# changelog

author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Stop accepting mail for local parts that have no mailbox: gate per_user_router
    on +real_mailboxes and add unknown_user_router, which reproduces qmail's
    .bounceon / .catchall / delete precedence. Replaces catchall_router, which was
    unseen and looked .catchall up as a keyed file. Drop spam_bounce_router, which
    reused .bounceon for a behavior qmail never had


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Unescape user_forward_router's condition so the forward-file existence test
    is actually evaluated instead of always returning true


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Write the interworx-mail env flag without a trailing newline so consumers can
    compare it against "exim" directly


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Point av_scanner at the TCP socket (127.0.0.1:3310) the interworx clamav
    package's clamd actually listens on, instead of a unix socket nothing
    configures, so the malware check below can reach the daemon
  - Add an active malware condition to the DATA ACL, gated on IWORX_VIRUS_SCAN_ENABLED,
    so NodeWorx's global virus-scanning on/off takes effect under Exim, matching qmail


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Gate the DATA ACL spam scan on the IWORX_SPAM_SCAN_ENABLED macro so NodeWorx's
    global spam-scanning on/off takes effect under Exim, matching qmail


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Enforce the MTA-level recipient blacklist: refuse RCPT for any address in the
    IWORX_BADRCPTTO control, which the panel already wrote but no ACL ever read


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Enforce the MTA-level sender blacklist and the realtime DNS blacklists: refuse
    senders in IWORX_BADMAILFROM at MAIL, and sending hosts listed in any
    IWORX_DNSBLS zone at RCPT. Both controls were written by the panel but no ACL
    ever read them


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Comment out the two remaining live greylisting warns, which set a reason string
    that nothing reads: the exim-greylist package is not shipped and the .include
    that consumes it is commented out


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Sign outbound mail with DKIM: walk the sender's account's own domains for a
    key the same way qmail's wrapper walked parent domains, but scoped to the
    sender's own account so it can never sign with another account's key. Also
    let a local sender claim an envelope address in a domain it owns, so DKIM
    has a real domain to key off for locally-injected mail (e.g. PHP mail())


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Own /etc/domainkeys, matching how qmail.spec owns it when qmail is installed
    instead. Without this the directory never existed on an Exim-only box, so
    turning on DomainKeys for the first domain on the box silently failed


