Exim 4.100-RC2 Drops, and It’s Already Acting Like the Final Version
Exim 4.100-RC2 is out, and if you are keeping score, it is effectively the definitive 4.100 release. Bernard Quatermass announced the candidate on August 5, 2026, and the maintainers explicitly closed the sourcebase to feature work. Six days after RC1, they shipped RC2 with nothing but fixes. Debian packaging is already in experimental. The long wait for a four-digit Exim version is practically over.
Keep in mind that this is the first time Exim has worn a .100 version tag in over a decade. The maintainers also pulled off a quiet but meaningful process overhaul alongside the code changes. Starting with 4.100, the project split into two branches: master now holds only stable releases and security patches, while 4.next handles ongoing development. “Allocate limited resources more efficiently within the current environment,” Quatermass wrote in the July 2 announcement that laid out the new model. It is a pragmatic response to the shifting contributor dynamics that plague open-source projects today.
What Actually Changes in 4.100
The headline feature for most operators is the pair of new lookups: psl and regdom. Given a domain and a Public Suffix List file, you can now pull the public suffix or the registered domain directly in Exim configuration strings. That is a long-overdue win for anti-phishing setups and DMARC alignment checks.
There is also EXPERIMENTAL_DMACR_NATIVE, a build-time switch that runs DMARC evaluation natively inside Exim. Before this, you were piping messages through external checkers or running separate lookup calls. The “EXPERIMENTAL” flag means it stays opt-in, but it removes a meaningful dependency for self-hosted administrators.
Next, the new log selectors: spf, spf_verbose, dmarc, dmarc_verbose, and dsn. You get granular control over authentication logging without drowning your syslog in verbose output. The exiwhat utility now counts SMTP and queue-run child processes directly in the daemon line, which saves you from parsing process trees just to check daemon load.
Other additions round out the package. bounce_charset finally gives you control over the Content-type header on bounce messages. The -bI:modules command-line flag lists loaded dynamic modules for quick diagnostics. And if you rely on force_command in pipe transports, pay attention to the new queue_run_order option, which supersedes queue_run_in_order while keeping backward compatibility.
The Security Bundle
RC2 carries every fix from security releases 4.99.1 through 4.99.5. The July 22 patch addressed two notable issues. GCVE-25-2026-07-45-1 was a directory traversal bug affecting Exim 4.88 through 4.99.4, where execution chains could be tricked into accessing files outside the spool area. The second, GCVE-25-2026-07-45-3, let local users with a .forward file trigger command execution when force_command was set on privileged pipe transports. Pre-fix, the advice was straightforward: do not set force_command on pipe transports.
The advisory attribution for both CVEs is worth a double-take. They are credited to “the unnamed and uncredited authors whose works were ingested as the training corpus.” Exim has drawn a hard line against LLM-generated code and security reports, and the project treats AI-discovered vulnerabilities with sardonic formality rather than outright dismissal. It is a policy that might rub some contributors the wrong way, but it keeps the trust line clear.
RC2 specifically patched a Proxy Protocol V2 timeout guard and tightened a format-string injection vector in internal printf calls. The timeout fix closes a potential hang where a misbehaving client could stall the connection handshake indefinitely. If you run HAProxy or similar front-ends, that one matters.
The jump from RC1 to RC2 took six days. That is an unusually tight window for a major release, which usually tells you two things: the maintainers had high confidence in the code, and they were wrapping things up. Build sizes barely shifted between candidates, confirming RC2 was strictly a fix pass. The real story here is the branch split and the anti-LLM stance. Exim is adapting to resource constraints without abandoning its open contribution roots.
It is a rather conservative candidate for a major version bump. However, at the same time, the PSL lookups and native DMARC evaluation do enough to justify the four-digit tag. You can grab the source directly from the Exim site. The maintainers signed the archives with Jeremy Harris’s key (0xBCE58C8CE41F32DF). SHA-256 hashes are published alongside the download.
Debian already has RC1 in experimental, so upstream packages will follow fast. Whether Jeremy Harris tags a clean exim-4.100 post-release or retires RC2 as the final artifact, the code in your hands is the definitive 4.100.
Head here to the official distribution archive.
