# Exim notes (MAS-WP-0004 T03)

No Exim profile is shipped, because there is no demand yet. These notes say
what one would need. The ACL finding was checked against the stock config
of Debian bookworm `exim4-daemon-light` (Exim 4.96, 2026-10-19). The router
and transport points come from the Exim documentation and are untested.

## Pitfalls

- **Stock ACL rejects every P2 address.** `acl_check_rcpt` denies local
  domains' local-parts that match `CHECK_RCPT_LOCAL_LOCALPARTS`, which
  defaults to `^[.] : ^.*[@%!/|`#&?]`. So `ticket!callback@D` and
  `ticket=PR%2B42@D` get `550 restricted characters in address`. This is the
  same failure class as Postfix's `reject_unauth_destination`. Upstream
  Exim's example `configure` has the same rule (`^[.] : ^.*[@%!/|]`).
- **Percent hack** is off by default (`percent_hack_domains` unset), so `%`
  is not rewritten once the ACL lets it through. Exim has no bang-path
  rewriting.
- **Case.** Routers lower-case `$local_part` unless `caseful_local_part =
  true`, which would hide `Ticket=PR42` (invalid in MAS) as `ticket=PR42`.
- **Suffixes.** A router with `local_part_suffix = +*` strips facets before
  the transport sees them. Do not set it on the MAS router.

## Settings a profile would need

```
# main section: drop % and ! from the local-domain restriction
CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@/|`#&?]

# router, first for the MAS domain
mas:
  driver = accept
  domains = D
  caseful_local_part = true
  transport = mas_pipe

# transport: one recipient per call, envelope recipient as received
mas_pipe:
  driver = pipe
  batch_max = 1
  user = mas
  command = /usr/local/bin/mas-gateway --statute <statute> \
    --trusted-authserv-id D pipe --app-url <url> \
    --recipient ${quote:$local_part}@$domain
```

Keep `CHECK_RCPT_REMOTE_LOCALPARTS` as it is: relaying stays closed, and only
D is a local domain. Sender authentication would use Exim's built-in
`dkim`/`spf`/`dmarc` ACL conditions with `add_header =
Authentication-Results: D; ...`. Incoming A-R headers for D must be removed
first (`headers_remove`).