From: root@deleuze.hcoop.net <>
Date: Fri, 19 Jan 2007 22:42:19 +0000 (-0500)
Subject: mwolson: Upgrade exim4 packages to equivalent of version in debian testing
X-Git-Url: https://git.hcoop.net/hcoop/zz_old/config/exim4-hopper.git/commitdiff_plain/d2b0a5673bd9cea2df559aca7295fa4586fdaebd

mwolson: Upgrade exim4 packages to equivalent of version in debian testing
---

diff --git a/conf.d/acl/20_exim4-config_whitelist_local_deny b/conf.d/acl/20_exim4-config_whitelist_local_deny
index 99abd27..f9003f1 100644
--- a/conf.d/acl/20_exim4-config_whitelist_local_deny
+++ b/conf.d/acl/20_exim4-config_whitelist_local_deny
@@ -8,17 +8,7 @@
 #
 # It is meant to be used from some other acl entry.
 #
-# For example,
-# deny
-#   message = local blacklist example
-#   !acl = acl_whitelist
-#   dnslist = some.dns.list.example
-# will allow messages with envelope sender listed in local_sender_whitelist
-# or messages coming in from hosts listed in local_host_whitelist to be
-# accepted even if the delivering host is listed in the dns list.
-#
-# Whitelisting can also be configured by including negative items in the
-# black list. See /usr/share/doc/exim4-config/default_acl for details.
+# See exim4-config_files(5) for details.
 #
 # If the files do not exist, the white list never matches, which is
 # the desired behaviour.
diff --git a/conf.d/acl/30_exim4-config_check_rcpt b/conf.d/acl/30_exim4-config_check_rcpt
index 6c954dc..cb4b73b 100644
--- a/conf.d/acl/30_exim4-config_check_rcpt
+++ b/conf.d/acl/30_exim4-config_check_rcpt
@@ -7,18 +7,13 @@
 # accepted or denied.
 #
 acl_check_rcpt:
+
   # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
   # testing for an empty sending host field.
   accept
     hosts = :
 
 
-  # Add missing Date and Message-ID header for relayed messages
-  warn
-    hosts = +relay_from_hosts
-    control = submission/sender_retain
-
-
   # The following section of the ACL is concerned with local parts that contain
   # certain non-alphanumeric characters. Dots in unusual places are
   # handled by this ACL as well.
@@ -38,12 +33,24 @@ acl_check_rcpt:
   # contain slashes. A pipe symbol can also be troublesome if the local part is
   # incorporated unthinkingly into a shell command line.
   #
+  # These ACL components will block recipient addresses that are valid
+  # from an RFC2822 point of view. We chose to have them blocked by
+  # default for security reasons.
+  #
+  # If you feel that your site should have less strict recipient
+  # checking, please feel free to change the default values of the macros
+  # defined in main/01_exim4-config_listmacrosdefs or override them from a
+  # local configuration file.
+  # 
   # Two different rules are used. The first one has a quite strict
   # default, and is applied to messages that are addressed to one of the
   # local domains handled by this host.
-  # If you have local accounts that include strange characters, you can
-  # use the macro provided to change the ACL range or to disable the
-  # check completely.
+
+  # The default value of CHECK_RCPT_LOCAL_LOCALPARTS is defined in
+  # main/01_exim4-config_listmacrosdefs:
+  # CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
+  # This blocks local parts that begin with a dot or contain a quite
+  # broad range of non-alphanumeric characters.
   .ifdef CHECK_RCPT_LOCAL_LOCALPARTS
   deny
     domains = +local_domains
@@ -54,6 +61,20 @@ acl_check_rcpt:
 
   # The second rule applies to all other domains, and its default is
   # considerably less strict.
+  
+  # The default value of CHECK_RCPT_REMOTE_LOCALPARTS is defined in
+  # main/01_exim4-config_listmacrosdefs:
+  # CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
+
+  # It allows local users to send outgoing messages to sites
+  # that use slashes and vertical bars in their local parts. It blocks
+  # local parts that begin with a dot, slash, or vertical bar, but allows
+  # these characters within the local part. However, the sequence /../ is
+  # barred. The use of some other non-alphanumeric characters is blocked.
+  # Single quotes might probably be dangerous as well, but they're
+  # allowed by the default regexps to avoid rejecting mails to Ireland.
+  # The motivation here is to prevent local users (or local users' malware)
+  # from mounting certain kinds of attack on remote sites.
   .ifdef CHECK_RCPT_REMOTE_LOCALPARTS
   deny
     domains = !+local_domains
@@ -71,16 +92,106 @@ acl_check_rcpt:
     .else
     local_parts = CHECK_RCPT_POSTMASTER
     .endif
-    domains = +local_domains
+    domains = +local_domains : +relay_to_domains
+
+
+  # Deny unless the sender address can be verified.
+  #
+  # This is disabled by default so that DNSless systems don't break. If
+  # your system can do DNS lookups without delay or cost, you might want
+  # to enable this feature.
+  #
+  # This feature does not work in smarthost and satellite setups as
+  # with these setups all domains pass verification. See spec.txt chapter
+  # 39.31 with the added information that a smarthost/satellite setup
+  # routes all non-local e-mail to the smarthost.
+  .ifdef CHECK_RCPT_VERIFY_SENDER
+  deny
+    message = Sender verification failed
+    !acl = acl_whitelist_local_deny
+    !verify = sender
+  .endif
+
+  # Verify senders listed in local_sender_callout with a callout.
+  #
+  # In smarthost and satellite setups, this causes the callout to be
+  # done to the smarthost. Verification will thus only be reliable if the
+  # smarthost does reject illegal addresses in the SMTP dialog.
+  deny
+    !acl = acl_whitelist_local_deny
+    senders = ${if exists{CONFDIR/local_sender_callout}\
+                         {CONFDIR/local_sender_callout}\
+                   {}}
+    !verify = sender/callout
+
+
+  # Accept if the message comes from one of the hosts for which we are an
+  # outgoing relay. It is assumed that such hosts are most likely to be MUAs,
+  # so we set control=submission to make Exim treat the message as a
+  # submission. It will fix up various errors in the message, for example, the
+  # lack of a Date: header line. If you are actually relaying out out from
+  # MTAs, you may want to disable this. If you are handling both relaying from
+  # MTAs and submissions from MUAs you should probably split them into two
+  # lists, and handle them differently.
+
+  # Recipient verification is omitted here, because in many cases the clients
+  # are dumb MUAs that don't cope well with SMTP error responses. If you are
+  # actually relaying out from MTAs, you should probably add recipient
+  # verification here.
+
+  # Note that, by putting this test before any DNS black list checks, you will
+  # always accept from these hosts, even if they end up on a black list. The
+  # assumption is that they are your friends, and if they get onto black
+  # list, it is a mistake.
+  accept
+    hosts = +relay_from_hosts
+    control = submission/sender_retain
+
+
+  # Accept if the message arrived over an authenticated connection, from
+  # any host. Again, these messages are usually from MUAs, so recipient
+  # verification is omitted, and submission mode is set. And again, we do this
+  # check before any black list tests.
+  accept
+    authenticated = *
+    control = submission/sender_retain
+
+
+  # Insist that any other recipient address that we accept is either in one of
+  # our local domains, or is in a domain for which we explicitly allow
+  # relaying. Any other domain is rejected as being unacceptable for relaying.
+  require
+    message = relay not permitted
+    domains = +local_domains : +relay_to_domains
+
+
+  # We also require all accepted addresses to be verifiable. This check will
+  # do local part verification for local domains, but only check the domain
+  # for remote domains.
+  require
+    verify = recipient
+
+
+  # Verify recipients listed in local_rcpt_callout with a callout.
+  # This is especially handy for forwarding MX hosts (secondary MX or
+  # mail hubs) of domains that receive a lot of spam to non-existent
+  # addresses.  The only way to check local parts for remote relay
+  # domains is to use a callout (add /callout), but please read the
+  # documentation about callouts before doing this.
+  deny
+    !acl = acl_whitelist_local_deny
+    recipients = ${if exists{CONFDIR/local_rcpt_callout}\
+                            {CONFDIR/local_rcpt_callout}\
+                      {}}
+    !verify = recipient/callout
 
 
-  # deny bad senders (envelope sender)
   # CONFDIR/local_sender_blacklist holds a list of envelope senders that
   # should have their access denied to the local host. Incoming messages
   # with one of these senders are rejected at RCPT time.
   #
   # The explicit white lists are honored as well as negative items in
-  # the black list. See /usr/share/doc/exim4-config/default_acl for details.
+  # the black list. See exim4-config_files(5) for details.
   deny
     message = sender envelope address $sender_address is locally blacklisted here. If you think this is wrong, get in touch with postmaster
     !acl = acl_whitelist_local_deny
@@ -105,39 +216,6 @@ acl_check_rcpt:
                  {}}
 
 
-  # Deny unless the sender address can be verified.
-  #
-  # This is disabled by default so that DNSless systems don't break. If
-  # your system can do DNS lookups without delay or cost, you might want
-  # to enable this feature.
-  .ifdef CHECK_RCPT_VERIFY_SENDER
-  deny
-    message = Sender verification failed
-    !acl = acl_whitelist_local_deny
-    !verify = sender
-  .endif
-
-  # For some sender domains, we do callout to verify if a sender
-  # exists.
-  deny
-    !acl = acl_whitelist_local_deny
-    senders = ${if exists{CONFDIR/local_sender_callout}\
-                         {CONFDIR/local_sender_callout}\
-                   {}}
-    !verify = sender/callout
-
-
-  # For some recipient domains, we do callout to verify if a recipient
-  # exists. This is especially handy for customers that receive a lot of
-  # spam to non-existent addresses.
-  deny
-    !acl = acl_whitelist_local_deny
-    recipients = ${if exists{CONFDIR/local_rcpt_callout}\
-                            {CONFDIR/local_rcpt_callout}\
-                      {}}
-    !verify = recipient/callout
-
-
   # Warn if the sender host does not have valid reverse DNS.
   # 
   # If your system can do DNS lookups without delay or cost, you might want
@@ -154,6 +232,48 @@ acl_check_rcpt:
   .endif
 
 
+  # Use spfquery to perform a pair of SPF checks (for details, see
+  # http://www.openspf.org/)
+  #
+  # This is quite costly in terms of DNS lookups (~6 lookups per mail).  Do not
+  # enable if that's an issue.  Also note that if you enable this, you must
+  # install "libmail-spf-query-perl" which provides the spfquery command.
+  # Missing libmail-spf-query-perl will trigger the "Unexpected error in
+  # SPF check" warning.
+  .ifdef CHECK_RCPT_SPF
+  deny
+    message = [SPF] $sender_host_address is not allowed to send mail from ${if def:sender_address_domain {$sender_address_domain}{$sender_helo_name}}.  \
+              Please see http://www.openspf.org/why.html?sender=$sender_address&ip=$sender_host_address
+    log_message = SPF check failed.
+    condition = ${run{/usr/bin/spfquery --ip \"$sender_host_address\" --mail-from \"$sender_address\" --helo \"$sender_helo_name\"}\
+                     {no}{${if eq {$runrc}{1}{yes}{no}}}}
+
+  defer
+    message = Temporary DNS error while checking SPF record.  Try again later.
+    condition = ${if eq {$runrc}{5}{yes}{no}}
+
+  warn
+    message = Received-SPF: ${if eq {$runrc}{0}{pass}{${if eq {$runrc}{2}{softfail}\
+                                 {${if eq {$runrc}{3}{neutral}{${if eq {$runrc}{4}{unknown}{${if eq {$runrc}{6}{none}{error}}}}}}}}}}
+    condition = ${if <={$runrc}{6}{yes}{no}}
+
+  warn
+    log_message = Unexpected error in SPF check.
+    condition = ${if >{$runrc}{6}{yes}{no}}
+
+  # Support for best-guess (see http://www.openspf.org/developers-guide.html)
+  warn
+    message = X-SPF-Guess: ${run{/usr/bin/spfquery --ip \"$sender_host_address\" --mail-from \"$sender_address\" \ --helo \"$sender_helo_name\" --guess true}\
+                                {pass}{${if eq {$runrc}{2}{softfail}{${if eq {$runrc}{3}{neutral}{${if eq {$runrc}{4}{unknown}\
+                                {${if eq {$runrc}{6}{none}{error}}}}}}}}}}
+    condition = ${if <={$runrc}{6}{yes}{no}}
+
+  defer
+    message = Temporary DNS error while checking SPF record.  Try again later.
+    condition = ${if eq {$runrc}{5}{yes}{no}}
+  .endif
+
+
   # Check against classic DNS "black" lists (DNSBLs) which list
   # sender IP addresses
   .ifdef CHECK_RCPT_IP_DNSBLS
@@ -165,8 +285,12 @@ acl_check_rcpt:
 
 
   # Check against DNSBLs which list sender domains, with an option to locally
-  # whitelist certain domains that might be blacklisted. If you want one
-  # blacklist per domain, you need to replicate the stanza for each DNSBL.
+  # whitelist certain domains that might be blacklisted.
+  #
+  # Note: If you define CHECK_RCPT_DOMAIN_DNSBLS, you must append
+  # "/$sender_address_domain" after each domain.  For example:
+  # CHECK_RCPT_DOMAIN_DNSBLS = rhsbl.foo.org/$sender_address_domain \
+  #                            : rhsbl.bar.org/$sender_address_domain
   .ifdef CHECK_RCPT_DOMAIN_DNSBLS
   warn
     message = X-Warning: $sender_address_domain is listed at $dnslist_domain ($dnslist_value: $dnslist_text)
@@ -174,7 +298,7 @@ acl_check_rcpt:
     !senders = ${if exists{CONFDIR/local_domain_dnsbl_whitelist}\
                     {CONFDIR/local_domain_dnsbl_whitelist}\
                     {}}
-    dnslists = CHECK_RCPT_DOMAIN_DNSBLS/$sender_address_domain
+    dnslists = CHECK_RCPT_DOMAIN_DNSBLS
   .endif
 
 
@@ -187,62 +311,28 @@ acl_check_rcpt:
   .endif
 
 
-  # Accept if the address is in a local domain, but only if the recipient can
-  # be verified. Otherwise deny. The "endpass" line is the border between
-  # passing on to the next ACL statement (if tests above it fail) or denying
-  # access (if tests below it fail).
+  #############################################################################
+  # This check is commented out because it is recognized that not every
+  # sysadmin will want to do it. If you enable it, the check performs
+  # Client SMTP Authorization (csa) checks on the sending host. These checks
+  # do DNS lookups for SRV records. The CSA proposal is currently (May 2005)
+  # an Internet draft. You can, of course, add additional conditions to this
+  # ACL statement to restrict the CSA checks to certain hosts only.
   #
-  accept
-    domains = +local_domains
-    endpass
-    message = unknown user
-    verify = recipient
+  # require verify = csa
+  #############################################################################
 
 
-  # Accept if the address is in a domain for which we are relaying, but again,
-  # only if the recipient can be verified.
-  #
-  # If you want to use the more conservative "unknown user" error
-  # message in case of a non-existing local part, you might want to
-  # set CHECK_RCPT_GIVE_UNKNOWN_USER. However, this might reveal
-  # local information, which is the cause for it not being enabled by
-  # default.
+  # Accept if the address is in a domain for which we are an incoming relay,
+  # but again, only if the recipient can be verified.
+
   accept
     domains = +relay_to_domains
     endpass
-    .ifdef CHECK_RCPT_GIVE_UNKNOWN_USER
-    message = ${if eq{$acl_verify_message}{Unrouteable address}{unknown user}{$acl_verify_message}}
-    .else
-    message = unrouteable address
-    .endif
     verify = recipient
 
 
-  ############
-  # If control reaches this point, the domain is neither in +local_domains
-  # nor in +relay_to_domains.
-  ############
+  # At this point, the address has passed all the checks that have been
+  # configured, so we accept it unconditionally.
 
-  # Accept if the message comes from one of the hosts for which we are an
-  # outgoing relay. Recipient verification is omitted here, because in many
-  # cases the clients are dumb MUAs that don't cope well with SMTP error
-  # responses. If you are actually relaying out from MTAs, you should probably
-  # add recipient verification here.
-  #
   accept
-    hosts = +relay_from_hosts
-
-
-  # Accept if the message arrived over an authenticated connection, from
-  # any host. Again, these messages are usually from MUAs, so recipient
-  # verification is omitted.
-  #
-  accept
-    authenticated = *
-
-
-  # Reaching the end of the ACL causes a "deny", but we might as well give
-  # an explicit message.
-  #
-  deny
-    message = relay not permitted
diff --git a/conf.d/acl/40_exim4-config_check_data b/conf.d/acl/40_exim4-config_check_data
index 08c5382..fb219a0 100644
--- a/conf.d/acl/40_exim4-config_check_data
+++ b/conf.d/acl/40_exim4-config_check_data
@@ -2,6 +2,10 @@
 ### acl/40_exim4-config_check_data
 #################################
 
+# This ACL is used after the contents of a message have been received. This
+# is the ACL in which you can test a message's headers or body, and in
+# particular, this is where you can invoke external virus or spam scanners.
+
 acl_check_data:
 
   # Deny unless the address list headers are syntactically correct.
@@ -25,6 +29,39 @@ acl_check_data:
   .endif
 
 
+  # Deny if the message contains malware. Before enabling this check, you
+  # must install a virus scanner and set the av_scanner option in the
+  # main configuration.
+  #
+  # exim4-daemon-heavy must be used for this section to work.
+  #
+  # deny
+  #   malware = *
+  #   message = This message was detected as possible malware ($malware_name).
+
+
+  # Add headers to a message if it is judged to be spam. Before enabling this,
+  # you must install SpamAssassin. You also need to set the spamd_address
+  # option in the main configuration.
+  #
+  # exim4-daemon-heavy must be used for this section to work.
+  #
+  # Please note that this is only suiteable as an example. There are
+  # multiple issues with this configuration method. For example, if you go
+  # this way, you'll give your spamassassin daemon write access to the
+  # entire exim spool which might be a security issue in case of a
+  # spamassassin exploit.
+  #
+  # See the exim docs and the exim wiki for more suitable examples.
+  #
+  # warn
+  #   spam = Debian-exim:true
+  #   message = X-Spam_score: $spam_score\n\
+  #             X-Spam_score_int: $spam_score_int\n\
+  #             X-Spam_bar: $spam_bar\n\
+  #             X-Spam_report: $spam_report
+
+
   # This hook allows you to hook in your own ACLs without having to
   # modify this file. If you do it like we suggest, you'll end up with
   # a small performance penalty since there is an additional file being
diff --git a/conf.d/auth/30_exim4-config_examples b/conf.d/auth/30_exim4-config_examples
index 6278da6..24d52d1 100644
--- a/conf.d/auth/30_exim4-config_examples
+++ b/conf.d/auth/30_exim4-config_examples
@@ -2,43 +2,54 @@
 ### auth/30_exim4-config_examples
 #################################
 
-# The examples below are for server side authentication
+# The examples below are for server side authentication, when the
+# local exim is SMTP server and clients authenticate to the local exim.
 
 # They allow two styles of plain-text authentication against an
-# CONFDIR/passwd file which should have user names in the first column
-# and crypted passwords in the second. The columns need to be separated
-# by ':'. Please note that apache's htpasswd program generates a file
-# in the correct format, but uses a different crypt scheme. So,
-# htpassword will _NOT_ work for exim4.
-
-# For CRAM-MD5 exim needs access to the UNENCRYPTED passwd - the example
-# below assumes it is available in the third column of CONFDIR/passwd
+# CONFDIR/passwd file whose syntax is described in exim_passwd(5).
 
 # Hosts that are allowed to use AUTH are defined by the
 # auth_advertise_hosts option in the main configuration. The default is
 # "*", which allows authentication to all hosts over all kinds of
 # connections if there is at least one authenticator defined here.
 # Authenticators which rely on unencrypted clear text passwords don't
-# advertise on unencrypted connections by default. You can set
-# AUTH_SERVER_ALLOW_NOTLS_PASSWORDS to advertise unencrypted clear text
-# password based authenticators on all connections.
+# advertise on unencrypted connections by default. Thus, it might be
+# wise to set up TLS to allow encrypted connections. If TLS cannot be
+# used for some reason, you can set AUTH_SERVER_ALLOW_NOTLS_PASSWORDS to
+# advertise unencrypted clear text password based authenticators on all
+# connections. As this is severely reducing security, using TLS is
+# preferred over allowing clear text password based authenticators on
+# unencrypted connections.
+
+# PLAIN authentication has no server prompts. The client sends its
+# credentials in one lump, containing an authorization ID (which we do not
+# use), an authentication ID, and a password. The latter two appear as
+# $auth2 and $auth3 in the configuration and should be checked against a
+# valid username and password. In a real configuration you would typically
+# use $auth2 as a lookup key, and compare $auth3 against the result of the
+# lookup, perhaps using the crypteq{}{} condition.
 
 # plain_server:
 #   driver = plaintext
 #   public_name = PLAIN
-#   server_condition = "${if crypteq{$3}{${extract{1}{:}{${lookup{$2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
-#   server_set_id = $2
+#   server_condition = "${if crypteq{$auth3}{${extract{1}{:}{${lookup{$auth2}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
+#   server_set_id = $auth2
 #   server_prompts = :
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
 #   .endif
-#
+
+# LOGIN authentication has traditional prompts and responses. There is no
+# authorization ID in this mechanism, so unlike PLAIN the username and
+# password are $auth1 and $auth2. Apart from that you can use the same
+# server_condition setting for both authenticators.
+
 # login_server:
 #   driver = plaintext
 #   public_name = LOGIN
 #   server_prompts = "Username:: : Password::"
-#   server_condition = "${if crypteq{$2}{${extract{1}{:}{${lookup{$1}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
-#   server_set_id = $1
+#   server_condition = "${if crypteq{$auth2}{${extract{1}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}{*:*}}}}}{1}{0}}"
+#   server_set_id = $auth1
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
 #   .endif
@@ -46,24 +57,24 @@
 # cram_md5_server:
 #   driver = cram_md5
 #   public_name = CRAM-MD5
-#   server_secret = ${extract{2}{:}{${lookup{$1}lsearch{CONFDIR/passwd}{$value}fail}}}
-#   server_set_id = $1
+#   server_secret = ${extract{2}{:}{${lookup{$auth1}lsearch{CONFDIR/passwd}{$value}fail}}}
+#   server_set_id = $auth1
 
 # Here is an example of CRAM-MD5 authentication against PostgreSQL:
 #
 # psqldb_auth_server:
 #   driver = cram_md5
 #   public_name = CRAM-MD5
-#   server_secret = ${lookup pgsql{SELECT pw FROM users WHERE username = '${quote_pgsql:$1}'}{$value}fail}
-#   server_set_id = $1
+#   server_secret = ${lookup pgsql{SELECT pw FROM users WHERE username = '${quote_pgsql:$auth1}'}{$value}fail}
+#   server_set_id = $auth1
 
 # Authenticate against local passwords using sasl2-bin
-# Requires exim_uid to be a member of sasl group, see README.SMTP-AUTH
+# Requires exim_uid to be a member of sasl group, see README.Debian.gz
 # plain_saslauthd_server:
 #   driver = plaintext
 #   public_name = PLAIN
-#   server_condition = ${if saslauthd{{$2}{$3}}{1}{0}}
-#   server_set_id = $2
+#   server_condition = ${if saslauthd{{$auth2}{$auth3}}{1}{0}}
+#   server_set_id = $auth2
 #   server_prompts = :
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
@@ -74,9 +85,8 @@
 #   public_name = LOGIN
 #   server_prompts = "Username:: : Password::"
 #   # don't send system passwords over unencrypted connections
-#   server_advertise_condition = ${if eq{$tls_cipher}{}{0}{1}}
-#   server_condition = ${if saslauthd{{$1}{$2}}{1}{0}}
-#   server_set_id = $1
+#   server_condition = ${if saslauthd{{$auth1}{$auth2}}{1}{0}}
+#   server_set_id = $auth1
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
 #   .endif
@@ -85,7 +95,7 @@
 #   driver = cyrus_sasl
 #   public_name = NTLM
 #   server_realm = <short main hostname>
-#   server_set_id = $1
+#   server_set_id = $auth1
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
 #   .endif
@@ -94,26 +104,25 @@
 #   driver = cyrus_sasl
 #   public_name = DIGEST-MD5
 #   server_realm = <short main hostname>
-#   server_set_id = $1
+#   server_set_id = $auth1
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
 #   .endif
 
 # Authentcate against cyrus-sasl
 # This is mainly untested, please report any problems to
-# pkg-exim4-users@lists.alioth.debian.org. If you have success with
-# using these authenticators until May 1 2005, please report as well.
+# pkg-exim4-users@lists.alioth.debian.org.
 # cram_md5_sasl_server:
 #   driver = cyrus_sasl
 #   public_name = CRAM-MD5
 #   server_realm = <short main hostname>
-#   server_set_id = $1
+#   server_set_id = $auth1
 #
 # plain_sasl_server:
 #   driver = cyrus_sasl
 #   public_name = PLAIN
 #   server_realm = <short main hostname>
-#   server_set_id = $1
+#   server_set_id = $auth1
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
 #   .endif
@@ -122,37 +131,41 @@
 #   driver = cyrus_sasl
 #   public_name = LOGIN
 #   server_realm = <short main hostname>
-#   server_set_id = $1
+#   server_set_id = $auth1
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
 #   .endif
 
 # Authenticate against courier authdaemon
 
-# This has been copied from
-# http://www.devco.net/archives/2004/06/10/smtp_auth_with_exim_and_courier_authdaemon.php
-# (thanks to r. i. pienaar). This has been reported as "working" with
-# the Debian packages by Sven Geggus. Possible pitfall: access rights
-# on /var/run/courier/authdaemon/socket.
-
+# This is now the (working!) example from
+# http://www.exim.org/eximwiki/FAQ/Policy_controls/Q0730
+# Possible pitfall: access rights on /var/run/courier/authdaemon/socket.
 # plain_courier_authdaemon:
 #   driver = plaintext
 #   public_name = PLAIN
 #   server_condition = \
-#                ${if eq {${readsocket{/var/run/courier/authdaemon/socket}\
-#                {AUTH ${strlen:exim\nlogin\n$2\n$3\n}\nexim\nlogin\n$2\n$3\n}}}{FAIL\n}{no}{yes}}
-#   server_set_id = $2
+#     ${extract {ADDRESS} \
+#               {${readsocket{/var/run/courier/authdaemon/socket} \
+#               {AUTH ${strlen:exim\nlogin\n$auth2\n$auth3\n}\nexim\nlogin\n$auth2\n$auth3\n} }} \
+#               {yes} \
+#               fail}
+#   server_set_id = $auth2
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
 #   .endif
-#
+
 # login_courier_authdaemon:
 #   driver = plaintext
 #   public_name = LOGIN
 #   server_prompts = Username:: : Password::
-#   server_condition = ${if eq {${readsocket{/var/run/courier/authdaemon/socket} \
-#                 {AUTH ${strlen:exim\nlogin\n$1\n$2\n}\nexim\nlogin\n$1\n$2\n}}}{FAIL\n}{no}{yes}}
-#   server_set_id = $1
+#   server_condition = \
+#     ${extract {ADDRESS} \
+#               {${readsocket{/var/run/courier/authdaemon/socket} \
+#               {AUTH ${strlen:exim\nlogin\n$auth1\n$auth2\n}\nexim\nlogin\n$auth1\n$auth2\n} }} \
+#               {yes} \
+#               fail}
+#   server_set_id = $auth1
 #   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
 #   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
 #   .endif
@@ -160,6 +173,8 @@
 # This one is a bad hack to support the broken version 4.xx of
 # Microsoft Outlook Express which violates the RFCs by demanding
 # "250-AUTH=" instead of "250-AUTH ".
+# If your list of offered authenticators is other than PLAIN and LOGIN,
+# you need to adapt the public_name line manually.
 # It has to be the last authenticator to work and has not been tested
 # well. Use at your own risk.
 # See the thread entry point from
@@ -172,21 +187,17 @@
 #   public_name = "\r\n250-AUTH=PLAIN LOGIN"
 #   server_prompts = User Name : Password
 #   server_condition = no
+#   .ifndef AUTH_SERVER_ALLOW_NOTLS_PASSWORDS
+#   server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}
+#   .endif
 
 ##############
-# See /usr/share/doc/exim4-base/README.SMTP-AUTH
+# See /usr/share/doc/exim4-base/README.Debian.gz
 ##############
 
 # These examples below are the equivalent for client side authentication.
-# They get the passwords from CONFDIR/passwd.client. This file should have
-# three columns separated by colons, the first contains the name of the
-# mailserver to authenticate against, the second the username and the third
-# contains the password.
-
-### # example for CONFDIR/passwd.client
-### mail.server:blah:secret
-### # default entry:
-### *:bar:foo
+# They get the passwords from CONFDIR/passwd.client, whose format is
+# defined in exim4_passwd_client(5)
 
 # Because AUTH PLAIN and AUTH LOGIN send the password in clear, we
 # only allow these mechanisms over encrypted connections by default.
@@ -196,8 +207,8 @@
 cram_md5:
   driver = cram_md5
   public_name = CRAM-MD5
-  client_name = ${extract{1}{:}{${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}}
-  client_secret = ${extract{2}{:}{${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}}
+  client_name = ${extract{1}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
+  client_secret = ${extract{2}{:}{${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}
 
 plain:
   driver = plaintext
@@ -205,23 +216,46 @@ plain:
 .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
   client_send = "${if !eq{$tls_cipher}{}{\
                      ^${extract{1}{::}\
-		       {${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}}\
+		       {${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}\
 		     ^${extract{2}{::}\
-		       {${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}}\
+		       {${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}\
 		   }fail}"
 .else
-  client_send = "^${extract{1}{::}{${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}}^${extract{2}{::}{${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}}"
+  client_send = "^${extract{1}{::}\
+                   {${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}\
+                 ^${extract{2}{::}\
+		   {${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}"
 .endif
 
 login:
   driver = plaintext
   public_name = LOGIN
 .ifndef AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS
-  client_send = "${if !eq{$tls_cipher}{}{}fail}\
+  # Return empty string if not non-TLS AND looking up $host in passwd-file
+  # yields a non-empty string; fail otherwise.
+  client_send = "${if and{\
+                          {!eq{$tls_cipher}{}}\
+                          {!eq\
+                              {${lookup{$host}nwildlsearch{CONFDIR/passwd.client}\
+                                 {$value}fail}}\
+                              {}}\
+                         }\
+                      {}fail}\
                  : ${extract{1}{::}\
-		        {${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}} \
+		        {${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}} \
 		 : ${extract{2}{::}\
-		     {${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}}"
+		     {${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}"
 .else
-  client_send = ": ${extract{1}{::}{${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}} : ${extract{2}{::}{${lookup{$host}lsearch*{CONFDIR/passwd.client}{$value}fail}}}"
+  # Return empty string if looking up $host in passwd-file yields a
+  # non-empty string; fail otherwise.
+  client_send = "${if !eq\
+                          {${lookup\
+                            {$host}nwildlsearch{CONFDIR/passwd.client}\
+                            {$value}fail}}\
+                          {}\
+                      {}fail}\
+                 : ${extract{1}{::}\
+                        {${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}} \
+                 : ${extract{2}{::}\
+                        {${lookup{$host}nwildlsearch{CONFDIR/passwd.client}{$value}fail}}}"
 .endif
diff --git a/conf.d/main/01_exim4-config_listmacrosdefs b/conf.d/main/01_exim4-config_listmacrosdefs
index 673792b..0f9f637 100644
--- a/conf.d/main/01_exim4-config_listmacrosdefs
+++ b/conf.d/main/01_exim4-config_listmacrosdefs
@@ -4,10 +4,13 @@
 ######################################################################
 
 ######################################################################
-# Depending on where you find this file, this might be a template or
-# an actual configuration file. Documentation about the Debian exim4
-# configuration scheme can be found in
-# /usr/share/doc/exim4-base/README.Debian.gz.
+# /etc/exim4/exim4.conf.template is only used with the non-split
+#   configuration scheme.
+# /etc/exim4/conf.d/main/01_exim4-config_listmacrosdefs is only used
+#   with the split configuration scheme.
+# If you find this comment anywhere else, somebody copied it there.
+# Documentation about the Debian exim4 configuration scheme can be
+# found in /usr/share/doc/exim4-base/README.Debian.gz.
 #
 # Strings like DEBCONFsomethingDEBCONF are replaced by installation
 # dependent values by update-exim4.conf, the script which builds the
@@ -44,20 +47,27 @@ DC_visiblename=DEBCONFvisiblenameDEBCONF
 # Create domain and host lists for relay control
 # '@' refers to 'the name of the local host'
 
+# List of domains considered local for exim. Domains not listed here
+# need to be deliverable remotely.
 .ifndef MAIN_LOCAL_DOMAINS
 MAIN_LOCAL_DOMAINS = DEBCONFlocal_domainsDEBCONF
 .endif
 domainlist local_domains = MAIN_LOCAL_DOMAINS
 
+# List of recipient domains to relay _to_. Use this list if you're -
+# for example - fallback MX or mail gateway for domains.
 .ifndef MAIN_RELAY_TO_DOMAINS
 MAIN_RELAY_TO_DOMAINS = DEBCONFrelay_domainsDEBCONF
 .endif
 domainlist relay_to_domains = MAIN_RELAY_TO_DOMAINS
 
+# List of sender networks (IP addresses) to _unconditionally_ relay
+# _for_. If you intend to be SMTP AUTH server, you do not need to enter
+# anything here.
 .ifndef MAIN_RELAY_NETS
 MAIN_RELAY_NETS = DEBCONFrelay_netsDEBCONF
 .endif
-hostlist relay_from_hosts = 127.0.0.1 : ::::1 : MAIN_RELAY_NETS
+hostlist relay_from_hosts = MAIN_RELAY_NETS
 
 
 # Specify the domain you want to be added to all unqualified addresses
@@ -114,23 +124,25 @@ DCconfig_DEBCONFconfigtypeDEBCONF = 1
 
 
 # define macros to be used in acl/30_exim4-config_check_rcpt to check
-# recipient local parts for strange characters
+# recipient local parts for strange characters.
+
+# This macro definition really should be in
+# acl/30_exim4-config_check_rcpt but cannot be there due to
+# http://www.exim.org/bugzilla/show_bug.cgi?id=101 as of exim 4.62.
+
+# These macros are documented in acl/30_exim4-config_check_rcpt,
+# can be changed here or overridden by a locally added configuration
+# file as described in README.Debian chapter 2.1.2
 
-# This macro is used to check local parts of recipients in local
-# domains.  It blocks local parts that begin with a dot or contain a
-# quite broad range of non-alphanumeric characters.
 .ifndef CHECK_RCPT_LOCAL_LOCALPARTS
-CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|\'`#&?]
+CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@%!/|`#&?]
 .endif
 
-# This macro is used to check local parts of recipients in non-local
-# domains. It thus allows your own users to send outgoing messages to
-# sites that use slashes and vertical bars in their local parts. It blocks
-# local parts that begin with a dot, slash, or vertical bar, but allows
-# these characters within the local part. However, the sequence /../ is
-# barred. The use of some other non-alphanumeric characters is blocked.
-# The motivation here is to prevent your users (or your users' viruses)
-# from mounting certain kinds of attack on remote sites.
 .ifndef CHECK_RCPT_REMOTE_LOCALPARTS
-CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!\'`#&?] : ^.*/\\.\\./
+CHECK_RCPT_REMOTE_LOCALPARTS = ^[./|] : ^.*[@%!`#&?] : ^.*/\\.\\./
+.endif
+
+# always log tls_peerdn as we use TLS for outgoing connects by default
+.ifndef MAIN_LOG_SELECTOR
+MAIN_LOG_SELECTOR = +tls_peerdn
 .endif
diff --git a/conf.d/main/02_exim4-config_options b/conf.d/main/02_exim4-config_options
index 3bccacc..e28e3e6 100644
--- a/conf.d/main/02_exim4-config_options
+++ b/conf.d/main/02_exim4-config_options
@@ -3,6 +3,15 @@
 #################################
 
 
+# Defines the access control list that is run when an
+# SMTP MAIL command is received.
+#
+.ifndef MAIN_ACL_CHECK_MAIL
+MAIN_ACL_CHECK_MAIL = acl_check_mail
+.endif
+acl_smtp_mail = MAIN_ACL_CHECK_MAIL
+
+
 # Defines the access control list that is run when an
 # SMTP RCPT command is received.
 #
@@ -28,6 +37,25 @@ message_size_limit = MESSAGE_SIZE_LIMIT
 .endif
 
 
+# If you are running exim4-daemon-heavy or a custom version of Exim that
+# was compiled with the content-scanning extension, you can cause incoming
+# messages to be automatically scanned for viruses. You have to modify the
+# configuration in two places to set this up. The first of them is here,
+# where you define the interface to your scanner. This example is typical
+# for ClamAV; see the manual for details of what to set for other virus
+# scanners. The second modification is in the acl_check_data access
+# control list.
+
+# av_scanner = clamd:/tmp/clamd
+
+
+# For spam scanning, there is a similar option that defines the interface to
+# SpamAssassin. You do not need to set this if you are using the default, which
+# is shown in this commented example. As for virus scanning, you must also
+# modify the acl_check_data access control list to enable spam scanning.
+
+# spamd_address = 127.0.0.1 783
+
 # Domain used to qualify unqualified recipient addresses
 # If this option is not set, the qualify_domain value is used.
 # qualify_recipient = <value of qualify_domain>
@@ -59,19 +87,18 @@ host_lookup = MAIN_HOST_LOOKUP
 # dumps it here to avoid DNS lookups being done at Exim run time.
 DEBCONF_hardcode_primary_hostname_DEBCONF
 
-
-# Do RFC 1413 (ident) callbacks for incoming SMTP calls. The default
-# is to do lookups for all hosts with a timeout of 30 seconds.
-# The options can be used to limit the hosts to which these calls are
-# made, and/or change the timeout that is used. If the timeout is zero,
-# no RFC 1413 calls are made. RFC 1413 calls are cheap and can provide
-# useful information for tracing problem messages, but some hosts and
-# firewalls are misconfigured to drop the requests instead of either
-# answering or rejecting them. This can result in timeouts, leading to
-# delays on starting up an SMTP session and to strange behavior in
-# settings where SMTP callouts are used.
+# The settings below, which are actually the same as the defaults in the
+# code, cause Exim to make RFC 1413 (ident) callbacks for all incoming SMTP
+# calls. You can limit the hosts to which these calls are made, and/or change
+# the timeout that is used. If you set the timeout to zero, all RFC 1413 calls
+# are disabled. RFC 1413 calls are cheap and can provide useful information
+# for tracing problem messages, but some hosts and firewalls are
+# misconfigured to drop the requests instead of either answering or
+# rejecting them. This can result in a timeout instead of an immediate refused
+# connection, leading to delays on starting up SMTP sessions. (The default was
+# reduced from 30s to 5s for release 4.61.)
 # rfc1413_hosts = *
-# rfc1413_query_timeout = 30s
+# rfc1413_query_timeout = 5s
 
 
 # By default, exim forces a Sender: header containing the local
@@ -152,14 +179,6 @@ trusted_groups = MAIN_TRUSTED_GROUPS
 # admin_groups = <unset>
 
 
-# customize logging. See spec.txt 48.15.
-# If you want to debug, it is probably a good idea to set this to
-# "+all -subject -arguments".
-# If you use TLS, it might be a good idea to set "+tls_cipher
-# +tls_peerdn".
-# log_selector = <unset>
-
-
 # SMTP Banner. The example includes the Debian version in the SMTP dialog
 # MAIN_SMTP_BANNER = "${primary_hostname} ESMTP Exim ${version_number} (Debian package DEBCONFpackageversionDEBCONF) ${tod_full}"
 # smtp_banner = $smtp_active_hostname ESMTP Exim $version_number $tod_full
diff --git a/conf.d/main/03_exim4-config_tlsoptions b/conf.d/main/03_exim4-config_tlsoptions
index d942dac..9b85499 100644
--- a/conf.d/main/03_exim4-config_tlsoptions
+++ b/conf.d/main/03_exim4-config_tlsoptions
@@ -18,6 +18,17 @@ tls_advertise_hosts = MAIN_TLS_ADVERTISE_HOSTS
 # Full paths to Certificate and Private Key. The Private Key file
 # must be kept 'secret' and should be owned by root.Debian-exim mode
 # 640 (-rw-r-----). exim-gencert takes care of these prerequisites.
+# Normally, exim4 looks for certificate and key in different files:
+#   MAIN_TLS_CERTIFICATE - path to certificate file,
+#                          CONFDIR/exim.crt if unset
+#   MAIN_TLS_PRIVATEKEY  - path to private key file
+#                          CONFDIR/exim.key if unset
+# You can also configure exim to look for certificate and key in the
+# same file, set MAIN_TLS_CERTKEY to that file to enable. This takes
+# precedence over all other settings regarding certificate and key file.
+.ifdef MAIN_TLS_CERTKEY
+tls_certificate = MAIN_TLS_CERTKEY
+.else
 .ifndef MAIN_TLS_CERTIFICATE
 MAIN_TLS_CERTIFICATE = CONFDIR/exim.crt
 .endif
@@ -27,11 +38,13 @@ tls_certificate = MAIN_TLS_CERTIFICATE
 MAIN_TLS_PRIVATEKEY = CONFDIR/exim.key
 .endif
 tls_privatekey = MAIN_TLS_PRIVATEKEY
+.endif
 
-
-# Pointer to the CA Certificates against which host certificates are
+# Pointer to the CA Certificates against which client certificates are
 # checked. This is controlled by the `tls_verify_hosts' and
 # `tls_try_verify_hosts' lists below.
+# If you want to check server certificates, you need to add an
+# tls_verify_certificates statement to the smtp transport.
 # /etc/ssl/certs/ca-certificates.crt is generated by
 # the "ca-certificates" package's update-ca-certificates(8) command.
 .ifndef MAIN_TLS_VERIFY_CERTIFICATES
diff --git a/conf.d/retry/30_exim4-config b/conf.d/retry/30_exim4-config
index 3f12f9f..87a6d5d 100644
--- a/conf.d/retry/30_exim4-config
+++ b/conf.d/retry/30_exim4-config
@@ -1,4 +1,7 @@
 
+### retry/30_exim4-config
+#################################
+
 # This single retry rule applies to all domains and all errors. It specifies
 # retries every 15 minutes for 2 hours, then increasing retry intervals,
 # starting at 1 hour and increasing each time by a factor of 1.5, up to 16
@@ -9,10 +12,8 @@
 # effective retry-time depends on the frequenzy of queue-running, too.
 # See QUEUEINTERVAL in /etc/default/exim4.
 
-# Domain               Error       Retries
-# ------               -----       -------
+# Address or Domain    Error       Retries
+# -----------------    -----       -------
 
 *                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h
 
-
-
diff --git a/conf.d/rewrite/31_exim4-config_rewriting b/conf.d/rewrite/31_exim4-config_rewriting
index ddecd06..25a2209 100644
--- a/conf.d/rewrite/31_exim4-config_rewriting
+++ b/conf.d/rewrite/31_exim4-config_rewriting
@@ -5,8 +5,8 @@
 # This rewriting rule is particularily useful for dialup users who
 # don't have their own domain, but could be useful for anyone.
 # It looks up the real address of all local users in a file
-*@+local_domains ${lookup{${local_part}}lsearch{/etc/email-addresses}\
-                   {$value}fail} Ffrs
+*@+local_domains "${lookup{${local_part}}lsearch{/etc/email-addresses}\
+                   {$value}fail}" Ffrs
 # identical rewriting rule for /etc/mailname
 DEBCONFrewriteemailaddresses_mailnameDEBCONF
 
diff --git a/conf.d/router/150_exim4-config_hubbed_hosts b/conf.d/router/150_exim4-config_hubbed_hosts
dissimilarity index 62%
index 1ae72b6..a0fcb26 100644
--- a/conf.d/router/150_exim4-config_hubbed_hosts
+++ b/conf.d/router/150_exim4-config_hubbed_hosts
@@ -1,31 +1,18 @@
-
-# router/150_exim4-config_hubbed_hosts
-#################################
-
-# route specific domains manually.
-#
-# The most common application of this router is to handle relaying to nonlocal
-# domains that the local host is primary MX for. That means that local
-# information needs to be present for a domain to be handled correctly.
-#
-# That information is put into the optional file /etc/exim4/hubbed_hosts
-# which contains key-value pairs of domain pattern and route data.
-#
-# foo.example: internal.mail.example.com
-# bar.example: 192.168.183.3
-#
-# will cause mail for foo.example to be sent to the host
-# internal.mail.example (IP address derived from A record only), and
-# mail to bar.example to be sent to 192.168.183.3.
-#
-# If the file /etc/exim4/hubbed_hosts does not exist, this router is a
-# no-op.
-
-hubbed_hosts:
-  debug_print = "R: hubbed_hosts for $domain"
-  driver = manualroute
-  domains = "${if exists{CONFDIR/hubbed_hosts}\
-                   {partial-lsearch;CONFDIR/hubbed_hosts}\
-              fail}"
-  route_data = ${lookup{$domain}partial-lsearch{CONFDIR/hubbed_hosts}}
-  transport = remote_smtp
+
+# router/150_exim4-config_hubbed_hosts
+#################################
+
+# route specific domains manually.
+#
+# see exim4-config_files(5) and spec.txt chapter 20.3 through 20.7 for
+# more detailed documentation.
+
+hubbed_hosts:
+  debug_print = "R: hubbed_hosts for $domain"
+  driver = manualroute
+  domains = "${if exists{CONFDIR/hubbed_hosts}\
+                   {partial-lsearch;CONFDIR/hubbed_hosts}\
+              fail}"
+  same_domain_copy_routing = yes
+  route_data = ${lookup{$domain}partial-lsearch{CONFDIR/hubbed_hosts}}
+  transport = remote_smtp
diff --git a/conf.d/router/200_exim4-config_primary b/conf.d/router/200_exim4-config_primary
index 3f9721e..8b2bafb 100644
--- a/conf.d/router/200_exim4-config_primary
+++ b/conf.d/router/200_exim4-config_primary
@@ -34,7 +34,8 @@ dnslookup:
   same_domain_copy_routing = yes
   # ignore private rfc1918 and APIPA addresses
   ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 : 192.168.0.0/16 :\
-                        172.16.0.0/12 : 10.0.0.0/8 : 169.254.0.0/16
+                        172.16.0.0/12 : 10.0.0.0/8 : 169.254.0.0/16 :\
+			255.255.255.255
   no_more
 
 .endif
diff --git a/conf.d/router/300_exim4-config_real_local b/conf.d/router/300_exim4-config_real_local
index b1c4a9d..5c5404b 100644
--- a/conf.d/router/300_exim4-config_real_local
+++ b/conf.d/router/300_exim4-config_real_local
@@ -1,5 +1,5 @@
 
-### router/400_exim4-config_system_aliases
+### router/300_exim4-config_real_local
 #################################
 
 # This router allows reaching a local user while avoiding local
diff --git a/conf.d/router/400_exim4-config_system_aliases b/conf.d/router/400_exim4-config_system_aliases
index e4ea7a8..f5f5f1c 100644
--- a/conf.d/router/400_exim4-config_system_aliases
+++ b/conf.d/router/400_exim4-config_system_aliases
@@ -14,14 +14,11 @@
 # of case. If you decide to handle /etc/aliases in a caseful way, you
 # need to make arrangements for a caseless postmaster.
 #
-# Piping to programs in /etc/aliases is disabled per default.
+# Delivery to arbitrary directories, files, and piping to programs in
+# /etc/aliases is disabled per default.
 # If that is a problem for you, see
-#   /usr/share/doc/exim4-config/README.system_aliases
+#   /usr/share/doc/exim4-base/README.Debian.gz
 # for explanation and some workarounds.
-#
-# Note that the transports listed below are the same as are used for
-# .forward files; you might want to set up different ones for pipe and
-# file deliveries from aliases.
 
 system_aliases:
   debug_print = "R: system_aliases for $local_part@$domain"
diff --git a/conf.d/router/600_exim4-config_userforward b/conf.d/router/600_exim4-config_userforward
index 2b71cc0..59259ca 100644
--- a/conf.d/router/600_exim4-config_userforward
+++ b/conf.d/router/600_exim4-config_userforward
@@ -1,9 +1,10 @@
 
-# router/600_exim4-config_userforward
+### router/600_exim4-config_userforward
 #################################
 
 # This router handles forwarding using traditional .forward files in users'
-# home directories and filtering with exim's builtin filter language. 
+# home directories. It also allows mail filtering with a forward file
+# starting with the string "# Exim filter" or "# Sieve filter".
 #
 # The no_verify setting means that this router is skipped when Exim is
 # verifying addresses. Similarly, no_expn means that this router is skipped if
@@ -24,10 +25,12 @@ userforward:
   domains = +local_domains
   check_local_user
   file = $home/.forward
+  require_files = $local_part:$home/.forward
   no_verify
   no_expn
   check_ancestor
   allow_filter
+  forbid_smtp_code = true
   directory_transport = address_directory
   file_transport = address_file
   pipe_transport = address_pipe
diff --git a/conf.d/router/900_exim4-config_local_user b/conf.d/router/900_exim4-config_local_user
index 52e1897..423c729 100644
--- a/conf.d/router/900_exim4-config_local_user
+++ b/conf.d/router/900_exim4-config_local_user
@@ -2,6 +2,9 @@
 ### router/900_exim4-config_local_user
 #################################
 
+# This router matches local user mailboxes. If the router fails, the error
+# message is "Unknown user".
+
 local_user:
   debug_print = "R: local_user for $local_part@$domain"
   driver = accept
@@ -9,6 +12,4 @@ local_user:
   check_local_user
   local_parts = ! root
   transport = LOCAL_DELIVERY
-
-
-
+  cannot_route_message = Unknown user
diff --git a/conf.d/transport/30_exim4-config_address_pipe b/conf.d/transport/30_exim4-config_address_pipe
index cb01c37..c5f1828 100644
--- a/conf.d/transport/30_exim4-config_address_pipe
+++ b/conf.d/transport/30_exim4-config_address_pipe
@@ -1,10 +1,8 @@
 
-# This transport is used for handling pipe deliveries generated by alias or
+# This transport is used for handling pipe deliveries generated by
 # .forward files. If the commands fails and produces any output on standard
 # output or standard error streams, the output is returned to the sender
 # of the message as a delivery error.
-# You can set different transports for aliases and forwards if you want to
-# - see the references to address_pipe in the routers section above.
 address_pipe:
   debug_print = "T: address_pipe for $local_part@$domain"
   driver = pipe
diff --git a/conf.d/transport/30_exim4-config_maildir_home b/conf.d/transport/30_exim4-config_maildir_home
index b8b56c8..a872acc 100644
--- a/conf.d/transport/30_exim4-config_maildir_home
+++ b/conf.d/transport/30_exim4-config_maildir_home
@@ -34,4 +34,8 @@ maildir_home:
   mode = 0600
   .endif
   mode_fail_narrower = false
-
+  # This transport always chdirs to $home before trying to deliver. If
+  # $home is not accessible, this chdir fails and prevents delivery.
+  # If you are in a setup where home directories might not be
+  # accessible, uncomment the current_directory line below.
+  # current_directory = /
diff --git a/conf.d/transport/30_exim4-config_remote_smtp b/conf.d/transport/30_exim4-config_remote_smtp
index fd8838b..14ecbed 100644
--- a/conf.d/transport/30_exim4-config_remote_smtp
+++ b/conf.d/transport/30_exim4-config_remote_smtp
@@ -5,3 +5,5 @@
 remote_smtp:
   debug_print = "T: remote_smtp for $local_part@$domain"
   driver = smtp
+  # to disable TLS on outgoing connections, uncomment this
+  # hosts_avoid_tls = *
diff --git a/conf.d/transport/30_exim4-config_remote_smtp_smarthost b/conf.d/transport/30_exim4-config_remote_smtp_smarthost
index d7e1273..0dcb19a 100644
--- a/conf.d/transport/30_exim4-config_remote_smtp_smarthost
+++ b/conf.d/transport/30_exim4-config_remote_smtp_smarthost
@@ -10,7 +10,12 @@
 remote_smtp_smarthost:
   debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
   driver = smtp
-  hosts_try_auth = ${if exists {CONFDIR/passwd.client}{DCsmarthost}{}}
+  hosts_try_auth = ${if exists {CONFDIR/passwd.client}\
+                               {${extract{1}{:}{DCsmarthost}}}\
+			       {}\
+		    }
   tls_tempfail_tryclear = false
+  # to disable TLS on outgoing connections, uncomment this
+  # hosts_avoid_tls = *
   DEBCONFheaders_rewriteDEBCONF
   DEBCONFreturn_pathDEBCONF
diff --git a/conf.d/transport/35_exim4-config_address_directory b/conf.d/transport/35_exim4-config_address_directory
index 94541a4..6861426 100644
--- a/conf.d/transport/35_exim4-config_address_directory
+++ b/conf.d/transport/35_exim4-config_address_directory
@@ -5,8 +5,9 @@
 address_directory:
   debug_print = "T: address_directory for $local_part@$domain"
   driver = appendfile
-  envelope_to_add = true
-  return_path_add = true
+  delivery_date_add
+  envelope_to_add
+  return_path_add
   check_string = ""
   escape_string = ""
   maildir_format
diff --git a/update-exim4.conf.conf b/update-exim4.conf.conf
index d54673e..96c6c09 100644
--- a/update-exim4.conf.conf
+++ b/update-exim4.conf.conf
@@ -28,3 +28,4 @@ CFILEMODE='644'
 dc_use_split_config='false'
 dc_hide_mailname=''
 dc_mailname_in_oh='true'
+dc_localdelivery='maildir_home'