My Server:
- CentOS 7.6
- Exim 4.91-5

What I am looking to achieve
Using Exim I want to silently discard incoming emails from a user set list of wildcard matches. SpamAssassin and other tools are not suitable in this instance.

For example:

I want to block any emails coming from a domain ending in .icu:

What have I read so far?
To do this I have read this answer as well as the Exim documention however my first attempt failed and caused all emails to the server to be rejected.

My edit methodology
My system has an Exim list of additional custom filter rules in a folder; /usr/local/cpanel/etc/exim/sysfilter/options/

My file in that folder stands as:

#block email domains
  ( $h_from: matches ".*@.*\.opskee\.gq\$"
  or $h_from: matches ".*@.*\.icu\$" )
#then noerror seen finish
  deliver "SpamTest <[email protected]>"
  seen finish

Intention of the above PCRE:
To block any email whose from domain ends in <anything>@<anything>.opskee.gq or <anything>@<anything>.icu.

I tried testing the system using the reference in the other question but this just hung the SSH.

/usr/sbin/exim -bF <scriptfile> -f <sender>


  • Is my above PCRE correct (or at least, avoids obvious exim-specific erorrs)?
  • Can a full complete example be provided/linked for the <sender> command in the above prompt?
  • Some documentation (3rd party) referencing brackets around the if statement (I currently have this) and others do not; which is better?

1 Answer 1


The proper way is to use exim's ACL instead of filtering.
Find the part of config starting with the line like that:


Your config can be different but acl, rcpt and semicolon should be present. Then there should be a number of blocks, starting with accept, deny, require and other verbs.
You have to add the new block:

deny condition = ${lookup{$sender_address}nwildlsearch{/path/black.list}{yes}} 
       message = Not that time, sorry.

File /path/black.list should contain banned addresses and/or regular expressions, one per line:

## You can block the certain sender
## Or everybody from some domain
## Or even all top-level domain at once

Here . is an PCRE token that means any symbol, .* means any number of any symbols while \. means the dot. Saying strictly the pattern ^.*@domain\.icu means:

Sender address starting with any number (0..n) of any symbols,
then symbol '@', 
then 'domain' substring,
and ending with '.icu' symbols

String [email protected] will match that RE.

Keep in mind that ACL rules are applied in the order they are defined in the configuration file. Those ACL you want to implement should be placed at the top of the ACL definitions for the RCPT stage.

Restart exim after reconfiguration.

  • Thank you for the info. My server only appears to have acl_smtp_rcpt: so I am using that.
    – Martin
    May 10, 2019 at 16:03
  • ACL section name is configurable so it's look exactly like what you need.
    – Kondybas
    May 10, 2019 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .