Merge branch 'master' into dane

Conflicts:
	doc/doc-txt/ChangeLog
	src/src/tls-openssl.c
	src/src/transports/smtp.c
	src/src/verify.c

146 files changed, 1507 insertions, 556 deletions

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index b6f387a1a..0775cb139 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -7266,7 +7266,7 @@ default list of ldap servers, and a single lookup can specify a single ldap
 server to use.  But when you need to do a lookup with a list of servers that is
 different than the default list (maybe different order, maybe a completely
 different set of servers), the SERVERS parameter allows you to specify this
-alternate list.
+alternate list (colon-separated).
 
 Here is an example of an LDAP query in an Exim lookup that uses some of these
 values. This is a single line, folded to fit on the page:
@@ -10997,12 +10997,10 @@ precedes the expansion of the string. For example, the commands available in
 Exim filter files include an &%if%& command with its own regular expression
 matching condition.
 
-.new
 .vitem "&$acl_arg1$&, &$acl_arg2$&, etc"
 Within an acl condition, expansion condition or expansion item
 any arguments are copied to these variables,
 any unused variables being made empty.
-.wen
 
 .vitem "&$acl_c...$&"
 Values can be placed in these variables by the &%set%& modifier in an ACL. They
@@ -11025,11 +11023,9 @@ message is received, the values of these variables are saved with the message,
 and can be accessed by filters, routers, and transports during subsequent
 delivery.
 
-.new
 .vitem &$acl_narg$&
 Within an acl condition, expansion condition or expansion item
 this variable has the number of arguments.
-.wen
 
 .vitem &$acl_verify_message$&
 .vindex "&$acl_verify_message$&"
@@ -11417,6 +11413,11 @@ the result, the name is not accepted, and &$host_lookup_deferred$& is set to
 .vindex "&$host_lookup_failed$&"
 See &$host_lookup_deferred$&.
 
+.vitem &$host_port$&
+.vindex "&$host_port$&"
+This variable is set to the remote host's TCP port whenever &$host$& is set
+for an outbound connection.
+
 
 .vitem &$inode$&
 .vindex "&$inode$&"
@@ -12359,7 +12360,9 @@ If TLS has not been negotiated, the value will be 0.
 This variable refers to the certificate presented to the peer of an
 inbound connection when the message was received.
 It is only useful as the argument of a
-&%certextract%& expansion item, &%md5%& or &%sha1%& operator,
+.new
+&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
+.wen
 or a &%def%& condition.
 
 .vitem &$tls_in_peercert$&
@@ -12367,21 +12370,27 @@ or a &%def%& condition.
 This variable refers to the certificate presented by the peer of an
 inbound connection when the message was received.
 It is only useful as the argument of a
-&%certextract%& expansion item, &%md5%& or &%sha1%& operator,
+.new
+&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
+.wen
 or a &%def%& condition.
 
 .vitem &$tls_out_ourcert$&
 .vindex "&$tls_out_ourcert$&"
 This variable refers to the certificate presented to the peer of an
 outbound connection.  It is only useful as the argument of a
-&%certextract%& expansion item, &%md5%& or &%sha1%& operator,
+.new
+&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
+.wen
 or a &%def%& condition.
 
 .vitem &$tls_out_peercert$&
 .vindex "&$tls_out_peercert$&"
 This variable refers to the certificate presented by the peer of an
 outbound connection.  It is only useful as the argument of a
-&%certextract%& expansion item, &%md5%& or &%sha1%& operator,
+.new
+&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
+.wen
 or a &%def%& condition.
 
 .vitem &$tls_in_certificate_verified$&
@@ -12421,6 +12430,24 @@ and then set to the outgoing cipher suite if one is negotiated. See chapter
 &<<CHAPTLS>>& for details of TLS support and chapter &<<CHAPsmtptrans>>& for
 details of the &(smtp)& transport.
 
+.vitem &$tls_in_ocsp$&
+.vindex "&$tls_in_ocsp$&"
+When a message is received from a remote client connection
+the result of any OCSP request from the client is encoded in this variable:
+.code
+0 OCSP proof was not requested (default value)
+1 No response to request
+2 Response not verified
+3 Verification failed
+4 Verification succeeded
+.endd
+
+.vitem &$tls_out_ocsp$&
+.vindex "&$tls_out_ocsp$&"
+When a message is sent to a remote host connection
+the result of any OCSP request made is encoded in this variable.
+See &$tls_in_ocsp$& for values.
+
 .vitem &$tls_in_peerdn$&
 .vindex "&$tls_in_peerdn$&"
 .vindex "&$tls_peerdn$&"
@@ -25376,6 +25403,7 @@ but it is present in many binary distributions.
 .scindex IIDdcotauth2 "authenticators" "&(dovecot)&"
 This authenticator is an interface to the authentication facility of the
 Dovecot POP/IMAP server, which can support a number of authentication methods.
+Note that Dovecot must be configured to use auth-client not auth-userdb.
 If you are using Dovecot to authenticate POP/IMAP clients, it might be helpful
 to use the same mechanisms for SMTP authentication. This is a server
 authenticator only. There is only one option:
@@ -26244,6 +26272,8 @@ file named by &%tls_ocsp_file%&.
 Note that the proof only covers the terminal server certificate,
 not any of the chain from CA to it.
 
+There is no current way to staple a proof for a client certificate.
+
 .code
   A helper script "ocsp_fetch.pl" for fetching a proof from a CA
   OCSP server is supplied.  The server URL may be included in the
@@ -27607,6 +27637,11 @@ anyway. If the message contains newlines, this gives rise to a multi-line SMTP
 response.
 
 .vindex "&$acl_verify_message$&"
+.new
+For ACLs that are called by an &%acl =%& ACL condition, the message is
+stored in &$acl_verify_message$&, from which the calling ACL may use it.
+.wen
+
 If &%message%& is used on a statement that verifies an address, the message
 specified overrides any message that is generated by the verification process.
 However, the original message is available in the variable
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index bb4752fbb..0bf49a7c5 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -12,6 +12,11 @@ TL/01 When running the test suite, the README says that variables such as
       variables, reset to the beginning of the script, and then run through
       the script parsing/test process like normal.
 
+TL/02 The BSD's have an arc4random API. One of the functions to induce
+      adding randomness was arc4random_stir(), but it has been removed in
+      OpenBSD 5.5. Detect this OpenBSD version and skip calling this
+      function when detected.
+
 
 Exim version 4.84
 -----------------
@@ -19,6 +24,14 @@ TL/01 Bugzilla 1506: Re-add a 'return NULL' to silence complaints from static
       checkers that were complaining about end of non-void function with no
       return.
 
+JH/01 Bug 1513: Fix parsing of quoted parameter values in MIME headers.
+      This was a regression intruduced in 4.83 by another bugfix.
+
+JH/02 Fix broken compilation when EXPERIMENTAL_DSN is enabled.
+
+TL/02 Bug 1509: Fix exipick for enhanced spoolfile specification used when
+      EXPERIMENTAL_DNS is enabled.  Fix from Wolfgang Breyha.
+
 
 Exim version 4.83
 -----------------
diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 80e970cc1..28591eaf7 100644
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -767,82 +767,83 @@ and (for SMTP transports) a second string on deferrals caused by a host error.
 This feature may be used, for example, to write exim internal log information
 (not available otherwise) into a database.
 
-In order to use the feature, you must set
+In order to use the feature, you must compile with
 
 EXPERIMENTAL_TPDA=yes
 
 in your Local/Makefile
 
-and define the expandable strings in the runtime config file, to
-be executed at end of delivery.
+and define the tpda_event_action option in the transport, to
+be expanded when the event fires.
 
-Additionally, there are 6 more variables, available at end of
-delivery:
+A new variable, $tpda_event, is set to the event type when the
+expansion is done.  The current list of events is:
 
-tpda_delivery_ip             IP of host, which has accepted delivery
-tpda_delivery_port           Port of remote host which has accepted delivery
-tpda_delivery_fqdn           FQDN of host, which has accepted delivery
-tpda_delivery_local_part     local part of address being delivered
-tpda_delivery_domain         domain part of address being delivered
-tpda_delivery_confirmation   SMTP confirmation message
+	msg:delivery
+	msg:host:defer
+	tcp:connect
+	tcp:close
+	tls:cert
+	smtp:connect
 
-In case of a deferral caused by a host-error:
-tpda_defer_errno             Error number
-tpda_defer_errstr            Error string possibly containing more details
+The expansion is called for all event types, and should use the $tpda_event
+value to decide when to act.  The variable data is a colon-separated
+list, describing an event tree.
 
-The $router_name and $transport_name variables are also usable.
+There is an auxilary variable, $tpda_data, for which the
+content is event_dependent:
 
+	msg:delivery		smtp confirmation mssage
+	msg:host:defer		error string
+	tls:cert		verification chain depth
+	smtp:connect		smtp banner
 
-To take action after successful deliveries, set the following option
-on any transport of interest.
+The msg:host:defer event populates one extra variable, $tpda_defer_errno.
+
+The following variables are likely to be useful for most event types:
+
+	router_name, transport_name
+	local_part, domain
+	host, host_address, host_port
+	tls_out_peercert
+	lookup_dnssec_authenticated, tls_out_dane
+	sending_ip_address, sending_port
 
-tpda_delivery_action
 
 An example might look like:
 
-tpda_delivery_action = \
-${lookup pgsql {SELECT * FROM record_Delivery( \
+tpda_event_action = ${if = {msg:delivery}{$tpda_event} \
+{${lookup pgsql {SELECT * FROM record_Delivery( \
     '${quote_pgsql:$sender_address_domain}',\
     '${quote_pgsql:${lc:$sender_address_local_part}}', \
-    '${quote_pgsql:$tpda_delivery_domain}', \
-    '${quote_pgsql:${lc:$tpda_delivery_local_part}}', \
-    '${quote_pgsql:$tpda_delivery_ip}', \
-    '${quote_pgsql:${lc:$tpda_delivery_fqdn}}', \
-    '${quote_pgsql:$message_exim_id}')}}
+    '${quote_pgsql:$domain}', \
+    '${quote_pgsql:${lc:$local_part}}', \
+    '${quote_pgsql:$host_address}', \
+    '${quote_pgsql:${lc:$host}}', \
+    '${quote_pgsql:$message_exim_id}')}} \
+} {}}
 
 The string is expanded after the delivery completes and any
 side-effects will happen.  The result is then discarded.
 Note that for complex operations an ACL expansion can be used.
 
+During the expansion the tpda_event variable will contain the
+string-list "msg:delivery".
+
+
+The expansion of the tpda_event_action option should normally
+return an empty string.  Should it return anything else the
+following will be forced:
+
+	msg:delivery	(ignored)
+	msg:host:defer	(ignored)
+	tcp:connect	do not connect
+	tcp:close	(ignored)
+	tls:cert	refuse verification
+	smtp:connect	close connection
+
+
 
-In order to log host deferrals, add the following option to an SMTP
-transport:
-
-tpda_host_defer_action
-
-This is a private option of the SMTP transport. It is intended to
-log failures of remote hosts. It is executed only when exim has
-attempted to deliver a message to a remote host and failed due to
-an error which doesn't seem to be related to the individual
-message, sender, or recipient address.
-See section 47.2 of the exim documentation for more details on how
-this is determined.
-
-Example:
-
-tpda_host_defer_action = \
-${lookup mysql {insert into delivlog set \
-    msgid = '${quote_mysql:$message_exim_id}', \
-    senderlp = '${quote_mysql:${lc:$sender_address_local_part}}', \
-    senderdom = '${quote_mysql:$sender_address_domain}', \
-    delivlp = '${quote_mysql:${lc:$tpda_delivery_local_part}}', \
-    delivdom = '${quote_mysql:$tpda_delivery_domain}', \
-    delivip = '${quote_mysql:$tpda_delivery_ip}', \
-    delivport = '${quote_mysql:$tpda_delivery_port}', \
-    delivfqdn = '${quote_mysql:$tpda_delivery_fqdn}', \
-    deliverrno = '${quote_mysql:$tpda_defer_errno}', \
-    deliverrstr = '${quote_mysql:$tpda_defer_errstr}' \
-    }}
 
 
 Redis Lookup
diff --git a/src/OS/os.h-OpenBSD b/src/OS/os.h-OpenBSD
index 55bade674..9578047af 100644
--- a/src/OS/os.h-OpenBSD
+++ b/src/OS/os.h-OpenBSD
@@ -5,6 +5,13 @@
 #define HAVE_SYS_MOUNT_H
 #define SIOCGIFCONF_GIVES_ADDR
 #define HAVE_ARC4RANDOM
+/* In May 2014, OpenBSD 5.5 was released which cleaned up the arc4random_* API
+   which removed the arc4random_stir() function. Set NOT_HAVE_ARC4RANDOM_STIR
+   if the version released is past that point. */
+#include <sys/param.h>
+#if OpenBSD >= 201405
+#define NOT_HAVE_ARC4RANDOM_STIR
+#endif
 
 typedef struct flock flock_t;
 
diff --git a/src/src/acl.c b/src/src/acl.c
index 6e635fbf1..fe1e254bd 100644
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -4129,7 +4129,11 @@ while (acl != NULL)
   switch(acl->verb)
     {
     case ACL_ACCEPT:
-    if (cond == OK || cond == DISCARD) return cond;
+    if (cond == OK || cond == DISCARD)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
+      return cond;
+      }
     if (endpass_seen)
       {
       HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
@@ -4140,17 +4144,26 @@ while (acl != NULL)
     case ACL_DEFER:
     if (cond == OK)
       {
+      HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
       acl_temp_details = TRUE;
       return DEFER;
       }
     break;
 
     case ACL_DENY:
-    if (cond == OK) return FAIL;
+    if (cond == OK)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
+      return FAIL;
+      }
     break;
 
     case ACL_DISCARD:
-    if (cond == OK || cond == DISCARD) return DISCARD;
+    if (cond == OK || cond == DISCARD)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
+      return DISCARD;
+      }
     if (endpass_seen)
       {
       HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
@@ -4159,11 +4172,19 @@ while (acl != NULL)
     break;
 
     case ACL_DROP:
-    if (cond == OK) return FAIL_DROP;
+    if (cond == OK)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
+      return FAIL_DROP;
+      }
     break;
 
     case ACL_REQUIRE:
-    if (cond != OK) return cond;
+    if (cond != OK)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
+      return cond;
+      }
     break;
 
     case ACL_WARN:
diff --git a/src/src/auths/dovecot.c b/src/src/auths/dovecot.c
index 1874f3238..c89411af8 100644
--- a/src/src/auths/dovecot.c
+++ b/src/src/auths/dovecot.c
@@ -240,7 +240,7 @@ int auth_dovecot_server(auth_instance *ablock, uschar *data)
        uschar *p;
        int nargs, tmp;
        int crequid = 1, cont = 1, fd, ret = DEFER;
-       BOOL found = FALSE;
+       BOOL found = FALSE, have_mech_line = FALSE;
 
        HDEBUG(D_auth) debug_printf("dovecot authentication\n");
 
@@ -300,8 +300,20 @@ int auth_dovecot_server(auth_instance *ablock, uschar *data)
                                OUT("authentication socket protocol version mismatch");
                } else if (Ustrcmp(args[0], US"MECH") == 0) {
                        CHECK_COMMAND("MECH", 1, INT_MAX);
+                       have_mech_line = TRUE;
                        if (strcmpic(US args[1], ablock->public_name) == 0)
                                found = TRUE;
+               } else if (Ustrcmp(args[0], US"SPID") == 0) {
+                       /* Unfortunately the auth protocol handshake wasn't designed well
+                          to differentiate between auth-client/userdb/master. auth-userdb
+                          and auth-master send VERSION + SPID lines only and nothing
+                          afterwards, while auth-client sends VERSION + MECH + SPID +
+                          CUID + more. The simplest way that we can determine if we've
+                          connected to the correct socket is to see if MECH line exists or
+                          not (alternatively we'd have to have a small timeout after SPID
+                          to see if CUID is sent or not). */
+                       if (!have_mech_line)
+                               OUT("authentication socket type mismatch (connected to auth-master instead of auth-client)");
                } else if (Ustrcmp(args[0], US"DONE") == 0) {
                        CHECK_COMMAND("DONE", 0, 0);
                        cont = 0;
diff --git a/src/src/deliver.c b/src/src/deliver.c
index ab0815ed4..d00af9c11 100644
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -141,11 +141,13 @@ the first address. */
 if (addr->host_list == NULL)
   {
   deliver_host = deliver_host_address = US"";
+  deliver_host_port = 0;
   }
 else
   {
   deliver_host = addr->host_list->name;
   deliver_host_address = addr->host_list->address;
+  deliver_host_port = addr->host_list->port;
   }
 
 deliver_recipients = addr;
@@ -713,6 +715,43 @@ d_tlslog(uschar * s, int * sizep, int * ptrp, address_item * addr)
 }
 #endif
 
+
+#ifdef EXPERIMENTAL_TPDA
+int
+tpda_raise_event(uschar * action, uschar * event, uschar * ev_data)
+{
+uschar * s;
+if (action)
+  {
+  DEBUG(D_deliver)
+    debug_printf("TPDA(%s): tpda_event_action=|%s| tpda_delivery_IP=%s\n",
+      event,
+      action, deliver_host_address);
+
+  tpda_event = event;
+  tpda_data =  ev_data;
+
+  if (!(s = expand_string(action)) && *expand_string_message)
+    log_write(0, LOG_MAIN|LOG_PANIC,
+      "failed to expand tpda_event_action %s in %s: %s\n",
+      event, transport_name, expand_string_message);
+
+  tpda_event = tpda_data = NULL;
+
+  /* If the expansion returns anything but an empty string, flag for
+  the caller to modify his normal processing
+  */
+  if (s && *s)
+    {
+    DEBUG(D_deliver)
+      debug_printf("TPDA(%s): event_action returned \"%s\"\n", s);
+    return DEFER;
+    }
+  }
+return OK;
+}
+#endif
+
 /* If msg is NULL this is a delivery log and logchar is used. Otherwise
 this is a nonstandard call; no two-character delivery flag is written
 but sender-host and sender are prefixed and "msg" is inserted in the log line.
@@ -736,12 +775,7 @@ have a pointer to the host item that succeeded; local deliveries can have a
 pointer to a single host item in their host list, for use by the transport. */
 
 #ifdef EXPERIMENTAL_TPDA
-  tpda_delivery_ip = NULL;	/* presume no successful remote delivery */
-  tpda_delivery_port = 0;
-  tpda_delivery_fqdn = NULL;
-  tpda_delivery_local_part = NULL;
-  tpda_delivery_domain = NULL;
-  tpda_delivery_confirmation = NULL;
+  /* presume no successful remote delivery */
   lookup_dnssec_authenticated = NULL;
 #endif
 
@@ -790,13 +824,8 @@ if ((log_extra_selector & LX_delivery_size) != 0)
 
 if (addr->transport->info->local)
   {
-  if (addr->host_list != NULL)
-    {
+  if (addr->host_list)
     s = string_append(s, &size, &ptr, 2, US" H=", addr->host_list->name);
-    #ifdef EXPERIMENTAL_TPDA
-      tpda_delivery_fqdn = addr->host_list->name;
-    #endif
-    }
   if (addr->shadow_message != NULL)
     s = string_cat(s, &size, &ptr, addr->shadow_message,
       Ustrlen(addr->shadow_message));
@@ -812,24 +841,20 @@ else
     if (continue_sequence > 1)
       s = string_cat(s, &size, &ptr, US"*", 1);
 
-    #ifdef EXPERIMENTAL_TPDA
-    tpda_delivery_ip =           addr->host_used->address;
-    tpda_delivery_port =         addr->host_used->port;
-    tpda_delivery_fqdn =         addr->host_used->name;
-    tpda_delivery_local_part =   addr->local_part;
-    tpda_delivery_domain =       addr->domain;
-    tpda_delivery_confirmation = addr->message;
+#ifdef EXPERIMENTAL_TPDA
+    deliver_host_address = addr->host_used->address;
+    deliver_host_port =    addr->host_used->port;
 
     /* DNS lookup status */
     lookup_dnssec_authenticated = addr->host_used->dnssec==DS_YES ? US"yes"
 			      : addr->host_used->dnssec==DS_NO ? US"no"
 			      : NULL;
-    #endif
+#endif
     }
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   s = d_tlslog(s, &size, &ptr, addr);
-  #endif
+#endif
 
   if (addr->authenticator)
     {
@@ -842,10 +867,10 @@ else
       }
     }
 
-  #ifndef DISABLE_PRDR
+#ifndef DISABLE_PRDR
   if (addr->flags & af_prdr_used)
     s = string_append(s, &size, &ptr, 1, US" PRDR");
-  #endif
+#endif
   }
 
 /* confirmation message (SMTP (host_used) and LMTP (driver_name)) */
@@ -885,19 +910,22 @@ s[ptr] = 0;
 log_write(0, flags, "%s", s);
 
 #ifdef EXPERIMENTAL_TPDA
-if (addr->transport->tpda_delivery_action)
   {
-  DEBUG(D_deliver)
-    debug_printf("  TPDA(Delivery): tpda_deliver_action=|%s| tpda_delivery_IP=%s\n",
-      addr->transport->tpda_delivery_action, tpda_delivery_ip);
-
-  router_name =    addr->router->name;
-  transport_name = addr->transport->name;
-  if (!expand_string(addr->transport->tpda_delivery_action) && *expand_string_message)
-    log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand tpda_deliver_action in %s: %s\n",
-      transport_name, expand_string_message);
-  router_name = NULL;
-  transport_name = NULL;
+  uschar * save_domain = deliver_domain;
+  uschar * save_local =  deliver_localpart;
+
+  router_name =    addr->router ? addr->router->name : NULL;
+  transport_name = addr->transport ? addr->transport->name : NULL;
+  deliver_domain = addr->domain;
+  deliver_localpart = addr->local_part;
+
+  (void) tpda_raise_event(addr->transport->tpda_event_action, US"msg:delivery",
+	    addr->host_used || Ustrcmp(addr->transport->driver_name, "lmtp") == 0
+	    ? addr->message : NULL);
+
+  deliver_localpart = save_local;
+  deliver_domain =    save_domain;
+  router_name = transport_name = NULL;
   }
 #endif
 store_reset(reset_point);
@@ -1097,7 +1125,7 @@ if (result == OK)
     }
 
   /* Certificates for logging (via TPDA) */
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   tls_out.ourcert = addr->ourcert;
   addr->ourcert = NULL;
   tls_out.peercert = addr->peercert;
@@ -1106,11 +1134,11 @@ if (result == OK)
   tls_out.cipher = addr->cipher;
   tls_out.peerdn = addr->peerdn;
   tls_out.ocsp = addr->ocsp;
-  #endif
+#endif
 
   delivery_log(LOG_MAIN, addr, logchar, NULL);
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   if (tls_out.ourcert)
     {
     tls_free_cert(tls_out.ourcert);
@@ -1124,7 +1152,7 @@ if (result == OK)
   tls_out.cipher = NULL;
   tls_out.peerdn = NULL;
   tls_out.ocsp = OCSP_NOT_REQ;
-  #endif
+#endif
   }
 
 
@@ -1305,9 +1333,9 @@ else
   if (addr->host_used != NULL)
     s = d_hostlog(s, &size, &ptr, addr);
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   s = d_tlslog(s, &size, &ptr, addr);
-  #endif
+#endif
 
   if (addr->basic_errno > 0)
     s = string_append(s, &size, &ptr, 2, US": ",
@@ -1896,19 +1924,19 @@ if ((pid = fork()) == 0)
   diagnosis that it's reasonable to make them something that has to be explicitly requested.
   */
 
-  #ifdef RLIMIT_CORE
+#ifdef RLIMIT_CORE
   struct rlimit rl;
   rl.rlim_cur = 0;
   rl.rlim_max = 0;
   if (setrlimit(RLIMIT_CORE, &rl) < 0)
     {
-    #ifdef SETRLIMIT_NOT_SUPPORTED
+# ifdef SETRLIMIT_NOT_SUPPORTED
     if (errno != ENOSYS && errno != ENOTSUP)
-    #endif
+# endif
       log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_CORE) failed: %s",
         strerror(errno));
     }
-  #endif
+#endif
 
   /* Reset the random number generator, so different processes don't all
   have the same sequence. */
@@ -2995,7 +3023,7 @@ while (!done)
     it in with the other info, in order to keep each message short enough to
     guarantee it won't be split in the pipe. */
 
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     case 'X':
     if (addr == NULL) goto ADDR_MISMATCH;          /* Below, in 'A' handler */
     switch (*ptr++)
@@ -3023,17 +3051,17 @@ while (!done)
 	(void) tls_import_cert(ptr, &addr->ourcert);
       break;
 
-      #ifndef DISABLE_OCSP
+# ifndef DISABLE_OCSP
       case '4':
       addr->ocsp = OCSP_NOT_REQ;
       if (*ptr)
 	addr->ocsp = *ptr - '0';
       break;
-      #endif
+# endif
       }
     while (*ptr++);
     break;
-    #endif	/*SUPPORT_TLS*/
+#endif	/*SUPPORT_TLS*/
 
     case 'C':	/* client authenticator information */
     switch (*ptr++)
@@ -3057,14 +3085,14 @@ while (!done)
     break;
 #endif
 
-    #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
     case 'D':
     if (addr == NULL) break;
     memcpy(&(addr->dsn_aware), ptr, sizeof(addr->dsn_aware));
     ptr += sizeof(addr->dsn_aware);
     DEBUG(D_deliver) debug_printf("DSN read: addr->dsn_aware = %d\n", addr->dsn_aware);
     break;
-    #endif
+#endif
 
     case 'A':
     if (addr == NULL)
@@ -3962,11 +3990,11 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
     that it can use either of them, though it prefers O_NONBLOCK, which
     distinguishes between EOF and no-more-data. */
 
-    #ifdef O_NONBLOCK
+#ifdef O_NONBLOCK
     (void)fcntl(pfd[pipe_read], F_SETFL, O_NONBLOCK);
-    #else
+#else
     (void)fcntl(pfd[pipe_read], F_SETFL, O_NDELAY);
-    #endif
+#endif
 
     /* If the maximum number of subprocesses already exist, wait for a process
     to finish. If we ran out of file descriptors, parmax will have been reduced
@@ -4138,7 +4166,7 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
 #endif
 
       /* Use an X item only if there's something to send */
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       if (addr->cipher)
         {
         ptr = big_buffer;
@@ -4174,7 +4202,7 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
 	  *ptr++ = 0;
         rmt_dlv_checked_write(fd, big_buffer, ptr - big_buffer);
 	}
-      #ifndef DISABLE_OCSP
+# ifndef DISABLE_OCSP
       if (addr->ocsp > OCSP_NOT_REQ)
 	{
 	ptr = big_buffer;
@@ -4182,8 +4210,8 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
 	while(*ptr++);
         rmt_dlv_checked_write(fd, big_buffer, ptr - big_buffer);
 	}
-      # endif
-      #endif	/*SUPPORT_TLS*/
+# endif
+#endif	/*SUPPORT_TLS*/
 
       if (client_authenticator)
         {
@@ -4207,17 +4235,17 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
         rmt_dlv_checked_write(fd, big_buffer, ptr - big_buffer);
 	}
 
-      #ifndef DISABLE_PRDR
+#ifndef DISABLE_PRDR
       if (addr->flags & af_prdr_used)
 	rmt_dlv_checked_write(fd, "P", 1);
-      #endif
+#endif
 
-      #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
       big_buffer[0] = 'D';
       memcpy(big_buffer+1, &addr->dsn_aware, sizeof(addr->dsn_aware));
       rmt_dlv_checked_write(fd, big_buffer, sizeof(addr->dsn_aware) + 1);
       DEBUG(D_deliver) debug_printf("DSN write: addr->dsn_aware = %d\n", addr->dsn_aware);
-      #endif
+#endif
 
       /* Retry information: for most success cases this will be null. */
 
@@ -4932,7 +4960,7 @@ attempted. */
 
 if (deliver_freeze)
   {
-  #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
   /* Moving to another directory removes the message from Exim's view. Other
   tools must be used to deal with it. Logging of this action happens in
   spool_move_message() and its subfunctions. */
@@ -4940,7 +4968,7 @@ if (deliver_freeze)
   if (move_frozen_messages &&
       spool_move_message(id, message_subdir, US"", US"F"))
     return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
-  #endif
+#endif
 
   /* For all frozen messages (bounces or not), timeout_frozen_after sets the
   maximum time to keep messages that are frozen. Thaw if we reach it, with a
@@ -5369,13 +5397,13 @@ if (process_recipients != RECIP_IGNORE)
       if (r->pno >= 0)
         new->onetime_parent = recipients_list[r->pno].address;
 
-      #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
       /* If DSN support is enabled, set the dsn flags and the original receipt 
          to be passed on to other DSN enabled MTAs */
       new->dsn_flags = r->dsn_flags & rf_dsnflags;
       new->dsn_orcpt = r->orcpt;
       DEBUG(D_deliver) debug_printf("DSN: set orcpt: %s  flags: %d\n", new->dsn_orcpt, new->dsn_flags);
-      #endif
+#endif
 
       switch (process_recipients)
         {
@@ -6311,21 +6339,21 @@ if (addr_remote != NULL)
     regex_must_compile(US"\\n250[\\s\\-]AUTH\\s+([\\-\\w\\s]+)(?:\\n|$)",
       FALSE, TRUE);
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   if (regex_STARTTLS == NULL) regex_STARTTLS =
     regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
-  #endif
+#endif
 
-  #ifndef DISABLE_PRDR
+#ifndef DISABLE_PRDR
   if (regex_PRDR == NULL) regex_PRDR =
     regex_must_compile(US"\\n250[\\s\\-]PRDR(\\s|\\n|$)", FALSE, TRUE);
-  #endif
+#endif
 
-  #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
   /* Set the regex to check for DSN support on remote MTA */
   if (regex_DSN == NULL) regex_DSN  =
     regex_must_compile(US"\\n250[\\s\\-]DSN(\\s|\\n|$)", FALSE, TRUE);
-  #endif
+#endif
 
   /* Now sort the addresses if required, and do the deliveries. The yield of
   do_remote_deliveries is FALSE when mua_wrapper is set and all addresses
@@ -6522,8 +6550,8 @@ if (addr_senddsn != NULL)
 	"Content-type: text/plain; charset=us-ascii\n\n"
    
 	"This message was created automatically by mail delivery software.\n"
-	" ----- The following addresses had successful delivery notifications -----\n"
-      qualify_domain_sender, sender_addres, boundaryStrs, boundarySt);
+	" ----- The following addresses had successful delivery notifications -----\n",
+      qualify_domain_sender, sender_address, boundaryStr, boundaryStr);
 
     addr_dsntmp = addr_senddsn;
     while(addr_dsntmp)
@@ -6955,8 +6983,9 @@ wording. */
       for (addr = handled_addr; addr; addr = addr->next)
         {
         fprintf(f, "Action: failed\n"
-	    "Final-Recipient: rfc822;%s\n", addr->address
-	    "Status: 5.0.0\n");
+	    "Final-Recipient: rfc822;%s\n"
+	    "Status: 5.0.0\n",
+	    addr->address);
         if (addr->host_used && addr->host_used->name)
           fprintf(f, "Remote-MTA: dns; %s\nDiagnostic-Code: smtp; %d\n",
 	    addr->host_used->name, addr->basic_errno);
@@ -7665,10 +7694,10 @@ if (remove_journal)
 
   /* Move the message off the spool if reqested */
 
-  #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
   if (deliver_freeze && move_frozen_messages)
     (void)spool_move_message(id, message_subdir, US"", US"F");
-  #endif
+#endif
   }
 
 /* Closing the data file frees the lock; if the file has been unlinked it
diff --git a/src/src/exim.c b/src/src/exim.c
index 8a9de72ac..85a7c812c 100644
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -267,6 +267,10 @@ will wait for ever, so we panic in this instance. (There was a case of this
 when a bug in a function that calls milliwait() caused it to pass invalid data.
 That's when I added the check. :-)
 
+We assume it to be not worth sleeping for under 100us; this value will
+require revisiting as hardware advances.  This avoids the issue of
+a zero-valued timer setting meaning "never fire".
+
 Argument:  an itimerval structure containing the interval
 Returns:   nothing
 */
@@ -276,6 +280,9 @@ milliwait(struct itimerval *itval)
 {
 sigset_t sigmask;
 sigset_t old_sigmask;
+
+if (itval->it_value.tv_usec < 100 && itval->it_value.tv_sec == 0)
+  return;
 (void)sigemptyset(&sigmask);                           /* Empty mask */
 (void)sigaddset(&sigmask, SIGALRM);                    /* Add SIGALRM */
 (void)sigprocmask(SIG_BLOCK, &sigmask, &old_sigmask);  /* Block SIGALRM */
diff --git a/src/src/exipick.src b/src/src/exipick.src
index ed3b66154..4708ebb4a 100644
--- a/src/src/exipick.src
+++ b/src/src/exipick.src
@@ -1020,6 +1020,12 @@ sub _parse_header {
       return($self->_error("incorrect format: $_")) if (length($2) != $3);
       $self->{_recips}{$1} = { pno => $4, errors_to => $2 };
       $addr = $1;
+    } elsif (/^(\S*)\s(\S*)\s(\d+),(\d+)\s(\S*)\s(\d+),(-?\d+)#3$/) {
+      #print STDERR "exim4 new type #3 DSN (untested): $_\n";
+      return($self->_error("incorrect format: $_"))
+        if ((length($2) != $3) || (length($5) != $6));
+      $self->{_recips}{$1} = { pno => $7, errors_to => $5 };
+      $addr = $1;
     } elsif (/^.*#(\d+)$/) {
       #print STDERR "exim4 #$1 style (unimplemented): $_\n";
       $self->_error("exim4 #$1 style (unimplemented): $_");
diff --git a/src/src/expand.c b/src/src/expand.c
index b0e76ba27..8111c4212 100644
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -501,6 +501,7 @@ static var_entry var_table[] = {
   { "host_data",           vtype_stringptr,   &host_data },
   { "host_lookup_deferred",vtype_int,         &host_lookup_deferred },
   { "host_lookup_failed",  vtype_int,         &host_lookup_failed },
+  { "host_port",           vtype_int,         &deliver_host_port },
   { "inode",               vtype_ino,         &deliver_inode },
   { "interface_address",   vtype_stringptr,   &interface_address },
   { "interface_port",      vtype_int,         &interface_port },
@@ -712,14 +713,12 @@ static var_entry var_table[] = {
   { "tod_zone",            vtype_todzone,     NULL },
   { "tod_zulu",            vtype_todzulu,     NULL },
 #ifdef EXPERIMENTAL_TPDA
+  { "tpda_data",           vtype_stringptr,   &tpda_data },
+
+  /*XXX want to use generic vars for as many of these as possible*/
   { "tpda_defer_errno",     vtype_int,         &tpda_defer_errno },
-  { "tpda_defer_errstr",    vtype_stringptr,   &tpda_defer_errstr },
-  { "tpda_delivery_confirmation", vtype_stringptr,   &tpda_delivery_confirmation },
-  { "tpda_delivery_domain", vtype_stringptr,   &tpda_delivery_domain },
-  { "tpda_delivery_fqdn",   vtype_stringptr,   &tpda_delivery_fqdn },
-  { "tpda_delivery_ip",     vtype_stringptr,   &tpda_delivery_ip },
-  { "tpda_delivery_local_part",vtype_stringptr,&tpda_delivery_local_part },
-  { "tpda_delivery_port",   vtype_int,         &tpda_delivery_port },
+
+  { "tpda_event",          vtype_stringptr,   &tpda_event },
 #endif
   { "transport_name",      vtype_stringptr,   &transport_name },
   { "value",               vtype_stringptr,   &lookup_value },
@@ -919,7 +918,9 @@ vaguely_random_number(int max)
 #ifdef HAVE_ARC4RANDOM
       /* cryptographically strong randomness, common on *BSD platforms, not
       so much elsewhere.  Alas. */
+#ifndef NOT_HAVE_ARC4RANDOM_STIR
       arc4random_stir();
+#endif
 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
 #ifdef HAVE_SRANDOMDEV
       /* uses random(4) for seeding */
diff --git a/src/src/functions.h b/src/src/functions.h
index a6257a913..fee4429a5 100644
--- a/src/src/functions.h
+++ b/src/src/functions.h
@@ -44,7 +44,7 @@ extern uschar * tls_cert_fprt_sha1(void *);
 extern uschar * tls_cert_fprt_sha256(void *);
 
 extern int     tls_client_start(int, host_item *, address_item *,
-		 void *);
+		 transport_instance *);
 extern void    tls_close(BOOL, BOOL);
 extern int     tls_export_cert(uschar *, size_t, void *);
 extern int     tls_feof(void);
@@ -337,7 +337,11 @@ extern int     sieve_interpret(uschar *, int, uschar *, uschar *, uschar *,
 extern void    sigalrm_handler(int);
 extern BOOL    smtp_buffered(void);
 extern void    smtp_closedown(uschar *);
-extern int     smtp_connect(host_item *, int, int, uschar *, int, BOOL, const uschar *);
+extern int     smtp_connect(host_item *, int, int, uschar *, int, BOOL, const uschar *
+#ifdef EXPERIMENTAL_TPDA
+		       , uschar *
+#endif
+		       );
 extern int     smtp_feof(void);
 extern int     smtp_ferror(void);
 extern uschar *smtp_get_connection_info(void);
diff --git a/src/src/globals.c b/src/src/globals.c
index 409c324e9..f5ed80fa2 100644
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -585,6 +585,7 @@ time_t  deliver_frozen_at      = 0;
 uschar *deliver_home           = NULL;
 uschar *deliver_host           = NULL;
 uschar *deliver_host_address   = NULL;
+int     deliver_host_port      = 0;
 uschar *deliver_in_buffer      = NULL;
 ino_t   deliver_inode          = 0;
 uschar *deliver_localpart      = NULL;
@@ -1337,13 +1338,8 @@ BOOL    timestamps_utc         = FALSE;
 
 #ifdef EXPERIMENTAL_TPDA
 int     tpda_defer_errno        = 0;
-uschar *tpda_defer_errstr       = NULL;
-uschar *tpda_delivery_ip        = NULL;
-int     tpda_delivery_port      = 0;
-uschar *tpda_delivery_fqdn      = NULL;
-uschar *tpda_delivery_local_part= NULL;
-uschar *tpda_delivery_domain    = NULL;
-uschar *tpda_delivery_confirmation = NULL;
+uschar *tpda_event              = NULL;
+uschar *tpda_data               = NULL;
 #endif
 
 transport_instance  *transports = NULL;
diff --git a/src/src/globals.h b/src/src/globals.h
index 1adda6411..0b5335e6f 100644
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -332,6 +332,7 @@ extern uschar *deliver_home;           /* Home directory for pipes */
 extern uschar *deliver_host;           /* (First) host for routed local deliveries */
                                        /* Remote host for filter */
 extern uschar *deliver_host_address;   /* Address for remote delivery filter */
+extern int     deliver_host_port;      /* Address for remote delivery filter */
 extern uschar *deliver_in_buffer;      /* Buffer for copying file */
 extern ino_t   deliver_inode;          /* Inode for appendfile */
 extern uschar *deliver_localpart;      /* The local part for delivery */
@@ -877,13 +878,8 @@ extern BOOL    timestamps_utc;         /* Use UTC for all times */
 
 #ifdef EXPERIMENTAL_TPDA
 extern int     tpda_defer_errno;        /* error number set when a remote delivery is deferred with a host error */
-extern uschar *tpda_defer_errstr;       /* error string set when a remote delivery is deferred with a host error */
-extern uschar *tpda_delivery_ip;        /* IP of host, which has accepted delivery */
-extern int     tpda_delivery_port;       /* port of host, which has accepted delivery */
-extern uschar *tpda_delivery_fqdn;      /* FQDN of host, which has accepted delivery */
-extern uschar *tpda_delivery_local_part;/* local part of address being delivered */
-extern uschar *tpda_delivery_domain;    /* domain part of address being delivered */
-extern uschar *tpda_delivery_confirmation; /* SMTP confirmation message */
+extern uschar *tpda_event;		/* event classification */
+extern uschar *tpda_data;;		/* event data */
 #endif
 
 extern uschar *transport_name;         /* Name of transport last started */
diff --git a/src/src/mime.c b/src/src/mime.c
index 6a9e31a0a..95d3da472 100644
--- a/src/src/mime.c
+++ b/src/src/mime.c
@@ -601,16 +601,28 @@ NEXT_PARAM_SEARCH:
 	    int param_value_len = 0;
 
 	    /* found an interesting parameter? */
-	    if (strncmpic(mp->name, p,mp->namelen) == 0)
+	    if (strncmpic(mp->name, p, mp->namelen) == 0)
 	      {
 	      uschar *q = p + mp->namelen;
+	      int size = 0;
+	      int ptr = 0;
+
 	      /* yes, grab the value and copy to its corresponding expansion variable */
-	      while(*q != ';') q++;
-	      param_value_len = (q - (p + mp->namelen));
-	      param_value = (uschar *)malloc(param_value_len+1);
-	      memset(param_value,0,param_value_len+1);
-	      q = p + mp->namelen;
-	      Ustrncpy(param_value, q, param_value_len);
+	      while(*q && *q != ';')		/* ; terminates */
+		{
+		if (*q == '"')
+		  {
+		  q++;				/* skip leading " */
+		  while(*q && *q != '"')	/* which protects ; */
+		    param_value = string_cat(param_value, &size, &ptr, q++, 1);
+		  if (*q) q++;			/* skip trailing " */
+		  }
+		else
+		  param_value = string_cat(param_value, &size, &ptr, q++, 1);
+		}
+	      param_value[ptr++] = '\0';
+	      param_value_len = ptr;
+
 	      param_value = rfc2047_decode(param_value, check_rfc2047_length, NULL, 32, &param_value_len, &q);
 	      debug_printf("Found %s MIME parameter in %s header, value is '%s'\n", mp->name, mime_header_list[i].name, param_value);
 	      *((uschar **)(mp->value)) = param_value;
diff --git a/src/src/smtp_out.c b/src/src/smtp_out.c
index b6ff51108..4920b7371 100644
--- a/src/src/smtp_out.c
+++ b/src/src/smtp_out.c
@@ -165,13 +165,18 @@ Arguments:
   timeout     timeout value or 0
   keepalive   TRUE to use keepalive
   dscp        DSCP value to assign to socket
+  tpda_event  event expansion
 
 Returns:      connected socket number, or -1 with errno set
 */
 
 int
 smtp_connect(host_item *host, int host_af, int port, uschar *interface,
-  int timeout, BOOL keepalive, const uschar *dscp)
+  int timeout, BOOL keepalive, const uschar *dscp
+#ifdef EXPERIMENTAL_TPDA
+  , uschar * tpda_event
+#endif
+  )
 {
 int on = 1;
 int save_errno = 0;
@@ -198,6 +203,13 @@ HDEBUG(D_transport|D_acl|D_v)
       host->address, port, interface);
   }
 
+#ifdef EXPERIMENTAL_TPDA
+  /*XXX Called from both delivery and verify.  Is that status observable? */
+  deliver_host_address = host->address;
+  deliver_host_port = port;
+  if (tpda_raise_event(tpda_event, US"tcp:connect", NULL) == DEFER) return -1;
+#endif
+
 /* Create the socket */
 
 if ((sock = ip_socket(SOCK_STREAM, host_af)) < 0) return -1;
diff --git a/src/src/structs.h b/src/src/structs.h
index 27b73e903..4f7862dc5 100644
--- a/src/src/structs.h
+++ b/src/src/structs.h
@@ -188,7 +188,7 @@ typedef struct transport_instance {
   BOOL    log_defer_output;
   BOOL    retry_use_local_part;   /* Defaults true for local, false for remote */
 #ifdef EXPERIMENTAL_TPDA
-  uschar  *tpda_delivery_action;  /* String to expand on success */
+  uschar  *tpda_event_action;     /* String to expand on notable events */
 #endif
 } transport_instance;
 
diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 266ab8909..b7eae1793 100644
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -47,6 +47,10 @@ require current GnuTLS, then we'll drop support for the ancient libraries).
 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
 # define DISABLE_OCSP
 #endif
+#if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_TPDA)
+# warning "GnuTLS library version too old; TPDA tls:cert event unsupported"
+# undef EXPERIMENTAL_TPDA
+#endif
 
 #ifndef DISABLE_OCSP
 # include <gnutls/ocsp.h>
@@ -115,6 +119,9 @@ typedef struct exim_gnutls_state {
 #ifdef EXPERIMENTAL_CERTNAMES
   uschar *exp_tls_verify_cert_hostnames;
 #endif
+#ifdef EXPERIMENTAL_TPDA
+  uschar *event_action;
+#endif
 
   tls_support *tlsp;	/* set in tls_init() */
 
@@ -133,6 +140,9 @@ static const exim_gnutls_state_st exim_gnutls_state_init = {
 #ifdef EXPERIMENTAL_CERTNAMES
                                             NULL,
 #endif
+#ifdef EXPERIMENTAL_TPDA
+                                            NULL,
+#endif
   NULL,
   NULL, 0, 0, 0, 0,
 };
@@ -144,7 +154,9 @@ context we're currently dealing with" pointer and rely upon being
 single-threaded to keep from processing data on an inbound TLS connection while
 talking to another TLS connection for an outbound check.  This does mean that
 there's no way for heart-beats to be responded to, for the duration of the
-second connection. */
+second connection.
+XXX But see gnutls_session_get_ptr()
+*/
 
 static exim_gnutls_state_st state_server, state_client;
 
@@ -174,18 +186,18 @@ static BOOL exim_gnutls_base_init_done = FALSE;
 the library logging; a value less than 0 disables the calls to set up logging
 callbacks. */
 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
-#define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
+# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
 #endif
 
 #ifndef EXIM_CLIENT_DH_MIN_BITS
-#define EXIM_CLIENT_DH_MIN_BITS 1024
+# define EXIM_CLIENT_DH_MIN_BITS 1024
 #endif
 
 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
 can ask for a bit-strength.  Without that, we stick to the constant we had
 before, for now. */
 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
-#define EXIM_SERVER_DH_BITS_PRE2_12 1024
+# define EXIM_SERVER_DH_BITS_PRE2_12 1024
 #endif
 
 #define exim_gnutls_err_check(Label) do { \
@@ -1512,6 +1524,52 @@ return 0;
 #endif
 
 
+#ifdef EXPERIMENTAL_TPDA
+/*
+We use this callback to get observability and detail-level control
+for an exim client TLS connection, raising a TPDA tls:cert event
+for each cert in the chain presented by the server.  Any event
+can deny verification.
+
+Return 0 for the handshake to continue or non-zero to terminate.
+*/
+
+static int
+client_verify_cb(gnutls_session_t session)
+{
+const gnutls_datum * cert_list;
+unsigned int cert_list_size = 0;
+gnutls_x509_crt_t crt;
+int rc;
+exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
+
+cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
+if (cert_list)
+  while (cert_list_size--)
+  {
+  rc = import_cert(&cert_list[cert_list_size], &crt);
+  if (rc != GNUTLS_E_SUCCESS)
+    {
+    DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
+      cert_list_size, gnutls_strerror(rc));
+    break;
+    }
+
+  state->tlsp->peercert = crt;
+  if (tpda_raise_event(state->event_action,
+	      US"tls:cert", string_sprintf("%d", cert_list_size)) == DEFER)
+    {
+    log_write(0, LOG_MAIN,
+	      "SSL verify denied by event-action: depth=%d", cert_list_size);
+    return 1;                     /* reject */
+    }
+  state->tlsp->peercert = NULL;
+  }
+
+return 0;
+}
+
+#endif
 
 
 
@@ -1694,7 +1752,7 @@ Arguments:
   fd                the fd of the connection
   host              connected host (for messages)
   addr              the first address (not used)
-  ob                smtp transport options
+  tb                transport (always smtp)
 
 Returns:            OK/DEFER/FAIL (because using common functions),
                     but for a client, DEFER and FAIL have the same meaning
@@ -1703,9 +1761,10 @@ Returns:            OK/DEFER/FAIL (because using common functions),
 int
 tls_client_start(int fd, host_item *host,
     address_item *addr ARG_UNUSED,
-    void *v_ob)
+    transport_instance *tb)
 {
-smtp_transport_options_block *ob = v_ob;
+smtp_transport_options_block *ob =
+  (smtp_transport_options_block *)tb->options_block;
 int rc;
 const char *error;
 exim_gnutls_state_st *state = NULL;
@@ -1804,6 +1863,15 @@ if (request_ocsp)
   }
 #endif
 
+#ifdef EXPERIMENTAL_TPDA
+if (tb->tpda_event_action)
+  {
+  state->event_action = tb->tpda_event_action;
+  gnutls_session_set_ptr(state->session, state);
+  gnutls_certificate_set_verify_function(state->x509_cred, client_verify_cb);
+  }
+#endif
+
 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
 state->fd_in = fd;
 state->fd_out = fd;
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 343122615..735ebff06 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -120,6 +120,9 @@ typedef struct tls_ext_ctx_cb {
 #ifdef EXPERIMENTAL_CERTNAMES
   uschar * verify_cert_hostnames;
 #endif
+#ifdef EXPERIMENTAL_TPDA
+  uschar * event_action;
+#endif
 } tls_ext_ctx_cb;
 
 /* should figure out a cleanup of API to handle state preserved per
@@ -266,6 +269,9 @@ when asked. We get here only if a certificate has been received. Handling of
 optional verification for this case is done when requesting SSL to verify, by
 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
 
+May be called multiple times for different issues with a certificate, even
+for a given "depth" in the certificate chain.
+
 Arguments:
   state      current yes/no state as 1/0
   x509ctx    certificate information.
@@ -279,6 +285,7 @@ verify_callback(int state, X509_STORE_CTX *x509ctx,
   tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
 {
 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
+int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 static uschar txt[256];
 
 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
@@ -286,7 +293,7 @@ X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 if (state == 0)
   {
   log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
-    X509_STORE_CTX_get_error_depth(x509ctx),
+    depth,
     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
     txt);
   tlsp->certificate_verified = FALSE;
@@ -300,10 +307,9 @@ if (state == 0)
     "tls_try_verify_hosts)\n");
   }
 
-else if (X509_STORE_CTX_get_error_depth(x509ctx) != 0)
+else if (depth != 0)
   {
-  DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n",
-     X509_STORE_CTX_get_error_depth(x509ctx), txt);
+  DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, txt);
 #ifndef DISABLE_OCSP
   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
     {	/* client, wanting stapling  */
@@ -315,6 +321,23 @@ else if (X509_STORE_CTX_get_error_depth(x509ctx) != 0)
       ERR_clear_error();
     }
 #endif
+#ifdef EXPERIMENTAL_TPDA
+  if (tlsp == &tls_out && client_static_cbinfo->event_action)
+    {
+    tlsp->peercert = X509_dup(cert);
+    if (tpda_raise_event(client_static_cbinfo->event_action,
+		    US"tls:cert", string_sprintf("%d", depth)) == DEFER)
+      {
+      log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
+			      "depth=%d cert=%s", depth, txt);
+      tlsp->certificate_verified = FALSE;
+      *calledp = TRUE;
+      return 0;			    /* reject */
+      }
+    X509_free(tlsp->peercert);
+    tlsp->peercert = NULL;
+    }
+#endif
   }
 else
   {
@@ -367,13 +390,28 @@ else
 # endif
 #endif	/*EXPERIMENTAL_CERTNAMES*/
 
+#ifdef EXPERIMENTAL_TPDA
+  if (tlsp == &tls_out)
+    {
+    if (tpda_raise_event(client_static_cbinfo->event_action,
+		    US"tls:cert", US"0") == DEFER)
+      {
+      log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
+			      "depth=0 cert=%s", txt);
+      tlsp->certificate_verified = FALSE;
+      *calledp = TRUE;
+      return 0;			    /* reject */
+      }
+    }
+#endif
+
   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
     *calledp ? "" : " authenticated", txt);
   if (!*calledp) tlsp->certificate_verified = TRUE;
   *calledp = TRUE;
   }
 
-return 1;   /* accept */
+return 1;   /* accept, at least for this level */
 }
 
 static int
@@ -917,7 +955,7 @@ if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
  {
   tls_out.ocsp = OCSP_FAILED;
   if (log_extra_selector & LX_tls_cipher)
-    log_write(0, LOG_MAIN, "Received TLS status response, parse error");
+    log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
   else
     DEBUG(D_tls) debug_printf(" parse error\n");
   return 0;
@@ -927,7 +965,7 @@ if(!(bs = OCSP_response_get1_basic(rsp)))
   {
   tls_out.ocsp = OCSP_FAILED;
   if (log_extra_selector & LX_tls_cipher)
-    log_write(0, LOG_MAIN, "Received TLS status response, error parsing response");
+    log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
   else
     DEBUG(D_tls) debug_printf(" error parsing response\n");
   OCSP_RESPONSE_free(rsp);
@@ -957,6 +995,8 @@ if(!(bs = OCSP_response_get1_basic(rsp)))
 	      cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
       {
       tls_out.ocsp = OCSP_FAILED;
+      if (log_extra_selector & LX_tls_cipher)
+	log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
       BIO_printf(bp, "OCSP response verify failure\n");
       ERR_print_errors(bp);
       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
@@ -1059,7 +1099,7 @@ tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
 long init_options;
 int rc;
 BOOL okay;
-tls_ext_ctx_cb *cbinfo;
+tls_ext_ctx_cb * cbinfo;
 
 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
 cbinfo->certificate = certificate;
@@ -1077,6 +1117,9 @@ else
 cbinfo->dhparam = dhparam;
 cbinfo->server_cipher_list = NULL;
 cbinfo->host = host;
+#ifdef EXPERIMENTAL_TPDA
+cbinfo->event_action = NULL;
+#endif
 
 SSL_load_error_strings();          /* basic set up */
 OpenSSL_add_ssl_algorithms();
@@ -1717,7 +1760,7 @@ Argument:
   fd               the fd of the connection
   host             connected host (for messages)
   addr             the first address
-  ob               smtp transport options
+  tb               transport (always smtp)
 
 Returns:           OK on success
                    FAIL otherwise - note that tls_error() will not give DEFER
@@ -1726,9 +1769,10 @@ Returns:           OK on success
 
 int
 tls_client_start(int fd, host_item *host, address_item *addr,
-  void *v_ob)
+  transport_instance *tb)
 {
-smtp_transport_options_block * ob = v_ob;
+smtp_transport_options_block * ob =
+  (smtp_transport_options_block *)tb->options_block;
 static uschar txt[256];
 uschar * expciphers;
 X509 * server_cert;
@@ -1910,6 +1954,9 @@ if (request_ocsp)
   }
 #endif
 
+#ifdef EXPERIMENTAL_TPDA
+client_static_cbinfo->event_action = tb->tpda_event_action;
+#endif
 
 /* There doesn't seem to be a built-in timeout on connection. */
 
diff --git a/src/src/transport.c b/src/src/transport.c
index 3648bfc82..31437b146 100644
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -95,8 +95,8 @@ optionlist optionlist_transports[] = {
   { "shadow_transport", opt_stringptr|opt_public,
                  (void *)offsetof(transport_instance, shadow) },
 #ifdef EXPERIMENTAL_TPDA
-  { "tpda_delivery_action",opt_stringptr | opt_public,
-                 (void *)offsetof(transport_instance, tpda_delivery_action) },
+  { "tpda_event_action",opt_stringptr | opt_public,
+                 (void *)offsetof(transport_instance, tpda_event_action) },
 #endif
   { "transport_filter", opt_stringptr|opt_public,
                  (void *)offsetof(transport_instance, filter_command) },
diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 1865adee8..7b2a7d559 100644
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -180,10 +180,6 @@ optionlist smtp_transport_options[] = {
   { "tls_verify_hosts",     opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, tls_verify_hosts) }
 #endif
-#ifdef EXPERIMENTAL_TPDA
- ,{ "tpda_host_defer_action", opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, tpda_host_defer_action) },
-#endif
 };
 
 /* Size of the options list. An extern variable has to be used so that its
@@ -273,9 +269,6 @@ smtp_transport_options_block smtp_transport_option_defaults = {
   NULL,                /* dkim_sign_headers */
   NULL                 /* dkim_strict */
 #endif
-#ifdef EXPERIMENTAL_TPDA
- ,NULL                 /* tpda_host_defer_action */
-#endif
 };
 
 #ifdef EXPERIMENTAL_DSN
@@ -497,7 +490,8 @@ Arguments:
 Returns:         TRUE if an SMTP "QUIT" command should be sent, else FALSE
 */
 
-static BOOL check_response(host_item *host, int *errno_value, int more_errno,
+static BOOL
+check_response(host_item *host, int *errno_value, int more_errno,
   uschar *buffer, int *yield, uschar **message, BOOL *pass_message)
 {
 uschar *pl = US"";
@@ -648,7 +642,6 @@ else
    It might, for example, be used to write to the database log.
 
 Arguments:
-  ob                    transport options block
   addr                  the address item containing error information
   host                  the current host
 
@@ -656,36 +649,39 @@ Returns:   nothing
 */
 
 static void
-tpda_deferred(smtp_transport_options_block *ob, address_item *addr, host_item *host)
+tpda_deferred(address_item *addr, host_item *host)
 {
-uschar *action = ob->tpda_host_defer_action;
+uschar * action = addr->transport->tpda_event_action;
+uschar * save_domain;
+uschar * save_local;
+
 if (!action)
-	return;
-
-tpda_delivery_ip =         string_copy(host->address);
-tpda_delivery_port =       (host->port == PORT_NONE)? 25 : host->port;
-tpda_delivery_fqdn =       string_copy(host->name);
-tpda_delivery_local_part = string_copy(addr->local_part);
-tpda_delivery_domain =     string_copy(addr->domain);
-tpda_defer_errno =         addr->basic_errno;
-
-tpda_defer_errstr = addr->message
-  ? addr->basic_errno > 0
-    ? string_sprintf("%s: %s", addr->message, strerror(addr->basic_errno))
-    : string_copy(addr->message)
-  : addr->basic_errno > 0
-    ? string_copy(US strerror(addr->basic_errno))
-    : NULL;
+  return;
 
-DEBUG(D_transport)
-  debug_printf("  TPDA(host defer): tpda_host_defer_action=|%s| tpda_delivery_IP=%s\n",
-    action, tpda_delivery_ip);
+save_domain = deliver_domain;
+save_local = deliver_localpart;
+
+/*XXX would ip & port already be set up? */
+deliver_host_address = string_copy(host->address);
+deliver_host_port =    (host->port == PORT_NONE)? 25 : host->port;
+tpda_defer_errno =     addr->basic_errno;
 
 router_name =    addr->router->name;
 transport_name = addr->transport->name;
-if (!expand_string(action) && *expand_string_message)
-  log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand tpda_defer_action in %s: %s\n",
-    transport_name, expand_string_message);
+deliver_domain = addr->domain;
+deliver_localpart = addr->local_part;
+
+(void) tpda_raise_event(action, US"msg:host:defer",
+    addr->message
+      ? addr->basic_errno > 0
+	? string_sprintf("%s: %s", addr->message, strerror(addr->basic_errno))
+	: string_copy(addr->message)
+      : addr->basic_errno > 0
+	? string_copy(US strerror(addr->basic_errno))
+	: NULL);
+
+deliver_localpart = save_local;
+deliver_domain =    save_domain;
 router_name = transport_name = NULL;
 }
 #endif
@@ -952,147 +948,147 @@ smtp_auth(uschar *buffer, unsigned bufsize, address_item *addrlist, host_item *h
     smtp_transport_options_block *ob, BOOL is_esmtp,
     smtp_inblock *ibp, smtp_outblock *obp)
 {
-  int require_auth;
-  uschar *fail_reason = US"server did not advertise AUTH support";
+int require_auth;
+uschar *fail_reason = US"server did not advertise AUTH support";
 
-  smtp_authenticated = FALSE;
-  client_authenticator = client_authenticated_id = client_authenticated_sender = NULL;
-  require_auth = verify_check_this_host(&(ob->hosts_require_auth), NULL,
-    host->name, host->address, NULL);
+smtp_authenticated = FALSE;
+client_authenticator = client_authenticated_id = client_authenticated_sender = NULL;
+require_auth = verify_check_this_host(&(ob->hosts_require_auth), NULL,
+  host->name, host->address, NULL);
 
-  if (is_esmtp && !regex_AUTH) regex_AUTH =
-      regex_must_compile(US"\\n250[\\s\\-]AUTH\\s+([\\-\\w\\s]+)(?:\\n|$)",
-            FALSE, TRUE);
+if (is_esmtp && !regex_AUTH) regex_AUTH =
+    regex_must_compile(US"\\n250[\\s\\-]AUTH\\s+([\\-\\w\\s]+)(?:\\n|$)",
+	  FALSE, TRUE);
 
-  if (is_esmtp && regex_match_and_setup(regex_AUTH, buffer, 0, -1))
-    {
-    uschar *names = string_copyn(expand_nstring[1], expand_nlength[1]);
-    expand_nmax = -1;                          /* reset */
+if (is_esmtp && regex_match_and_setup(regex_AUTH, buffer, 0, -1))
+  {
+  uschar *names = string_copyn(expand_nstring[1], expand_nlength[1]);
+  expand_nmax = -1;                          /* reset */
 
-    /* Must not do this check until after we have saved the result of the
-    regex match above. */
+  /* Must not do this check until after we have saved the result of the
+  regex match above. */
 
-    if (require_auth == OK ||
-        verify_check_this_host(&(ob->hosts_try_auth), NULL, host->name,
-          host->address, NULL) == OK)
-      {
-      auth_instance *au;
-      fail_reason = US"no common mechanisms were found";
+  if (require_auth == OK ||
+      verify_check_this_host(&(ob->hosts_try_auth), NULL, host->name,
+	host->address, NULL) == OK)
+    {
+    auth_instance *au;
+    fail_reason = US"no common mechanisms were found";
 
-      DEBUG(D_transport) debug_printf("scanning authentication mechanisms\n");
+    DEBUG(D_transport) debug_printf("scanning authentication mechanisms\n");
 
-      /* Scan the configured authenticators looking for one which is configured
-      for use as a client, which is not suppressed by client_condition, and
-      whose name matches an authentication mechanism supported by the server.
-      If one is found, attempt to authenticate by calling its client function.
-      */
+    /* Scan the configured authenticators looking for one which is configured
+    for use as a client, which is not suppressed by client_condition, and
+    whose name matches an authentication mechanism supported by the server.
+    If one is found, attempt to authenticate by calling its client function.
+    */
 
-      for (au = auths; !smtp_authenticated && au != NULL; au = au->next)
-        {
-        uschar *p = names;
-        if (!au->client ||
-            (au->client_condition != NULL &&
-             !expand_check_condition(au->client_condition, au->name,
-               US"client authenticator")))
-          {
-          DEBUG(D_transport) debug_printf("skipping %s authenticator: %s\n",
-            au->name,
-            (au->client)? "client_condition is false" :
-                          "not configured as a client");
-          continue;
-          }
+    for (au = auths; !smtp_authenticated && au != NULL; au = au->next)
+      {
+      uschar *p = names;
+      if (!au->client ||
+	  (au->client_condition != NULL &&
+	   !expand_check_condition(au->client_condition, au->name,
+	     US"client authenticator")))
+	{
+	DEBUG(D_transport) debug_printf("skipping %s authenticator: %s\n",
+	  au->name,
+	  (au->client)? "client_condition is false" :
+			"not configured as a client");
+	continue;
+	}
 
-        /* Loop to scan supported server mechanisms */
+      /* Loop to scan supported server mechanisms */
 
-        while (*p != 0)
-          {
-          int rc;
-          int len = Ustrlen(au->public_name);
-          while (isspace(*p)) p++;
+      while (*p != 0)
+	{
+	int rc;
+	int len = Ustrlen(au->public_name);
+	while (isspace(*p)) p++;
 
-          if (strncmpic(au->public_name, p, len) != 0 ||
-              (p[len] != 0 && !isspace(p[len])))
-            {
-            while (*p != 0 && !isspace(*p)) p++;
-            continue;
-            }
+	if (strncmpic(au->public_name, p, len) != 0 ||
+	    (p[len] != 0 && !isspace(p[len])))
+	  {
+	  while (*p != 0 && !isspace(*p)) p++;
+	  continue;
+	  }
 
-          /* Found data for a listed mechanism. Call its client entry. Set
-          a flag in the outblock so that data is overwritten after sending so
-          that reflections don't show it. */
+	/* Found data for a listed mechanism. Call its client entry. Set
+	a flag in the outblock so that data is overwritten after sending so
+	that reflections don't show it. */
 
-          fail_reason = US"authentication attempt(s) failed";
-          obp->authenticating = TRUE;
-          rc = (au->info->clientcode)(au, ibp, obp,
-            ob->command_timeout, buffer, bufsize);
-          obp->authenticating = FALSE;
-          DEBUG(D_transport) debug_printf("%s authenticator yielded %d\n",
-            au->name, rc);
+	fail_reason = US"authentication attempt(s) failed";
+	obp->authenticating = TRUE;
+	rc = (au->info->clientcode)(au, ibp, obp,
+	  ob->command_timeout, buffer, bufsize);
+	obp->authenticating = FALSE;
+	DEBUG(D_transport) debug_printf("%s authenticator yielded %d\n",
+	  au->name, rc);
 
-          /* A temporary authentication failure must hold up delivery to
-          this host. After a permanent authentication failure, we carry on
-          to try other authentication methods. If all fail hard, try to
-          deliver the message unauthenticated unless require_auth was set. */
+	/* A temporary authentication failure must hold up delivery to
+	this host. After a permanent authentication failure, we carry on
+	to try other authentication methods. If all fail hard, try to
+	deliver the message unauthenticated unless require_auth was set. */
 
-          switch(rc)
-            {
-            case OK:
-            smtp_authenticated = TRUE;   /* stops the outer loop */
-	    client_authenticator = au->name;
-	    if (au->set_client_id != NULL)
-	      client_authenticated_id = expand_string(au->set_client_id);
-            break;
-
-            /* Failure after writing a command */
-
-            case FAIL_SEND:
-            return FAIL_SEND;
-
-            /* Failure after reading a response */
-
-            case FAIL:
-            if (errno != 0 || buffer[0] != '5') return FAIL;
-            log_write(0, LOG_MAIN, "%s authenticator failed H=%s [%s] %s",
-              au->name, host->name, host->address, buffer);
-            break;
-
-            /* Failure by some other means. In effect, the authenticator
-            decided it wasn't prepared to handle this case. Typically this
-            is the result of "fail" in an expansion string. Do we need to
-            log anything here? Feb 2006: a message is now put in the buffer
-            if logging is required. */
-
-            case CANCELLED:
-            if (*buffer != 0)
-              log_write(0, LOG_MAIN, "%s authenticator cancelled "
-                "authentication H=%s [%s] %s", au->name, host->name,
-                host->address, buffer);
-            break;
-
-            /* Internal problem, message in buffer. */
-
-            case ERROR:
-            set_errno(addrlist, 0, string_copy(buffer), DEFER, FALSE);
-            return ERROR;
-            }
+	switch(rc)
+	  {
+	  case OK:
+	  smtp_authenticated = TRUE;   /* stops the outer loop */
+	  client_authenticator = au->name;
+	  if (au->set_client_id != NULL)
+	    client_authenticated_id = expand_string(au->set_client_id);
+	  break;
+
+	  /* Failure after writing a command */
+
+	  case FAIL_SEND:
+	  return FAIL_SEND;
+
+	  /* Failure after reading a response */
+
+	  case FAIL:
+	  if (errno != 0 || buffer[0] != '5') return FAIL;
+	  log_write(0, LOG_MAIN, "%s authenticator failed H=%s [%s] %s",
+	    au->name, host->name, host->address, buffer);
+	  break;
+
+	  /* Failure by some other means. In effect, the authenticator
+	  decided it wasn't prepared to handle this case. Typically this
+	  is the result of "fail" in an expansion string. Do we need to
+	  log anything here? Feb 2006: a message is now put in the buffer
+	  if logging is required. */
+
+	  case CANCELLED:
+	  if (*buffer != 0)
+	    log_write(0, LOG_MAIN, "%s authenticator cancelled "
+	      "authentication H=%s [%s] %s", au->name, host->name,
+	      host->address, buffer);
+	  break;
+
+	  /* Internal problem, message in buffer. */
+
+	  case ERROR:
+	  set_errno(addrlist, 0, string_copy(buffer), DEFER, FALSE);
+	  return ERROR;
+	  }
 
-          break;  /* If not authenticated, try next authenticator */
-          }       /* Loop for scanning supported server mechanisms */
-        }         /* Loop for further authenticators */
-      }
+	break;  /* If not authenticated, try next authenticator */
+	}       /* Loop for scanning supported server mechanisms */
+      }         /* Loop for further authenticators */
     }
+  }
 
-  /* If we haven't authenticated, but are required to, give up. */
+/* If we haven't authenticated, but are required to, give up. */
 
-  if (require_auth == OK && !smtp_authenticated)
-    {
-    set_errno(addrlist, ERRNO_AUTHFAIL,
-      string_sprintf("authentication required but %s", fail_reason), DEFER,
-      FALSE);
-    return DEFER;
-    }
+if (require_auth == OK && !smtp_authenticated)
+  {
+  set_errno(addrlist, ERRNO_AUTHFAIL,
+    string_sprintf("authentication required but %s", fail_reason), DEFER,
+    FALSE);
+  return DEFER;
+  }
 
-  return OK;
+return OK;
 }
 
 
@@ -1295,9 +1291,14 @@ specially so they can be identified for retries. */
 
 if (continue_hostname == NULL)
   {
+  /* This puts port into host->port */
   inblock.sock = outblock.sock =
     smtp_connect(host, host_af, port, interface, ob->connect_timeout,
-      ob->keepalive, ob->dscp);   /* This puts port into host->port */
+		  ob->keepalive, ob->dscp
+#ifdef EXPERIMENTAL_TPDA
+		  , tblock->tpda_event_action
+#endif
+		);
 
   if (inblock.sock < 0)
     {
@@ -1321,6 +1322,17 @@ if (continue_hostname == NULL)
     if (!smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
       ob->command_timeout)) goto RESPONSE_FAILED;
 
+#ifdef EXPERIMENTAL_TPDA
+    if (tpda_raise_event(tblock->tpda_event_action, US"smtp:connect", buffer)
+	== DEFER)
+	{
+	uschar *message = US"deferred by smtp:connect event expansion";
+	set_errno(addrlist, 0, message, DEFER, FALSE);
+	yield = DEFER;
+	goto SEND_QUIT;
+	}
+#endif
+
     /* Now check if the helo_data expansion went well, and sign off cleanly if
     it didn't. */
 
@@ -1375,7 +1387,7 @@ goto SEND_QUIT;
   /* Alas; be careful, since this goto is not an error-out, so conceivably
   we might set data between here and the target which we assume to exist
   and be usable.  I can see this coming back to bite us. */
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   if (smtps)
     {
     tls_offered = TRUE;
@@ -1384,7 +1396,7 @@ goto SEND_QUIT;
     smtp_command = US"SSL-on-connect";
     goto TLS_NEGOTIATE;
     }
-  #endif
+#endif
 
   if (esmtp)
     {
@@ -1421,13 +1433,13 @@ goto SEND_QUIT;
 
   /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   tls_offered = esmtp &&
     pcre_exec(regex_STARTTLS, NULL, CS buffer, Ustrlen(buffer), 0,
       PCRE_EOPT, NULL, 0) >= 0;
-  #endif
+#endif
 
-  #ifndef DISABLE_PRDR
+#ifndef DISABLE_PRDR
   prdr_offered = esmtp &&
     (pcre_exec(regex_PRDR, NULL, CS buffer, Ustrlen(buffer), 0,
       PCRE_EOPT, NULL, 0) >= 0) &&
@@ -1436,7 +1448,7 @@ goto SEND_QUIT;
 
   if (prdr_offered)
     {DEBUG(D_transport) debug_printf("PRDR usable\n");}
-  #endif
+#endif
   }
 
 /* For continuing deliveries down the same channel, the socket is the standard
@@ -1493,7 +1505,7 @@ if (tls_offered && !suppress_tls &&
   else
   TLS_NEGOTIATE:
     {
-    int rc = tls_client_start(inblock.sock, host, addrlist, ob);
+    int rc = tls_client_start(inblock.sock, host, addrlist, tblock);
 
     /* TLS negotiation failed; give an error. From outside, this function may
     be called again to try in clear on a new connection, if the options permit
@@ -1599,9 +1611,9 @@ continued session down a previously-used socket, we haven't just done EHLO, so
 we skip this. */
 
 if (continue_hostname == NULL
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     || tls_out.active >= 0
-    #endif
+#endif
     )
   {
   /* Set for IGNOREQUOTA if the response to LHLO specifies support and the
@@ -1738,12 +1750,11 @@ if (prdr_offered)
 	  {			/* at least two recipients to send */
 	  prdr_active = TRUE;
 	  sprintf(CS p, " PRDR"); p += 5;
-	  goto prdr_is_active;
+	  break;
 	  }
       break;
       }
   }
-prdr_is_active:
 #endif
 
 #ifdef EXPERIMENTAL_DSN
@@ -1786,7 +1797,10 @@ otherwise no check - this feature is expected to be used with LMTP and other
 cases where non-standard addresses (e.g. without domains) might be required. */
 
 if (smtp_mail_auth_str(p, sizeof(buffer) - (p-buffer), addrlist, ob))
-    return ERROR;
+  {
+  yield = ERROR;
+  goto SEND_QUIT;
+  }
 
 /* From here until we send the DATA command, we can make use of PIPELINING
 if the server host supports it. The code has to be able to check the responses
@@ -1840,25 +1854,22 @@ for (addr = first_addr;
   int count;
   BOOL no_flush;
 
-  #ifdef EXPERIMENTAL_DSN
-  if(smtp_use_dsn)
-    addr->dsn_aware = dsn_support_yes;
-  else
-    addr->dsn_aware = dsn_support_no;
-  #endif
+#ifdef EXPERIMENTAL_DSN
+  addr->dsn_aware = smtp_use_dsn ? dsn_support_yes : dsn_support_no;
+#endif
 
   if (addr->transport_return != PENDING_DEFER) continue;
 
   address_count++;
   no_flush = smtp_use_pipelining && (!mua_wrapper || addr->next != NULL);
 
-  #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
   /* Add any DSN flags to the rcpt command and add to the sent string */
 
   p = buffer;
   *p = 0;
 
-  if ((smtp_use_dsn) && ((addr->dsn_flags & rf_dsnlasthop) != 1))
+  if (smtp_use_dsn && (addr->dsn_flags & rf_dsnlasthop) != 1)
     {
     if ((addr->dsn_flags & rf_dsnflags) != 0)
       {
@@ -1867,7 +1878,6 @@ for (addr = first_addr;
       strcpy(p, " NOTIFY=");
       while (*p) p++;
       for (i = 0; i < 4; i++)
-        {
         if ((addr->dsn_flags & rf_list[i]) != 0)
           {
           if (!first) *p++ = ',';
@@ -1875,16 +1885,16 @@ for (addr = first_addr;
           strcpy(p, rf_names[i]);
           while (*p) p++;
           }
-        }
       }
 
-    if (addr->dsn_orcpt != NULL) {
+    if (addr->dsn_orcpt != NULL)
+      {
       string_format(p, sizeof(buffer) - (p-buffer), " ORCPT=%s",
         addr->dsn_orcpt);
       while (*p) p++;
       }
     }
-  #endif
+#endif
 
 
   /* Now send the RCPT command, and process outstanding responses when
@@ -1892,13 +1902,13 @@ for (addr = first_addr;
   yield as OK, because this error can often mean that there is a problem with
   just one address, so we don't want to delay the host. */
 
-  #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
   count = smtp_write_command(&outblock, no_flush, "RCPT TO:<%s>%s%s\r\n",
     transport_rcpt_address(addr, tblock->rcpt_include_affixes), igquotstr, buffer);
-  #else
+#else
   count = smtp_write_command(&outblock, no_flush, "RCPT TO:<%s>%s\r\n",
     transport_rcpt_address(addr, tblock->rcpt_include_affixes), igquotstr);
-  #endif
+#endif
 
   if (count < 0) goto SEND_FAILED;
   if (count > 0)
@@ -1989,6 +1999,7 @@ if (!ok) ok = TRUE; else
   DEBUG(D_transport|D_v)
     debug_printf("  SMTP>> writing message and terminating \".\"\n");
   transport_count = 0;
+
 #ifndef DISABLE_DKIM
   ok = dkim_transport_write_message(addrlist, inblock.sock,
     topt_use_crlf | topt_end_dot | topt_escape_headers |
@@ -2115,9 +2126,9 @@ if (!ok) ok = TRUE; else
     /* Set up confirmation if needed - applies only to SMTP */
 
     if (
-        #ifndef EXPERIMENTAL_TPDA
+#ifndef EXPERIMENTAL_TPDA
           (log_extra_selector & LX_smtp_confirmation) != 0 &&
-        #endif
+#endif
           !lmtp
        )
       {
@@ -2293,10 +2304,10 @@ if (!ok)
   in message and save_errno, and setting_up will always be true. Treat as
   a temporary error. */
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   TLS_FAILED:
   code = '4';
-  #endif
+#endif
 
   /* If the failure happened while setting up the call, see if the failure was
   a 5xx response (this will either be on connection, or following HELO - a 5xx
@@ -2489,7 +2500,7 @@ if (completed_address && ok && send_quit)
       when TLS is shut down. We test for this by sending a new EHLO. If we
       don't get a good response, we don't attempt to pass the socket on. */
 
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       if (tls_out.active >= 0)
         {
         tls_close(FALSE, TRUE);
@@ -2500,7 +2511,7 @@ if (completed_address && ok && send_quit)
                smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
                  ob->command_timeout);
         }
-      #endif
+#endif
 
       /* If the socket is successfully passed, we musn't send QUIT (or
       indeed anything!) from here. */
@@ -2556,6 +2567,11 @@ specified in the transports, and therefore not visible at top level, in which
 case continue_more won't get set. */
 
 (void)close(inblock.sock);
+
+#ifdef EXPERIMENTAL_TPDA
+(void) tpda_raise_event(tblock->tpda_event_action, US"tcp:close", NULL);
+#endif
+
 continue_transport = NULL;
 continue_hostname = NULL;
 return yield;
@@ -2644,13 +2660,13 @@ for (addr = addrlist; addr != NULL; addr = addr->next)
   addr->basic_errno = 0;
   addr->more_errno = (host->mx >= 0)? 'M' : 'A';
   addr->message = NULL;
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   addr->cipher = NULL;
   addr->ourcert = NULL;
   addr->peercert = NULL;
   addr->peerdn = NULL;
   addr->ocsp = OCSP_NOT_REQ;
-  #endif
+#endif
   }
 return first_addr;
 }
@@ -3263,10 +3279,10 @@ for (cutoff_retry = 0; expired &&
                          first_addr->basic_errno != ERRNO_TLSFAILURE)
         write_logs(first_addr, host);
 
-      #ifdef EXPERIMENTAL_TPDA
+#ifdef EXPERIMENTAL_TPDA
       if (rc == DEFER)
-        tpda_deferred(ob, first_addr, host);
-      #endif
+        tpda_deferred(first_addr, host);
+#endif
 
       /* If STARTTLS was accepted, but there was a failure in setting up the
       TLS session (usually a certificate screwup), and the host is not in
@@ -3277,16 +3293,16 @@ for (cutoff_retry = 0; expired &&
       session, so the in-clear transmission after those errors, if permitted,
       happens inside smtp_deliver().] */
 
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       if (  rc == DEFER
 	 && first_addr->basic_errno == ERRNO_TLSFAILURE
 	 && ob->tls_tempfail_tryclear
 	 && verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
              host->address, NULL) != OK
-#ifdef EXPERIMENTAL_DANE
+# ifdef EXPERIMENTAL_DANE
 	 && verify_check_this_host(&(ob->hosts_require_dane), NULL, host->name,
              host->address, NULL) != OK
-#endif
+# endif
 	 )
         {
         log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
@@ -3296,12 +3312,12 @@ for (cutoff_retry = 0; expired &&
           expanded_hosts != NULL, &message_defer, TRUE);
         if (rc == DEFER && first_addr->basic_errno != ERRNO_AUTHFAIL)
           write_logs(first_addr, host);
-        #ifdef EXPERIMENTAL_TPDA
+# ifdef EXPERIMENTAL_TPDA
         if (rc == DEFER)
-          tpda_deferred(ob, first_addr, host);
-        #endif
+          tpda_deferred(first_addr, host);
+# endif
         }
-      #endif
+#endif	/*SUPPORT_TLS*/
       }
 
     /* Delivery attempt finished */
diff --git a/src/src/transports/smtp.h b/src/src/transports/smtp.h
index d968a4d54..4494adfb2 100644
--- a/src/src/transports/smtp.h
+++ b/src/src/transports/smtp.h
@@ -85,9 +85,6 @@ typedef struct {
   uschar *dkim_sign_headers;
   uschar *dkim_strict;
 #endif
-#ifdef EXPERIMENTAL_TPDA
-  uschar *tpda_host_defer_action;
-#endif
 } smtp_transport_options_block;
 
 /* Data for reading the private options. */
diff --git a/src/src/verify.c b/src/src/verify.c
index c2ee47892..edd9ad17d 100644
--- a/src/src/verify.c
+++ b/src/src/verify.c
@@ -462,6 +462,7 @@ else
 
     deliver_host = host->name;
     deliver_host_address = host->address;
+    deliver_host_port = host->port;
     deliver_domain = addr->domain;
 
     if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
@@ -501,7 +502,12 @@ else
     tls_retry_connection:
 
     inblock.sock = outblock.sock =
-      smtp_connect(host, host_af, port, interface, callout_connect, TRUE, NULL);
+      smtp_connect(host, host_af, port, interface, callout_connect, TRUE, NULL
+#ifdef EXPERIMENTAL_TPDA
+    /*XXX tpda action? NULL for now. */
+		  , NULL
+#endif
+		  );
     /* reconsider DSCP here */
     if (inblock.sock < 0)
       {
@@ -533,12 +539,23 @@ else
     /* Unless ssl-on-connect, wait for the initial greeting */
     smtps_redo_greeting:
 
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     if (!smtps || (smtps && tls_out.active >= 0))
-    #endif
+#endif
+      {
       if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
         goto RESPONSE_FAILED;
 
+#ifdef EXPERIMENTAL_TPDA
+      if (tpda_raise_event(addr->transport->tpda_event_action,
+			    US"smtp:connect", responsebuffer) == DEFER)
+	{
+	/* Logging?  Debug? */
+	goto RESPONSE_FAILED;
+	}
+#endif
+      }
+
     /* Not worth checking greeting line for ESMTP support */
     if (!(esmtp = verify_check_this_host(&(ob->hosts_avoid_esmtp), NULL,
       host->name, host->address, NULL) != OK))
@@ -547,14 +564,14 @@ else
 
     tls_redo_helo:
 
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     if (smtps  &&  tls_out.active < 0)	/* ssl-on-connect, first pass */
       {
       tls_offered = TRUE;
       ob->tls_tempfail_tryclear = FALSE;
       }
-      else				/* all other cases */
-    #endif
+    else				/* all other cases */
+#endif
 
       { esmtp_retry:
 
@@ -568,26 +585,26 @@ else
 	  done= FALSE;
 	  goto RESPONSE_FAILED;
 	  }
-        #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
         tls_offered = FALSE;
-        #endif
+#endif
         esmtp = FALSE;
         goto esmtp_retry;			/* fallback to HELO */
         }
 
       /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       if (esmtp && !suppress_tls &&  tls_out.active < 0)
-        {
-          if (regex_STARTTLS == NULL) regex_STARTTLS =
-	    regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
+	{
+	if (regex_STARTTLS == NULL) regex_STARTTLS =
+	  regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
 
-          tls_offered = pcre_exec(regex_STARTTLS, NULL, CS responsebuffer,
-			Ustrlen(responsebuffer), 0, PCRE_EOPT, NULL, 0) >= 0;
+	tls_offered = pcre_exec(regex_STARTTLS, NULL, CS responsebuffer,
+		      Ustrlen(responsebuffer), 0, PCRE_EOPT, NULL, 0) >= 0;
 	}
       else
         tls_offered = FALSE;
-      #endif
+#endif
       }
 
     /* If TLS is available on this connection attempt to
@@ -598,7 +615,7 @@ else
     the client not be required to use TLS. If the response is bad, copy the buffer
     for error analysis. */
 
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     if (tls_offered &&
     	verify_check_this_host(&(ob->hosts_avoid_tls), NULL, host->name,
   	  host->address, NULL) != OK &&
@@ -623,11 +640,11 @@ else
         {
         if (errno != 0 || buffer2[0] == 0 ||
         	(buffer2[0] == '4' && !ob->tls_tempfail_tryclear))
-  	{
-  	Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
-  	done= FALSE;
-  	goto RESPONSE_FAILED;
-  	}
+	  {
+	  Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
+	  done= FALSE;
+	  goto RESPONSE_FAILED;
+	  }
         }
 
        /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
@@ -637,36 +654,36 @@ else
 	int rc;
 
 	ob->command_timeout = callout;
-        rc = tls_client_start(inblock.sock, host, addr, ob);
+        rc = tls_client_start(inblock.sock, host, addr, addr->transport);
 	ob->command_timeout = oldtimeout;
 
         /* TLS negotiation failed; give an error.  Try in clear on a new connection,
            if the options permit it for this host. */
         if (rc != OK)
-          {
-  	if (  rc == DEFER
-	   && ob->tls_tempfail_tryclear
-	   && !smtps
-	   && verify_check_this_host(&(ob->hosts_require_tls), NULL,
-	     host->name, host->address, NULL) != OK
+	  {
+	  if (  rc == DEFER
+	     && ob->tls_tempfail_tryclear
+	     && !smtps
+	     && verify_check_this_host(&(ob->hosts_require_tls), NULL,
+	       host->name, host->address, NULL) != OK
 #ifdef EXPERIMENTAL_DANE
-	   && verify_check_this_host(&(ob->hosts_require_dane), NULL,
-	     host->name, host->address, NULL) != OK
+	     && verify_check_this_host(&(ob->hosts_require_dane), NULL,
+	       host->name, host->address, NULL) != OK
 #endif
-	   )
-  	  {
-            (void)close(inblock.sock);
-  	  log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
-  	    "to %s [%s] (not in hosts_require_tls)", host->name, host->address);
-  	  suppress_tls = TRUE;
-  	  goto tls_retry_connection;
-  	  }
-  	/*save_errno = ERRNO_TLSFAILURE;*/
-  	/*message = US"failure while setting up TLS session";*/
-  	send_quit = FALSE;
-  	done= FALSE;
-  	goto TLS_FAILED;
-  	}
+	     )
+	    {
+	      (void)close(inblock.sock);
+	    log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
+	      "to %s [%s] (not in hosts_require_tls)", host->name, host->address);
+	    suppress_tls = TRUE;
+	    goto tls_retry_connection;
+	    }
+	  /*save_errno = ERRNO_TLSFAILURE;*/
+	  /*message = US"failure while setting up TLS session";*/
+	  send_quit = FALSE;
+	  done= FALSE;
+	  goto TLS_FAILED;
+	  }
 
         /* TLS session is set up.  Copy info for logging. */
         addr->cipher = tls_out.cipher;
@@ -674,7 +691,7 @@ else
 
         /* For SMTPS we need to wait for the initial OK response, then do HELO. */
         if (smtps)
-  	 goto smtps_redo_greeting;
+	  goto smtps_redo_greeting;
 
         /* For STARTTLS we need to redo EHLO */
         goto tls_redo_helo;
@@ -714,13 +731,13 @@ else
         cutthrough_delivery= FALSE;
         HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
         }
-      #ifndef DISABLE_DKIM
+#ifndef DISABLE_DKIM
       if (ob->dkim_domain)
         {
         cutthrough_delivery= FALSE;
         HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
         }
-      #endif
+#endif
       }
 
     SEND_FAILED:
@@ -1006,10 +1023,14 @@ else
         cancel_cutthrough_connection("multiple verify calls");
       if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
 
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       tls_close(FALSE, TRUE);
-      #endif
+#endif
       (void)close(inblock.sock);
+#ifdef EXPERIMENTAL_TPDA
+      (void) tpda_raise_event(addr->transport->tpda_event_action,
+			      US"tcp:close", NULL);
+#endif
       }
 
     }    /* Loop through all hosts, while !done */
diff --git a/test/confs/0601 b/test/confs/0601
index 58b47d517..84f7d38a6 100644
--- a/test/confs/0601
+++ b/test/confs/0601
@@ -4,17 +4,12 @@
 exim_path = EXIM_PATH
 spool_directory = DIR/spool
 log_file_path = DIR/spool/log/%slog
+queue_only
 
 # ----- Main settings -----
 
-acl_smtp_connect = check
+acl_smtp_connect = accept udpsend = <; 127.0.0.1 ; 1223 ; message from exim
+acl_smtp_rcpt = accept
 
 
-# ----- ACL -----
-
-begin acl
-
-check:
-  warn	udpsend = <; 127.0.0.1 ; 1223 ; message from exim
-
 # End
diff --git a/test/confs/5608 b/test/confs/5608
index 55d9a2015..272d5f638 100644
--- a/test/confs/5608
+++ b/test/confs/5608
@@ -55,6 +55,7 @@ check_data:
   accept
 
 logger:
+  accept condition = ${if !eq {msg} {${listextract{1}{$tpda_event}}}}
   warn	logwrite = client ocsp status: $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
@@ -100,8 +101,7 @@ send_to_server1:
   hosts_require_tls =	*
   hosts_request_ocsp =	:
   headers_add =			X-TLS-out: ocsp status $tls_out_ocsp
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =		${acl {logger}}
 
 # norequire: request stapling but do not verify
 send_to_server2:
@@ -113,8 +113,7 @@ send_to_server2:
   hosts_require_tls =	*
 # note no ocsp mention here
   headers_add =			X-TLS-out: ocsp status $tls_out_ocsp
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =		${acl {logger}}
 
 # (any other name): request and verify
 send_to_server3:
@@ -127,8 +126,7 @@ send_to_server3:
   hosts_require_tls =	*
   hosts_require_ocsp =	*
   headers_add =			X-TLS-out: ocsp status $tls_out_ocsp
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =		${acl {logger}}
 
 # (any other name): request and verify, ssl-on-connect
 send_to_server4:
@@ -142,8 +140,7 @@ send_to_server4:
   hosts_require_tls =  *
   hosts_require_ocsp = *
   headers_add =			X-TLS-out: ocsp status $tls_out_ocsp
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =		${acl {logger}}
 
 
 # ----- Retry -----
diff --git a/test/confs/5658 b/test/confs/5658
index e8f2494f6..e4c346a96 100644
--- a/test/confs/5658
+++ b/test/confs/5658
@@ -52,6 +52,7 @@ check_data:
   accept
 
 logger:
+  accept condition = ${if !eq {msg} {${listextract{1}{$tpda_event}}}}
   warn	logwrite = client ocsp status: $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
@@ -99,8 +100,7 @@ send_to_server1:
   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =	${acl {logger}}
 
 send_to_server2:
   driver = smtp
@@ -113,8 +113,7 @@ send_to_server2:
   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =	${acl {logger}}
 
 send_to_server3:
   driver = smtp
@@ -129,8 +128,7 @@ send_to_server3:
   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =	${acl {logger}}
 
 send_to_server4:
   driver = smtp
@@ -146,8 +144,7 @@ send_to_server4:
   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =	${acl {logger}}
 
 
 # ----- Retry -----
diff --git a/test/confs/5700 b/test/confs/5700
index 52b28018a..0856bb056 100644
--- a/test/confs/5700
+++ b/test/confs/5700
@@ -18,22 +18,58 @@ acl_smtp_data = accept
 
 begin acl
 
-logger:
-    accept condition = ${if eq {$acl_arg2}{domain1}}
-	   logwrite = \
-	    $acl_arg1 \
-	    ip <$tpda_delivery_ip> \
-	    port <$tpda_delivery_port> \
-	    fqdn <$tpda_delivery_fqdn> \
-	    local_part <$tpda_delivery_local_part> \
-	    domain <$tpda_delivery_domain> \
-	    confirmation <$tpda_delivery_confirmation> \
+ev_tcp:
+    accept condition = ${if eq {$tpda_event}{tcp:connect}}
+	   logwrite = . [$host_address]:$sending_port
+    accept condition = ${if eq {$tpda_event}{tcp:close}}
+	   logwrite = . [$sending_ip_address] -> \
+			[$host_address]:$host_port
+    accept
+
+ev_smtp:
+    accept
+	   logwrite = . [$sending_ip_address] -> \
+			[$host_address]:$host_port
+	   logwrite = . banner <$tpda_data>
+
+ev_msg:
+    accept condition = ${if !eq {$acl_arg2}{domain1}}
+	   logwrite = $this_expansion_will_fail
+
+    accept condition = ${if eq {$acl_arg1}{msg:delivery}}
+	   logwrite = . \
+	    delivery \
+	    ip <$host_address> \
+	    port <$host_port> \
+	    fqdn <$host> \
+	    local_part <$local_part> \
+	    domain <$domain> \
+	    confirmation <$tpda_data> \
+	    router <$router_name> \
+	    transport <$transport_name>
+
+    accept condition = ${if eq {$acl_arg1}{msg:host:defer}}
+	   logwrite = . \
+	    deferral \
+	    ip <$host_address> \
+	    port <$host_port> \
+	    fqdn <$host> \
+	    local_part <$local_part> \
+	    domain <$domain> \
 	    errno <$tpda_defer_errno> \
-	    errstr <$tpda_defer_errstr> \
+	    errstr <$tpda_data> \
 	    router <$router_name> \
 	    transport <$transport_name>
 
-    accept logwrite = $this_expansion_will_fail
+logger:
+    warn   logwrite = event $tpda_event
+    accept condition = ${if eq {tcp} {${listextract{1}{$tpda_event}}}}
+	   acl = ev_tcp
+    accept condition = ${if eq {smtp} {${listextract{1}{$tpda_event}}}}
+	   acl = ev_smtp
+    accept condition = ${if eq {msg} {${listextract{1}{$tpda_event}}}}
+	   acl = ev_msg $tpda_event $acl_arg2
+
 
 # ----- Routers -----
 
@@ -61,7 +97,6 @@ smtp:
   port = PORT_S
   command_timeout = 1s
   final_timeout = 1s
-  tpda_delivery_action =   ${acl {logger} {delivery} {$domain} }
-  tpda_host_defer_action = ${acl {logger} {deferral} {$domain} }
+  tpda_event_action =   ${acl {logger} {$tpda_event} {$domain} }
 
 # End
diff --git a/test/confs/5750 b/test/confs/5750
index a8ff60350..bcb03ac5d 100644
--- a/test/confs/5750
+++ b/test/confs/5750
@@ -32,10 +32,16 @@ tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server2.example.com/
 #
 
 begin acl
-logger:
-  warn   logwrite =  $acl_arg1 $tpda_delivery_local_part
+
+ev_tls:
+  accept logwrite =  $tpda_event depth=$tpda_data \
+			<${certextract {subject} {$tls_out_peercert}}>
+#	 message = noooo
+
+ev_msg:
+  warn   logwrite =  $acl_arg1 $local_part
   warn   logwrite =  ${if !def:tls_out_ourcert \
-		{NO CLENT CERT presented} \
+		{NO CLIENT CERT presented} \
 		{Our cert SN: ${certextract{subject}{$tls_out_ourcert}}}}
   accept condition = ${if !def:tls_out_peercert}
 	 logwrite =  No Peer cert
@@ -51,6 +57,12 @@ logger:
 #	 logwrite =       ${certextract {ocsp_uri}	{$tls_out_peercert} {OCU <$value>}{(no OCU)}}
 	 logwrite =       ${certextract {crl_uri}	{$tls_out_peercert} {CRU <$value>}{(no CRU)}}
 
+logger:
+  accept condition = ${if eq {msg} {${listextract{1}{$tpda_event}}}}
+	 acl = ev_msg $tpda_event $acl_arg2
+  accept condition = ${if eq {tls} {${listextract{1}{$tpda_event}}}}
+	 message =   ${acl {ev_tls}}
+  accept
 
 # ----- Routers -----
 
@@ -81,8 +93,7 @@ send_to_server:
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}
 
-  tpda_delivery_action =   ${acl {logger} {delivery} {$domain} }
-  tpda_host_defer_action = ${acl {logger} {deferral} {$domain} }
+  tpda_event_action =   ${acl {logger} {$tpda_event} {$domain} }
 
 # ----- Retry -----
 
diff --git a/test/confs/5760 b/test/confs/5760
index e9868d109..c3b49d1b7 100644
--- a/test/confs/5760
+++ b/test/confs/5760
@@ -32,10 +32,16 @@ tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server2.example.com/
 #
 
 begin acl
-logger:
-  warn   logwrite =  $acl_arg1 $tpda_delivery_local_part
+
+ev_tls:
+  accept logwrite =  $tpda_event depth=$tpda_data \
+			<${certextract {subject} {$tls_out_peercert}}>
+#	 message = nooooo
+
+ev_msg:
+  warn   logwrite =  $acl_arg1 $local_part
   warn   logwrite =  ${if !def:tls_out_ourcert \
-		{NO CLENT CERT presented} \
+		{NO CLIENT CERT presented} \
 		{Our cert SN: ${certextract{subject}{$tls_out_ourcert}}}}
   accept condition = ${if !def:tls_out_peercert}
 	 logwrite =  No Peer cert
@@ -51,6 +57,12 @@ logger:
 	 logwrite =       ${certextract {ocsp_uri}	{$tls_out_peercert} {OCU <$value>}{(no OCU)}}
 	 logwrite =       ${certextract {crl_uri}	{$tls_out_peercert} {CRU <$value>}{(no CRU)}}
 
+logger:
+  accept condition = ${if eq {msg} {${listextract{1}{$tpda_event}}}}
+	 acl =	     ev_msg $tpda_event $acl_arg2
+  accept condition = ${if eq {tls} {${listextract{1}{$tpda_event}}}}
+	 message =   ${acl {ev_tls}}
+  accept
 
 # ----- Routers -----
 
@@ -81,8 +93,7 @@ send_to_server:
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}
 
-  tpda_delivery_action =   ${acl {logger} {delivery} {$domain} }
-  tpda_host_defer_action = ${acl {logger} {deferral} {$domain} }
+  tpda_event_action =   ${acl {logger} {$tpda_event} {$domain} }
 
 # ----- Retry -----
 
diff --git a/test/log/0601 b/test/log/0601
index 1d4157f7f..6f48bb034 100644
--- a/test/log/0601
+++ b/test/log/0601
@@ -1 +1,6 @@
-1999-03-02 09:44:33 U=CALLER rejected connection in "connect" ACL
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local-smtp S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 ** CALLER@the.local.host.name: Unrouteable address
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= <> R=10HmaX-0005vi-00 U=EXIMUSER P=local S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 ** CALLER@the.local.host.name: Unrouteable address
+1999-03-02 09:44:33 10HmaY-0005vi-00 Frozen (delivery error message)
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
diff --git a/test/log/5700 b/test/log/5700
index d11936571..150aef773 100644
--- a/test/log/5700
+++ b/test/log/5700
@@ -1,19 +1,43 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
+1999-03-02 09:44:33 10HmaY-0005vi-00 event tcp:connect
+1999-03-02 09:44:33 10HmaY-0005vi-00 . [127.0.0.1]:-1
+1999-03-02 09:44:33 10HmaY-0005vi-00 event smtp:connect
+1999-03-02 09:44:33 10HmaY-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
+1999-03-02 09:44:33 10HmaY-0005vi-00 . banner <220 ESMTP>
+1999-03-02 09:44:33 10HmaY-0005vi-00 event tcp:close
+1999-03-02 09:44:33 10HmaY-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userx@domain1 R=others T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
-1999-03-02 09:44:33 10HmaY-0005vi-00 delivery ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> confirmation <250 OK> errno <0> errstr <> router <others> transport <smtp>
+1999-03-02 09:44:33 10HmaY-0005vi-00 event msg:delivery
+1999-03-02 09:44:33 10HmaY-0005vi-00 . delivery ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> confirmation <250 OK> router <others> transport <smtp>
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
+1999-03-02 09:44:33 10HmaX-0005vi-00 event tcp:connect
+1999-03-02 09:44:33 10HmaX-0005vi-00 . [127.0.0.1]:-1
+1999-03-02 09:44:33 10HmaX-0005vi-00 event smtp:connect
+1999-03-02 09:44:33 10HmaX-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
+1999-03-02 09:44:33 10HmaX-0005vi-00 . banner <220 ESMTP>
+1999-03-02 09:44:33 10HmaX-0005vi-00 event tcp:close
+1999-03-02 09:44:33 10HmaX-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@domain2 R=others T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
-1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_deliver_action in smtp: error from acl "logger"
+1999-03-02 09:44:33 10HmaX-0005vi-00 event msg:delivery
+1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_event_action msg:delivery in smtp: error from acl "logger"
 
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 event tcp:connect
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . [127.0.0.1]:-1
+1999-03-02 09:44:33 10HmaZ-0005vi-00 event smtp:connect
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . banner <220 ESMTP>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 event tcp:close
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
 1999-03-02 09:44:33 10HmaZ-0005vi-00 SMTP timeout while connected to 127.0.0.1 [127.0.0.1] after EHLO the.local.host.name: Connection timed out
-1999-03-02 09:44:33 10HmaZ-0005vi-00 deferral ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> confirmation <> errno <110> errstr <SMTP timeout while connected to 127.0.0.1 [127.0.0.1] after EHLO the.local.host.name: Connection timed out> router <others> transport <smtp>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 event msg:host:defer
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . deferral ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> errno <110> errstr <SMTP timeout while connected to 127.0.0.1 [127.0.0.1] after EHLO the.local.host.name: Connection timed out> router <others> transport <smtp>
 1999-03-02 09:44:33 10HmaZ-0005vi-00 == userx@domain1 R=others T=smtp defer (dd): Connection timed out: SMTP timeout while connected to 127.0.0.1 [127.0.0.1] after EHLO the.local.host.name
 1999-03-02 09:44:33 10HmaZ-0005vi-00 ** userx@domain1: retry timeout exceeded
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= <> R=10HmaZ-0005vi-00 U=EXIMUSER P=local S=sss
diff --git a/test/log/5750 b/test/log/5750
index 845624676..c13fe6a3b 100644
--- a/test/log/5750
+++ b/test/log/5750
@@ -1,9 +1,10 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 tls:cert depth=0 <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (certificate verification failed): certificate invalid
-1999-03-02 09:44:33 10HmaX-0005vi-00 deferral bad
-1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLENT CERT presented
+1999-03-02 09:44:33 10HmaX-0005vi-00 msg:host:defer bad
+1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLIENT CERT presented
 1999-03-02 09:44:33 10HmaX-0005vi-00 Peer cert:
 1999-03-02 09:44:33 10HmaX-0005vi-00 ver <3>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SN  <CN=server1.example.com>
@@ -16,12 +17,13 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
 1999-03-02 09:44:33 10HmaX-0005vi-00 => bad@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
-1999-03-02 09:44:33 10HmaX-0005vi-00 delivery bad
-1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLENT CERT presented
+1999-03-02 09:44:33 10HmaX-0005vi-00 msg:delivery bad
+1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLIENT CERT presented
 1999-03-02 09:44:33 10HmaX-0005vi-00 No Peer cert
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth=0 <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 => good@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 DN="CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
-1999-03-02 09:44:33 10HmaY-0005vi-00 delivery good
+1999-03-02 09:44:33 10HmaY-0005vi-00 msg:delivery good
 1999-03-02 09:44:33 10HmaY-0005vi-00 Our cert SN: CN=server2.example.com
 1999-03-02 09:44:33 10HmaY-0005vi-00 Peer cert:
 1999-03-02 09:44:33 10HmaY-0005vi-00 ver <3>
diff --git a/test/log/5760 b/test/log/5760
index 6b0b59597..e8fd95fd2 100644
--- a/test/log/5760
+++ b/test/log/5760
@@ -3,8 +3,8 @@
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=2 error=self signed certificate in certificate chain cert=/O=example.com/CN=clica CA
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (SSL_connect): error: <<detail omitted>>
-1999-03-02 09:44:33 10HmaX-0005vi-00 deferral bad
-1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLENT CERT presented
+1999-03-02 09:44:33 10HmaX-0005vi-00 msg:host:defer bad
+1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLIENT CERT presented
 1999-03-02 09:44:33 10HmaX-0005vi-00 Peer cert:
 1999-03-02 09:44:33 10HmaX-0005vi-00 ver <2>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SN  <CN=clica CA,O=example.com>
@@ -18,12 +18,15 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 (no CRU)
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
 1999-03-02 09:44:33 10HmaX-0005vi-00 => bad@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
-1999-03-02 09:44:33 10HmaX-0005vi-00 delivery bad
-1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLENT CERT presented
+1999-03-02 09:44:33 10HmaX-0005vi-00 msg:delivery bad
+1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLIENT CERT presented
 1999-03-02 09:44:33 10HmaX-0005vi-00 No Peer cert
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth=2 <CN=clica CA,O=example.com>
+1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth=1 <CN=clica Signing Cert,O=example.com>
+1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth=0 <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 => good@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
-1999-03-02 09:44:33 10HmaY-0005vi-00 delivery good
+1999-03-02 09:44:33 10HmaY-0005vi-00 msg:delivery good
 1999-03-02 09:44:33 10HmaY-0005vi-00 Our cert SN: CN=server2.example.com
 1999-03-02 09:44:33 10HmaY-0005vi-00 Peer cert:
 1999-03-02 09:44:33 10HmaY-0005vi-00 ver <2>
diff --git a/test/paniclog/5700 b/test/paniclog/5700
index 4f28d19c4..dcb696955 100644
--- a/test/paniclog/5700
+++ b/test/paniclog/5700
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_deliver_action in smtp: error from acl "logger"
+1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_event_action msg:delivery in smtp: error from acl "logger"
 
diff --git a/test/rejectlog/0601 b/test/rejectlog/0601
deleted file mode 100644
index 1d4157f7f..000000000
--- a/test/rejectlog/0601
+++ /dev/null
@@ -1 +0,0 @@
-1999-03-02 09:44:33 U=CALLER rejected connection in "connect" ACL
diff --git a/test/runtest b/test/runtest
index 048fc2a0b..a647b229a 100755
--- a/test/runtest
+++ b/test/runtest
@@ -560,7 +560,7 @@ RESET_AFTER_EXTRA_LINE_READ:
   s/\buid=$parm_caller_uid\b/uid=CALLER_UID/g;
   s/\bgid=$parm_caller_gid\b/gid=CALLER_GID/g;
 
-  s/\bname=$parm_caller_gecos\b/name=CALLER_GECOS/g;
+  s/\bname="?$parm_caller_gecos"?/name=CALLER_GECOS/g;
 
   # When looking at spool files with -Mvh, we will find not only the caller
   # login, but also the uid and gid. It seems that $) in some Perls gives all
@@ -833,6 +833,11 @@ RESET_AFTER_EXTRA_LINE_READ:
         next;
         }
       }
+
+    # openssl version variances
+    next if /^SSL info: unknown state/;
+    next if /^SSL info: SSLv2\/v3 write client hello A/;
+
     }
 
   # ======== stderr ========
@@ -1293,7 +1298,7 @@ $munges =
     { 'mainlog' => 's/\(gnutls_handshake\): Error in the push function/\(gnutls_handshake\): A TLS packet with unexpected length was received/', },
 
     'tpda' =>
-    { 'stdout' => '/tpda_delivery_action =/', },
+    { 'stdout' => '/tpda_event_action =/', },
 
   };
 
diff --git a/test/scripts/0000-Basic/0601 b/test/scripts/0000-Basic/0601
index c126c06fb..8ff091866 100644
--- a/test/scripts/0000-Basic/0601
+++ b/test/scripts/0000-Basic/0601
@@ -13,4 +13,5 @@ This is a test message.
 .
 quit
 ***
-sleep 4
+sleep 2
+no_msglog_check
diff --git a/test/stderr/0002 b/test/stderr/0002
index 023c001bd..a30eb7399 100644
--- a/test/stderr/0002
+++ b/test/stderr/0002
@@ -185,6 +185,7 @@ host in "<
  partial-lsearch;TESTSUITE/aux-fixed/0002.lsearch 
  1.2.3.4"? yes (matched "partial-lsearch;TESTSUITE/aux-fixed/0002.lsearch")
 deny: condition test succeeded in ACL "connect1"
+end of ACL "connect1": DENY
 SMTP>> 550 Administrative prohibition
 LOG: MAIN REJECT
   H=ten-1.test.ex [V4NET.0.0.1] rejected connection in "connect" ACL
@@ -245,8 +246,10 @@ search_tidyup called
 >>> using ACL "connect0"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "connect0"
+>>> end of ACL "connect0": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> using ACL "check_data"
 >>> processing "warn"
 >>> check logwrite = Subject is: "$h_subject:"
@@ -256,9 +259,11 @@ LOG: 10HmaX-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaX-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -269,9 +274,11 @@ LOG: 10HmaY-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaY-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<a@b>
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -282,9 +289,11 @@ LOG: 10HmaZ-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaZ-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<c@d>
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -295,9 +304,11 @@ LOG: 10HmbA-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbA-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -308,6 +319,7 @@ LOG: 10HmbB-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbB-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<x@y>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -320,8 +332,10 @@ LOG: 10HmbB-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<x
 >>> using ACL "connect0"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "connect0"
+>>> end of ACL "connect0": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -332,6 +346,7 @@ LOG: 10HmbC-0005vi-00 Subject is: "=?iso-8859-8?Q?_here_we_go=3A_a_string_that_i
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbC-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -344,8 +359,10 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 >>> using ACL "connect0"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "connect0"
+>>> end of ACL "connect0": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -356,6 +373,7 @@ LOG: 10HmbD-0005vi-00 Subject is: " here we go: a string that is going to be enc
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbD-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 Exim version x.yz ....
 changed uid/gid: -C, -D, -be or -bf forces real uid
diff --git a/test/stderr/0003 b/test/stderr/0003
index c149125a7..60cbaf3f9 100644
--- a/test/stderr/0003
+++ b/test/stderr/0003
@@ -16,6 +16,7 @@
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> a@b.c in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<a@b.c> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -27,6 +28,7 @@ LOG: H=[1.1.1.1] F=<a@b.c> rejected RCPT <x@test.ex>
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> a@B.C in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "check_recipient"
@@ -39,6 +41,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> A@b.c in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<A@b.c> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -50,6 +53,7 @@ LOG: H=[1.1.1.1] F=<A@b.c> rejected RCPT <x@test.ex>
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> A@B.C in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<A@B.C> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -61,6 +65,7 @@ LOG: H=[1.1.1.1] F=<A@B.C> rejected RCPT <x@test.ex>
 >>> y.z in "Y.Z"? yes (matched "Y.Z")
 >>> x@y.z in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "X@Y.Z")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<x@y.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -72,6 +77,7 @@ LOG: H=[1.1.1.1] F=<x@y.z> rejected RCPT <x@test.ex>
 >>> y.z in "Y.Z"? yes (matched "Y.Z")
 >>> x@Y.Z in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "X@Y.Z")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<x@Y.Z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -83,6 +89,7 @@ LOG: H=[1.1.1.1] F=<x@Y.Z> rejected RCPT <x@test.ex>
 >>> y.z in "Y.Z"? yes (matched "Y.Z")
 >>> X@y.z in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "X@Y.Z")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<X@y.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -94,6 +101,7 @@ LOG: H=[1.1.1.1] F=<X@y.z> rejected RCPT <x@test.ex>
 >>> y.z in "Y.Z"? yes (matched "Y.Z")
 >>> X@Y.Z in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "X@Y.Z")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<X@Y.Z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -104,6 +112,7 @@ LOG: H=[1.1.1.1] F=<X@Y.Z> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ax@e.f in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\Dx@e\.f")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -114,6 +123,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ay@g.h in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\DY@G\.H")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ay@g.h> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -124,6 +134,7 @@ LOG: H=[1.1.1.1] F=<ay@g.h> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> bX@E.F in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\Dx@e\.f")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<bX@E.F> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -134,6 +145,7 @@ LOG: H=[1.1.1.1] F=<bX@E.F> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> bY@G.H in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\DY@G\.H")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<bY@G.H> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -149,6 +161,7 @@ LOG: H=[1.1.1.1] F=<bY@G.H> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -163,6 +176,7 @@ LOG: H=[1.1.1.1] F=<bY@G.H> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -172,6 +186,7 @@ LOG: H=[1.1.1.1] F=<bY@G.H> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@aa.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@aa.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -182,6 +197,7 @@ LOG: H=[1.1.1.1] F=<q@aa.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@AA.COM in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@AA.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -192,6 +208,7 @@ LOG: H=[1.1.1.1] F=<q@AA.COM> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@bb.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@bb.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -202,6 +219,7 @@ LOG: H=[1.1.1.1] F=<Q@bb.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@BB.Com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@BB.Com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -212,6 +230,7 @@ LOG: H=[1.1.1.1] F=<Q@BB.Com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> cc@dd.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<cc@dd.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -222,6 +241,7 @@ LOG: H=[1.1.1.1] F=<cc@dd.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> CC@DD.COM in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -237,6 +257,7 @@ LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -246,6 +267,7 @@ LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@nn.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@nn.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -256,6 +278,7 @@ LOG: H=[1.1.1.1] F=<q@nn.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@NN.COM in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@NN.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -266,6 +289,7 @@ LOG: H=[1.1.1.1] F=<Q@NN.COM> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@MM.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@MM.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -276,6 +300,7 @@ LOG: H=[1.1.1.1] F=<q@MM.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Pp@Qq.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -286,6 +311,7 @@ LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> abcd@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<abcd@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -296,6 +322,7 @@ LOG: H=[1.1.1.1] F=<abcd@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ABCD@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ABCD@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -306,6 +333,7 @@ LOG: H=[1.1.1.1] F=<ABCD@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ax@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -316,6 +344,7 @@ LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> bX@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<bX@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -326,6 +355,7 @@ LOG: H=[1.1.1.1] F=<bX@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Ay@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Ay@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -336,6 +366,7 @@ LOG: H=[1.1.1.1] F=<Ay@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> BY@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -346,6 +377,7 @@ LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> blocked@xy.zz in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<blocked@xy.zz> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -356,4 +388,5 @@ LOG: H=[1.1.1.1] F=<blocked@xy.zz> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> BLOCKED@zz.xy in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<BLOCKED@zz.xy> rejected RCPT <x@test.ex>
diff --git a/test/stderr/0004 b/test/stderr/0004
index 958ee7bc2..310a4ef29 100644
--- a/test/stderr/0004
+++ b/test/stderr/0004
@@ -16,6 +16,7 @@
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> a@b.c in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<a@b.c> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -27,6 +28,7 @@ LOG: H=[1.1.1.1] F=<a@b.c> rejected RCPT <x@test.ex>
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> a@B.C in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "check_recipient"
@@ -43,6 +45,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -57,6 +60,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -71,6 +75,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -85,6 +90,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -100,6 +106,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -115,6 +122,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -124,6 +132,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ax@e.f in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\Dx@e\.f")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -139,6 +148,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -153,6 +163,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -167,6 +178,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -181,6 +193,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -195,6 +208,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -204,6 +218,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@aa.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@aa.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -214,6 +229,7 @@ LOG: H=[1.1.1.1] F=<q@aa.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@AA.COM in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@AA.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -224,6 +240,7 @@ LOG: H=[1.1.1.1] F=<q@AA.COM> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@bb.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@bb.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -234,6 +251,7 @@ LOG: H=[1.1.1.1] F=<Q@bb.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@BB.Com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@BB.Com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -244,6 +262,7 @@ LOG: H=[1.1.1.1] F=<Q@BB.Com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> cc@dd.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<cc@dd.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -254,6 +273,7 @@ LOG: H=[1.1.1.1] F=<cc@dd.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> CC@DD.COM in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -269,6 +289,7 @@ LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -278,6 +299,7 @@ LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@nn.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@nn.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -288,6 +310,7 @@ LOG: H=[1.1.1.1] F=<q@nn.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@NN.COM in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@NN.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -298,6 +321,7 @@ LOG: H=[1.1.1.1] F=<Q@NN.COM> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@MM.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@MM.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -308,6 +332,7 @@ LOG: H=[1.1.1.1] F=<q@MM.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@mm.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@mm.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -318,6 +343,7 @@ LOG: H=[1.1.1.1] F=<q@mm.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Pp@Qq.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -333,6 +359,7 @@ LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -347,6 +374,7 @@ LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -356,6 +384,7 @@ LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> AbCd@aa.bb in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<AbCd@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -366,6 +395,7 @@ LOG: H=[1.1.1.1] F=<AbCd@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ax@aa.bb in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -381,6 +411,7 @@ LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -395,6 +426,7 @@ LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -404,6 +436,7 @@ LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> BY@aa.bb in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -419,6 +452,7 @@ LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -433,6 +467,7 @@ LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -442,5 +477,6 @@ LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> BlOcKeD@zz.xy in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<BlOcKeD@zz.xy> rejected RCPT <x@test.ex>
 LOG: unexpected disconnection while reading SMTP command from [1.1.1.1]
diff --git a/test/stderr/0018 b/test/stderr/0018
index 6ab981441..833a0a30c 100644
--- a/test/stderr/0018
+++ b/test/stderr/0018
@@ -21,5 +21,6 @@ MUNGED: ::1 will be omitted in what follows
 LOG: H=[127.0.0.1] Warning: accepted etrn #some.random.domain
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_etrn"
+>>> end of ACL "check_etrn": ACCEPT
 >>> ETRN command is: exim -R
 >>> ETRN command execution skipped
diff --git a/test/stderr/0020 b/test/stderr/0020
index 07c368482..cbab114bb 100644
--- a/test/stderr/0020
+++ b/test/stderr/0020
@@ -2107,3 +2107,4 @@ MUNGED: ::1 will be omitted in what follows
 >>> check hosts = 10.250.104.0/21
 >>> host in "10.250.104.0/21"? yes (matched "10.250.104.0/21")
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
diff --git a/test/stderr/0021 b/test/stderr/0021
index 3dbb81639..43331d4aa 100644
--- a/test/stderr/0021
+++ b/test/stderr/0021
@@ -28,6 +28,7 @@ check logwrite = $sender_host_address accepted by connect ACL
 LOG: MAIN
   10.9.8.8 accepted by connect ACL
 accept: condition test succeeded in ACL "connect"
+end of ACL "connect": ACCEPT
 using ACL "mail"
 processing "warn"
   message: added header line
@@ -66,6 +67,7 @@ check logwrite = :main,reject: mail accepted "$smtp_command" "$smtp_command_argu
 LOG: MAIN REJECT
   mail accepted "mail from:<ok@test1>" "<ok@test1>"
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 using ACL "rcpt"
 processing "accept"
 check senders = +ok_senders
@@ -82,6 +84,7 @@ check logwrite = :panic: rcpt accepted
 LOG: PANIC
   rcpt accepted
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 using ACL "rcpt"
 processing "accept"
 check senders = +ok_senders
@@ -95,6 +98,7 @@ check logwrite = :panic: rcpt accepted
 LOG: PANIC
   rcpt accepted
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 LOG: smtp_connection MAIN
   SMTP connection from CALLER closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -129,6 +133,7 @@ check logwrite = $sender_host_address accepted by connect ACL
 LOG: MAIN
   10.9.8.8 accepted by connect ACL
 accept: condition test succeeded in ACL "connect"
+end of ACL "connect": ACCEPT
 using ACL "mail"
 processing "warn"
   message: added header line
@@ -153,6 +158,7 @@ check logwrite = :main,reject: mail accepted "$smtp_command" "$smtp_command_argu
 LOG: MAIN REJECT
   mail accepted "mail from:<ok@test3>" "<ok@test3>"
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 using ACL "rcpt"
 processing "accept"
 check senders = +ok_senders
@@ -171,6 +177,7 @@ check logwrite = :panic: rcpt accepted
 LOG: PANIC
   rcpt accepted
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 host in ignore_fromline_hosts? no (option unset)
 >>Headers added by MAIL or RCPT ACL:
   X-ACL-Warn: added header line
diff --git a/test/stderr/0022 b/test/stderr/0022
index 864e19762..65768e251 100644
--- a/test/stderr/0022
+++ b/test/stderr/0022
@@ -32,6 +32,7 @@ processing "warn"
 warn: condition test succeeded in ACL "warn_empty"
 processing "accept"
 accept: condition test succeeded in ACL "warn_empty"
+end of ACL "warn_empty": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -98,6 +99,7 @@ LOG: MAIN
   H=[V4NET.9.8.7] Warning: warn log message
 processing "accept"
 accept: condition test succeeded in ACL "warn_log"
+end of ACL "warn_log": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -162,6 +164,7 @@ processing "warn"
 warn: condition test succeeded in ACL "warn_user"
 processing "accept"
 accept: condition test succeeded in ACL "warn_user"
+end of ACL "warn_user": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -207,14 +210,17 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> processing "defer"
 >>>   message: forcibly deferred
 >>> defer: condition test succeeded in ACL "defer"
+>>> end of ACL "defer": DEFER
 LOG: H=[V4NET.9.8.7] F=<x@y> temporarily rejected RCPT <defer@y>: forcibly deferred
 >>> using ACL "accept"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "accept"
+>>> end of ACL "accept": ACCEPT
 >>> using ACL "drop"
 >>> processing "drop"
 >>>   message: forcibly dropped
 >>> drop: condition test succeeded in ACL "drop"
+>>> end of ACL "drop": DROP
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <drop@y>: forcibly dropped
 LOG: SMTP connection from [V4NET.9.8.7] closed by DROP in ACL
 >>> host in hosts_connection_nolog? no (end of list)
@@ -231,6 +237,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> check senders = :
 >>>  in ":"? yes (matched "")
 >>> defer: condition test succeeded in ACL "defer_senders"
+>>> end of ACL "defer_senders": DEFER
 LOG: H=[V4NET.9.8.7] F=<> temporarily rejected RCPT <defer_senders@y>
 LOG: SMTP connection from [V4NET.9.8.7] closed by QUIT
 >>> host in hosts_connection_nolog? no (end of list)
@@ -248,6 +255,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> delay modifier requests 1-second delay
 >>> delay skipped in -bh checking mode
 >>> accept: condition test succeeded in ACL "delay_accept"
+>>> end of ACL "delay_accept": ACCEPT
 >>> using ACL "delay_warn"
 >>> processing "warn"
 >>> check delay = 1s
@@ -256,6 +264,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> warn: condition test succeeded in ACL "delay_warn"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "delay_warn"
+>>> end of ACL "delay_warn": ACCEPT
 LOG: SMTP connection from [V4NET.9.8.7] closed by QUIT
 >>> host in hosts_connection_nolog? no (end of list)
 LOG: SMTP connection from [V4NET.9.8.7]
@@ -272,6 +281,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> host in "net-lsearch;TESTSUITE/aux-var/0022.hosts"? yes (matched "net-lsearch;TESTSUITE/aux-var/0022.hosts")
 >>>   message: host data >$host_data<
 >>> deny: condition test succeeded in ACL "host_check"
+>>> end of ACL "host_check": DENY
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check@y>: host data >A host-specific message<
 >>> using ACL "host_check"
 >>> processing "deny"
@@ -279,6 +289,7 @@ LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check@y>: host data >A host-spe
 >>> host in "net-lsearch;TESTSUITE/aux-var/0022.hosts"? yes (matched "net-lsearch;TESTSUITE/aux-var/0022.hosts")
 >>>   message: host data >$host_data<
 >>> deny: condition test succeeded in ACL "host_check"
+>>> end of ACL "host_check": DENY
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check@y>: host data >A host-specific message<
 >>> using ACL "host_check2"
 >>> processing "deny"
@@ -287,6 +298,7 @@ LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check@y>: host data >A host-spe
 >>> host in "net-lsearch;TESTSUITE/aux-var/0022.hosts"? yes (matched "net-lsearch;TESTSUITE/aux-var/0022.hosts")
 >>> host in "+some_hosts"? yes (matched "+some_hosts")
 >>> deny: condition test succeeded in ACL "host_check2"
+>>> end of ACL "host_check2": DENY
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check2@y>: host data >A host-specific message<
 >>> using ACL "host_check2"
 >>> processing "deny"
@@ -294,6 +306,7 @@ LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check2@y>: host data >A host-sp
 >>> check hosts = +some_hosts
 >>> host in "+some_hosts"? yes (matched "+some_hosts" - cached)
 >>> deny: condition test succeeded in ACL "host_check2"
+>>> end of ACL "host_check2": DENY
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check2@y>: host data >A host-specific message<
 LOG: SMTP connection from [V4NET.9.8.7] closed by QUIT
 LOG: smtp_connection MAIN
@@ -340,6 +353,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> processing "drop"
 >>>   message: forcibly dropped
 >>> drop: condition test succeeded in ACL "drop"
+>>> end of ACL "drop": DROP
 >>> accept: condition test yielded "drop" in ACL "nested_drop"
 >>> accept: endpass encountered - denying access
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <nested_drop@y>: forcibly dropped
@@ -360,7 +374,9 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> processing "drop"
 >>>   message: forcibly dropped
 >>> drop: condition test succeeded in ACL "drop"
+>>> end of ACL "drop": DROP
 >>> require: condition test yielded "drop" in ACL "nested_drop_require"
+>>> end of ACL "nested_drop_require": not OK
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <nested_drop_require@y>: forcibly dropped
 LOG: SMTP connection from [V4NET.9.8.7] closed by DROP in ACL
 
diff --git a/test/stderr/0023 b/test/stderr/0023
index 01994efe6..16c4abaf6 100644
--- a/test/stderr/0023
+++ b/test/stderr/0023
@@ -31,6 +31,7 @@
 >>> check domains = !refuse.test.ex
 >>> test.ex in "!refuse.test.ex"? yes (end of list)
 >>> accept: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": ACCEPT
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
 >>> check domains = !nopass
@@ -89,6 +90,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <z@z>
 >>> check domains = !refuse.test.ex
 >>> test.ex in "!refuse.test.ex"? yes (end of list)
 >>> accept: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": ACCEPT
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
 >>> check domains = !nopass
@@ -114,6 +116,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <z@z>
 >>> check domains = !refuse.test.ex
 >>> test.ex in "!refuse.test.ex"? yes (end of list)
 >>> accept: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": ACCEPT
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
 >>> check domains = !nopass
@@ -139,6 +142,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <z@z>
 >>> check domains = !refuse.test.ex
 >>> relay.test.ex in "!refuse.test.ex"? yes (end of list)
 >>> accept: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": ACCEPT
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
 >>> check domains = !nopass
@@ -156,6 +160,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <z@z>
 >>> check domains = deny.test.ex
 >>> deny.test.ex in "deny.test.ex"? yes (matched "deny.test.ex")
 >>> deny: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@deny.test.ex>: DOMAIN EXPLICITLY DENIED
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
@@ -189,6 +194,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@refuse.test.ex>: refuse.test.ex gets r
 >>> check domains = !nopass
 >>> nopass in "!nopass"? no (matched "!nopass")
 >>> require: condition test failed in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": not OK
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@nopass>
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
@@ -200,6 +206,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@nopass>
 >>> check domains = !wontpass
 >>> wontpass in "!wontpass"? no (matched "!wontpass")
 >>> require: condition test failed in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": not OK
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@wontpass>: x@wontpass shall not pass
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -232,6 +239,7 @@ LOG: H=[5.6.7.8] F=<x@y> rejected RCPT <x@test.ex>
 >>> check local_parts = $domain_data
 >>> userx in "userx : spqr"? yes (matched "userx")
 >>> accept: condition test succeeded in ACL "acl_5_6_7"
+>>> end of ACL "acl_5_6_7": ACCEPT
 >>> using ACL "acl_5_6_7"
 >>> processing "accept"
 >>> check domains = lsearch;TESTSUITE/aux-fixed/0023.doms
@@ -239,6 +247,7 @@ LOG: H=[5.6.7.8] F=<x@y> rejected RCPT <x@test.ex>
 >>> check local_parts = $domain_data
 >>> spqr in "userx : spqr"? yes (matched "spqr")
 >>> accept: condition test succeeded in ACL "acl_5_6_7"
+>>> end of ACL "acl_5_6_7": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -253,11 +262,13 @@ LOG: H=[5.6.7.8] F=<x@y> rejected RCPT <x@test.ex>
 >>> host in "9.9.9.9"? yes (matched "9.9.9.9")
 >>> host in "+ok9_hosts"? yes (matched "+ok9_hosts")
 >>> accept: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": ACCEPT
 >>> using ACL "acl_9_9_9"
 >>> processing "accept"
 >>> check hosts = +ok9_hosts
 >>> host in "+ok9_hosts"? yes (matched "+ok9_hosts" - cached)
 >>> accept: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -277,6 +288,7 @@ LOG: H=[5.6.7.8] F=<x@y> rejected RCPT <x@test.ex>
 >>> check hosts = 9.9.9.0/26
 >>> host in "9.9.9.0/26"? yes (matched "9.9.9.0/26")
 >>> deny: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": DENY
 LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <x@y>: don't like this host
 >>> using ACL "acl_9_9_9"
 >>> processing "accept"
@@ -288,6 +300,7 @@ LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <x@y>: don't like this host
 >>> check hosts = 9.9.9.0/26
 >>> host in "9.9.9.0/26"? yes (matched "9.9.9.0/26")
 >>> deny: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": DENY
 LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <a@b>: don't like this host
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -312,6 +325,7 @@ LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <a@b>: don't like this host
 >>> check hosts = 9.9.9.0/24
 >>> host in "9.9.9.0/24"? yes (matched "9.9.9.0/24")
 >>> accept: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": ACCEPT
 >>> using ACL "acl_9_9_9"
 >>> processing "accept"
 >>> check hosts = +ok9_hosts
@@ -326,6 +340,7 @@ LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <a@b>: don't like this host
 >>> check hosts = 9.9.9.0/24
 >>> host in "9.9.9.0/24"? yes (matched "9.9.9.0/24")
 >>> accept: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -357,6 +372,7 @@ LOG: H=[5.6.8.1] F=<x@y> rejected RCPT <y@x>
 >>> domain1 in "domain1"? yes (matched "domain1")
 >>> user1@domain1 in "user1@domain1 : domain2 : +ok_senders"? yes (matched "user1@domain1")
 >>> accept: condition test succeeded in ACL "acl_5_6_8"
+>>> end of ACL "acl_5_6_8": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "acl_5_6_8"
 >>> processing "accept"
@@ -374,6 +390,7 @@ LOG: H=[5.6.8.1] F=<user2@domain1> rejected RCPT <x@y>
 >>> domain2 in "domain2"? yes (matched "domain2")
 >>> user1@domain2 in "user1@domain1 : domain2 : +ok_senders"? yes (matched "domain2")
 >>> accept: condition test succeeded in ACL "acl_5_6_8"
+>>> end of ACL "acl_5_6_8": ACCEPT
 >>> using ACL "acl_5_6_8"
 >>> processing "accept"
 >>> check senders = user1@domain1 : domain2 : +ok_senders
@@ -382,12 +399,14 @@ LOG: H=[5.6.8.1] F=<user2@domain1> rejected RCPT <x@y>
 >>> ok@ok.ok in "ok@ok.ok"? yes (matched "ok@ok.ok")
 >>> ok@ok.ok in "user1@domain1 : domain2 : +ok_senders"? yes (matched "+ok_senders")
 >>> accept: condition test succeeded in ACL "acl_5_6_8"
+>>> end of ACL "acl_5_6_8": ACCEPT
 >>> using ACL "acl_5_6_8"
 >>> processing "accept"
 >>> check senders = user1@domain1 : domain2 : +ok_senders
 >>> ok.ok in "domain2"? no (end of list)
 >>> ok@ok.ok in "user1@domain1 : domain2 : +ok_senders"? yes (matched "+ok_senders" - cached)
 >>> accept: condition test succeeded in ACL "acl_5_6_8"
+>>> end of ACL "acl_5_6_8": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -401,11 +420,13 @@ LOG: H=[5.6.8.1] F=<user2@domain1> rejected RCPT <x@y>
 >>> check condition = ${if match{$local_part}{^x}{yes}{no}}
 >>>                 = yes
 >>> accept: condition test succeeded in ACL "acl_5_6_11"
+>>> end of ACL "acl_5_6_11": ACCEPT
 >>> using ACL "acl_5_6_11"
 >>> processing "accept"
 >>> check condition = ${if match{$local_part}{^x}{yes}{no}}
 >>>                 = yes
 >>> accept: condition test succeeded in ACL "acl_5_6_11"
+>>> end of ACL "acl_5_6_11": ACCEPT
 >>> using ACL "acl_5_6_11"
 >>> processing "accept"
 >>> check condition = ${if match{$local_part}{^x}{yes}{no}}
@@ -414,6 +435,7 @@ LOG: H=[5.6.8.1] F=<user2@domain1> rejected RCPT <x@y>
 >>> processing "deny"
 >>>   message: "local part of wrong type\n(quotes are literal)
 >>> deny: condition test succeeded in ACL "acl_5_6_11"
+>>> end of ACL "acl_5_6_11": DENY
 LOG: H=[5.6.11.1] F=<x@y> rejected RCPT <y2@y>: "local part of wrong type
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -434,7 +456,9 @@ LOG: H=[5.6.11.1] F=<x@y> rejected RCPT <y2@y>: "local part of wrong type
 >>> check domains = ok
 >>> ok in "ok"? yes (matched "ok")
 >>> accept: condition test succeeded in ACL "acl_5_6_12A"
+>>> end of ACL "acl_5_6_12A": ACCEPT
 >>> accept: condition test succeeded in ACL "acl_5_6_12"
+>>> end of ACL "acl_5_6_12": ACCEPT
 >>> using ACL "acl_5_6_12"
 >>> processing "accept"
 >>> check hosts = 5.6.12.1
@@ -465,6 +489,7 @@ LOG: H=[5.6.12.1] F=<x@y> rejected RCPT <x@y>: failed nested acl
 >>> accept: condition test failed in ACL "acl_5_6_12"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_5_6_12"
+>>> end of ACL "acl_5_6_12": ACCEPT
 >>> using ACL "acl_5_6_12"
 >>> processing "accept"
 >>> check hosts = 5.6.12.1
@@ -472,6 +497,7 @@ LOG: H=[5.6.12.1] F=<x@y> rejected RCPT <x@y>: failed nested acl
 >>> accept: condition test failed in ACL "acl_5_6_12"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_5_6_12"
+>>> end of ACL "acl_5_6_12": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -583,7 +609,9 @@ LOG: H=[8.8.8.8] F=<x@y> temporarily rejected RCPT <x@y>: ACL nested too deep: p
 >>> check local_parts = x
 >>> x in "x"? yes (matched "x")
 >>> accept: condition test succeeded in ACL "TESTSUITE/aux-fixed/0023.acl1"
+>>> end of ACL "TESTSUITE/aux-fixed/0023.acl1": ACCEPT
 >>> accept: condition test succeeded in ACL "acl_5_6_13"
+>>> end of ACL "acl_5_6_13": ACCEPT
 >>> using ACL "acl_5_6_13"
 >>> processing "accept"
 >>> check acl = TESTSUITE/aux-fixed/0023.acl1
@@ -630,6 +658,7 @@ LOG: H=[5.6.13.1] F=<x@y> rejected RCPT <x2@y>
 >>> DNS lookup for 13.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.13 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "acl_V4NET_11_12"
+>>> end of ACL "acl_V4NET_11_12": DENY
 LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x@y>: DNSLIST (rbl.test.ex: This is a test blacklisting message)
 >>> using ACL "acl_V4NET_11_12"
 >>> processing "deny"
@@ -641,6 +670,7 @@ LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x@y>: DNSLIST (rbl.test.ex: This
 >>> DNS lookup for 13.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.13 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "acl_V4NET_11_12"
+>>> end of ACL "acl_V4NET_11_12": DENY
 LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x1@y>: DNSLIST (rbl.test.ex: This is a test blacklisting message)
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -662,6 +692,7 @@ LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x1@y>: DNSLIST (rbl.test.ex: This
 >>> deny: condition test failed in ACL "acl_V4NET_11_12"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_V4NET_11_12"
+>>> end of ACL "acl_V4NET_11_12": ACCEPT
 >>> using ACL "acl_V4NET_11_12"
 >>> processing "deny"
 >>>   message: host in DNS list $dnslist_domain: $dnslist_text
@@ -674,6 +705,7 @@ LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x1@y>: DNSLIST (rbl.test.ex: This
 >>> deny: condition test failed in ACL "acl_V4NET_11_12"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_V4NET_11_12"
+>>> end of ACL "acl_V4NET_11_12": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -751,6 +783,7 @@ LOG: H=[20.20.20.20] F=<userx@y> rejected RCPT <x1@y>: Unrouteable address
 >>> routed by r1 router
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "acl_20_20_20"
+>>> end of ACL "acl_20_20_20": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -793,6 +826,7 @@ LOG: H=[21.21.21.21] F=<userx@y> rejected RCPT <x1@y>: Unrouteable address
 >>> routed by r1 router
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "acl_21_21_21"
+>>> end of ACL "acl_21_21_21": ACCEPT
 >>> using ACL "acl_21_21_21"
 >>> processing "accept"
 >>> check verify = sender
@@ -867,6 +901,7 @@ LOG: H=[22.22.22.22] F=<userx@y> rejected RCPT <userx@y>
 >>> y in "y"? yes (matched "y")
 >>> x@y in "x@y"? yes (matched "x@y")
 >>> accept: condition test succeeded in ACL "acl_22_22_22"
+>>> end of ACL "acl_22_22_22": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -889,6 +924,7 @@ LOG: H=[22.22.22.22] F=<userx@y> rejected RCPT <userx@y>
 >>> no more routers
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "acl_23_23_23"
+>>> end of ACL "acl_23_23_23": DENY
 LOG: H=[23.23.23.0] sender verify fail for <x@y>: Unrouteable address
 LOG: H=[23.23.23.0] F=<x@y> rejected RCPT <userx@y>: Sender verify failed
 >>> using ACL "acl_23_23_23"
@@ -907,6 +943,7 @@ LOG: H=[23.23.23.0] F=<x@y> rejected RCPT <userx@y>: Sender verify failed
 >>> deny: condition test failed in ACL "acl_23_23_23"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_23_23_23"
+>>> end of ACL "acl_23_23_23": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -922,6 +959,7 @@ LOG: H=[23.23.23.0] F=<x@y> rejected RCPT <userx@y>: Sender verify failed
 >>> deny: condition test failed in ACL "acl_23_23_23"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_23_23_23"
+>>> end of ACL "acl_23_23_23": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -971,6 +1009,7 @@ LOG: H=[25.25.25.25] F=<x@y> rejected RCPT <x@y>
 >>> deny: condition test failed in ACL "acl_26_26_26"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_26_26_26"
+>>> end of ACL "acl_26_26_26": ACCEPT
 >>> using ACL "acl_26_26_26"
 >>> processing "deny"
 >>> check senders = :
@@ -979,6 +1018,7 @@ LOG: H=[25.25.25.25] F=<x@y> rejected RCPT <x@y>
 >>> check condition = ${if > {$recipients_count}{0}{yes}{no}}
 >>>                 = yes
 >>> deny: condition test succeeded in ACL "acl_26_26_26"
+>>> end of ACL "acl_26_26_26": DENY
 LOG: H=[26.26.26.26] F=<> rejected RCPT <y@y>: bounce messages can have only one recipient
 >>> using ACL "acl_26_26_26"
 >>> processing "deny"
@@ -988,6 +1028,7 @@ LOG: H=[26.26.26.26] F=<> rejected RCPT <y@y>: bounce messages can have only one
 >>> check condition = ${if > {$recipients_count}{0}{yes}{no}}
 >>>                 = yes
 >>> deny: condition test succeeded in ACL "acl_26_26_26"
+>>> end of ACL "acl_26_26_26": DENY
 LOG: H=[26.26.26.26] F=<> rejected RCPT <z@y>: bounce messages can have only one recipient
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -1004,6 +1045,7 @@ LOG: H=[26.26.26.26] F=<> rejected RCPT <z@y>: bounce messages can have only one
 >>> deny: condition test failed in ACL "acl_27_27_27"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_27_27_27"
+>>> end of ACL "acl_27_27_27": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1017,11 +1059,13 @@ LOG: H=[26.26.26.26] F=<> rejected RCPT <z@y>: bounce messages can have only one
 >>> check sender_domains = : okdomain
 >>>  in ": okdomain"? yes (matched "")
 >>> accept: condition test succeeded in ACL "acl_28_28_28"
+>>> end of ACL "acl_28_28_28": ACCEPT
 >>> using ACL "acl_28_28_28"
 >>> processing "accept"
 >>> check sender_domains = : okdomain
 >>> okdomain in ": okdomain"? yes (matched "okdomain")
 >>> accept: condition test succeeded in ACL "acl_28_28_28"
+>>> end of ACL "acl_28_28_28": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "acl_28_28_28"
 >>> processing "accept"
@@ -1058,6 +1102,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> require: condition test succeeded in ACL "acl_V4NET_0_0"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_V4NET_0_0"
+>>> end of ACL "acl_V4NET_0_0": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1073,6 +1118,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> looking up host name for V4NET.0.0.97
 LOG: no host name found for IP address V4NET.0.0.97
 >>> require: condition test failed in ACL "acl_V4NET_0_0"
+>>> end of ACL "acl_V4NET_0_0": not OK
 LOG: H=[V4NET.0.0.97] F=<> rejected RCPT <x@y>: host lookup failed for reverse lookup check (failed to find host name from IP address)
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -1091,6 +1137,7 @@ LOG: H=[V4NET.0.0.97] F=<> rejected RCPT <x@y>: host lookup failed for reverse l
 >>> DNS lookup for localhost.test.ex succeeded (yielding 127.0.0.1)
 >>> => that means localhost is listed at test.ex
 >>> deny: condition test succeeded in ACL "acl_29_29_29"
+>>> end of ACL "acl_29_29_29": DENY
 LOG: H=[29.29.29.29] F=<a@localhost> rejected RCPT <x@y>
 >>> using ACL "acl_29_29_29"
 >>> processing "deny"
@@ -1103,6 +1150,7 @@ LOG: H=[29.29.29.29] F=<a@localhost> rejected RCPT <x@y>
 >>> deny: condition test failed in ACL "acl_29_29_29"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_29_29_29"
+>>> end of ACL "acl_29_29_29": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1121,6 +1169,7 @@ LOG: H=[29.29.29.29] F=<a@localhost> rejected RCPT <x@y>
 >>> DNS lookup for ten-1.test.ex succeeded (yielding V4NET.0.0.1)
 >>> => that means ten-1 is listed at test.ex
 >>> deny: condition test succeeded in ACL "acl_30_30_30"
+>>> end of ACL "acl_30_30_30": DENY
 LOG: H=[30.30.30.30] F=<a@ten-1> rejected RCPT <x@y>: domain=test.ex
 >>> using ACL "acl_30_30_30"
 >>> processing "deny"
@@ -1135,6 +1184,7 @@ LOG: H=[30.30.30.30] F=<a@ten-1> rejected RCPT <x@y>: domain=test.ex
 >>> deny: condition test failed in ACL "acl_30_30_30"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_30_30_30"
+>>> end of ACL "acl_30_30_30": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "acl_30_30_30"
 >>> processing "deny"
@@ -1146,6 +1196,7 @@ LOG: H=[30.30.30.30] F=<a@ten-1> rejected RCPT <x@y>: domain=test.ex
 >>> DNS lookup for 13.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means 13.12.11.V4NET.rbl is listed at test.ex
 >>> deny: condition test succeeded in ACL "acl_30_30_30"
+>>> end of ACL "acl_30_30_30": DENY
 LOG: H=[30.30.30.30] F=<a@13.12.11.V4NET.rbl> rejected RCPT <x@y>: domain=test.ex
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -1164,6 +1215,7 @@ LOG: dnslist query is too long (ignored): y+extra+extra+extra+extra+extra+extra+
 >>> deny: condition test failed in ACL "acl_31_31_31"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_31_31_31"
+>>> end of ACL "acl_31_31_31": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1235,6 +1287,7 @@ LOG: DNS list lookup defer (probably timeout) for 1.44.44.44.test.again.dns: ret
 LOG: H=[44.44.44.1] Warning: ACL "warn" statement skipped: condition test deferred
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_44_44_44"
+>>> end of ACL "acl_44_44_44": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1253,6 +1306,7 @@ LOG: H=[44.44.44.1] Warning: ACL "warn" statement skipped: condition test deferr
 >>> accept: condition test failed in ACL "TESTSUITE/aux-fixed/0023.acl2"
 >>> end of ACL "TESTSUITE/aux-fixed/0023.acl2": implicit DENY
 >>> accept: condition test succeeded in ACL "acl_60_60_60"
+>>> end of ACL "acl_60_60_60": ACCEPT
 >>> using ACL "acl_60_60_60"
 >>> processing "accept"
 >>> check !acl = TESTSUITE/aux-fixed/0023.acl2
@@ -1263,6 +1317,7 @@ LOG: H=[44.44.44.1] Warning: ACL "warn" statement skipped: condition test deferr
 >>> check local_parts = a
 >>> a in "a"? yes (matched "a")
 >>> accept: condition test succeeded in ACL "TESTSUITE/aux-fixed/0023.acl2"
+>>> end of ACL "TESTSUITE/aux-fixed/0023.acl2": ACCEPT
 >>> accept: condition test failed in ACL "acl_60_60_60"
 >>> end of ACL "acl_60_60_60": implicit DENY
 LOG: H=[60.60.60.60] F=<x@y> rejected RCPT <a@b>
diff --git a/test/stderr/0026 b/test/stderr/0026
index 328b169bd..26c27365d 100644
--- a/test/stderr/0026
+++ b/test/stderr/0026
@@ -8,6 +8,7 @@
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "acl_data"
 >>> processing "deny"
@@ -18,6 +19,7 @@
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "acl_data"
+>>> end of ACL "acl_data": not OK
 LOG: 10HmbH-0005vi-00 H=[10.0.0.0] F=<x@y> rejected after DATA: domain missing or malformed: failing address in "From:" header is: @
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -29,6 +31,7 @@ LOG: 10HmbH-0005vi-00 H=[10.0.0.0] F=<x@y> rejected after DATA: domain missing o
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "acl_data"
 >>> processing "deny"
@@ -36,4 +39,5 @@ LOG: 10HmbH-0005vi-00 H=[10.0.0.0] F=<x@y> rejected after DATA: domain missing o
 >>> check condition = ${if match{$message_body}{trigger}{yes}{no}}
 >>>                 = yes
 >>> deny: condition test succeeded in ACL "acl_data"
+>>> end of ACL "acl_data": DENY
 LOG: 10HmbI-0005vi-00 H=[10.0.0.0] F=<x@y> rejected after DATA: body contains trigger
diff --git a/test/stderr/0038 b/test/stderr/0038
index 727c1c6c3..2cde5de35 100644
--- a/test/stderr/0038
+++ b/test/stderr/0038
@@ -21,6 +21,7 @@
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -32,6 +33,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 LOG: 10HmaX-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaX-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -55,6 +57,7 @@ LOG: 10HmaX-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=2.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -66,6 +69,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=2.0 sender_rate_limit=
 LOG: 10HmaY-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=2.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaY-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -90,6 +94,7 @@ LOG: 10HmaY-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -101,6 +106,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 LOG: 10HmaZ-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaZ-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -124,6 +130,7 @@ LOG: 10HmaZ-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=2.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -135,6 +142,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=2.0 sender_rate_limit=
 LOG: 10HmbA-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=2.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbA-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -159,6 +167,7 @@ LOG: 10HmbA-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> using ACL "check_rcpt"
 >>> processing "warn"
 >>> check ratelimit = 0/1h/per_rcpt
@@ -171,6 +180,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 >>> warn: condition test succeeded in ACL "check_rcpt"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> using ACL "check_rcpt"
 >>> processing "warn"
 >>> check ratelimit = 0/1h/per_rcpt
@@ -183,6 +193,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 >>> warn: condition test succeeded in ACL "check_rcpt"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -196,6 +207,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=3.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -223,6 +235,7 @@ LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> warn: condition test failed in ACL "check_rcpt2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt2"
+>>> end of ACL "check_rcpt2": ACCEPT
 >>> using ACL "check_rcpt2"
 >>> processing "warn"
 >>> check ratelimit = 1/1m/per_rcpt/noupdate
@@ -239,6 +252,7 @@ LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> warn: condition test failed in ACL "check_rcpt2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt2"
+>>> end of ACL "check_rcpt2": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -253,4 +267,5 @@ LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: 10HmbC-0005vi-00 H=(test.ex) [V4NET.9.8.6] Warning: DATA: sender_rate=19.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbC-0005vi-00 H=(test.ex) [V4NET.9.8.6] F=<> rejected after DATA
diff --git a/test/stderr/0041 b/test/stderr/0041
index 621936924..4aacae883 100644
--- a/test/stderr/0041
+++ b/test/stderr/0041
@@ -30,6 +30,7 @@ LOG: H=[1.1.1.1] rejected EXPN postmaster
 >>> check hosts = 2.2.2.2
 >>> host in "2.2.2.2"? yes (matched "2.2.2.2")
 >>> accept: condition test succeeded in ACL "check_expn"
+>>> end of ACL "check_expn": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing list@test.ex
 >>> calling system_aliases router
diff --git a/test/stderr/0042 b/test/stderr/0042
index e3ee2b7a3..63eb0fbf8 100644
--- a/test/stderr/0042
+++ b/test/stderr/0042
@@ -9,6 +9,7 @@
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing userx@test.ex
 >>> test.ex in "test.ex"? yes (matched "test.ex")
@@ -19,6 +20,7 @@
 >>> routed by localuser router
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing junkjunk@test.ex
 >>> test.ex in "test.ex"? yes (matched "test.ex")
@@ -29,6 +31,7 @@
 LOG: VRFY failed for junkjunk@test.ex H=[1.1.1.1]
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing expan@test.ex
 >>> test.ex in "test.ex"? yes (matched "test.ex")
diff --git a/test/stderr/0043 b/test/stderr/0043
index 31ba8d9ce..6ea0099d2 100644
--- a/test/stderr/0043
+++ b/test/stderr/0043
@@ -25,6 +25,7 @@
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=(exim.test.ex) [V4NET.0.0.97] sender verify fail for <junkjunk@exim.test.ex>: Unrouteable address
 LOG: H=(exim.test.ex) [V4NET.0.0.97] F=<junkjunk@exim.test.ex> rejected RCPT <postmaster@exim.test.ex>: Sender verify failed
 LOG: H=(exim.test.ex) [V4NET.0.0.97] incomplete transaction (RSET) from <junkjunk@exim.test.ex>
@@ -77,6 +78,7 @@ LOG: H=(exim.test.ex) [V4NET.0.0.97] incomplete transaction (RSET) from <junkjun
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -99,6 +101,7 @@ LOG: H=(exim.test.ex) [V4NET.0.0.97] incomplete transaction (RSET) from <junkjun
 >>> no more routers
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.0.0.97] F=<postmaster@exim.test.ex> rejected RCPT junkjunk@exim.test.ex: Unrouteable address
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -120,5 +123,6 @@ LOG: H=(exim.test.ex) [V4NET.0.0.97] F=<postmaster@exim.test.ex> rejected RCPT j
 >>> system_aliases router forced address failure
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.0.0.97] F=<postmaster@exim.test.ex> rejected RCPT fail@exim.test.ex: this alias is forced to fail
 LOG: H=(exim.test.ex) [V4NET.0.0.97] incomplete transaction (QUIT) from <postmaster@exim.test.ex> for postmaster@exim.test.ex
diff --git a/test/stderr/0044 b/test/stderr/0044
index d8b7ebe80..71453d636 100644
--- a/test/stderr/0044
+++ b/test/stderr/0044
@@ -18,6 +18,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -39,6 +40,7 @@
 >>> DNS lookup for 13.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.13 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.11.12.13] F=<postmaster@exim.test.ex> rejected RCPT list@exim.test.ex: host is listed in rbl.test.ex
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.13] P=esmtp S=sss
@@ -66,5 +68,6 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> there.test.ex in "*"? yes (matched "*")
 >>> myfriend@there.test.ex in "myfriend@*"? yes (matched "myfriend@*")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= myfriend@there.test.ex H=(exim.test.ex) [V4NET.11.12.13] P=esmtp S=sss
diff --git a/test/stderr/0056 b/test/stderr/0056
index 6d75121b3..b23e4ca71 100644
--- a/test/stderr/0056
+++ b/test/stderr/0056
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -23,6 +24,7 @@
 >>> otherhost.example.com in "*"? yes (matched "*")
 >>> otherhost.example.com in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -34,4 +36,5 @@
 >>> 3rdhost.example.com in "*"? yes (matched "*")
 >>> 3rdhost.example.com in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
diff --git a/test/stderr/0057 b/test/stderr/0057
index 483ca182c..958a7cb67 100644
--- a/test/stderr/0057
+++ b/test/stderr/0057
@@ -13,6 +13,7 @@
 >>> test.ex in "test.ex : myhost.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> anotherhost.example.com in percent_hack_domains? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -28,6 +29,7 @@
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 >>> 3rdhost.example.com in percent_hack_domains? no (end of list)
 >>> using ACL "check_recipient"
@@ -44,5 +46,6 @@ LOG: H=[V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@another
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@3rdhost.example.com>: relay not permitted
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
diff --git a/test/stderr/0058 b/test/stderr/0058
index 66aa2539e..1698bc1bc 100644
--- a/test/stderr/0058
+++ b/test/stderr/0058
@@ -17,6 +17,7 @@
 >>> host in "*"? yes (matched "*")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -28,4 +29,5 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> check hosts = +relay_hosts
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts" - cached)
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
diff --git a/test/stderr/0059 b/test/stderr/0059
index 34fffb580..9028e512b 100644
--- a/test/stderr/0059
+++ b/test/stderr/0059
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -31,5 +32,6 @@
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
diff --git a/test/stderr/0060 b/test/stderr/0060
index 7e3e5672f..4d6fc412b 100644
--- a/test/stderr/0060
+++ b/test/stderr/0060
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -31,6 +32,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "! V4NET.255.0.1 : !V4NET.255.0.2 : !TESTSUITE/aux-var/0060.d1 : ! TESTSUITE/aux-var/0060.d2 : ten-1.test.ex : ten-5-6.test.ex"? yes (matched "ten-1.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -46,6 +48,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -72,6 +75,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.2] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -88,6 +92,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.2] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -111,6 +116,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "! V4NET.255.0.1 : !V4NET.255.0.2 : !TESTSUITE/aux-var/0060.d1 : ! TESTSUITE/aux-var/0060.d2 : ten-1.test.ex : ten-5-6.test.ex"? yes (matched "ten-5-6.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -126,6 +132,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -149,6 +156,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "! V4NET.255.0.1 : !V4NET.255.0.2 : !TESTSUITE/aux-var/0060.d1 : ! TESTSUITE/aux-var/0060.d2 : ten-1.test.ex : ten-5-6.test.ex"? yes (matched "ten-5-6.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.6] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -164,6 +172,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.6] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -183,6 +192,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.6] P=smtp S=sss
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.255.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -199,6 +209,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.1] P=smtp S=s
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -218,6 +229,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.1] P=smtp S=s
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.255.0.2] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -234,6 +246,7 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.2] P=smtp S=s
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -253,6 +266,7 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.2] P=smtp S=s
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.255.0.3] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.3] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -269,6 +283,7 @@ LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.3] P=smtp S=s
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -288,5 +303,6 @@ LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.3] P=smtp S=s
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.255.0.4] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbE-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.4] P=smtp S=sss
diff --git a/test/stderr/0061 b/test/stderr/0061
index 8e178fbc5..32c5f35c6 100644
--- a/test/stderr/0061
+++ b/test/stderr/0061
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -31,6 +32,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "@"? yes (matched "@")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -46,6 +48,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -68,5 +71,6 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.2] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.2] P=smtp S=sss
diff --git a/test/stderr/0062 b/test/stderr/0062
index 7343d7df2..38648d606 100644
--- a/test/stderr/0062
+++ b/test/stderr/0062
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -39,10 +40,12 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 >>> using ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -58,6 +61,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -82,9 +86,11 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "*-2.test.ex : *-3-alias.test.ex"? yes (matched "*-2.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=ten-2.test.ex [V4NET.0.0.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -100,6 +106,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=ten-2.test.ex [V4NET.0.0.2
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -130,7 +137,9 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "*-2.test.ex : *-3-alias.test.ex"? yes (matched "*-3-alias.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=ten-3.test.ex [V4NET.0.0.3] P=smtp S=sss
diff --git a/test/stderr/0063 b/test/stderr/0063
index 2eb0b3160..16cf4808a 100644
--- a/test/stderr/0063
+++ b/test/stderr/0063
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -39,6 +40,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -55,6 +57,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -79,4 +82,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "^[^\d]+2"? yes (matched "^[^\d]+2")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=ten-2.test.ex [V4NET.0.0.2] P=smtp S=sss
diff --git a/test/stderr/0064 b/test/stderr/0064
index 6790f9495..47de0e789 100644
--- a/test/stderr/0064
+++ b/test/stderr/0064
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -39,6 +40,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -55,6 +57,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -79,4 +82,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "lsearch;TESTSUITE/aux-fixed/0064.hosts"? yes (matched "lsearch;TESTSUITE/aux-fixed/0064.hosts")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=ten-2.test.ex [V4NET.0.0.2] P=smtp S=sss
diff --git a/test/stderr/0065 b/test/stderr/0065
index ae6fc7f97..325ca98e7 100644
--- a/test/stderr/0065
+++ b/test/stderr/0065
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -28,6 +29,7 @@
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "1.2.3.4")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -43,6 +45,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -62,6 +65,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.5] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -78,6 +82,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -94,6 +99,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "1.2.0.0/16")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -109,6 +115,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -128,6 +135,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.3.2.4] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -144,6 +152,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -160,6 +169,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "net16-lsearch;TESTSUITE/aux-fixed/0065.nets")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -175,6 +185,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -191,6 +202,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "net24-lsearch;TESTSUITE/aux-fixed/0065.nets")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -206,6 +218,7 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=ss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -222,4 +235,5 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=ss
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "net-lsearch;TESTSUITE/aux-fixed/0065.nets")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=[192.153.98.4] P=smtp S=sss
diff --git a/test/stderr/0066 b/test/stderr/0066
index 9dbb6f08b..b86c2d553 100644
--- a/test/stderr/0066
+++ b/test/stderr/0066
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -34,6 +35,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "1.2.3.4" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -49,6 +51,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -74,6 +77,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.5] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -90,6 +94,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -112,6 +117,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "1.2.0.0/16" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -127,6 +133,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -155,6 +162,7 @@ LOG: no host name found for IP address 1.3.2.4
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.3.2.4] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -171,6 +179,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -193,6 +202,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "net16-lsearch;TESTSUITE/aux-fixed/0066.nets" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -208,6 +218,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -230,6 +241,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "net24-lsearch;TESTSUITE/aux-fixed/0066.nets" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -245,6 +257,7 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=ss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -275,6 +288,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "*-1.test.ex" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -290,6 +304,7 @@ LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -312,6 +327,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.11.12.13] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbE-0005vi-00 <= userx@somehost.example.com H=[V4NET.11.12.13] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -328,6 +344,7 @@ LOG: 10HmbE-0005vi-00 <= userx@somehost.example.com H=[V4NET.11.12.13] P=smtp S=
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -350,4 +367,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? no (matched "!ten-3.test.ex" in TESTSUITE/aux-fixed/0066.nothosts)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbF-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.3] P=smtp S=sss
diff --git a/test/stderr/0067 b/test/stderr/0067
index b63242f08..252f07e5a 100644
--- a/test/stderr/0067
+++ b/test/stderr/0067
@@ -31,6 +31,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -54,6 +55,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -69,6 +71,7 @@
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> y@b.c in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "*@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<y@b.c> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -84,6 +87,7 @@ LOG: H=[1.2.3.4] F=<y@b.c> rejected RCPT <x@test.ex>
 >>> xy.z in "b.c"? no (end of list)
 >>> philip@xy.z in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "^(phil|quil)[^@]*@")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<philip@xy.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -99,6 +103,7 @@ LOG: H=[1.2.3.4] F=<philip@xy.z> rejected RCPT <x@test.ex>
 >>> patch.work in "b.c"? no (end of list)
 >>> quilt@patch.work in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "^(phil|quil)[^@]*@")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<quilt@patch.work> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -123,6 +128,7 @@ LOG: H=[1.2.3.4] F=<quilt@patch.work> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -137,6 +143,7 @@ LOG: H=[1.2.3.4] F=<quilt@patch.work> rejected RCPT <x@test.ex>
 >>> abc.def in "b.c"? no (end of list)
 >>> xx@abc.def in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<xx@abc.def> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -152,6 +159,7 @@ LOG: H=[1.2.3.4] F=<xx@abc.def> rejected RCPT <x@test.ex>
 >>> d.e.f in "b.c"? no (end of list)
 >>> abc@d.e.f in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<abc@d.e.f> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -178,6 +186,7 @@ LOG: H=[1.2.3.4] F=<abc@d.e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -202,6 +211,7 @@ LOG: H=[1.2.3.4] F=<abc@d.e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -216,6 +226,7 @@ LOG: H=[1.2.3.4] F=<abc@d.e.f> rejected RCPT <x@test.ex>
 >>> z.z in "b.c"? no (end of list)
 >>> abc@z.z in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<abc@z.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -242,6 +253,7 @@ LOG: H=[1.2.3.4] F=<abc@z.z> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -256,6 +268,7 @@ LOG: H=[1.2.3.4] F=<abc@z.z> rejected RCPT <x@test.ex>
 >>> z.z in "b.c"? no (end of list)
 >>> xyz@z.z in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<xyz@z.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -271,6 +284,7 @@ LOG: H=[1.2.3.4] F=<xyz@z.z> rejected RCPT <x@test.ex>
 >>> p.q.r in "b.c"? no (end of list)
 >>> 12345678@p.q.r in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<12345678@p.q.r> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -286,6 +300,7 @@ LOG: H=[1.2.3.4] F=<12345678@p.q.r> rejected RCPT <x@test.ex>
 >>> z.z in "b.c"? no (end of list)
 >>> 12345678@z.z in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<12345678@z.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -313,6 +328,7 @@ LOG: H=[1.2.3.4] F=<12345678@z.z> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -334,6 +350,7 @@ LOG: H=[1.2.3.4] F=<12345678@z.z> rejected RCPT <x@test.ex>
 >>> m.n.o in "m.n.o"? yes (matched "m.n.o")
 >>> 1234@m.n.o in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "1234@m.n.o")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<1234@m.n.o> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -345,6 +362,7 @@ LOG: H=[1.2.3.4] F=<1234@m.n.o> rejected RCPT <userx@test.ex>
 >>> test.ex in "*"? yes (matched "*")
 >>> postmaster@test.ex in "postmaster@*"? yes (matched "postmaster@*")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -355,6 +373,7 @@ LOG: H=[1.2.3.4] F=<1234@m.n.o> rejected RCPT <userx@test.ex>
 >>> myhost.ex in "*"? yes (matched "*")
 >>> postmaster@myhost.ex in "postmaster@*"? yes (matched "postmaster@*")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -376,6 +395,7 @@ LOG: H=[1.2.3.4] F=<1234@m.n.o> rejected RCPT <userx@test.ex>
 >>> a.b.c in "a.b.c"? yes (matched "a.b.c")
 >>> rr01@a.b.c in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "rr01@a.b.c" in TESTSUITE/aux-fixed/0067.rejrec)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<rr01@a.b.c> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -402,6 +422,7 @@ LOG: H=[1.2.3.4] F=<rr01@a.b.c> rejected RCPT <userx@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -422,6 +443,7 @@ LOG: H=[1.2.3.4] F=<rr01@a.b.c> rejected RCPT <userx@test.ex>
 >>> check senders = 1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec
 >>> qq@a.b.c in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "^qq" in TESTSUITE/aux-fixed/0067.rejrec)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<qq@a.b.c> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -443,6 +465,7 @@ LOG: H=[1.2.3.4] F=<qq@a.b.c> rejected RCPT <userx@test.ex>
 >>> check senders = 1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec
 >>> !excl@z.z in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "^!excl" in TESTSUITE/aux-fixed/0067.rejrec)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<!excl@z.z> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -465,6 +488,7 @@ LOG: H=[1.2.3.4] F=<!excl@z.z> rejected RCPT <userx@test.ex>
 >>> y.p.s in "y.p.s"? yes (matched "y.p.s")
 >>> sh#rp@y.p.s in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "sh#rp@y.p.s" in TESTSUITE/aux-fixed/0067.rejrec)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<sh#rp@y.p.s> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -491,6 +515,7 @@ LOG: H=[1.2.3.4] F=<sh#rp@y.p.s> rejected RCPT <userx@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -505,6 +530,7 @@ LOG: H=[1.2.3.4] F=<sh#rp@y.p.s> rejected RCPT <userx@test.ex>
 >>> xx.yy in "b.c"? no (end of list)
 >>> xyzbc@xx.yy in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<xyzbc@xx.yy> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -520,6 +546,7 @@ LOG: H=[1.2.3.4] F=<xyzbc@xx.yy> rejected RCPT <x@test.ex>
 >>> xx.yy in "b.c"? no (end of list)
 >>> aabc@xx.yy in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<aabc@xx.yy> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -546,6 +573,7 @@ LOG: H=[1.2.3.4] F=<aabc@xx.yy> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -561,6 +589,7 @@ LOG: H=[1.2.3.4] F=<aabc@xx.yy> rejected RCPT <x@test.ex>
 >>> bb.cc in "bb.cc"? yes (matched "bb.cc")
 >>> y@bb.cc in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "*@bb.cc")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<y@bb.cc> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -589,6 +618,7 @@ LOG: H=[1.2.3.4] F=<y@bb.cc> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -614,6 +644,7 @@ LOG: H=[1.2.3.4] F=<y@bb.cc> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -630,4 +661,5 @@ LOG: H=[1.2.3.4] F=<y@bb.cc> rejected RCPT <x@test.ex>
 >>> bbb.ccc in "bbb.ccc"? yes (matched "bbb.ccc")
 >>> z@bbb.ccc in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "bbb.ccc")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<z@bbb.ccc> rejected RCPT <x@test.ex>
diff --git a/test/stderr/0068 b/test/stderr/0068
index 8966ab413..fe81f4922 100644
--- a/test/stderr/0068
+++ b/test/stderr/0068
@@ -8,12 +8,17 @@
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 LOG: too many recipients: message rejected: sender=<x@y> H=[V4NET.10.10.10]
diff --git a/test/stderr/0069 b/test/stderr/0069
index 2355b74cd..0772c28b1 100644
--- a/test/stderr/0069
+++ b/test/stderr/0069
@@ -23,6 +23,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> check hosts = +include_unknown : ^ten-1\\.test\\.ex
 >>> host in "+include_unknown : ^ten-1\.test\.ex"? yes (matched "^ten-1\.test\.ex")
 >>> deny: condition test succeeded in ACL "check_recipientx"
+>>> end of ACL "check_recipientx": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<x@y> rejected RCPT <x@test.ex>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -47,6 +48,7 @@ LOG: failed to find host name for V4NET.0.0.13: accepted by +include_unknown
 >>> host in "+include_unknown : ^ten-1\.test\.ex"? yes (failed to find host name for V4NET.0.0.13)
 LOG: failed to find host name for V4NET.0.0.13: accepted by +include_unknown
 >>> deny: condition test succeeded in ACL "check_recipientx"
+>>> end of ACL "check_recipientx": DENY
 LOG: H=[V4NET.0.0.13] F=<userx@myhost.test.ex> rejected RCPT <x@test.ex>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -70,6 +72,7 @@ LOG: no IP address found for host non.existent.invalid (during SMTP connection f
 >>> processing "deny"
 >>>   message: "Denied"
 >>> deny: condition test succeeded in ACL "check_recipienty"
+>>> end of ACL "check_recipienty": DENY
 LOG: H=[V4NET.0.0.13] F=<userx@test.ex> rejected RCPT <y@test.ex>: "Denied"
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -91,6 +94,7 @@ LOG: no IP address found for host non.existent.invalid (during SMTP connection f
 >>> failed to find IP address for non.existent.invalid: item ignored by +ignore_unknown
 >>> host in "+ignore_unknown : non.existent.invalid : V4NET.0.0.13"? yes (matched "V4NET.0.0.13")
 >>> accept: condition test succeeded in ACL "check_recipientz"
+>>> end of ACL "check_recipientz": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -114,6 +118,7 @@ LOG: list matching forced to fail: failed to find IP address for non.existent.in
 >>> processing "deny"
 >>>   message: "Denied"
 >>> deny: condition test succeeded in ACL "check_recipienty"
+>>> end of ACL "check_recipienty": DENY
 LOG: H=[V4NET.0.0.13] F=<userx@test.ex> rejected RCPT <y@test.ex>: "Denied"
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -137,6 +142,7 @@ LOG: failed to find host name for V4NET.0.0.13: accepted by +include_unknown
 >>> test.again.dns in dns_again_means_nonexist? no (option unset)
 LOG: DNS lookup of test.again.dns deferred: accepted by +include_defer
 >>> deny: condition test succeeded in ACL "check_recipienta"
+>>> end of ACL "check_recipienta": DENY
 LOG: H=[V4NET.0.0.13] F=<userx@myhost.test.ex> rejected RCPT <a@test.ex>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -176,3 +182,4 @@ LOG: failed to find host name for V4NET.0.0.13: accepted by +include_unknown
 >>> DNS lookup of test.again.dns deferred: item ignored by +ignore_defer
 >>> host in "+ignore_defer : test.again.dns : V4NET.0.0.13"? yes (matched "V4NET.0.0.13")
 >>> accept: condition test succeeded in ACL "check_recipientc"
+>>> end of ACL "check_recipientc": ACCEPT
diff --git a/test/stderr/0070 b/test/stderr/0070
index bb6e554a8..ebab42f3e 100644
--- a/test/stderr/0070
+++ b/test/stderr/0070
@@ -33,6 +33,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> verifying EHLO/HELO argument "NULL"
 >>> no EHLO/HELO command was issued
 >>> require: condition test failed in ACL "rcpt"
+>>> end of ACL "rcpt": not OK
 LOG: H=[V4NET.0.0.13] F=<userx@cus.cam.ac.uk> rejected RCPT <a@b>: helo not verified
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -59,6 +60,7 @@ MUNGED: ::1 will be omitted in what follows
 >>>   message: helo not verified
 >>> check verify = helo
 >>> require: condition test failed in ACL "rcpt"
+>>> end of ACL "rcpt": not OK
 LOG: H=([V4NET.0.0.1]) [V4NET.0.0.2] F=<a@b> rejected RCPT <c@d>: helo not verified
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -88,6 +90,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: helo did verify
 >>> deny: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": DENY
 LOG: H=([V4NET.0.0.2]) [V4NET.0.0.2] F=<a@b> rejected RCPT <c@d>: helo did verify
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -213,6 +216,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> check verify = helo
 >>> verifying EHLO/HELO argument "[V4NET.0.0.99]"
 >>> require: condition test failed in ACL "rcpt"
+>>> end of ACL "rcpt": not OK
 LOG: H=([V4NET.0.0.99]) [V4NET.0.0.13] F=<a@b> rejected RCPT <c@d>: helo not verified
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -242,6 +246,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: helo did verify
 >>> deny: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": DENY
 LOG: H=([V4NET.0.0.13]) [V4NET.0.0.13] F=<a@b> rejected RCPT <c@d>: helo did verify
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -272,4 +277,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> getting IP address for rhubarb
 >>> no IP address found for host rhubarb (during SMTP connection from (rhubarb) [99.99.99.99])
 >>> require: condition test failed in ACL "rcpt"
+>>> end of ACL "rcpt": not OK
 LOG: H=(rhubarb) [99.99.99.99] F=<a@b> rejected RCPT <c@d>: helo not verified
diff --git a/test/stderr/0077 b/test/stderr/0077
index eabe6ae13..c8e30e996 100644
--- a/test/stderr/0077
+++ b/test/stderr/0077
@@ -22,6 +22,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> test.ex in "test.ex : myhost.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -43,6 +44,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> test.ex in "test.ex : myhost.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -62,4 +64,5 @@ MUNGED: ::1 will be omitted in what follows
 >>>   name=localhost address=127.0.0.1
 >>> host in "! @ : ! localhost"? yes (end of list)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<x@test.ex> rejected RCPT <x@test.ex>
diff --git a/test/stderr/0079 b/test/stderr/0079
index e00d79050..15a8ba903 100644
--- a/test/stderr/0079
+++ b/test/stderr/0079
@@ -41,6 +41,7 @@ LOG: H=(exim.test.ex) [V4NET.11.12.14] Warning: accepting postmaster from host i
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -73,6 +74,7 @@ LOG: H=(exim.test.ex) [V4NET.11.12.14] Warning: accepting postmaster from host i
 >>> DNS lookup for 14.12.11.V4NET.rbl2.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl2.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.11.12.14] F=<postmaster@exim.test.ex> rejected RCPT list@exim.test.ex: host is listed in rbl2.test.ex
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmbB-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtp S=sss
diff --git a/test/stderr/0080 b/test/stderr/0080
index 0a0d03f47..718dbba6e 100644
--- a/test/stderr/0080
+++ b/test/stderr/0080
@@ -14,6 +14,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check recipients = postmaster@exim.test.ex
@@ -27,6 +28,7 @@
 >>> DNS lookup for 14.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.11.12.14] F=<postmaster@exim.test.ex> rejected RCPT list@exim.test.ex: host is listed in rbl.test.ex
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtp S=sss
diff --git a/test/stderr/0086 b/test/stderr/0086
index ec49cd32d..1d133ff73 100644
--- a/test/stderr/0086
+++ b/test/stderr/0086
@@ -8,11 +8,13 @@
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaY-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: '>' missing at end of address: failing address in "Cc:" header is: <abcd@x.y.z
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -24,11 +26,13 @@ LOG: 10HmaY-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaZ-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: '>' missing at end of address: failing address in "Cc:" header is: <abcd@x.y.z
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -40,11 +44,13 @@ LOG: 10HmaZ-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: '>' missing at end of address: failing address in "Resent-To:" header is: <xyz@a.b.c.d
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -56,11 +62,13 @@ LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbB-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: unmatched doublequote in local part: failing address in "Cc:" header begins: "abcd@x.y.z (missing quote),\n  longlonglonglonglong@long.long.long.long.long.long.long.long,\n  listlistlistlistlist@list.list.list.list.list.list.list.list,\n  ofofofofofofofofofof@of.of.of.of.of.of.of.of.of.of.of.of.of,\n  addressesaddresses@addresses.addresses.addresses.addresses,   \n  longlonglonglonglong@long.long.long.long.long.long.long.long,\n  listlistlistlistlist@list.list.list.list.list.list.list.list,\n  ofofofofofofofofofof@of.of.of.of.of.of.of.of.of.of.of.of.of,\n  addressesaddresses@addresses.addresses.addresses.addresses,   \n  longlonglonglonglong@long.long.long.long.long.long.long.long,\n  listlistlistlistlist@list.list.list.list.list.list.list.list,\n  ofofofofofofofofofof@of.of.of.of.of.of.of.of.of.of.of.of.of,\n  addressesaddresses@addresses.addresses.addresses.addresses,   \n  longlonglonglonglong@long.long.long.long.long.long.long.long,\n  listlistlistlistlist@list.list.list.list.list.list.list.list,\n  ofofofofofofofofofof@of.of.of.of.of.of.of.of.of.of.of.of.of,\n  addressesaddresses@addresses.addre
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -72,11 +80,13 @@ LOG: 10HmbB-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: unqualified address not permitted: failing address in "Cc:" header is: <abcd>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -88,6 +98,7 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -95,4 +106,5 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.9] P=smtp S=sss
diff --git a/test/stderr/0087 b/test/stderr/0087
index ee44cf008..31cefea84 100644
--- a/test/stderr/0087
+++ b/test/stderr/0087
@@ -26,6 +26,7 @@
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -35,6 +36,7 @@
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -64,6 +66,7 @@ LOG: 10HmaX-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -73,6 +76,7 @@ LOG: 10HmaX-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -102,6 +106,7 @@ LOG: 10HmaY-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -113,6 +118,7 @@ LOG: 10HmaY-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> badbad in "userx"? no (end of list)
 >>> no more routers
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@test.ex> rejected after DATA: there is no valid sender in any header line
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -142,6 +148,7 @@ LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@test.ex> rejected after DATA:
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -157,6 +164,7 @@ LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@test.ex> rejected after DATA:
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -186,6 +194,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
diff --git a/test/stderr/0089 b/test/stderr/0089
index 83fc35df4..213760dae 100644
--- a/test/stderr/0089
+++ b/test/stderr/0089
@@ -23,6 +23,7 @@ LOG: rejected HELO from [V4NET.0.0.0]: syntactically invalid argument(s): @#$%^&
 >>> test.ex in "Test.ex : myhost.test.EX"? yes (matched "Test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -41,6 +42,7 @@ LOG: rejected HELO from [V4NET.0.0.0]: syntactically invalid argument(s): @#$%^&
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(abc_xyz) [V4NET.0.0.0] F=<userx@cus.cam.ac.uk> rejected RCPT <userx@else.where>: relay not permitted
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -73,6 +75,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> relay.one.ex in "Test.ex : Relay.one.ex"? yes (matched "Relay.one.ex")
 >>> relay.one.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -91,4 +94,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-99.test.ex (@#$%^&*()) [V4NET.0.0.99] F=<root@myhost.test.ex> rejected RCPT <yy@relay.two.ex>: relay not permitted
diff --git a/test/stderr/0091 b/test/stderr/0091
index 277cb8d70..4f6852885 100644
--- a/test/stderr/0091
+++ b/test/stderr/0091
@@ -16,6 +16,7 @@
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -26,6 +27,7 @@
 >>> junk in "userx"? no (end of list)
 >>> no more routers
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaY-0005vi-00 H=[V4NET.0.0.1] F=<junk@jink.jonk.test.ex> rejected after DATA: there is no valid sender in any header line
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -46,6 +48,7 @@ LOG: 10HmaY-0005vi-00 H=[V4NET.0.0.1] F=<junk@jink.jonk.test.ex> rejected after
 >>> no more routers
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.2] sender verify fail for <junk@jink.jonk.test.ex>: Unrouteable address
 LOG: H=[V4NET.0.0.2] F=<junk@jink.jonk.test.ex> rejected RCPT <root@test.ex>: Sender verify failed
 >>> host in hosts_connection_nolog? no (option unset)
@@ -73,6 +76,7 @@ LOG: H=[V4NET.0.0.2] F=<junk@jink.jonk.test.ex> rejected RCPT <root@test.ex>: Se
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -83,6 +87,7 @@ LOG: H=[V4NET.0.0.2] F=<junk@jink.jonk.test.ex> rejected RCPT <root@test.ex>: Se
 >>> junk in "userx"? no (end of list)
 >>> no more routers
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaZ-0005vi-00 H=[V4NET.0.0.2] F=<userx@test.ex> rejected after DATA: there is no valid sender in any header line
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -109,6 +114,7 @@ LOG: 10HmaZ-0005vi-00 H=[V4NET.0.0.2] F=<userx@test.ex> rejected after DATA: the
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -122,4 +128,5 @@ LOG: 10HmaZ-0005vi-00 H=[V4NET.0.0.2] F=<userx@test.ex> rejected after DATA: the
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@test.ex H=[V4NET.0.0.2] P=smtp S=sss
diff --git a/test/stderr/0092 b/test/stderr/0092
index f7bdef819..09bf352d1 100644
--- a/test/stderr/0092
+++ b/test/stderr/0092
@@ -30,6 +30,7 @@ LOG: SMTP command timeout on connection from [V4NET.0.0.1]
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: SMTP data timeout (message abandoned) on connection from [V4NET.0.0.1] F=<userx@test.ex>
 exim: timed out while reading - message abandoned
 exim: timed out while reading - message abandoned
@@ -61,6 +62,7 @@ exim: timed out while reading - message abandoned
 >>> no more routers
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<userx@test.ex> rejected RCPT verify@test.ex: Unrouteable address
 LOG: SMTP command timeout on connection from [V4NET.0.0.1]
 An error was detected while processing a file of BSMTP input.
diff --git a/test/stderr/0094 b/test/stderr/0094
index 77ca6bc2a..8626c5ec1 100644
--- a/test/stderr/0094
+++ b/test/stderr/0094
@@ -27,6 +27,7 @@ LOG: no host name found for IP address V4NET.11.12.13
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.11.12.13] F=<userx@cam.ac.uk> rejected RCPT <userx@cam.ac.uk>: relay not permitted
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? yes (matched "0.0.0.0/0")
@@ -61,6 +62,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<userx@cam.ac.uk> rejected RCPT <userx@cam.ac.uk>: relay not permitted
 Exim version x.yz ....
 changed uid/gid: forcing real = effective
@@ -125,6 +127,7 @@ check domains = +local_domains
 test.ex in "test.ex"? yes (matched "test.ex")
 test.ex in "+local_domains"? yes (matched "+local_domains")
 accept: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<userx@cam.ac.uk>
 using ACL "check_recipient"
@@ -145,6 +148,7 @@ accept: condition test failed in ACL "check_recipient"
 processing "deny"
   message: relay not permitted
 deny: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": DENY
 SMTP>> 550 relay not permitted
 LOG: MAIN REJECT
   H=oneback.test.ex [V4NET.99.99.90] F=<userx@test.ex> rejected RCPT <userx@cam.ac.uk>: relay not permitted
diff --git a/test/stderr/0121 b/test/stderr/0121
index 39cdfba9b..a00b2faf1 100644
--- a/test/stderr/0121
+++ b/test/stderr/0121
@@ -18,6 +18,7 @@
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[127.0.0.1] sender verify fail for <unknown@test.ex>: Unrouteable address
 LOG: H=[127.0.0.1] F=<unknown@test.ex> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> using ACL "check_recipient"
@@ -31,6 +32,7 @@ LOG: H=[127.0.0.1] F=<unknown@test.ex> rejected RCPT <userx@test.ex>: Sender ver
 >>> fail_remote_domains router forced address failure
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[127.0.0.1] sender verify fail for <userx@unknown.dom.ain>: unrouteable mail domain "unknown.dom.ain"
 LOG: H=[127.0.0.1] F=<userx@unknown.dom.ain> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
@@ -46,6 +48,7 @@ LOG: H=[127.0.0.1] F=<userx@unknown.dom.ain> rejected RCPT <userx@test.ex>: Send
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[127.0.0.1] sender verify fail for <"unknown with spaces"@test.ex>: Unrouteable address
 LOG: H=[127.0.0.1] F=<"unknown with spaces"@test.ex> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> using ACL "check_recipient"
@@ -66,6 +69,7 @@ LOG: H=[127.0.0.1] F=<"unknown with spaces"@test.ex> rejected RCPT <userx@test.e
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -79,6 +83,7 @@ LOG: H=[127.0.0.1] F=<"unknown with spaces"@test.ex> rejected RCPT <userx@test.e
 >>> unknown in "userx"? no (end of list)
 >>> no more routers
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaX-0005vi-00 H=[127.0.0.1] F=<userx@test.ex> rejected after DATA: there is no valid sender in any header line
 >>> using ACL "check_recipient"
 >>> processing "require"
@@ -98,12 +103,14 @@ LOG: 10HmaX-0005vi-00 H=[127.0.0.1] F=<userx@test.ex> rejected after DATA: there
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_sender
 >>> verifying From: header address <>
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaY-0005vi-00 H=[127.0.0.1] F=<userx@test.ex> rejected after DATA: syntax error in 'From:' header when scanning for sender: missing or malformed local part in "<>"
 >>> using ACL "check_recipient"
 >>> processing "require"
@@ -138,6 +145,7 @@ LOG: H=[127.0.0.1] F=<defer@test.ex> temporarily rejected RCPT <userx@test.ex>:
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
diff --git a/test/stderr/0124 b/test/stderr/0124
index 328d78084..d259f4768 100644
--- a/test/stderr/0124
+++ b/test/stderr/0124
@@ -27,6 +27,7 @@ LOG: no host name found for IP address V4NET.0.0.97
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.97] F=<userx@test.ex> rejected RCPT <userx@external.test.ex>: relay not permitted
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -45,4 +46,5 @@ LOG: H=[V4NET.0.0.97] F=<userx@test.ex> rejected RCPT <userx@external.test.ex>:
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.97] F=<userx@test.ex> rejected RCPT <userx@external.test.ex>: relay not permitted
diff --git a/test/stderr/0138 b/test/stderr/0138
index 921115a6e..c84420ece 100644
--- a/test/stderr/0138
+++ b/test/stderr/0138
@@ -24,6 +24,7 @@
 >>> DNS lookup for 14.12.11.V4NET.rbl3.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl3.test.ex
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -40,6 +41,7 @@
 >>> DNS lookup for 14.12.11.V4NET.rbl3.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl3.test.ex
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -116,5 +118,6 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.13] P=esmtp S=sss
diff --git a/test/stderr/0139 b/test/stderr/0139
index c7f1f32eb..140f54673 100644
--- a/test/stderr/0139
+++ b/test/stderr/0139
@@ -37,6 +37,7 @@
 >>> warn: condition test failed in ACL "check_mail"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "warn"
 >>>   message: X-Warn: host is listed in $dnslist_domain but not =127.0.0.3${if def:dnslist_text{\n  $dnslist_text}}
@@ -87,6 +88,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "warn"
 >>>   message: X-Warn: host is listed in $dnslist_domain but not =127.0.0.3${if def:dnslist_text{\n  $dnslist_text}}
@@ -123,6 +125,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=[V4NET.11.12.14] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -164,6 +167,7 @@ LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=[V4NET.11.12.14] P=smtp S=sss
 >>> warn: condition test failed in ACL "check_mail"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "warn"
 >>>   message: X-Warn: host is listed in $dnslist_domain but not =127.0.0.3${if def:dnslist_text{\n  $dnslist_text}}
@@ -182,6 +186,7 @@ LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=[V4NET.11.12.14] P=smtp S=sss
 >>> DNS lookup for 15.12.11.V4NET.rbl3.test.ex succeeded (yielding 127.0.0.3)
 >>> => that means V4NET.11.12.15 is listed at rbl3.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.test.ex>: host is listed in rbl3.test.ex with value 127.0.0.3
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -226,6 +231,7 @@ LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.te
 >>> warn: condition test failed in ACL "check_mail"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -267,6 +273,7 @@ LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.te
 >>> warn: condition test failed in ACL "check_mail"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -290,6 +297,7 @@ LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.te
 >>> warn: condition test succeeded in ACL "check_helo"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_helo"
+>>> end of ACL "check_helo": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -361,6 +369,7 @@ LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.te
 >>> warn: condition test failed in ACL "check_vrfy"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_vrfy"
+>>> end of ACL "check_vrfy": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing a@b
 >>> calling system_aliases router
diff --git a/test/stderr/0145 b/test/stderr/0145
index 129616bef..aa06f5a7f 100644
--- a/test/stderr/0145
+++ b/test/stderr/0145
@@ -17,6 +17,7 @@
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[V4NET.9.8.7] sender verify fail for <x@mxt10.test.ex>: all relevant MX records point to non-existent hosts or (invalidly) to IP addresses
 LOG: H=[V4NET.9.8.7] F=<x@mxt10.test.ex> rejected RCPT <x@y>: Sender verify failed
 >>> host in hosts_connection_nolog? no (option unset)
@@ -46,4 +47,5 @@ LOG: H=[V4NET.9.8.7] F=<x@mxt10.test.ex> rejected RCPT <x@y>: Sender verify fail
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[V4NET.9.8.7] F=<x@ten-1.test.ex> rejected RCPT <x@mxt10.test.ex>: all relevant MX records point to non-existent hosts or (invalidly) to IP addresses
diff --git a/test/stderr/0157 b/test/stderr/0157
index bcd4f6f78..a36650c8a 100644
--- a/test/stderr/0157
+++ b/test/stderr/0157
@@ -43,6 +43,7 @@ LOG: H=[V4NET.0.0.1] F=<x@y.z> rejected RCPT <a@b.c>: invalid sender
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> userx@test.ex in "userx@test.ex"? yes (matched "userx@test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -70,6 +71,7 @@ LOG: H=[V4NET.0.0.1] F=<x@y.z> rejected RCPT <a@b.c>: invalid sender
 >>> host in "V4NET.0.0.1 : V4NET.0.0.2"? yes (matched "V4NET.0.0.2")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -88,6 +90,7 @@ LOG: H=[V4NET.0.0.1] F=<x@y.z> rejected RCPT <a@b.c>: invalid sender
 >>> check hosts = +relay_hosts
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts" - cached)
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -118,6 +121,7 @@ LOG: H=[V4NET.0.0.1] F=<x@y.z> rejected RCPT <a@b.c>: invalid sender
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.3] F=<x@y.z> rejected RCPT <a@b.c>: relay not permitted
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -140,4 +144,5 @@ LOG: H=[V4NET.0.0.3] F=<x@y.z> rejected RCPT <a@b.c>: relay not permitted
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.3] F=<userx@test.ex> rejected RCPT <a@b.c>: relay not permitted
diff --git a/test/stderr/0175 b/test/stderr/0175
index cbf66d591..9423139cf 100644
--- a/test/stderr/0175
+++ b/test/stderr/0175
@@ -23,6 +23,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> fail_sender router forced address failure
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[V4NET.0.0.0] sender verify fail for <user@bad.domain>: remote host address is the local host
 LOG: H=[V4NET.0.0.0] F=<user@bad.domain> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> host in hosts_connection_nolog? no (option unset)
@@ -53,6 +54,7 @@ MUNGED: ::1 will be omitted in what follows
 >>>   name=localhost address=127.0.0.1
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[V4NET.0.0.0] sender verify fail for <user@bad.domain2>: fail_sender2 router forced verify failure
 LOG: H=[V4NET.0.0.0] F=<user@bad.domain2> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> host in hosts_connection_nolog? no (option unset)
@@ -87,4 +89,5 @@ LOG: H=[V4NET.0.0.0] F=<user@bad.domain2> rejected RCPT <userx@test.ex>: Sender
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= user@ten-1.test.ex H=[V4NET.0.0.0] P=smtp S=sss
diff --git a/test/stderr/0234 b/test/stderr/0234
index 727641b57..b7c44c7a9 100644
--- a/test/stderr/0234
+++ b/test/stderr/0234
@@ -15,6 +15,7 @@
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -23,6 +24,7 @@ LOG: H=[V4NET.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
 >>> mxt1.test.ex in "@mx_any"? yes (matched "@mx_any")
 >>> mxt1.test.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +relay_domains
@@ -32,3 +34,4 @@ LOG: H=[V4NET.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
 >>> mxt6.test.ex in "@mx_any"? yes (matched "@mx_any")
 >>> mxt6.test.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
diff --git a/test/stderr/0243 b/test/stderr/0243
index b8aaf253c..605febbfe 100644
--- a/test/stderr/0243
+++ b/test/stderr/0243
@@ -29,3 +29,4 @@
 >>> nl.demon.net in "nl.demon.net"? yes (matched "nl.demon.net")
 >>> nl.demon.net in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
diff --git a/test/stderr/0251 b/test/stderr/0251
index 982d9af3d..6a509366b 100644
--- a/test/stderr/0251
+++ b/test/stderr/0251
@@ -32,6 +32,7 @@
 >>> listr.test.ex in "test.ex : *.test.ex"? yes (matched "*.test.ex")
 >>> listr.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "deny"
 >>>   message: unrouteable address
@@ -50,5 +51,6 @@
 >>> listr.test.ex in "test.ex : *.test.ex"? yes (matched "*.test.ex")
 >>> listr.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 
 ******** SERVER ********
diff --git a/test/stderr/0281 b/test/stderr/0281
index 88d08143f..9a3396bbb 100644
--- a/test/stderr/0281
+++ b/test/stderr/0281
@@ -14,6 +14,7 @@
 >>> require: condition test succeeded in ACL "acl_rcpt_1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_1"
+>>> end of ACL "acl_rcpt_1": ACCEPT
 >>> using ACL "acl_rcpt_1"
 >>> processing "require"
 >>>   message: domain doesn't match @ or @[]
@@ -22,12 +23,14 @@
 >>> require: condition test succeeded in ACL "acl_rcpt_1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_1"
+>>> end of ACL "acl_rcpt_1": ACCEPT
 >>> using ACL "acl_rcpt_1"
 >>> processing "require"
 >>>   message: domain doesn't match @ or @[]
 >>> check domains = @ : @[]
 >>> else.where in "@ : @[]"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_1"
+>>> end of ACL "acl_rcpt_1": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match @ or @[]
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
@@ -39,6 +42,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match
 >>> require: condition test succeeded in ACL "acl_rcpt_2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": ACCEPT
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_any
@@ -49,6 +53,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match
 >>> require: condition test succeeded in ACL "acl_rcpt_2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": ACCEPT
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_any
@@ -62,6 +67,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match
 >>> require: condition test succeeded in ACL "acl_rcpt_2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": ACCEPT
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_any
@@ -71,6 +77,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match
 >>> ten-3.test.ex in hosts_treat_as_local? no (end of list)
 >>> mxt9.test.ex in "@mx_any"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxt9.test.ex>: domain doesn't match @mx_any
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
@@ -78,6 +85,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxt9.test.ex>: domain doesn't matc
 >>> check domains = @mx_any
 >>> mxnone.test.ex in "@mx_any"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxnone.test.ex>: domain doesn't match @mx_any
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
@@ -90,6 +98,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxnone.test.ex>: domain doesn't ma
 >>> require: condition test succeeded in ACL "acl_rcpt_3"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": ACCEPT
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_primary
@@ -102,6 +111,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxnone.test.ex>: domain doesn't ma
 >>>   eximtesthost.test.ex ip4.ip4.ip4.ip4 6
 >>> mxt6.test.ex in "@mx_primary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt6.test.ex>: domain doesn't match @mx_primary
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
@@ -112,6 +122,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt6.test.ex>: domain doesn't matc
 >>> ten-3.test.ex in hosts_treat_as_local? no (end of list)
 >>> mxt9.test.ex in "@mx_primary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt9.test.ex>: domain doesn't match @mx_primary
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
@@ -119,6 +130,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt9.test.ex>: domain doesn't matc
 >>> check domains = @mx_primary
 >>> mxnone.test.ex in "@mx_primary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxnone.test.ex>: domain doesn't match @mx_primary
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
@@ -128,6 +140,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxnone.test.ex>: domain doesn't ma
 >>> local host has lowest MX
 >>> mxt5.test.ex in "@mx_secondary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt5.test.ex>: domain doesn't match @mx_secondary
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
@@ -143,6 +156,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt5.test.ex>: domain doesn't matc
 >>> require: condition test succeeded in ACL "acl_rcpt_4"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": ACCEPT
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_secondary
@@ -152,6 +166,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt5.test.ex>: domain doesn't matc
 >>> ten-3.test.ex in hosts_treat_as_local? no (end of list)
 >>> mxt9.test.ex in "@mx_secondary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt9.test.ex>: domain doesn't match @mx_secondary
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
@@ -159,6 +174,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt9.test.ex>: domain doesn't matc
 >>> check domains = @mx_secondary
 >>> mxnone.test.ex in "@mx_secondary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxnone.test.ex>: domain doesn't match @mx_secondary
 >>> using ACL "acl_rcpt_5"
 >>> processing "require"
@@ -169,6 +185,7 @@ MUNGED: ::1 will be omitted in what follows
 >>>   name=myhost.test.ex address=V4NET.10.10.10
 >>> host in "@ : @[]"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_5"
+>>> end of ACL "acl_rcpt_5": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <5@myhost.test.ex>: host doesn't match @ or @[]
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -189,6 +206,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> require: condition test succeeded in ACL "acl_rcpt_5"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_5"
+>>> end of ACL "acl_rcpt_5": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -208,6 +226,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> require: condition test succeeded in ACL "acl_rcpt_5"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_5"
+>>> end of ACL "acl_rcpt_5": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -228,6 +247,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> require: condition test succeeded in ACL "acl_rcpt_2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": ACCEPT
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_primary
@@ -238,6 +258,7 @@ MUNGED: ::1 will be omitted in what follows
 >>>   eximtesthost.test.ex ip4.ip4.ip4.ip4 6
 >>> mxt3.test.ex in "@mx_primary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt3.test.ex>: domain doesn't match @mx_primary
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
@@ -251,3 +272,4 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt3.test.ex>: domain doesn't matc
 >>> require: condition test succeeded in ACL "acl_rcpt_4"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": ACCEPT
diff --git a/test/stderr/0294 b/test/stderr/0294
index 3b09873e2..362675064 100644
--- a/test/stderr/0294
+++ b/test/stderr/0294
@@ -110,6 +110,7 @@ one in "reject"? no (end of list)
 deny: condition test failed in inline ACL
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<one@z>
 host in smtp_ratelimit_hosts? no (end of list)
@@ -119,6 +120,7 @@ one in "reject"? no (end of list)
 deny: condition test failed in inline ACL
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
@@ -152,6 +154,7 @@ one in "reject"? no (end of list)
 deny: condition test failed in inline ACL
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<one@z>
 host in smtp_ratelimit_hosts? yes (matched "V4NET.9.8.7")
@@ -162,6 +165,7 @@ one in "reject"? no (end of list)
 deny: condition test failed in inline ACL
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/0303 b/test/stderr/0303
index bd6f78c4b..9893e6404 100644
--- a/test/stderr/0303
+++ b/test/stderr/0303
@@ -83,6 +83,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -152,6 +153,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0304 b/test/stderr/0304
index 253287df2..d82bb3ee9 100644
--- a/test/stderr/0304
+++ b/test/stderr/0304
@@ -47,6 +47,7 @@
 >>> x in "x"? yes (matched "x")
 >>> b1@x in "b1@x"? yes (matched "b1@x")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<> rejected RCPT <b1@x>: failed 7
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -96,6 +97,7 @@ LOG: H=[1.2.3.4] F=<> rejected RCPT <b1@x>: failed 7
 >>> x in "x"? yes (matched "x")
 >>> b2@x in "b2@x"? yes (matched "b2@x")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<> rejected RCPT <b2@x>: failed 8
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -162,12 +164,14 @@ LOG: H=[1.2.3.4] F=<> rejected RCPT <b2@x>: failed 8
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
 >>> check recipients = \N^abc.*@.*\.x\.y\.z\N : a@b
 >>> abc@w.x.y.z in "^abc.*@.*\.x\.y\.z : a@b"? yes (matched "^abc.*@.*\.x\.y\.z")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@w.x.y.z>: failed 1
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -175,6 +179,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@w.x.y.z>: failed 1
 >>> check recipients = \N^abc.*@.*\.x\.y\.z\N : a@b
 >>> abcdef@q.x.y.z in "^abc.*@.*\.x\.y\.z : a@b"? yes (matched "^abc.*@.*\.x\.y\.z")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcdef@q.x.y.z>: failed 1
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -183,6 +188,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcdef@q.x.y.z>: failed 1
 >>> b in "b"? yes (matched "b")
 >>> a@b in "^abc.*@.*\.x\.y\.z : a@b"? yes (matched "a@b")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@b>: failed 1
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -246,6 +252,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@b>: failed 1
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -257,6 +264,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@b>: failed 1
 >>> check recipients = lsearch*@;TESTSUITE/aux-fixed/0304.d1
 >>> x@a.b.c in "lsearch*@;TESTSUITE/aux-fixed/0304.d1"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0304.d1")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@a.b.c>: failed 2
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -269,6 +277,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@a.b.c>: failed 2
 >>> check recipients = lsearch*@;TESTSUITE/aux-fixed/0304.d1
 >>> abc@d.e.f in "lsearch*@;TESTSUITE/aux-fixed/0304.d1"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0304.d1")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@d.e.f>: failed 2
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -332,6 +341,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@d.e.f>: failed 2
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -348,6 +358,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@d.e.f>: failed 2
 >>> check recipients = @@lsearch;TESTSUITE/aux-fixed/0304.d2
 >>> abc@at.1 in "@@lsearch;TESTSUITE/aux-fixed/0304.d2"? yes (matched "@@lsearch;TESTSUITE/aux-fixed/0304.d2")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@at.1>: failed 3
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -365,6 +376,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@at.1>: failed 3
 >>> check recipients = @@lsearch;TESTSUITE/aux-fixed/0304.d2
 >>> xyz@at.1 in "@@lsearch;TESTSUITE/aux-fixed/0304.d2"? yes (matched "@@lsearch;TESTSUITE/aux-fixed/0304.d2")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@at.1>: failed 3
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -382,6 +394,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@at.1>: failed 3
 >>> check recipients = @@lsearch;TESTSUITE/aux-fixed/0304.d2
 >>> abcxyz@at.1 in "@@lsearch;TESTSUITE/aux-fixed/0304.d2"? yes (matched "@@lsearch;TESTSUITE/aux-fixed/0304.d2")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcxyz@at.1>: failed 3
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -445,6 +458,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcxyz@at.1>: failed 3
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -467,6 +481,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcxyz@at.1>: failed 3
 >>> domain.only in "domain.only"? yes (matched "domain.only")
 >>> x@domain.only in "domain.only : *.domain2.only"? yes (matched "domain.only")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@domain.only>: failed 4
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -491,6 +506,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@domain.only>: failed 4
 >>> abc.domain2.only in "*.domain2.only"? yes (matched "*.domain2.only")
 >>> x@abc.domain2.only in "domain.only : *.domain2.only"? yes (matched "*.domain2.only")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@abc.domain2.only>: failed 4
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -554,6 +570,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@abc.domain2.only>: failed 4
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -583,6 +600,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@abc.domain2.only>: failed 4
 >>> domain3 in "domain3"? yes (matched "domain3")
 >>> abc@domain3 in "abc@domain3 : xyz@*.domain4"? yes (matched "abc@domain3")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@domain3>: failed 5
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -613,6 +631,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@domain3>: failed 5
 >>> x.domain4 in "*.domain4"? yes (matched "*.domain4")
 >>> xyz@x.domain4 in "abc@domain3 : xyz@*.domain4"? yes (matched "xyz@*.domain4")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@x.domain4>: failed 5
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -677,6 +696,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@x.domain4>: failed 5
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -741,6 +761,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@x.domain4>: failed 5
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -775,6 +796,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@x.domain4>: failed 5
 >>> myhost.test.ex in "@"? yes (matched "@")
 >>> pqr@myhost.test.ex in "pqr@@"? yes (matched "pqr@@")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <pqr@myhost.test.ex>: failed 6
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -838,6 +860,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <pqr@myhost.test.ex>: failed 6
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -889,6 +912,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <pqr@myhost.test.ex>: failed 6
 >>> domain5 in "lsearch;TESTSUITE/aux-fixed/0304.d3"? yes (matched "lsearch;TESTSUITE/aux-fixed/0304.d3")
 >>> a@domain5 in "*@lsearch;TESTSUITE/aux-fixed/0304.d3"? yes (matched "*@lsearch;TESTSUITE/aux-fixed/0304.d3")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@domain5>: failed 9
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -947,6 +971,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@domain5>: failed 9
 >>> domain6 in "lsearch;TESTSUITE/aux-fixed/0304.d4"? yes (matched "lsearch;TESTSUITE/aux-fixed/0304.d4")
 >>> xyz@domain6 in "xyz@lsearch;TESTSUITE/aux-fixed/0304.d4"? yes (matched "xyz@lsearch;TESTSUITE/aux-fixed/0304.d4")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@domain6>: failed 10
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -1011,6 +1036,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@domain6>: failed 10
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -1071,4 +1097,5 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@domain6>: failed 10
 >>> check recipients = lsearch*@;TESTSUITE/aux-fixed/0304.d5
 >>> x@domain7 in "lsearch*@;TESTSUITE/aux-fixed/0304.d5"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0304.d5")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@domain7>: failed 11
diff --git a/test/stderr/0305 b/test/stderr/0305
index ecf6bb944..7fc6cfc5b 100644
--- a/test/stderr/0305
+++ b/test/stderr/0305
@@ -12,6 +12,7 @@
 >>> ten-1.test.ex in "ten-1.test.ex"? yes (matched "ten-1.test.ex")
 >>> ten-1.test.ex in "+ok_domains"? yes (matched "+ok_domains")
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "accept"
 >>> check domains = +ok_domains
diff --git a/test/stderr/0306 b/test/stderr/0306
index e4207e42a..d2fcf91e5 100644
--- a/test/stderr/0306
+++ b/test/stderr/0306
@@ -24,6 +24,7 @@
 >>> routed by r5 router
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": ACCEPT
 >>> using ACL "rcpt"
 >>> processing "accept"
 >>> check verify = recipient
@@ -35,6 +36,7 @@
 >>> routed by r2 router
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "rcpt"
 >>> processing "accept"
diff --git a/test/stderr/0308 b/test/stderr/0308
index 4a89c24ea..2c800bb61 100644
--- a/test/stderr/0308
+++ b/test/stderr/0308
@@ -18,6 +18,7 @@ LOG: no host name found for IP address V4NET.0.0.97
 >>> check hosts = V4NET.0.0.97
 >>> host in "V4NET.0.0.97"? yes (matched "V4NET.0.0.97")
 >>> accept: condition test succeeded in ACL "acl_V4NET_0_0"
+>>> end of ACL "acl_V4NET_0_0": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -39,3 +40,4 @@ MUNGED: ::1 will be omitted in what follows
 >>>   V4NET.0.0.1 OK
 >>> host in "*.test.ex"? yes (matched "*.test.ex")
 >>> accept: condition test succeeded in ACL "acl_V4NET_0_0"
+>>> end of ACL "acl_V4NET_0_0": ACCEPT
diff --git a/test/stderr/0325 b/test/stderr/0325
index 727ee56b1..cd66e202c 100644
--- a/test/stderr/0325
+++ b/test/stderr/0325
@@ -32,4 +32,5 @@ r4: $local_part_data = LOCAL PART DATA
 >>> xxx in "+test_local_parts"? yes (matched "+test_local_parts" - cached)
 >>>   message: \$domain_data=$domain_data \$local_part_data=$local_part_data
 >>> deny: condition test succeeded in ACL "a1"
+>>> end of ACL "a1": DENY
 LOG: H=[V4NET.0.0.0] F=<a@b.c> rejected RCPT xxx@a.b.c: $domain_data=DOMAIN DATA $local_part_data=LOCAL PART DATA
diff --git a/test/stderr/0342 b/test/stderr/0342
index 1e84be464..dc772a105 100644
--- a/test/stderr/0342
+++ b/test/stderr/0342
@@ -22,3 +22,4 @@
 >>> deny: condition test failed in ACL "check_rcpt"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
diff --git a/test/stderr/0362 b/test/stderr/0362
index 14065094f..5f03562df 100644
--- a/test/stderr/0362
+++ b/test/stderr/0362
@@ -73,6 +73,7 @@ routed by r2 router
   transport: t2
 ----------- end verify ------------
 accept: condition test succeeded in ACL "check_rcpt"
+end of ACL "check_rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 the.local.host.name closing connection
diff --git a/test/stderr/0371 b/test/stderr/0371
index c4f9a93ac..df1a378c8 100644
--- a/test/stderr/0371
+++ b/test/stderr/0371
@@ -27,6 +27,7 @@ check set acl_c0 = $acl_c0; connect
 check set acl_c9 = $acl_c9; connect
                  = ; connect
 accept: condition test succeeded in ACL "connect"
+end of ACL "connect": ACCEPT
 SMTP>> 220 mail.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< ehlo something
@@ -50,6 +51,7 @@ check set acl_c9 = $acl_c9; mail
 check set acl_m0 = $acl_m0; mail
                  = ; mail
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 using ACL "rcpt"
@@ -61,6 +63,7 @@ check set acl_m9 = $acl_m9; rcpt
 check set acl_c0 = $acl_c0; rcpt
                  = ; connect; mail; rcpt
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -84,6 +87,7 @@ check set acl_m0 = $acl_m0; data
 check set acl_m9 = $acl_m9; data
                  = ; rcpt; data
 accept: condition test succeeded in ACL "data"
+end of ACL "data": ACCEPT
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
 LOG: MAIN
@@ -101,6 +105,7 @@ check set acl_c9 = $acl_c9; vrfy
 check set acl_m0 = $acl_m0; vrfy
                  = ; vrfy
 accept: condition test succeeded in ACL "vrfy"
+end of ACL "vrfy": ACCEPT
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 Verifying x@y
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
@@ -121,6 +126,7 @@ check set acl_c9 = $acl_c9; mail
 check set acl_m0 = $acl_m0; mail
                  = ; mail
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 SMTP>> 250 OK
 SMTP<< quit
 SMTP>> 221 mail.test.ex closing connection
diff --git a/test/stderr/0381 b/test/stderr/0381
index 7f6f680db..176287a50 100644
--- a/test/stderr/0381
+++ b/test/stderr/0381
@@ -73,6 +73,7 @@ host in "!*.co.uk.test.ex"? no (matched "!*.co.uk.test.ex")
 warn: condition test failed in ACL "check_rcpt"
 processing "accept"
 accept: condition test succeeded in ACL "check_rcpt"
+end of ACL "check_rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/0384 b/test/stderr/0384
index 8d556f5a0..7a0eb8339 100644
--- a/test/stderr/0384
+++ b/test/stderr/0384
@@ -15,3 +15,4 @@
 LOG: rejected "EHLO [1.2.3.4]" from ([1.2.3.4]) [V4NET.9.8.7]
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
diff --git a/test/stderr/0386 b/test/stderr/0386
index b796773d8..6084853e4 100644
--- a/test/stderr/0386
+++ b/test/stderr/0386
@@ -68,6 +68,7 @@ require: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl1"
 processing "deny"
   message: No such user here
 deny: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl1"
+end of ACL "TESTSUITE/aux-fixed/0386.acl1": DENY
 SMTP>> 550 No such user here
 LOG: MAIN REJECT
   H=[V4NET.9.8.7] F=<x@y> rejected RCPT <1@b>: No such user here
@@ -113,6 +114,7 @@ require: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl1"
 processing "deny"
   message: No such user here
 deny: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl1"
+end of ACL "TESTSUITE/aux-fixed/0386.acl1": DENY
 SMTP>> 550 No such user here
 LOG: MAIN REJECT
   H=[V4NET.9.8.7] F=<x@y> rejected RCPT <1@b>: No such user here
@@ -175,6 +177,7 @@ LOG: MAIN
 created log directory TESTSUITE/spool/log
 processing "accept"
 accept: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl2"
+end of ACL "TESTSUITE/aux-fixed/0386.acl2": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -335,6 +338,7 @@ LOG: MAIN
   H=[V4NET.11.12.13] U=CALLER Warning: found in rbl.test.ex: This is a test blacklisting message
 processing "accept"
 accept: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl2"
+end of ACL "TESTSUITE/aux-fixed/0386.acl2": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0391 b/test/stderr/0391
index e6fac476b..326807765 100644
--- a/test/stderr/0391
+++ b/test/stderr/0391
@@ -55,6 +55,7 @@ routed by r1 router
 ----------- end verify ------------
 sender U@W.x.y verified ok as U@x.y
 accept: condition test succeeded in ACL "acl_rcpt"
+end of ACL "acl_rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/0394 b/test/stderr/0394
index a51fcf45f..72ffbede4 100644
--- a/test/stderr/0394
+++ b/test/stderr/0394
@@ -13,6 +13,7 @@ LOG: no host name found for IP address V4NET.255.255.255
 >>> processing "require"
 >>> check verify = reverse_host_lookup
 >>> require: condition test failed in ACL "connect"
+>>> end of ACL "connect": not OK
 LOG: H=[V4NET.255.255.255] rejected connection in "connect" ACL: host lookup failed (failed to find host name from IP address)
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? yes (matched "*")
diff --git a/test/stderr/0398 b/test/stderr/0398
index 0acc6c21c..5118c1af7 100644
--- a/test/stderr/0398
+++ b/test/stderr/0398
@@ -156,6 +156,7 @@ address match test: subject=qq@remote pattern=qq@remote
 remote in "remote"? yes (matched "remote")
 qq@remote in "qq@remote"? yes (matched "qq@remote")
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<xyz@local>
 using ACL "rcpt"
@@ -234,6 +235,7 @@ address match test: subject=qq@remote pattern=qq@remote
 remote in "remote"? yes (matched "remote")
 qq@remote in "qq@remote"? yes (matched "qq@remote")
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 mail.test.ex closing connection
diff --git a/test/stderr/0401 b/test/stderr/0401
index 10afc1392..ef9181703 100644
--- a/test/stderr/0401
+++ b/test/stderr/0401
@@ -11,6 +11,7 @@
 >>> check hosts = TESTSUITE/aux-var/0401.hosts1
 >>> host in "TESTSUITE/aux-var/0401.hosts1"? yes (matched "V4NET.9.8.7" in TESTSUITE/aux-var/0401.hosts1)
 >>> accept: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": ACCEPT
 >>> xxx in helo_lookup_domains? no (end of list)
 >>> using ACL "mail"
 >>> processing "accept"
diff --git a/test/stderr/0420 b/test/stderr/0420
index fbb2bf6c6..34f575e01 100644
--- a/test/stderr/0420
+++ b/test/stderr/0420
@@ -27,6 +27,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -51,6 +52,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0422 b/test/stderr/0422
index 36cfef60e..ffb7de0a7 100644
--- a/test/stderr/0422
+++ b/test/stderr/0422
@@ -17,6 +17,7 @@
 >>> deny: condition test failed in ACL "connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -34,4 +35,5 @@
 >>> DNS lookup for 2.13.13.V4NET.rbl.test.ex succeeded (yielding 127.0.0.1, 127.0.0.2)
 >>> => that means V4NET.13.13.2 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": DENY
 LOG: H=[V4NET.13.13.2] rejected connection in "connect" ACL: dnslist_value is 127.0.0.1, 127.0.0.2
diff --git a/test/stderr/0423 b/test/stderr/0423
index 47e674e52..c9963ca86 100644
--- a/test/stderr/0423
+++ b/test/stderr/0423
@@ -10,4 +10,5 @@
 >>> processing "deny"
 >>>   message: xxxxxxxxxxxxxx has refused this message because it looks like it is infected with the Sobig.E worm. See http://www.xxxx.xxx/xxxxxxxx/xxxx/xxxx/w32.sobig.e@xx.html for details. If you feel this determination is in error, please forward the entire message to postmaster@xxxxxxxxxxxxx.com and include code \"xx#1\" in the Subject
 >>> deny: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": DENY
 LOG: H=[V4NET.13.13.1] rejected connection in "connect" ACL: xxxxxxxxxxxxxx has refused this message because it looks like it is infected with the Sobig.E worm. See http://www.xxxx.xxx/xxxxxxxx/xxxx/xxxx/w32.sobig.e@xx.html for details. If you feel this determination is in error, please forward the entire message to postmaster@xxxxxxxxxxxxx.com and include code "xx#1" in the Subject
diff --git a/test/stderr/0432 b/test/stderr/0432
index 759c9a819..a9581e9b4 100644
--- a/test/stderr/0432
+++ b/test/stderr/0432
@@ -23,6 +23,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> (Use -bhc if you want the callouts to happen.)
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
 Exim version x.yz ....
 changed uid/gid: forcing real = effective
   uid=uuuu gid=CALLER_GID pid=pppp
@@ -111,6 +112,7 @@ wrote positive callout cache address record
 ----------- end verify ------------
 sender x@y verified ok
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 SMTP>> 250 OK
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
@@ -185,6 +187,7 @@ callout cache: address record is positive
 ----------- end verify ------------
 sender x@y verified ok
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 SMTP>> 250 OK
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
@@ -218,6 +221,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> callout cache: address record is positive
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -258,6 +262,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> wrote positive callout cache address record
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
diff --git a/test/stderr/0445 b/test/stderr/0445
index f8b5c1d87..a78932683 100644
--- a/test/stderr/0445
+++ b/test/stderr/0445
@@ -16,6 +16,7 @@
 >>> bad_addresses router forced address failure
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": DENY
 LOG: H=[1.2.3.4] sender verify fail for <lp1@x.y>: 
 LOG: H=[1.2.3.4] F=<lp1@x.y> rejected RCPT <zz@x.y>: Sender verify failed
 >>> using ACL "rcpt"
@@ -28,5 +29,6 @@ LOG: H=[1.2.3.4] F=<lp1@x.y> rejected RCPT <zz@x.y>: Sender verify failed
 >>> bad_addresses router forced address failure
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": DENY
 LOG: H=[1.2.3.4] sender verify fail for <lp2@x.y>: This is a message
 LOG: H=[1.2.3.4] F=<lp2@x.y> rejected RCPT <zz@x.y>: Sender verify failed
diff --git a/test/stderr/0464 b/test/stderr/0464
index 6d2746223..b405a8192 100644
--- a/test/stderr/0464
+++ b/test/stderr/0464
@@ -163,6 +163,7 @@ routed by r2 router
 require: condition test succeeded in ACL "rcpt"
 processing "accept"
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/0465 b/test/stderr/0465
index 070227068..634cd2103 100644
--- a/test/stderr/0465
+++ b/test/stderr/0465
@@ -52,6 +52,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<abc@domain.>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -76,6 +77,7 @@ using ACL "check_data"
 processing "accept"
 check verify = header_syntax
 accept: condition test succeeded in ACL "check_data"
+end of ACL "check_data": ACCEPT
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
 Writing spool header file
@@ -114,6 +116,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<abc@xyz>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0479 b/test/stderr/0479
index 92880ddb7..fe0190e97 100644
--- a/test/stderr/0479
+++ b/test/stderr/0479
@@ -67,6 +67,7 @@ sender a@b verified ok as rewritten-a@rewritten-b
 require: condition test succeeded in ACL "rcpt"
 processing "accept"
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<e@f>
 using ACL "rcpt"
@@ -80,6 +81,7 @@ using cached sender verify result
 require: condition test succeeded in ACL "rcpt"
 processing "accept"
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 the.local.host.name closing connection
diff --git a/test/stderr/0487 b/test/stderr/0487
index 448754ed5..4f2bbc2aa 100644
--- a/test/stderr/0487
+++ b/test/stderr/0487
@@ -30,6 +30,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<userx@test.ex>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0513 b/test/stderr/0513
index 5ee113b7c..b889bc065 100644
--- a/test/stderr/0513
+++ b/test/stderr/0513
@@ -19,4 +19,5 @@
 >>> ----------- end verify ------------
 >>>   message: >$acl_verify_message< ++++
 >>> defer: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": DEFER
 LOG: H=(a.b.c.d) [1.2.3.4] F=<> temporarily rejected RCPT <x@mxt2.test.ex>: all relevant MX records point to non-existent hosts
diff --git a/test/stderr/0524 b/test/stderr/0524
index d839bc3d3..22b7888de 100644
--- a/test/stderr/0524
+++ b/test/stderr/0524
@@ -13,6 +13,7 @@
 >>>   message: CSA status is $csa_status
 >>> check verify = csa
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> csa2.test.ex in helo_lookup_domains? no (end of list)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
diff --git a/test/stderr/0534 b/test/stderr/0534
index edda3c2a2..9296b5cd2 100644
--- a/test/stderr/0534
+++ b/test/stderr/0534
@@ -11,3 +11,4 @@
 >>> check hosts = 5.6.7.8
 >>> host in "5.6.7.8"? yes (matched "5.6.7.8")
 >>> accept: condition test succeeded in ACL "two"
+>>> end of ACL "two": ACCEPT
diff --git a/test/stderr/0537 b/test/stderr/0537
index a2fed387b..f6ad3ba90 100644
--- a/test/stderr/0537
+++ b/test/stderr/0537
@@ -40,7 +40,9 @@ LOG: sender_host_name=
 >>>                = sender_ident=
 LOG: sender_ident=
 >>> accept: condition test succeeded in ACL "log"
+>>> end of ACL "log": ACCEPT
 >>> accept: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -81,7 +83,9 @@ LOG: sender_host_name=hostname
 >>>                = sender_ident=ident
 LOG: sender_ident=ident
 >>> accept: condition test succeeded in ACL "log"
+>>> end of ACL "log": ACCEPT
 >>> accept: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": ACCEPT
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> using ACL "mail"
 >>> processing "accept"
@@ -115,6 +119,7 @@ LOG: sender_host_name=hostname
 >>>                = sender_ident=ident
 LOG: sender_ident=ident
 >>> accept: condition test succeeded in ACL "log"
+>>> end of ACL "log": ACCEPT
 >>> check acl = auth
 >>> using ACL "auth"
 >>> processing "accept"
@@ -123,7 +128,9 @@ LOG: sender_ident=ident
 >>> check logwrite = +++ host is authenticated +++
 LOG: +++ host is authenticated +++
 >>> accept: condition test succeeded in ACL "auth"
+>>> end of ACL "auth": ACCEPT
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
 >>> using ACL "mail"
 >>> processing "accept"
 >>> check acl = log
@@ -156,6 +163,7 @@ LOG: sender_host_name=hostname
 >>>                = sender_ident=ident
 LOG: sender_ident=ident
 >>> accept: condition test succeeded in ACL "log"
+>>> end of ACL "log": ACCEPT
 >>> check acl = auth
 >>> using ACL "auth"
 >>> processing "accept"
@@ -164,4 +172,6 @@ LOG: sender_ident=ident
 >>> check logwrite = +++ host is authenticated +++
 LOG: +++ host is authenticated +++
 >>> accept: condition test succeeded in ACL "auth"
+>>> end of ACL "auth": ACCEPT
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
diff --git a/test/stderr/0569 b/test/stderr/0569
index ea01fa87a..168f0eb53 100644
--- a/test/stderr/0569
+++ b/test/stderr/0569
@@ -13,8 +13,10 @@
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -23,6 +25,7 @@
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -39,14 +42,17 @@ LOG: 10HmaX-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>>   message: ${if def:acl_m_message {$acl_m_message}}
 >>> check verify = header_names_ascii
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: Invalid character in header "Received" found
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -63,14 +69,17 @@ LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> usery@exim.test.ex in "usery@exim.test.ex"? yes (matched "usery@exim.test.ex")
 >>> check set acl_m_message = I do not like your message
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>>   message: ${if def:acl_m_message {$acl_m_message}}
 >>> check verify = header_names_ascii
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbB-0005vi-00 H=[V4NET.10.10.10] F=<usery@exim.test.ex> rejected after DATA: Invalid character in header "Subjec⍅" found
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -87,14 +96,17 @@ LOG: 10HmbB-0005vi-00 H=[V4NET.10.10.10] F=<usery@exim.test.ex> rejected after D
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>>   message: ${if def:acl_m_message {$acl_m_message}}
 >>> check verify = header_names_ascii
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: Invalid character in header "Subjec⍅" found
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -111,8 +123,10 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -121,6 +135,7 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -137,8 +152,10 @@ LOG: 10HmaY-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -147,4 +164,5 @@ LOG: 10HmaY-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
diff --git a/test/stderr/2600 b/test/stderr/2600
index a1adefa66..35b81412d 100644
--- a/test/stderr/2600
+++ b/test/stderr/2600
@@ -157,6 +157,7 @@ accept: condition test failed in ACL "check_recipient"
 processing "deny"
   message: relay not permitted
 deny: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": DENY
 SMTP>> 550 relay not permitted
 LOG: MAIN REJECT
   H=[10.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
@@ -186,6 +187,7 @@ accept: condition test failed in ACL "check_recipient"
 processing "deny"
   message: relay not permitted
 deny: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": DENY
 SMTP>> 550 relay not permitted
 LOG: MAIN REJECT
   H=[10.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
@@ -244,6 +246,7 @@ lookup yielded: name=ok id=10.10.10.10
 host in "sqlite;TESTSUITE/aux-fixed/sqlitedb select * from them where id='10.10.10.10'"? yes (matched "sqlite;TESTSUITE/aux-fixed/sqlitedb select * from them where id='10.10.10.10'")
 host in "+relay_hosts"? yes (matched "+relay_hosts")
 accept: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<c@d>
 using ACL "check_recipient"
@@ -267,6 +270,7 @@ lookup yielded: name=ok id=10.10.10.10
 host in "sqlite;TESTSUITE/aux-fixed/sqlitedb select * from them where id='10.10.10.10'"? yes (matched "sqlite;TESTSUITE/aux-fixed/sqlitedb select * from them where id='10.10.10.10'")
 host in "+relay_hosts"? yes (matched "+relay_hosts")
 accept: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/3000 b/test/stderr/3000
index 47714a125..0b7c946d3 100644
--- a/test/stderr/3000
+++ b/test/stderr/3000
@@ -53,5 +53,6 @@ LOG: this is a warning at TESTSUITE/aux-fixed/3000.pl line 25.
 >>> check condition = ${if !eq {${perl{foo_warn}}}{}}
 >>>                 = true
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 
 ******** SERVER ********
diff --git a/test/stderr/3208 b/test/stderr/3208
index 7e12f1fe1..9b33e5f3d 100644
--- a/test/stderr/3208
+++ b/test/stderr/3208
@@ -19,6 +19,7 @@
 >>> test.ex in "!*relay.ex : test.ex : testhack.ex : testhack2.ex : testdb;defer"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> other.ex in percent_hack_domains? list match deferred for testdb;defer
 LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCPT <a@other.ex>: defer in percent_hack_domains check
 >>> testhack.ex in percent_hack_domains? yes (matched "testhack.ex")
@@ -35,6 +36,7 @@ LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCP
 >>> test.ex in "!*relay.ex : test.ex : testhack.ex : testhack2.ex : testdb;defer"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> testhack2.ex in percent_hack_domains? list match deferred for testdb;defer
 LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCPT <a%b@testhack2.ex>: defer in percent_hack_domains check
 >>> yesrelay.ex in percent_hack_domains? no (matched "!*relay.ex")
@@ -53,6 +55,7 @@ LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCP
 >>> yesrelay.ex in "test.ex : testhack.ex : testhack2.ex : yesrelay.ex : testdb;defer"? yes (matched "yesrelay.ex")
 >>> yesrelay.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> norelay.ex in percent_hack_domains? no (matched "!*relay.ex")
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -87,6 +90,7 @@ LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCP
 >>> yesrelay.ex in "test.ex : testhack.ex : testhack2.ex : yesrelay.ex : testdb;defer"? yes (matched "yesrelay.ex")
 >>> yesrelay.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> testhack.ex in percent_hack_domains? yes (matched "testhack.ex")
 >>> norelay.ex in percent_hack_domains? no (matched "!*relay.ex")
 >>> using ACL "check_recipient"
diff --git a/test/stderr/3400 b/test/stderr/3400
index 529ce480c..138f2be2c 100644
--- a/test/stderr/3400
+++ b/test/stderr/3400
@@ -13,6 +13,7 @@
 >>> warn: condition test failed in ACL "check_connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "check_vrfy"
 >>> processing "deny"
@@ -22,6 +23,7 @@
 >>> deny: condition test failed in ACL "check_vrfy"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_vrfy"
+>>> end of ACL "check_vrfy": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing userx@test.ex
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
@@ -38,6 +40,7 @@
 >>> check hosts = 10.0.0.0/24
 >>> host in "10.0.0.0/24"? yes (matched "10.0.0.0/24")
 >>> accept: condition test succeeded in ACL "check_expn"
+>>> end of ACL "check_expn": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing list@test.ex
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
@@ -60,6 +63,7 @@ LOG: ETRN #abcd received from [10.0.0.2]
 LOG: H=[10.0.0.2] Warning: accepted ETRN #abcd
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_etrn"
+>>> end of ACL "check_etrn": ACCEPT
 >>> ETRN command is: exim -R
 >>> ETRN command execution skipped
 >>> host in hosts_connection_nolog? no (option unset)
@@ -77,6 +81,7 @@ LOG: H=[10.0.0.2] Warning: accepted ETRN #abcd
 >>> warn: condition test failed in ACL "check_connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
 >>> test.host in helo_lookup_domains? no (end of list)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in "10.0.0.1"? yes (matched "10.0.0.1")
@@ -89,6 +94,7 @@ LOG: H=[10.0.0.2] Warning: accepted ETRN #abcd
 >>>   message: authentication required
 >>> check !authenticated = *
 >>> deny: condition test succeeded in ACL "check_vrfy"
+>>> end of ACL "check_vrfy": DENY
 LOG: H=(test.host) [10.0.0.1] rejected VRFY userx@test.ex: authentication required
 >>> using ACL "check_expn"
 >>> processing "deny"
@@ -97,6 +103,7 @@ LOG: H=(test.host) [10.0.0.1] rejected VRFY userx@test.ex: authentication requir
 >>>   message: authentication required
 >>> check !authenticated = *
 >>> deny: condition test succeeded in ACL "check_expn"
+>>> end of ACL "check_expn": DENY
 LOG: H=(test.host) [10.0.0.1] rejected EXPN list@test.ex: authentication required
 LOG: ETRN abcd received from (test.host) [10.0.0.1]
 >>> using ACL "check_etrn"
@@ -106,6 +113,7 @@ LOG: ETRN abcd received from (test.host) [10.0.0.1]
 >>>   message: authentication required
 >>> check !authenticated = *
 >>> deny: condition test succeeded in ACL "check_etrn"
+>>> end of ACL "check_etrn": DENY
 LOG: H=(test.host) [10.0.0.1] rejected ETRN abcd: authentication required
 >>> using ACL "check_recipient"
 >>> processing "warn"
@@ -126,6 +134,7 @@ LOG: H=(test.host) [10.0.0.1] rejected ETRN abcd: authentication required
 >>>   message: authentication required
 >>> check !authenticated = *
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@test.ex>: authentication required
 >>> mylogin authenticator server_condition:
 >>>   $auth1 = userx secret
@@ -157,6 +166,7 @@ LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@te
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "warn"
 >>> check hosts = 10.0.0.5
@@ -195,6 +205,7 @@ LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@te
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> A=mylogin rejected RCPT <userx@cus.cam.ac.uk>: relay not permitted
 >>> using ACL "check_vrfy"
 >>> processing "deny"
@@ -206,6 +217,7 @@ LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> A=mylogin rejected RCPT
 >>> deny: condition test failed in ACL "check_vrfy"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_vrfy"
+>>> end of ACL "check_vrfy": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing userx@test.ex
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
@@ -225,6 +237,7 @@ LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> A=mylogin rejected RCPT
 >>> check hosts = 10.0.0.0/24
 >>> host in "10.0.0.0/24"? yes (matched "10.0.0.0/24")
 >>> accept: condition test succeeded in ACL "check_expn"
+>>> end of ACL "check_expn": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing list@test.ex
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
@@ -250,6 +263,7 @@ LOG: ETRN #abcd received from (test.host) [10.0.0.1]
 LOG: H=(test.host) [10.0.0.1] Warning: accepted ETRN #abcd
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_etrn"
+>>> end of ACL "check_etrn": ACCEPT
 >>> ETRN command is: exim -R
 >>> ETRN command execution skipped
 >>> host in hosts_connection_nolog? no (option unset)
@@ -267,6 +281,7 @@ LOG: H=(test.host) [10.0.0.1] Warning: accepted ETRN #abcd
 >>> warn: condition test failed in ACL "check_connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
 >>> test.host in helo_lookup_domains? no (end of list)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in "10.0.0.1"? no (end of list)
@@ -345,6 +360,7 @@ LOG: H=(test.host) [10.0.0.3] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@cu
 >>> check authenticated = *
 >>> mylogin in "*"? yes (matched "*")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -360,6 +376,7 @@ LOG: H=(test.host) [10.0.0.3] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@cu
 >>> warn: condition test failed in ACL "check_connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
 >>> test.host in helo_lookup_domains? no (end of list)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in "10.0.0.1"? no (end of list)
@@ -401,6 +418,7 @@ host in "10.0.0.6"? no (end of list)
 warn: condition test failed in ACL "check_connect"
 processing "accept"
 accept: condition test succeeded in ACL "check_connect"
+end of ACL "check_connect": ACCEPT
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< ehlo testing.testing
diff --git a/test/stderr/3408 b/test/stderr/3408
index 753824558..105c6ba99 100644
--- a/test/stderr/3408
+++ b/test/stderr/3408
@@ -19,6 +19,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -37,6 +38,7 @@
 >>> DNS lookup for 14.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.11.12.14] F=<postmaster@exim.test.ex> rejected RCPT userx@exim.test.ex: host is listed in rbl.test.ex
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtp S=sss
@@ -69,6 +71,7 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -114,5 +117,6 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtpa A=plain:userx S=sss
diff --git a/test/stderr/3410 b/test/stderr/3410
index e129996a7..618d18aca 100644
--- a/test/stderr/3410
+++ b/test/stderr/3410
@@ -30,6 +30,7 @@ LOG: H=[5.6.9.1] F=<x@y> rejected RCPT <x@y>: You must authenticate
 >>> check authenticated = *
 >>> auth1 in "*"? yes (matched "*")
 >>> accept: condition test succeeded in ACL "acl_5_6_9"
+>>> end of ACL "acl_5_6_9": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -60,6 +61,7 @@ LOG: H=[5.6.10.1] F=<x@y> rejected RCPT <x@y>
 >>> check authenticated = auth1
 >>> auth1 in "auth1"? yes (matched "auth1")
 >>> accept: condition test succeeded in ACL "acl_5_6_10"
+>>> end of ACL "acl_5_6_10": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
diff --git a/test/stderr/3500 b/test/stderr/3500
index ee07be398..53c850879 100644
--- a/test/stderr/3500
+++ b/test/stderr/3500
@@ -58,6 +58,7 @@
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= userx@some.domain H=(test.host) [10.0.0.1] P=esmtpa A=cram_md5:tim S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -93,5 +94,6 @@ LOG: cram_md5 authenticator failed for (test.host) [10.0.0.5]: 535 Incorrect aut
 >>> check hosts = 10.0.0.5
 >>> host in "10.0.0.5"? yes (matched "10.0.0.5")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaZ-0005vi-00 <= userx@some.domain H=(test.host) [10.0.0.5] P=esmtp S=sss
diff --git a/test/stderr/5400 b/test/stderr/5400
index 1c9b0d83a..fc3b6063d 100644
--- a/test/stderr/5400
+++ b/test/stderr/5400
@@ -12,6 +12,7 @@ LOG: MAIN
   rcpt for userx@domain.com
 created log directory TESTSUITE/spool/log
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
@@ -24,6 +25,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Send data
 ----------- start cutthrough headers send -----------
@@ -57,6 +59,7 @@ check logwrite = rcpt for $local_part@$domain
 LOG: MAIN
   rcpt for userz@domain.com
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 SMTP only spoken here
@@ -71,6 +74,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Send data
 ----------- start cutthrough headers send -----------
@@ -104,6 +108,7 @@ check logwrite = rcpt for $local_part@$domain
 LOG: MAIN
   rcpt for usery@domain.com
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
@@ -122,6 +127,7 @@ check logwrite = rcpt for $local_part@$domain
 LOG: MAIN
   rcpt for userx@domain.com
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
   SMTP>> QUIT
 ----------- cutthrough shutdown (more than one recipient) ------------
 LOG: MAIN
@@ -186,6 +192,7 @@ check logwrite = rcpt for $local_part@$domain
 LOG: MAIN
   rcpt for userx@domain.com
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
@@ -198,6 +205,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Send data
 ----------- start cutthrough headers send -----------
diff --git a/test/stderr/5401 b/test/stderr/5401
index 1bd14f8d5..1b42441d9 100644
--- a/test/stderr/5401
+++ b/test/stderr/5401
@@ -9,6 +9,7 @@ check control = cutthrough_delivery
 check verify = recipient
 ----------- end verify ------------
 accept: condition test succeeded in ACL "acl_rcpt"
+end of ACL "acl_rcpt": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
@@ -21,6 +22,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Send data
 ----------- start cutthrough headers send -----------
diff --git a/test/stderr/5410 b/test/stderr/5410
index ddd6dbcc6..09685491d 100644
--- a/test/stderr/5410
+++ b/test/stderr/5410
@@ -32,6 +32,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -96,6 +97,7 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
@@ -190,6 +192,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -230,6 +233,7 @@ expanding: ${if eq {$address_data}{usery}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
@@ -324,6 +328,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -364,6 +369,7 @@ expanding: ${if eq {$address_data}{usery}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
diff --git a/test/stderr/5420 b/test/stderr/5420
index 9eea77d05..5694e911f 100644
--- a/test/stderr/5420
+++ b/test/stderr/5420
@@ -32,6 +32,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -98,6 +99,7 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
@@ -192,6 +194,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -232,6 +235,7 @@ expanding: ${if eq {$address_data}{usery}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
@@ -326,6 +330,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -366,6 +371,7 @@ expanding: ${if eq {$address_data}{usery}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
diff --git a/test/stderr/5700 b/test/stderr/5700
index 4f28d19c4..dcb696955 100644
--- a/test/stderr/5700
+++ b/test/stderr/5700
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_deliver_action in smtp: error from acl "logger"
+1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_event_action msg:delivery in smtp: error from acl "logger"
 
diff --git a/test/stdout/0601 b/test/stdout/0601
index 75968f3de..85107ba74 100644
--- a/test/stdout/0601
+++ b/test/stdout/0601
@@ -1,2 +1,7 @@
+220 the.local.host.name ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

 received:  message from exim
-550 Administrative prohibition

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+250 OK id=10HmaX-0005vi-00

+221 the.local.host.name closing connection

diff --git a/test/stdout/2102 b/test/stdout/2102
index 77ae109b2..56c47f8b3 100644
--- a/test/stdout/2102
+++ b/test/stdout/2102
@@ -20,7 +20,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -74,7 +73,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -128,7 +126,6 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -168,7 +165,6 @@ Key file = TESTSUITE/aux-fixed/exim-ca/example.com/server2.example.com/server2.e
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2103 b/test/stdout/2103
index 1c2f41881..d7d74beca 100644
--- a/test/stdout/2103
+++ b/test/stdout/2103
@@ -20,7 +20,6 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -67,7 +66,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2105 b/test/stdout/2105
index a9eb350be..457921c41 100644
--- a/test/stdout/2105
+++ b/test/stdout/2105
@@ -26,7 +26,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2106 b/test/stdout/2106
index cae6e21c8..576eef83f 100644
--- a/test/stdout/2106
+++ b/test/stdout/2106
@@ -20,7 +20,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2114 b/test/stdout/2114
index 35a696915..c0c698b22 100644
--- a/test/stdout/2114
+++ b/test/stdout/2114
@@ -20,7 +20,6 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -58,7 +57,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -112,7 +110,6 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -164,7 +161,6 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -216,7 +212,6 @@ Key file = aux-fixed/cert1
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -257,7 +252,6 @@ Key file = aux-fixed/cert1
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -311,7 +305,6 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -352,7 +345,6 @@ Key file = aux-fixed/cert1
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2118 b/test/stdout/2118
index 1709dee8a..fa74b6c51 100644
--- a/test/stdout/2118
+++ b/test/stdout/2118
@@ -20,7 +20,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2119 b/test/stdout/2119
index 0bcff273b..a5c488226 100644
--- a/test/stdout/2119
+++ b/test/stdout/2119
@@ -2,7 +2,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -53,7 +52,6 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2122 b/test/stdout/2122
index 4bb927032..8da07cd89 100644
--- a/test/stdout/2122
+++ b/test/stdout/2122
@@ -20,7 +20,6 @@ Connecting to ip4.ip4.ip4.ip4 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2124 b/test/stdout/2124
index d2d83d5b6..d1e0f2137 100644
--- a/test/stdout/2124
+++ b/test/stdout/2124
@@ -22,7 +22,6 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2128 b/test/stdout/2128
index 795f469d1..65457b924 100644
--- a/test/stdout/2128
+++ b/test/stdout/2128
@@ -20,7 +20,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -43,7 +42,6 @@ Connecting to 127.0.0.1 port 1226 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/2150 b/test/stdout/2150
index 2f5596499..6601866c9 100644
--- a/test/stdout/2150
+++ b/test/stdout/2150
@@ -20,7 +20,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/3450 b/test/stdout/3450
index 1bd2e21d2..24b1f8bf9 100644
--- a/test/stdout/3450
+++ b/test/stdout/3450
@@ -50,7 +50,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/3454 b/test/stdout/3454
index ae2eab337..5cdb2a760 100644
--- a/test/stdout/3454
+++ b/test/stdout/3454
@@ -22,7 +22,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -64,7 +63,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/3460 b/test/stdout/3460
index 92c47970f..b9dc4ef50 100644
--- a/test/stdout/3460
+++ b/test/stdout/3460
@@ -50,7 +50,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/3463 b/test/stdout/3463
index 68b1b55c0..d1c8d2aa6 100644
--- a/test/stdout/3463
+++ b/test/stdout/3463
@@ -22,7 +22,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -71,7 +70,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/3464 b/test/stdout/3464
index 46f1c3729..2b900a3e1 100644
--- a/test/stdout/3464
+++ b/test/stdout/3464
@@ -22,7 +22,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -65,7 +64,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/5600 b/test/stdout/5600
index 9020be17e..7c6a458ab 100644
--- a/test/stdout/5600
+++ b/test/stdout/5600
@@ -22,11 +22,9 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 Response verify OK
-SSL info: unknown state
 SSL info: SSLv3 read server key exchange A
 SSL info: SSLv3 read server certificate request A
 SSL info: SSLv3 read server done A
@@ -76,7 +74,6 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 no response received
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
@@ -120,7 +117,6 @@ Key file = aux-fixed/cert2
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 no response received
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A