{"id":910,"date":"2021-07-23T12:41:04","date_gmt":"2021-07-23T12:41:04","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/exim-configuration-manager-basic-editor\/"},"modified":"2021-07-23T12:41:04","modified_gmt":"2021-07-23T12:41:04","slug":"exim-configuration-manager-basic-editor","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/exim-configuration-manager-basic-editor\/","title":{"rendered":"Exim Configuration Manager Basic Editor"},"content":{"rendered":"<\/p>\n<div class=\"col-md-9\">\n<div class=\"flex-column flex-md-row article-header\">\n<div id=\"versioned-article-header\">\n<p class=\"valid-version-info\"><em>Valid for versions 94 through the latest version<\/em><\/p>\n<\/div>\n<div id=\"version-select-group\" aria-label=\"select versions\">\n<h4>Version:<\/h4>\n<h4>82<\/h4>\n<h4>84<\/h4>\n<h4>86<\/h4>\n<h4>94<\/h4>\n<\/div><\/div>\n<hr>\n<h2 id=\"overview\">Overview<\/h2>\n<p>Select the <em>Basic Editor<\/em> tab in the <em>Exim Configuration Manager<\/em> interface to modify your server\u2019s Exim configuration settings.<\/p>\n<h2 id=\"all\">All<\/h2>\n<p>This tab displays all available settings. To filter the displayed settings, select a category tab. You can also use the <em>Find<\/em> text box to search for a specific Basic Editor setting.<\/p>\n<h3 id=\"acl-options\">ACL Options<\/h3>\n<p>These settings limit who can send mail to your server. Use these settings to minimize bandwidth usage, prevent spam, and block emails with a forged sender address (spoofed emails).<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>The system <strong>discards<\/strong> any email messages that it rejects at SMTP time.<\/p>\n<\/p><\/div>\n<\/div>\n<h5 id=\"apache-spamassassin-reject-spam-score-threshold\"><em>Apache SpamAssassin\u2122 reject spam score threshold<\/em><\/h5>\n<p>This setting sets the spam score that Apache SpamAssassin\u2122 uses to reject incoming messages.<\/p>\n<p>Enter a positive or negative number, which may contain a single decimal point.<\/p>\n<div class=\"callout callout-warning\">\n<div class=\"callout-heading\">Important:<\/div>\n<div class=\"callout-content\">\n<p>If you enter a value that contains an integer greater than or less than <code>0<\/code> and a decimal point, Apache SpamAssassin multiplies the value that you enter by a measure of ten. For example, if you enter a spam score threshold of <code>1.6<\/code>, Apache SpamAssassin sets the threshold to <code>16<\/code>.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>No reject rule by spam score<\/em>.<\/p>\n<h5 id=\"dictionary-attack-protection\"><em>Dictionary attack protection<\/em><\/h5>\n<p>This setting allows you to drop and rate-limit hosts with more than four failed recipients, in order to block dictionary attacks. A dictionary attack is a method whereby a malicious user attempts to guess a password with words in a dictionary.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"reject-remote-mail-sent-to-the-server-s-hostname\"><em>Reject remote mail sent to the server\u2019s hostname<\/em><\/h5>\n<p>This setting allows you to reject messages in which the recipient exists as an address of your server\u2019s primary hostname. In general, the primary hostname, a common target for spammers, should <strong>not<\/strong> receive remote mail.<\/p>\n<p>This setting Defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"enable-apache-spamassassin-for-secondary-mx-domains\"><em>Enable Apache SpamAssassin\u2122 for secondary MX domains<\/em><\/h5>\n<p>This setting configures Apache SpamAssassin to scan email for domains that exist in the <code>\/etc\/secondarymx<\/code> file which users send to the primary mail exchanger.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"ratelimit-suspicious-smtp-servers\"><em>Ratelimit suspicious SMTP servers<\/em><\/h5>\n<p>This setting allows you to rate-limit incoming SMTP connections that violate RFCs. This setting rate-limits mail servers that do not send QUIT, recently matched an RBL, or recently attacked the server. Real mail servers <strong>must<\/strong> follow RFC specifications.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>To ensure that the system does not rate-limit an SMTP connection, add the server to a whitelist. This allows the system to deliver mail from connections that violate RFCs to your inbox. To add a server to a whitelist, edit the <em>Only-verify-recipient<\/em> setting in the <em>Access Lists<\/em> tab, and enter the IP address of the trusted server.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"apache-spamassassin-ratelimit-spam-score-threshold\"><em>Apache SpamAssassin\u2122: ratelimit spam score threshold<\/em><\/h5>\n<p>This setting allows you to rate-limit hosts that send spam to your server. When you activate this setting, rate limits delay email from hosts that send you spam. The system activates rate limits when it meets both of the following conditions:<\/p>\n<ol>\n<li>\n<p>A host reaches or exceeds the Apache SpamAssassin score that you enter in the text box.<\/p>\n<\/li>\n<li>\n<p>That host exceeds the number of emails that the rate-limit formula specifies. Exim averages rate limits over time. By default, the system uses the following rate-limit formula:\n<\/p>\n<div class=\"highlight\">\n<pre style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-BASH\" data-lang=\"BASH\">ratelimit <span style=\"color:#f92672\">=<\/span> <span style=\"color:#ae81ff\">1<\/span>.2 \/ 1h \/ strict \/ per_conn \/ noupdate<\/code><\/pre>\n<\/div>\n<\/li>\n<\/ol>\n<p>This setting defaults to <em>No ratelimiting by spam score<\/em>.<\/p>\n<h5 id=\"ratelimit-incoming-connections-with-only-failed-recipients\"><em>Ratelimit incoming connections with only failed recipients<\/em><\/h5>\n<p>This setting allows you to rate-limit incoming SMTP connections that only send email to failed recipients during five separate connection times in the past hour.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"require-helo-before-mail\"><em>Require HELO before MAIL<\/em><\/h5>\n<p>This setting allows you to require that incoming SMTP connections send a HELO command before they send a MAIL command.<\/p>\n<p>A HELO is a command that mail servers send before an email, and that specifies the name of the sending domain. Apache SpamAssassin can perform various checks on this information (for example, it can ensure that the domain name matches the IP address that sent the message). This ensures that your server does not receive spam that reports a false domain name.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"introduce-a-delay-into-the-smtp-transaction-for-unknown-hosts-and-messages-detected-as-spam\"><em>Introduce a delay into the SMTP transaction for unknown hosts and messages detected as spam.<\/em><\/h5>\n<p>This setting configures the SMTP receiver to wait a few additional seconds for a connection when it detects spam messages. Typically, legitimate mailing systems will wait past the delay, whereas spammers do not wait past the delay.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>The system excludes the following remote hosts from the delay:<\/p>\n<ul>\n<li>\n<p>Neighbor IP addresses in the same netblock<\/p>\n<\/li>\n<li>\n<p>Loopback addresses<\/p>\n<\/li>\n<li>\n<p>Trusted Hosts<\/p>\n<\/li>\n<li>\n<p>Relay Hosts<\/p>\n<\/li>\n<li>\n<p>Backup MX Hosts<\/p>\n<\/li>\n<li>\n<p>Skip SMTP Checks Host<\/p>\n<\/li>\n<li>\n<p>Sender Verify Bypass Hosts<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n<div class=\"callout callout-danger\">\n<div class=\"callout-heading\">Warning:<\/div>\n<div class=\"callout-content\">\n<ul>\n<li>\n<p>If you use third-party sites to diagnose mail server issues, this setting may falsely detect spam messages.<\/p>\n<\/li>\n<li>\n<p>If your external monitoring system reports failures after you update your server, configure your monitoring system to allow 45 seconds timeout for connections to port <code>25<\/code>. For more information about how to adjust the timeout and polling settings, read your monitoring system\u2019s documentation.<\/p>\n<ul>\n<li>\n<p>If that does not resolve the problem, add the IP address of your monitoring system to the <em>Trusted SMTP IP Addresses<\/em> section of WHM\u2019s <em>Exim Configuration Manager<\/em> interface (<em>WHM &gt;&gt; Home &gt;&gt; Service Configuration &gt;&gt; Exim Configuration Manager<\/em>).<\/p>\n<\/li>\n<li>\n<p>If you still encounter errors on your monitoring system, disable the <em>Introduce a delay into the SMTP transaction for unknown hosts and messages detected as spam<\/em> setting in the Basic Editor section of WHM\u2019s <em>Exim Configuration Manager<\/em> interface (<em>WHM &gt;&gt; Home &gt;&gt; Service Configuration &gt;&gt; Exim Configuration Manager<\/em>). However, this will likely result in an increase in spam that your server receives.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul><\/div>\n<\/div>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"do-not-delay-the-smtp-connections-for-hosts-in-the-greylisting-trusted-hosts-list\"><em>Do not delay the SMTP connections for hosts in the Greylisting \u201cTrusted Hosts\u201d list<\/em><\/h5>\n<p>This setting configures the SMTP receiver to not delay any hosts that you add to the list in the <em>Trusted Hosts<\/em> tab in WHM\u2019s <em>Greylisting<\/em> Interface (<em>WHM &gt;&gt; Home &gt;&gt; Email &gt;&gt; Greylisting<\/em>).<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"do-not-delay-the-smtp-connections-for-hosts-in-the-greylisting-common-mail-providers-list\"><em>Do not delay the SMTP connections for hosts in the Greylisting \u201cCommon Mail Providers\u201d List<\/em><\/h5>\n<p>This setting configures the SMTP receiver to not delay any hosts that you add to the list in the <em>Common Main Providers<\/em> tab in WHM\u2019s <em>Greylisting<\/em> interface (<em>WHM &gt;&gt; Home &gt;&gt; Email &gt;&gt; Greylisting<\/em>).<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"require-remote-hostname-ip-address-helo\"><em>Require remote (hostname\/IP address) HELO<\/em><\/h5>\n<p>This setting allows you to require that incoming SMTP connections send a HELO command that does not match the primary hostname or a local IP address (IPv4 or IPv6). Enable this setting to block emails with a forged sender address (spoofed emails).<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"require-remote-domain-helo\"><em>Require remote (domain) HELO<\/em><\/h5>\n<p>This setting allows you to require that incoming SMTP connections send a HELO command that does not match your server\u2019s local domains. Enable this setting to block emails with a forged sender address (spoofed emails).<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"require-rfc-compliant-helo\"><em>Require RFC-compliant HELO<\/em><\/h5>\n<p>This setting allows you to require that incoming SMTP connections send a HELO command that conforms with the internet standards in RFC 2821 4.1.1.1.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>If you enable this setting, it overrides any entries in the <code>\/etc\/alwaysrelay<\/code> and <code>\/etc\/relayhosts<\/code> files.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"allow-dkim-verification-for-incoming-messages\"><em>Allow DKIM verification for incoming messages<\/em><\/h5>\n<p>This setting allows you to use DomainKeys Identified Mail (DKIM) verification to verify incoming messages.<\/p>\n<div class=\"callout callout-danger\">\n<div class=\"callout-heading\">Warning:<\/div>\n<div class=\"callout-content\">\n<p>This verification process can slow your server\u2019s performance.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"reject-dkim-failures\"><em>Reject DKIM failures<\/em><\/h5>\n<p>This setting allows you to reject email at SMTP time if the sender fails DKIM key validation.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>You <strong>must<\/strong> set the <em>Allow DKIM verification for incoming messages<\/em> setting to <em>On<\/em> to enable this setting.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"maximum-message-recipients-soft-limit\"><em>Maximum message recipients (soft limit)<\/em><\/h5>\n<p>This setting allows you to determine the number of recipient addresses your server accepts in a single message.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>RFCs specify that SMTP servers <strong>must<\/strong> accept at least 100 RCPT commands for a single message.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>No rejection based on number of recipients<\/em>.<\/p>\n<h5 id=\"maximum-message-recipients-before-disconnect-hard-limit\"><em>Maximum message recipients before disconnect (hard limit)<\/em><\/h5>\n<p>This setting allows you to determine the number of recipient addresses that your server permits in a single message before it disconnects and rate-limits a connection.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>RFCs specify that SMTP servers <strong>must<\/strong> accept at least 100 RCPT commands for a single message.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>No disconnection based on number of recipients<\/em>.<\/p>\n<h3 id=\"access-lists\">Access Lists<\/h3>\n<p>These settings further limit who sends mail to your server.<\/p>\n<h5 id=\"blacklisted-smtp-ip-addresses\"><em>Blacklisted SMTP IP addresses<\/em><\/h5>\n<p>This setting allows you to edit the list of blacklisted SMTP IP addresses. The system does not allow these IP addresses to connect to the SMTP server, and instead drops connections with a 550 error.<\/p>\n<p>Click <em>Edit<\/em> to modify this setting.<\/p>\n<h5 id=\"sender-verification-bypass-ip-addresses\"><em>Sender verification bypass IP addresses<\/em><\/h5>\n<p>This setting allows you to edit the list of IP addresses that the system excludes from SMTP sender verification checks.<\/p>\n<p>Click <em>Edit<\/em> to modify this setting.<\/p>\n<h5 id=\"only-verify-recipient\"><em>Only-verify-recipient<\/em><\/h5>\n<p>This setting allows you to edit the list of hosts or IP addresses that the system excludes from all spam checks at SMTP connection time, except recipient verification checks. The system adds any hosts or IP addresses you enter here to the <code>\/etc\/trustedmailhosts<\/code> file.<\/p>\n<p>Click <em>Edit<\/em> to modify this setting.<\/p>\n<h5 id=\"trusted-smtp-ip-addresses\"><em>Trusted SMTP IP addresses<\/em><\/h5>\n<p>This setting allows you to edit the list of hosts or IP addresses that the system excludes from the following checks at SMTP connection time:<\/p>\n<ul>\n<li>\n<p>Recipient verification checks<\/p>\n<\/li>\n<li>\n<p>Sender checks<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>These senders must still use an RFC-compliant HELO name if the Require RFC-compliant HELO setting is enabled.<\/p>\n<\/p><\/div>\n<\/div>\n<\/li>\n<li>\n<p>Spam checks<\/p>\n<\/li>\n<li>\n<p>Relay checks.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>The system adds any hosts\u2019 IP addresses that you enter here to the <code>\/etc\/skipsmtpcheckhosts<\/code> file.<\/p>\n<\/p><\/div>\n<\/div>\n<\/li>\n<\/ul>\n<p>Click <em>Edit<\/em> to modify this setting.<\/p>\n<h5 id=\"backup-mx-hosts\"><em>Backup MX hosts<\/em><\/h5>\n<p>This setting allows you to edit the list of hosts from which the system permits SMTP connections, regardless of rate limits. Make certain that you properly configure reverse DNS records for any hosts which you enter here.<\/p>\n<p>Click <em>Edit<\/em> to modify this setting.<\/p>\n<h5 id=\"trusted-mail-users\"><em>Trusted mail users<\/em><\/h5>\n<p>The Trusted mail users setting allows system administrators to designate certain users as trusted mail users. This setting affects the <em>EXPERIMENTAL: Rewrite From: header to match actual sender<\/em> setting in the <em>Mail<\/em> tab. Trusted users can bypass the <em>EXPERIMENTAL: Rewrite From: header to match actual sender<\/em> setting. The <em>Trusted mail users<\/em> setting allows the listed users to modify their <em>From:<\/em> header, and the <em>EXPERIMENTAL: Rewrite From: header to match actual sender<\/em> setting does not override these changes. Enter the trusted mail usernames or their email addresses, one per line.<\/p>\n<p>Click <em>Edit<\/em> to modify this setting.<\/p>\n<h5 id=\"blocked-domains\"><em>Blocked Domains<\/em><\/h5>\n<p>This setting allows you to filter your server\u2019s incoming email by region or country.<\/p>\n<p>When you click <em>Manage<\/em>, a new browser tab will appear with WHM\u2019s <em>Filter Incoming Emails by Domain<\/em> interface (<em>WHM &gt;&gt; Home &gt;&gt; Email &gt;&gt; Filter Incoming Emails by Domain<\/em>).<\/p>\n<h5 id=\"blocked-countries\"><em>Blocked Countries<\/em><\/h5>\n<p>This setting allows you to filter your server\u2019s incoming email by domain.<\/p>\n<p>When you click <em>Manage<\/em>, a new browser tab will appear with WHM\u2019s <em>Filter Incoming Emails by Country<\/em> interface (<em>WHM &gt;&gt; Home &gt;&gt; Email &gt;&gt; Filter Incoming Emails by Country<\/em>).<\/p>\n<h3 id=\"domains-and-ips\">Domains and IPs<\/h3>\n<p>These settings change the IP address from which Exim sends mail. When you disable them, Exim will automatically send mail from your server\u2019s main shared IP address. For more information, read our How to Configure the Exim Outgoing IP Address documentation.<\/p>\n<h5 id=\"send-mail-from-the-account-s-ip-address\"><em>Send mail from the account\u2019s IP address<\/em><\/h5>\n<p>This setting allows you to automatically send mail for users <strong>without<\/strong> a dedicated IP address from a reseller\u2019s main shared IP address. It will <strong>not<\/strong> use the server\u2019s main shared IP address. The system will also use the server\u2019s hostname for reseller accounts that share an IP address. If you want to change this, you <strong>must<\/strong> use a custom configuration.<\/p>\n<div class=\"callout callout-danger\">\n<div class=\"callout-heading\">Warning:<\/div>\n<div class=\"callout-content\">\n<p>Make <strong>certain<\/strong> that you use the correct reverse DNS (rDNS) entries for your hosting provider. An invalid entry can cause mail servers to reject your server\u2019s mail. For more information, read our How to Configure Reverse DNS for BIND in WHM documentation.<\/p>\n<\/p><\/div>\n<\/div>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<ul>\n<li>\n<p>This setting <strong>only<\/strong> applies to IPv4 addresses.<\/p>\n<\/li>\n<li>\n<p>When you enable this setting:<\/p>\n<ul>\n<li>\n<p>The <code>\/usr\/local\/cpanel\/scripts\/updateuserdomains<\/code> script will automatically populate the <code>\/etc\/mailhelo<\/code> and <code>\/etc\/mailips<\/code> files. This will overwrite any manual changes in the <code>\/etc\/mailhelo<\/code> and <code>\/etc\/mailips<\/code> files.<\/p>\n<\/li>\n<li>\n<p>The system <strong>disables<\/strong> the <em>Reference \/etc\/mailhelo for outgoing SMTP HELO<\/em> and <em>Reference \/etc\/mailips for outgoing SMTP connections<\/em> settings.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul><\/div>\n<\/div>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"use-the-reverse-dns-entry-for-the-mail-helo-ehlo-if-available\"><em>Use the reverse DNS entry for the mail HELO\/EHLO if available<\/em><\/h5>\n<p>The system will use the server\u2019s IP address as the reverse DNS for all outgoing SMTP connections. This <strong>only<\/strong> applies during the HELO\/EHLO request.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"rebuild-reverse-dns-cache-and-update-mail-helo\"><em>Rebuild Reverse DNS Cache and Update Mail HELO<\/em><\/h5>\n<p>This setting updates the reverse DNS cache and user domains for mail HELO. This setting <strong>only<\/strong> appears when you enable the <em>Use the reverse DNS entry for the mail HELO\/EHLO if available<\/em> setting.<\/p>\n<h5 id=\"reference-etc-mailhelo-for-custom-outgoing-smtp-helo\"><em>Reference \/etc\/mailhelo for custom outgoing SMTP HELO<\/em><\/h5>\n<p>This setting allows you to send a HELO command based on the domain name in the <code>\/etc\/mailhelo<\/code> file. For more information, read our How to Configure the Exim Outgoing IP Address documentation.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>The system <strong>disables<\/strong> this setting if you enable the <em>Send mail from account\u2019s IP address<\/em> or the <em>Use the reverse DNS entry for the mail HELO\/EHLO if available<\/em> settings.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"reference-etc-mailips-for-custom-ip-on-outgoing-smtp-connections\"><em>Reference \/etc\/mailips for custom IP on outgoing SMTP connections<\/em><\/h5>\n<p>This setting allows you to send outgoing mail from the IP address that matches the domain name in the <code>\/etc\/mailips<\/code> file. For more information, read our How to Configure the Exim Outgoing IP Address documentation.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>The system <strong>disables<\/strong> this setting if you enable the <em>Send mail from account\u2019s IP address<\/em> setting.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h3 id=\"filters\">Filters<\/h3>\n<p>These settings allow you to select and configure filters that can block spam and potentially dangerous attachments.<\/p>\n<h5 id=\"system-filter-file\"><em>System Filter File<\/em><\/h5>\n<p>Use this setting to enable or disable Exim\u2019s system filter file, which the system stores in the <code>\/etc\/cpanel_exim_system_filter<\/code> file. You can also choose to specify and customize another Exim system filter file.<\/p>\n<div class=\"callout callout-danger\">\n<div class=\"callout-heading\">Warning:<\/div>\n<div class=\"callout-content\">\n<p>Regardless of the setting that you select, the Exim configuration includes <strong>all<\/strong> of the files in the <code>\/usr\/local\/cpanel\/etc\/exim\/sysfilter\/options\/<\/code> directory.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>\/etc\/cpanel_exim_system_filter<\/em>.<\/p>\n<h5 id=\"attachments-filter-messages-with-dangerous-attachments\"><em>Attachments: Filter messages with dangerous attachments<\/em><\/h5>\n<p>Select this setting to filter email messages that contain potentially dangerous attachments. The system filters the following file extensions:<\/p>\n<div class=\"collapse-wrapper\">\n<p>        Click to view&#8230;<\/p>\n<div class=\"collapse\" id=\"click-to-view---1626990044526547715\">\n<div class=\"card card-body\">\n<div class=\"highlight\">\n<pre style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-perl\" data-lang=\"perl\"><span style=\"color:#f92672\">.<\/span>ade\n<span style=\"color:#f92672\">.<\/span>adp\n<span style=\"color:#f92672\">.<\/span>bas\n<span style=\"color:#f92672\">.<\/span>bat\n<span style=\"color:#f92672\">.<\/span>chm\n<span style=\"color:#f92672\">.<\/span>cmd\n<span style=\"color:#f92672\">.<\/span>com\n<span style=\"color:#f92672\">.<\/span>cpl\n<span style=\"color:#f92672\">.<\/span>crt\n<span style=\"color:#f92672\">.<\/span>eml\n<span style=\"color:#f92672\">.<\/span>exe\n<span style=\"color:#f92672\">.<\/span>hlp\n<span style=\"color:#f92672\">.<\/span>hta\n<span style=\"color:#f92672\">.<\/span>inf\n<span style=\"color:#f92672\">.<\/span>ins\n<span style=\"color:#f92672\">.<\/span>isp\n<span style=\"color:#f92672\">.<\/span>js\n<span style=\"color:#f92672\">.<\/span>jse\n<span style=\"color:#f92672\">.<\/span>lnk\n<span style=\"color:#f92672\">.<\/span>mdb\n<span style=\"color:#f92672\">.<\/span>mde\n<span style=\"color:#f92672\">.<\/span>msc\n<span style=\"color:#f92672\">.<\/span>msi\n<span style=\"color:#f92672\">.<\/span>msp\n<span style=\"color:#f92672\">.<\/span>mst\n<span style=\"color:#f92672\">.<\/span>pcd\n<span style=\"color:#f92672\">.<\/span>pif\n<span style=\"color:#f92672\">.<\/span>reg\n<span style=\"color:#f92672\">.<\/span>scr\n<span style=\"color:#f92672\">.<\/span>sct\n<span style=\"color:#f92672\">.<\/span>shs\n<span style=\"color:#f92672\">.<\/span>url\n<span style=\"color:#f92672\">.<\/span>vbs\n<span style=\"color:#f92672\">.<\/span>vbe\n<span style=\"color:#f92672\">.<\/span>wsf\n<span style=\"color:#f92672\">.<\/span>wsh\n<span style=\"color:#f92672\">.<\/span>wsc<\/code><\/pre>\n<\/div><\/div>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"apache-spamassassin-global-subject-rewrite\"><em>Apache SpamAssassin\u2122: Global Subject Rewrite<\/em><\/h5>\n<p>Select this setting to prefix the Subject header with information from the X-Spam-Subject header and omit the X-Spam-Subject header.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"apache-spamassassin-bounce-spam-score-threshold\"><em>Apache SpamAssassin\u2122: bounce spam score threshold<\/em><\/h5>\n<p>Select this setting to define the spam score that Apache SpamAssassin uses to bounce incoming messages. Enter a positive or negative number, which may contain a single decimal point. For more information, read the Apache SpamAssassin documentation.<\/p>\n<p>This setting defaults to <em>No bouncing by spam score<\/em>.<\/p>\n<h5 id=\"apache-spamassassin-x-spam-subject-subject-header-prefix-for-spam-emails\"><em>Apache SpamAssassin\u2122: X-Spam-Subject\/Subject header prefix for spam emails<\/em><\/h5>\n<p>Select this setting to use the default X-Spam-Subject header prefix for spam email or to enter a custom prefix.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>You can use an Exim variable as a custom prefix. For a complete list of Exim\u2019s variables, read Exim\u2019s documentation.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>***SPAM***<\/em>.<\/p>\n<h3 id=\"mail\">Mail<\/h3>\n<p>Use these settings to configure specific mail settings.<\/p>\n<h5 id=\"log-sender-rates-in-the-exim-mainlog-this-can-be-helpful-for-tracking-problems-and-or-spammers\"><em>Log sender rates in the exim mainlog. This can be helpful for tracking problems and\/or spammers.<\/em><\/h5>\n<p>This setting allows you to log sender rates in the Exim mail log.<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"sender-verification-callouts\"><em>Sender Verification Callouts<\/em><\/h5>\n<p>This setting allows Exim to connect to the mail exchanger for an address. This allows Exim to verify that the address exists before Exim accepts the message.<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"smarthost-support\"><em>Smarthost support<\/em><\/h5>\n<p>This setting allows you to use a smart host for outgoing messages. To configure this setting, enter a valid <code>route_list<\/code> value in the <em>Smarthost<\/em> support text box.<\/p>\n<div class=\"callout callout-warning\">\n<div class=\"callout-heading\">Important:<\/div>\n<div class=\"callout-content\">\n<ul>\n<li>\n<p>If you enter IPv6 addresses, you <strong>must<\/strong> enclose the IP addresses in quotes and begin the list with <code>&lt;\/<\/code> to cause Exim to use slashes (<code>\/<\/code>) as separators. Otherwise, Exim will interpret the colons in each IPv6 address as separators, and use each segment of the IPv6 address as a separate host. For more information, read the Exim route_list documentation.<\/p>\n<\/li>\n<li>\n<p>If you do not enter an asterisk before the IP address or addresses, the smart host will <strong>not<\/strong> function.<\/p>\n<\/li>\n<\/ul><\/div>\n<\/div>\n<ul>\n<li>To configure a smart host that uses one IP address, enter an asterisk ( <code>*<\/code> ) followed by an IPv4 or IPv6 address. For example:<\/li>\n<\/ul>\n<div class=\"highlight\">\n<div style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\">\n<table style=\"border-spacing:0;padding:0;margin:0;border:0;width:auto;overflow:auto;display:block;\">\n<tr>\n<td style=\"vertical-align:top;padding:0;margin:0;border:0;\">\n<pre style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-go\" data-lang=\"go\"><span style=\"margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f\">1\n<\/span><span style=\"margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f\">2\n<\/span><\/code><\/pre>\n<\/td>\n<td style=\"vertical-align:top;padding:0;margin:0;border:0;;width:100%\">\n<pre style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-go\" data-lang=\"go\"><span style=\"color:#f92672\">*<\/span> <span style=\"color:#ae81ff\">192.168.0.1<\/span>\n<span style=\"color:#f92672\">*<\/span> <span style=\"color:#e6db74\">\"&lt;\/ \"<\/span><span style=\"color:#ae81ff\">2001<\/span>:<span style=\"color:#ae81ff\">0<\/span><span style=\"color:#a6e22e\">db8<\/span>:<span style=\"color:#ae81ff\">85<\/span><span style=\"color:#a6e22e\">a3<\/span>:<span style=\"color:#ae81ff\">0042<\/span>:<span style=\"color:#ae81ff\">1000<\/span>:<span style=\"color:#ae81ff\">8<\/span><span style=\"color:#a6e22e\">a2e<\/span>:<span style=\"color:#ae81ff\">0370<\/span>:<span style=\"color:#ae81ff\">7334<\/span><span style=\"color:#960050;background-color:#1e0010\">\"<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<ul>\n<li>\n<p>To configure a smart host that uses multiple IP addresses, enter an asterisk, followed by the IP addresses. For example: <\/p>\n<div class=\"highlight\">\n<div style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\">\n<table style=\"border-spacing:0;padding:0;margin:0;border:0;width:auto;overflow:auto;display:block;\">\n<tr>\n<td style=\"vertical-align:top;padding:0;margin:0;border:0;\">\n<pre style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-go\" data-lang=\"go\"><span style=\"margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f\">1\n<\/span><span style=\"margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f\">2\n<\/span><\/code><\/pre>\n<\/td>\n<td style=\"vertical-align:top;padding:0;margin:0;border:0;;width:100%\">\n<pre style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-go\" data-lang=\"go\"><span style=\"color:#f92672\">*<\/span> <span style=\"color:#ae81ff\">192.188.0.20<\/span>:<span style=\"color:#ae81ff\">192.188.0.21<\/span>:<span style=\"color:#ae81ff\">192.188.0.22<\/span>\n<span style=\"color:#f92672\">*<\/span> <span style=\"color:#e6db74\">\"&lt;\/ [2001:0db8:85a3:0042:1000:8a2e:0370:7334]:1225 \/ [::1]:1226 \/ 192.168.0.1\"<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<\/li>\n<li>\n<p>To configure a smart host that uses only specific domains from the hosts that you enter, replace the asterisk with the desired domain name. Separate entries for multiple domain names with a semicolon (;). For example:<\/p>\n<div class=\"highlight\">\n<div style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\">\n<table style=\"border-spacing:0;padding:0;margin:0;border:0;width:auto;overflow:auto;display:block;\">\n<tr>\n<td style=\"vertical-align:top;padding:0;margin:0;border:0;\">\n<pre style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-go\" data-lang=\"go\"><span style=\"margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f\">1\n<\/span><span style=\"margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f\">2\n<\/span><\/code><\/pre>\n<\/td>\n<td style=\"vertical-align:top;padding:0;margin:0;border:0;;width:100%\">\n<pre style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4\"><code class=\"language-go\" data-lang=\"go\"><span style=\"color:#a6e22e\">example<\/span>.<span style=\"color:#a6e22e\">com<\/span> <span style=\"color:#ae81ff\">192.188.0.20<\/span>:<span style=\"color:#ae81ff\">192.188.0.21<\/span>:<span style=\"color:#ae81ff\">192.188.0.22<\/span>; <span style=\"color:#a6e22e\">exampletwo<\/span>.<span style=\"color:#a6e22e\">com<\/span> <span style=\"color:#ae81ff\">192.168.0.1<\/span>\n<span style=\"color:#a6e22e\">example<\/span>.<span style=\"color:#a6e22e\">com<\/span> <span style=\"color:#e6db74\">\"&lt;\/ [2001:0db8:85a3:0042:1000:8a2e:0370:7334]:1225 \/ [::1]:1226 \/ 192.168.0.1\"<\/span>; <span style=\"color:#a6e22e\">exampletwo<\/span>.<span style=\"color:#a6e22e\">com<\/span> <span style=\"color:#e6db74\">\"&lt;\/ 2001:0db8:85a3:0042:1000:8a2e:0370:7334\"<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n<\/li>\n<\/ul>\n<p>This setting defaults to <em>None<\/em>.<\/p>\n<h5 id=\"autodiscovery-spf-include-hosts-from-the-smarthost-route-list\"><em>Autodiscovery SPF include hosts from the smarthost route list<\/em><\/h5>\n<p>This setting allows the system to check the smarthost route list labels for SPF entries and insert an include entry to the SPF records. For example, example.com has an SPF record and the <code>* outbound.example.com<\/code> smarthost routelist setting. The system adds an include entry for all SPF-enabled domains.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"spf-include-hosts-for-all-domains-on-this-system\"><em>SPF include hosts for all domains on this system<\/em><\/h5>\n<p>This setting allows you to enter hosts that the system will add as SPF include entries for all SPF enabled-domains.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>Use commas (<code>,<\/code>) to separate multiple host entries.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>None<\/em>.<\/p>\n<h5 id=\"experimental-rewrite-from-header-to-match-actual-sender\"><em>EXPERIMENTAL: Rewrite From: header to match actual sender<\/em><\/h5>\n<p>This setting rewrites the <em>From<\/em> header in emails to show the original identity of the actual sender for messages sent from your server. Email recipients can see the original From header as the <em>X-From-Rewrite<\/em> header as well as the rewritten <em>From<\/em> header. This setting is useful to determine the actual mail sender.<\/p>\n<p>In order to conduct an attack or send unsolicited email, a malicious user can alter the <em>From<\/em> header in an email to confuse the recipient. For example, a user may authenticate as <code>user@example.com<\/code> and send a message with the <em>From<\/em> header set to <code>account@forged.example.com<\/code>. When you enable this setting, Exim rewrites the <em>From<\/em> header to show the authenticated sender (<code>user@example.com<\/code>).<\/p>\n<p>You can enable this setting to ensure that the <em>From<\/em> header for mail sent from their servers always matches one of the following methods:<\/p>\n<ul>\n<li>\n<p>The actual sender. \u2014 If you authenticate as <code>user@example.com<\/code>, the <em>From<\/em> header will <strong>always<\/strong> display <code>user@example.com<\/code>.<\/p>\n<\/li>\n<li>\n<p>An email address that has been forwarded to the actual sender. \u2014 If <code>user@example.com<\/code> is an email address on your server and it forwards mail to <code>account@domain.org<\/code>, then <code>account@domain.org<\/code> may set the <em>From<\/em> header to either address.<\/p>\n<\/li>\n<li>\n<p>An email address to which the sender has access. \u2014 If you authenticate as the <code>username<\/code> user, set the <em>From<\/em> header to any email account that the <code>username<\/code> user controls.<\/p>\n<\/li>\n<\/ul>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>This setting does <strong>not<\/strong> affect mail that you receive from a remote host. The system only rewrites the <em>From<\/em> header for mail that it sends from the local machine because it is not possible to determine or validate the actual mail sender from remote machines.<\/p>\n<\/p><\/div>\n<\/div>\n<p>You can select the following settings:<\/p>\n<ul>\n<li>\n<p><em>remote<\/em> \u2014 This setting uses SMTP to rewrite the <em>From<\/em> header in outgoing emails to match the actual sender.<\/p>\n<ul>\n<li>If a local user sends mail to a user on a remote host, this setting rewrites the <em>From<\/em> header.<\/li>\n<li>If a local user receives mail from a user on a remote host, this setting does <strong>not<\/strong> rewrite the <em>From<\/em> header because it is not possible to determine the authenticated sender.<\/li>\n<li>If a local user sends mail to another local user on the same server, this setting does <strong>not<\/strong> rewrite the <em>From<\/em> header because this is not a remote delivery.<\/li>\n<li>If a local user receives mail from another local user on the same server, this setting does <strong>not<\/strong> rewrite the <em>From<\/em> header.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><em>all<\/em> \u2014 This setting rewrites the <em>From<\/em> header in all outgoing emails to match the actual sender.<\/p>\n<ul>\n<li>If a local user sends mail to a user on a remote host, the system rewrites the <em>From<\/em> header.<\/li>\n<li>If a local user receives mail from a user on a remote host, this setting does <strong>not<\/strong> rewrite the <em>From<\/em> header because it is not possible to determine the authenticated sender.<\/li>\n<li>If a local user sends mail to another local user on the same server, this setting rewrites the <em>From<\/em> header because this setting includes local deliveries.<\/li>\n<li>If a local user receives mail from another local user on the same server, this setting rewrites the <em>From<\/em> header because the sender already rewrote the <em>From<\/em> header.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><em>disable<\/em> \u2014 This setting does not rewrite the <em>From<\/em> header in any email. This is the default setting.<\/p>\n<\/li>\n<\/ul>\n<h5 id=\"allow-mail-delivery-if-malware-scanner-fails\"><em>Allow mail delivery if malware scanner fails<\/em><\/h5>\n<p>This setting allows the system to deliver mail if the malware scanner if it fails. If you select <em>On<\/em>, in the event of a malware scanner failure, the server delivers all mail normally.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>If you select <em>Off<\/em> and the malware scanner fails, users will <strong>not<\/strong> receive new messages until you repair the malware scanner.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"sender-verification\"><em>Sender Verification<\/em><\/h5>\n<p>This setting allows you to verify the origin of mail senders.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"set-smtp-sender-headers\"><em>Set SMTP Sender: headers<\/em><\/h5>\n<p>This setting allows you to set the <em>Sender:<\/em> header as &#8211;<em>f flag passed to sendmail<\/em> when a mail sender changes.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>If you set this setting to <em>Off<\/em>, Microsoft\u00ae Outlook\u00ae will <strong>not<\/strong> add an <em>On behalf<\/em> of header. This may limit your ability to track abuse of the mail system.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"allow-mail-delivery-if-spam-scanner-fails\"><em>Allow mail delivery if spam scanner fails<\/em><\/h5>\n<p>This setting allows you to disable the spam scanner if it fails. If you select <em>On<\/em>, the system delivers all mail normally in the event of a spam scanner failure.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>If you select <em>Off<\/em> and the spam scanner fails, users will <strong>not<\/strong> receive new messages until you repair the spam scanner.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"enable-sender-rewriting-scheme-srs-support\"><em>Enable Sender Rewriting Scheme (SRS) Support<\/em><\/h5>\n<p>This setting rewrites sender addresses so that the email appears to come from the forwarding mail server. This allows forwarded email to pass an SPF check on the receiving server.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>This setting uses the default configuration for SRS. If you wish to customize the SRS configuration, use the <em>Advanced Editor<\/em> interface.<\/p>\n<\/p><\/div>\n<\/div>\n<div class=\"callout callout-danger\">\n<div class=\"callout-heading\">Warning:<\/div>\n<div class=\"callout-content\">\n<p>Sender Rewriting Scheme (SRS) will <strong>not<\/strong> function correctly if the external mail server\u2019s autoresponder replies to the Sender address instead of the From address.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"query-apache-server-status-to-determine-the-sender-of-email-sent-from-processes-running-as-nobody\"><em>Query Apache server status to determine the sender of email sent from processes running as nobody<\/em><\/h5>\n<p>This setting allows the mail delivery process to query the Apache server to determine the true sender of a message when the <code>nobody<\/code> user sends a message.<\/p>\n<ul>\n<li>\n<p>This setting requires an additional connection to the server for each message that the <code>nobody<\/code> user account sends when suPHP and the mod_ruid2 module are both disabled.<\/p>\n<\/li>\n<li>\n<p>This setting is more secure, but it is faster to trust the <em>X-PHP-Script<\/em> headers.<\/p>\n<\/li>\n<\/ul>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"trust-x-php-script-headers-to-determine-the-sender-of-email-sent-from-processes-running-as-nobody\"><em>Trust X-PHP-Script headers to determine the sender of email sent from processes running as nobody<\/em><\/h5>\n<p>This setting allows Exim to trust messages that the <code>nobody<\/code> user sends with <em>X-PHP-Script<\/em> headers. This setting also enables the mail server to determine the true sender. This provides a faster delivery process than a query to the Apache server to determine the sender.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>Advanced users may forge this header. If your users may misuse this function, disable this setting and send a query to the Apache server to determine the sender of <code>nobody<\/code> messages.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"hosts-to-which-to-advertise-the-smtp-dsn-option\"><em>Hosts to which to advertise the SMTP DSN option<\/em><\/h5>\n<p>This setting allows you to specify a list of hostnames to which to advertise SMTP Delivery Status Notification (DSN) support. Enter a list of hostnames to which to advertise the SMTP DSN extension in the text box, or an asterisk ( <code>*<\/code> ) to advertise to all of the hosts on the internet.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>For more information about SMTP DSN support, read ietf.org\u2019s RFC 3461 documentation.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Disabled for all hosts<\/em>.<\/p>\n<h5 id=\"hosts-to-which-to-advertise-the-smtputf8-smtp-option\"><em>Hosts to which to advertise the SMTPUTF8 SMTP option<\/em><\/h5>\n<p>This setting allows you to specify a list of hostnames to which to advertise SMTP support for international email addresses that contain UTF-8 characters. Enter a list of hostnames to which to advertise the SMTP UTF-8 support in the text box, or an asterisk ( <code>*<\/code> ) to advertise to all of the hosts on the internet.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>For more information about SMTPUTF8 support, read ietf.org\u2019s RFC 6531 documentation.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Disabled for all hosts<\/em>.<\/p>\n<h5 id=\"delivery-behavior-for-suspended-cpanel-accounts\"><em>Delivery behavior for suspended cPanel accounts<\/em><\/h5>\n<p>This setting configures what action the server should perform when an email message is sent to a suspended account. To read more information about suspended accounts, read our Manage Account Suspension documentation.<\/p>\n<div class=\"callout callout-danger\">\n<div class=\"callout-heading\">Warning:<\/div>\n<div class=\"callout-content\">\n<p>Delivering email to a suspended account requires the evaluation of filters, redirection lists, and other data that can be abused to retain access to the server. For more information, read our What Happens When You Suspend an Account documentation.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Accept and queue messages<\/em>.<\/p>\n<h3 id=\"rbls\">RBLs<\/h3>\n<p>These settings allow you to configure your mail server to check incoming mail against the available Real-time Blackhole Lists (RBLs). Your server blocks the incoming messages if the IP address or hostname matches an RBL entry.<\/p>\n<p>RBL servers store lists of spam-heavy IP addresses and hostnames so that you can easily block them. The WHM interface accesses two RBLs: <code>bl.spamcop.net<\/code> and <code>zen.spamhaus.org<\/code>.<\/p>\n<h5 id=\"manage-custom-rbls\"><em>Manage Custom RBLs<\/em><\/h5>\n<p>Click <em>Manage<\/em> to view and manage your server\u2019s RBLs. A new interface will appear. The <em>Current RBLs<\/em> table lists the following information for each RBL:<\/p>\n<ul>\n<li>\n<p><em>Origin<\/em> \u2014 The source of the RBL.<\/p>\n<ul>\n<li><em>Custom<\/em> \u2014 Indicates that you added the RBL.<\/li>\n<li><em>System<\/em> \u2014 Indicates cPanel-included RBLs.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><em>RBL name<\/em> \u2014 The RBL\u2019s name.<\/p>\n<\/li>\n<li>\n<p><em>DNS list<\/em> \u2014 The RBL\u2019s DNS list.<\/p>\n<\/li>\n<li>\n<p><em>Info URL<\/em> \u2014 The RBL information URL.<\/p>\n<\/li>\n<li>\n<p><em>Action<\/em> \u2014 For custom RBLs, click <em>Delete<\/em> to remove the RBL.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<ul>\n<li>\n<p>You <strong>cannot<\/strong> delete cPanel-included RBLs.<\/p>\n<\/li>\n<li>\n<p>To add an RBL, enter the appropriate information in the text boxes and click <em>Add<\/em>.<\/p>\n<ul>\n<li>Make certain that you choose an RBL name that allows you to remember the DNS list for this RBL.<\/li>\n<li>After you add custom RBLs, each custom RBL will appear at the bottom of the RBLs settings tab. Select <em>On<\/em> to enable a custom RBL.<\/li>\n<li>Custom RBLs default to <em>Off<\/em>.<br \/>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul><\/div>\n<\/div>\n<\/li>\n<\/ul>\n<h5 id=\"rbl-bl-spamcop-net\"><em>RBL: bl.spamcop.net<\/em><\/h5>\n<p>This setting allows you to reject mail at SMTP-time if the sender\u2019s host is in the bl.spamcop.net RBL.<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"rbl-zen-spamhaus-org\"><em>RBL: zen.spamhaus.org<\/em><\/h5>\n<p>This setting allows you to reject mail at SMTP-time if the sender\u2019s host is in the zen.spamhaus.org RBL.<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"exempt-servers-in-the-same-netblock-as-this-one-from-rbl-checks\"><em>Exempt servers in the same netblock as this one from RBL checks<\/em><\/h5>\n<p>This setting allows you to disable RBL checks of mail from servers in the same IANA netblock.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"exempt-servers-in-the-greylisting-common-mail-providers-list-from-rbl-checks\"><em>Exempt servers in the Greylisting \u201cCommon Mail Providers\u201d list from RBL checks<\/em><\/h5>\n<p>This setting allows you to disable RBL checks of mail from an IP address block that you include in the<br \/>\n<em>Common Mail Providers<\/em> list in WHM\u2019s <em>Greylisting<\/em> interface (<em>WHM &gt;&gt; Home &gt;&gt; Email &gt;&gt; Greylisting<\/em>).<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"exempt-servers-in-the-greylisting-trusted-hosts-list-from-rbl-checks\"><em>Exempt servers in the Greylisting \u201cTrusted Hosts\u201d list from RBL checks<\/em><\/h5>\n<p>This setting allows you to disable RBL checks of mail from IP address blocks that you include in the <em>Trusted Hosts<\/em> list in WHM\u2019s <em>Greylisting<\/em> interface (<em>WHM &gt;&gt; Home &gt;&gt; Email &gt;&gt; Greylisting<\/em>).<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"whitelist-ip-addresses-that-should-not-be-checked-against-rbls\"><em>Whitelist: IP addresses that should not be checked against RBLs<\/em><\/h5>\n<p>This setting allows you to choose a list of IP addresses to whitelist. Exim does <strong>not<\/strong> RBL-check these addresses.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>Enter one IP address per line in the text box.<\/p>\n<\/p><\/div>\n<\/div>\n<h3 id=\"security\">Security<\/h3>\n<p>These settings allow you to configure security settings for your mail server.<\/p>\n<h5 id=\"allow-weak-ssl-tls-ciphers\"><em>Allow weak SSL\/TLS ciphers<\/em><\/h5>\n<p>This setting allows you to use weak SSL\/TLS encryption ciphers.<\/p>\n<div class=\"callout callout-warning\">\n<div class=\"callout-heading\">Important:<\/div>\n<div class=\"callout-content\">\n<ul>\n<li>Weak SSL\/TLS encryption ciphers violate PCI compliance. For more information about PCI compliance, read the PCI Compliance Guide.<\/li>\n<li>cPanel &#038; WHM supports Transport Layer Security (TLS) protocol version 1.2 and Transport Layer Security (TLS) protocol version 1.3:\n<ul>\n<li>cPanel &#038; WHM only supports TLSv1.2 or newer. The system enables TLSv1.2 by default.<\/li>\n<li>Not all clients will support TLSv1.3, which requires OpenSSL 1.1.1 or higher.<\/li>\n<\/ul>\n<\/li>\n<\/ul><\/div>\n<\/div>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"require-clients-to-connect-with-ssl-or-issue-the-starttls-command-before-they-are-allowed-to-authenticate-with-the-server\"><em>Require clients to connect with SSL or issue the STARTTLS command before they are allowed to authenticate with the server<\/em><\/h5>\n<p>This setting allows you to specify whether clients must connect with SSL or issue the <code>STARTTLS<\/code> command before they authenticate.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"scan-messages-for-malware-from-authenticated-senders-exiscan\"><em>Scan messages for malware from authenticated senders (exiscan)<\/em><\/h5>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>To view this setting, you <strong>must<\/strong> install ClamAV on your server.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting configures the ClamAVconnector plugin to scan all outbound messages for malware. The system rejects any mail that tests positive for malware.<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"scan-outgoing-messages-for-malware\"><em>Scan outgoing messages for malware<\/em><\/h5>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>To view this setting, you <strong>must<\/strong> install ClamAV on your server.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting configures the ClamAVconnector plugin to scan mail from non-whitelisted domains for malware. The system rejects any mail from non-whitelisted domains that tests positive for malware.<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"options-for-openssl\"><em>Options for OpenSSL<\/em><\/h5>\n<p>This setting configures SSL and TLS protocols in OpenSSL that Exim will use to securely communicate with client software. Either select the default setting or enter a space-separated list of protocols that you wish to disallow in the text box. For more information about OpenSSL\u2019s protocol settings, read OpenSSLs Client documentation.<\/p>\n<h5 id=\"ssl-tls-cipher-suite-list\"><em>SSL\/TLS Cipher Suite List<\/em><\/h5>\n<p>This setting allows you to configure the cipher suites in OpenSSL that Exim uses to securely communicate with client software. Either select the default setting or enter a cipher suite that you wish to use. For more information about cipher suites available to OpenSSL, read OpenSSL\u2019s Cipher documentation.<\/p>\n<h3 id=\"apache-spamassassin-options\">Apache SpamAssassin\u2122 Options<\/h3>\n<p>These settings allow you to configure Apache SpamAssassin to suit your server\u2019s needs. Apache SpamAssassin is a spam detection and blocking program which examines the content of an email message and assigns it an overall score. Apache SpamAssassin bases this score on the number of spam-related traits that it finds in the message. If the message\u2019s score exceeds a predefined limit,  Apache SpamAssassin discards it as spam.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>Any changes that you make to Apache SpamAssassin\u2019s configuration may require you to run <code>\/usr\/bin\/sa-compile<\/code> before they take effect.<\/p>\n<\/p><\/div>\n<\/div>\n<h5 id=\"apache-spamassassin-forced-global-on\"><em>Apache SpamAssassin\u2122: Forced Global ON<\/em><\/h5>\n<p>This setting allows you to turn on Apache SpamAssassin for all accounts on the server without an setting for the users to disable it.<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"apache-spamassassin-message-size-threshold-to-scan\"><em>Apache SpamAssassin\u2122: message size threshold to scan<\/em><\/h5>\n<p>This setting allows you to set the maximum size, in Kilobytes (KB), for messages that Apache SpamAssassin scans. It is generally inefficient to scan large messages because spam messages are typically small (<code>4<\/code> KB or smaller).<\/p>\n<p>This setting defaults to <em>1000 KB<\/em>.<\/p>\n<h5 id=\"scan-outgoing-messages-for-spam-and-reject-based-on-the-apache-spamassassin-internal-spam-score-setting\"><em>Scan outgoing messages for spam and reject based on the Apache SpamAssassin\u2122 internal spam_score setting<\/em><\/h5>\n<p>This setting allows Apache SpamAssassin to scan and reject messages to non-local domains with a higher spam score than Apache SpamAssassin\u2019s internal <code>spam_score<\/code> setting of <code>5<\/code>.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>This setting does <strong>not<\/strong> affect outbound forwarded mail. Forwarders use the <em>Do not forward mail to external recipients if it matches the Apache SpamAssassin\u2122 internal spam_score setting<\/em> setting.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"scan-outgoing-messages-for-spam-and-reject-based-on-defined-apache-spamassassin-score\"><em>Scan outgoing messages for spam and reject based on defined Apache SpamAssassin\u2122 score<\/em><\/h5>\n<p>This setting allows you to set the <code>spam_score<\/code> threshold that Apache SpamAssassin uses to determine when it rejects messages to non-local domains. To enable this setting, enter a number to use as a minimum spam score in the text box.<\/p>\n<ul>\n<li>This value <strong>must<\/strong> be a number between <code>0.1<\/code> and <code>99.9<\/code>.<\/li>\n<li>This value <strong>only<\/strong> accepts up to two decimal places.<\/li>\n<\/ul>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>This setting does <strong>not<\/strong> affect outbound forwarded mail. Forwarders use the <em>Do not forward mail to external recipients based on the defined Apache SpamAssassin\u2122 score<\/em> setting.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>Disabled<\/em>.<\/p>\n<h5 id=\"do-not-forward-mail-to-external-recipients-if-it-matches-the-apache-spamassassin-internal-spam-score-setting\"><em>Do not forward mail to external recipients if it matches the Apache SpamAssassin\u2122 internal spam_score setting<\/em><\/h5>\n<p>This setting allows Apache SpamAssassin to scan and reject messages in the forwarder queue with a higher spam score than Apache SpamAssassin\u2019s internal <code>spam_score<\/code> setting of <code>5<\/code>. The system disables this setting by default.<\/p>\n<p>This setting defaults to <em>Off<\/em>.<\/p>\n<h5 id=\"do-not-forward-mail-to-external-recipients-based-on-the-defined-apache-spamassassin-score\"><em>Do not forward mail to external recipients based on the defined Apache SpamAssassin\u2122 score<\/em><\/h5>\n<p>This setting allows you to set the <code>spam_score<\/code> threshold that Apache SpamAssassin uses to determine whether it rejects messages that users forward to non-local domains. To enable this setting, enter a number to use as a minimum spam score in the text box.<\/p>\n<ul>\n<li>This value <strong>must<\/strong> be a number between <code>0.1<\/code> and <code>99.9<\/code>.<\/li>\n<li>This value <strong>only<\/strong> accepts up to two decimal places.<\/li>\n<\/ul>\n<p>This setting defaults to <em>Disabled<\/em>.<\/p>\n<h5 id=\"enable-bayes-poison-defense-apache-spamassassin-ruleset\"><em>Enable BAYES_POISON_DEFENSE Apache SpamAssassin\u2122 ruleset<\/em><\/h5>\n<p>This setting increases the scoring thresholds that the Bayes Poison Defense module needs to learn SPAM and HAM (not spam). This helps Apache SpamAssassin to better protect the system against spammers who use Bayes poisoning.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"enable-passive-os-fingerprinting-for-apache-spamassassin\"><em>Enable Passive OS Fingerprinting for Apache SpamAssassin\u2122<\/em><\/h5>\n<p>This setting allows Apache SpamAssassin to use Passive OS Fingerprinting.<\/p>\n<div class=\"callout callout-info\">\n<div class=\"callout-heading\">Note:<\/div>\n<div class=\"callout-content\">\n<p>You <strong>must<\/strong> enable the Passive OS Fingerprinting setting in WHM\u2019s <em>Service Manager<\/em> interface (<em>WHM &gt;&gt; Home &gt;&gt; Service Configuration &gt;&gt; Service Manager<\/em>) for this setting to function.<\/p>\n<\/p><\/div>\n<\/div>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"enable-kam-apache-spamassassin-ruleset\"><em>Enable KAM Apache SpamAssassin\u2122 ruleset<\/em><\/h5>\n<p>This setting allows Apache SpamAssassin to use the Kevin A. McGrail\u2019s KAM ruleset, with significant contributions from Joe Quinn. For more information about the KAM ruleset, read the module\u2019s website.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<h5 id=\"enable-the-apache-spamassassin-ruleset-that-cpanel-uses-on-cpanel-net\"><em>Enable the Apache SpamAssassin\u2122 ruleset that cPanel uses on cpanel.net<\/em><\/h5>\n<p>This setting allows Apache SpamAssassin to use the ruleset that cPanel, L.L.C. uses on the <code>cpanel.net<\/code> servers.<\/p>\n<p>This setting defaults to <em>On<\/em>.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Valid for versions 94 through the latest version Version: 82 84 86 94 Overview Select the Basic Editor tab in the Exim Configuration Manager interface to modify your server\u2019s Exim configuration settings. All This tab displays all available settings. To filter the displayed settings, select a category tab. You can also use the Find text &hellip;<\/p>\n","protected":false},"author":1,"featured_media":911,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/910"}],"collection":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/comments?post=910"}],"version-history":[{"count":0,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/910\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media\/911"}],"wp:attachment":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media?parent=910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/categories?post=910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/tags?post=910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}