{"id":4904,"date":"2026-02-21T14:52:56","date_gmt":"2026-02-21T14:52:56","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=4904"},"modified":"2026-02-21T14:52:56","modified_gmt":"2026-02-21T14:52:56","slug":"exim-address-re-write-flattening-sub-domain","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=4904","title":{"rendered":"Exim – Address Re-Write (Flattening Sub-Domain)"},"content":{"rendered":"\n

We had an interesting issue where our EXIM configuration was flattening a subdomain’s “From” address, i.e. it was re-writing an email’s From (HFrom)<\/strong> and MailFrom (return-path\/envelope-from)<\/strong> headers to @domain.com addresses, i.e. to catch emails such as root@mymachine.domain.comand re-write the From (HFrom)<\/strong> and MailFrom (return-path\/envelope-from)<\/strong> to root@domain.com instead.<\/p>\n\n\n\n

Problem was, this configuration wasn’t documented, so needed a bit of investigation; but is also a good learning point for email, how it works, and how it can be manipulated.<\/p>\n\n\n\n

Remember that within an email message the From address you see in your email client isn’t the same as the MailFrom (return-path\/envelope-from) – although it could be!<\/p>\n\n\n\n

RFC5322 From (HFrom) <\/strong>– This is the header field in the email message that specifies the sender’s address and name as displayed in the email client. It’s used for display purposes and is often the address the recipient sees when they reply to the email.
RFC5321 MailFrom (return-path\/envelope-from)<\/strong> – This is the address used in the SMTP envelope, which is not directly visible to the recipient. It’s used for the initial handshake and delivery of the email, and it’s related to the bounce address.<\/p>\n\n\n\n

Rewrite Example Rules<\/h1>\n\n\n\n

Here is an example re-write configuration, if we explore some of the lines.<\/p>\n\n\n\n

You can specify that an address (or pattern of an address) never to be rewritten, which means once the address is picked up by a rule it is never passed on to the next rule. Or you can specify an address (or pattern of an address) is to be rewritten, which means once the address is picked up by a rule it is acted upon, and never passed to the next rule.<\/p>\n\n\n\n

####### Begin Address Re-Write ############\n\nbegin rewrite\n\n# Excluded Subdomains\n*@*.subdomain.domain.com * Ff\n\n# Subdomains\n*@*\\.domain.com  $1@domain.com Ff<\/code><\/pre>\n\n\n\n
We’ll explore a couple of the lines, to explain what is going on, for a more well rounded set of documentation see the “Additional Information” section below for some more in-depth links.<\/p>\n\n\n\n
Excluded Subdomain<\/h3>\n\n\n\n
If you want to exclude a subdomain from being processed, then 1. you need to ensure it is not matched by any rule above it, 2. then add a rule in the format: <match> <action> <flags><\/em><\/strong><\/p>\n\n\n\n
So for example to exclude any emails which have the the From (HFrom) and MailFrom (return-path\/envelope-from) from any further processing (and possible re-write) you would use the following:<\/p>\n\n\n\n
*@*.subdomain.domain.com * Ff<\/code><\/pre>\n\n\n\n
Matches any email address from @subdomain.domain.com<\/strong> (or a sub-domain thereof), then “*” means do nothing, and the Ff means only evaluate the From (HFrom) and MailFrom (return-path\/envelope-from).<\/p>\n\n\n\n
It also means go no further and stop evaluating any more rules and move the email to delivery.<\/p>\n\n\n\n
Included (Rewritten Subdomain)<\/h3>\n\n\n\n
If you want to re-write a subdomain of domain.com for example you would use something like:<\/p>\n\n\n\n
*@*\\.domain.com  $1@domain.com Ff<\/code><\/pre>\n\n\n\n
Which means match anything @domain.com<\/strong> (which might include say root@mymachine.domain.com)<\/strong> and then “flatten” it with $1@domain.com to become root@domain.com acting only on the From (HFrom) and MailFrom (return-path\/envelope-from) attributes. <\/p>\n\n\n\n
In plain terms match any email which has a From (HFrom) and\/or MailFrom (return-path\/envelope-from) sub-domain of sanger.ac.uk and then re-write the From (HFrom) and\/or MailFrom (return-path\/envelope-from) to $1@domain.com<\/strong> instead, so root@mymachine.domain.com<\/strong> would become root@domain.com<\/strong>.<\/p>\n\n\n\n
Flags<\/h3>\n\n\n\n
The flags can be set to act upon different parts of the email attributes, for example:<\/p>\n\n\n\n
E       rewrite all envelope fields\nF       rewrite the envelope From field\nT       rewrite the envelope To field\nb       rewrite the Bcc: header\nc       rewrite the Cc: header\nf       rewrite the From: header\nh       rewrite all headers\nr       rewrite the Reply-To: header\ns       rewrite the Sender: header\nt       rewrite the To: header<\/code><\/pre>\n\n\n\n
Check Configuration File Syntax<\/h1>\n\n\n\n
You can check the syntax of the configuration file with the following to check for any errors:<\/p>\n\n\n\n
exim -C exim.conf -bV<\/code><\/pre>\n\n\n\n
Testing<\/h1>\n\n\n\n
To verify your change has been successful, or to see what the current configuration is doing in terms of re-writing, you can use the following command.<\/p>\n\n\n\n
Before<\/h2>\n\n\n\n
As you can see the address\u00a0support@dev.domain.com\u00a0is being rewritten to:\u00a0support@domain.com.\u00a0<\/p>\n\n\n\n
# exim -brw support@dev.domain.com\n  sender: support@dev.domain.com\n    from: support@domain.com<\/strong>\n      to: support@dev.domain.com\n      cc: support@dev.domain.com\n     bcc: support@dev.domain.com\nreply-to: support@dev.domain.com\nenv-from: support@domain.com<\/strong>\n  env-to: support@dev.domain.com<\/code><\/pre>\n\n\n\n
After<\/h2>\n\n\n\n
After a change was made to the configuration to explicitly exclude this sub-domain from being re-written, we can see that the address is not being re-written.<\/p>\n\n\n\n
[root@mail-relay-01 ~]# exim -brw support@dev.domain.com\n  sender: support@dev.domain.com\n    from: support@dev.domain.com\n      to: support@dev.domain.com\n      cc: support@dev.domain.com\n     bcc: support@dev.domain.com\nreply-to: support@dev.domain.com\nenv-from: support@dev.domain.com\n  env-to: support@dev.domain.com<\/code><\/pre>\n\n\n\n
Obviously you should also check the addresses you do want to be re-written are still indeed being rewritten!<\/p>\n\n\n\n
Test Submission<\/h1>\n\n\n\n
If you want to test a real submission, you can create an email file and drop it into the submission with the following procedure.<\/p>\n\n\n\n
# cat > exim-rewrite-test.eml <<'EOF'\n> From: support@dev.domain.com\n> To: adminuser@domain.com\n> Subject: Rewrite Test\n>\n> test\n> EOF\n[root@mail-relay-01 ~]# cat exim-rewrite-test.eml\nFrom: support@dev.domain.com\nTo: adminuser@domain.com\nSubject: Rewrite Test\n\ntest\n\n# exim -odq -i -f support@dev.domain.com adminuser@domain.com < exim-rewrite-test.eml\n\n# exim -bp\n 0m   379 1vrz0d-000000003gC-3jth <support@domain.com>\n          adminuser@domain.com\n\n# exim -Mvh 1vrz0d-000000003gC-3jth\n1vrz0d-000000003gC-3jth-H\nroot 0 0\n<support@domain.com>\n1771249891 0\n-received_time_usec .891414\n-received_time_complete 1771249891.892573\n-ident root\n-received_protocol local\n-body_linecount 1\n-max_received_linelength 46\n-allow_unqualified_recipient\n-allow_unqualified_sender\n-deliver_firsttime\n-tls_resumption A\nXX\n1\nadminuser@domain.com\n\n199P Received: from root by mail-relay-01.domain.com with local (Exim 4.97.1)\n\t(envelope-from <support@domain.com>)\n\tid 1vrz0d-000000003gC-3jth\n\tfor adminuser@domain.com;\n\tMon, 16 Feb 2026 13:51:31 +0000\n047* From: support@dev.domain.com\n027F From: support@domain.com\n021T To: adminuser@domain.com\n022  Subject: Rewrite Test\n066I Message-Id: <E1vrz0d-000000003gC-3jth@mail-relay-01.domain.com>\n059* X-rewrote-sender: support@dev.domain.com\n038  Date: Mon, 16 Feb 2026 13:51:31 +0000\n\n# exim -Mrm 1vrz0d-000000003gC-3jth\nMessage 1vrz0d-000000003gC-3jth has been removed\n\n# rm exim-rewrite-test.eml\nrm: remove regular file 'exim-rewrite-test.eml'? y\n<\/code><\/pre>\n\n\n\n
Additional Information<\/h1>\n\n\n\n