We setup exim to use Amazon SES to route all your emails, but we found out that if we use an email forwader created by cPanel, Amazon doesn't properly route those emails because it's coming from a From field that is unknown by Amazon.

Therefore, how can we set up exim to bypass the Amazon route if the From field is from a non-local domain?

The error I'm getting is:

2014-06-11 21:50:21 1Wuu9k-00073D-Gn ** XXX R=send_via_ses T=ses_smtp: SMTP error from remote mail server after end of data: host ses-smtp-us-west-2-prod-14896 026.us-west-2.elb.amazonaws.com []: 554 Message rejected: Email address is not verified.

  • Amend your question and put the exact error message you are seeing. Include some log messages for an email or two that were rejected. At first glance, you might be confusing "envelope from" with "header from", and I expect any logs or error messages to provide some clarity. – Todd Lyons Jun 13 '14 at 18:45
  • Thanks @ToddLyons, I have updated the question with the error message. I have stripped down the email address. – Raisen Jun 13 '14 at 19:55
  • Update the question with ALL lines for that have mailqueue id 1Wuu9k-00073D-Gn in it. I suspect Amazon's mail servers require the From address to be able to use SMTP Auth. It's hard to know if "Email address is not verified" means it doesn't like who you are sending from, or who you are sending to. You need to test more to find cases that do send properly, then change email addresses (first the sender, then the receiver) with the case you know does not work to figure out which it is complaining about. – Todd Lyons Jun 14 '14 at 17:02
  • It's who I am sending from - I was able to confirm this after a few tests. I'm aware of the problem, and the solution would be to tell exim to bypass the Amazon route if the From address comes from a non-local domain, but I don't know how to do that. – Raisen Jun 15 '14 at 6:57

After a few exploratory questions, we've concluded that the issue is you need to detect when a message sender is not local and route it differently. So first, I would detect non-local senders by adding to the RCPT acl:

warn  condition = ${if forany{+local_domains}{eq{$item}{$sender_address_domain}}}
      set acl_m_use_ses=1

The forany loops through all domains in the +local_domains list and compares each one to $sender_address_domain. The variable only gets set if the sender domain is in that list. Then in your router, you add the requirement that the variable must be set to 1:

condition = ${if eq{$acl_m_use_ses}{1} {yes}{no}}

Then the outbound message will skip that router if the MAIL FROM envelope sender does not have a domain that is recognized by exim as a local domain. For the emails which skip this router, you must have a subsequent router that will either try to send the email out directly using SMTP or out through a different smarthost that doesn't require the domain to match.

| improve this answer | |
  • Thanks very much for your response. I have added those lines to the exim.conf and for some reason the Amazon route is always being ignored regardless of the From address's domain name. Any ideas on how to debug this? – Raisen Jun 15 '14 at 17:31
  • Todd, I ran the following command: exim -bt -f "info@localdomain" -d some_external@email.com and I got the following debugging info for the Amazon's router: pastebin.com/WVhT3Lt4 Any ideas on how to debug this further? I tried to add log_messages to the RCPT acl you provided above but they aren't showing up in the debugging messages. – Raisen Jun 16 '14 at 6:02
  • Use logwrite to force it to write the message to the logfile (log_message will write one message per smtp conversation, whereas logwrite is a "do it now I don't care do it now" type of command). – Todd Lyons Jun 16 '14 at 12:14
  • Todd, I tried using the log_message. For some reason, the condition is always failing: >>> check condition = ${if forany{+local_domains}{match{$item}{$sender_address_domain}}} >>> = >>> warn: condition test failed in ACL "acl_smtp_rcpt" I have logged the $sender_address_domain and seems to be ok. Any ideas on what's going on? The condiion is returning an empty response, is that normal? – Raisen Jun 16 '14 at 20:20
  • I typo'd my response. That first part should go in the MAIL acl, not the RCPT acl. Try moving it to that acl, creating it if it doesn't already exist. Put your full debug output in your original question so we can see what exactly is happening (expansions and comparisons) on that particular ACL stanza. Don't put it in a comment, put it in the original question. – Todd Lyons Jun 17 '14 at 2:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.