root@mail1:~# exim4 --version | head -1
Exim version 4.95 #2 built 22-Sep-2026 18:29:28
root@mail1:~# systemctl is-active exim4
active
root@mail1:~# exim4 -bV | tail -1
Configuration file is /var/lib/exim4/config.autogenerated

root@mail1:~# update-exim4.conf && systemctl reload exim4

root@mail1:~# sed -i "s/^dc_use_split_config=.*/dc_use_split_config='true'/" /etc/exim4/update-exim4.conf.conf
root@mail1:~# update-exim4.conf && systemctl restart exim4
root@mail1:~# ls /etc/exim4/conf.d/
acl  auth  main  retry  rewrite  router  transport
root@mail1:~# for d in /etc/exim4/conf.d/*/; do echo "$d $(ls $d | wc -l) files"; done
/etc/exim4/conf.d/acl/ 5 files
/etc/exim4/conf.d/auth/ 2 files
/etc/exim4/conf.d/main/ 4 files
/etc/exim4/conf.d/retry/ 2 files
/etc/exim4/conf.d/rewrite/ 2 files
/etc/exim4/conf.d/router/ 13 files
/etc/exim4/conf.d/transport/ 12 files
root@mail1:~# exim4 -bV | tail -1
Configuration file is /var/lib/exim4/config.autogenerated

2026-10-26 11:07:36 1xLIf4-0003rM-TT => admin@example.org R=smarthost T=remote_smtp_smarthost H=mail1.example.org [10.89.61.11] X=TLS1.3:... CV=no DN="C=UK,O=Exim Developers,CN=mail1.example.org" K C="250 OK id=1xLIf4-0003rQ-Uq"

root@mail1:~# exim4 -bP tls_advertise_hosts tls_certificate tls_privatekey
tls_advertise_hosts = *
tls_certificate =
tls_privatekey =
root@mail1:~# grep -rn 'MAIN_TLS_ENABLE' /etc/exim4/conf.d/ /etc/exim4/exim4.conf.localmacros
/etc/exim4/exim4.conf.localmacros:MAIN_TLS_ENABLE = yes

root@mail1:~# rm -f /etc/exim4/exim4.conf.localmacros
root@mail1:~# printf 'MAIN_TLS_ENABLE = yes\n' > /etc/exim4/conf.d/main/000_localmacros
root@mail1:~# update-exim4.conf && systemctl reload exim4
root@mail1:~# exim4 -bP tls_advertise_hosts tls_certificate tls_privatekey
tls_advertise_hosts = *
tls_certificate = /etc/exim4/exim.crt
tls_privatekey = /etc/exim4/exim.key

root@mail2:~# echo | openssl s_client -connect mail1.example.org:25 -starttls smtp 2>/dev/null | openssl x509 -noout -subject
subject=CN = mail1.example.org, O = Example Lab, C=CN

root@mail1:~# cat /etc/exim4/update-exim4.conf.conf
# /etc/exim4/update-exim4.conf.conf
#
# Edit this file and call 'update-exim4.conf' for changes to take effect.
# See update-exim4.conf(8) for details.

dc_eximconfig_configtype='internet'
dc_other_hostnames='mail1.example.org:example.org'
dc_local_interfaces='0.0.0.0 ; ::0'
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets='10.89.61.0/24'
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='true'
dc_hide_mailname=''
dc_mailname_in_oh='true'
dc_localdelivery='maildir_home'

root@mail2:~# sed -i "s/^dc_eximconfig_configtype=.*/dc_eximconfig_configtype='smarthost'/; s/^dc_smarthost=.*/dc_smarthost='mail1.example.org::25'/" /etc/exim4/update-exim4.conf.conf
root@mail2:~# update-exim4.conf && systemctl reload exim4
root@mail2:~# printf 'Pure smarthost route test.\n' | mail -s 'smart-02' admin@example.org
root@mail2:~# grep '1xLIf4-0003rM-TT' /var/log/exim4/mainlog
2026-10-26 11:07:36 1xLIf4-0003rM-TT => admin@example.org R=smarthost T=remote_smtp_smarthost H=mail1.example.org [10.89.61.11] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=no DN="C=UK,O=Exim Developers,CN=mail1.example.org" K C="250- 480 byte chunk, total 480\n250 OK id=1xLIf4-0003rQ-Uq"
2026-10-26 11:07:36 1xLIf4-0003rM-TT Completed

root@mail2:~# sed -i "s/^dc_eximconfig_configtype=.*/dc_eximconfig_configtype='internet'/; s/^dc_smarthost=.*/dc_smarthost=''/" /etc/exim4/update-exim4.conf.conf
root@mail2:~# update-exim4.conf && systemctl reload exim4
root@mail2:~# grep -E 'configtype|smarthost' /etc/exim4/update-exim4.conf.conf
dc_eximconfig_configtype='internet'
dc_smarthost=''

root@mail1:~# exim4 -bP '+local_domains'
+local_domains = @ : localhost : example.org : mail1.example.org

root@mail1:~# exim4 -bt admin@example.net
R: hubbed_hosts for admin@example.net
admin@example.net
  router = hubbed_hosts, transport = remote_smtp
  host mail2.example.net [10.89.61.12]

root@mail1:~# exim4 -bP +relay_from_hosts
hostlist relay_from_hosts = 10.89.61.0/24 : 127.0.0.1 : ::::1

# Macro defining the main configuration directory.
# We do not use absolute paths.
.ifndef CONFDIR
CONFDIR = /etc/exim4
.endif

# debconf-driven macro definitions get inserted after this line

root@mail1:~# cat /etc/exim4/conf.d/main/000_localmacros
MAIN_TLS_ENABLE = yes
root@mail1:~# exim4 -bP tls_advertise_hosts tls_certificate tls_privatekey
tls_advertise_hosts = *
tls_certificate = /etc/exim4/exim.crt
tls_privatekey = /etc/exim4/exim.key

.ifdef MAIN_TLS_ENABLE
# Defines what hosts to 'advertise' STARTTLS functionality to. The
# default, *, will advertise to all hosts that connect with EHLO.
.ifndef MAIN_TLS_ADVERTISE_HOSTS
MAIN_TLS_ADVERTISE_HOSTS = *
.endif
tls_advertise_hosts = MAIN_TLS_ADVERTISE_HOSTS

.ifndef DC_minimaldns
.ifndef MAIN_HOST_LOOKUP
MAIN_HOST_LOOKUP = *
.endif
host_lookup = MAIN_HOST_LOOKUP
.endif

root@mail1:~# printf 'MAIN_TLS_ENABLE = yes\nMAIN_HOST_LOOKUP =\n' > /etc/exim4/conf.d/main/000_localmacros
root@mail1:~# update-exim4.conf && systemctl restart exim4
root@mail1:~# exim4 -bP host_lookup
host_lookup =

root@mail2:~# printf 'MAIN_TLS_ENABLE = yes\nMESSAGE_SIZE_LIMIT = 10M\n' > /etc/exim4/exim4.conf.localmacros
root@mail2:~# update-exim4.conf && systemctl reload exim4
root@mail2:~# exim4 -bP message_size_limit
message_size_limit = 10M
root@mail2:~# printf 'EHLO lab\r\nQUIT\r\n' | timeout 5 bash -c 'exec 3<>/dev/tcp/127.0.0.1/25; cat <&3 & cat >&3; wait' | tr -d '\r' | grep SIZE
250-SIZE 10485760

root@mail1:~# exim4 -bP primary_hostname qualify_domain message_size_limit daemon_smtp_ports
primary_hostname = mail1.example.org
qualify_domain = example.org
message_size_limit = 50M
daemon_smtp_ports = 25
root@mail1:~# exim4 -bP '+local_domains' '+relay_to_domains' '+relay_from_hosts'
+local_domains = @ : localhost : example.org : mail1.example.org
+relay_to_domains =
+relay_from_hosts = 10.89.61.0/24 : 127.0.0.1 : ::::1

acl_smtp_mail = MAIN_ACL_CHECK_MAIL
acl_smtp_rcpt = MAIN_ACL_CHECK_RCPT
acl_smtp_data = MAIN_ACL_CHECK_DATA

  accept
    hosts = +relay_from_hosts
    control = submission/sender_retain
    control = dkim_disable_verify


  # Accept if the message arrived over an authenticated connection, from
  # any host. ...
  accept
    authenticated = *
    control = submission/sender_retain
    control = dkim_disable_verify

  # Insist that any other recipient address that we accept is either in one of
  # our local domains, or is in a domain for which we explicitly allow
  # relaying. Any other domain is rejected as being unacceptable for relaying.
  require
    message = relay not permitted
    domains = +local_domains : +relay_to_domains

root@mail2:~# { printf 'EHLO lab\r\nMAIL FROM:<root@example.net>\r\nRCPT TO:<someone@example.com>\r\nRSET\r\nQUIT\r\n'; sleep 2; } | timeout 10 bash -c 'exec 3<>/dev/tcp/mail1.example.org/25; cat <&3 & cat >&3; wait' | tr -d '\r'
220 mail1.example.org ESMTP Exim 4.95 Ubuntu Mon, 26 Oct 2026 11:22:55 +0000
250-mail1.example.org Hello lab [10.89.61.12]
250-SIZE 52428800
250-8BITMIME
250-PIPELINING
250-PIPE_CONNECT
250-AUTH PLAIN
250-CHUNKING
250-STARTTLS
250-PRDR
250 HELP
250 OK
250 Accepted
250 Reset OK
221 mail1.example.org closing connection

root@mail1:~# sed -i "s/^dc_relay_nets=.*/dc_relay_nets=''/ /etc/exim4/update-exim4.conf.conf
root@mail1:~# update-exim4.conf && systemctl reload exim4
root@mail2:~# { printf 'EHLO lab\r\nMAIL FROM:<root@example.net>\r\nRCPT TO:<someone@example.com>\r\nRSET\r\nQUIT\r\n'; sleep 2; } | timeout 10 bash -c 'exec 3<>/dev/tcp/mail1.example.org/25; cat <&3 & cat >&3; wait' | tr -d '\r' | grep -E '^(250 [A-Z]|550|221)'
250 OK
550 relay not permitted
221 mail1.example.org closing connection

2026-10-26 11:31:57 H=(lab) [10.89.61.12] F=<root@example.net> rejected RCPT <someone@example.com>: relay not permitted

root@mail1:~# openssl passwd -6 'q1w2e3r4'
$6$roFh37CXl.VZTQyP$T5nYBi1eQE7l8umJbWKzOqR3WrLX/oW8gb2jNJlunhyvABCBWEVZNTtlrq6UkxWaEt9ugBFtGpwCIdVJZEXi/
root@mail1:~# printf 'admin:$6$roFh37CXl.VZTQyP$T5nYBi1eQE7l8umJbWKzOqR3WrLX/oW8gb2jNJlunhyvABCBWEVZNTtlrq6UkxWaEt9ugBFtGpwCIdVJZEXi/\n' > /etc/exim4/smtp.users
root@mail1:~# cat /etc/exim4/conf.d/auth/170_lab-plain
plain_server:
  driver = plaintext
  public_name = PLAIN
  server_condition = ${if crypteq{$auth3}{${lookup{$auth2}lsearch{CONFDIR/smtp.users}{$value}fail}}{yes}{no}}
  server_set_id = $auth2
root@mail1:~# update-exim4.conf && systemctl restart exim4

root@mail2:~# B64=$(printf '\0admin\0q1w2e3r4' | base64)
root@mail2:~# { printf "EHLO lab\r\nAUTH PLAIN %s\r\nMAIL FROM:<root@example.net>\r\nRCPT TO:<someone@example.com>\r\nRSET\r\nQUIT\r\n" "$B64"; sleep 2; } | timeout 10 bash -c 'exec 3<>/dev/tcp/mail1.example.org/25; cat <&3 & cat >&3; wait' | tr -d '\r' | grep -E '^(235|250 [A-Z]|550)'
235 Authentication succeeded
250 OK
250 Accepted

root@mail2:~# B64B=$(printf '\0admin\0wrongpass' | base64)
root@mail2:~# { printf "EHLO lab\r\nAUTH PLAIN %s\r\nQUIT\r\n" "$B64B"; sleep 2; } | timeout 10 bash -c 'exec 3<>/dev/tcp/mail1.example.org/25; cat <&3 & cat >&3; wait' | tr -d '\r' | grep -E '^(235|535|221)'
535 Incorrect authentication data
221 mail1.example.org closing connection

2026-10-26 11:32:01 plain_server authenticator failed for (lab) [10.89.61.12]: 535 Incorrect authentication data (set_id=admin)

hubbed_hosts:
  debug_print = "R: hubbed_hosts for $domain"
  driver = manualroute
  domains = "${if exists{CONFDIR/hubbed_hosts}\
                   {partial-lsearch;CONFDIR/hubbed_hosts}\
              fail}"
  same_domain_copy_routing = yes
  route_data = ${lookup{$domain}partial-lsearch{CONFDIR/hubbed_hosts}}
  transport = remote_smtp

dnslookup:
  debug_print = "R: dnslookup for $local_part@$domain"
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  same_domain_copy_routing = yes
  ignore_target_hosts = ROUTER_DNSLOOKUP_IGNORE_TARGET_HOSTS
  no_more

system_aliases:
  debug_print = "R: system_aliases for $local_part@$domain"
  driver = redirect
  domains = +local_domains
  allow_fail
  allow_defer
  data = ${lookup{$local_part}lsearch{/etc/aliases}}

userforward:
  debug_print = "R: userforward for $local_part@$domain"
  driver = redirect
  domains = +local_domains
  check_local_user
  file = $home/.forward
  require_files = $local_part_data:$home/.forward
  no_verify
  no_expn
  check_ancestor
  allow_filter
  directory_transport = address_directory
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply
  skip_syntax_errors

local_user:
  debug_print = "R: local_user for $local_part@$domain"
  driver = accept
  domains = +local_domains
  check_local_user
  local_parts = ! root
  transport = LOCAL_DELIVERY
  cannot_route_message = Unknown user

mail4root:
  debug_print = "R: mail4root for $local_part@$domain"
  driver = redirect
  domains = +local_domains
  data = /var/mail/mail
  file_transport = address_file
  local_parts = root
  user = mail
  group = mail

maildir_home:
  debug_print = "T: maildir_home for $local_part@$domain"
  driver = appendfile
  directory = $home/Maildir
  create_directory
  delivery_date_add
  envelope_to_add
  return_path_add
  maildir_format
  directory_mode = 0700
  mode = 0600
  mode_fail_narrower = false

remote_smtp:
  debug_print = "T: remote_smtp for $local_part@$domain"
  driver = smtp

address_file:
  debug_print = "T: address_file for $local_part@$domain"
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add

root@mail1:~# printf 'billing: admin\n' >> /etc/aliases
root@mail1:~# tail -2 /etc/aliases
ops-list: admin, root
billing: admin
root@mail1:~# exim4 -bt billing@example.org
R: system_aliases for billing@example.org
R: system_aliases for admin@example.org
R: userforward for admin@example.org
R: system_aliases for admin@example.org
R: procmail for admin@example.org
R: maildrop for admin@example.org
R: lowuid_aliases for admin@example.org (UID 1000)
R: local_user for admin@example.org
R: hubbed_hosts for example.net
admin@example.org
    <-- admin@example.org
    <-- billing@example.org
  router = local_user, transport = maildir_home
admin@example.net
    <-- admin@example.org
    <-- billing@example.org
  router = hubbed_hosts, transport = remote_smtp
  host mail2.example.net [10.89.61.12]

root@mail1:~# printf '\\admin\nadmin@example.net\n' > /home/admin/.forward
root@mail1:~# chown admin:admin /home/admin/.forward
root@mail1:~# cat -A /home/admin/.forward
\admin$
admin@example.net$
root@mail1:~# printf 'Forward test: local copy + remote copy to mail2.\n' | mail -s 'fwd-02' admin@example.org
root@mail1:~# tail -4 /var/log/exim4/mainlog
2026-10-26 11:32:41 1xLIwT-0005Tm-L3 <= root@example.org U=root P=local S=485
2026-10-26 11:32:41 1xLIwT-0005Tm-L3 => admin <admin@example.org> R=local_user T=maildir_home
2026-10-26 11:32:41 1xLIwT-0005Tm-L3 => admin@example.net <admin@example.org> R=hubbed_hosts T=remote_smtp H=mail2.example.net [10.89.61.12] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=no DN="CN=mail2.example.net,O=Example Lab,C=CN" K C="250- 500 byte chunk, total 500\n250 OK id=1xLIwT-0005Uq-Lk"
2026-10-26 11:32:41 1xLIwT-0005Tm-L3 Completed

root@mail2:~# B64=$(printf '\0admin\0q1w2e3r4' | base64)
root@mail2:~# { printf "EHLO lab\r\nAUTH PLAIN %s\r\nMAIL FROM:<root@example.net>\r\nRCPT TO:<admin@example.net>\r\nDATA\r\n" "$B64"; sleep 2; printf "Subject: auth-relay-03\r\nFrom: root@example.net\r\n\r\nTwo-stage authenticated relay body.\r\n.\r\nQUIT\r\n"; sleep 2; } | timeout 14 bash -c 'exec 3<>/dev/tcp/mail1.example.org/25; cat <&3 & cat >&3; wait' | tr -d '\r'
235 Authentication succeeded
250 OK
250 Accepted
354 Enter message, ending with "." on a line by itself
250 OK id=1xLIw1-0005TI-WD
221 mail1.example.org closing connection

2026-10-26 11:32:15 1xLIw1-0005TI-WD <= root@example.net H=(lab) [10.89.61.12] P=esmtpa A=plain_server:admin S=371
2026-10-26 11:32:16 1xLIw1-0005TI-WD => admin@example.net R=hubbed_hosts T=remote_smtp H=mail2.example.net [10.89.61.12] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=no DN="CN=mail2.example.net,O=Example Lab,C=CN" K C="250- 383 byte chunk, total 383\n250 OK id=1xLIw4-0005Ub-0d"
2026-10-26 11:32:16 1xLIw1-0005TI-WD Completed

# /etc/exim4/update-exim4.conf.conf
dc_eximconfig_configtype='internet'
dc_other_hostnames='mail1.example.org:example.org'
dc_local_interfaces='0.0.0.0 ; ::0'
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets='10.89.61.0/24'
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='true'
dc_hide_mailname=''
dc_mailname_in_oh='true'
dc_localdelivery='maildir_home'

# /etc/exim4/conf.d/main/000_localmacros（分片模式）
MAIN_TLS_ENABLE = yes
MAIN_HOST_LOOKUP =

# /etc/exim4/exim4.conf.localmacros（单一模式，二选一）
MAIN_TLS_ENABLE = yes
MAIN_HOST_LOOKUP =

root@mail2:~# printf 'MAIN_TLS_ENABLE = yes\nMESSAGE_SIZE_LIMIT = 10M\nBAD_DIRECTIVE_HERE\n' >> /etc/exim4/exim4.conf.localmacros
root@mail2:~# update-exim4.conf
2026-10-26 11:15:32 Exim configuration error in line 3 of /etc/exim4/exim4.conf.localmacros:
  main option "bad_directive_here" unknown

2026-10-26 11:07:36 1xLIf4-0003rM-TT TLS session: (certificate verification failed): certificate invalid: delivering unencrypted to H=mail1.example.org [10.89.61.11] (not in hosts_require_tls)