|Original author(s)||Philip Hazel|
|Developer(s)||The Exim Maintainers|
|Stable release||4.82 / October 28, 2013|
|Type||Mail transfer agent|
|License||GNU General Public License|
Exim is a mail transfer agent (MTA) used on Unix-like operating systems. Exim is free software distributed under the terms of the GNU General Public License, and it aims to be a general and flexible mailer with extensive facilities for checking incoming e-mail.
In January 2013 in a study performed by E-Soft, Inc., approximately 48% of the publicly reachable mail-servers on the Internet ran Exim.
The first version of Exim was written in 1995 by Philip Hazel for use in the University of Cambridge Computing Service’s e-mail systems. The name initially stood for EXperimental Internet Mailer. It was originally based on an older MTA, Smail-3, but it has since diverged from Smail-3 in its design and philosophy.
Exim, like Smail, still follows the Sendmail design model, where a single binary controls all the facilities of the MTA. This monolithic design is considered by some to be inherently less secure, due to the lack of binary separation between the individual components of the system. Instead, Exim separates the components out in terms of invocation and has well-defined stages during which it gains or loses privileges.
Exim’s security record has been fairly clean, with only a handful of serious security problems diagnosed over the years. Since the redesigned version 4 was released there have been four remote code execution flaws and one conceptual flaw concerning how much trust it is appropriate to place in the run-time user; the latter was fixed in a security lockdown in revision 4.73, one of the very rare occasions when Exim has broken backwards compatibility with working configurations. This issue would not have been prevented by using a non-monolithic design.
Exim is highly configurable, and therefore has features that are lacking in other MTAs. It has always had substantial facilities for mail policy controls, providing facilities for the administrator to control who may send or relay mail through the system. In version 4.x this has matured to an Access Control List based system allowing very detailed and flexible controls. The integration of a framework for content scanning, which allowed for easier integration of anti-virus and anti-spam measures, happened in the 4.x releases. This made Exim very suitable for enforcing diverse mail policies.
The configuration is done through a (typically single) configuration file, which must include the main section with generic settings and variables, as well as the following optional sections:
- the access control list (ACL) section which defines behaviour during the SMTP sessions,
- the routers section which includes a number of processing elements which operate on addresses (the delivery logic), each tried in turn,
- the transports section which includes processing elements which transmit actual messages to destinations,
- the retry section where policy on retrying messages that fail to get delivered at the first attempt is defined,
- the rewrite section, defining if and how the mail system will rewrite addresses on incoming e-mails
- the authenticators section with settings for SMTP AUTH, a rule per auth mechanism.
The configuration file permits inclusion of other files, which leads to two different configuration styles.
There are two main schools of configuration style for Exim. The native school keeps the Exim configuration in one file and external files are only used as data sources; this is strongly influenced by Philip Hazel's preferences and notes on performance as the configuration file is re-read at every exec, which happens post-fork for receiving inbound connections and at delivery. There is no use of knobs with names starting dc_.
The second commonly encountered style is the Debian style which is designed to make it easier to have an installed application automatically provide mail integration support without having the administrator edit configuration files. There are a couple of variants of this and Debian provide documentation of their approach as part of the packages. In these approaches, a debconf configuration file is used to build the Exim configuration file, together with templates and directories with configuration fragments. The meta-config is tuned with variables which have names starting dc_.
Because the Debian approach diverges significantly from the Exim one it is common to find a lack of support for the Debian approach on the regular Exim mailing-lists, with people advised  to ask Debian questions on the Debian-managed mailing-list. The Ubuntu packaging  still advises users to use the Debian mailing-list.
Exim has extensive and exhaustive documentation; if a feature or some behaviour is not documented then this is classed as a bug. The documentation consists of The Exim Specification and two ancillary files: the experimental specification for features that might disappear and "NewStuff", which tracks very recent changes that might not have been fully integrated into the main specification. The Exim Specification is available in multiple formats, including online in HTML and in plain-text for fast searching. The document preparation system ensures that the plain-text format is highly usable.
Exim has been deployed in busy environments, often handling thousands of emails per hour efficiently. Exim is designed to deliver email immediately, without queueing. However, its queue processing performance is comparatively poor when queues are large (which happens rarely on typical low-traffic sites, but can happen regularly on high-traffic sites).
Unlike qmail, Postfix, and ZMailer, Exim does not have a central queue manager (i.e. an equivalent of qmail-send, qmgr, or scheduler). There is thus no centralized load balancing, either of queue processing (leading to disproportionate amounts of time being spent on processing the same queue entries repeatedly) or of system-wide remote transport concurrency (leading to a "thundering herd" problem when multiple messages addressed to a single domain are submitted at once). In Philip Hazel's own words:
- "The bottom line is that Exim does not perform particularly well in environments where the queue regularly gets very large. It was never designed for this; deliveries from the queue were always intended to be 'exceptions' rather than the norm."
However, the interfaces to the spool system are well defined and various people have written their own spool management daemons to use instead of asking the listening daemon to periodically fork queue runners.
In 1997, Philip Hazel replaced Exim's POSIX regular expression library written by Henry Spencer with a new library he developed called PCRE (Perl Compatible Regular Expressions). Perl regular expressions are much more powerful than POSIX and other common regular expressions, and PCRE has become popular in applications other than Exim.
Historically, Exim used a peculiar version numbering scheme where the first decimal digit is updated only whenever the main documentation is fully up to date; until that time, changes were accumulated in the file NewStuff. For this reason, a 0.01 version change can signify important changes, not necessarily fully documented. In 2005, changes to Exim's version numbering were on the table of discussion.
In more recent times, the document preparation system for Exim has been overhauled and changes are much more likely to just go immediately into The Exim Specification. The 4.70 release just followed on naturally from 4.69 and the 4.6x releases had up-to-date documentation.
Philip Hazel retired from the University of Cambridge in 2007 and maintenance of Exim transitioned to a team of maintainers. The release rate since then has slowed, with some lengthy gaps between releases.
Most discussion about Exim takes place on the Exim mailing-lists; it is, after all, a mail transfer agent.
- Exim-Announce is a low-volume list, receiving new release announcements, security advisories and conference details.
- Exim-Users takes the bulk of the discussion
- Pkg-Exim4-Users takes Debian-specific questions
- Exim-Dev takes developer discussion and bug status updates
- Exim-CVS gets commit messages from the central git repo.
One of the maintainers has a public Twitter list of those maintainers with Twitter accounts.
There is an official Google+ page, which gets announcements with a little more volume than the exim-announce list; for instance, Release Candidate posts are made. There is also a Google+ Community named ‘Exim’.
- Golanski, Y (2000) The Exim Mail Transfer Agent in a Large Scale Deployment
- "E-Soft MX survey".
- Philip Hazel The Exim SMTP Mail Server (Preface)
- Philip Hazel's original thoughts on implementing a future MTA based on Smail
- Smail-3 homepage
- Security Considerations chapter of The Exim Specification
- EximSecurity in the Exim wiki
- posting by Philip Hazel
- [Exim] Exim 4.21 released
- Exim Development - From The Cathedral Towards The Bizarre
- Hazel, Philip (April 1, 2007). The Exim SMTP Mail Server: Official Guide for Release 4 (Second ed.). UIT Cambridge Ltd. p. 640. ISBN 0-9544529-7-6.
- Official website
- Exim wiki
- PCRE - Perl Compatible Regular Expressions
- Debian information on their packaging of Exim