# flushing' operations, but should be populated with a list
# of trusted machines. Wildcards are not permitted
# bsmtp_domains - Domains that we deliver locally via bsmtp
+# submission-domains - Domains for which mail will be accepted via the
+# submission port
<%- if @is_mailrelay -%>
# mailhubdomains - Domains for which we are the MX, but the mail is relayed
# elsewhere. This is designed for use with small volume or
# that list.
<%- end -%>
+# From /var/lib/misc / UD:
+#
+# mail-forward.cdb - aliases for @d.o
+# user-forward.cdb - aliases for @thishost.d.o
+
# Exim's wildcard mechanism is a bit odd in that to say "any address in
# debian.org including debian.org" you must use two patterns,
# *.debian.org
localpartlist postmasterish = postmaster : abuse : hostmaster
-hostlist debianhosts = <; ; 127.0.0.1 ; ::1 ; /var/lib/misc/thishost/debianhosts ; 89.16.166.49 ; 82.195.75.76 ; 2001:41b8:202:deb:bab5:0:52c3:4b4c
+hostlist debianhosts = <; ; 127.0.0.1 ; ::1 ; /var/lib/misc/thishost/debianhosts
hostlist reservedaddrs = 0.0.0.0/8 : 127.0.0.0/8 : 10.0.0.0/8 : 169.254.0.0/16 : 172.16.0.0/12 : 192.0.0.0/24 : 192.168.0.0/16 : 224.0.0.0/4 : 240.0.0.0/5 : 248.0.0.0/5
+domainlist google_mxen = aspmx.l.google.com : gmail-smtp-in.l.google.com : \
+ *.aspmx.l.google.com : *.gmail-smtp-in.l.google.com
+
+domainlist single_domain_mx = +google_mxen
+
<%- if @is_mailrelay -%>
# Domains we relay for; that is domains that aren't considered local but we
# accept mail for them.
# expensive, you can specify the networks for which a lookup is done, or
# remove the setting entirely.
host_lookup = *
-# dns_ipv4_lookup = !localhost (disabled upon sgrans request, zobel, 2010-03-16)
+dns_ipv4_lookup = +google_mxen
# If this option is set, then any process that is running as one of the
# listed users may pass a message to Exim and specify the sender's
gecos_pattern = ^([^,:]*)
gecos_name = $1
+# Do *not* include the body of the original message in a bounce
+# The combinaton of bounce_return_message and bounce_return_body
+# allows us to return only the headers within a bounce
+
+bounce_return_message = true
+bounce_return_body = false
+
# This tells Exim to immediately discard error messages (ie double bounces).
ignore_bounce_errors_after = 0s
auto_thaw = 1d
tls_advertise_hosts = *
smtp_enforce_sync = true
-log_selector = +tls_cipher +tls_peerdn +queue_time +deliver_time +smtp_connection +smtp_incomplete_transaction +smtp_confirmation +smtp_protocol_error
+log_selector = \
+ +tls_cipher \
+ +tls_peerdn \
+ +queue_time \
+ +queue_time_overall \
+ +deliver_time \
+ +received_recipients \
+ +unknown_in_list \
+ +smtp_connection \
+ +smtp_incomplete_transaction \
+ +smtp_confirmation \
+ +smtp_syntax_error \
+ +smtp_no_mail \
+ +smtp_protocol_error
received_header_text = Received: ${if def:sender_rcvhost {from $sender_rcvhost\n\t}\
{${if def:sender_ident {from ${quote_local_part:$sender_ident} }}${if def:sender_helo_name {(helo=$sender_helo_name)\n\t}}}}\
# macro definitions.
# Do not wrap!
+MAX_SCAN_SIZE = 256000
VDOMAINDATA = ${lookup{$domain}partial-lsearch{/etc/exim4/virtualdomains}{$value}}
VSENDERDOMAINDATA = ${lookup{$sender_address_domain}partial-lsearch{/etc/exim4/virtualdomains}{$value}}
WHITELIST = ${if match_domain{$domain}{+virtual_domains}\
deny
acl_getprofile:
- # This is a bad hack to reset the variable, by defining it be something
- # never referenced.
- warn set acl_m_rprf = $acl_m_undefined
+ # Determine the mail profile for this recipient.
+ # An empty string implies no match has been found.
+
+ warn set acl_m_rprf =
warn recipients = survey@popcon.debian.org
set acl_m_rprf = PopconMail
#!!# ACL that is used after the RCPT command on the submission port
check_submission:
- # Accept if the source is local SMTP (i.e. not over TCP/IP).
- # We do this by testing for an empty sending host field.
accept hosts = +debianhosts
<%- if @is_mailrelay -%>
message = slow down (no reverse dns, mismatched ehlo, dialup, or in blacklists)
<%- if has_variable?("policydweight") && @policydweight -%>
- # Check with policyd-weight - this only works with a version after etch's,
- # sadly. etch's version attempts to hold the socket open, since that's what
- # postfix expects. Exim, on the other hand, expects the remote side to close
- # the socket when it's finished sending data, so it see each transaction as
- # an incomplete read. I'm sure there's a way we could force Exim to do
- # something sick and clever to force either the interpretation or the socket
- # closure, but I'm fairly sure it's now worth it, since the backport of
- # policyd-weight is trivial.
+ # Check with policyd-weight
warn !hosts = +debianhosts
condition = ${if !eq {$acl_m_prf}{PopconMail}}
set acl_m_pw = ${readsocket{inet:127.0.0.1:12525}\
accept verify = certificate
accept hosts = +debianhosts
- discard condition = ${if <{$message_size}{256000}}
+ discard condition = ${if <{$message_size}{MAX_SCAN_SIZE}}
condition = ${if eq {$acl_m_prf}{blackhole}}
set acl_m_srb = ${perl{surblspamcheck}}
condition = ${if !eq{$acl_m_srb}{false}}
log_message = discarded surbl message for $recipients
- deny condition = ${if <{$message_size}{256000}}
+ deny condition = ${if <{$message_size}{MAX_SCAN_SIZE}}
condition = ${if !eq {$acl_m_prf}{markup}}
condition = ${if !eq {$acl_m_prf}{PopconMail}}
set acl_m_srb = ${perl{surblspamcheck}}
log_message = $acl_m_srb
message = $acl_m_srb
- warn condition = ${if <{$message_size}{256000}}
+ warn condition = ${if <{$message_size}{MAX_SCAN_SIZE}}
condition = ${if eq {$acl_m_prf}{markup}}
set acl_m_srb = ${perl{surblspamcheck}}
condition = ${if !eq{$acl_m_srb}{false}}
<%- end -%>
<%- if @heavy -%>
- discard condition = ${if <{$message_size}{256000}}
+ discard condition = ${if <{$message_size}{MAX_SCAN_SIZE}}
condition = ${if eq {$acl_m_prf}{blackhole}}
set acl_m_srb = ${perl{surblspamcheck}}
condition = ${if !eq{$acl_m_srb}{false}}
log_message = discarded surbl message for $recipients
- deny condition = ${if <{$message_size}{256000}}
+ deny condition = ${if <{$message_size}{MAX_SCAN_SIZE}}
condition = ${if !eq {$acl_m_prf}{markup}}
condition = ${if !eq {$acl_m_prf}{PopconMail}}
set acl_m_srb = ${perl{surblspamcheck}}
log_message = $acl_m_srb
message = $acl_m_srb
- warn condition = ${if <{$message_size}{256000}}
+ warn condition = ${if <{$message_size}{MAX_SCAN_SIZE}}
condition = ${if eq {$acl_m_prf}{markup}}
set acl_m_srb = ${perl{surblspamcheck}}
condition = ${if !eq{$acl_m_srb}{false}}
!authenticated = *
!verify = certificate
!hosts = +debianhosts
- condition = ${if <{$message_size}{256000}}
+ condition = ${if <{$message_size}{MAX_SCAN_SIZE}}
spam = pkg_user : true
condition = ${if >{$spam_score_int}{59}}
<%- if @is_mailrelay -%>
relay_manualroute:
+ debug_print = "R: relay_manualroute for $local_part@$domain"
driver = manualroute
domains = +mailhubdomains
- transport = remote_smtp
+ transport = ${if forany{${lookup dnsdb{>: mxh=$domain}}}\
+ {match_domain{$item}{+single_domain_mx}}\
+ {remote_smtp_single_domain}{remote_smtp}\
+ }
route_data = ${lookup{$domain}lsearch{/etc/exim4/manualroute}}
require_files = /etc/exim4/manualroute
debug_print = "R: dnslookup for $local_part@$domain"
driver = dnslookup
domains = !+handled_domains
- transport = remote_smtp
+ transport = ${if forany{${lookup dnsdb{>: mxh=$domain}}}\
+ {match_domain{$item}{+single_domain_mx}}\
+ {remote_smtp_single_domain}{remote_smtp}\
+ }
ignore_target_hosts = +reservedaddrs
no_more
local_part_suffix_optional
retry_use_local_part
-<%=
-out = ""
-if @is_bugsmx
- domain = 'bugs.debian.org'
- out = '
+<%- if @is_bugsmx -%>
# This router delivers for bugs.d.o
bugs:
debug_print = "R: bugs for $local_part@$domain"
driver = accept
transport = bugs_pipe
- domains = ' + domain + '
+ domains = bugs.debian.org
cannot_route_message = Unknown or archived bug
require_files = /srv/bugs.debian.org/mail/run-procmail
no_more
{\N^(\d+)(\d{2})(?:-(?:(?:submit|maintonly|quiet|forwarded|done|close|request|submitter)|(?:unsubscribe|ignore|help|(?:sub(?:scribe|help|yes|approve|reject))|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*))?$\N}\
{${if exists{/srv/bugs.debian.org/spool/db-h/$2/$1$2.summary}\
{$local_part}fail}}fail}
-'
-end
-out
-%>
+<%- end -%>
######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
tls_certificate = /etc/exim4/ssl/thishost.crt
tls_privatekey = /etc/exim4/ssl/thishost.key
+remote_smtp_single_domain:
+ driver = smtp
+ connect_timeout = 15s
+ delay_after_cutoff = false
+ no_multi_domain
+ tls_certificate = /etc/exim4/ssl/thishost.crt
+ tls_privatekey = /etc/exim4/ssl/thishost.key
+
<%- if @use_smarthost -%>
remote_smtp_smarthost:
debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
projects / mirror / dsa-puppet.git / blobdiff