Overview

• What you’ll learn: How to install and configure Exim4 as a Mail Transfer Agent on Ubuntu/Debian — including its split-configuration model, routing and transport architecture, TLS setup, and practical comparison with Postfix.
• Prerequisites: Email Protocols (SMTP, IMAP, POP3), Postfix basics, DNS concepts
• Estimated reading time: 18 minutes

Introduction

Exim4 is a powerful and highly configurable Mail Transfer Agent originally developed at the University of Cambridge. It is the default MTA on Debian-based systems (though Ubuntu defaults to Postfix). Exim4 takes a different approach to configuration than Postfix, using a single, highly flexible configuration language that gives administrators fine-grained control over mail routing, access control, and message processing.

While Postfix emphasizes simplicity and a “secure by default” architecture with separate programs for each function, Exim4 uses a monolithic design with a powerful built-in scripting language. This makes Exim4 extremely flexible but also means its configuration has a steeper learning curve.

In this lesson, you will learn how to install Exim4, understand its configuration model, set up basic mail delivery, configure TLS encryption, and understand when to choose Exim4 over Postfix.

Installing and Initial Configuration

On Debian-based systems, Exim4 can be installed from the default repositories. Ubuntu includes a convenient configuration tool called dpkg-reconfigure that walks you through the initial setup with a series of questions.

# Install Exim4
$ sudo apt update
$ sudo apt install exim4-daemon-heavy -y

# The "heavy" variant includes features like:
# - DKIM support
# - Database lookups (MySQL, PostgreSQL, SQLite)
# - Content scanning
# - LDAP support

# Run the interactive configuration wizard
$ sudo dpkg-reconfigure exim4-config

# Configuration choices:
# 1. General type: "internet site; mail is sent and received directly using SMTP"
# 2. System mail name: example.com
# 3. IP addresses to listen on: (leave empty for all interfaces)
# 4. Other destinations to accept mail for: example.com
# 5. Domains to relay for: (leave empty)
# 6. Machines to relay for: (leave empty)
# 7. Keep DNS queries minimal: No
# 8. Delivery method: Maildir format in home directory
# 9. Split configuration: Yes

# Verify installation
$ exim4 -bV
Exim version 4.96 #2 built 12-Jun-2023
...

# Check service status
$ sudo systemctl status exim4
● exim4.service - LSB: Mail Transport Agent
     Active: active (running)

# Verify Exim4 is listening on port 25
$ sudo ss -tlnp | grep :25
LISTEN  0  20  0.0.0.0:25  0.0.0.0:*  users:(("exim4",pid=3456,fd=3))

Split vs. Monolithic Configuration

Exim4 on Debian/Ubuntu supports two configuration modes:

• Split configuration: Settings are spread across multiple files in /etc/exim4/conf.d/, organized by category (routers, transports, ACLs, etc.). This is the Debian default and recommended approach.
• Monolithic configuration: Everything is in a single file /etc/exim4/exim4.conf.template. This is more similar to upstream Exim4 and may be preferred by administrators who want full control.

# Split configuration directory structure
$ ls /etc/exim4/conf.d/
acl/        auth/       main/       retry/      rewrite/
router/     transport/

# Key files in the split configuration:
# main/       — Global settings (hostname, domains, TLS)
# router/     — Mail routing rules (how to find the destination)
# transport/  — Delivery methods (how to deliver the message)
# acl/        — Access Control Lists (accept/reject decisions)
# auth/       — Authentication mechanisms
# retry/      — Retry rules for failed deliveries
# rewrite/    — Address rewriting rules

# After making changes, regenerate the configuration:
$ sudo update-exim4.conf

# Test the configuration
$ sudo exim4 -bV

# Reload Exim4
$ sudo systemctl reload exim4

Exim4 Routing and Transport Architecture

Exim4 processes mail through a pipeline of routers and transports. Routers determine where a message should go (local delivery, remote delivery, redirect, etc.), and transports determine how it gets there (file, pipe, SMTP, etc.). This separation provides great flexibility.

# View the default routers (in order of evaluation)
$ cat /etc/exim4/conf.d/router/200_exim4-config_primary

# Example: The default remote delivery router
dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  no_more

# Example: The default local delivery router
localuser:
  driver = accept
  domains = +local_domains
  transport = maildir_home
  check_local_user

# View the default transports
$ cat /etc/exim4/conf.d/transport/30_exim4-config_remote_smtp

# Remote SMTP transport
remote_smtp:
  driver = smtp
  dkim_domain = ${lc:${domain:$h_from:}}
  dkim_selector = mail
  dkim_private_key = ${if exists{/etc/exim4/dkim/${dkim_domain}-private.pem}
                       {/etc/exim4/dkim/${dkim_domain}-private.pem}{0}}

# Local Maildir transport
maildir_home:
  driver = appendfile
  directory = $home/Maildir
  delivery_date_add
  envelope_to_add
  return_path_add
  maildir_format

TLS and Authentication

Exim4 supports TLS encryption for both incoming and outgoing connections. On Debian/Ubuntu, TLS can be configured through the split configuration files or the Debian-specific macros in /etc/exim4/conf.d/main/.

# Enable TLS in /etc/exim4/conf.d/main/03_exim4-config_tlsoptions

# TLS certificate and key
MAIN_TLS_ENABLE = yes
tls_certificate = /etc/letsencrypt/live/mail.example.com/fullchain.pem
tls_privatekey = /etc/letsencrypt/live/mail.example.com/privkey.pem

# Require TLS for authentication
tls_advertise_hosts = *
auth_advertise_hosts = ${if eq{$tls_in_cipher}{}{}{*}}

# Minimum TLS version
tls_require_ciphers = ECDHE-ECDSA-AES128-GCM-SHA256:
  ECDHE-RSA-AES128-GCM-SHA256:
  ECDHE-ECDSA-AES256-GCM-SHA384:
  ECDHE-RSA-AES256-GCM-SHA384

# Configure SMTP authentication
# Edit /etc/exim4/conf.d/auth/30_exim4-config_examples

plain_server:
  driver = plaintext
  public_name = PLAIN
  server_condition = "${if crypteq{$auth3}{${extract{1}{:}
    {${lookup{$auth2}lsearch{/etc/exim4/passwd}}}}}{1}{0}}"
  server_set_id = $auth2
  server_prompts = :
  server_advertise_condition = ${if eq{$tls_in_cipher}{}{}{*}}

# Regenerate configuration and restart
$ sudo update-exim4.conf
$ sudo systemctl restart exim4

# Test TLS connection
$ openssl s_client -starttls smtp -connect mail.example.com:25
250 HELP
EHLO test
250-mail.example.com Hello test
250-SIZE 52428800
250-8BITMIME
250-PIPELINING
250-STARTTLS
250 HELP

Exim4 vs. Postfix: Comparison

Both Exim4 and Postfix are mature, production-ready MTAs, but they have different design philosophies and strengths:

# Quick comparison commands

# Check which MTA is installed
$ dpkg -l | grep -E 'exim4|postfix'

# Switch from Postfix to Exim4 (if needed)
$ sudo apt install exim4-daemon-heavy
$ sudo apt remove postfix

# Switch from Exim4 to Postfix
$ sudo apt install postfix
$ sudo apt remove exim4-daemon-heavy

# Exim4 mail queue management
$ sudo exim4 -bp          # View queue (like mailq)
$ sudo exim4 -qf          # Force delivery attempt (like postqueue -f)
$ sudo exim4 -Mrm MSG_ID  # Remove a message (like postsuper -d)

# Exim4 testing and debugging
$ sudo exim4 -bt user@example.com   # Test routing for an address
$ sudo exim4 -d -bt user@remote.com # Debug routing with verbose output
$ sudo exim4 -bP                     # Show all configuration settings

• Configuration: Postfix uses simple key=value pairs in main.cf; Exim4 uses a full scripting language with conditions, lookups, and string expansions.
• Architecture: Postfix is modular (separate processes); Exim4 is monolithic (single binary handles everything).
• Flexibility: Exim4 is more flexible for complex routing and filtering scenarios; Postfix is simpler for standard configurations.
• Default: Exim4 is the Debian default; Postfix is the Ubuntu default and more common in the broader Linux ecosystem.

Key Takeaways

• Exim4 is a powerful MTA with a flexible scripting configuration language; it is the default on Debian while Postfix is the default on Ubuntu.
• Debian/Ubuntu uses a split configuration model under /etc/exim4/conf.d/ with categories for routers, transports, ACLs, and authentication; run update-exim4.conf after changes.
• Mail processing flows through routers (where to deliver) and transports (how to deliver), providing fine-grained control over mail routing.
• TLS and authentication should always be enabled; Exim4 can use Let’s Encrypt certificates and supports PLAIN/LOGIN authentication with TLS-only advertising.
• Choose Exim4 when you need complex routing logic, deep customization, or are running on Debian; choose Postfix for simpler setups, better documentation, and wider community support.

What’s Next

In the next lesson, you will learn how to integrate all the components — Postfix, Dovecot, OpenDKIM, and DNS authentication — into a complete, production-ready mail stack.

# 安裝 Exim4
$ sudo apt update
$ sudo apt install exim4-daemon-heavy -y

# 執行互動式設定精靈
$ sudo dpkg-reconfigure exim4-config

# 驗證安裝
$ exim4 -bV

# 檢查服務狀態
$ sudo systemctl status exim4

# 分割設定目錄結構
$ ls /etc/exim4/conf.d/
acl/  auth/  main/  retry/  rewrite/  router/  transport/

# 變更後重新產生設定：
$ sudo update-exim4.conf

# 測試設定
$ sudo exim4 -bV

# 重新載入 Exim4
$ sudo systemctl reload exim4

# 遠端投遞路由器範例
dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  no_more

# 本地投遞路由器範例
localuser:
  driver = accept
  domains = +local_domains
  transport = maildir_home
  check_local_user

# Maildir 傳輸
maildir_home:
  driver = appendfile
  directory = $home/Maildir
  maildir_format

# 在 /etc/exim4/conf.d/main/ 中啟用 TLS
MAIN_TLS_ENABLE = yes
tls_certificate = /etc/letsencrypt/live/mail.example.com/fullchain.pem
tls_privatekey = /etc/letsencrypt/live/mail.example.com/privkey.pem
tls_advertise_hosts = *

# 重新產生設定並重新啟動
$ sudo update-exim4.conf
$ sudo systemctl restart exim4

# Exim4 のインストール
$ sudo apt update
$ sudo apt install exim4-daemon-heavy -y

# インタラクティブ設定ウィザードの実行
$ sudo dpkg-reconfigure exim4-config

# インストールの確認
$ exim4 -bV

# サービス状態の確認
$ sudo systemctl status exim4

# 分割設定ディレクトリ構造
$ ls /etc/exim4/conf.d/
acl/  auth/  main/  retry/  rewrite/  router/  transport/

# 変更後に設定を再生成：
$ sudo update-exim4.conf

# Exim4 のリロード
$ sudo systemctl reload exim4

# リモート配信ルーターの例
dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  no_more

# ローカル配信ルーターの例
localuser:
  driver = accept
  domains = +local_domains
  transport = maildir_home
  check_local_user

# Maildir トランスポート
maildir_home:
  driver = appendfile
  directory = $home/Maildir
  maildir_format

# /etc/exim4/conf.d/main/ で TLS を有効化
MAIN_TLS_ENABLE = yes
tls_certificate = /etc/letsencrypt/live/mail.example.com/fullchain.pem
tls_privatekey = /etc/letsencrypt/live/mail.example.com/privkey.pem
tls_advertise_hosts = *

# 設定を再生成して再起動
$ sudo update-exim4.conf
$ sudo systemctl restart exim4