After the "Exim as default MTA." discussion on the fedora-devel list, i set out to test out Exim for the first time, based on what i currently use Qmail for.
(thanks to Jeff for posting his minifc3 iso, it makes it alot easier to experiement with fresh installations in VMware)
I'd like to use it relaying to an exchange server, with the relay_to_domains = example.org
but i've come to wonder about the default configuration
Under the ACL's there is a # Accept if the address is in a domain for which we are relaying, but again, # only if the recipient can be verified.
accept domains = +relay_to_domains endpass verify = recipient
Whats going on here? how is it verifying recipients on another server?
btw. for the Exim discussion on the devel list, the exim.conf file seems very straight forward and easy to understand for someone that havent seen it before.
On Friday 25 Feb 2005 00:45, Cream wrote:
accept domains = +relay_to_domains endpass verify = recipient
domainlist relay_to_domains = yourdomains
# Accept if the address is in a local domain, but only if the recipient can # be verified. Otherwise deny. The "endpass" line is the border between # passing on to the next ACL statement (if tests above it fail) or denying # access (if tests below it fail).
accept domains = +local_domains endpass verify = recipient
# Accept if the address is in a domain for which we are relaying, but again, # only if the recipient can be verified.
accept domains = +relay_to_domains endpass verify = recipient
isnt relay_to_domains = accept mail to domains on other servers? (ie. NOT local domains, ie. NOT my domains)
domainlist local_domains = my.domain.net domainlist relay_to_domains = my.friend.net
So i accept mails for my friend's domain, and when his server comes back online, i pass them on to his server. (working as backup MX)
"domains for which your host is an incomming relay"
so the question remains, how is it supposed to verify recipients?
Im just asking because im trying to understand it, so no pressure.
Gavin Henry wrote:
On Friday 25 Feb 2005 00:45, Cream wrote:
accept domains = +relay_to_domains endpass verify = recipient
domainlist relay_to_domains = yourdomains
# Accept if the address is in a local domain, but only if the recipient can # be verified. Otherwise deny. The "endpass" line is the border between # passing on to the next ACL statement (if tests above it fail) or denying # access (if tests below it fail).
accept domains = +local_domains endpass verify = recipient
# Accept if the address is in a domain for which we are relaying, but again, # only if the recipient can be verified.
accept domains = +relay_to_domains endpass verify = recipient
On Fri, 2005-02-25 at 01:45 +0100, Cream wrote:
accept domains = +relay_to_domains endpass verify = recipient
Whats going on here? how is it verifying recipients on another server?
In that case it's simply verifying that it can route messages to the other server -- it's not verifying individual recipients at all.
Synchronising user lists is outside the scope of the default configuration, but the simple option is to do a callout to the primary MX to verify that the recipient actually exists. Obviously that doesn't help if the primary MX is down, but it does help with the common spammer trick of just sending crap to the backup on the basis that it's more likely to accept it. You can change the above to:
accept domains = +relay_to_domains endpass verify = recipient/callout=use_sender,defer_ok
Going to http://www.exim.org/exim-html-4.40/doc/html/spec.html then selecting 'V' in the Concept Index then 'verifying:address, options for' will get http://www.exim.org/exim-html-4.40/doc/html/spec_38.html#IX2434 which explains the callout options in more detail -- basically this attempts an SMTP callout to the primary MX using the same source and destination mail addresses, and rejects the incoming mail if the primary MX doesn't like the (sender,recipient) pair. If the primary is down, the defer_ok option means that it'll accept the mail and queue it.
If the primary is one of the versions of Exchange which can't (or doesn't) do rejection at SMTP time properly, then the above won't help and you have to use an LDAP query for verifying addresses. See sample configuration 'C043' in the FAQ.
-
Cream -
David Woodhouse -
Gavin Henry