Skip to main content

Exim Cheatsheet

Exim is the most used linux mailserver. Have you ever got to a situation where you want to mass delete emails, or trace emails and no GUI is available in your server ? Use this cheatsheet to complete your tasks


Basic information

Print a count of the messages in the queue:

root@localhost# exim -bpc

Print a listing of the messages in the queue (time queued, size, message-id, sender, recipient):

root@localhost# exim -bp

Print a summary of messages in the queue (count, volume, oldest, newest, domain, and totals):

root@localhost# exim -bp | exiqsumm

Print what Exim is doing right now:

root@localhost# exiwhat

Test how exim will route a given address:

root@localhost# exim -bt
  router = localuser, transport = local_delivery
root@localhost# exim -bt
  router = localuser, transport = local_delivery
root@localhost# exim -bt
  router = lookuphost, transport = remote_smtp
  host [] MX=0

Run a pretend SMTP transaction from the command line, as if it were coming from the given IP address. This will display Exim’s checks, ACLs, and filters as they are applied. The message will NOT actually be delivered.

root@localhost# exim -bh

Display all of Exim’s configuration settings:

root@localhost# exim -bP

Searching the queue with exiqgrep

Exim includes a utility that is quite nice for grepping through the queue, called exiqgrep. Learn it. Know it. Live it. If you’re not using this, and if you’re not familiar with the various flags it uses, you’re probably doing things the hard way, like piping `exim -bp` into awk, grep, cut, or `wc -l`. Don’t make life harder than it already is.

First, various flags that control what messages are matched. These can be combined to come up with a very particular search.

Use -f to search the queue for messages from a specific sender:

root@localhost# exiqgrep -f [luser]@domain

Use -r to search the queue for messages for a specific recipient/domain:

root@localhost# exiqgrep -r [luser]@domain

Use -o to print messages older than the specified number of seconds. For example, messages older than 1 day:

root@localhost# exiqgrep -o 86400 [...]

Use -y to print messages that are younger than the specified number of seconds. For example, messages less than an hour old:

root@localhost# exiqgrep -y 3600 [...]

Use -s to match the size of a message with a regex. For example, 700-799 bytes:

root@localhost# exiqgrep -s '^7..$' [...]

Use -z to match only frozen messages, or -x to match only unfrozen messages.

There are also a few flags that control the display of the output.

Use -i to print just the message-id as a result of one of the above two searches:

root@localhost# exiqgrep -i [ -r | -f ] ...

Use -c to print a count of messages matching one of the above searches:

root@localhost# exiqgrep -c ...

Print just the message-id of the entire queue:

root@localhost# exiqgrep -i

Managing the queue

The main exim binary (/usr/sbin/exim) is used with various flags to make things happen to messages in the queue. Most of these require one or more message-IDs to be specified in the command line, which is where `exiqgrep -i` as described above really comes in handy.

Start a queue run:

root@localhost# exim -q -v

Start a queue run for just local deliveries:

root@localhost# exim -ql -v

Remove a message from the queue:

root@localhost# exim -Mrm <message-id> [ <message-id> ... ]

Freeze a message:

root@localhost# exim -Mf <message-id> [ <message-id> ... ]

Thaw a message:

root@localhost# exim -Mt <message-id> [ <message-id> ... ]

Deliver a message, whether it’s frozen or not, whether the retry time has been reached or not:

root@localhost# exim -M <message-id> [ <message-id> ... ]

Deliver a message, but only if the retry time has been reached:

root@localhost# exim -Mc <message-id> [ <message-id> ... ]

Force a message to fail and bounce as “cancelled by administrator”:

root@localhost# exim -Mg <message-id> [ <message-id> ... ]

Remove all frozen messages:

root@localhost# exiqgrep -z -i | xargs exim -Mrm

Remove all messages older than five days (86400 * 5 = 432000 seconds):

root@localhost# exiqgrep -o 432000 -i | xargs exim -Mrm

Freeze all queued mail from a given sender:

root@localhost# exiqgrep -i -f luser@example.tld | xargs exim -Mf

View a message’s headers:

root@localhost# exim -Mvh <message-id>

View a message’s body:

root@localhost# exim -Mvb <message-id>

View a message’s logs:

root@localhost# exim -Mvl <message-id>

Add a recipient to a message:

root@localhost# exim -Mar <message-id> <address> [ <address> ... ]

Edit the sender of a message:

root@localhost# exim -Mes <message-id> <address>

Access control

Exim allows you to apply access control lists at various points of the SMTP transaction by specifying an ACL to use and defining its conditions in exim.conf. You could start with the HELO string.

# Specify the ACL to use after HELO
acl_smtp_helo = check_helo

# Conditions for the check_helo ACL:

    deny message = Gave HELO/EHLO as "friend"
    log_message = HELO/EHLO friend
    condition = ${if eq {$sender_helo_name}{friend} {yes}{no}}

    deny message = Gave HELO/EHLO as our IP address
    log_message = HELO/EHLO our IP address
    condition = ${if eq {$sender_helo_name}{$interface_address} {yes}{no}}


NOTE: Pursue HELO checking at your own peril. The HELO is fairly unimportant in the grand scheme of SMTP these days, so don’t put too much faith in whatever it contains. Some spam might seem to use a telltale HELO string, but you might be surprised at how many legitimate messages start off with a questionable HELO as well. Anyway, it’s just as easy for a spammer to send a proper HELO than it is to send HELO im.a.spammer, so consider yourself lucky if you’re able to stop much spam this way.

Next, you can perform a check on the sender address or remote host. This shows how to do that after the RCPT TO command; if you reject here, as opposed to rejecting after the MAIL FROM, you’ll have better data to log, such as who the message was intended for.

# Specify the ACL to use after RCPT TO
acl_smtp_rcpt = check_recipient

# Conditions for the check_recipient ACL

    # [...]

    drop hosts = /etc/exim_reject_hosts
    drop senders = /etc/exim_reject_senders

    # [ Probably a whole lot more... ]

This example uses two plain text files as blacklists. Add appropriate entries to these files – hostnames/IP addresses to /etc/exim_reject_hosts, addresses to /etc/exim_reject_senders, one entry per line.

It is also possible to perform content scanning using a regex against the body of a message, though obviously this can cause Exim to use more CPU than it otherwise would need to, especially on large messages.

# Specify the ACL to use after DATA
acl_smtp_data = check_message

# Conditions for the check_messages ACL

    deny message = "Sorry, Charlie: $regex_match_string"
    regex = ^Subject:: .*Lower your self-esteem by becoming a sysadmin


Fix SMTP-Auth for Pine

If pine can’t use SMTP authentication on an Exim host and just returns an “unable to authenticate” message without even asking for a password, add the following line to exim.conf:

  begin authenticators

  driver = plaintext
  public_name = PLAIN
  server_condition = "${perl{checkuserpass}{$1}{$2}{$3}}"
  server_set_id = $2
>  server_prompts = :

This was a problem on CPanel Exim builds awhile ago, but they seem to have added this line to their current stock configuration.

Log the subject line

This is one of the most useful configuration tweaks I’ve ever found for Exim. Add this to exim.conf, and you can log the subject lines of messages that pass through your server. This is great for troubleshooting, and for getting a very rough idea of what messages may be spam.

log_selector = +subject

Reducing or increasing what is logged.

Disable identd lookups

Frankly, I don’t think identd has been useful for a long time, if ever. Identd relies on the connecting host to confirm the identity (system UID) of the remote user who owns the process that is making the network connection. This may be of some use in the world of shell accounts and IRC users, but it really has no place on a high-volume SMTP server, where the UID is often simply “mail” or whatever the remote MTA runs as, which is useless to know. It’s overhead, and results in nothing but delays while the identd query is refused or times out. You can stop your Exim server from making these queries by setting the timeout to zero seconds in exim.conf:

rfc1413_query_timeout = 0s

Disable Attachment Blocking

To disable the executable-attachment blocking that many Cpanel servers do by default but don’t provide any controls for on a per-domain basis, add the following block to the beginning of the /etc/antivirus.exim file:

if $header_to: matches "example\.com|example2\.com"

It is probably possible to use a separate file to list these domains, but I haven’t had to do this enough times to warrant setting such a thing up.

Searching the logs with exigrep

The exigrep utility (not to be confused with exiqgrep) is used to search an exim log for a string or pattern. It will print all log entries with the same internal message-id as those that matched the pattern, which is very handy since any message will take up at least three lines in the log. exigrep will search the entire content of a log entry, not just particular fields.

One can search for messages sent from a particular IP address:

root@localhost# exigrep '<= .* \[\] ' /path/to/exim_log

Search for messages sent to a particular IP address:

root@localhost# exigrep '=> .* \[\]' /path/to/exim_log

This example searches for outgoing messages, which have the “=>” symbol, sent to “user@domain.tld”. The pipe to grep for the “<=” symbol will match only the lines with information on the sender – the From address, the sender’s IP address, the message size, the message ID, and the subject line if you have enabled logging the subject. The purpose of doing such a search is that the desired information is not on the same log line as the string being searched for.

root@localhost# exigrep '=> .*user@domain.tld' /path/to/exim_log | fgrep '<='

Generate and display Exim stats from a logfile:

root@localhost# eximstats /path/to/exim_mainlog

Same as above, with less verbose output:

root@localhost# eximstats -ne -nr -nt /path/to/exim_mainlog

Same as above, for one particular day:

root@localhost# fgrep YYYY-MM-DD /path/to/exim_mainlog | eximstats


To delete all queued messages containing a certain string in the body:

root@localhost# grep -lr 'a certain string' /var/spool/exim/input/ | \
                sed -e 's/^.*\/\([a-zA-Z0-9-]*\)-[DH]$/\1/g' | xargs exim -Mrm

Note that the above only delves into /var/spool/exim in order to grep for queue files with the given string, and that’s just because exiqgrep doesn’t have a feature to grep the actual bodies of messages. If you are deleting these files directly, YOU ARE DOING IT WRONG! Use the appropriate exim command to properly deal with the queue.

If you have to feed many, many message-ids (such as the output of an `exiqgrep -i` command that returns a lot of matches) to an exim command, you may exhaust the limit of your shell’s command line arguments. In that case, pipe the listing of message-ids into xargs to run only a limited number of them at once. For example, to remove thousands of messages sent from

root@localhost# exiqgrep -i -f '<>' | xargs exim -Mrm

Speaking of “DOING IT WRONG” — Attention, CPanel forum readers

I get a number of hits to this page from a link in this post at the CPanel forums. The question is:

Due to spamming, spoofing from fields, etc., etc., etc., I am finding it necessary to spend more time to clear the exim queue from time to time. […] what command would I use to delete the queue

The answer is: Just turn exim off, because your customers are better off knowing that email simply isn’t running on your server, than having their queued messages deleted without notice.

Or, figure out what is happening. The examples given in that post pay no regard to the legitimacy of any message, they simply delete everything, making the presumption that if a message is in the queue, it’s junk. That is total fallacy. There are a number of reasons legitimate mail can end up in the queue. Maybe your backups or CPanel’s “upcp” process are running, and your load average is high — exim goes into a queue-only mode at a certain threshold, where it stops trying to deliver messages as they come in and just queues them until the load goes back down. Or, maybe it’s an outgoing message, and the DNS lookup failed, or the connection to the domain’s MX failed, or maybe the remote MX is busy or greylisting you with a 4xx deferral. These are all temporary failures, not permanent ones, and the whole point of having temporary failures in SMTP and a mail queue in your MTA is to be able to try again after awhile.

Exim already purges messages from the queue after the period of time specified in exim.conf. If you have this value set appropriately, there is absolutely no point in removing everything from your queue every day with a cron job. You will lose legitimate mail, and the sender and recipient will never know if or why it happened. Do not do this!

If you regularly have a large number of messages in your queue, find out why they are there. If they are outbound messages, see who is sending them, where they’re addressed to, and why they aren’t getting there. If they are inbound messages, find out why they aren’t getting delivered to your user’s account. If you need to delete some, use exiqgrep to pick out just the ones that should be deleted.

Reload the configuration

After making changes to exim.conf, you need to give the main exim pid a SIGHUP to re-exec it and have the configuration re-read. Sure, you could stop and start the service, but that’s overkill and causes a few seconds of unnecessary downtime. Just do this:

root@localhost# kill -HUP `cat /var/spool/exim/`

You should then see something resembling the following in exim_mainlog:

pid 1079: SIGHUP received: re-exec daemon
exim 4.52 daemon started: pid=1079, -q1h, listening for SMTP on port 25 (IPv4)

Read The Fucking Manual

C Function to Validate ISO 8601 Date Formats Using ‘strptime’

Here’s a demonstration of how to use strptime and a list of format strings to validate, for example, a supplied ISO 8601 date in C or C++. You can play with the code below over at It’s not an extensive list of all ISO 8601 dates, but these are the ones that work within a MySQL query. One improvement that could be made is to handle timezones in datetime strings like ’2010-01-01T01:01:01-7:00′ and potentially micro seconds (if possible).

This is also a good demonstration for how to easily loop through all elements in an array of undefined size in C.

#define _GNU_SOURCE
#include <stdio.h>
#include <time.h>
#include <string.h>

static int
is_valid_iso8601_date_value(char *in)
    struct tm result;
    char **f;
    char *ret;
    char *formats[] = {
        "%Y-%m-%d %T",
        "%y-%m-%d %T",
        "%Y-%m-%d %TZ",
        "%y-%m-%d %TZ",
        "%Y%m%d %TZ",
        "%y%m%d %TZ",

    memset(&result, 0, sizeof(result));

    for (f = formats; f && *f; f++)
        ret = strptime(in, *f, &result);
        if (ret && *ret == '')
            return 1;

    return 0;

int main(void) {
	char date_str[] = "2010-01-01T01:01:01Z";
    if (is_valid_iso8601_date_value(date_str))
    	printf("%s is a valid iso8601 date!", date_str);
        return 0;
    	printf("%s is not a valid iso8601 date!", date_str);
		return 1;

Using ‘shopt’ To Adjust Bash Terminal Number Columns After Resizing Window

This solved a long time frustration I had within PuTTY in that when changing the window size, the terminal columns get all messed up and you get some pretty strange behavior (as seen in this blog post). The solution is to use shopt with the checkwinsize option. This will make sure that your bash terminal will always have the correct number of columns.

shopt -s checkwinsize

After throwing this into my ~/.bashrc file (or ~/.bash_profile, if you prefer), my frustration is gone! Whew!

Check out the man page or this page for more information.

Use CDPATH to Quickly Change Directories

You can create a shortcut to frequently accessed directories by adding them to the CDPATH environment variable.  So, say I frequently access /var/www/html/.  Instead of typing cd /var/www/html, I can add /var/www/ to CDPATH and then I only have to type cd html.

Open ~/.bashrc (or ~/.bash_profile) and add the following line with your frequently used directories separated with a colon (similar to PATH variable).

export CDPATH=$CDPATH:/var/www/

Here’s an example usage:

dhildreth@hostname:~> export CDPATH=$CDPATH:/var/www/
dhildreth@hostname:~> cd html

There’s one caveat to using this that I’ve ran into in the past: if you are working with Makefiles and building c/c++ apps, this can potentially confuse the Makefile script. So, if you suddenly can’t build your project after adding this variable, try removing it.

A Loving Copyright Notice (With Interesting Date)

I just came across this loving copyright notice in a file at work. For one thing, I enjoyed the content, but then it got me wondering if it was inspired by 9-11. The more I thought about it, the more I enjoyed the content.

** 2001 September 15
** The author disclaims copyright to this source code.  In place of
** a legal notice, here is a blessing:
**    May you do good and not evil.
**    May you find forgiveness for yourself and forgive others.
**    May you share freely, never taking more than you give.

Attn Subscribers: Google Reader Being Shutdown

Google announced March 13th that it’s going through some more spring cleaning which includes Google Reader (see and I’d like to remind my subscribers, of which 90% or so are using Reader or iGoogle, may need to resubscribe or transfer their subscription to iGoogle or another feed reader. You should be able to click the RSS Feed link and choose an RSS reader. Thanks for your continued support!

Tutorial: Installing Django on Shared Hosting Service Such as

This guide will walk you through how to install and run Django on a shared host such as Bluehost. Because I use Bluehost, I was able to verify the steps you see below, but you might need to modify some of the steps to work with your specific host. The whole thing should take less than 10 minutes. If I’ve done my job right, you should be able to copy/paste multiple lines to run all commands in a block as if it were a script. If you feel more comfortable, you can run each command line by line. Let’s get to it…

Step 1: Installing Python 2.7

This step is for those of you who have an older installation of Python on your webhost. In the case of Bluehost (as of 12/6/2012), the version that is installed is 2.6.6. If you have version 2.7.0 and up (but not including version 3.0), then you can skip this step. Otherwise, follow along (you should be able to copy/paste this entire block into the terminal to run it all at once):

cd ~
mkdir python27
tar xf Python-2.7.3.tgz
cd Python-2.7.3/
./configure -prefix=$HOME/python27/ --enable-unicode=ucs4
make && make install
mv ~/python27/bin/python ~/python27/bin/python27
echo "PATH=$PATH:$HOME/python27/bin" >> ~/.bashrc
echo "export LC_ALL=en_US.UTF-8" >> ~/.bashrc
echo "export LANG=en_US.UTF-8" >> ~/.bashrc
. ~/.bashrc

At this point, you should be able to run which python27 successfully like this:

# which python27

Step 2: Installing SetupTools and PIP

Now that Python 2.7 has been installed, we’ll need to install setuptools and pip (you should be able to copy/paste this entire block into the terminal to run it all at once):

tar xf setuptools-0.6c11.tar.gz
cd setuptools-0.6c11
python27 install
cd ~
tar xf pip-1.1.tar.gz
cd pip-1.1
python27 install

At this point, you should be able to run which pip successfully like this:

# which pip

Step 3: Use pip to Install Modules

We’re going to install MySQL-python, flup, and Django using pip (Note: If you plan on using PosgreSQL, you’ll need to install psycopg2):

pip install Django MySQL-python flup #psycopg2

At this point, you should be able to run which successfully like this:

# which

Step 4: Setup an Environment for the Project

I’m going to name the project ‘myproject’. When you go to create your own, you’ll want to replace anything called ‘myproject’ with the project name of your choice (you should be able to copy/paste this entire block into the terminal to run it all at once):

mkdir ~/public_html/myproject
cd ~/public_html/myproject

cat > myproject.fcgi << EOF
import sys, os
project_name = "myproject"

# Add a custom Python path.
sys.path.insert(0, os.path.expanduser("~") + "/python27")
sys.path.insert(13, os.getcwd() + "/" + project_name)

os.environ['DJANGO_SETTINGS_MODULE'] = project_name + '.settings'
from django.core.servers.fastcgi import runfastcgi
runfastcgi(method="threaded", daemonize="false")

cat > .htaccess << EOF
AddHandler fcgid-script .fcgi
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ myproject.fcgi/$1 [QSA,L]

chmod 0755 myproject.fcgi

Step 4: Create the Django Project

Lastly, we’re going to use django-admin to start our project called ‘myproject’ making sure to be in the correct directory first:

cd ~/public_html/myproject/ startproject myproject

Now, visit your website at http://mydomain/myproject and you should see the Django start page! Have fun with it.

A final note: If you want to use the admin pages, you’ll need to follow a few more steps to get the page to show up properly with css, js, and images (you’ll need to replace mydomainname with your actual domain name).

ln -s $HOME/python27/lib/python2.7/site-packages/django/contrib/admin/static $HOME/public_html/myproject/static
sed -i "s/^STATIC_ROOT = ''/STATIC_ROOT = 'admin'/g" $HOME/public_html/myproject/myproject/myproject/
sed -i "s/^STATIC_URL = ''/STATIC_URL = ''/g" $HOME/public_html/myproject/myproject/myproject/

Sources: Simply Argh Blog

Handy Terminal Keyboard Shortcuts

Put these into your “Terminal Guru” belt and be more productive!

Cursor Movement Control
Ctrl-a: Move cursor to the start of a line
Ctrl-e: Move cursor to the end of a line
Ctrl-Left/Right: Navigate word by word (may not work in all terminals)

Modify Text
Ctrl-w: Delete the whole word to the left of the cursor
Ctrl-k: Erase to end of line
Ctrl-u: Erase to beginning of line

Scrolling/Buffer Control
Shift-PageUp/PageDown: Scroll through current buffer
Ctrl-s: Pause terminal output (program will keep running)
Ctrl-q: Release terminal output (after being paused)
Ctrl-l: Clears the screen. Use this instead of the clear command.

Ctrl-r: Search the history (enter to run the command once found)

Bonus Tip: Use ‘!!’ command to run last command and ‘!com’ to run the last command starting with ‘com’.

Process Control
Ctrl-d: Exit
Ctrl-c: Kill the current process
Ctrl-z: Put the current process in the background (fg will restore it)

Are there any keyboard shortcuts that you can’t live without? Tell us about them in the comments below.

msmtp – a (fairly) simple mail submission program

As an oldtime Unix guy, I’ve always been used to having the BSD mail utility to hand, and a suitably configured mail system, so that I can script jobs to run and email the results back to me. I use mail as a sort of glorified syslog facility. With smaller single board Linux computers we don’t always want to install a full mail setup – resources often tend to be limited. A few years back I discovered msmtp

This utility is an smtp client that submits a file in standard mail format to a mail server. It can submit plain text email or use TLS/SSL etc. I use a couple of script wrappers to emulate, sort of, sendmail and the sending part of the BSD mail utility.

Of course to use msmtp you need a mail server to which you can submit email for delivery. My home server is my mail server, but you could use your ISP’s smtp server. Another problem is that msmtp just fails if it can’t connect to the mail server – it’s up to you to handle that and do something else with that precious message you can’t mail just now! My sample scripts do not deal with that situation.

This very simple script I call sendmail, and it will need customising for your setup…


# set these for your setup...

exec msmtp --host=$MailServer --domain=$Domain --from=$From $*

This is my simple script to emulate the simple parts of the send functionality in the BSD mail utility. It has many shortcomings, but it has served me well…

# A sort of shell replacment for the send functionality of
# the standard "mail" utility.
# mail [-s subject] recipient(s)

u=`id -un`

while [ $# -gt 0 ]; do
 case "$p" in
        if [ $# -gt 0 ]; then shift ; fi
        echo 1>&2 "Option "$p" not recognised."
        exit 1
        r="$r , $p"
if [ "$r" = "" ]; then
 echo 1>&2 "No Recipients."
 exit 1
if [ "$s" = "" ]; then
 printf "Subject: "
 read s

s="Subject: $s n"

(echo -e "From: ${u}@$d nTo: $r n$s nn"
 cat ) | sendmail -t $v

So if you have a job to run on the platform, then this will email the output to you…

my_job | mail -s “my_job output”

msmtp can be loaded from the package systems of most distributions, but I have had occasion to cross-compile the package for installing on a system without package management. I had only limited libraries on my cross compile system, and found that after downloading and extracting the sourcecode from sourceforge, I had to cross compile without some of the advanced features. I used

./configure –build=arm –disable-ssl –disable-gsasl –disable-nls

before doing the make to build the binaries. The resultant binary just submitted plain text email, but that was ok for my use – YMMV. The resultant binary, suitably stripped,is pretty lean.

I recently revisited using msmtp to pre-test a change to my ISP’s new smtp server, before committing the change to my mailserver’s sendmail setup. It can also be useful for testing security settings etc on mail submissions systems.


Kermit lives!

As a veteran of the IT industry I’ve seen software and OSes come and go, but there are some pieces of software that I seem to have used on a lot of platforms for a lot of years. One of the oldest of these is the file transfer software Kermit, from Columbia University –

I’ve used kermit in the early 80′s, on various CP/M systems, the very first IBM PCs and on the BBC Micro, and have been using it since on various early Unices, and other OSes that are now only memories in old fogy minds like mine. I even used hacked versions of kermit for building an email system between various computers joined by rs232 links, and then gatewayed out to the big wide world in the late 1980′s.

I used it extensively in the 90′s for automating and controlling transfers and connections over dial-up modems. It is still my console of choice when I need to hook up microcontrollers and single board computers with rs232. It’s configurability, features and programmability make it second to none.

However it has always erked me that it’s licensing prevented it being available in the standard repositories of the major Linux distributions. I have got used to downloading the source tar ball and compiling my own executables whenever I’ve needed kermit, and cursed silently that yum or apt-get would not simply do the job for me.

So imagine my joy when I belatedly discovered that Columbia University have cancelled the Kermit project and allowed it to be re-licensed and development continue at The new license is a Revised 3-Clause BSD License which will at last allow Kermit to join the Free Software Family as a full member – and about time too!

If you are not familiar with Kermit, and need to go beyond where minicom etc can take you, then do check it out. It might appear a bit old school but it is very, very powerfull.