{"id":121,"date":"2025-09-20T18:37:58","date_gmt":"2025-09-20T13:07:58","guid":{"rendered":"https:\/\/vvcares.com\/blog\/?p=121"},"modified":"2025-09-23T18:44:48","modified_gmt":"2025-09-23T13:14:48","slug":"how-to-configure-exim4-as-smarthost-with-mailjet","status":"publish","type":"post","link":"https:\/\/vvcares.com\/blog\/how-to-configure-exim4-as-smarthost-with-mailjet\/","title":{"rendered":"How to configure Exim4 as Smarthost with Mailjet"},"content":{"rendered":"\r\n

Below is a minimal \u201cone\u2011file\u201d change<\/strong> that will make your Ubuntu\u2011based Exim4 instance forward all outbound mail<\/a><\/em> to Mailjet\u2019s SMTP relay.
Everything you need lives in \/etc\/exim4\/exim4.conf.template<\/code><\/strong> \u2013 just edit that file, run update-exim4.conf<\/code> (or sudo service exim4 restart<\/code>), and you\u2019re done.<\/p>\r\n\r\n\r\n

\r\n\r\n\r\n

1. What to change (quick\u2011reference list)<\/h2>\r\n\r\n\r\n\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Section<\/th>\r\nSetting<\/th>\r\nWhat to put<\/th>\r\nWhy<\/th>\r\n<\/tr>\r\n<\/thead>\r\n
System identity<\/strong><\/td>\r\nprimary_hostname<\/code><\/td>\r\nmail.yourdomain.com<\/code><\/td>\r\nThe name your server advertises.<\/td>\r\n<\/tr>\r\n
\u00a0<\/td>\r\nappend_dot_mydomain<\/code><\/td>\r\nyes<\/code><\/td>\r\nEnsures local\u2011look\u2011ups are resolved correctly.<\/td>\r\n<\/tr>\r\n
\u00a0<\/td>\r\nlocal_domains<\/code><\/td>\r\n+local_domains<\/code><\/td>\r\nKeeps local mail (if you still need it).<\/td>\r\n<\/tr>\r\n
\u00a0<\/td>\r\nlocal_delivery_class<\/code><\/td>\r\nlocal<\/code><\/td>\r\nStill deliver local mail locally (optional).<\/td>\r\n<\/tr>\r\n
SMTP Relay (Router)<\/strong><\/td>\r\nAdd smarthost<\/code> router<\/td>\r\nSee snippet below<\/td>\r\nRoutes every<\/em> non\u2011local recipient through Mailjet.<\/td>\r\n<\/tr>\r\n
Transport<\/strong><\/td>\r\nAdd remote_smtp<\/code> transport<\/td>\r\nSee snippet below<\/td>\r\nHandles the actual SMTP push to Mailjet.<\/td>\r\n<\/tr>\r\n
Authentication<\/strong><\/td>\r\nAdd an authenticator<\/td>\r\nSee snippet below<\/td>\r\nSupplies your Mailjet API\/Secret pair.<\/td>\r\n<\/tr>\r\n
TLS<\/strong><\/td>\r\ntls_on_connect_ports<\/code><\/td>\r\n587<\/code><\/td>\r\nForces TLS on the outbound connection.<\/td>\r\n<\/tr>\r\n
\u00a0<\/td>\r\ntls_advertise_hosts<\/code><\/td>\r\n+my_domains<\/code><\/td>\r\nOptional \u2013 lets clients know you support TLS.<\/td>\r\n<\/tr>\r\n
\u00a0<\/td>\r\ntls_certificate, tls_private_key<\/code><\/td>\r\nIf you want your own cert (optional)<\/td>\r\nNot required for Mailjet.<\/td>\r\n<\/tr>\r\n
Logging<\/strong><\/td>\r\nlog_output<\/code><\/td>\r\nverbose<\/code> (or keep default)<\/td>\r\nHelps debug if something goes wrong.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<\/figure>\r\n\r\n\r\n\r\n
\r\n

NOTE<\/strong> \u2013 The snippets below replace<\/em> the default router\/transport blocks that point to localhost<\/code>.
If you want to keep the default configuration (e.g., for local delivery) you can prepend<\/strong> these blocks (or put them after<\/em> the existing ones).
The smarthost<\/code> router should be positioned after<\/em> any local\u2011delivery routers so that local mail still goes to \/var\/mail\/*<\/code>.<\/p>\r\n<\/blockquote>\r\n\r\n\r\n

\r\n\r\n\r\n

2. Full example \u2013 replace the relevant parts<\/h2>\r\n\r\n\r\n\r\n
# --------------------------------------------------\r\n# System identity\r\n# --------------------------------------------------\r\nprimary_hostname = mail.yourdomain.com\r\nappend_dot_mydomain = yes\r\nlocal_domains = +local_domains\r\nlocal_delivery_class = local\r\n\r\n# --------------------------------------------------\r\n# Routers\r\n# --------------------------------------------------\r\n# 1.  Default local delivery router (kept from default config)\r\n#    (Assuming you still want to deliver to local* if needed)\r\nlocal_delivery:\r\n  driver = accept\r\n  domains = +local_domains\r\n  transport = local_delivery\r\n  local_transport = local_delivery\r\n\r\n# 2.  Smarthost router \u2013 everything that is *not* local goes to Mailjet\r\nsmarthost:\r\n  driver = manualroute\r\n  domains = ! +local_domains\r\n  transport = remote_smtp\r\n  route_list = * smtp.mailjet.com byname\r\n  # Timeout settings (optional)\r\n  timeout = 60\r\n\r\n# --------------------------------------------------\r\n# Transports\r\n# --------------------------------------------------\r\n# 1.  Local delivery transport (kept)\r\nlocal_delivery:\r\n  driver = appendfile\r\n  delivery_date_add\r\n  envelope_to_add\r\n  return_path_add\r\n  mail_dir = \/var\/mail\/\r\n\r\n# 2.  Remote SMTP transport \u2013 talks to Mailjet\r\nremote_smtp:\r\n  driver = smtp\r\n  port = 587\r\n  hosts = smtp.mailjet.com\r\n  # Use TLS \u2013 Mailjet requires it\r\n  tls_on_connect_ports = 587\r\n  tls_require = yes\r\n  tls_verify_hosts = +my_domains\r\n  # Authentication\r\n  auth = mailjet\r\n\r\n# --------------------------------------------------\r\n# Authenticators\r\n# --------------------------------------------------\r\n# Mailjet credentials\r\nmailjet:\r\n  driver = plain\r\n  # The API key and Secret key \u2013 replace these!\r\n  server_username = YOUR_API_KEY\r\n  server_password = YOUR_SECRET_KEY\r\n  # TLS required for authentication\r\n  server_use_tls = true\r\n  server_address = smtp.mailjet.com\r\n  server_port = 587\r\n  auth_type = login\r\n\r\n# --------------------------------------------------\r\n# Logging (optional \u2013 leave as default or set to verbose)\r\n# --------------------------------------------------\r\nlog_output = verbose\r\n\r\n# --------------------------------------------------\r\n# End of template\r\n# --------------------------------------------------<\/code><\/pre>\r\n\r\n\r\n\r\n
What each new block does<\/h3>\r\n\r\n\r\n\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Block<\/th>\r\nPurpose<\/th>\r\n<\/tr>\r\n<\/thead>\r\n
smarthost<\/code> router<\/strong><\/td>\r\nCatches any<\/em> recipient that is not<\/strong> a local domain and forces the message through the remote_smtp<\/code> transport.<\/td>\r\n<\/tr>\r\n
remote_smtp<\/code> transport<\/strong><\/td>\r\nConnects to smtp.mailjet.com<\/code> on port 587, forces TLS, and uses the mailjet<\/code> authenticator.<\/td>\r\n<\/tr>\r\n
mailjet<\/code> authenticator<\/strong><\/td>\r\nSupplies your API Key<\/strong> as the username and Secret Key<\/strong> as the password to Mailjet. TLS is mandatory for authentication.<\/td>\r\n<\/tr>\r\n
local_domains<\/code> \/ local_delivery<\/code><\/strong><\/td>\r\nKeeps the default local mail delivery if you still need it. If you only<\/em> want to use Mailjet, you can delete the local router\/transport blocks entirely.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<\/figure>\r\n\r\n\r\n
\r\n\r\n\r\n
3. Apply the changes<\/h2>\r\n\r\n\r\n\r\n
# 1. Edit the file\r\nsudo nano \/etc\/exim4\/exim4.conf.template\r\n\r\n# 2. Re\u2011compile the template into the actual config\r\nsudo update-exim4.conf\r\n\r\n# 3. Restart Exim\r\nsudo systemctl restart exim4\r\n\r\n# 4. Verify\r\n#   - Check that Exim is listening on port 25\/587\r\n#   - Send a test mail: echo \"test\" | mail -s \"Test\" you@example.com\r\n#   - Inspect \/var\/log\/exim4\/mainlog for the SMTP conversation

Ref: Exim4 on Ubuntu<\/a><\/code><\/pre>\r\n\r\n\r\n
\r\n\r\n\r\n
4. Troubleshooting tips<\/h2>\r\n\r\n\r\n\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Symptom<\/th>\r\nLikely cause<\/th>\r\nFix<\/th>\r\n<\/tr>\r\n<\/thead>\r\n
No mail delivered, error \u201cauthentication failed\u201d<\/td>\r\nWrong API\/Secret key<\/td>\r\nDouble\u2011check the keys in the mailjet<\/code> authenticator.<\/td>\r\n<\/tr>\r\n
No TLS handshake<\/td>\r\ntls_on_connect_ports<\/code> missing or wrong<\/td>\r\nEnsure the transport uses tls_on_connect_ports = 587<\/code>.<\/td>\r\n<\/tr>\r\n
Mail goes to local mailbox instead of Mailjet<\/td>\r\nRouter order wrong<\/td>\r\nMake sure smarthost<\/code> router appears after<\/strong> the local\u2011delivery router.<\/td>\r\n<\/tr>\r\n
Exim complains \u201cunknown router smarthost\u201d<\/td>\r\nSyntax error in template<\/td>\r\nVerify that the block names are correct and no stray characters.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<\/figure>\r\n\r\n\r\n
\r\n\r\n\r\n
5. Optional: Advanced tweaks<\/h2>\r\n\r\n\r\n\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Feature<\/th>\r\nHow to add<\/th>\r\n<\/tr>\r\n<\/thead>\r\n
Per\u2011domain routing<\/strong><\/td>\r\nAdd additional routers with domains = yourdomain.com<\/code> and route_list = * smtp.mailjet.com<\/code>.<\/td>\r\n<\/tr>\r\n
SSL certificate for your own SMTP<\/strong><\/td>\r\nAdd tls_certificate<\/code>\/tls_private_key<\/code> under the remote_smtp<\/code> transport (optional).<\/td>\r\n<\/tr>\r\n
Logging more verbosely<\/strong><\/td>\r\nSet log_output = verbose<\/code> or add debug_output = yes<\/code>.<\/td>\r\n<\/tr>\r\n
Firewall<\/strong><\/td>\r\nMake sure outgoing port 587 is allowed (ufw allow out 587<\/code>).<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<\/figure>\r\n\r\n\r\n
\r\n\r\n\r\n
Bottom line<\/h3>\r\n\r\n\r\n\r\n
    \r\n
  1. Update primary_hostname<\/code>, local_domains<\/code>, etc.<\/strong> \u2013 keep your local mail if needed.<\/li>\r\n\r\n\r\n\r\n
  2. Add a smarthost<\/code> router<\/strong> that points to smtp.mailjet.com<\/code>.<\/li>\r\n\r\n\r\n\r\n
  3. Add a remote_smtp<\/code> transport<\/strong> that enforces TLS and uses the mailjet<\/code> authenticator.<\/li>\r\n\r\n\r\n\r\n
  4. Define the mailjet<\/code> authenticator<\/strong> with your API & Secret keys.<\/li>\r\n\r\n\r\n\r\n
  5. Re\u2011compile & restart Exim.<\/strong><\/li>\r\n<\/ol>\r\n\r\n\r\n\r\n
    That\u2019s all you need \u2013 no other files, no extra services. Happy sending!<\/p>\r\n","protected":false},"excerpt":{"rendered":"
    Below is a minimal \u201cone\u2011file\u201d change that will make your Ubuntu\u2011based Exim4 instance forward all outbound mail to Mailjet\u2019s SMTP relay.Everything you need lives in \/etc\/exim4\/exim4.conf.template \u2013 just edit that file, run update-exim4.conf (or sudo service exim4 restart), and you\u2019re done. 1. What to change (quick\u2011reference list) Section Setting What to put Why System identity […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,1],"tags":[],"class_list":["post-121","post","type-post","status-publish","format-standard","hentry","category-linux-ubuntu","category-servers"],"_links":{"self":[{"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/posts\/121","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/comments?post=121"}],"version-history":[{"count":3,"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/posts\/121\/revisions"}],"predecessor-version":[{"id":623,"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/posts\/121\/revisions\/623"}],"wp:attachment":[{"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/media?parent=121"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/categories?post=121"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vvcares.com\/blog\/wp-json\/wp\/v2\/tags?post=121"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}