Exim smart relay + verification?

[beddo]

Hi there,
I've been using exim smart relays with these for a while:

static_route:
 driver = manualroute
 transport = remote_smtp_smart
 route_data = ${lookup{$domain}lsearch{/etc/staticroutes}}

remote_smtp_smart:
  driver = smtp
  port = 25
  hosts = ${lookup{$domain}lsearch{/etc/staticroutes}}
  hosts_override

This works wonderfully for a lot of our clients and cuts the spam load massively with the spam setup we have. The only limitation that is fairly obvious with this setup is that exim will accept mail for accounts that don't exist on the destination server and it will sit in the queue until it expires.

Then I got to thinking. The Cpanel/exim implementation supports sender verification callouts for incoming mail. Surely there must be some way to adapt a similar feature and have exim do a lookup on the destination server before accepting the mail.

I'm going to have a look and see if I can figure anything out myself but I have no idea where this would even start so if anyone has any pointers or has tried in the past I'd like to know what you came up with or what stopped you.

Cheers.

[beddo]

After many hours banging my head against a brick wall (not helped by a malfunctioning Exchange server used for testing) I have solved this myself.

The solution is to look for the following section in the check_recipient ACL:

#recipient verifications are required for all messages that are not sent to the local machine
                        #this was done at multiple users requests
                        require verify = recipient

After it, put in the following:

  warn
    condition = ${if eq {1}{${lookup{$domain}lsearch{/etc/staticroutes}{1}{0}}}}
    add_header = X_Staticroutes: TRUE
    require verify = recipient/callout=use_sender

Looks so simple. I don't think you actually need the add_header line but that won't cause any problems. I recommend this for everyone who is using staticroutes as it stops those rejected dictionary attacks from clogging up the mail queues. (Make sure you thoroughly test it out first though and don't blame me if anything goes wrong - it works for me!).