\.\\./
329 #############################################################################
331 # Accept mail to postmaster in any local domain, regardless of the source,
332 # and without verifying the sender.
334 accept local_parts = postmaster
335 domains = +local_domains
337 # Deny unless the sender address can be verified.
339 require verify = sender
341 #############################################################################
342 # There are no checks on DNS "black" lists because the domains that contain
343 # these lists are changing all the time. However, here are two examples of
344 # how you could get Exim to perform a DNS black list lookup at this point.
345 # The first one denies, while the second just warns.
347 # deny message = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
348 # dnslists = black.list.example
350 # warn message = X-Warning: $sender_host_address is in a black list at $dnslist_domain
351 # log_message = found in $dnslist_domain
352 # dnslists = black.list.example
353 #############################################################################
355 # Accept if the address is in a local domain, but only if the recipient can
356 # be verified. Otherwise deny. The "endpass" line is the border between
357 # passing on to the next ACL statement (if tests above it fail) or denying
358 # access (if tests below it fail).
360 accept domains = +local_domains
364 # Accept if the address is in a domain for which we are relaying, but again,
365 # only if the recipient can be verified.
367 accept domains = +relay_to_domains
370 # If control reaches this point, the domain is neither in +local_domains
371 # nor in +relay_to_domains.
373 # Accept if the message comes from one of the hosts for which we are an
374 # outgoing relay. Recipient verification is omitted here, because in many
375 # cases the clients are dumb MUAs that don't cope well with SMTP error
376 # responses. If you are actually relaying out from MTAs, you should probably
377 # add recipient verification here.
379 accept hosts = +relay_from_hosts
381 # Accept if the message arrived over an authenticated connection, from
382 # any host. Again, these messages are usually from MUAs, so recipient
383 # verification is omitted.
385 accept authenticated = *
387 # Reaching the end of the ACL causes a "deny", but we might as well give
388 # an explicit message.
390 deny message = relay not permitted
392 # These access control lists are used for content scanning with the exiscan-acl
393 # patch. You must also uncomment the entries for acl_smtp_data and acl_smtp_mime
394 # (scroll up), otherwise the ACLs will not be used. IMPORTANT: the default entries here
395 # should be treated as EXAMPLES. You MUST read the file doc/exiscan-acl-spec.txt
396 # to fully understand what you are doing ...
400 # Decode MIME parts to disk. This will support virus scanners later.
401 warn decode = default
403 # File extension filtering.
404 deny message = Blacklisted file extension detected
405 condition = ${if match \
406 {${lc:$mime_filename}} \
407 {\N(\.exe|\.pif|\.bat|\.scr|\.lnk|\.com)$\N} \
410 # Reject messages that carry chinese character sets.
411 # WARNING: This is an EXAMPLE.
412 deny message = Sorry, noone speaks chinese here
413 condition = ${if eq{$mime_charset}{gb2312}{1}{0}}
419 # Reject virus infested messages.
420 deny message = This message contains malware ($malware_name)
423 # Always add X-Spam-Score and X-Spam-Report headers, using SA system-wide settings
424 # (user "nobody"), no matter if over threshold or not.
425 warn message = X-Spam-Score: $spam_score ($spam_bar)
427 warn message = X-Spam-Report: $spam_report
430 # Add X-Spam-Flag if spam is over system-wide threshold
431 warn message = X-Spam-Flag: YES
434 # Reject spam messages with score over 10, using an extra condition.
435 deny message = This message scored $spam_score points. Congratulations!
437 condition = ${if >{$spam_score_int}{100}{1}{0}}
439 # finally accept all the rest
443 ######################################################################
444 # ROUTERS CONFIGURATION #
445 # Specifies how addresses are handled #
446 ######################################################################
447 # THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT! #
448 # An address is passed to each router in turn until it is accepted. #
449 ######################################################################
453 # This router routes to remote hosts over SMTP by explicit IP address,
454 # when an email address is given in "domain literal" form, for example,
455 # <user@[192.168.35.64]>. The RFCs require this facility. However, it is
456 # little-known these days, and has been exploited by evil people seeking
457 # to abuse SMTP relays. Consequently it is commented out in the default
458 # configuration. If you uncomment this router, you also need to uncomment
459 # allow_domain_literals above, so that Exim can recognize the syntax of
460 # domain literal addresses.
464 # domains = ! +local_domains
465 # transport = remote_smtp
468 # This router routes addresses that are not in local domains by doing a DNS
469 # lookup on the domain name. Any domain that resolves to 0.0.0.0 or to a
470 # loopback interface address (127.0.0.0/8) is treated as if it had no DNS
471 # entry. Note that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated
472 # as the local host inside the network stack. It is not 0.0.0.0/0, the default
473 # route. If the DNS lookup fails, no further routers are tried because of
474 # the no_more setting, and consequently the address is unrouteable.
478 domains = ! +local_domains
479 transport = remote_smtp
480 ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
484 # The remaining routers handle addresses in the local domain(s).
487 # This router handles aliasing using a linearly searched alias file with the
488 # name /etc/mail/aliases. When this configuration is installed automatically,
489 # the name gets inserted into this file from whatever is set in Exim's
490 # build-time configuration. The default path is the traditional /etc/aliases.
491 # If you install this configuration by hand, you need to specify the correct
492 # path in the "data" setting below.
494 ##### NB You must ensure that the alias file exists. It used to be the case
495 ##### NB that every Unix had that file, because it was the Sendmail default.
496 ##### NB These days, there are systems that don't have it. Your aliases
497 ##### NB file should at least contain an alias for "postmaster".
499 # If any of your aliases expand to pipes or files, you will need to set
500 # up a user and a group for these deliveries to run under. You can do
501 # this by uncommenting the "user" option below (changing the user name
502 # as appropriate) and adding a "group" option if necessary. Alternatively, you
503 # can specify "user" on the transports that are used. Note that the transports
504 # listed below are the same as are used for .forward files; you might want
505 # to set up different ones for pipe and file deliveries from aliases.
511 data = ${lookup{$local_part}lsearch{/etc/mail/aliases}}
513 file_transport = address_file
514 pipe_transport = address_pipe
517 # This router handles forwarding using traditional .forward files in users'
518 # home directories. If you want it also to allow mail filtering when a forward
519 # file starts with the string "# Exim filter" or "# Sieve filter", uncomment
520 # the "allow_filter" option.
522 # If you want this router to treat local parts with suffixes introduced by "-"
523 # or "+" characters as if the suffixes did not exist, uncomment the two local_
524 # part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
525 # in the same way as xxxx@your.domain by this router. You probably want to make
526 # the same change to the localuser router.
528 # The no_verify setting means that this router is skipped when Exim is
529 # verifying addresses. Similarly, no_expn means that this router is skipped if
530 # Exim is processing an EXPN command.
532 # The check_ancestor option means that if the forward file generates an
533 # address that is an ancestor of the current one, the current one gets
534 # passed on instead. This covers the case where A is aliased to B and B
535 # has a .forward file pointing to A.
537 # The three transports specified at the end are those that are used when
538 # forwarding generates a direct delivery to a file, or to a pipe, or sets
539 # up an auto-reply, respectively.
544 # local_part_suffix = +* : -*
545 # local_part_suffix_optional
546 file = $home/.forward
551 file_transport = address_file
552 pipe_transport = address_pipe
553 reply_transport = address_reply
555 # Procmail. Uncomment following if you want procmail delivery.
560 # local_part_suffix = DSUFFIX*
561 # local_part_suffix_optional
562 # require_files = "${local_part}:+${home}/.procmailrc:\
563 # +/usr/bin/procmail:!${home}/.forward"
564 # transport = procmail_pipe
566 # This router matches local user mailboxes. If the router fails, the error
567 # message is "Unknown user".
569 # If you want this router to treat local parts with suffixes introduced by "-"
570 # or "+" characters as if the suffixes did not exist, uncomment the two local_
571 # part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
572 # in the same way as xxxx@your.domain by this router.
577 # local_part_suffix = +* : -*
578 # local_part_suffix_optional
579 transport = local_delivery
580 cannot_route_message = Unknown user
583 ######################################################################
584 # TRANSPORTS CONFIGURATION #
585 ######################################################################
586 # ORDER DOES NOT MATTER #
587 # Only one appropriate transport is called for each delivery. #
588 ######################################################################
590 # A transport is used only when referenced from a router that successfully
591 # handles an address.
596 # This transport is used for delivering messages over SMTP connections.
602 # This transport is used for local delivery to user mailboxes in traditional
603 # BSD mailbox format. By default it will be run under the uid and gid of the
604 # local user, and requires the sticky bit to be set on the /var/mail directory.
605 # Some systems use the alternative approach of running mail deliveries under a
606 # particular group instead of using the sticky bit. The commented options below
607 # show how this can be done.
611 file = /var/mail/$local_part
618 # Procmail transport. Uncomment following if you want procmail delivery
622 # command = "procmail -f-"
625 # path = "/usr/local/bin:/usr/bin:/bin"
627 # user = ${local_part}
628 # temp_errors= 75 : 75 : 256
633 # This transport is used for handling pipe deliveries generated by alias or
634 # .forward files. If the pipe generates any standard output, it is returned
635 # to the sender of the message as a delivery error. Set return_fail_output
636 # instead of return_output if you want this to happen only when the pipe fails
637 # to complete normally. You can set different transports for aliases and
638 # forwards if you want to - see the references to address_pipe in the routers
646 # This transport is used for handling deliveries directly to files that are
647 # generated by aliasing or forwarding.
656 # This transport is used for handling autoreplies generated by the filtering
657 # option of the userforward router.
664 ######################################################################
665 # RETRY CONFIGURATION #
666 ######################################################################
670 # This single retry rule applies to all domains and all errors. It specifies
671 # retries every 15 minutes for 2 hours, then increasing retry intervals,
672 # starting at 1 hour and increasing each time by a factor of 1.5, up to 16
673 # hours, then retries every 6 hours until 4 days have passed since the first
676 # Domain Error Retries
677 # ------ ----- -------
679 * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
683 ######################################################################
684 # REWRITE CONFIGURATION #
685 ######################################################################
687 # There are no rewriting specifications in this default configuration file.
693 ######################################################################
694 # AUTHENTICATION CONFIGURATION #
695 ######################################################################
697 # There are no authenticator specifications in this default configuration file.
701 # Uncomment lines below to enable SMTP AUTH support. Be aware that this
702 # requires cyrus-sasl-saslauthd package to be installed.
706 # public_name = PLAIN
708 # server_condition = ${if saslauthd{{$2}{$3}{smtp}}{1}{0}}
713 # public_name = LOGIN
714 # server_prompts = "Username:: : Password::"
715 # server_condition = ${if saslauthd{{$1}{$2}{smtp}}{1}{0}}
718 # End of Exim configuration file