Exim4 smarthost

Keep using sendmail on your VPS. Configure Exim4 to relay outbound email through Sendy, and your applications and scripts can keep submitting mail through the local /usr/sbin/sendmail interface. Configure Sendy’s SMTP credentials once in Exim4 instead of adding them to each application.

Exim queues local submissions and relays nonlocal mail to Sendy over STARTTLS on port 2525. These steps use Debian and Ubuntu’s split configuration. Your applications still need valid message headers and sender addresses on a verified domain; the prerequisites cover sender rewriting for system mail.

1. Store the API key

   Create /etc/exim4/sendy-api-key with a privileged editor. Put your full API key, including snd_key_, on its own line without quotes. Restrict access:

   sudo chown root:Debian-exim /etc/exim4/sendy-api-key
   sudo chmod 0640 /etc/exim4/sendy-api-key

   The authenticator reads this file at delivery time. You do not need to put the key in a configuration fragment or a shell command.

2. Route nonlocal mail to Sendy

   Create /etc/exim4/conf.d/router/150_local_sendy with this router:

   sendy_smarthost:
     driver = manualroute
     domains = ! +local_domains
     transport = sendy_smtp
     route_list = * smtp.usesendy.com byname
     no_more

   Keep your existing local_domains list. With custom routers, place this router before any router that delivers nonlocal mail directly. Local delivery remains with your existing local routers.

3. Require authenticated TLS delivery

   Create /etc/exim4/conf.d/transport/30_local_sendy with this transport:

   sendy_smtp:
     driver = smtp
     port = 2525
     hosts_require_auth = *
     hosts_require_tls = *
     tls_verify_hosts = *
     tls_verify_cert_hostnames = *
     tls_verify_certificates = /etc/ssl/certs/ca-certificates.crt

   Exim must authenticate and verify the server’s certificate and hostname. A TLS or authentication failure defers delivery instead of falling back to an unencrypted session.

4. Add client authentication

   Create /etc/exim4/conf.d/auth/00_local_sendy with this authenticator:

   sendy_login:
     driver = plaintext
     public_name = LOGIN
     client_condition = ${if and{\
       {eq{$host}{smtp.usesendy.com}}\
       {def:tls_out_cipher}}{yes}{no}}
     hide client_send = : apikey : ${readfile{/etc/exim4/sendy-api-key}{}}

   Use the literal username apikey. This client-only LOGIN authenticator is restricted to Sendy’s hostname and an encrypted connection. Keep it before other LOGIN client authenticators, and keep the backslashes that continue the condition across lines. The file reader removes the API key file’s line ending.

5. Check and apply the configuration

   Check the generated configuration first. If the check succeeds, restart Exim4 and test routing to an address outside your local domains:

   sudo update-exim4.conf --check &&
     sudo invoke-rc.d exim4 restart &&
     sudo exim4 -bt [email protected]

   Replace [email protected] with your test recipient. The routing output should identify sendy_smarthost, sendy_smtp, and Sendy’s SMTP host. This routing test does not send an email or test authentication.

6. Submit a test email

   Save this as email.eml. Replace the sender with an address on your verified domain and the recipient with an external test address:

   From: My App <[email protected]>
   To: [email protected]
   Subject: Welcome
   MIME-Version: 1.0
   Content-Type: text/html; charset=UTF-8
   Content-Transfer-Encoding: quoted-printable
   
   <h1>Welcome</h1><p>Your account is ready.</p>

   Submit it through Exim. Replace the envelope sender with the same verified sender:

   sudo /usr/sbin/sendmail -f [email protected] -t < email.eml

   This test runs as root so Exim accepts the explicit envelope sender without adding a Sender header. For application submissions, account for Exim’s local sender policy: untrusted users can have their envelope sender replaced or a Sender header added. Sendy does not accept Sender headers; see SMTP message requirements.

sudo exim4 -bp