The following is the GNU All-permissive License as recommended in https://www.gnu.org/licenses/license-recommendations.en.html

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.

Contributions are welcome. See https://savannah.gnu.org/maintenance/fsf/.

Blocking email in exim

Deploying

If the exim config has a syntax error, systemctl reload exim4 will fail with no harm because it will fail on generating the config. Fencepost is the only old exim that uses /etc/exim4/exim4.conf.

However, acls can have errors within them that prevent exim from processing messages. Tail the mainlog and look for errors. Check the paniclog. Ian knows how to test acls, he can help.

Block list files

Mailman blocklist is at roles/exim/files/mx/simple/etc/exim4/mailman-blocklist see the comments.

Sender domain blocks are documented at https://brains.fsf.org/wiki/sysadmin/kb/blocked_email_domains_instructions/

Sender full address blocks are in ansible at roles/exim/files/mx/simple/etc/exim4/bad-senders.

The full address and domain blocks are matched against the "rcpt from" address, and the From: header. No globbing or pattern matching will work except the "*." prefix for domain blocks, as described in the instructions for that file. To do pattern matching, you need to add a custom acl statement.

Custom acl statements

Based on sender address

Blocking on sender envelope should be done in roles/exim/files/mx/econf/rcpt_local_acl. Blocking on headers must be done in roles/exim/files/mx/econf/data_local_acl. See those files for examples.

A thorough block will block on "rcpt from" aka "envelope from" and the From: header. If both would work and its just a spammer, its not important to block both. Lean toward an rcpt block if you are just doing one. Note, our exim puts the the envelope/rcpt from address into the Return-path: header.

deny vs discard

Use reject unless

Reject is causing the sender to retry and ddos us. Otherwise, reject takes less resources, especially in the rcpt acl.
You suspect the sender to be crafty or targeting us, and there is no chance of a false positive. Reject lets the sender know their message didn't go through

logging

reject
  message = fsfrule 28
  ...

Only works with reject. Aim to use this first. This message will be part of the smtp error code the sender can see and logged in the exim log. It shouldn't tell the sender exactly whats wrong, but can include asking them to email sysadmin@fsf.org for more details, and perhaps telling them its their address or domain, so they can figure out how to get a mail through to that.

discard
  log_message = fsfrule 29
  ...

Use log_mesage whenever message = is not appropriate.

some tags for searchability: spam blacklist deny discard