====== Exim ======

  * Manual: [[http://www.exim.org/docs.html]]
  * Testing Exim: [[https://github.com/Exim/exim/wiki/TestingExim]]
  * Exim cheatsheet: [[http://bradthemad.org/tech/notes/exim_cheatsheet.php]]
  * Exim cheatsheet2: [[https://knowledge-base1.readthedocs.io/en/latest/exim.html]]
  * Exim cheatsheet3: [[http://www.datadisk.co.uk/html_docs/exim/exim_cs.htm]]
  * Exim cheatsheet4: [[https://www.first2host.co.uk/exim-cheat-sheet-manage-exim/]]
  * Exim cheatsheet5: [[https://nixcp.com/exim-cheatsheet/]]

**About logs:**
  * https://www.exim.org/exim-html-current/doc/html/spec_html/ch-log_files.html
  * https://www.liquidweb.com/kb/how-to-read-an-exim-maillog/

===== Configuration =====

Exim check run time configuration:
<code bash>
# exim -bV
</code>

Exim check configuration values:
<code bash>
# exim -bP
</code>
OR
<code bash>
# grep -r 'PARAM' /etc/exim*
</code>

===== Log analysis =====

Search spammer by subject:
<code bash>
grep -o 'T=.*>' /var/log/exim/mainlog | sort | uniq -c | sort -n
</code>

Search who spam to hotmail, outlook, live.com:
<code bash>
#DirectAdmin
egrep 'hotmail|outlook|live.com' /var/log/exim/mainlog | grep 'Queued mail for delivery' | grep -o 'F=<[^>]*' | sort | uniq -c | sort -n
#cpanel / whm
egrep 'hotmail|outlook|live.com' /var/log/exim_mainlog | grep 'Queued mail for deliver' | grep -o '=>.* R'
</code>


Search who mostly send to remote servers:
<code bash>
grep 'T=remote_smtp' /var/log/exim/mainlog | grep -o 'F=<.*>' | sort | uniq -c | sort -n
</code>
===== Usefull commands =====

Remove messages from queue by domain:
<code bash>
# exim -bp | awk /domain/{'print $3'} | xargs exim -Mrm
</code>

Remove all messages from queue:
<code bash>
# exim -bp | exiqgrep -i | xargs exim -Mrm
</code>

===== Debug exim =====

<code bash>
service exim stop; /usr/sbin/exim -bd -d+all
</code>

<code bash>
exim -be 'string'
</code>
===== Exim LOG summ =====

<code bash>
eximstats /var/log/exim/mainlog | less
</code>

===== Testing mail send with swaks =====

Install swaks (yum, apt, sources, etc...)

<code bash>
swaks --to receiver@remotedomain.tld \
   --from=test@domain.tld \
   --auth \
   --auth-user=test@domain.tld \
   --auth-password=no-way:P \
   --server mail.domain.tld
</code>

===== Email sub-addressing (plus-signs as in Gmail) =====

To router definition add:
<code>
local_part_suffix = +* : -* : _*
local_part_suffix_optional
</code>

More info: https://wiki.debian.org/Exim#Email_Sub-addressing_.28plus_signs_like_Gmail.29