Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking to use exim on a 'frontend' simply to hide the IP of the true backend mail servers. This exim configuration will server for multiple domains. Really what I am looking for is confirmation that the setup I have made will work.

I have installed and configured exim routers as follows

# Setup Static Configuration Route
        driver = manualroute
        transport = remote_smtp
        route_data = ${lookup{$domain}lsearch{/etc/staticroutes}}

The /etc/staticroutes file then looks like  x.x.x.x  x.x.x.x

So in theory any mail going to this mail server for example will then be forwarded to the backend mail server to Will this work as I expect?

Look forward to hearing your responses.

Thanks in advance (And after ofcourse), Chris.

share|improve this question

Your solution looks like it will work to me but is a little naive in the state of modern email handling. Specifically, without any recipient local part verification on the frontend server, your frontend server will be doing accept and forward for all local parts in and This is a huge issue in modern mail handling and if you handle any volume of mail your exim server will start getting blacklisted due to bounce-back spam.

The proper way to do this (use a front end mail server) is to have some sort of verification set up. It might be an lsearched file containing valid local_parts for each domain. It might be an ldap query for each domain (for instance, to a back end Exchange server). It might be a mixture of solutions specific to each domain that you are being a middle man for. It could be call-forward SMTP verification. It doesn't really matter how, but you will end up regretting it both in time spent cleaning out your mail queues and time spent trying to clear your name with DNSBLs if you don't put some form of recipient local part verification on the frontend server.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.