Forcing exim to skip local delivery

[meeven]

On a cPanel VPS, I am using MXLogic for some domains. This basically makes all incoming emails for those domains pass through MXLogic filters before being delivered to the respective domains.

The problem is that, when users in the same domain using the service mail to each other, the server bypasses the MXLogic filtering and delivers the email locally. This is both a security risk for those users (one infected user could infect other users on the domain) and defeats the very purpose of using MXLogic for all incoming email.

MXLogic had the following answer when I submitted a ticket about this;

This situation happens depending on the settings of your clients email server. Many email servers by default will skip sending the email out and back when the email is from an email address in the domain or domains that it is configured to handle. So when abc@1234.com sends email to def@1234.com it recognizes the mail address as one that will becoming right back, so it takes a short cut and moves the email right to that users inbox rather then sending it out and waiting for it to come back. You will need to go through your email servers settings and change it to send email out all them time whether it knows the email address is one that it handles or not.

Unfortunately, my host is not forthcoming on what I should do to make these domains skip local delivery and instead send them out and then receive them. Can anyone here guide me on which settings I should change in Exim to make this possible?

Also, if I were to prevent local delivery, would this affect all domains? I would like to do this only for the domains that are using the spam filtering service.

Thanks,
Meeven

[jerrybell]

The lack of understanding of mail from MXLogic in their answer is breathtaking.

Granted, I'm really tired and probably missing something, but I can't think of a clean way, or even a dirty way, to do this. If you create a transport that says "use smtp to a smarthost if the sender_doman is one of the local domains", it'll just keep looping out. Possibly, another router could catch mail coming back from the mxlogic box and put it back into the flow. I took a look through the cpanel exim transports and routers, and I think I'm not nearly smart enough to follow all of the logic through to see where this would need to go.

[meeven]

The lack of understanding of mail from MXLogic in their answer is breathtaking.

Yes, I am really disappointed too. To be fair to them, it was not MXLogic themselves, but their channel partner, who shall go un-named here. Having said that, I doubt if the support from MXLogic would've been any better. It seems to me that even if you have a VPS etc, you're really on your own when it comes to doing things in a non-standard way. Even my host washed their hands off this request.

I really wish someone could help solve this riddle.

[nedry]

I'm having the same problem.

[mtindor]

You could probably set up a transport that uses this logic:

if sender is smtp authenticated

and

if recipient domain is in this list (a file that has a list of domains to bypass)

then use some remote transport


I don't have the time right now to figure out how to add it into exim, but somebody may.

Of course this would not work if you have your exim set up to not require your business email users to smtp-authenticate to send outbound mail.

Mike

[mtindor]

I was wrong about the logic. It should be:

if sender has smtp-authenticated AND sender domain is in the list
send using alternate transport

I'm working on something now. I may fail miserably.

Mike

You could probably set up a transport that uses this logic:

if sender is smtp authenticated

and

if recipient domain is in this list (a file that has a list of domains to bypass)

then use some remote transport


I don't have the time right now to figure out how to add it into exim, but somebody may.

Of course this would not work if you have your exim set up to not require your business email users to smtp-authenticate to send outbound mail.

Mike

[mtindor]

Actually, I'm not working on it - at least not now.

But yes it should still be able to be done. The logic itself should be quite simple to code for somebody more familiar [than I] with exim.

Mike

I was wrong about the logic. It should be:

if sender has smtp-authenticated AND sender domain is in the list
send using alternate transport

I'm working on something now. I may fail miserably.

Mike