devture/exim-relay

🐳 A lightweight non-root Docker image for an Exim mail relay, based on Alpine Linux.

Docker Exim Relay Image

A lightweight Docker image for an Exim mail relay, based on the official Alpine image.

For extra security, the container runs as exim (uid=100 and gid=101), not root.

This is a fork of Industrie&Co's wonderful (but seemingly unmaintained) industrieco/docker-exim-relay image. The following changes have been done on top of it:

• based on a newer Alpine release (and thus, newer exim)

• removing Received headers for mail received by exim (helps email deliverability)

Docker

Default setup

This will allow relay from all private address ranges and will relay directly to the internet receiving mail servers

docker run \
       --user=100:101 \
       --name smtp \
       --restart always \
       -e HOSTNAME=my.host.name \
       -d \
       -p 25:8025 \
       docker.io/devture/exim-relay:SOME_TAGGED_RELEASE

Note: we advise setting the hostname using a HOSTNAME environment variable, instead of --hostname. Since Docker 20.10, the latter has the side-effect of making other services on the same Docker network resolve said hostname to the in-container IP address of the mailer container. If you'd rather this hostname resolves to the actual public IP address, avoid using --hostname.

Smarthost setup

To send forward outgoing email to a smart relay host

docker run \
       --user=100:101 \
       --name smtp \
       --restart always \
       -d \
       -p 25:8025 \
       -e HOSTNAME=my.host.name \
       -e SMARTHOST=some.relayhost.name::587 \
       -e SMTP_USERNAME=someuser \
       -e SMTP_PASSWORD=password \
       docker.io/devture/exim-relay:SOME_TAGGED_RELEASE

DKIM setup

To sign outgoing email with DKIM

docker run \
       --user=100:101 \
       --name smtp \
       --restart always \
       -d \
       -p 25:8025 \
       -e HOSTNAME=my.host.name \
       -e SMARTHOST=some.relayhost.name::587 \
       -e SMTP_USERNAME=someuser \
       -e SMTP_PASSWORD=password \
       --mount type=bind,src=/PATH/TO/THE/PRIVATE/KEY.pem,dst=/etc/exim/dkim.pem,ro \ 
       docker.io/devture/exim-relay:SOME_TAGGED_RELEASE

Docker Compose

version: "3.7"

services:
  smtp:
    image: docker.io/devture/exim-relay:SOME_TAGGED_RELEASE
    user: 100:101
    restart: always
    ports:
      - "25:8025"
    environment:
      HOSTNAME: my.host.name
      SMARTHOST: some.relayhost.name::587
      SMTP_USERNAME: someuser
      SMTP_PASSWORD: password

Other Variables

HOSTNAME

• The hostname that is sent as part of the HELO message.

LOCAL_DOMAINS

• List (colon separated) of domains that are delivered to the local machine
• Defaults to the hostname of the local machine
• Set blank to have no mail delivered locally

RELAY_FROM_HOSTS

• A list (colon separated) of subnets to allow relay from
• Set to "*" to allow any host to relay - use this with RELAY_TO_DOMAINS to allow any client to relay to a list of domains
• Defaults to private address ranges: 10.0.0.0/8:172.16.0.0/12:192.168.0.0/16

RELAY_TO_DOMAINS

• A list (colon separated) of domains to allow relay to
• Defaults to "*" to allow relaying to all domains
• Setting both RELAY_FROM_HOSTS and RELAY_TO_DOMAINS to "*" will make this an open relay
• Setting both RELAY_FROM_HOSTS and RELAY_TO_DOMAINS to other values will limit which clients can send and who they can send to

RELAY_TO_USERS

• A whitelist (colon separated) of recipient email addresses to allow relay to
• This list is processed in addition to the domains in RELAY_TO_DOMAINS
• Use this for more precise whitelisting of relayable mail
• Defaults to "" which doesn't whitelist any addresses

DISABLE_SENDER_VERIFICATION

If the environment variable is set, sender address verification will be disabled.

SMARTHOST

• A relay host to forward all non-local email through

SMTP_USERNAME

• The username for authentication to the smarthost

SMTP_PASSWORD

• The password for authentication to the smarthost - leave this blank to disable authenticaion

Docker Secrets

The smarthost password can also be supplied via docker swarm secrets / rancher secrets. Create a secret called SMTP_PASSWORD and don't use the SMTP_PASSWORD environment variable

Debugging

The logs are sent to /dev/stdout and /dev/stderr and can be viewed via docker logs

docker logs smtp

docker logs -f smtp

Exim commands can be run to check the status of the mail server as well

docker exec -ti smtp exim -bp

exim-relay's Issues

Docker secrets file is not working

I tried to set up the SMTP password as docker secret, but it's not working

config:

    secrets:
      - source: myapp_smtp_password
        target: SMTP_PASSWORD

logs:

[email protected] R=smarthost T=remote_smtp defer (-42): authentication required but no common mechanisms were found

arm64

Can you provide builds for Raspberry Pi 4?

Offer :latest tag

It would be great if a latest tag was provided for this image. I understand that latest is not recommended in production but I am using this image on a personal deployment for sending email alerts. I would rather get security updates automatically and deal with the risk that during an update something breaks than miss a security update.

Thanks for the image!

SMTP authentication

Hi,

First of all, thanks for this nice project!

I have a little question, is it possible to add SMTP authentication to the implementation?
I did found this blog where the writer tells you how to add it to a normal installation:
https://bobcares.com/blog/exim4-smtp-authentication/

I can, of course, use the config of this project, change it and make it persistent... When I do that I might miss some future updates.

The reason behind this question is that the self hosted version of n8n is requiring and SMTP username and password when you want to activate user management. And I must admit that I do like the idea that only authenticated projects can use the exim-relay. You never know when your computer gets infected and starts sending emails using the :25 on your network ;)

Exim docker container debug logging

Hi @spantaleev

I based a docker container on your exim-relay from this repo.
I would like to ask you do you know how to get the most detailed debug logging?

I tried putting in log_selector = +all exim.conf but im still missing a lot of logging, doest seem to make much of a difference, if at all.

Not sure why, if there is not more logging or that this alpine exim package is limited in some way?
Hope you can shed some light on it. Or have a way to get detailed logging. I am currently facing a issue with relaying to another exim server, with the starttls tls upgrade seems to fail. I would like to log everything including the tls handshake.

Thanks

Is it possible to configure DKIM?

Manifest missing

Hi,

It'd also appread the image is missing:

 % docker pull devture/exim-relay:4.93.1-r0

Error response from daemon: manifest for devture/exim-relay:4.93.1-r0 not found: manifest unknown: manifest unknown

The manifest appears to be missing on all tags

Kubernetes compatibility

As par this SO question, the --init flag and init docker-compose key are unknown from Kubernetes.

It would be great to have Tini included in this image, avoiding to use that --init flag, and making this image Kubernetes compatible.