Previous   Next   Contents       (Exim 4.50 Specification)

52. Format of spool files

A message on Exim's queue consists of two files, whose names are the message id followed by -D and -H, respectively. The data portion of the message is kept in the -D file on its own. The message's envelope, status, and headers are all kept in the -H file, whose format is described in this chapter. Each of these two files contains the final component of its own name as its first line. This is insurance against disk crashes where the directory is lost but the files themselves are recoverable.

Some people are tempted into editing -D files in order to modify messages. You need to be extremely careful if you do this; it is not recommended and you are on your own if you do it. Here are some of the pitfalls:

Files whose names end with -J may also be seen in the input directory (or its subdirectories when split_spool_directory is set). These are journal files, used to record addresses to which the message has been delivered during the course of a delivery run. At the end of the run, the -H file is updated, and the -J file is deleted.

52.1 Format of the -H file

The second line of the -H file contains the login name for the uid of the process that called Exim to read the message, followed by the numerical uid and gid. For a locally generated message, this is normally the user who sent the message. For a message received over TCP/IP, it is normally the Exim user.

The third line of the file contains the address of the message's sender as transmitted in the envelope, contained in angle brackets. The sender address is empty for bounce messages. For incoming SMTP mail, the sender address is given in the MAIL command. For locally generated mail, the sender address is created by Exim from the login name of the current user and the configured qualify_domain. However, this can be overridden by the -f option or a leading “From” line if the caller is trusted, or if the supplied address is “<>” or an address that matches untrusted_set_senders.

The fourth line contains two numbers. The first is the time that the message was received, in the conventional Unix form – the number of seconds since the start of the epoch. The second number is a count of the number of messages warning of delayed delivery that have been sent to the sender.

There follow a number of lines starting with a hyphen. These can appear in any order, and are omitted when not relevant:

Following the options there is a list of those addresses to which the message is not to be delivered. This set of addresses is initialized from the command line when the -t option is used and extract_addresses_remove_arguments is set; otherwise it starts out empty. Whenever a successful delivery is made, the address is added to this set. The addresses are kept internally as a balanced binary tree, and it is a representation of that tree which is written to the spool file. If an address is expanded via an alias or forward file, the original address is added to the tree when deliveries to all its child addresses are complete.

If the tree is empty, there is a single line in the spool file containing just the text “XX”. Otherwise, each line consists of two letters, which are either Y or N, followed by an address. The address is the value for the node of the tree, and the letters indicate whether the node has a left branch and/or a right branch attached to it, respectively. If branches exist, they immediately follow. Here is an example of a three-node tree:

  YY darcy@austen.fict.example
  NN alice@wonderland.fict.example
  NN editor@thesaurus.ref.example

After the non-recipients tree, there is a list of the message's recipients. This is a simple list, preceded by a count. It includes all the original recipients of the message, including those to whom the message has already been delivered. In the simplest case, the list contains one address per line. For example:


However, when a child address has been added to the top-level addresses as a result of the use of the one_time option on a redirect router, each line is of the following form:

  <top-level address> <errors_to address> <length>,<parent number>#<flag bits>

The 01 flag bit indicates the presence of the three other fields that follow the top-level address. Other bits may be used in future to support additional fields. The <parent number> is the offset in the recipients list of the original parent of the “one time” address. The first two fields are the envelope sender that is associated with this address and its length. If the length is zero, there is no special envelope sender (there are then two space characters in the line). A non-empty field can arise from a redirect router that has an errors_to setting.

A blank line separates the envelope and status information from the headers which follow. A header may occupy several lines of the file, and to save effort when reading it in, each header is preceded by a number and an identifying character. The number is the number of characters in the header, including any embedded newlines and the terminating newline. The character is one of the following:

  <blank>  header in which Exim has no special interest
   B  Bcc: header
   C  Cc: header
   F  From: header
   I  Message-id: header
   P  Received: header – P for “postmark”
   R  Reply-To: header
   S  Sender: header
   T  To: header
   *  replaced or deleted header

Deleted or replaced (rewritten) headers remain in the spool file for debugging purposes. They are not transmitted when the message is delivered. Here is a typical set of headers:

  111P Received: by hobbit.fict.example with local (Exim 4.00)
          id 14y9EI-00026G-00; Fri, 11 May 2001 10:28:59 +0100
  049  Message-Id: <E14y9EI-00026G-00@hobbit.fict.example>
  038* X-rewrote-sender: bb@hobbit.fict.example
  042* From: Bilbo Baggins <bb@hobbit.fict.example>
  049F From: Bilbo Baggins <B.Baggins@hobbit.fict.example>
  099* To: alice@wonderland.fict.example, rdo@foundation,
   darcy@austen.fict.example, editor@thesaurus.ref.example
  109T To: alice@wonderland.fict.example, rdo@foundation.fict.example,
   darcy@austen.fict.example, editor@thesaurus.ref.example
  038  Date: Fri, 11 May 2001 10:28:59 +0100

The asterisked headers indicate that the envelope sender, From: header, and To: header have been rewritten, the last one because routing expanded the unqualified domain foundation.

Previous  Next  Contents       (Exim 4.50 Specification)