Re: [exim] Trigger a spam/malware scan within a router, outside the smtp_data ACL

On Fri, 1 Apr 2022 09:01:09 +0100 Jeremy Harris via Exim-users wrote: > On 01/04/2022 06:12, Christian Balzer via Exim-users wrote: > > Any suggestions > Exim with debug mode, for more info. > As I wrote that was ALL of the pertinent out from a "-d -bv" session, a &q

Re: [exim] Trigger a spam/malware scan within a router, outside the smtp_data ACL

On Wed, 30 Mar 2022 23:10:44 +0900 Christian Balzer via Exim-users wrote: > On Wed, 30 Mar 2022 13:00:13 +0100 Jeremy Harris via Exim-users wrote: > > > On 30/03/2022 08:44, Christian Balzer via Exim-users wrote: > > > Can the not_smtp ACL be abused for that with a pipe

Re: [exim] Trigger a spam/malware scan within a router, outside the smtp_data ACL

On Wed, 30 Mar 2022 13:00:13 +0100 Jeremy Harris via Exim-users wrote: > On 30/03/2022 08:44, Christian Balzer via Exim-users wrote: > > Can the not_smtp ACL be abused for that with a pipe transport or similar? > > Possibly, but rather unclean. > > Slightly less so w

[exim] Trigger a spam/malware scan within a router, outside the smtp_data ACL

or similar? Alternatively (but I doubt that's possible) can a collated list of target address (as in the "exim -v -bv adress" command) be created during ACL time, similar to the SMTP RCPT recipients one? Don't suggest amavisd please. ^o^ Regards, Christian -- Christian Balzer

Re: [exim] Google/gmail timeouts, IPv6 conntrack issue?

-dont-send-to-gmail-over-ipv6.html Christian On Wed, 16 Feb 2022 21:45:31 + Jeremy Harris via Exim-users wrote: > On 16/02/2022 07:17, Christian Balzer via Exim-users wrote: > > Now the reason this happens is that the local iptables > > (Established, Related is set) is starting to r

Re: [exim] Truncated warning messages (again)

On Fri, 18 Feb 2022 10:58:35 + (GMT) Andrew C Aitchison via Exim-users wrote: > On Fri, 18 Feb 2022, Christian Balzer via Exim-users wrote: > > On Thu, 17 Feb 2022 11:25:01 + Jeremy Harris via Exim-users wrote: > >> On 17/02/2022 05:04, Christian Balzer vi

Re: [exim] Truncated warning messages (again)

On Thu, 17 Feb 2022 11:25:01 + Jeremy Harris via Exim-users wrote: > On 17/02/2022 05:04, Christian Balzer via Exim-users wrote: > > Maybe phrasing here, but clearly the previous behavior of displaying the > > full response of the remote SMTP server is more "beautiful&quo

Re: [exim] Google/gmail timeouts, IPv6 conntrack issue?

On Thu, 17 Feb 2022 11:25:15 +0300 Evgeniy Berdnikov via Exim-users wrote: > On Thu, Feb 17, 2022 at 02:01:49PM +0900, Christian Balzer via Exim-users > wrote > > If found it excruciatingly hard to correlate tcpdump and nf_conntrack > > flows, > > These data can b

Re: [exim] Google/gmail timeouts, IPv6 conntrack issue?

Hello, On Thu, 17 Feb 2022 10:00:12 +0100 Kai Bojens via Exim-users wrote: > Am 16.02.22 um 08:17 schrieb Christian Balzer via Exim-users: > > > On the MSAs we added IPv6 and noticed this oddity when delivering large > > mails (over 128KB it seems) to google/gmail via v6: &

Re: [exim] Truncated warning messages (again)

On Wed, 16 Feb 2022 12:43:33 + Jeremy Harris via Exim-users wrote: > On 16/02/2022 12:36, Christian Balzer via Exim-users wrote: > > If you'd be so kind to have a look at what I quoted, as in this 2yo thread: > > https://www.mail-archive.com/exim-users@exim.org/msg54030.html

Re: [exim] Google/gmail timeouts, IPv6 conntrack issue?

Hello, firstly this was mostly meant as a heads up to other potentially encountering this and of course a "have you seen this before" kinda query. On Wed, 16 Feb 2022 21:45:31 + Jeremy Harris via Exim-users wrote: > On 16/02/2022 07:17, Christian Balzer via Exim-users w

[exim] Google/gmail timeouts, IPv6 conntrack issue?

re-tried by exim using v4, is there some logic present that goes "if address family a fails, try family b before any further IPs from family a"? Regards, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Rakuten Communications 13:53:35.6

Re: [exim] Truncated warning messages (again)

On Wed, 16 Feb 2022 12:14:59 + Jeremy Harris via Exim-users wrote: > On 16/02/2022 05:49, Christian Balzer via Exim-users wrote: > > any comment, even a "too hard to go back to what was working beautifully, > > won't fix." would be really appreciated. > > Wh

Re: [exim] Truncated warning messages (again)

Hello, any comment, even a "too hard to go back to what was working beautifully, won't fix." would be really appreciated. Regards, Christian On Tue, 28 Dec 2021 17:40:43 +0900 Christian Balzer via Exim-users wrote: > Hello, > > Nearly exactly 2 years later, le

[exim] Truncated warning messages (again)

s the only message in the queue and/or destined for gmail. Is there any hope that this will be fixed? Can it be done via some config option to increase the DBM record size? Regards, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Rakuten Comm

Re: [exim] Taint checker confusing error (blaming file but caused by later ldap lookup)

t http://www.exim.org/ > ## Please use the Wiki with this list - http://wiki.exim.org/ > -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Rakuten Communications -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/

[exim] Taint checker confusing error (blaming file but caused by later ldap lookup)

he false taint error in this case? Thanks, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Rakuten Communications -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the

Re: [exim] SSL wildcard certificate intermediate CA weirdness

On Mon, 23 Dec 2019 09:31:08 +0100 Heiko Schlittermann via Exim-users wrote: > Christian Balzer (Mo 23 Dez 2019 06:07:46 CET): > > > > > I've tried this with "openssl s_server" and it works either which way, > > unsurprisingly. > > "openssl s_server

Re: [exim] SSL wildcard certificate intermediate CA weirdness

On Fri, 20 Dec 2019 15:01:16 +0100 Heiko Schlittermann wrote: > Christian Balzer (Fr 20 Dez 2019 14:49:27 CET): > > > > The testmail.do.main VIP is handled by smtp01 and 02, with being > > > > resident > > > > on smtp01 for most of the test

Re: [exim] SSL wildcard certificate intermediate CA weirdness

On Fri, 20 Dec 2019 07:47:42 +0100 Heiko Schlittermann via Exim-users wrote: > Christian Balzer via Exim-users (Fr 20 Dez 2019 > 01:15:18 CET): > > > > Kinda implied by the VIP, pacemaker bits. :) > > > > The testmail.do.main VIP is handled by smtp01 and 02, wit

Re: [exim] SSL wildcard certificate intermediate CA weirdness

On Fri, 20 Dec 2019 09:09:28 + Jeremy Harris via Exim-users wrote: > On 20/12/2019 02:47, Christian Balzer via Exim-users wrote: > >>> The same VIP was used for testing with HTTPS (apache), IMAPS and POP3S > >>> (dovecot) w/o issues so the problem is not sy

Re: [exim] SSL wildcard certificate intermediate CA weirdness

Hello, On Fri, 20 Dec 2019 00:38:29 + Jeremy Harris via Exim-users wrote: > On 20/12/2019 00:15, Christian Balzer via Exim-users wrote: > > Kinda implied by the VIP, pacemaker bits. :) > > You're running a loadbalancer for smtp? When a couple of > MX's does the same

Re: [exim] SSL wildcard certificate intermediate CA weirdness

On Thu, 19 Dec 2019 20:03:46 + Jeremy Harris via Exim-users wrote: > On 19/12/2019 03:25, Christian Balzer via Exim-users wrote: > > With Exim (4.89 Debian) when connecting to testmail.do.main:465 only the > > server (wildcard) certificate is returned, not the inte

[exim] SSL wildcard certificate intermediate CA weirdness

tting up Thunderbird to use testmail.do.main:465 as SMTP server works fine w/o any errors or requests for exceptions, so I'm not particular worried about this, but clearly when testing with openssl one would like to see successes in all cases. Regards, Christian -- Christian BalzerNetw

Re: [exim] ACL with suffix or prefix (again)

On Tue, 21 May 2019 09:41:47 +0100 Jeremy Harris via Exim-users wrote: > On 21/05/2019 06:50, Christian Balzer via Exim-users wrote: > > 13 years ago we had this: > > https://lists.exim.org/lurker/message/20060201.151954.0a776084.pt.html > > (2006) > > >

[exim] ACL with suffix or prefix (again)

thing like this: --- accept recipients= EXCEPTUSERS --- would work with either abuse@ or abuse=something@ as expected. Any thoughts? Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Rakuten Communications -- ## List details at https://list

Re: [exim] EXIM Timeout on tcp required ports

ble For Hire: https://linkedin.com/in/billcole > > -- > ## List details at https://lists.exim.org/mailman/listinfo/exim-users > ## Exim details at http://www.exim.org/ > ## Please use the Wiki with this list - http://wiki.exim.org/ > -- Christian BalzerNetwork/Systems E

[exim] The Google Lie

who might be seeing this and scratching their heads. Regards, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Rakuten Communications -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ##

Re: [exim] exim spfquery config

ows what else PRECISELY because people out there will ignore our policy settings and use any such published records to filter things hard based on was at best a subtle hint in an inherently broken design. See also my next post later today. Regards, Christian -- Christian BalzerNetwork/Syst

Re: [exim] DMARC and ARC in the default configuration?

the sand approach isn't the way forward either. Especially for those of use whose job it is to supply/support large scale mail systems. As for Jeremy, I'll probably go and do the operational deployment at least on some secondary MXs, but can't help with the buildfarm bits. Regards, Christian

[exim] DMARC and ARC in the default configuration?

ble will help polish these features. Note that I'm no fan of any of the above schemes, but that lemmings train seems to have come and gone. Regards, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Rakuten Communications -- ## List details at ht

Re: [exim] TLS error on connection (gnutls_handshake): timed out

y with these. Would be nice is people with high volume mail servers could have a peek in their logs to see if that's happening to them, too. Christian On Wed, 26 Jul 2017 22:14:11 +0900 Christian Balzer wrote: > On Wed, 26 Jul 2017 13:33:26 +0100 Jeremy Harris wrote: > > > On 26/07/17 13:08,

Re: [exim] TLS error on connection (gnutls_handshake): timed out

On Wed, 26 Jul 2017 13:33:26 +0100 Jeremy Harris wrote: > On 26/07/17 13:08, Christian Balzer wrote: > > 2017-07-26 17:47:11 1daHyG-0006wE-On <= somebodyredacted.com U=mail > > P=spam-scanned S=8615 > > id=ps1pr0302mb2521ea6d93330dc628d6b68a8d...@ps1pr0302mb2521.a

Re: [exim] TLS error on connection (gnutls_handshake): timed out

On Wed, 26 Jul 2017 12:41:29 +0100 Jeremy Harris wrote: > On 26/07/17 11:41, Christian Balzer wrote: > > The original connection was actually in the previous logfile. ^o^ > > --- > > 2017-07-26 06:01:14 1da6x5-0005fV-IX <= redacted@redacted U=mail > > P=spam-sc

Re: [exim] TLS error on connection (gnutls_handshake): timed out

On Wed, 26 Jul 2017 10:46:44 +0100 (BST) Andrew C Aitchison wrote: > On Wed, 26 Jul 2017, Jeremy Harris wrote: > > > On 26/07/17 01:29, Christian Balzer wrote: > >> 2017-07-26 08:12:33 1da6x5-0005fV-IX > >> H=redacted.mail.protection.outlook.com [23.103.139.138]

[exim] TLS error on connection (gnutls_handshake): timed out

handshake timeout be configured to be something more sensible (like a minute or less)? Regards, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Rakuten Communications -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim

Re: [exim] Spurious segfaults with Exim 4.88

Hello, On Wed, 25 Jan 2017 09:34:39 + Jeremy Harris wrote: > On 25/01/17 07:10, Christian Balzer wrote: > > I'd be happy to collect cores if this can be turned on with the existing > > binaries, but I have a feeling that the RLIMIT_CORE override is still in > > there a

[exim] Spurious segfaults with Exim 4.88

-- Christian BalzerNetwork/Systems Engineer ch...@gol.com Global OnLine Japan/Rakuten Communications http://www.gol.com/ -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list

Re: [exim] SMTP VRFY (was: gotcha: chunking and predata)

P. > You're missing for example this: http://slett.net/spam-filtering-for-mx/exim-sign.html Which is something we use/offer here. And the client IP address (RBL, locally listed) is another factor. RCPT TO might be ineffective, but I don't see me exposing VRFY/EXPN ever. Christian -- Ch

Re: [exim] DKIM signing with the i= (Identity) tag/header

On Tue, 22 Nov 2016 15:58:24 + Jeremy Harris wrote: > On 22/11/16 15:45, Christian Balzer wrote: > > On Tue, 22 Nov 2016 14:06:28 + Jeremy Harris wrote: > > > >> On 21/11/16 08:44, Christian Balzer wrote: > >>> The problem was with the DNS

Re: [exim] DKIM signing with the i= (Identity) tag/header

ous DKIM testers (including the plugin for Thunderbird) seem to be utterly strict ("dkim1" does NOT equate "DKIM1") I suppose Exim ought to be, too. Despite my personal preference of having MTAs like Exim work with near garbage if all relevant information is there to be found

Re: [exim] DKIM signing with the i= (Identity) tag/header

On Tue, 22 Nov 2016 14:06:28 + Jeremy Harris wrote: > On 21/11/16 08:44, Christian Balzer wrote: > > The problem was with the DNS TXT record after all, but so subtly that > > Exim itself didn't spot it and gave things clean bill of health when > > checking mails s

Re: [exim] DKIM signing with the i= (Identity) tag/header

Hello Phil, On Mon, 21 Nov 2016 23:00:47 + Phil Pennock wrote: > On 2016-11-21 at 17:44 +0900, Christian Balzer wrote: > > To wit, the record had "v=DKIM1\\\; k=rsa\\\; ..." in it, instead of a > > single backslash. > > The people responsible are

Re: [exim] DKIM signing with the i= (Identity) tag/header

Hello Phil, On Mon, 21 Nov 2016 07:59:33 + Phil Pennock wrote: > On 2016-11-21 at 11:06 +0900, Christian Balzer wrote: > > Since the "i=" field is optional, that doesn't come as a big surprise, nor > > should it be an issue. > > > > That is, if it we

[exim] DKIM signing with the i= (Identity) tag/header

results when dealing with the Google behemoth? Regards, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Global OnLine Japan/Rakuten Communications http://www.gol.com/ -- ## List details at https://lists.exim.org/mailman/listinfo/exim-user

[exim] Sporadic relaying not permitted errors

this error. Regards, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Global OnLine Japan/Fusion Communications http://www.gol.com/ -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org

Re: [exim] Sporadic relaying not permitted errors

On Mon, 26 Mar 2012 13:03:35 +1000 Ted Cooper wrote: On 26/03/12 12:48, Christian Balzer wrote: If LDAP were the culprit I'd expect a different (user not found) error so I'm rather stumped and puzzled at this time. Is there any scenario anybody can think of how a relaying not permitted

[exim] sender_rcvhost versus SpamAssassin RDNS_NONE

be addressed by the SA folks, can somebody here conjure up a received_header_text definition that would play nice with SA's quirky RDNS_NONE rule? Regards, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Global OnLine Japan/Fusion

Re: [exim] SQL select for $spam_score_int in acl_smtp_data for $domain

recipient basis AFTER the SMTP DATA phase there are no really good solutions to this problem unfortunately. Technically perfectly fine and valid answer by Jeremy, it's just a pet peeve of mine and thus me piping up. ^^ Dewa, Chibi -- Christian BalzerNetwork/Systems Engineer

Re: [exim] Exim and SPF

) of BATV. We're using it here and amazingly enough Google finds our crappy PR blabber way way before the actual URL on which I based our implementation: http://www.tldp.net/HOWTO/Spam-Filtering-for-MX/exim-sign.html Regards, Christian -- Christian BalzerNetwork/Systems Engineer

Re: [exim] Exim and SPF

based data as in BATV. Similar line of reasoning why our greylisting does not include IP addresses. YMMV etc. Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Global OnLine Japan/Fusion Communications http://www.gol.com/ -- ## List details

Re: [exim] Exim and SPF

On Tue, 15 Dec 2009 15:31:53 + Mike Cardwell wrote: On 15/12/2009 13:39, Christian Balzer wrote: The example they provide looks dangerous to me: return_path= $sender_address_local_part=$local_part=$domain=\ ${hash_8:${hmac{md5}{SECRET}{${lc

Re: [exim] Exim development

. Regards, Christian -- Christian BalzerNetwork/Systems Engineer ch...@gol.com Global OnLine Japan/Fusion Communications http://www.gol.com/ -- ## List details at http://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org

Re: [exim] Remote shadow transport

this to work we would be one of those vendors/suppliers. ;) I'm sure (I hope) someone else will pipe up now, if you'll excuse the terrible pun. So far none, I guess they could not stand the pun-ishment. Regards, Christian -- Christian BalzerNetwork/Systems EngineerNOC ch

[exim] Remote shadow transport

then? The only things I could come up with would be local deliveries to temporary location where some external cron script picks them up and re-sends them. Not elegant at all... Any other ideas about this or takers to actually implement that feature? Regards, Christian -- Christian Balzer

Re: [exim] Remote shadow transport

Hello Graeme, On Mon, 03 Aug 2009 14:18:36 +0100 Graeme Fowler wrote: On Mon, 2009-08-03 at 16:44 +0900, Christian Balzer wrote: So how do people keep a backup (meaning only mails that actually got a final delivery, splitting things off earlier is trivial of course) of incoming mails

Re: [exim] adding rbls...

% hits after zen so it is kinda pointless. Using spamcop to deny mails is one of the most stupid things you could do. If I had a dollar for every false alert/listing from them, I'd be a rich goat. Regards, Christian -- Christian BalzerNetwork/Systems EngineerNOC ch

Re: [exim] Emailreg.org - have you seen this?

by Barracuda. This trips my personal sleaze-o-meter in a big way; your mileage may vary. Indeed. Also this of course breaks forwarding or at the very least is unusable for ISPs and others allowing/using forwarding. Regards, Christian -- Christian BalzerNetwork/Systems Engineer

Re: [exim] Defer mail for time

the ones a default exim config will generate after it has been unable to hand off a mail for more than 4 hours. If any of the systems you are deferring implement such a thing, there will be plenty of fallout. Regards, Christian -- Christian BalzerNetwork/Systems EngineerNOC ch

[exim] Exim 4.6x versus qmail (CRLF issue?)

or CRCRLF to appear on the wire. Workaround: none --- (from http://www-dt.e-technik.uni-dortmund.de/~ma/qmail-bugs.html) and a changed default behavior in Exim 4 compared to 3 on how to interpret these abominations? Regards, Christian -- Christian BalzerNetwork/Systems Engineer

Re: [exim] Exim 4.6x versus qmail (CRLF issue?)

Hello, On Tue, 11 Mar 2008 17:57:58 -0700 Phil Pennock wrote: On 2008-03-11 at 19:29 +0900, Christian Balzer wrote: and a changed default behavior in Exim 4 compared to 3 on how to interpret these abominations? Yes. The Exim Specification (spec.txt), 44.2 Line endings. Yeah, that's

Re: [exim] Incoming duplicates

fire ;) it shows what happens when big players think they can go and make up rules as they go. Regards, Christian Balzer -- Christian BalzerNetwork/Systems EngineerNOC [EMAIL PROTECTED] Global OnLine Japan/Fusion Network Services http://www.gol.com/ -- ## List

[exim] LDAP failover

the exim.conf LDAP server ordering as opposed to an active/standby configuration. So what I'm saying (again ;) is I'd like to see exim fail over in a more semi-permanent way when trying to reach external database servers like LDAP. Dewa, Chibi -- Christian BalzerNetwork/Systems Engineer

Re: [exim] greylisting

. Things like the pre-whitelisting and auto-whitelisting of real mail servers for example. It also runs very much on autopilot after determining the optimum values like tuple retention for our situation. Regards, Christian Balzer -- Christian BalzerNetwork/Systems EngineerNOC