#
# Exim config
# http://www.stonki.de/computer/
# by support@stonki.de
# Version 2.1 vom 4. März 2021
# 
# 
# This config based on the very good work and howto of <pille@struction.de>
#
# Amendments by Stonki (support@stonki.de)
#

######################################################################
#                  Runtime configuration file for Exim               #
######################################################################

# setup database connection
// CHANGE ME
hide mysql_servers = SERVER/DB_NAME/MYSQL_USER/MYSQL_PASS

#
# Greylist by <pille@struction.de>
#
# seconds after a greylisted message is accepted (10 minutes, changed to 5)
GREYLIST_TIMEOUT = ${eval:60*5}

# integer spam score (times 10) threshold to activate selective greylisting (1.0 points)
GREYLIST_SPAM_THRESHOLD = ${eval:10*1}

#
# Settings
#
smtp_accept_max = 100
# messages bigger than this aren't spam-scanned
SPAM_FILESIZE_LIMIT = 10M

# messages bigger than this aren't virus-scanned
VIRUS_FILESIZE_LIMIT = 32M

######################################################################
#                    MAIN CONFIGURATION SETTINGS                     #
######################################################################

# local
// change ME
# primary_hostname = FQDN.voller_domain.name.optional
local_interfaces =  127.0.0.1 : <ALLE EXTERNEN IP>

# ports to listen on (smtps is forced to use TLS/SSL via tls_on_connect_ports)
daemon_smtp_ports = smtp : smtps : 567

# The first setting specifies your local domains, for example:
# The next three settings create two lists of domains and one list of hosts.
# These lists are referred to later in this configuration using the syntax
# +local_domains, +relay_to_domains, and +relay_from_hosts, respectively. They
# are all colon-separated lists:

domainlist local_domains = ${lookup mysql { SELECT domain FROM mailbox WHERE domain='${quote_mysql:$domain}' \
				      UNION SELECT alias_domain as domain FROM alias_domain WHERE alias_domain='${quote_mysql:$domain}' \
			   }}

# TODO: add $value above (needed?)
domainlist relay_to_domains =

# The third setting specifies hosts that can use your host as an outgoing relay
# to any other host on the Internet. Such a setting commonly refers to a
# complete local network as well as the localhost. For example:

hostlist   relay_from_hosts = 127.0.0.1 


# If Exim is compiled with support for TLS, you may want to enable the
# following options so that Exim allows clients to make encrypted
# connections. In the authenticators section below, there are template
# configurations for plaintext username/password authentication. This kind
# of authentication is only safe when used within a TLS connection, so the
# authenticators will only work if the following TLS settings are turned on
# as well.

tls_advertise_hosts = *

# additionally listen on ssl/smtp
tls_on_connect_ports = 465		

# Specify the location of the Exim server's TLS certificate and private key.
# The private key must not be encrypted (password protected). You can put
# the certificate and private key in the same file, in which case you only
# need the first setting, or in separate files, in which case you need both
# options.
#tls_certificate = /etc/exim4/exim.crt
#tls_privatekey = /etc/exim4/exim.key
#tls_dhparam = /etc/exim/exim2048.dh


tls_certificate = /etc/exim4/fullchain.pem
tls_privatekey = /etc/exim4/privkey.pem


keep_environment = MAIN_KEEP_ENVIRONMENT



# 2007-02-25 <pille@struction.de>  log some more details
#log_selector = +tls_cipher +tls_peerdn
log_selector = +tls_cipher +tls_peerdn +all_parents +deliver_time +delivery_size +queue_time +queue_time_overall +received_recipients +received_sender +smtp_confirmation +lost_incoming_connection +smtp_incomplete_transaction +smtp_protocol_error +smtp_syntax_error


# All three of these lists may contain many different kinds of item, including
# wildcarded names, regular expressions, and file lookups. See the reference
# manual for details. The lists above are used in the access control lists for
# checking incoming messages. The names of these ACLs are defined here:

acl_smtp_connect = acl_check_connect
#acl_smtp_helo = acl_check_helo
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data


# If you are running a version of Exim that was compiled with the content-
# scanning extension, you can cause incoming messages to be automatically
# scanned for viruses. You have to modify the configuration in two places to
# set this up. The first of them is here, where you define the interface to
# your scanner. This example is typical for ClamAV; see the manual for details
# of what to set for other virus scanners. The second modification is in the
# acl_check_data access control list (see below).

# 2007-03-22 <pille@struction.de>
# we support multiple av-scanners -> actual value will be set in DATA ACL
av_scanner = $acl_m0


# For spam scanning, there is a similar option that defines the interface to
# SpamAssassin. You do not need to set this if you are using the default, which
# is shown in this commented example. As for virus scanning, you must also
# modify the acl_check_data access control list to enable spam scanning.

spamd_address = 127.0.0.1 783
# spamd_address = /var/run/spamassassin/spamd.sock


# Specify the domain you want to be added to all unqualified addresses
# here. An unqualified address is one that does not contain an "@" character
# followed by a domain. For example, "caesar@rome.example" is a fully qualified
# address, but the string "caesar" (i.e. just a login name) is an unqualified
# email address. Unqualified addresses are accepted only from local callers by
# default. See the recipient_unqualified_hosts option if you want to permit
# unqualified addresses from remote sources. If this option is not set, the
# primary_hostname value is used for qualification.

# qualify_domain =


# If you want unqualified recipient addresses to be qualified with a different
# domain to unqualified sender addresses, specify the recipient domain here.
# If this option is not set, the qualify_domain value is used.

# qualify_recipient =


# The following line must be uncommented if you want Exim to recognize
# addresses of the form "user@[10.11.12.13]" that is, with a "domain literal"
# (an IP address) instead of a named domain. The RFCs still require this form,
# but it makes little sense to permit mail to be sent to specific hosts by
# their IP address in the modern Internet. This ancient format has been used
# by those seeking to abuse hosts by using them for unwanted relaying. If you
# really do want to support domain literals, uncomment the following line, and
# see also the "domain_literal" router below.

# allow_domain_literals


# No deliveries will ever be run under the uids of users specified by
# never_users (a colon-separated list). An attempt to do so causes a panic
# error to be logged, and the delivery to be deferred. This is a paranoic
# safety catch. There is an even stronger safety catch in the form of the
# FIXED_NEVER_USERS setting in the configuration for building Exim. The list of
# users that it specifies is built into the binary, and cannot be changed. The
# option below just adds additional users to the list. The default for
# FIXED_NEVER_USERS is "root", but just to be absolutely sure, the default here
# is also "root".

# Note that the default setting means you cannot deliver mail addressed to root
# as if it were a normal user. This isn't usually a problem, as most sites have
# an alias for root that redirects such mail to a human administrator.

never_users = root


# The setting below causes Exim to do a reverse DNS lookup on all incoming
# IP calls, in order to get the true host name. If you feel this is too
# expensive, you can specify the networks for which a lookup is done, or
# remove the setting entirely.

host_lookup = *


# The settings below, which are actually the same as the defaults in the
# code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP
# calls. You can limit the hosts to which these calls are made, and/or change
# the timeout that is used. If you set the timeout to zero, all RFC 1413 calls
# are disabled. RFC 1413 calls are cheap and can provide useful information
# for tracing problem messages, but some hosts and firewalls have problems
# with them. This can result in a timeout instead of an immediate refused
# connection, leading to delays on starting up SMTP sessions. (The default was
# reduced from 30s to 5s for release 4.61.)

rfc1413_hosts = *
rfc1413_query_timeout = 5s


# By default, Exim expects all envelope addresses to be fully qualified, that
# is, they must contain both a local part and a domain. If you want to accept
# unqualified addresses (just a local part) from certain hosts, you can specify
# these hosts by setting one or both of
#
# sender_unqualified_hosts =
# recipient_unqualified_hosts =
#
# to control sender and recipient addresses, respectively. When this is done,
# unqualified addresses are qualified using the settings of qualify_domain
# and/or qualify_recipient (see above).


# If you want Exim to support the "percent hack" for certain domains,
# uncomment the following line and provide a list of domains. The "percent
# hack" is the feature by which mail addressed to x%y@z (where z is one of
# the domains listed) is locally rerouted to x@y and sent on. If z is not one
# of the "percent hack" domains, x%y is treated as an ordinary local part. This
# hack is rarely needed nowadays; you should not enable it unless you are sure
# that you really need it.
#
# percent_hack_domains =
#
# As well as setting this option you will also need to remove the test
# for local parts containing % in the ACL definition below.


# When Exim can neither deliver a message nor return it to sender, it "freezes"
# the delivery error message (aka "bounce message"). There are also other
# circumstances in which messages get frozen. They will stay on the queue for
# ever unless one of the following options is set.

# This option unfreezes frozen bounce messages after two days, tries
# once more to deliver them, and ignores any delivery failures.

ignore_bounce_errors_after = 2d

# This option cancels (removes) frozen messages that are older than a week.

timeout_frozen_after = 7d

# By default, messages that are waiting on Exim's queue are all held in a
# single directory called "input" which it itself within Exim's spool
# directory. (The default spool directory is specified when Exim is built, and
# is often /var/spool/exim/.) Exim works best when its queue is kept short, but
# there are circumstances where this is not always possible. If you uncomment
# the setting below, messages on the queue are held in 62 subdirectories of
# "input" instead of all in the same directory. The subdirectories are called
# 0, 1, ... A, B, ... a, b, ... z. This has two benefits: (1) If your file
# system degrades with many files in one directory, this is less likely to
# happen; (2) Exim can process the queue one subdirectory at a time instead of
# all at once, which can give better performance with large queues.

# split_spool_directory = true
# 2009-08-01 <pille@struction.de>
split_spool_directory = true



######################################################################
#                       ACL CONFIGURATION                            #
#         Specifies access control lists for incoming SMTP mail      #
######################################################################

begin acl

acl_check_connect:
# 2009-08-01 <pille@struction.de> 	currently unused

  accept



# 2006-10-xx <pille@struction.de> 	currently unused
acl_check_helo:

  accept
	 
  
# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.
acl_check_rcpt:

  
  # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  # testing for an empty sending host field.

  accept  hosts = :

  # 2007-02-23 <pille@struction.de>
  # temporary reject message, if already greylisted and entry hasn't expired yet                                                                                                                                                       
  # authenticated users skip this                                                                                                                                                                                                      
  defer message         = Your Message is currently still greylisted! Please try again later.                                                                                                                                          
	log_message     = message from ${sender_address} over [${sender_host_address}] is still GreyListed                                                                                                                               
	!authenticated  = *
	!hosts		= +relay_from_hosts
	# true, if triple is in db and not yet GREYLIST_TIMEOUT seconds since first seen
	# false, else (older or not in db)
	condition       = ${if >={GREYLIST_TIMEOUT}{${lookup mysql{\
			    SELECT (UNIX_TIMESTAMP()-MAX(first_seen)) AS QueueTime \ 
			    FROM greylist \
			    WHERE SenderIP = '${quote_mysql:$sender_host_address}' \ 
			    AND SenderAddress = '${quote_mysql:$sender_address}' \
			  }{$value}{${eval:GREYLIST_TIMEOUT+1}}}}{true}{false}}
					       

  # save authenticated user in header, if nessessary (intentionally done before spamcheck, to use it's headers)
  warn  authenticated 	= *
  	message 	= X-Authenticated-User: $authenticated_id\n\
			  X-Authenticator: $sender_host_authenticated


  # 2006-10-20 <pille@struction.de>  (deny active since 2006-10-26)
  # deny, if foreign, unauthenticated connection claims to come from a local domain
  # 2009-08-01 <pille@struction.de>  this has some strange behaviour (blocking) on two systems (A & B are different servers) with this config under the following condition
  #                                  A: user@Adomain writes to user user@Bdomain (which is an alias for someotheruser@Adomain)
  #                                  if your users have such circular aliases on different servers using this config, simply comment it out!                               
  deny 	message 	= Sender claims to have a local address, but is neither authenticated nor relayed (try using SMTP-AUTH!)
  	log_message   	= Forged Sender address (claims to be local user [${sender_address}], but isn't authenticated)
  	!hosts		= +relay_from_hosts
	!authenticated 	= *
	condition 	= ${if match_domain{$sender_address_domain}{+local_domains}}

  warn	message     	= You cannot be localhost.localdomain in the internet
  	log_message 	= HELO is faked as localhost.localdomain
	condition   	= ${if match{$sender_helo_name}{\Nlocalhost\.localdomain\N}}


  # we're doing HELO checks here, because we can't add headers in acl_smtp_helo
  warn	message     	= X-Invalid-HELO: HELO is IP only (See RFC2821 4.1.3)
  	log_message 	= HELO ($sender_helo_name) is IP only (See RFC2821 4.1.3)
    	condition   	= ${if isip{$sender_helo_name}}


  warn	message     	= X-Invalid-HELO: HELO is no FQDN (contains no dot) (See RFC2821 4.1.1.1)
  	log_message 	= HELO ($sender_helo_name) is no FQDN (contains no dot) (See RFC2821 4.1.1.1)
	# Required because "[IPv6:<address>]" will have no .s
    	condition   	= ${if match{$sender_helo_name}{\N^\[\N}{no}{yes}}  				
        condition   	= ${if match{$sender_helo_name}{\N\.\N}{no}{yes}}


  warn	message     	= X-Invalid-HELO: HELO is no FQDN (ends in dot) (See RFC2821 4.1.1.1)
  	log_message 	= HELO ($sender_helo_name) is no FQDN (ends in dot) (See RFC2821 4.1.1.1)
	condition   	= ${if match{$sender_helo_name}{\N\.$\N}}


  warn	message     	= X-Invalid-HELO: HELO is no FQDN (contains double dot) (See RFC2821 4.1.1.1)
  	log_message 	= HELO ($sender_helo_name) is no FQDN (contains double dot) (See RFC2821 4.1.1.1)
	condition   	= ${if match{$sender_helo_name}{\N\.\.\N}}
	

  warn	message	    	= X-Invalid-HELO: Host impersonating [$primary_hostname]
  	log_message 	= HELO ($sender_helo_name) impersonating [$primary_hostname]
      	condition   	= ${if match{$sender_helo_name}{$primary_hostname}{yes}{no}}
	# TODO: nicht auf loopback generieren


  warn	message	    	= X-Invalid-HELO: $interface_address is _my_ address
  	log_message 	= HELO ($sender_helo_name) uses _my_ address ($interface_address)
	# [own IP] or even without brackets as HELO
  	condition   	= ${if or{{\
			  	eq{[$interface_address]}{$sender_helo_name}\
			  }{\
			  	eq{$interface_address}{$sender_helo_name}\
			  }}}
	
  warn	message     	= X-Invalid-HELO: no HELO 
  	log_message 	= no HELO ($sender_helo_name)
        condition   	= ${if !def:sender_helo_name}



  #############################################################################
  # The following section of the ACL is concerned with local parts that contain
  # @ or % or ! or / or | or dots in unusual places.
  #
  # The characters other than dots are rarely found in genuine local parts, but
  # are often tried by people looking to circumvent relaying restrictions.
  # Therefore, although they are valid in local parts, these rules lock them
  # out, as a precaution.
  #
  # Empty components (two dots in a row) are not valid in RFC 2822, but Exim
  # allows them because they have been encountered. (Consider local parts
  # constructed as "firstinitial.secondinitial.familyname" when applied to
  # someone like me, who has no second initial.) However, a local part starting
  # with a dot or containing /../ can cause trouble if it is used as part of a
  # file name (e.g. for a mailing list). This is also true for local parts that
  # contain slashes. A pipe symbol can also be troublesome if the local part is
  # incorporated unthinkingly into a shell command line.
  #
  # Two different rules are used. The first one is stricter, and is applied to
  # messages that are addressed to one of the local domains handled by this
  # host. The line "domains = +local_domains" restricts it to domains that are
  # defined by the "domainlist local_domains" setting above. The rule  blocks
  # local parts that begin with a dot or contain @ % ! / or |. If you have
  # local accounts that include these characters, you will have to modify this
  # rule.

  deny    message       = Restricted characters in address
          domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]

  # The second rule applies to all other domains, and is less strict. The line
  # "domains = !+local_domains" restricts it to domains that are NOT defined by
  # the "domainlist local_domains" setting above. The exclamation mark is a
  # negating operator. This rule allows your own users to send outgoing
  # messages to sites that use slashes and vertical bars in their local parts.
  # It blocks local parts that begin with a dot, slash, or vertical bar, but
  # allows these characters within the local part. However, the sequence /../
  # is barred. The use of @ % and ! is blocked, as before. The motivation here
  # is to prevent your users (or your users' viruses) from mounting certain
  # kinds of attack on remote sites.

  deny    message       = Restricted characters in address
          domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
  #############################################################################

  # Accept mail to postmaster in any local domain, regardless of the source,
  # and without verifying the sender.

  accept  local_parts   = postmaster
          domains       = +local_domains

  # Deny unless the sender address can be verified.

  # require verify        = sender
  
  # 2006-11-03	<pille@struction.de>
  # embed a header flag, if sender callout verification fails. this may lead to rejection in future, or give a hint to bayes filter
  # the next both directives have complement verify conditions, so only one matches
  # Callout 
  #warn	message		= X-Sender-Verify: FAILED ($sender_verify_failure)
  #	log_message	= Sender ($sender_address) could not be verified using callout: $acl_verify_message ($sender_verify_failure)
  #	!verify		= sender/callout=10s,random
#
  #warn	message		= X-Sender-Verify: SUCCEEDED (sender exists & accepts mail)
  #	verify		= sender/callout=10s,random
	

  # Accept if the message comes from one of the hosts for which we are an
  # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
  # so we set control=submission to make Exim treat the message as a
  # submission. It will fix up various errors in the message, for example, the
  # lack of a Date: header line. If you are actually relaying out out from
  # MTAs, you may want to disable this. If you are handling both relaying from
  # MTAs and submissions from MUAs you should probably split them into two
  # lists, and handle them differently.

  # Recipient verification is omitted here, because in many cases the clients
  # are dumb MUAs that don't cope well with SMTP error responses. If you are
  # actually relaying out from MTAs, you should probably add recipient
  # verification here.

  # Note that, by putting this test before any DNS black list checks, you will
  # always accept from these hosts, even if they end up on a black list. The
  # assumption is that they are your friends, and if they get onto a black
  # list, it is a mistake.

  accept  hosts         = +relay_from_hosts
          control       = submission

  # Accept if the message arrived over an authenticated connection, from
  # any host. Again, these messages are usually from MUAs, so recipient
  # verification is omitted, and submission mode is set. And again, we do this
  # check before any black list tests.

  accept  authenticated = *
          # 2006-09-27 <pille@struction.de>
	  # force empty domain, when fixing header during submission, as we use fqdn in our usernames (to avoid doubled domains)
	  # 2007-01-30 <pille@struction.de>
	  # added /sender_retain option to take any given address from 'Sender:'-header (used as 'Return-path:' and for 'MAIL FROM:'-SMTP-command)
  	  #control       = submission
	  #control       = submission/domain=
	  control       = submission/sender_retain/domain=

  # Insist that any other recipient address that we accept is either in one of
  # our local domains, or is in a domain for which we explicitly allow
  # relaying. Any other domain is rejected as being unacceptable for relaying.

  require message = relay not permitted
          domains = +local_domains : +relay_to_domains

  # We also require all accepted addresses to be verifiable. This check will
  # do local part verification for local domains, but only check the domain
  # for remote domains. The only way to check local parts for the remote
  # relay domains is to use a callout (add /callout), but please read the
  # documentation about callouts before doing this.

  require verify = recipient

	
  #############################################################################
  # There are no default checks on DNS black lists because the domains that
  # contain these lists are changing all the time. However, here are two
  # examples of how you can get Exim to perform a DNS black list lookup at this
  # point. The first one denies, whereas the second just warns.
  #
   deny   message       = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
          dnslists      = zen.spamhaus.org


   deny    message       = rejected because $sender_host_address is listed in nIX Spam
           dnslists      = +defer_unknown : ix.dnsbl.manitu.net 


  # warn    dnslists      = zen.spamhaus.org
  #         add_header    = X-Warning: $sender_host_address is in a black list at $dnslist_domain
  #         log_message   = found in $dnslist_domain
  #############################################################################

  #############################################################################
  # This check is commented out because it is recognized that not every
  # sysadmin will want to do it. If you enable it, the check performs
  # Client SMTP Authorization (csa) checks on the sending host. These checks
  # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
  # an Internet draft. You can, of course, add additional conditions to this
  # ACL statement to restrict the CSA checks to certain hosts only.
  #
  # require verify = csa
  #############################################################################

  # At this point, the address has passed all the checks that have been
  # configured, so we accept it unconditionally.

  accept



# This ACL is used after the contents of a message have been received. This
# is the ACL in which you can test a message's headers or body, and in
# particular, this is where you can invoke external virus or spam scanners.
# Some suggested ways of configuring these tests are shown below, commented
# out. Without any tests, this ACL accepts all messages. If you want to use
# such tests, you must ensure that Exim is compiled with the content-scanning
# extension (WITH_CONTENT_SCAN=yes in Local/Makefile).

acl_check_data:
  
  # Lokale Blacklist Datei
 deny senders 		= /etc/exim4/deny_sender


  # Unpack MIME containers and reject file extensions
  # used by worms. Note that the extension list may be
  # incomplete.
  # No longer supported
  #deny  message 	= $found_extension files are not accepted here
  #      demime 		= com:exe:vbs:bat:pif:reg:scr
	
	
  # Reject messages that have serious MIME errors.
  # This calls the demime condition again, but will return cached results.
  # no longer supported
  #deny  message 	= Serious MIME defect detected ($demime_reason).
  #	demime 		= *
  #	condition 	= ${if >{$demime_errorlevel}{2}{1}{0}}
	       
  # Deny if the message contains a virus. Before enabling this check, you
  # must install a virus scanner and set the av_scanner option above.
  #
  deny	message   	= This message contains a virus ($malware_name) and is rejected.
  	log_message 	= rejected VIRUS ($malware_name) from $sender_address to $recipients (ClamAV)
  	set acl_m0 	= clamd:/var/run/clamav/clamd.ctl
	condition 	= ${if < {$message_size}{VIRUS_FILESIZE_LIMIT}}
  	# demime 	  	= *   // no longer supported
	malware   	= *

  # Add headers to all messages (:true). Before enabling this,
  # you must install SpamAssassin. You may also need to set the spamd_address
  # option above.
  #
  warn	message		= X-Spam-Score-new: $spam_score\n\
                      	  X-Spam-Score-Int-new: $spam_score_int\n\
                      	  X-Spam-Bar-new: $spam_bar\n\
                      	  X-Spam-Report-new: $spam_report
	!authenticated  = *
  	!hosts          = +relay_from_hosts
	condition 	= ${if < {$message_size}{SPAM_FILESIZE_LIMIT}}  
	spam      	= spamd:true

  # 2007-02-27 <pille@struction.de>
  # temp. reject messages that seem to have timeouts during spam-scan
  defer	message		= Temporary error while spam-scanning. Please try again later.
  	log_message	= message temporarily rejected, because of spam-scan error (maybe timeout)
	!authenticated  = *
  	!hosts          = +relay_from_hosts
	condition 	= ${if < {$message_size}{SPAM_FILESIZE_LIMIT}}
	condition	= ${if !def:spam_score}

  # Reject spam messages with score over 10+2*max_score_from_db (fallback=15 if mysql fails), using an extra condition.
  deny  message 	= This message is classified as UBE (SPAM) and therefore rejected. You scored $spam_score points. Congratulations!
        spam 		= spamd:true
	!authenticated  = *
  	!hosts          = +relay_from_hosts
	condition 	= ${if >={$spam_score_int}{${lookup mysql{\
				SELECT ((max(spam_threshold)*2+0)*10) AS spam_reject_threshold \ 
				FROM mailbox \
				WHERE active='1' AND local_part='${quote_mysql:$local_part}'  AND domain='${quote_mysql:$domain}' \
				  }{$value}{15}}}{true}{false}}

  # 2007-02-23 <pille@struction.de>
  # temporary reject message for greylisting, if integer spamscore is above GREYLIST_SPAM_THRESHOLD and the message (sender address + IP) is seen for the first time
  # authenticated users skip this
  defer message   	= Your Message will be greylisted! Please try again in GREYLIST_TIMEOUT seconds.
  log_message     	= message from ${sender_address} over [${sender_host_address}] will be GreyListed as it scores $spam_score spam points
  !authenticated  	= *
  !hosts		= +relay_from_hosts
  condition       	= ${if >={$spam_score_int}{GREYLIST_SPAM_THRESHOLD}{true}{false}}
  # false, if triple is in db (at this point if it's in the timeout has expired)
  # true, if not
  condition       	= ${lookup mysql{ \
  			  	SELECT MAX(first_seen) \
				FROM greylist \
				WHERE SenderIP = '${quote_mysql:$sender_host_address}' \
				AND SenderAddress = '${quote_mysql:$sender_address}' \
			  }{false}{true}}
  # insert triple into database (which should succeed)
  condition       	= ${lookup mysql{ \
  			  	INSERT INTO greylist ( SenderIP, SenderAddress, first_seen ) \
				VALUES ( '${quote_mysql:$sender_host_address}', '${quote_mysql:$sender_address}', UNIX_TIMESTAMP() ) \
			  }{$value}fail}

  # 2007-02-24 <pille@struction.de>
  # log, if mail successfully passed greylisting
  warn 	message   	= X-GreyList: Message successfully passed GreyListing after $acl_m0 seconds.
  	log_message     = message from ${sender_address} over [${sender_host_address}] with HELO ($sender_helo_name) successfully passed GreyListing after $acl_m0 seconds and scores $spam_score spam points
  	!authenticated  = *
	!hosts		= +relay_from_hosts
  	# true, if triple is in db (at this point if it's in the timeout has expired)
  	# false, if not
  	condition       = ${lookup mysql{ \
				SELECT MAX(first_seen) \
				FROM greylist \
				WHERE SenderIP = '${quote_mysql:$sender_host_address}' \
				AND SenderAddress = '${quote_mysql:$sender_address}' \
			  }{true}{false}}
  	set 	acl_m0  = ${eval:$tod_epoch-${lookup mysql{ \
			  	SELECT MAX(first_seen) \
			  	FROM greylist \
			  	WHERE SenderIP = '${quote_mysql:$sender_host_address}' \
			  	AND SenderAddress = '${quote_mysql:$sender_address}' \
			  }{$value}}}


  # save exim version and current date in header
  warn  message 	= X-Exim-Version: $version_number (build at $compile_date)\n\
			  X-Date: $tod_log\n\
			  X-Connected-IP: $sender_host_address:$sender_host_port
			  
  # save additional information in header
  warn message		= X-Message-Linecount: $message_linecount\n\  
  			  X-Body-Linecount: $body_linecount\n\
			  X-Message-Size: $message_size\n\
			  X-Body-Size: $message_body_size
			  #X-Received-Count: $received_count\n\
			  #X-Recipient-Count: $recipients_count\n\
			  #X-Local-Recipient-Count: $rcpt_count\n\
			  #X-Local-Recipient-Defer-Count: $rcpt_defer_count\n\		
			  #X-Local-Recipient-Fail-Count: $rcpt_fail_count
			  
  warn log_message = DEBUG  load_avgx1000: $load_average  spam_score: $spam_score  message_size: $message_size
			  
  # finally accept the message in DATA ACL.
  accept


######################################################################
#                      ROUTERS CONFIGURATION                         #
#               Specifies how addresses are handled                  #
######################################################################
#     THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT!       #
# An address is passed to each router in turn until it is accepted.  #
######################################################################

begin routers

# This router routes to remote hosts over SMTP by explicit IP address,
# when an email address is given in "domain literal" form, for example,
# <user@[192.168.35.64]>. The RFCs require this facility. However, it is
# little-known these days, and has been exploited by evil people seeking
# to abuse SMTP relays. Consequently it is commented out in the default
# configuration. If you uncomment this router, you also need to uncomment
# allow_domain_literals above, so that Exim can recognize the syntax of
# domain literal addresses.

# domain_literal:
#   driver = ipliteral
#   domains = ! +local_domains
#   transport = remote_smtp


# This router routes addresses that are not in local domains by doing a DNS
# lookup on the domain name. The exclamation mark that appears in "domains = !
# +local_domains" is a negating operator, that is, it can be read as "not". The
# recipient's domain must not be one of those defined by "domainlist
# local_domains" above for this router to be used.
#
# If the router is used, any domain that resolves to 0.0.0.0 or to a loopback
# interface address (127.0.0.0/8) is treated as if it had no DNS entry. Note
# that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated as the
# local host inside the network stack. It is not 0.0.0.0/0, the default route.
# If the DNS lookup fails, no further routers are tried because of the no_more
# setting, and consequently the address is unrouteable.


#
# normale Zustellung
# für richtige Mailserver
#
dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  no_more

#
# für Smarthost Zustellung
#
#divertnonlocal:
#driver = manualroute
#domains = ! +local_domains
#transport = remote_smtp
#route_list = * REMOTE.SMTP.SERVER.ORG
#ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
#no_more


# The remaining routers handle addresses in the local domain(s), that is those
# domains that are defined by "domainlist local_domains" above.


# 2006-10-02 <pille@struction.de>	all-user-aliases from mysql-db
# alle@<domain> is an auto-generated alias for all users of <domain>, which is only available for authenticated senders
# NOTE: we need to respect SMTP_allowed for every user!
mysql_all_domain_alias:
  driver 	= redirect
  # restriction to local domains only may be a double check, as data takes care of it already ;-)
  domains 	= +local_domains
  local_parts 	= alle
  data 		= ${lookup mysql{ \
		  	SELECT username AS sendto \
			FROM mailbox \
			WHERE domain='${quote_mysql:$domain}' \
			AND active='1' \
		  }}
  # treat localhost as authenticated
  condition 	= ${if or {{\
  			def:authenticated_id\
		    }{\
		      	eq {$sender_host_address}{127.0.0.1}\
		    }}\
		  }
  file_transport = address_file
  pipe_transport = address_pipe
  
  
# 2006-10-02 <pille@struction.de>	aliases from mysql-db
# an alias can be specified by giving one or more db-entries that match username and domain,
# or return a comma-seperated list of recipients.
# when no domain is specified in db-entry, recipients are taken from all domains with a matching username
# setting internal='YES' only allows sending mail to this alias, if authenticated (for internal usage)
mysql_alias:
  driver                = redirect
  # restriction to local domains only may be a double check, as data takes care of it already ;-)
  domains               = +local_domains
  file_transport        = address_file
  pipe_transport        = address_pipe
 data                    = ${if or {{\
                                def:authenticated_id\
                          }{\
                                eq {$sender_host_address}{127.0.0.1}\
                          }}{\
                                ${lookup mysql{ \
                                        SELECT goto \
                                        FROM alias \
                                        WHERE ( address='${quote_mysql:$local_part}@${quote_mysql:$domain}') }}\
                          } {\
                                ${lookup mysql{ \
                                        SELECT goto \
                                        FROM alias \
                                        WHERE ( ( address='${quote_mysql:$local_part}@${quote_mysql:$domain}')  \
                                        AND active='1' )}}\
                          }}
  local_part_suffix 	= +*
  local_part_suffix_optional


# 2006-10-03 <pille@struction.de>
# virtual user in mysql-db? and suffixed with a condition?
# currently supported: 
# 	<user>#before#<yyyymmdd>@<localdomain>			e.g.: pille#before#20061003@struction.de will accept mail for existing user pille@struction.de, if current date is before 20061003
# 	<user>#fromdomain#<senderdomain>@<localdomain>		e.g.: pille#fromdomain#example.com@struction.de will accept mail for existing user pille@struction.de, if current domain of sender is example.com
mysql_user_condition:
  driver 		= accept
  # restriction to local domains only may be a double check, as the condition takes care of it already ;-)
  domains 		= +local_domains
  # 2006-10-08 <pille@struction.de>
  # as we embed base64 encoded strings in local_part_suffix, and these are case sensitive, we must take care of them.
  # NOTE: this results in the missing feature, that conditional-mails in this router are case-sensitive! (pille#...#...@struction.de != Pille#...#...@struction.de)
  caseful_local_part 	= true
  condition 		= ${if and {{\
  					# existing user
  					eq {${lookup mysql{ \
						SELECT username AS email \
						FROM mailbox \
						WHERE local_part='${quote_mysql:$local_part}' \
						AND domain='${quote_mysql:$domain}' \
						AND active='1' \
					}{true}{false}}}{true}\
			  	   }{\
					# different conditions
					or {{\
						# suffix contains #before# and date (yyyymmdd) is not yet #before#yyyymmdd		
						and {{\
							eq {${sg{$local_part_suffix}{^#([^#]+)#[0-9]\{8\}\$}{\$1}}}{before}\
					    	}{\
							lt {$tod_logfile}{${sg{$local_part_suffix}{^#[^#]+#([0-9]\{8\})\$}{\$1}}}\
			    	     	    	}\
				           }\
					   }{\
						# suffix contains #fromdomain# and the domain-name of sender
						and {{\
							eq {${sg{$local_part_suffix}{^#([^#]+)#.*\$}{\$1}}}{fromdomain}\
						    }{\
							eq {$sender_address_domain}{${sg{$local_part_suffix}{^#[^#]+#(.*)\$}{\$1}}}\
			    	     		    }\
				     		}\
			    		   }{\
						# suffix contains #b64from# and the base64 encoded address of sender	DOES NOT WORK YET!
						and {{\
							eq {${sg{$local_part_suffix}{^#([^#]+)#.*\$}{\$1}}}{b64from}\
					            }{\
							eq {${str2b64:$sender_address}}{${sg{$local_part_suffix}{^#[^#]+#(.*)\$}{\$1}}}\
			    	     	    	    }\
				     		}\
			    		   }\
					}\
				   }\
		   	  }\
			  }
  local_part_suffix 	= #*
  transport 		= local_mysql_delivery_dovecot


# 2006-09-07 <pille@struction.de>	virtual user in mysql-db? (note: it's not nessessary to return real data)
mysql_user:
  driver 		= accept
  # restriction to local domains only may be a double check, as the condition takes care of it already ;-)
  domains 		= +local_domains
  condition 		= ${lookup mysql{ \
  				SELECT username AS email \
				FROM mailbox \
				WHERE local_part='${quote_mysql:$local_part}' \
				AND domain='${quote_mysql:$domain}' \
				AND active='1' \
			  }{true}{false}}
  local_part_suffix 	= +*
  local_part_suffix_optional
  transport 		= local_mysql_delivery_dovecot
  no_more


# 2007-01-16 <pille@struction.de>	catchall domains
# a catchall domain can be specified by giving one or more db-entries that match the domain,
# or return a comma-seperated list of recipients.
# this router acts as a fallback, so it has to be placed below all routers that react on 'users'.
# any mail to a not otherwise (in another router above) defined local_prefix in these domains are forwarded.
# so keep in mind that this mostly may forward unsolicited mail and should not be used at all ;-)
#mysql_catchall:
#  driver 		= redirect
#  # restriction to local domains only may be a double check, as data takes care of it already ;-)
#  domains 		= +local_domains
#  file_transport 	= address_file
#  pipe_transport 	= address_pipe
#  data 			= ${lookup mysql{ \
#  			  	SELECT sendto \
#				FROM catchall \
#				WHERE domain='${quote_mysql:$domain}' \
#			  }}


# This router handles aliasing using a linearly searched alias file with the
# name /etc/mail/aliases. When this configuration is installed automatically,
# the name gets inserted into this file from whatever is set in Exim's
# build-time configuration. The default path is the traditional /etc/aliases.
# If you install this configuration by hand, you need to specify the correct
# path in the "data" setting below.
#
##### NB  You must ensure that the alias file exists. It used to be the case
##### NB  that every Unix had that file, because it was the Sendmail default.
##### NB  These days, there are systems that don't have it. Your aliases
##### NB  file should at least contain an alias for "postmaster".
#
# If any of your aliases expand to pipes or files, you will need to set
# up a user and a group for these deliveries to run under. You can do
# this by uncommenting the "user" option below (changing the user name
# as appropriate) and adding a "group" option if necessary. Alternatively, you
# can specify "user" on the transports that are used. Note that the transports
# listed below are the same as are used for .forward files; you might want
# to set up different ones for pipe and file deliveries from aliases.

system_aliases:
  driver 		= redirect
  allow_fail
  allow_defer
  data 			= ${lookup{$local_part}lsearch{/etc/mail/aliases}}
# user 			= exim
  file_transport 	= address_file
  pipe_transport 	= address_pipe


# This router handles forwarding using traditional .forward files in users'
# home directories. If you want it also to allow mail filtering when a forward
# file starts with the string "# Exim filter" or "# Sieve filter", uncomment
# the "allow_filter" option.

# If you want this router to treat local parts with suffixes introduced by "-"
# or "+" characters as if the suffixes did not exist, uncomment the two local_
# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
# in the same way as xxxx@your.domain by this router. You probably want to make
# the same change to the localuser router.

# The no_verify setting means that this router is skipped when Exim is
# verifying addresses. Similarly, no_expn means that this router is skipped if
# Exim is processing an EXPN command.

# The check_ancestor option means that if the forward file generates an
# address that is an ancestor of the current one, the current one gets
# passed on instead. This covers the case where A is aliased to B and B
# has a .forward file pointing to A.

# The three transports specified at the end are those that are used when
# forwarding generates a direct delivery to a file, or to a pipe, or sets
# up an auto-reply, respectively.

# 2009-08-01 <pille@struction.de>  not needed, since we don't have users ;-)
#userforward:
#  driver 		= redirect
#  check_local_user
## local_part_suffix 	= +* : -*
## local_part_suffix_optional
#  file 			= $home/.forward
## allow_filter
#  no_verify
#  no_expn
#  check_ancestor
#  file_transport 	= address_file
#  pipe_transport 	= address_pipe
#  reply_transport 	= address_reply


# This router matches local user mailboxes. If the router fails, the error
# message is "Unknown user".

# If you want this router to treat local parts with suffixes introduced by "-"
# or "+" characters as if the suffixes did not exist, uncomment the two local_
# part_suffix options. Then, for example, xxxx-foo@your.domain will be treated
# in the same way as xxxx@your.domain by this router.

localuser:
  driver 		= accept
  check_local_user
# local_part_suffix 	= +* : -*
# local_part_suffix_optional
  transport = local_delivery_dovecot
  cannot_route_message 	= Unknown user



######################################################################
#                      TRANSPORTS CONFIGURATION                      #
######################################################################
#                       ORDER DOES NOT MATTER                        #
#     Only one appropriate transport is called for each delivery.    #
######################################################################

# A transport is used only when referenced from a router that successfully
# handles an address.

begin transports


# This transport is used for delivering messages over SMTP connections.

remote_smtp:
  driver 		= smtp
  headers_remove 	= X-Spam-Report:X-Spam-Bar
#  hosts_try_auth 	= SMTP.REMOTE.ORG

# This transport is used for local delivery to user mailboxes in traditional
# BSD mailbox format. By default it will be run under the uid and gid of the
# local user, and requires the sticky bit to be set on the /var/mail directory.
# Some systems use the alternative approach of running mail deliveries under a
# particular group instead of using the sticky bit. The commented options below
# show how this can be done.

local_delivery_dovecot:
  driver = pipe
  command = /usr/lib/dovecot/deliver -e -k -d $local_part@$domain
  message_prefix =
  message_suffix =
  delivery_date_add
  envelope_to_add
  return_path_add
  log_output
  user = emails
  group = emails
  temp_errors = 64 : 69 : 70: 71 : 72 : 73 : 74 : 75 : 78





local_mysql_delivery_dovecot:
  driver = pipe
  command = /usr/lib/dovecot/deliver  -e -k -d  $local_part@$domain
  message_prefix =
  message_suffix =
  delivery_date_add
  envelope_to_add
  return_path_add
  user 		= emails
  group 	= emails
  temp_errors = 64 : 69 : 70: 71 : 72 : 73 : 74 : 75 : 78
  log_output

  # at this time, we know a local user to get his individual preferences to tag the mail
  # the '${eval:$header_X-Spam-Score-Int:}' is is a hack to cope with negative ints that seem to be parsed as strings, thus failing the comparsion
  # if there's no X-Spam-Score-Int header set by data-acl above, don't panic ;-)
  # another hack is that we remove important headers, we add later to be sure there are no multiple versions from earlier relays, or forged ones (this is BUGGY right now as it merges all equal headers!)
  #     therefore i implemented the ${sg{$header_X-Spam-Score-Int:}{^.*\n}{}} regex hack, that strips all


# This transport is used for handling pipe deliveries generated by alias or
# .forward files. If the pipe generates any standard output, it is returned
# to the sender of the message as a delivery error. Set return_fail_output
# instead of return_output if you want this to happen only when the pipe fails
# to complete normally. You can set different transports for aliases and
# forwards if you want to - see the references to address_pipe in the routers
# section above.

address_pipe:
  driver = pipe
  return_output


# This transport is used for handling deliveries directly to files that are
# generated by aliasing or forwarding.

address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add


# This transport is used for handling autoreplies generated by the filtering
# option of the userforward router.

address_reply:
  driver = autoreply



######################################################################
#                      RETRY CONFIGURATION                           #
######################################################################

begin retry

# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the first
# failed delivery.

# WARNING: If you do not have any retry rules at all (this section of the
# configuration is non-existent or empty), Exim will not do any retries of
# messages that fail to get delivered at the first attempt. The effect will
# be to treat temporary errors as permanent. Therefore, DO NOT remove this
# retry rule unless you really don't want any retries.
 
# Address or Domain    Error       Retries
# -----------------    -----       -------

# 2007-03-28 <pille@struction.de>
# in the beginning  try every 5 minutes for the first 15 minutes to speed up possible greylisting
#*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h
*                      *           F,15m,5m; F,2h,15m; G,16h,1h,1.5; F,4d,6h



######################################################################
#                      REWRITE CONFIGURATION                         #
######################################################################

# There are no rewriting specifications in this default configuration file.

begin rewrite



######################################################################
#                   AUTHENTICATION CONFIGURATION                     #
######################################################################

# The following authenticators support plaintext username/password
# authentication using the standard PLAIN mechanism and the traditional
# but non-standard LOGIN mechanism, with Exim acting as the server.
# PLAIN and LOGIN are enough to support most MUA software.
#
# These authenticators are not complete: you need to change the
# server_condition settings to specify how passwords are verified.
# They are set up to offer authentication to the client only if the
# connection is encrypted with TLS, so you also need to add support
# for TLS. See the global configuration options section at the start
# of this file for more about TLS.
#
# The default RCPT ACL checks for successful authentication, and will accept
# messages from authenticated users from anywhere on the Internet.

begin authenticators
# only advertise, if connection is encrypted (as the secret is transmitted in plain text)
# we store only password-hashes so we cannot use cram-md5 (which avoids transmitting the secret)

#plain:
#driver 				= plaintext
#public_name 			= PLAIN
##server_advertise_condition 	= ${if eq{$tls_cipher}{}{no}{yes}}
#
#
#server_advertise_condition	= yes
#server_condition 		= ${if crypteq {$3}{\{md5\}${lookup mysql{ \
#								SELECT password \
#								FROM user \
#								WHERE CONCAT(username,'@',domain)='${quote_mysql:$2}' \
#								AND enabled='YES' \
#					      		    }}}{yes}{no}}
#server_set_id 			= $2

#
# für SMTP Auth
#
#plain:                                                               
#driver = plaintext                                                 
#public_name = PLAIN                                                
#client_send = "^USERNAME^PASS"                                 
                                                                    
#login:                                                               
#driver = plaintext                                                 
#public_name = LOGIN                                                
#client_send = ": USERNAME : PASS"   

#
# für SMTP Auth ENDE
#

dovecot_plain:
  driver = dovecot
  public_name = PLAIN
  server_socket = /var/run/dovecot/auth-client
  server_set_id = $2


dovecot_login:
  driver = dovecot
  public_name = "LOGIN"
  server_socket = /var/run/dovecot/auth-client
  server_set_id = $1


######################################################################
#                   CONFIGURATION FOR local_scan()                   #
######################################################################

# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember to
# uncomment the "begin" line. It is commented by default because it provokes
# an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.

# begin local_scan


# End of Exim configuration file
