Debian 7: Setting up production Exim MTA as an e-mail service provider


With a mis-configured email server, it is very easy to get your IP address blacklisted!

Recently, my Exim mail server was hopelessly spammed to such an extent that I wasn’t even able to clear the mail queue using rm ./*, nor even list the files, nor even count the files with ls.  How still I managed to delete probably millions of mail files in one folder is documented in my post “Removing a million files in a directory“.

After this shock, I decided to integrate anti-spam and anti-malware systems into my Exim MTA, and within a few hours my server was back up and running, and this time, bouncing spam emails back to where they belong. This blog post documents my steps in Debian 7 “Wheezy”.


If you are serious about the topic, I would suggest you grab your own copy of the Official Guide to Exim from Amazon.

How to install Exim

You can install Exim by running

apt-get install exim4

but by default, this installs the package exim4-daemon-light, which does not have advanced capabilities compiled in. Since we want to do spam filtering, we need to install exim4-daemon-heavy:

apt-get install exim4-daemon-heavy

This will remove exim4-daemon-light automatically.



Enter the domains you want to receive emails for:


Make Exim listen on all interfaces by emptying the following config line:


Enable TLS for Exim by running the script …






Spam Assassin



apt-get install spamassassin

This starts a daemon called spamd  automatically. However, it is disabled by default. Enable it by changing the following line in /etc/default/spamassassin :




to this:




Also, enable the cronjob to automatically update spamassassin’s rules:



Next, you can configure the behavior of spamassassin in the config file /etc/spamassassin/ . Especially the entries “rewrite_header” and “required_score” are interesting, but later we will configure Exim to do these jobs for us directly.

Restart the daemon to make the changes effective:

service spamassassin restart

Integration into Exim

All of following modifications have to take place in /etc/exim4/exim4.conf.template.

Now we have to enable spamd in Exim’s configuration file. Search for the line containing spamd_address and uncomment it like this:

spamd_address = 783

It is a good idea to add special headers to each processed email which specify the spam score. The configuration is already there, we just have to uncomment it (see also official documentation of this here):

    spam = debian-spamd:true
    add_header = X-Spam_score: $spam_score\n\
              X-Spam_score_int: $spam_score_int\n\
              X-Spam_bar: $spam_bar\n\
              X-Spam_report: $spam_report



    message = This message scored $spam_score spam points.
    spam = debian-spamd


service exim4 restart





SMTP error from remote server after transfer of mail text:
This message scored 1000.0 spam points.


X-Spam_score: 2.7
X-Spam_score_int: 27
X-Spam_bar: ++
X-Spam_report: snip

So far, so good.




apt-get install greylistd

You will be shown a configuration notice, instructing you how to enable greylistd in the Exim configuration. The following will show you what to do.

Integration into Exim

greylistd-setup-exim4 add

As far as I could determine, this automatically adds some lines in the already existing Exim configuration templates exim4.conf.template and inside of the directory /etc/exim4/conf.d. It adds it right after acl_check_rcpt:.

At this point, greylistd is already running. In case you want to restart the service, run

service greylist restart


service exim4 restart


Observe the contents of the Exim log file

tail -f /var/log/exim4/mainlog


F=<> temporarily rejected RCPT <>: greylisted.

When it says “temporarily rejected RCPT” and “greylisted” it means that greylistd is working.

Anti-Malware and Anti-Virus



First, install the daemon:

apt-get install clamav-daemon



To get rid of the messages, you have to run


This command updates your virus databases from the internet. You should create a cron job to run it regularly. Now you are able to restart the daemon without failure messages:

service clamav-daemon restart

Next, add the clamav daemon user to the Debian-exim group, so that it can access the spool files:

usermod -a -G Debian-exim clamav

Integration into Exim

Locate the line in /etc/exim4/exim4.conf.template which contains av_scanner, un-comment it, and change it to the following (as the Ubuntu Wiki correctly says, the default value does not work):

av_scanner = clamd:/var/run/clamav/clamd.ctl

Next, un-comment the following lines in /etc/exim4/exim4.conf.template (this is where the Ubuntu Wiki says that you should create a new file, but it’s already there):

    malware = *


service exim4 restart





SMTP error from remote server after transfer of mail text:

When you get this, ClamAV is working correctly.

Setting up Exim with DKIM (DomainKeys Identified Mail)


Generate a private key with openssl:

cd /etc/exim4
openssl genrsa -out dkim.private.key 1024

Extract the public key:



chmod 640 dkim.p*
chown root:Debian-exim dkim.p*


DKIM_PRIVATE_KEY = CONFDIR/dkim.private.key
DKIM_CANON = relaxed


Update the configuration and restart Exim:

service exim4 restart






TXT  |  _domainkey  |  o=~;

You can use this tester to check the policy record:


TXT  |  _adsp._domainkey  |  dkim=all


For details on DKIM see: RFC specification


Now check if your zone records have been saved and are effective:

dig TXT


If it responds with

DKIM check:         pass

Then the DKIM set-up was successful.

Additional Anti-Spam measures

A characteristic behavior of malicious Spam senders is that they send a Spam Flood (as many messages as possible in the least time possible).  If possible, they will send many messages in just one SMTP connection (i.e. several MAIL commands in one session). If that happens, you will be blacklisted very soon, and with tens of thousands of sent spam emails, it will be very difficult to re-gain a good reputation in the eyes of email providers like Google or Yahoo. Legitimate human senders however will only send a few single messages, one message per SMTP connection, and it will take them at least 10 seconds to write a short email. So, we can rate-limit the submission of messages, having a big impact on spammers, but little impact on legitimate human senders. Exim has a rate-limiting feature, but I decided for an easier, more robust, low-level approach using the iptables firewall.

First, we will configure Exim to just allow one MAIL command per SMTP session. From the Exim Main Configuration Documentation, we can write somewhere in /etc/exim4/exim4.conf.template

smtp_accept_max_per_connection = 1


smtp_accept_max_per_host = 1


smtp_accept_max = 100



This will limit incoming SMTP connections to 6 in 1 minute, which is one connection per 10 seconds in average – enough for private or business emails, not enough for spammers.

SMTP banner delay

(inspiration from here and here) Exim drops the connection if a SMTP client attempts to send something before the SMTP banner is displayed. This is a spam protection built directly into Exim:


To further slow down spam, we simply delay this banner. Somewhere at the beginning of the Exim config file, write:

acl_smtp_connect = acl_check_connect


    delay = 10s

You can test this by telneting to your server. The banner should appear only after 10 seconds.

More Anti Spam measures (not tested)



Exim is a very complex program (the most complex one I’ve encountered so far) and you can go very, very deep studying it. The complexity seems to stem from the complexity of the email delivery process itself. Despite that fact, this tutorial enables you to set up Exim with Anti-Malware and Anti-Spam measures in less than 1 hour. It is by no means exhaustive, but it at least bounces Spam emails above a certain threshold which is the most important thing when you don’t want your server and IP address to be blacklisted all over the internet. It also adds value to your customers when you are operating Exim as a business.

But: Anyone who would like to operate Exim for customers – would like to be a professional email hosting company – should think twice if it’s really worth it. Things do go wrong all the time, and if you don’t have a deep knowledge about what exactly to do in case of an technical or security-relevant incident – immediately, right there and then – you could upset all your customers pretty quickly. So, my advice would be: “hands-off” unless you know what you are doing. As I like to say: “You pays your money and you takes your chances!”

Follow up:

Exim and Spamassassin: Rewriting Subject lines, adding SPAM and Score