My guess was wrong.But I found that it happens with one specific email. Here is the link to file in .eml for analysis.
https://mega.nz/#!so0jgZIT!CZCQoGc-EPSpQo0z1WjGzfalI6KN7SWnY-5d-wPt-eg
Max Kostikov via Exim-users писал 2017-12-28 14:26:
According to quick analysis, it happens somewhere in this section of
Exim config which comes directly after DMARC checks
warn !verify = header_syntax
!hosts = +relay_from_hosts
...
I'll try to isolate this rule to see what happens.
-- With best regards, Max Kostikov BBM: 24CA5DF8 | W: https://kostikov.co
signature.asc
Description: OpenPGP digital signature
-- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
