Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get Exim to use STARTTLS to send emails that are just FORWARDS.

I have a server accepting email at for users. So I want to forward all email to If I do this from the command like on echo "test" | mail -s "ssl/tls test" Success!! Sent via TLS BUT, if I send an email to the forward fails, it's NOT being sent via TLS. I've tried both forwarding the email via /etc/aliases and the user .forward file. The email is indeed sent, but NOT via TLS.

Why is it when I run "mail" from the command like it's working like it should, but a .forward is not using TLS?


share|improve this question

You have some kind of constraint on which router can be used, which is being applied based on some local configuration. Perhaps you set some $acl_m_foo data in an ACL which is later evaluated in a router, perhaps the relevant router is checking $sender_host_address.

Use exim -bt to see how Exim normally routes mails to that address, and use exim -bh -bt to see the decisions made when Exim assumes that the message was sent from To see more data, use the -d option, for debugging, which also takes a bunch of tags to turn on even more debugging (eg, -d+expand+acl).

In a normal configuration, routers only look at the recipient, not the sender, so if recipient A is routed such that TLS is used for a mail submitted locally, it will do so if the message came in remotely. Exim is powerful and flexible enough that you can shoot yourself in the foot, though.

share|improve this answer

I would try setting hosts_require_tls to include the domain you are forwarding to. This should cause Exim to always use TLS for the server. This may need to be set on all transports using the smtp driver. (Some configurations have multiple smtp transports.)

EDIT: If it works from the command line, then your configuration appears correct. It is possible that your running daemon is running an old configuration. You could test this with a command like

sendmail -odq
Subject: Test message


This should add the message to the queue. It will be delivered the next time the queue is run. Check that message to see if it as delivered using TLS. You can get Exim to reload its configuration by sending it a HUP signal. The command exiwhat should tell you the PID of the Exim daemon.

share|improve this answer
Wouldn't this do it? in /etc/exim4/conf.d/transport/30_exim4-config_remote_smtp I have hosts_require_tls = * – Blake Oct 14 '13 at 22:09
Also, it is using TLS from the command line, but it's not when the email is send via /etc/alisases or a .forward file. – Blake Oct 14 '13 at 22:12
It is possible another transport is handling the request. Try setting hosts_require_tls at the top of the configuration. It should apply to all transports when set there. – BillThor Oct 15 '13 at 12:59
No, hosts_require_tls is an SMTP Transport option, it needs to be set on a particular transport, it can not be set in the main section of the configuration. There are no general rules that Transport options can be set in Main. – Phil P Oct 25 '13 at 5:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.