Back to PkgExim4
1. Debian Exim4 User FAQ
This is work in progress, so it is probably not yet very helpful.
?TableOfContents
1.1. Meta
1.1.1. Where can I find more information about Debian exim4
http://pkg-exim4.alioth.debian.org/ has a truckload of links to documentation
=== I have a question ==
Do not edit this page to ask your question. Ask it on the Debian exim4 user mailing list where it is less likely to be missed.
=== I want to contribute ==
It is vital that this web page does not contain false information. It is appreciated if you could announce your changes on the Debian exim4 user mailing list to have them reviewed.
Of course, if your change is trivial, you don't need to do that.
1.2. Debian Configuration
1.2.1. How do I re-execute the debconf-driven configuration?
Debian's configuration is factored out into a dedicated package. Thus, dpkg-reconfiguring exim4, exim4-base or one of the daemon packages is not going to work. Please use dpkg-reconfigure exim4-config or edit /etc/exim4/update-exim4.conf.conf directly.
More information can be found in the manual page for update-exim4.conf.
1.3. General exim issues
1.3.1. When I try to deliver a message via SMTP to my Exim, I get "550 relay not permitted"
Exim does not relay by default for any host. If you want to use your exim as a smart host, please enter the IP ranges your exim should relay for into dc_relay_nets in /etc/exim4/update-exim4.conf.conf or reconfigure exim using debconf.
Please note that you cannot use this mechanism if your client is on a dynamic IP as your client's IP address changes. In these case, use SMTP AUTH to have your client authenticate before relaying.
If this does work, verify that you're actually talking to your exim. Some ISPs block incoming SMTP connections (port tcp/25 blocking) or redirect these connections to their own server.
1.4. Networking and ISP issues
1.4.1. my exim cannot connect to the outside
It might be possible that your ISP blocks outgoing connections to port TCP/25 of external hosts. This prevents computers on the ISP network from directly sending out e-mail. Many ISPs do this as a security precaution because compromised computers (called "Zombies") are frequently used to send out Spam.
On these networks, you cannot deliver e-mail directly. You need to use a smart host for outgoing mail. If your ISP offers a smart host for outgoing mail, it is probably a good idea to use it.
If your ISP does not offer a smart host or you want to deliver via a trusted third party, you need to have your exim deliver the messages to the smart host on a different port, for example tcp/587.
1.4.2. my exim cannot be connected to from the outside
It might be possible that your ISP blocks incoming connections to port TCP/25 of their customer's machines. This prevents computers on the ISP network from directly receiving e-mail. Many ISPs do this as a security precaution because misconfigured SMTP servers can be an open relay and thus be abused to send out Spam.
If you want to run a MX server on such a connection, you're out of luck. It is not possible to use a different port for MX servers since the Internet Standards don't offer the possibility to tell delivering hosts to try delivery on a different port.
If you want to run a smarthost on such a connection, it might be a solution to configure exim to listen on port tcp/587 additionally. Please note that the Internet standards demand that you only accept e-mail after authentication if the connection is made to TCP/587. Otherwise, you might open yourself to receiving and sending Spam.
1.4.3. How do I configure exim to use a different port to receive mail
Set SMTPLISTENEROPTIONS to the appropriate value in /etc/default/exim4. For example, use -oX 25:587 -oP /var/run/exim4/exim.pid to have exim listen on tcp/25 and tcp/587. The -oP parameter is necessary in this case since exim does not create a pid file automatically if -oX is given on the command line. If you omit the -oP parameter, the init script will malfunction.
1.4.4. How do I configure exim to use a different port to send mail
This does only make sense when delivering to a smarthost. Starting with exim4 4.63-5, you can enter smarthost.example::portnumber as a smarthost to have exim deliver to a different port.
With earlier exim versions, you need to modify the smarthost and hub_user_smarthost routers manually.
1.5. not yet categorized
1.5.1. I am trying to have exim forward mail to some internal hosts, but all I am getting is "all relevant MX records point to non-existent hosts"
A probeble cause for this might be that all MX records for the offending domain point to site local or link local IP addresses, which are ignored by the dnslookup router to protect from misconfigured external domains. The default configuration has relaxed checking for domains that the local system is configured to allow relaying to, so adding the offending domain to dc_relay_domains will most probably help.
Please note that no domain on the public Internet should have MX records pointing to site local or link local IP addresses, so you might check your externally visible MX records.
If this doesn't help, try analyzing the output of exim -d -bt some.local.part@the.offending.domain.example
[http://www.exim.org/eximwiki/FAQ/Routing_to_remote_hosts/Q0302 Upstream Exim FAQ Q0302] might help as well.
1.5.2. I get the error "Mailing to remote domains not supported". I don't have a FQDN on this machine and just want it to send notifications by email (to outside domains) via various scripts. Can exim do this? How?
Not yet answered.
1.5.3. What do "lowest numbered MX record points to local host" or "remote host address is the local host" mean?
This is covered in [http://www.exim.org/eximwiki/FAQ/Routing_to_remote_hosts/Q0301 Upstream Exim FAQ Q0301.] The Debian default configuration has the hubbed_hosts router mentioned there already defined. Its configuration file is /etc/exim4/hubbed_hosts, and some documentation can be found in /etc/exim4/conf.d/router/150_exim4-config_hubbed_hosts.
1.5.4. What do the "DEBCONFfooDEBCONF" macros in the Debian configuration do?
When the Exim daemon is started, the dpkg-conffiles in /etc/exim4 are post-processed to the result /var/lib/exim4/config.autogenerated, which is the configuration file that Exim reads. In this post-processing step, done by update-exim4.conf, the DEBCONFfooDEBCONF strings are replaced with values pulled from /etc/exim4/update-exim4.conf.conf and system configuration.
Please note that the string DEBCONF is kind of a misnomer since the strings are _not_ directly pulled from the Debconf database, but from user-editable conffiles instead. This is a common misunderstanding.
For more information, read the update-exim4.conf man page.
1.5.5. I am experiencing timeout issues with TLS connections
Answer not yet fleshed out.
- GnuTLS Entropy issue
- Kernel not generating enough entropy
- network removed
- /proc/sys/kernel/random/entropy_avail
- hardware RNG
- audio in RNG
- Rebuild exim 4.60-3+ with OpenSSL
- install gnutls-bin
- install openssl on exim 4.63-4+
1.5.6. How does exim find out its host name to use in HELO/EHLO?
Answer not yet fleshed out.
The name used in EHLO/HELO is pulled from configuration option primary_hostname
Debian's exim4 default configuration does not set primary_hostname
exim then defaults to uname() to find the host name. If that call only returns one component, gethostbyname() or getipnodebyname() is used to obtain the fully qualified host name.
Most frequent cause for localhost.localdomain is the default /etc/hosts created by Debian installation.
- The recommended way is to fix the system instead of forcing exim to the intended host name.
1.5.7. How do I configure a catch-all?
Answer not yet fleshed out.
*: target in /etc/aliases
- break the loop by aliasing the target account to itself
- other aliases take precedence, alias exceptions to themselves
- catch-all is a real bad idea these days
1.5.8. Exim stops delivery after ten messages are received
Answer not yet fleshed out.
- In the default configuration, exim delivers the first ten messages received over a single SMTP connection immediately, and places the following messages on the queue.
- These messages will be delivered by the next queue runner process
- Queue runners are started every 30 minutes by default.
- This situation is most frequently experienced by sites running fetchmail
- One possible fix: increase smtp_accept_queue_per_connection. This option is not in the default configuration, hence the default of 10 is used by exim.
- In the fetchmail case, a better fix is to have fetchmail execute exim -q after finishing the retrieving process.
- This decreases the load spike which would otherwise be experienced.
You can specify a command to execute in fetchmailrc using the postcommand user option, e.g. postcommand "/usr/sbin/exim4 -q", in the appropriate "poll" line in your fetchmailrc. This, of course, assumes that the user running fetchmail has the appropriate privileges to cause an exim queue run.
1.5.9. How can I debug SMTP AUTH and/or other SMTP aspects
- Exim's logs are usually quite helpful
- Find out which side of the communication is causing you trouble
- Check whether the other side behaves properly
- Use telnet, openssl and/or gnutls-cli for low-level debugging
If you are not too familiar with SMTP's innards, consider using [http://packages.debian.org/swaks swaks] for debugging.
1.5.10. I have configured exim with help of a non-Debian HOWTO. It doesn't work.
Unfortunately, a lot of third-party documentation has been written by people who do not fully understand how things work. They might have been successful in solving the issue at their hands, but challenges are so different that it is extremely improbable that the solution will hold in other situations.
It is thus adviseable to take third-party HOWTOs with extreme caution and use them only as input for a local solution. Taking a third-party configuration snippet verbatim is like asking for extreme trouble.
In this FAQ entry, we'll link to third-party HOWTO documents and comment about what we think about their contents.
[http://www.lexspoon.org/linux/smtp-relay.html SMTP Relaying Via a Smarthost.] This document shows basic understanding of the concepts in an abstract way, but gives questionable advice in detail.
- The document gives a truckload of Debian-specific advice and does not say that it is Debian-specific. This suggests that the author does not have too much E-Mail admin experience, and nearly none outside a Debian environment.
- Why does the document recommend changing our local configuration to use a hardcoded user name instead of the file lookup that we provide?
- Why does the document recommend having Exim listen on Port 26 instead of using the standardized submission port 587?
- The author has never heard of swaks and advocates manual debugging
- The author rants about Debian's exim4 configuration scheme and calls it "confusing". In the same paragraph, he says that he didn't find out how to use a single, hand-crafted exim4.conf file. Considered that it is prominently documented in the README that /etc/exim4/exim4.conf takes absolute preference over all other configurations, it looks to me that the author of this HOWTO did not bother to read our documentation.
[http://koivi.com/exim4-config/ Installing and configuring Exim 4 on Debian.] This document gives advice how to configure spamassassin, clamav and some implementation of "virtual domains". Please note that "virtual" is a very overused term and you might think of "virtual domains" as something different than the document's author might think. Additionally, the documentation uses exim's built-in content scanning interface to link to clamav, but uses sa-exim for spamassassin integration. This is double work since exim's built-in content scanning can link to spamassassin as well.
[http://www.lug-untermain.de/howto/exim.php Gemischtes Doppel.] This Document in German language isn't so bad, but it switches off all Debian automatisms and leaves the user out in the dark without updates.
[http://www.dbmail.org/dokuwiki/doku.php?id=debian:exim4 debian:exim4 [dbmail]] is a HOWTO about how to use exim4 with dbmail. I have to advise against using this howto for the following reasons:
- The author himself claims to be not an expert on spamassassin, pam, clamav or exim4. Yet, he publishes his (wrong and misleading) findings.
- He neither did manage to get saslauthd to work, nor mySQL. Both things are trivial to do if one has familiarized oneself with exim as it is necessary to run a mail server on the Internet.
- It advises to use sa-exim "For Spamassassin auto-blocking". I don't know what auto-blocking is, but exim can use spamassassin at SMTP time natively and can also block depending on the spamassassin results. I have not yet seen a setup where sa-exim was actually needed.
- At least th HOWTO uses our configuration and allows people to receive updates in the future.
1.5.11. How can I create a blacklist to deny specific hosts / ip addresses?
- demonstrate how debian configures blacklists and how they differ from the default non-debian configuration
I know little, just made it work with the monolithic file that supports debconf.
~$ less /etc/exim4/exim4.conf.template shows the file that debian exim4 constructs a config file from. Search '/' for "acl_check_rcpt" (Second occurance) to find the sequence of rules which are pretty comprehensive. exim4.conf.template recommends viewing /usr/share/doc/exim4-config/default_acl
To make a local blacklist create a file called /etc/exim4/local_host_blacklist. List your least favourite hostnames, IP addresses, or networks in CIDR format.
To use an IP blacklist service, edit /etc/exim4/update-exim4.conf.conf to include an entry like CHECK_RCPT_IP_DNSBLS=ipblacklist.foo.bar/$sender_address_domain
Same again for a DNS blacklist, over two lines this time CHECK_RCPT_DOMAIN_DNSBLS=dnsblacklist1.foo.bar/$sender_address_domain : \ dnsblacklist2.foo.bar/$sender_address_domain
CHECK_RCPT_LOCAL_ACL_FILE is provided as a hook for a custom access list. If you want to go that far you're a braver hacker than I. Let us know how you get on.
I don't know about non-debian exim4. From what I've seen, there seems to be encouragement out there to add a few lines to your exim4.conf file now and again. I've heard legends about how your exim conf file can get spectacularly out of control, but don't want to find out for myself.
1.5.12. How can I integrate content scanning at SMPT time with Exiscan?
- demonstrate how debian writes exim4's configuration (/etc/exim4/exim.conf.template) file to allow for exiscan intergration.
Back to PkgExim4