How to Update Exim and Check Its Version

Exim is one of the most widespread mail servers: it is the default on Debian and part of cPanel, DirectAdmin and HestiaCP. Because of that, Exim vulnerabilities are actively hunted and exploited, and timely updates are a mandatory part of server maintenance.

Checking the current version

exim -bV | head -n 1

On Debian and Ubuntu the command may be called exim4:

exim4 -bV | head -n 1

The reply contains a line like Exim version 4.98 #2 built .... You can also get the installed package version from the package manager:

dpkg -l | grep exim4        # Debian, Ubuntu
rpm -q exim                 # AlmaLinux, Rocky Linux

Updating on Debian and Ubuntu

sudo apt update
sudo apt install --only-upgrade exim4 exim4-base exim4-config exim4-daemon-light

If the feature-rich variant is installed, use exim4-daemon-heavy instead of exim4-daemon-light. It is simpler to update every system package at once:

sudo apt update && sudo apt upgrade

Updating on AlmaLinux and Rocky Linux

Exim comes from the EPEL repository:

sudo dnf update exim

Servers with a control panel

Control panels build or ship Exim themselves, so update it with the panel’s tools rather than by hand — otherwise its configuration may break.

• cPanel: /scripts/upcp updates the panel together with Exim. Check that automatic updates are enabled under WHM → Update Preferences.
• DirectAdmin: updates go through CustomBuild: da build update and then da build exim.
• HestiaCP: Exim is installed from the distribution repository and updated with apt upgrade. More about the panel is in the HestiaCP installation guide.

After the update

Make sure the service started and mail is being sent:

sudo systemctl status exim4      # Debian, Ubuntu
sudo systemctl status exim       # AlmaLinux, Rocky Linux, cPanel

Check the message queue:

exim -bpc

The command prints the number of messages in the queue. A sharp rise after an update means delivery has stopped — the log will show why:

sudo tail -n 50 /var/log/exim4/mainlog     # Debian, Ubuntu
sudo tail -n 50 /var/log/exim/main.log     # AlmaLinux, Rocky Linux

Check the configuration syntax:

exim -bV > /dev/null && echo "Configuration is fine"

Automatic security updates

So that you do not depend on running updates by hand, enable automatic installation of security fixes.

Debian and Ubuntu:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

AlmaLinux and Rocky Linux:

sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer

If no update is available

Sometimes a vulnerability is already public while the fixed package is not out yet. In that case:

• restrict ports 25, 465 and 587 in the firewall if the server does not need to accept mail from outside;
• follow the security advisories of your distribution and control panel;
• if the distribution release is no longer supported, no Exim update will come for it — plan a move to a current release.

Do you need your own mail server

If Exim is installed only to send system notifications, close port 25 for incoming connections — that removes most of the risk. For full-featured mail on your own server, ready-made solutions such as Mailcow, which update with one command, are more convenient. Keep the server itself protected with Fail2Ban.