How to configure Exim4 as Smarthost with Mailjet

Below is a minimal “one‑file” change that will make your Ubuntu‑based Exim4 instance forward all outbound mail to Mailjet’s SMTP relay.
Everything you need lives in /etc/exim4/exim4.conf.template – just edit that file, run update-exim4.conf (or sudo service exim4 restart), and you’re done.

1. What to change (quick‑reference list)

Section	Setting	What to put	Why
System identity	`primary_hostname`	`mail.yourdomain.com`	The name your server advertises.
	`append_dot_mydomain`	`yes`	Ensures local‑look‑ups are resolved correctly.
	`local_domains`	`+local_domains`	Keeps local mail (if you still need it).
	`local_delivery_class`	`local`	Still deliver local mail locally (optional).
SMTP Relay (Router)	Add `smarthost` router	See snippet below	Routes every non‑local recipient through Mailjet.
Transport	Add `remote_smtp` transport	See snippet below	Handles the actual SMTP push to Mailjet.
Authentication	Add an authenticator	See snippet below	Supplies your Mailjet API/Secret pair.
TLS	`tls_on_connect_ports`	`587`	Forces TLS on the outbound connection.
	`tls_advertise_hosts`	`+my_domains`	Optional – lets clients know you support TLS.
	`tls_certificate, tls_private_key`	If you want your own cert (optional)	Not required for Mailjet.
Logging	`log_output`	`verbose` (or keep default)	Helps debug if something goes wrong.

NOTE – The snippets below replace the default router/transport blocks that point to localhost.
If you want to keep the default configuration (e.g., for local delivery) you can prepend these blocks (or put them after the existing ones).
The smarthost router should be positioned after any local‑delivery routers so that local mail still goes to /var/mail/*.

2. Full example – replace the relevant parts

# --------------------------------------------------
# System identity
# --------------------------------------------------
primary_hostname = mail.yourdomain.com
append_dot_mydomain = yes
local_domains = +local_domains
local_delivery_class = local

# --------------------------------------------------
# Routers
# --------------------------------------------------
# 1.  Default local delivery router (kept from default config)
#    (Assuming you still want to deliver to local* if needed)
local_delivery:
  driver = accept
  domains = +local_domains
  transport = local_delivery
  local_transport = local_delivery

# 2.  Smarthost router – everything that is *not* local goes to Mailjet
smarthost:
  driver = manualroute
  domains = ! +local_domains
  transport = remote_smtp
  route_list = * smtp.mailjet.com byname
  # Timeout settings (optional)
  timeout = 60

# --------------------------------------------------
# Transports
# --------------------------------------------------
# 1.  Local delivery transport (kept)
local_delivery:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add
  mail_dir = /var/mail/

# 2.  Remote SMTP transport – talks to Mailjet
remote_smtp:
  driver = smtp
  port = 587
  hosts = smtp.mailjet.com
  # Use TLS – Mailjet requires it
  tls_on_connect_ports = 587
  tls_require = yes
  tls_verify_hosts = +my_domains
  # Authentication
  auth = mailjet

# --------------------------------------------------
# Authenticators
# --------------------------------------------------
# Mailjet credentials
mailjet:
  driver = plain
  # The API key and Secret key – replace these!
  server_username = YOUR_API_KEY
  server_password = YOUR_SECRET_KEY
  # TLS required for authentication
  server_use_tls = true
  server_address = smtp.mailjet.com
  server_port = 587
  auth_type = login

# --------------------------------------------------
# Logging (optional – leave as default or set to verbose)
# --------------------------------------------------
log_output = verbose

# --------------------------------------------------
# End of template
# --------------------------------------------------

What each new block does

Block	Purpose
`smarthost` router	Catches any recipient that is not a local domain and forces the message through the `remote_smtp` transport.
`remote_smtp` transport	Connects to `smtp.mailjet.com` on port 587, forces TLS, and uses the `mailjet` authenticator.
`mailjet` authenticator	Supplies your API Key as the username and Secret Key as the password to Mailjet. TLS is mandatory for authentication.
`local_domains` / `local_delivery`	Keeps the default local mail delivery if you still need it. If you only want to use Mailjet, you can delete the local router/transport blocks entirely.

3. Apply the changes

# 1. Edit the file
sudo nano /etc/exim4/exim4.conf.template

# 2. Re‑compile the template into the actual config
sudo update-exim4.conf

# 3. Restart Exim
sudo systemctl restart exim4

# 4. Verify
#   - Check that Exim is listening on port 25/587
#   - Send a test mail: echo "test" | mail -s "Test" [email protected]
#   - Inspect /var/log/exim4/mainlog for the SMTP conversation

Ref: Exim4 on Ubuntu

4. Troubleshooting tips

Symptom	Likely cause	Fix
No mail delivered, error “authentication failed”	Wrong API/Secret key	Double‑check the keys in the `mailjet` authenticator.
No TLS handshake	`tls_on_connect_ports` missing or wrong	Ensure the transport uses `tls_on_connect_ports = 587`.
Mail goes to local mailbox instead of Mailjet	Router order wrong	Make sure `smarthost` router appears after the local‑delivery router.
Exim complains “unknown router smarthost”	Syntax error in template	Verify that the block names are correct and no stray characters.

5. Optional: Advanced tweaks

Feature	How to add
Per‑domain routing	Add additional routers with `domains = yourdomain.com` and `route_list = * smtp.mailjet.com`.
SSL certificate for your own SMTP	Add `tls_certificate`/`tls_private_key` under the `remote_smtp` transport (optional).
Logging more verbosely	Set `log_output = verbose` or add `debug_output = yes`.
Firewall	Make sure outgoing port 587 is allowed (`ufw allow out 587`).

Bottom line

Update primary_hostname, local_domains, etc. – keep your local mail if needed.
Add a smarthost router that points to smtp.mailjet.com.
Add a remote_smtp transport that enforces TLS and uses the mailjet authenticator.
Define the mailjet authenticator with your API & Secret keys.
Re‑compile & restart Exim.

That’s all you need – no other files, no extra services. Happy sending!