Exim Ships 4.100, Marking Three Decades of Continuous SMTP Infrastructure Development
The Linux mail transfer agent's most critical update in years drops today, consolidating features and patching regressions from the 4.99 cycle.
Exim has shipped version 4.100. The source tarballs hit downloads.exim.org today, August 20, 2026, landing exactly three decades after Philip Hazel first wrote the project at the University of Cambridge in 1995. The jump from .9x to 100 isn't arbitrary. It's a milestone for the longest-running active mail transfer agent in the Linux ecosystem.
Keep in mind that the project's main page still lists 4.99.5 as the current stable release, published just two months ago in June. But the 4.100 tarballs are real, signed, and sitting in the downloads directory. This is a development milestone, not a marketing gimmick. It represents two years of consolidating experimental features, patching regressions from the 4.99 release cycle, and tightening security posture. Philip Hazel was blunt about older versions when asked about the legacy Exim 3 line, noting on the project's homepage that it is twenty years obsolete and should not be used. He hasn't weighed in publicly on the 4.100 bump, but maintainer Heiko Schlittermann and the core team have been clear that security advisories and coordinated CVE response drive the day-to-day workflow.
Security and Regressions
The 4.99 cycle introduced its share of rough edges. Exim 4.100 specifically addresses a use-after-free during duplicate processing, a crash caused by uninitialized pointers after deferred local deliveries, and a performance regression where remote deliveries hammered DNS servers for destinations returning temporary errors. There's also a fix for RFC 2047 encoding that previously allowed the first encoded-word to exceed the size limit. If you've been watching your logs for weird header corruption lately, this might be worth investigating.
The security hardening is where the real operational value lies. Taint tracking now extends to certextract expansions, meaning endpoint certificates are actually marked tainted instead of silently leaking untrusted data into expansion contexts. The eval operator refuses tainted arguments now, closing a path that could let malicious sender input reach arithmetic evaluation. Four high-severity CVEs were patched between April and August 2026 alone, and the PROXYv2 parser now validates minimum payload lengths before reading stack bytes. Not cheap in terms of development effort, but necessary for a daemon that sits at the edge of the internet.
What Actually Changed in 4.100
Native DMARC evaluation is no longer behind a flag. Public Suffix List lookups (psl and regdom) are finally here, which matters for DMARC policy checks and anti-spam heuristics. You'll also get three new log selectors (spf, dmarc, dsn), a -bI:modules flag to enumerate dynamically loaded components, and a Sieve body extension that finally lets server-side filters inspect message content instead of just headers.
The configuration language keeps growing. Nongreedy wildcards in local-part affix patterns give you more precise routing control. Router and transport options now support full string expansion before use, which trims down boilerplate for dynamic setups. On the build side, macOS support has been gone since 4.95, and OpenSSL 0.9.x is firmly in the dustbin. The build system now relies on pkg-config and pcre-config for library references. You'll need TLS extensions, SHA-256, ECDH, and OCSP features in your OpenSSL library.
One of the more interesting architectural shifts is the push toward loadable modules. You can now compile nearly all lookups, authenticators, and transports as dynamic modules, with only the SMTP transport baked into the core binary. It reduces the attack surface and makes auditing simpler. The new -bI:modules flag gives you operational visibility into what's actually loaded.
All tarballs are cryptographically signed. Head here to pull the source. The maintainers' keyring is available here. Verify the signatures before trusting anything.
