domainlist local_domains = @ : my.domain
domainlist relay_to_domains =
hostlist   relay_from_hosts = localhost

acl_smtp_rcpt =         acl_check_rcpt
.ifdef _HAVE_PRDR
acl_smtp_data_prdr =    acl_check_prdr
.endif
acl_smtp_data =         acl_check_data

tls_certificate = /etc/letsencrypt/live/my.domain/fullchain.pem
tls_privatekey = /etc/letsencrypt/live/my.domain/privkey.pem

.ifdef _HAVE_OPENSSL
tls_require_ciphers = ECDSA:RSA:!COMPLEMENTOFDEFAULT
.endif
p
.ifdef _HAVE_TLS_RESUME
tls_resumption_hosts = ${if inlist {$received_port}{587:465} {:}{*}}
.endif

never_users = root
host_lookup = *

dns_dnssec_ok = 1
.ifdef _HAVE_PRDR
prdr_enable = true
.endif

log_selector = +all
ignore_bounce_errors_after = 2d

timeout_frozen_after = 7d
begin acl

acl_check_rcpt:

  accept  hosts = :
          control = dkim_disable_verify

  deny    message       = Restricted characters in address
          domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]

  deny    message       = Restricted characters in address
          domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

  accept  local_parts   = postmaster
          domains       = +local_domains

  require message       = Did not verify sender address
          verify        = sender

  deny    condition     = ${if and {\
                        {>{$rcpt_count}{10}}\
                        {<{$recipients_count}{${eval:$rcpt_count/2}}} }}
          message       = Rejected for too many bad recipients
          logwrite      = REJECT [$sender_host_address]: bad recipient count high [${eval:$rcpt_count-$recipients_count}]


  accept  hosts         = +relay_from_hosts
          control       = submission
          control       = dkim_disable_verify

  accept  authenticated = *
          control       = submission
          control       = dkim_disable_verify

  require message = relay not permitted
          domains = +local_domains : +relay_to_domains

  require message = Did not verify recipient
          verify = recipient

  accept

.ifdef _HAVE_PRDR
acl_check_prdr:
  warn  set acl_m_did_prdr = y

  accept
.endif

acl_check_data:
  deny    condition  = ${if > {$max_received_linelength}{998}}
          message    = maximum allowed line length is 998 octets, \
                       got $max_received_linelength

  deny    !verify =     header_syntax
          message =     header syntax
          log_message = header syntax ($acl_verify_message)

  accept
begin routers
.ifdef ROUTER_SMARTHOST

smarthost:
  driver = manualroute
  domains = ! +local_domains
  transport = smarthost_smtp
  route_data = ROUTER_SMARTHOST
  ignore_target_hosts = <; 0.0.0.0 ; 127.0.0.0/8 ; ::1
  no_more

.else
dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  no_more

.endif


system_aliases:
  driver = redirect
  allow_fail
  allow_defer
  data = ${lookup{$local_part}lsearch{/etc/aliases}}
  file_transport = address_file
  pipe_transport = address_pipe

userforward:
  driver = redirect
  check_local_user
  file = $home/.forward
  no_verify
  no_expn
  check_ancestor
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply

localuser:
  driver = accept
  check_local_user
  transport = local_delivery
  cannot_route_message = Unknown user

begin transports
remote_smtp:
  driver = smtp
  dkim_domain = my.domain
  dkim_selector = my_ed_sel : my_rsa_sel
  dkim_private_key = /etc/exim/dkim_$dkim_selector.private
  dkim_identity = my.domain
  dkim_strict = true

.ifdef _HAVE_TLS_RESUME
  tls_resumption_hosts = *
.endif
smarthost_smtp:
  driver = smtp
  multi_domain
  #
.ifdef _HAVE_TLS
  hosts_require_tls = *
  tls_verify_hosts = *
  tls_try_verify_hosts = *
  tls_sni = ROUTER_SMARTHOST
  #
.ifdef _HAVE_OPENSSL
  tls_require_ciphers = HIGH:!aNULL:@STRENGTH
.endif
.ifdef _HAVE_GNUTLS
  tls_require_ciphers = SECURE192:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1
.endif
.ifdef _HAVE_TLS_RESUME
  tls_resumption_hosts = *
.endif
.endif
local_delivery:
  driver = appendfile
  file = /var/mail/$local_part_data
  delivery_date_add
  envelope_to_add
  return_path_add
address_pipe:
  driver = pipe
  return_output
address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add
address_reply:
  driver = autoreply
begin retry
*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h
begin rewrite
begin authenticators
