Custom Exim ACL: The Ultimate Comprehensive Guide for Mastering

Exim access control lists (ACLs) decide, at each stage of an SMTP conversation, whether your mail server accepts, rejects or delays a message. This guide explains how ACLs work, where to put custom rules on a plain server, cPanel & WHM and DirectAdmin, and gives tested patterns for common jobs. It is for administrators of their own VPS or dedicated server: on shared hosting you can't change the mail server's configuration.

1. How Exim ACLs work

Exim runs a named ACL at each stage of an incoming SMTP session. The main options that attach them are:

Inside an ACL, each statement starts with a verb:

• accept: stop and accept if all conditions match.
• deny: stop and reject permanently (5xx) if all conditions match.
• defer: stop and reject temporarily (4xx), so the sender retries.
• require: if any condition fails, reject; otherwise continue.
• warn: take no decision; used to log or add a header.
• drop and discard: close the connection, or accept and silently throw the message away. Use discard with great care.

Conditions under a verb are ANDed together. An ACL that reaches its end without a match denies by default, so most ACLs finish with an explicit accept or deny.

2. Where custom rules go

Whichever you use, back up first:

cp -a /etc/exim.conf /root/exim.conf.$(date +%F)

3. Test before you restart

4. Common rules

The snippets below go into the RCPT ACL (or the matching custom block) above the final accept statements that allow local delivery and authenticated relaying. Adjust names and addresses to your own.

Block a sender domain:

deny    message = Mail from $sender_address_domain is not accepted
        senders = *@spamdomain.example : *@*.spamdomain.example

Reject clients whose reverse DNS doesn't check out (strict; some legitimate servers fail this, so start with warn and watch the log):

deny    message = Reverse DNS check failed for $sender_host_address
        !authenticated = *
        !verify = reverse_host_lookup

Use a DNS blocklist:

deny    message = $sender_host_address is listed at $dnslist_domain
        !authenticated = *
        dnslists = bl.spamcop.net

Some blocklists, including Spamhaus, refuse queries sent through large public resolvers and need a local resolver or a registered key. Read each list's usage terms before you rely on it.

Rate-limit authenticated senders (limits a compromised mailbox):

deny    message = Sending rate exceeded, try again later
        authenticated = *
        ratelimit = 300 / 1h / per_rcpt / $authenticated_id

Let a trusted network through (place above the checks it should bypass):

accept  hosts = 198.51.100.0/24

5. Content and attachment rules

Content checks belong in later stages. In the MIME ACL, block risky attachment types:

acl_check_mime:
  deny    message = Blocked attachment type: $mime_filename
          condition = ${if match{${lc:$mime_filename}}{\N\.(exe|scr|bat|com|js|vbs)$\N}}
  accept

In the DATA ACL, you can add a spam score header when SpamAssassin (spamd) is running:

warn    spam = nobody:true
        add_header = X-Spam-Score: $spam_score

Set the maximum message size with the main option message_size_limit, not an ACL. Exim can scan only as much of the body as message_body_visible allows, so body-keyword rules are unreliable; a spam filter does this job better.

6. SPF, DKIM and DMARC

These checks need an Exim built with the matching support (exim -bV lists it). The syntax differs from ordinary conditions:

• SPF uses the spf condition in the RCPT ACL, for example deny spf = fail with a message.
• DKIM results are checked in acl_smtp_dkim using dkim_status.
• DMARC needs the DMARC library and uses dmarc_status in the DATA ACL.

Old examples such as verify{spf} do not exist in Exim and will fail the config check. cPanel and DirectAdmin include their own SPF and DKIM handling, so use the panel's settings there rather than hand-written rules.

7. Troubleshooting

• Config check fails: exim -bV names the line. Restore your backup if you can't fix it quickly.
• Legitimate mail rejected: search the main and reject logs (/var/log/exim_mainlog and /var/log/exim_rejectlog on cPanel; /var/log/exim/mainlog and rejectlog on DirectAdmin) for the sender, then use exim -bh with the sender's IP to see which statement matched.
• A rule never fires: an earlier accept matched first. Move the rule above it.
• Everything is deferred: a DNS lookup or blocklist is timing out. Check the server's resolver.

For log searching, see Mastering mail log analysis.

8. Running this on Domain India

A Domain India VPS is self-managed with full root access, so you install and configure your own mail server and rules. VPS plans don't include cPanel; the VPS page lists the operating systems and panels offered. Prices on the card are live and exclude 18% GST.

If you'd rather not run a mail server at all, Business Email gives you managed mailboxes with DKIM signing, and works with any website host.

Ready to set up your own mail server? Compare VPS plans, or look at Business Email if you'd rather have mailboxes managed for you. For a problem with mail on shared hosting, open a support ticket.