exim - не все так просто

[.scu]

вообщем какая-то беда с экзимом - многие жалуются, что не все письма доходят, которые они отправляют. При этом не приходит каких-либо ошибок и нельзя быть точно уверенным - дошло ли письмо.
настройки вроде бы все стандартные - связка экзим + виртуал экзим.

Очень прошу помочь разобраться
(конфиги во вложении)

Заранее благодарна за помощь

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[dikens3]

вообщем какая-то беда с экзимом - многие жалуются, что не все письма доходят, которые они отправляют. При этом не приходит каких-либо ошибок и нельзя быть точно уверенным - дошло ли письмо.

В логах что?

Exim всегда фиксирует доставку письма удалённому серверу, к примеру:

2008-06-07 16:19:44 [41764] 1K4xOS-000Arb-Lk => kuzXXX@nbdbank.ru F=<fin_XXX@mydomain.ru> P=<fin_XXX@mydomain.ru> R=dnslookup T=remote_smtp S=518 H=post.kis.ru [195.98.32.206] X=TLSv1:DES-CBC3-SHA:168 CV=no DN="/C=RU/ST=Russia/L=N.Novgorod/O=Commercial Information Networks/OU=Mail/CN=post.kis.ru/emailAddress=postmaster@kis.ru" C="250 800467953 message accepted for delivery" QT=8s DT=8s

В данном примере письмо успешно было доставлено на сервер с использованием шифрования. В очереди письмо находилось 8 секунд. И кстати, обрати внимание на код 800467953, по нему можно выяснить у получателя (перепиской или по телефону) что случилось с твоим письмом. Основная проблема, что телефонов у тебя нет, а на E-Mail никто не отвечает.

[.scu]

в логах сейчас посмотрю пример

Основная проблема, что телефонов у тебя нет, а на E-Mail никто не отвечает.

- это честно говоря не поняла к чему.

[dikens3]

Основная проблема, что телефонов у тебя нет, а на E-Mail никто не отвечает.

- это честно говоря не поняла к чему.

Когда к тебе приходит пользователь и говорит, что он отправил некое письмо на адрес user@domain.ru ты лезешь в логи (или очередь) и смотришь что в них:

1. Письмо ещё находится в очереди.
Ты выясняешь причину задержки и сообщаешь пользователю подробности и причины.

2. Письмо было доставлено на удалённый сервер.
Сообщаешь пользователю, что мол у нас всё в порядке, проблема в удалённой стороне. Но, иногда пользователи имеют свойство(и право) недоверять и тебе придётся связаться с админом на удалённой стороне. Сделать это можно имея некоторые данные:
1. Время, дату, от кого пиьма(E-Mail) и кому (E-Mail).
2. Перечисленное в пункте 1 + уникальный идентификатор по которому системный администратор может отследить куда подевалось у него письмо.

Связаться с системным администратором можно по E-Mail (postmaster, abuse и т.п.) или по телефону.

Вот я о чём.

Ну и конечно сообщаешь о результатах.

[.scu]

основные ошибки:

Код: Выделить всё

2008-06-04 15:19:50 [7763] 1K3qx8-000212-Nu == <mail@site.ru> R=dnslookup T=remote_smtp defer (110): Connection timed out: SMTP timeout while connected to mail.site.ru [212.119.254.66] after initial connection

rejected RCPT <nigar@investdom.ru>: Sender verify failed

2008-06-04 17:19:14 [29328] 1K3sog-0007cw-0y == mail@site.ru R=dnslookup T=remote_smtp defer (110): Connection timed out: SMTP timeout while connected to mail.site.ru [212.119.254.66] after initial connection

[princeps]

rejected RCPT <nigar@investdom.ru>: Sender verify failed

Ну вот, а говоришь не приходит никаких ошибок. Удаленный сервер пытается проверить, существует ли пользователь, от которого письмо, а у тебя такая проверка, видимо, запрещена. Как ее разрешить - есть в полезных скриптах

PS все правила, которыми ты рубишь спам, могут быть применены и к тебе тоже другими почтовиками.

[.scu]

второй пример с рамблером:

Код: Выделить всё

2008-05-28 17:32:49 [29681] 1K1Llp-0007ij-BC <= mail@site.ru H=(manager1) [62.141.98.38]:63237 I=[62.213.68.80]:25 P=esmtpa A=fixed_login:mail@site.ru S=56902 id=001301c8c0c7$87b72210$97256630$@ru T="" from <mail@site.ru> for mail@rambler.ru
2008-05-28 17:32:51 [29692] 1K1Llp-0007ij-BC == mail@rambler.ru R=dnslookup T=remote_smtp defer (-46): SMTP error from remote mail server after end of data: host imx2.rambler.ru [81.19.88.6]: 452 4.7.1 Tryagain later
2008-05-28 18:14:49 [6726] 1K1MQL-0001kU-MZ <= mail@site.ru H=(manager1) [62.141.98.38]:62441 I=[62.213.68.80]:25 P=esmtpa A=fixed_login:mail@site.ru S=849367 id=001f01c8c0cd$64456fc0$2cd04f40$@ru T="\312\317 \357\360\356\344\342\350\346\345\355\350\345" from <mail@site.ru> for mail@rambler.ru
2008-05-28 18:14:51 [6960] 1K1MQL-0001kU-MZ == mail@rambler.ru R=dnslookup T=remote_smtp defer (-46): SMTP error from remote mail server after end of data: host imx2.rambler.ru [81.19.88.6]: 452 4.7.1 Try again later
2008-05-29 11:09:42 [9764] 1K1cGT-0002XU-P5 <= mail@site.ru H=(manager1) [62.141.98.38]:63323 I=[62.213.68.80]:25 P=esmtpa A=fixed_login:mail@site.ru S=851624 id=000001c8c15b$209d17d0$61d74770$@ru T="FW: \312\317 \357\360\356\344\342\350\346\345\355\350\345" from <mail@site.ru> for mail@rambler.ru
2008-05-29 11:42:43 [12416] 1K1cmZ-0003EG-9i <= mail@site.ru H=(manager1) [62.141.98.38]:63409 I=[62.213.68.80]:25 P=esmtpa A=fixed_login:mail@site.ru S=5585 id=000001c8c15f$c2752490$475f6db0$@ru T="test" from <mail@site.ru> for mail@rambler.ru
2008-05-29 11:43:40 [12728] 1K1cnU-0003JI-B2 <= mail@rambler.ru H=mcgi48.rambler.ru [81.19.67.32]:61117 I=[62.213.68.80]:25 P=esmtp S=1568 id=1199119400.1212047045.158847992.9759@mcgi48.rambler.ru T="\300\344\360\345\361" from <a mail@rambler.ru> for mail@site.ru
2008-05-29 11:49:38 [17566] 1K1ct8-0004ZK-LD <= mail@site.ru H=(manager1) [62.141.98.38]:63443 I=[62.213.68.80]:25 P=esmtpa A=fixed_login:mail@site.ru S=849347 id=000501c8c160$b540e790$1fc2b6b0$@ru T="" from <mail@site.ru> for mail@rambler.ru
2008-05-29 11:57:08 [25002] 1K1d0U-0006VG-Ic <= mail@site.ru H=(manager1) [62.141.98.38]:63472 I=[62.213.68.80]:2525 P=esmtpa A=fixed_login:mail@site.ru S=849347 id=000b01c8c161$c5031080$4f093180$@ru T="" from <mail@site.ru> for mail@rambler.ru
2008-05-29 12:55:29 [17016] 1K1dur-0004QS-O8 <= mail@site.ru H=(manager1) [62.141.98.38]:62584 I=[62.213.68.80]:25 P=esmtpa A=fixed_login:mail@site.ru S=849319 id=002c01c8c169$f12379e0$d36a6da0$@ru T="\312\317" from <mail@site.ru> for mail@rambler.ru
2008-05-29 12:55:32 [17109] 1K1dur-0004QS-O8 == mail@rambler.ru R=dnslookup T=remote_smtp defer (-46): SMTP error from remote mail server after end of data: host imx2.rambler.ru [81.19.88.3]: 452 4.7.1 Tryagain later
2008-05-30 13:28:35 [23390] 1K20uZ-00065G-De <= mail@site.ru H=(manager1) [62.141.98.38]:63782 I=[62.213.68.80]:25 P=esmtpa A=fixed_login:mail@site.ru S=6068 id=001101c8c237$b8feb830$2afc2890$@ru T="\357\360\356\344\342\350\346\345\355\350\345" from <mail@site.ru> for mail@rambler.ru
2008-05-30 13:28:38 [23398] 1K20uZ-00065G-De == mail@rambler.ru R=dnslookup T=remote_smtp defer (-46): SMTP error from remote mail server after end of data: host imx2.rambler.ru [81.19.88.2]: 452 4.7.1 Tryagain later
2008-06-06 12:37:38 [3611] 1K4XS6-0000wF-IW <= mail@site.ru H=(manager1) [62.141.98.38]:63903 I=[62.213.68.80]:25 P=esmtpa A=fixed_login:mail@site.ru S=6860 id=002a01c8c7b0$b5060020$1f120060$@ruT="\357\360\356\344\342\350\346\345\355\350\345" from <mail@site.ru> for mail@rambler.ru
2008-06-06 12:37:48 [3616] 1K4XS6-0000wF-IW == mail@rambler.ru R=dnslookup T=remote_smtp defer (-46): SMTP error from remote mail server after end of data: host imx2.rambler.ru [81.19.88.3]: 452 4.7.1 Try again later

[.scu]

rejected RCPT <nigar@investdom.ru>: Sender verify failed

Ну вот, а говоришь не приходит никаких ошибок. Удаленный сервер пытается проверить, существует ли пользователь, от которого письмо, а у тебя такая проверка, видимо, запрещена. Как ее разрешить - есть в полезных скриптах

PS все правила, которыми ты рубишь спам, могут быть применены и к тебе тоже другими почтовиками.

а можно подробнее, где искать?
хочется настроить так, чтобы все письма доходили

[.scu]

я вроде бы нашла.
http://forum.lissyara.su/viewtopic.php?p=22957#p22957
!senders = : - нужно добавлять везде, где есть deny ?

то есть например, нужно ли здесь?

Код: Выделить всё

  deny
        !senders = : 
        message       = relay not permitted

Код: Выделить всё

 deny    
     !senders = : 
     local_parts   = ^.*[@%!/|] : ^\\.

[.scu]

нужно ли добавлять к тем условиям, где есть

Код: Выделить всё

drop

?

[.scu]

и как быть с рамблером?

Код: Выделить всё

2008-06-07 19:14:33 [408] 1K507k-00006U-4K == aver***@rambler.ru R=dnslookup T=remote_smtp defer (-46): SMTP error from remote mail server after end of data: host imx2.rambler.ru [81.19.88.2]: 452 4.7.1 Try again later

[princeps]

Везде надо добавлять.
Смысл проверки такой - удаленный компьютер (тот, которому отправлялось письмо) соединяется с твоим сервером и делает вид, что собирается отправить письмо. Они обмениваются командами и когда удаленный сервер получает ответ 250 на команду rcpt to (то есть подтверждение существования пользователя), он прерывает отправку письма.

и как быть с рамблером?

Сначала реши эту проблему и может быть ситуация с рамблером решится сама собой. У них там на сайте есть адреса и телефоны технической службы, свяжись с ними (только письма не со своего сервера посылай - они не дойдут, а с mail.ru какого-нибудь).
Об обратной проверке пользователя и о рамблере мы с dikens3 говорили вот тут:
http://forum.lissyara.su/viewtopic.php?f=20&t=8345

[princeps]

!senders = : - нужно добавлять везде, где есть deny ?

Эта строчка означает, что все утверждение не будет применено к письмам с пустым отправителем. Обычно обратную проверку делают с пустым отправителем, кроме рамблера - у него от постмастера. А потом в acl_smtp_predata надо будет запретить доставку с пустым отправителем, об этом прочитаешь по той ссылке, которую я дал

[.scu]

я внесла те изменения, которые рекомендовали в полезных скриптах, ситуацию с рамблером это не поменяло (лог такой, как я писала выше).

[princeps]

Связывайся с саппортом рамблера. Другого пути, видимо, нет.

[dikens3]

и как быть с рамблером?

Код: Выделить всё

2008-06-07 19:14:33 [408] 1K507k-00006U-4K == aver***@rambler.ru R=dnslookup T=remote_smtp defer (-46): SMTP error from remote mail server after end of data: host imx2.rambler.ru [81.19.88.2]: 452 4.7.1 Try again later

Это на GreyList похоже. Должно позже уйти.

[.scu]

нет, это не грейлист - письма так и не дошли.
я не добавляла в конфиг ничего специфического, только то, что было в мануале по установке + на этом сайте в полезных скриптах.

у кого еще есть мнения относительно проблем с рамблером ?

[serge]

Удаленный сервер пытается проверить, существует ли пользователь, от которого письмо, а у тебя такая проверка, видимо, запрещена. Как ее разрешить - есть в полезных скриптах.

Гм.. в дефолтном конфиге все и так работает без "наколенных" скриптов. Может с него начать exim настраивать???

[.scu]

Удаленный сервер пытается проверить, существует ли пользователь, от которого письмо, а у тебя такая проверка, видимо, запрещена. Как ее разрешить - есть в полезных скриптах.

Гм.. в дефолтном конфиге все и так работает без "наколенных" скриптов. Может с него начать exim настраивать???

не совсем поняла, что вы имеете ввиду.
я настраивала exim в связке с courier + vexim по статье (http://www.opennet.ru/base/net/exim_install.txt.html), никаких своих настроек не делала (в первом сообщении мой конфиг)

[princeps]

Почему ты так упорно не хочешь связываться с техподдержкой рамблера? У меня половина проблем с почтой этим методом решаются

[dikens3]

нет, это не грейлист - письма так и не дошли.

Rambler должен сообщить причину отказа, можно её огласить?

я не добавляла в конфиг ничего специфического, только то, что было в мануале по установке + на этом сайте в полезных скриптах.

А это не от твоего конфига зависит.

[.scu]

после добавления предаты отправка почты вообще перестала работать (но пользователям при этом ошибки не приходят)

[princeps]

Покажи, как ты там чего добавила.

[.scu]

конфиг см. ниже (+ есть еще конфиги vexim на acl правила)

Код: Выделить всё

daemon_smtp_ports = 25 : 2525 : 465

MAILMAN_HOME=/var/lib/mailman
MAILMAN_WRAP=MAILMAN_HOME/mail/mailman
MAILMAN_USER=exim
MAILMAN_GROUP=exim

primary_hostname = site.ru
VIRTUAL_DOMAINS = SELECT DISTINCT domain FROM domains WHERE type = 'local' AND enabled = '1' AND domain = '${quote_mysql:$domain}'
RELAY_DOMAINS = SELECT DISTINCT domain FROM domains WHERE type = 'relay'  AND domain = '${quote_mysql:$domain}'
ALIAS_DOMAINS = SELECT DISTINCT alias FROM domainalias WHERE alias = '${quote_mysql:$domain}'

#VIRTUAL_DOMAINS = SELECT DISTINCT domain || ' : ' FROM domains WHERE type = 'local'
#RELAY_DOMAINS = SELECT DISTINCT domain || ' : ' FROM domains WHERE type = 'relay'

domainlist local_domains = @ : mail.site.ru : ${lookup mysql{VIRTUAL_DOMAINS}} : ${lookup mysql{ALIAS_DOMAINS}}
domainlist relay_to_domains = ${lookup mysql{RELAY_DOMAINS}}
hostlist   relay_from_hosts = localhost : 127.0.0.1 : 62.141.98.38 : MY_IP
trusted_users = base1

hide mysql_servers = localhost::(/home/mysql/mysql.sock)/vexim/vexim/veximvexim


acl_smtp_rcpt = acl_check_rcpt
acl_smtp_mime = acl_check_mime

#acl_smtp_predata = acl_check_predata
acl_smtp_data = acl_check_content

acl_smtp_helo = acl_check_helo

av_scanner = clamd:/var/run/clamav/clamd-socket

spamd_address = 127.0.0.1 783

exim_user = exim
exim_group = exim
never_users = root

rfc1413_hosts = *
rfc1413_query_timeout = 0s
smtp_accept_max = 100
smtp_connect_backlog = 40
smtp_accept_max_per_host = 20
smtp_accept_queue = 44
smtp_accept_queue_per_connection = 20

split_spool_directory = true
remote_max_parallel = 15

smtp_banner = "Welcome on our mail server!\n\
    This system does not accept Unsolicited \
    Commercial Email\nand will blacklist \
    offenders via our spam processor.\nHave a \
    nice day!\n\n${primary_hostname} ESMTP"


recipients_max = 40
recipients_max_reject = true
message_size_limit = 50M
accept_8bitmime
allow_mx_to_ip = true
log_file_path = syslog : /var/log/exim/%s-%D.log

ignore_bounce_errors_after = 30m

timeout_frozen_after = 3d
freeze_tell = support@site.ru

# Настройки TLS
tls_certificate = mailed.crt
tls_privatekey = mailed.key
tls_on_connect_ports = 465
tls_advertise_hosts = *
tls_verify_certificates = *

log_selector = +all

######################################################################
#                       ACL CONFIGURATION                            #
#         Specifies access control lists for incoming SMTP mail      #
######################################################################

begin acl
  .include /home/exim/vexim-acl-check-spf.conf

acl_check_helo:

# Include Vexim specific helo ACLs
  .include /home/exim/vexim-acl-check-helo.conf

# This access control list is used for every RCPT command in an incoming
# SMTP message. The tests are run in order until the address is either
# accepted or denied.


acl_check_rcpt:

  # Accept if the source is local SMTP (i.e. not over TCP/IP). We do this by
  # testing for an empty sending host field.

  require verify = sender
  accept  hosts = :

  # Include Vexim specific rcpt ACLs
  .include /home/exim/vexim-acl-check-rcpt.conf

  # Deny if the local part contains @ or % or / or | or !. These are rarely
  # found in genuine local parts, but are often tried by people looking to
  # circumvent relaying restrictions.

  # Also deny if the local part starts with a dot. Empty components aren't
  # strictly legal in RFC 2822, but Exim allows them because this is common.
  # However, actually starting with a dot may cause trouble if the local part
  # is used as a file name (e.g. for a mailing list).

  deny  
	!senders = :
	 local_parts   = ^.*[@%!/|] : ^\\.

  # Accept mail to postmaster in any local domain, regardless of the source,
  # and without verifying the sender.

  accept  local_parts   = postmaster
          domains       = +local_domains

  # Deny unless the sender address can be verified.
  # require verify        = sender

  #############################################################################
  # There are no checks on DNS "black" lists because the domains that contain
  # these lists are changing all the time. However, here are two examples of
  # how you could get Exim to perform a DNS black list lookup at this point.
  # The first one denies, while the second just warns.
  #
  # deny    message       = rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
  #         dnslists      = black.list.example
  #
  # warn    message       = X-Warning: $sender_host_address is in a black list at $dnslist_domain
  #         log_message   = found in $dnslist_domain
  #         dnslists      = black.list.example
  #############################################################################

  # Accept if the address is in a local domain, but only if the recipient can
  # be verified. Otherwise deny. The "endpass" line is the border between
  # passing on to the next ACL statement (if tests above it fail) or denying
  # access (if tests below it fail).

  accept  domains       = +local_domains
          endpass
          verify        = recipient

  # Accept if the address is in a domain for which we are relaying, but again,
  # only if the recipient can be verified.

  accept  domains       = +relay_to_domains
          endpass
          verify        = recipient

  # If control reaches this point, the domain is neither in +local_domains
  # nor in +relay_to_domains.

  # Accept if the message comes from one of the hosts for which we are an
  # outgoing relay. Recipient verification is omitted here, because in many
  # cases the clients are dumb MUAs that don't cope well with SMTP error
  # responses. If you are actually relaying out from MTAs, you should probably
  # add recipient verification here.

  accept  hosts         = +relay_from_hosts

  # Accept if the message arrived over an authenticated connection, from
  # any host. Again, these messages are usually from MUAs, so recipient
  # verification is omitted.

  accept  authenticated = *

  # Reaching the end of the ACL causes a "deny", but we might as well give
  # an explicit message.

  #deny   hosts		= +host_reject
  #       message	= You are banned. Go away.
  deny  
	!senders = :
	message       = relay not permitted


# This access control list is used for content scanning with the exiscan-acl
# patch. You must also uncomment the entry for acl_smtp_data (scroll up),
# otherwise the ACL will not be used. IMPORTANT: the default entries here
# should be treated as EXAMPLES. You MUST read the file doc/exiscan-acl-spec.txt
# to fully understand what you are doing ...

acl_check_mime:

  # Произодим декодирование mime сообщений. Полезно для дальнейшей проверки на
  # вирусы
  warn decode = default

  # Можно очень быстро отсеять сообщения, просто запретив некоторые mime
  # вложения, чаще всего содержащие вирусы, хотя, конечно, это не панацея
  deny 
	!senders = :
	message = Blacklisted file extension detected
       condition = ${if match \
                        {${lc:$mime_filename}} \
                        {\N(\.wav|\.cpl|\.pif|\.bat|\.scr|\.lnk|\.com)$\N} \
                     {1}{0}}
  
  # Много ли у нас людей, знающих китайский? А вот китайского спама это поубавит
  # :)
  deny 
	!senders = :
	message = Sorry, noone speaks chinese here
       condition = ${if eq{$mime_charset}{gb2312}{1}{0}}

  accept

#acl_check_predata:
# Проверки после команды DATA, но до приёма письма
# Прибиваем mailer-daemon
#  deny    message       = "Unknown user"
#          condition     = ${if match{$recipients}{mailer-daemon}{yes}{no}}

# Прибиваем с пустым отправителями (<>) используется для проверки существования E-Mail'а
#  deny    message       = "Unknown user"
#          senders       = : verify@*

# Проверка существования E-Mail'a отправителя для внешних клиентов
#deny      log_message   = Отправитель неправильный
#          !authenticated = *
#          !verify       = sender/callout=20s,defer_ok,maxwait=30s

#accept


acl_check_content:
	# Если нет "реального"(т.е. Mailer-Daemon и т.п.) отправителя для bounce сообщений - то позже будет deny. Пока только запись в лог.
	# после тестов - deny. message вместо log_message
	warn   senders = :
       		log_message = A valid sender header is required for bounces
       		!verify = header_sender

  
  # Include Vexim specific rcpt ACLs
  .include /home/exim/vexim-acl-check-content.conf

  # finally accept all the rest
  accept
  

######################################################################
#                      ROUTERS CONFIGURATION                         #
#               Specifies how addresses are handled                  #
######################################################################
#     THE ORDER IN WHICH THE ROUTERS ARE DEFINED IS IMPORTANT!       #
# An address is passed to each router in turn until it is accepted.  #
######################################################################

begin routers

# This router routes to remote hosts over SMTP by explicit IP address,
# when an email address is given in "domain literal" form, for example,
# <user@[192.168.35.64]>. The RFCs require this facility. However, it is
# little-known these days, and has been exploited by evil people seeking
# to abuse SMTP relays. Consequently it is commented out in the default
# configuration. If you uncomment this router, you also need to uncomment
# allow_domain_literals above, so that Exim can recognize the syntax of
# domain literal addresses.

# domain_literal:
#   driver = ipliteral
#   domains = ! +local_domains
#   transport = remote_smtp


# This router routes addresses that are not in local domains by doing a DNS
# lookup on the domain name. Any domain that resolves to 0.0.0.0 or to a
# loopback interface address (127.0.0.0/8) is treated as if it had no DNS
# entry. Note that 0.0.0.0 is the same as 0.0.0.0/32, which is commonly treated
# as the local host inside the network stack. It is not 0.0.0.0/0, the default
# route. If the DNS lookup fails, no further routers are tried because of
# the no_more setting, and consequently the address is unrouteable.

dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  no_more

mailman_router:
  driver = accept
  require_files = MAILMAN_HOME/lists/$local_part/config.pck
  local_part_suffix_optional
  local_part_suffix = -bounces : -bounces+* : \
                      -confirm+* : -join : -leave : \
                      -owner : -request : -admin
  headers_remove = X-Spam-Score:X-Spam-Report
  transport = mailman_transport

# The remaining routers handle addresses in the local domain(s).

# The virtual_domains alias, queries your given mysql database
# and requests the home directory of the user's maildir, the
# UID and the GID of the process to deliver under. You can be
# clever, and set the UID and GID of a user, to that of a
# local system user, so they can check their mail locally,
# rather than having to over a network. Three different
# transports are specified. virtual_delivery delivers if the
# home directory is a given directory on a locally accessible
# file system. address_reply is called if the home directory
# returns an email address (making the rcpt address an alias).
# finally, pipe_transport is used to pipe the mail to a
# process.

# This router caused me so much s*** it's untrue.
# If your db lookup returns 'no data', then $spam_in_score is
# greater than no data, and mail gets deleted.
# Eventually got this working with Philip Hazel and Codiac's help.
ditch_maxmsgsize:
  driver = redirect
  allow_fail
  condition = ${if >{$message_size}{${lookup mysql{select users.maxmsgsize from users,domains \
  		where localpart = '${quote_mysql:$local_part}' \
		and domain = '${quote_mysql:$domain}' \
		and users.maxmsgsize > 0 \
		and users.domain_id=domains.domain_id }{${value}K}fail}} {yes}{no}}
  data = :fail:\n\Your message is too big.\n \
	 	Your message was rejected because the user $local_part@$domain\n \
		does not accept messages larger than \
		${lookup mysql{select users.maxmsgsize from users,domains \
		where localpart = '${quote_mysql:$local_part}' \
		and domain = '${quote_mysql:$domain}' \
		and users.maxmsgsize > 0 \
		and users.domain_id=domains.domain_id}{${value}K}fail} Kb.
  local_part_suffix = -*
  local_part_suffix_optional
  retry_use_local_part

ditch_malware:
  driver = redirect
  allow_fail
  data = :blackhole:
  condition = ${if and { {match {$h_X-ACL-Warn:}{.*malware.*}} \
                         {eq {${lookup mysql{select users.on_avscan from users,domains \
		                where localpart = '${quote_mysql:$local_part}' \
		                and domain = '${quote_mysql:$domain}' \ 
		                and users.on_avscan = '1' \
		                and users.domain_id=domains.domain_id}}}{1} }} {yes}{no} }

ditch_spam:
  driver = redirect
  allow_fail
  data = :blackhole:
  condition = ${if >{$spam_score_int}{${lookup mysql{select users.sa_refuse * 10 from users,domains \
                where localpart = '${quote_mysql:$local_part}' \
                and domain = '${quote_mysql:$domain}' \
        	and users.on_spamassassin = '1' \
                and users.domain_id=domains.domain_id \
		and users.sa_refuse > 0 }{$value}fail}} {yes}{no}}
  local_part_suffix = -*
  local_part_suffix_optional
  retry_use_local_part

ditch_hdrmailer:
  driver = redirect
  allow_fail
  data = :blackhole:
  condition = ${if eq {${lookup mysql{select count(*) from blocklists,users,domains \
  			where blocklists.blockhdr = 'x-mailer' \
			and blocklists.blockval = '${quote_mysql:$h_x-mailer:}' \
			and users.localpart = '${quote_mysql:$local_part}' \
  			and domains.domain = '${quote_mysql:$domain}' \
			and domains.domain_id=blocklists.domain_id \
			and users.user_id=blocklists.user_id}}}{1} {yes}{no}}
  local_part_suffix = -*
  local_part_suffix_optional
  retry_use_local_part

ditch_hdrto:
  driver = redirect
  allow_fail
  data = :blackhole:
  condition = ${if eq {${lookup mysql{select count(*) from blocklists,users,domains \
  			where blocklists.blockhdr = 'to' \
			and blocklists.blockval = '${quote_mysql:$h_to:}' \
			and users.localpart = '${quote_mysql:$local_part}' \
  			and domains.domain = '${quote_mysql:$domain}' \
			and domains.domain_id=blocklists.domain_id \
			and users.user_id=blocklists.user_id}}}{1} {yes}{no}}
  local_part_suffix = -*
  local_part_suffix_optional
  retry_use_local_part

ditch_hdrfrom:
  driver = redirect
  allow_fail
  data = :blackhole:
  condition = ${if eq {${lookup mysql{select count(*) from blocklists,users,domains \
  			where blocklists.blockhdr = 'from' \
			and blocklists.blockval = '${quote_mysql:$h_from:}' \
			and users.localpart = '${quote_mysql:$local_part}' \
  			and domains.domain = '${quote_mysql:$domain}' \
			and domains.domain_id=blocklists.domain_id \
			and users.user_id=blocklists.user_id}}}{1} {yes}{no}}
  local_part_suffix = -*
  local_part_suffix_optional
  retry_use_local_part

ditch_hdrsubject:
  driver = redirect
  allow_fail
  data = :blackhole:
  condition = ${if eq {${lookup mysql{select count(*) from blocklists,users,domains \
  			where blocklists.blockhdr = 'subject' \
			and blocklists.blockval = '${quote_mysql:$h_subject:}' \
			and users.localpart = '${quote_mysql:$local_part}' \
  			and domains.domain = '${quote_mysql:$domain}' \
			and domains.domain_id=blocklists.domain_id \
			and users.user_id=blocklists.user_id}}}{1} {yes}{no}}
  local_part_suffix = -*
  local_part_suffix_optional
  retry_use_local_part

virtual_vacation:
  driver = accept
  condition = ${if and { {!match {$h_precedence:}{(?i)junk|bulk|list}} \
                         {eq {${lookup mysql{select users.on_vacation from users,domains \
		                where localpart = '${quote_mysql:$local_part}' \
		                and domain = '${quote_mysql:$domain}' \ 
		                and users.on_vacation = '1' \
		                and users.domain_id=domains.domain_id}}}{1} }} {yes}{no} }
  no_verify
  no_expn
  unseen
  transport = virtual_vacation_delivery

virtual_forward:
  driver = redirect
  check_ancestor
  unseen = ${if eq {${lookup mysql{select unseen from users,domains \
		where localpart = '${quote_mysql:$local_part}' \
		and domain = '${quote_mysql:$domain}' \
		and users.on_forward = '1' \
		and users.domain_id=domains.domain_id}}}{1} {yes}{no}}
  data = ${lookup mysql{select forward from users,domains \
	where localpart='${quote_mysql:$local_part}' \
	and domain='${quote_mysql:$domain}' \
	and users.domain_id=domains.domain_id \
	and on_forward = '1'}}
  # We explicitly make this condition NOT forward mailing list mail!
  condition = ${if and { {!match {$h_precedence:}{(?i)junk}} \
                         {eq {${lookup mysql{select users.on_forward from users,domains \
		                where localpart = '${quote_mysql:$local_part}' \
		                and domain = '${quote_mysql:$domain}' \ 
		                and users.on_forward = '1' \
		                and users.domain_id=domains.domain_id}}}{1} }} {yes}{no} }
  
virtual_domains:
  driver = redirect
  allow_fail
  data = ${lookup mysql{select smtp from users,domains \
  		where localpart = '${quote_mysql:$local_part}' \
		and domain = '${quote_mysql:$domain}' \
		and domains.enabled = '1' \
		and users.enabled = '1' \
		and users.domain_id = domains.domain_id}}
  headers_add = ${if >{$spam_score_int}{${lookup mysql{select users.sa_tag * 10 from users,domains \
  		where localpart = '${quote_mysql:$local_part}' \
		and domain = '${quote_mysql:$domain}' \
		and users.on_spamassassin = '1' \
		and users.domain_id=domains.domain_id }{$value}fail}} {X-Spam-Flag: YES\n}{} }
  headers_remove = ${if or { { <{$spam_score_int}{1} } \
  			     { <{$spam_score_int}{${lookup mysql{select users.sa_tag * 10 from users,domains \
			       where localpart = '${quote_mysql:$local_part}' \
			       and domain = '${quote_mysql:$domain}' \
			       and users.on_spamassassin = 1 \
			       and users.domain_id=domains.domain_id}{$value}fail}} } \
			     { eq {0}{${lookup mysql{select users.sa_tag * 10 from users,domains \
			       where localpart = '${quote_mysql:$local_part}' \
			       and domain = '${quote_mysql:$domain}' \
			       and users.on_spamassassin = 0 \
			       and users.domain_id=domains.domain_id}{$value}fail}}} \
			   } {X-Spam-Score:X-Spam-Report} }
  local_part_suffix = -*
  local_part_suffix_optional
  retry_use_local_part
  file_transport = virtual_delivery
  reply_transport = address_reply
  pipe_transport = address_pipe
  
.include /home/exim/vexim-group-router.conf

virtual_domains_catchall:
  driver = redirect
  allow_fail
  data = ${lookup mysql{select smtp from users,domains where localpart = '*' \
  		and domain = '${quote_mysql:$domain}' \
		and users.domain_id = domains.domain_id}}
  retry_use_local_part
  file_transport = virtual_delivery
  reply_transport = address_reply
  pipe_transport = address_pipe_catchall

virtual_domain_alias:
  driver = redirect
  allow_fail
  data = ${lookup mysql{select concat('${quote_mysql:$local_part}@', domain) \
  		from domains,domainalias where domainalias.alias = '${quote_mysql:$domain}' \
		and domainalias.domain_id = domains.domain_id}}
  retry_use_local_part
  

# This router handles aliasing using a linearly searched alias file with the
# name /etc/aliases. When this configuration is installed automatically,
# the name gets inserted into this file from whatever is set in Exim's
# build-time configuration. The default path is the traditional /etc/aliases.
# If you install this configuration by hand, you need to specify the correct
# path in the "data" setting below.
#
##### NB  You must ensure that the alias file exists. It used to be the case
##### NB  that every Unix had that file, because it was the Sendmail default.
##### NB  These days, there are systems that don't have it. Your aliases
##### NB  file should at least contain an alias for "postmaster".
#
# If any of your aliases expand to pipes or files, you will need to set
# up a user and a group for these deliveries to run under. You can do
# this by uncommenting the "user" option below (changing the user name
# as appropriate) and adding a "group" option if necessary. Alternatively, you
# can specify "user" on the transports that are used. Note that the transports
# listed below are the same as are used for .forward files; you might want
# to set up different ones for pipe and file deliveries from aliases.

system_aliases:
  driver = redirect
  allow_fail
  allow_defer
  data = ${lookup{$local_part}lsearch{/etc/aliases}}
  user = exim
  group = exim
  file_transport = address_file
  pipe_transport = address_pipe


# This router handles forwarding using traditional .forward files in users'
# home directories. If you want it also to allow mail filtering when a forward
# file starts with the string "# Exim filter", uncomment the "allow_filter"
# option.

# The no_verify setting means that this router is skipped when Exim is
# verifying addresses. Similarly, no_expn means that this router is skipped if
# Exim is processing an EXPN command.

# The check_ancestor option means that if the forward file generates an
# address that is an ancestor of the current one, the current one gets
# passed on instead. This covers the case where A is aliased to B and B
# has a .forward file pointing to A.

# The three transports specified at the end are those that are used when
# forwarding generates a direct delivery to a file, or to a pipe, or sets
# up an auto-reply, respectively.

userforward:
  driver = redirect
  check_local_user
  file = $home/.forward
  no_verify
  no_expn
  check_ancestor
# allow_filter
  file_transport = address_file
  pipe_transport = address_pipe_local
  reply_transport = address_reply
  condition = ${if exists{$home/.forward} {yes} {no} }
  group = exim
## group = mail


# This router matches local user mailboxes. If the router fails, the error
# message is "Unknown user".

localuser:
  driver = accept
  check_local_user
  transport = local_delivery
  cannot_route_message = Unknown user



######################################################################
#                      TRANSPORTS CONFIGURATION                      #
######################################################################
#                       ORDER DOES NOT MATTER                        #
#     Only one appropriate transport is called for each delivery.    #
######################################################################

# A transport is used only when referenced from a router that successfully
# handles an address.

begin transports


# This transport is used for delivering messages over SMTP connections.

remote_smtp:
  driver = smtp

# This transport is used for local delivery to user mailboxes in traditional
# BSD mailbox format. By default it will be run under the uid and gid of the
# local user, and requires the sticky bit to be set on the /var/mail directory.
# Some systems use the alternative approach of running mail deliveries under a
# particular group instead of using the sticky bit. The commented options below
# show how this can be done.

local_delivery:
  driver = appendfile
  file = /home/exim/mail/$local_part
  delivery_date_add
  envelope_to_add
  return_path_add
  group = exim
  user = $local_part
  mode = 0660
  no_mode_fail_narrower

virtual_delivery:
  driver = appendfile
  envelope_to_add
  return_path_add
  mode = 0600
  maildir_format = true
  create_directory = true
  directory = ${lookup mysql{select smtp from users,domains \
		where localpart = '${quote_mysql:$local_part}' \
		and domain = '${quote_mysql:$domain}' \
		and users.domain_id = domains.domain_id}}
  user = ${lookup mysql{select users.uid  from users,domains \
		where localpart = '${quote_mysql:$local_part}' \
		and domain = '${quote_mysql:$domain}' \
		and users.domain_id = domains.domain_id}}
  group = ${lookup mysql{select users.gid from users,domains \
		where localpart = '${quote_mysql:$local_part}' \
		and domain = '${quote_mysql:$domain}' \
		and users.domain_id = domains.domain_id}}
  quota = ${lookup mysql{select users.quota from users,domains \
  		where localpart = '${quote_mysql:$local_part}' \
		and domain = '${quote_mysql:$domain}' \
		and users.domain_id = domains.domain_id}{${value}M}}
  quota_is_inclusive = false
  #quota_size_regex = ,S=(\d+):
  quota_warn_threshold = 75%
  maildir_use_size_file = false
  quota_warn_message = "To: $local_part@$domain\n\
  			Subject: Mailbox quota warning\n\n\
			This message was automatically generated by the mail delivery software.\n\n\
			You are now using over 75% of your allocated mail storage quota.\n\n\
			If your mailbox fills completely, further incoming messages will be automatically\n\
			returned to their senders.\n\n\
			Please take note of this and remove unwanted mail from your mailbox.\n"

virtual_vacation_delivery:
  driver   = autoreply
  from     = "${local_part}@${domain}"
  to       = ${sender_address}
  subject  = "Autoreply from ${local_part}@${domain}"
  text     = ${lookup mysql{select vacation from users,domains \
		where domain='${quote_mysql:$domain}' \
		and localpart='${quote_mysql:$local_part}' \
		and users.domain_id=domains.domain_id}}

mailman_transport:
  driver = pipe
  command = MAILMAN_WRAP \
            '${if def:local_part_suffix \
                  {${sg{$local_part_suffix}{-(\\w+)(\\+.*)?}{\$1}}} \
                  {post}}' \
            $local_part
  current_directory = MAILMAN_HOME
  home_directory = MAILMAN_HOME
  user = MAILMAN_USER
  group = MAILMAN_GROUP

# This transport is used for handling pipe deliveries generated by alias or
# .forward files. If the pipe generates any standard output, it is returned
# to the sender of the message as a delivery error. Set return_fail_output
# instead of return_output if you want this to happen only when the pipe fails
# to complete normally. You can set different transports for aliases and
# forwards if you want to - see the references to address_pipe in the routers
# section above.

address_pipe:
  driver = pipe
  return_output
  user = ${lookup mysql{select users.uid from users,domains where localpart = '${quote_mysql:$local_part}' and domain = '${quote_mysql:$domain}' and users.domain_id = domains.domain_id}}
  group = ${lookup mysql{select users.gid from users,domains where localpart = '${quote_mysql:$local_part}' and domain = '${quote_mysql:$domain}' and users.domain_id = domains.domain_id}}

address_pipe_catchall:
  driver = pipe
  return_output
  user = ${lookup mysql{select users.uid from users,domains where localpart = '*' and domain = '${quote_mysql:$domain}' and users.domain_id = domains.domain_id}}
  group = ${lookup mysql{select users.gid from users,domains where localpart = '*' and domain = '${quote_mysql:$domain}' and users.domain_id = domains.domain_id}}

address_pipe_local:
  driver = pipe
  return_output


# This transport is used for handling deliveries directly to files that are
# generated by aliasing or forwarding.

address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add


# This transport is used for handling autoreplies generated by the filtering
# option of the userforward router.

address_reply:
  driver = autoreply



######################################################################
#                      RETRY CONFIGURATION                           #
######################################################################

begin retry

# This single retry rule applies to all domains and all errors. It specifies
# retries every 15 minutes for 2 hours, then increasing retry intervals,
# starting at 1 hour and increasing each time by a factor of 1.5, up to 16
# hours, then retries every 6 hours until 4 days have passed since the first
# failed delivery.

# Domain               Error       Retries
# ------               -----       -------

*                      *           F,2h,15m; G,16h,1h,1.5; F,14d,6h



######################################################################
#                      REWRITE CONFIGURATION                         #
######################################################################

# There are no rewriting specifications in this default configuration file.

begin rewrite



######################################################################
#                   AUTHENTICATION CONFIGURATION                     #
######################################################################

# There are no authenticator specifications in this default configuration file.

begin authenticators

plain_login:
        driver = plaintext
        public_name = PLAIN
        server_condition = ${lookup mysql{SELECT '1' FROM users \
				WHERE username = '${quote_mysql:$2}' \
				AND clear = '${quote_mysql:$3}'} {yes}{no}}
        server_set_id = $2

fixed_login:
        driver = plaintext
        public_name = LOGIN
        server_prompts = "Username:: : Password::"
        server_condition = ${lookup mysql{SELECT '1' FROM users \
				WHERE username = '${quote_mysql:$1}' \
				AND clear = '${quote_mysql:$2}'} {yes}{no}}                    
        server_set_id = $1

fixed_cram:
        driver = cram_md5
        public_name = CRAM-MD5
        server_secret = ${lookup mysql{SELECT clear FROM users \
				WHERE username = '${quote_mysql:$1}'}{$value}fail}
        server_set_id = $1


######################################################################
#                   CONFIGURATION FOR local_scan()                   #
######################################################################

# If you have built Exim to include a local_scan() function that contains
# tables for private options, you can define those options here. Remember to
# uncomment the "begin" line. It is commented by default because it provokes
# an error with Exim binaries that are not built with LOCAL_SCAN_HAS_OPTIONS
# set in the Local/Makefile.

# begin local_scan


# End of Exim configuration file

[princeps]

Эмм, и что ты тут добавила в предата?
Конфиги твои особенно не помогут, ты лучше логи покажи.