Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Merge pull request #205 from Udera/rcpt
Review order of RCPT-ACLs
  • Loading branch information
rimas-kudelis committed Aug 20, 2016
2 parents 9a78e9a + 0313170 commit f450093
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 33 deletions.
49 changes: 16 additions & 33 deletions docs/configure
Expand Up @@ -343,9 +343,6 @@ acl_check_rcpt:

accept hosts = :

# Include Vexim specific rcpt ACLs
.include /usr/local/etc/exim/vexim-acl-check-rcpt.conf

# Deny if the local part contains @ or % or / or | or !. These are rarely
# found in genuine local parts, but are often tried by people looking to
# circumvent relaying restrictions.
Expand All @@ -363,22 +360,22 @@ acl_check_rcpt:
accept local_parts = postmaster
domains = +local_domains

# Deny unless the sender address can be verified.
# require verify = sender

#############################################################################
# There are no checks on DNS "black" lists because the domains that contain
# these lists are changing all the time. However, here are two examples of
# how you could get Exim to perform a DNS black list lookup at this point.
# The first one denies, while the second just warns.
#
# deny message = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
# dnslists = black.list.example
#
# warn message = X-Warning: $sender_host_address is in a black list at $dnslist_domain
# log_message = found in $dnslist_domain
# dnslists = black.list.example
#############################################################################
# Accept if the message arrived over an authenticated connection, from
# any host. These messages are usually from MUAs that don't cope well
# with SMTP error responses, so recipient verification is omitted.

accept authenticated = *

# Accept if the message comes from one of the hosts for which we are an
# outgoing relay. Recipient verification is omitted here, because in many
# cases the clients are MUAs. If you are actually relaying out from MTAs,
# you should probably add recipient verification here.

accept hosts = +relay_from_hosts

# Include Vexim specific rcpt ACLs

.include /usr/local/etc/exim/vexim-acl-check-rcpt.conf

# Accept if the address is in a local domain, but only if the recipient can
# be verified. Otherwise deny. The "endpass" line is the border between
Expand All @@ -399,20 +396,6 @@ acl_check_rcpt:
# If control reaches this point, the domain is neither in +local_domains
# nor in +relay_to_domains.

# Accept if the message comes from one of the hosts for which we are an
# outgoing relay. Recipient verification is omitted here, because in many
# cases the clients are dumb MUAs that don't cope well with SMTP error
# responses. If you are actually relaying out from MTAs, you should probably
# add recipient verification here.

accept hosts = +relay_from_hosts

# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
# verification is omitted.

accept authenticated = *

# Reaching the end of the ACL causes a "deny", but we might as well give
# an explicit message.

Expand Down
4 changes: 4 additions & 0 deletions docs/vexim-acl-check-rcpt.conf
Expand Up @@ -60,6 +60,10 @@
.endif


# Deny unless the sender address can be verified.
# require verify = sender


# To use a DNSBL the best would be to set up a caching dns server (e.g. unbound) because there is
# often a rate limit that you will hit when using public DNS servers.
deny message = DNSBL listed at $dnslist_domain\n$dnslist_text
Expand Down

0 comments on commit f450093

Please sign in to comment.