The Exim development team released 4.100-RC3 on August 13, marking the third and final release candidate before the stable major update ships. The new branch introduces native DMARC evaluation, expanded log selectors, and a musl DNS out-of-bounds read fix for containerized environments. Legacy malware scanner bridges and outdated protocol support have been removed alongside a new versioning structure that separates security patches onto a dedicated branch. Operators running mail infrastructure should test the release candidate now, with the official 4.100 tag expected within weeks.

Exim 4.100-RC3 Ships With Feature Freeze, Pointing to Imminent Final Release

The Exim development team released Exim 4.100-RC3 on August 13, and if you run mail infrastructure on Unix or Linux, it's the build you should test next. Bernard Quatermass announced it on the project mailing list with the telltale sign of a team that knows exactly when a release candidate is done: "Time for another RC (are we there yet ?)." The sourcebase is officially closed for feature additions. The stable 4.100 release is just waiting on a few more weeks of RC polish.

Exim remains the open-source workhorse MTA that replaced Sendmail for a generation of sysadmins. Originally built at the University of Cambridge by Philip Hazel, it's shipped on GNU GPL and sits in place of proprietary mail transports across millions of servers. The current production line rests at 4.99.5, a security patch addressing two CVEs. Everything new in 4.100 layers on top of that maintenance branch, which means you get hardening and bugfixes alongside the headline changes.

What's Actually New in 4.100

The change operators have been asking about for years is native DMARC evaluation. The new EXPERIMENTAL_DMARC_NATIVE compile flag lets Exim validate DMARC records without shelling out to an external validator. Less latency. Fewer moving parts. The domain lookup table also gains psl and regdom entries, which parse public suffix and registered domains directly from a Public Suffix List file. That's useful for DMARC alignment checks and basic anti-phishing routing.

Log selectors got a long overdue expansion. You can now dial in spf, spf_verbose, dmarc, dmarc_verbose, and dsn independently. If your syslog is already loud enough, granular controls are a relief. The daemon inspection tool exiwhat now reports SMTP and queue-run child process counts, which saves you from running an extra ps command just to eyeball load.

RC3 specifically adds an out-of-bounds read fix for DNS resolution when Exim is compiled against musl. If you're running Alpine-based containers or any musl distro, this one matters. The package also carries forward fixes for GnuTLS hostname verification against zero-length subject certificates, correct handling of empty envelope senders in DMARC checks, and a rejection of tainted format strings in internal printf calls. Not a single CVE to ignore.

What's Gone and How the Cadence Shifts

The old-school malware scanner bridges are gone. f-prot6, sophie, drweb, mksd, and a handful of others have been purged from the tree. So is legacy Interbase and Brightmail protocol support. If you were still relying on those, the path forward is a third-party integration or a modern scanner. It's a pragmatic cleanup. Those engines haven't been actively maintained in years, and keeping their code in the tree was just technical debt waiting to bite.

The project also announced a structural change to how it will version going forward. After 4.100, the master branch will only hold 4.yyy and 4.yyy.zz releases. Security patches and minor fixes get the .zz suffix, and all intermediate development for 4.101 and beyond moves to a 4.next branch. RCs for the next major version will tag there. It mirrors the cadence most other major open-source projects use, and it should make tracking security updates a lot less confusing.

"The sourcebase is now closed for feature additions at this point in the release process." That line in the announcement is developer speak for "we're done writing. We're just testing now."

You can grab the source in tar.bz2, tar.gz, or tar.xz formats from ftp.exim.org. The full SHA256 sums and GPG key (0xBCE58C8CE41F32DF) are published alongside the release. The RC tag is exim-4.100-RC3 on code.exim.org.

If your mail infrastructure has to survive the next round of authentication policy changes, 4.100 is the branch to plan around.