mail-address-semantics/integrations/exim/NOTES.md

Exim notes (MAS-WP-0004 T03)

No Exim profile is shipped, because there is no demand yet. These notes say what one would need. The ACL finding was checked against the stock config of Debian bookworm exim4-daemon-light (Exim 4.96, 2026-10-19). The router and transport points come from the Exim documentation and are untested.

Pitfalls

• Stock ACL rejects every P2 address. acl_check_rcpt denies local domains' local-parts that match CHECK_RCPT_LOCAL_LOCALPARTS, which defaults to ^[.] : ^.*[@%!/|#&?]. So ticket!callback@Dandticket=PR%2B42@Dget550 restricted characters in address. This is the same failure class as Postfix's reject_unauth_destination. Upstream Exim's example configure has the same rule (^[.] : ^.*[@%!/|]`).
• Percent hack is off by default (percent_hack_domains unset), so % is not rewritten once the ACL lets it through. Exim has no bang-path rewriting.
• Case. Routers lower-case $local_part unless caseful_local_part = true, which would hide Ticket=PR42 (invalid in MAS) as ticket=PR42.
• Suffixes. A router with local_part_suffix = +* strips facets before the transport sees them. Do not set it on the MAS router.

Settings a profile would need

# main section: drop % and ! from the local-domain restriction
CHECK_RCPT_LOCAL_LOCALPARTS = ^[.] : ^.*[@/|`#&?]

# router, first for the MAS domain
mas:
  driver = accept
  domains = D
  caseful_local_part = true
  transport = mas_pipe

# transport: one recipient per call, envelope recipient as received
mas_pipe:
  driver = pipe
  batch_max = 1
  user = mas
  command = /usr/local/bin/mas-gateway --statute <statute> \
    --trusted-authserv-id D pipe --app-url <url> \
    --recipient ${quote:$local_part}@$domain

Keep CHECK_RCPT_REMOTE_LOCALPARTS as it is: relaying stays closed, and only D is a local domain. Sender authentication would use Exim's built-in dkim/spf/dmarc ACL conditions with add_header = Authentication-Results: D; .... Incoming A-R headers for D must be removed first (headers_remove).