From a612424f526dbe6a0bde0658cf104b41a8458d05 Mon Sep 17 00:00:00 2001
From: Jeremy Harris <jgh146exb@wizmail.org>
Date: Sat, 9 Aug 2014 13:44:29 +0100
Subject: Doc updates for work since 4.83

---
 doc/doc-txt/ChangeLog | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'doc/doc-txt')

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 615b4cf96..bea6b1aa3 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -8,6 +8,14 @@ TL/01 Bugzilla 1506: Re-add a 'return NULL' to silence complaints from static
       checkers that were complaining about end of non-void function with no
       return.
 
+JH/01 Bug 1513: Fix parsing of quoted parameter values in MIME headers.
+      This was a regression intruduced in 4.83 by another bugfix.
+
+JH/02 Fix broken compilation when EXPERIMENTAL_DSN is enabled.
+
+TL/02 Bug 1509: Fix exipick for enhanced spoolfile specification used when
+      EXPERIMENTAL_DNS is enabled.  Fix from Wolfgang Breyha.
+
 
 Exim version 4.83
 -----------------
-- 
cgit v1.2.3


From e449c3b03ae53a6b90affaad467e8e81df55600c Mon Sep 17 00:00:00 2001
From: Todd Lyons <tlyons@exim.org>
Date: Thu, 14 Aug 2014 12:36:34 -0700
Subject: Properly detect/set test variables from scripts.

---
 doc/doc-txt/ChangeLog | 11 +++++++++++
 test/runtest          | 15 ++++++++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

(limited to 'doc/doc-txt')

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index bea6b1aa3..a93f9057b 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -2,6 +2,17 @@ Change log file for Exim from version 4.21
 -------------------------------------------
 
 
+Exim version 4.85
+-----------------
+TL/01 When running the test suite, the README says that variables such as
+      no_msglog_check are global and can be placed anywhere in a specific
+      test's script, however it was observed that placement needed to be near
+      the beginning for it to behave that way. Changed the runtest perl
+      script to read through the entire script once to detect and set these
+      variables, reset to the beginning of the script, and then run through
+      the script parsing/test process like normal.
+
+
 Exim version 4.84
 -----------------
 TL/01 Bugzilla 1506: Re-add a 'return NULL' to silence complaints from static
diff --git a/test/runtest b/test/runtest
index a6c4f0acd..c3faa4262 100755
--- a/test/runtest
+++ b/test/runtest
@@ -3358,9 +3358,20 @@ foreach $test (@test_list)
   undef %expected_msglogs;
 
   # Open the test's script
-
   open(SCRIPT, "scripts/$test") ||
     tests_exit(-1, "Failed to open \"scripts/$test\": $!");
+  # Run through the script once to set variables which should be global
+  while (<SCRIPT>)
+    {
+    if (/^no_message_check/) { $message_skip = 1; next; }
+    if (/^no_msglog_check/)  { $msglog_skip = 1; next; }
+    if (/^no_stderr_check/)  { $stderr_skip = 1; next; }
+    if (/^no_stdout_check/)  { $stdout_skip = 1; next; }
+    if (/^rmfiltertest/)     { $rmfiltertest = 1; next; }
+    if (/^sortlog/)          { $sortlog = 1; next; }
+    }
+  # Reset to beginning of file for per test interpreting/processing
+  seek(SCRIPT, 0, 0);
 
   # The first line in the script must be a comment that is used to identify
   # the set of tests as a whole.
@@ -3383,6 +3394,8 @@ foreach $test (@test_list)
     while (<SCRIPT>)
       {
       $lineno++;
+      # Could remove these variable settings because they are already
+      # set above, but doesn't hurt to leave them here.
       if (/^no_message_check/) { $message_skip = 1; next; }
       if (/^no_msglog_check/)  { $msglog_skip = 1; next; }
       if (/^no_stderr_check/)  { $stderr_skip = 1; next; }
-- 
cgit v1.2.3


From ac20058fb01a79d2011352107b9b6e4aa3e3e35b Mon Sep 17 00:00:00 2001
From: Todd Lyons <tlyons@exim.org>
Date: Thu, 14 Aug 2014 12:59:49 -0700
Subject: ChangeLog entry for OpenBSD 5.5 patch

---
 doc/doc-txt/ChangeLog | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'doc/doc-txt')

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index a93f9057b..0bf49a7c5 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -12,6 +12,11 @@ TL/01 When running the test suite, the README says that variables such as
       variables, reset to the beginning of the script, and then run through
       the script parsing/test process like normal.
 
+TL/02 The BSD's have an arc4random API. One of the functions to induce
+      adding randomness was arc4random_stir(), but it has been removed in
+      OpenBSD 5.5. Detect this OpenBSD version and skip calling this
+      function when detected.
+
 
 Exim version 4.84
 -----------------
-- 
cgit v1.2.3


From a7538db17824b7fd70c12ef7561a67b85d6f247e Mon Sep 17 00:00:00 2001
From: Jeremy Harris <jgh146exb@wizmail.org>
Date: Wed, 20 Aug 2014 14:05:30 +0100
Subject: Expanded EXPERIMENTAL_TPDA feature

Note this introduces incompatible changes; users who are compiling
the feature in, and with configuration files using it, will need to
change their configurations appropriately.  See the experimental-spec.txt
file.
---
 doc/doc-docbook/spec.xfpt         |  10 +
 doc/doc-txt/experimental-spec.txt | 107 +++++-----
 src/src/acl.c                     |  31 ++-
 src/src/deliver.c                 | 178 +++++++++-------
 src/src/expand.c                  |  13 +-
 src/src/functions.h               |   8 +-
 src/src/globals.c                 |  10 +-
 src/src/globals.h                 |  10 +-
 src/src/smtp_out.c                |  14 +-
 src/src/structs.h                 |   2 +-
 src/src/tls-gnu.c                 |  82 +++++++-
 src/src/tls-openssl.c             |  64 +++++-
 src/src/transport.c               |   4 +-
 src/src/transports/smtp.c         | 412 ++++++++++++++++++++------------------
 src/src/transports/smtp.h         |   3 -
 src/src/verify.c                  | 111 ++++++----
 test/confs/5608                   |  13 +-
 test/confs/5658                   |  13 +-
 test/confs/5700                   |  63 ++++--
 test/confs/5750                   |  21 +-
 test/confs/5760                   |  21 +-
 test/log/5700                     |  30 ++-
 test/log/5750                     |  12 +-
 test/log/5760                     |  13 +-
 test/paniclog/5700                |   2 +-
 test/runtest                      |   2 +-
 test/stderr/0002                  |  18 ++
 test/stderr/0003                  |  33 +++
 test/stderr/0004                  |  36 ++++
 test/stderr/0018                  |   1 +
 test/stderr/0020                  |   1 +
 test/stderr/0021                  |   7 +
 test/stderr/0022                  |  16 ++
 test/stderr/0023                  |  55 +++++
 test/stderr/0026                  |   4 +
 test/stderr/0038                  |  15 ++
 test/stderr/0041                  |   1 +
 test/stderr/0042                  |   3 +
 test/stderr/0043                  |   4 +
 test/stderr/0044                  |   3 +
 test/stderr/0056                  |   3 +
 test/stderr/0057                  |   3 +
 test/stderr/0058                  |   2 +
 test/stderr/0059                  |   2 +
 test/stderr/0060                  |  16 ++
 test/stderr/0061                  |   4 +
 test/stderr/0062                  |   9 +
 test/stderr/0063                  |   4 +
 test/stderr/0064                  |   4 +
 test/stderr/0065                  |  14 ++
 test/stderr/0066                  |  18 ++
 test/stderr/0067                  |  32 +++
 test/stderr/0068                  |   5 +
 test/stderr/0069                  |   7 +
 test/stderr/0070                  |   6 +
 test/stderr/0077                  |   3 +
 test/stderr/0079                  |   2 +
 test/stderr/0080                  |   2 +
 test/stderr/0086                  |  12 ++
 test/stderr/0087                  |   9 +
 test/stderr/0089                  |   4 +
 test/stderr/0091                  |   7 +
 test/stderr/0092                  |   2 +
 test/stderr/0094                  |   4 +
 test/stderr/0121                  |   8 +
 test/stderr/0124                  |   2 +
 test/stderr/0138                  |   3 +
 test/stderr/0139                  |   9 +
 test/stderr/0145                  |   2 +
 test/stderr/0157                  |   5 +
 test/stderr/0175                  |   3 +
 test/stderr/0234                  |   3 +
 test/stderr/0243                  |   1 +
 test/stderr/0251                  |   2 +
 test/stderr/0281                  |  22 ++
 test/stderr/0294                  |   4 +
 test/stderr/0303                  |   2 +
 test/stderr/0304                  |  27 +++
 test/stderr/0305                  |   1 +
 test/stderr/0306                  |   2 +
 test/stderr/0308                  |   2 +
 test/stderr/0325                  |   1 +
 test/stderr/0342                  |   1 +
 test/stderr/0362                  |   1 +
 test/stderr/0371                  |   6 +
 test/stderr/0381                  |   1 +
 test/stderr/0384                  |   1 +
 test/stderr/0386                  |   4 +
 test/stderr/0391                  |   1 +
 test/stderr/0394                  |   1 +
 test/stderr/0398                  |   2 +
 test/stderr/0401                  |   1 +
 test/stderr/0420                  |   2 +
 test/stderr/0422                  |   2 +
 test/stderr/0423                  |   1 +
 test/stderr/0432                  |   5 +
 test/stderr/0445                  |   2 +
 test/stderr/0464                  |   1 +
 test/stderr/0465                  |   3 +
 test/stderr/0479                  |   2 +
 test/stderr/0487                  |   1 +
 test/stderr/0513                  |   1 +
 test/stderr/0524                  |   1 +
 test/stderr/0534                  |   1 +
 test/stderr/0537                  |  10 +
 test/stderr/0569                  |  18 ++
 test/stderr/2600                  |   4 +
 test/stderr/3000                  |   1 +
 test/stderr/3208                  |   4 +
 test/stderr/3400                  |  18 ++
 test/stderr/3408                  |   4 +
 test/stderr/3410                  |   2 +
 test/stderr/3500                  |   2 +
 test/stderr/5400                  |   8 +
 test/stderr/5401                  |   2 +
 test/stderr/5410                  |   6 +
 test/stderr/5420                  |   6 +
 test/stderr/5700                  |   2 +-
 test/stdout/3450                  |   1 -
 test/stdout/3454                  |   2 -
 120 files changed, 1371 insertions(+), 479 deletions(-)

(limited to 'doc/doc-txt')

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 38c8b34fa..0775cb139 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -11413,6 +11413,11 @@ the result, the name is not accepted, and &$host_lookup_deferred$& is set to
 .vindex "&$host_lookup_failed$&"
 See &$host_lookup_deferred$&.
 
+.vitem &$host_port$&
+.vindex "&$host_port$&"
+This variable is set to the remote host's TCP port whenever &$host$& is set
+for an outbound connection.
+
 
 .vitem &$inode$&
 .vindex "&$inode$&"
@@ -27632,6 +27637,11 @@ anyway. If the message contains newlines, this gives rise to a multi-line SMTP
 response.
 
 .vindex "&$acl_verify_message$&"
+.new
+For ACLs that are called by an &%acl =%& ACL condition, the message is
+stored in &$acl_verify_message$&, from which the calling ACL may use it.
+.wen
+
 If &%message%& is used on a statement that verifies an address, the message
 specified overrides any message that is generated by the verification process.
 However, the original message is available in the variable
diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 6657f63c7..b98ac7929 100644
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -767,82 +767,83 @@ and (for SMTP transports) a second string on deferrals caused by a host error.
 This feature may be used, for example, to write exim internal log information
 (not available otherwise) into a database.
 
-In order to use the feature, you must set
+In order to use the feature, you must compile with
 
 EXPERIMENTAL_TPDA=yes
 
 in your Local/Makefile
 
-and define the expandable strings in the runtime config file, to
-be executed at end of delivery.
+and define the tpda_event_action option in the transport, to
+be expanded when the event fires.
 
-Additionally, there are 6 more variables, available at end of
-delivery:
+A new variable, $tpda_event, is set to the event type when the
+expansion is done.  The current list of events is:
 
-tpda_delivery_ip             IP of host, which has accepted delivery
-tpda_delivery_port           Port of remote host which has accepted delivery
-tpda_delivery_fqdn           FQDN of host, which has accepted delivery
-tpda_delivery_local_part     local part of address being delivered
-tpda_delivery_domain         domain part of address being delivered
-tpda_delivery_confirmation   SMTP confirmation message
+	msg:delivery
+	msg:host:defer
+	tcp:connect
+	tcp:close
+	tls:cert
+	smtp:connect
 
-In case of a deferral caused by a host-error:
-tpda_defer_errno             Error number
-tpda_defer_errstr            Error string possibly containing more details
+The expansion is called for all event types, and should use the $tpda_event
+value to decide when to act.  The variable data is a colon-separated
+list, describing an event tree.
 
-The $router_name and $transport_name variables are also usable.
+There is an auxilary variable, $tpda_data, for which the
+content is event_dependent:
 
+	msg:delivery		smtp confirmation mssage
+	msg:host:defer		error string
+	tls:cert		verification chain depth
+	smtp:connect		smtp banner
 
-To take action after successful deliveries, set the following option
-on any transport of interest.
+The msg:host:defer event populates one extra variable, $tpda_defer_errno.
+
+The following variables are likely to be useful for most event types:
+
+	router_name, transport_name
+	local_part, domain
+	host, host_address, host_port
+	tls_out_peercert
+	lookup_dnssec_authenticated, tls_out_dane
+	sending_ip_address, sending_port
 
-tpda_delivery_action
 
 An example might look like:
 
-tpda_delivery_action = \
-${lookup pgsql {SELECT * FROM record_Delivery( \
+tpda_event_action = ${if = {msg:delivery}{$tpda_event} \
+{${lookup pgsql {SELECT * FROM record_Delivery( \
     '${quote_pgsql:$sender_address_domain}',\
     '${quote_pgsql:${lc:$sender_address_local_part}}', \
-    '${quote_pgsql:$tpda_delivery_domain}', \
-    '${quote_pgsql:${lc:$tpda_delivery_local_part}}', \
-    '${quote_pgsql:$tpda_delivery_ip}', \
-    '${quote_pgsql:${lc:$tpda_delivery_fqdn}}', \
-    '${quote_pgsql:$message_exim_id}')}}
+    '${quote_pgsql:$domain}', \
+    '${quote_pgsql:${lc:$local_part}}', \
+    '${quote_pgsql:$host_address}', \
+    '${quote_pgsql:${lc:$host}}', \
+    '${quote_pgsql:$message_exim_id}')}} \
+} {}}
 
 The string is expanded after the delivery completes and any
 side-effects will happen.  The result is then discarded.
 Note that for complex operations an ACL expansion can be used.
 
+During the expansion the tpda_event variable will contain the
+string-list "msg:delivery".
+
+
+The expansion of the tpda_event_action option should normally
+return an empty string.  Should it return anything else the
+following will be forced:
+
+	msg:delivery	(ignored)
+	msg:host:defer	(ignored)
+	tcp:connect	do not connect
+	tcp:close	(ignored)
+	tls:cert	refuse verification
+	smtp:connect	close connection
+
+
 
-In order to log host deferrals, add the following option to an SMTP
-transport:
-
-tpda_host_defer_action
-
-This is a private option of the SMTP transport. It is intended to
-log failures of remote hosts. It is executed only when exim has
-attempted to deliver a message to a remote host and failed due to
-an error which doesn't seem to be related to the individual
-message, sender, or recipient address.
-See section 47.2 of the exim documentation for more details on how
-this is determined.
-
-Example:
-
-tpda_host_defer_action = \
-${lookup mysql {insert into delivlog set \
-    msgid = '${quote_mysql:$message_exim_id}', \
-    senderlp = '${quote_mysql:${lc:$sender_address_local_part}}', \
-    senderdom = '${quote_mysql:$sender_address_domain}', \
-    delivlp = '${quote_mysql:${lc:$tpda_delivery_local_part}}', \
-    delivdom = '${quote_mysql:$tpda_delivery_domain}', \
-    delivip = '${quote_mysql:$tpda_delivery_ip}', \
-    delivport = '${quote_mysql:$tpda_delivery_port}', \
-    delivfqdn = '${quote_mysql:$tpda_delivery_fqdn}', \
-    deliverrno = '${quote_mysql:$tpda_defer_errno}', \
-    deliverrstr = '${quote_mysql:$tpda_defer_errstr}' \
-    }}
 
 
 Redis Lookup
diff --git a/src/src/acl.c b/src/src/acl.c
index 6e635fbf1..fe1e254bd 100644
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -4129,7 +4129,11 @@ while (acl != NULL)
   switch(acl->verb)
     {
     case ACL_ACCEPT:
-    if (cond == OK || cond == DISCARD) return cond;
+    if (cond == OK || cond == DISCARD)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
+      return cond;
+      }
     if (endpass_seen)
       {
       HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
@@ -4140,17 +4144,26 @@ while (acl != NULL)
     case ACL_DEFER:
     if (cond == OK)
       {
+      HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
       acl_temp_details = TRUE;
       return DEFER;
       }
     break;
 
     case ACL_DENY:
-    if (cond == OK) return FAIL;
+    if (cond == OK)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
+      return FAIL;
+      }
     break;
 
     case ACL_DISCARD:
-    if (cond == OK || cond == DISCARD) return DISCARD;
+    if (cond == OK || cond == DISCARD)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
+      return DISCARD;
+      }
     if (endpass_seen)
       {
       HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
@@ -4159,11 +4172,19 @@ while (acl != NULL)
     break;
 
     case ACL_DROP:
-    if (cond == OK) return FAIL_DROP;
+    if (cond == OK)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
+      return FAIL_DROP;
+      }
     break;
 
     case ACL_REQUIRE:
-    if (cond != OK) return cond;
+    if (cond != OK)
+      {
+      HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
+      return cond;
+      }
     break;
 
     case ACL_WARN:
diff --git a/src/src/deliver.c b/src/src/deliver.c
index 87b54d88e..48d3fd7ec 100644
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -141,11 +141,13 @@ the first address. */
 if (addr->host_list == NULL)
   {
   deliver_host = deliver_host_address = US"";
+  deliver_host_port = 0;
   }
 else
   {
   deliver_host = addr->host_list->name;
   deliver_host_address = addr->host_list->address;
+  deliver_host_port = addr->host_list->port;
   }
 
 deliver_recipients = addr;
@@ -705,6 +707,43 @@ d_tlslog(uschar * s, int * sizep, int * ptrp, address_item * addr)
 }
 #endif
 
+
+#ifdef EXPERIMENTAL_TPDA
+int
+tpda_raise_event(uschar * action, uschar * event, uschar * ev_data)
+{
+uschar * s;
+if (action)
+  {
+  DEBUG(D_deliver)
+    debug_printf("TPDA(%s): tpda_event_action=|%s| tpda_delivery_IP=%s\n",
+      event,
+      action, deliver_host_address);
+
+  tpda_event = event;
+  tpda_data =  ev_data;
+
+  if (!(s = expand_string(action)) && *expand_string_message)
+    log_write(0, LOG_MAIN|LOG_PANIC,
+      "failed to expand tpda_event_action %s in %s: %s\n",
+      event, transport_name, expand_string_message);
+
+  tpda_event = tpda_data = NULL;
+
+  /* If the expansion returns anything but an empty string, flag for
+  the caller to modify his normal processing
+  */
+  if (s && *s)
+    {
+    DEBUG(D_deliver)
+      debug_printf("TPDA(%s): event_action returned \"%s\"\n", s);
+    return DEFER;
+    }
+  }
+return OK;
+}
+#endif
+
 /* If msg is NULL this is a delivery log and logchar is used. Otherwise
 this is a nonstandard call; no two-character delivery flag is written
 but sender-host and sender are prefixed and "msg" is inserted in the log line.
@@ -728,12 +767,7 @@ have a pointer to the host item that succeeded; local deliveries can have a
 pointer to a single host item in their host list, for use by the transport. */
 
 #ifdef EXPERIMENTAL_TPDA
-  tpda_delivery_ip = NULL;	/* presume no successful remote delivery */
-  tpda_delivery_port = 0;
-  tpda_delivery_fqdn = NULL;
-  tpda_delivery_local_part = NULL;
-  tpda_delivery_domain = NULL;
-  tpda_delivery_confirmation = NULL;
+  /* presume no successful remote delivery */
   lookup_dnssec_authenticated = NULL;
 #endif
 
@@ -782,13 +816,8 @@ if ((log_extra_selector & LX_delivery_size) != 0)
 
 if (addr->transport->info->local)
   {
-  if (addr->host_list != NULL)
-    {
+  if (addr->host_list)
     s = string_append(s, &size, &ptr, 2, US" H=", addr->host_list->name);
-    #ifdef EXPERIMENTAL_TPDA
-      tpda_delivery_fqdn = addr->host_list->name;
-    #endif
-    }
   if (addr->shadow_message != NULL)
     s = string_cat(s, &size, &ptr, addr->shadow_message,
       Ustrlen(addr->shadow_message));
@@ -804,24 +833,20 @@ else
     if (continue_sequence > 1)
       s = string_cat(s, &size, &ptr, US"*", 1);
 
-    #ifdef EXPERIMENTAL_TPDA
-    tpda_delivery_ip =           addr->host_used->address;
-    tpda_delivery_port =         addr->host_used->port;
-    tpda_delivery_fqdn =         addr->host_used->name;
-    tpda_delivery_local_part =   addr->local_part;
-    tpda_delivery_domain =       addr->domain;
-    tpda_delivery_confirmation = addr->message;
+#ifdef EXPERIMENTAL_TPDA
+    deliver_host_address = addr->host_used->address;
+    deliver_host_port =    addr->host_used->port;
 
     /* DNS lookup status */
     lookup_dnssec_authenticated = addr->host_used->dnssec==DS_YES ? US"yes"
 			      : addr->host_used->dnssec==DS_NO ? US"no"
 			      : NULL;
-    #endif
+#endif
     }
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   s = d_tlslog(s, &size, &ptr, addr);
-  #endif
+#endif
 
   if (addr->authenticator)
     {
@@ -834,10 +859,10 @@ else
       }
     }
 
-  #ifndef DISABLE_PRDR
+#ifndef DISABLE_PRDR
   if (addr->flags & af_prdr_used)
     s = string_append(s, &size, &ptr, 1, US" PRDR");
-  #endif
+#endif
   }
 
 /* confirmation message (SMTP (host_used) and LMTP (driver_name)) */
@@ -877,19 +902,22 @@ s[ptr] = 0;
 log_write(0, flags, "%s", s);
 
 #ifdef EXPERIMENTAL_TPDA
-if (addr->transport->tpda_delivery_action)
   {
-  DEBUG(D_deliver)
-    debug_printf("  TPDA(Delivery): tpda_deliver_action=|%s| tpda_delivery_IP=%s\n",
-      addr->transport->tpda_delivery_action, tpda_delivery_ip);
-
-  router_name =    addr->router->name;
-  transport_name = addr->transport->name;
-  if (!expand_string(addr->transport->tpda_delivery_action) && *expand_string_message)
-    log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand tpda_deliver_action in %s: %s\n",
-      transport_name, expand_string_message);
-  router_name = NULL;
-  transport_name = NULL;
+  uschar * save_domain = deliver_domain;
+  uschar * save_local =  deliver_localpart;
+
+  router_name =    addr->router ? addr->router->name : NULL;
+  transport_name = addr->transport ? addr->transport->name : NULL;
+  deliver_domain = addr->domain;
+  deliver_localpart = addr->local_part;
+
+  (void) tpda_raise_event(addr->transport->tpda_event_action, US"msg:delivery",
+	    addr->host_used || Ustrcmp(addr->transport->driver_name, "lmtp") == 0
+	    ? addr->message : NULL);
+
+  deliver_localpart = save_local;
+  deliver_domain =    save_domain;
+  router_name = transport_name = NULL;
   }
 #endif
 store_reset(reset_point);
@@ -1089,7 +1117,7 @@ if (result == OK)
     }
 
   /* Certificates for logging (via TPDA) */
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   tls_out.ourcert = addr->ourcert;
   addr->ourcert = NULL;
   tls_out.peercert = addr->peercert;
@@ -1098,11 +1126,11 @@ if (result == OK)
   tls_out.cipher = addr->cipher;
   tls_out.peerdn = addr->peerdn;
   tls_out.ocsp = addr->ocsp;
-  #endif
+#endif
 
   delivery_log(LOG_MAIN, addr, logchar, NULL);
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   if (tls_out.ourcert)
     {
     tls_free_cert(tls_out.ourcert);
@@ -1116,7 +1144,7 @@ if (result == OK)
   tls_out.cipher = NULL;
   tls_out.peerdn = NULL;
   tls_out.ocsp = OCSP_NOT_REQ;
-  #endif
+#endif
   }
 
 
@@ -1297,9 +1325,9 @@ else
   if (addr->host_used != NULL)
     s = d_hostlog(s, &size, &ptr, addr);
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   s = d_tlslog(s, &size, &ptr, addr);
-  #endif
+#endif
 
   if (addr->basic_errno > 0)
     s = string_append(s, &size, &ptr, 2, US": ",
@@ -1888,19 +1916,19 @@ if ((pid = fork()) == 0)
   diagnosis that it's reasonable to make them something that has to be explicitly requested.
   */
 
-  #ifdef RLIMIT_CORE
+#ifdef RLIMIT_CORE
   struct rlimit rl;
   rl.rlim_cur = 0;
   rl.rlim_max = 0;
   if (setrlimit(RLIMIT_CORE, &rl) < 0)
     {
-    #ifdef SETRLIMIT_NOT_SUPPORTED
+# ifdef SETRLIMIT_NOT_SUPPORTED
     if (errno != ENOSYS && errno != ENOTSUP)
-    #endif
+# endif
       log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_CORE) failed: %s",
         strerror(errno));
     }
-  #endif
+#endif
 
   /* Reset the random number generator, so different processes don't all
   have the same sequence. */
@@ -2987,7 +3015,7 @@ while (!done)
     it in with the other info, in order to keep each message short enough to
     guarantee it won't be split in the pipe. */
 
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     case 'X':
     if (addr == NULL) goto ADDR_MISMATCH;          /* Below, in 'A' handler */
     switch (*ptr++)
@@ -3015,17 +3043,17 @@ while (!done)
 	(void) tls_import_cert(ptr, &addr->ourcert);
       break;
 
-      #ifndef DISABLE_OCSP
+# ifndef DISABLE_OCSP
       case '4':
       addr->ocsp = OCSP_NOT_REQ;
       if (*ptr)
 	addr->ocsp = *ptr - '0';
       break;
-      #endif
+# endif
       }
     while (*ptr++);
     break;
-    #endif	/*SUPPORT_TLS*/
+#endif	/*SUPPORT_TLS*/
 
     case 'C':	/* client authenticator information */
     switch (*ptr++)
@@ -3049,14 +3077,14 @@ while (!done)
     break;
 #endif
 
-    #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
     case 'D':
     if (addr == NULL) break;
     memcpy(&(addr->dsn_aware), ptr, sizeof(addr->dsn_aware));
     ptr += sizeof(addr->dsn_aware);
     DEBUG(D_deliver) debug_printf("DSN read: addr->dsn_aware = %d\n", addr->dsn_aware);
     break;
-    #endif
+#endif
 
     case 'A':
     if (addr == NULL)
@@ -3954,11 +3982,11 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
     that it can use either of them, though it prefers O_NONBLOCK, which
     distinguishes between EOF and no-more-data. */
 
-    #ifdef O_NONBLOCK
+#ifdef O_NONBLOCK
     (void)fcntl(pfd[pipe_read], F_SETFL, O_NONBLOCK);
-    #else
+#else
     (void)fcntl(pfd[pipe_read], F_SETFL, O_NDELAY);
-    #endif
+#endif
 
     /* If the maximum number of subprocesses already exist, wait for a process
     to finish. If we ran out of file descriptors, parmax will have been reduced
@@ -4127,7 +4155,7 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
       if (tls_out.certificate_verified) setflag(addr, af_cert_verified);
 
       /* Use an X item only if there's something to send */
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       if (addr->cipher)
         {
         ptr = big_buffer;
@@ -4163,7 +4191,7 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
 	  *ptr++ = 0;
         rmt_dlv_checked_write(fd, big_buffer, ptr - big_buffer);
 	}
-      #ifndef DISABLE_OCSP
+# ifndef DISABLE_OCSP
       if (addr->ocsp > OCSP_NOT_REQ)
 	{
 	ptr = big_buffer;
@@ -4171,8 +4199,8 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
 	while(*ptr++);
         rmt_dlv_checked_write(fd, big_buffer, ptr - big_buffer);
 	}
-      # endif
-      #endif	/*SUPPORT_TLS*/
+# endif
+#endif	/*SUPPORT_TLS*/
 
       if (client_authenticator)
         {
@@ -4196,17 +4224,17 @@ for (delivery_count = 0; addr_remote != NULL; delivery_count++)
         rmt_dlv_checked_write(fd, big_buffer, ptr - big_buffer);
 	}
 
-      #ifndef DISABLE_PRDR
+#ifndef DISABLE_PRDR
       if (addr->flags & af_prdr_used)
 	rmt_dlv_checked_write(fd, "P", 1);
-      #endif
+#endif
 
-      #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
       big_buffer[0] = 'D';
       memcpy(big_buffer+1, &addr->dsn_aware, sizeof(addr->dsn_aware));
       rmt_dlv_checked_write(fd, big_buffer, sizeof(addr->dsn_aware) + 1);
       DEBUG(D_deliver) debug_printf("DSN write: addr->dsn_aware = %d\n", addr->dsn_aware);
-      #endif
+#endif
 
       /* Retry information: for most success cases this will be null. */
 
@@ -4921,7 +4949,7 @@ attempted. */
 
 if (deliver_freeze)
   {
-  #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
   /* Moving to another directory removes the message from Exim's view. Other
   tools must be used to deal with it. Logging of this action happens in
   spool_move_message() and its subfunctions. */
@@ -4929,7 +4957,7 @@ if (deliver_freeze)
   if (move_frozen_messages &&
       spool_move_message(id, message_subdir, US"", US"F"))
     return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
-  #endif
+#endif
 
   /* For all frozen messages (bounces or not), timeout_frozen_after sets the
   maximum time to keep messages that are frozen. Thaw if we reach it, with a
@@ -5358,13 +5386,13 @@ if (process_recipients != RECIP_IGNORE)
       if (r->pno >= 0)
         new->onetime_parent = recipients_list[r->pno].address;
 
-      #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
       /* If DSN support is enabled, set the dsn flags and the original receipt 
          to be passed on to other DSN enabled MTAs */
       new->dsn_flags = r->dsn_flags & rf_dsnflags;
       new->dsn_orcpt = r->orcpt;
       DEBUG(D_deliver) debug_printf("DSN: set orcpt: %s  flags: %d\n", new->dsn_orcpt, new->dsn_flags);
-      #endif
+#endif
 
       switch (process_recipients)
         {
@@ -6300,21 +6328,21 @@ if (addr_remote != NULL)
     regex_must_compile(US"\\n250[\\s\\-]AUTH\\s+([\\-\\w\\s]+)(?:\\n|$)",
       FALSE, TRUE);
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   if (regex_STARTTLS == NULL) regex_STARTTLS =
     regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
-  #endif
+#endif
 
-  #ifndef DISABLE_PRDR
+#ifndef DISABLE_PRDR
   if (regex_PRDR == NULL) regex_PRDR =
     regex_must_compile(US"\\n250[\\s\\-]PRDR(\\s|\\n|$)", FALSE, TRUE);
-  #endif
+#endif
 
-  #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
   /* Set the regex to check for DSN support on remote MTA */
   if (regex_DSN == NULL) regex_DSN  =
     regex_must_compile(US"\\n250[\\s\\-]DSN(\\s|\\n|$)", FALSE, TRUE);
-  #endif
+#endif
 
   /* Now sort the addresses if required, and do the deliveries. The yield of
   do_remote_deliveries is FALSE when mua_wrapper is set and all addresses
@@ -7653,10 +7681,10 @@ if (remove_journal)
 
   /* Move the message off the spool if reqested */
 
-  #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
   if (deliver_freeze && move_frozen_messages)
     (void)spool_move_message(id, message_subdir, US"", US"F");
-  #endif
+#endif
   }
 
 /* Closing the data file frees the lock; if the file has been unlinked it
diff --git a/src/src/expand.c b/src/src/expand.c
index e3e1c7833..f6b70cb47 100644
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -501,6 +501,7 @@ static var_entry var_table[] = {
   { "host_data",           vtype_stringptr,   &host_data },
   { "host_lookup_deferred",vtype_int,         &host_lookup_deferred },
   { "host_lookup_failed",  vtype_int,         &host_lookup_failed },
+  { "host_port",           vtype_int,         &deliver_host_port },
   { "inode",               vtype_ino,         &deliver_inode },
   { "interface_address",   vtype_stringptr,   &interface_address },
   { "interface_port",      vtype_int,         &interface_port },
@@ -706,14 +707,12 @@ static var_entry var_table[] = {
   { "tod_zone",            vtype_todzone,     NULL },
   { "tod_zulu",            vtype_todzulu,     NULL },
 #ifdef EXPERIMENTAL_TPDA
+  { "tpda_data",           vtype_stringptr,   &tpda_data },
+
+  /*XXX want to use generic vars for as many of these as possible*/
   { "tpda_defer_errno",     vtype_int,         &tpda_defer_errno },
-  { "tpda_defer_errstr",    vtype_stringptr,   &tpda_defer_errstr },
-  { "tpda_delivery_confirmation", vtype_stringptr,   &tpda_delivery_confirmation },
-  { "tpda_delivery_domain", vtype_stringptr,   &tpda_delivery_domain },
-  { "tpda_delivery_fqdn",   vtype_stringptr,   &tpda_delivery_fqdn },
-  { "tpda_delivery_ip",     vtype_stringptr,   &tpda_delivery_ip },
-  { "tpda_delivery_local_part",vtype_stringptr,&tpda_delivery_local_part },
-  { "tpda_delivery_port",   vtype_int,         &tpda_delivery_port },
+
+  { "tpda_event",          vtype_stringptr,   &tpda_event },
 #endif
   { "transport_name",      vtype_stringptr,   &transport_name },
   { "value",               vtype_stringptr,   &lookup_value },
diff --git a/src/src/functions.h b/src/src/functions.h
index a6257a913..fee4429a5 100644
--- a/src/src/functions.h
+++ b/src/src/functions.h
@@ -44,7 +44,7 @@ extern uschar * tls_cert_fprt_sha1(void *);
 extern uschar * tls_cert_fprt_sha256(void *);
 
 extern int     tls_client_start(int, host_item *, address_item *,
-		 void *);
+		 transport_instance *);
 extern void    tls_close(BOOL, BOOL);
 extern int     tls_export_cert(uschar *, size_t, void *);
 extern int     tls_feof(void);
@@ -337,7 +337,11 @@ extern int     sieve_interpret(uschar *, int, uschar *, uschar *, uschar *,
 extern void    sigalrm_handler(int);
 extern BOOL    smtp_buffered(void);
 extern void    smtp_closedown(uschar *);
-extern int     smtp_connect(host_item *, int, int, uschar *, int, BOOL, const uschar *);
+extern int     smtp_connect(host_item *, int, int, uschar *, int, BOOL, const uschar *
+#ifdef EXPERIMENTAL_TPDA
+		       , uschar *
+#endif
+		       );
 extern int     smtp_feof(void);
 extern int     smtp_ferror(void);
 extern uschar *smtp_get_connection_info(void);
diff --git a/src/src/globals.c b/src/src/globals.c
index d3f99877c..f1b771ad3 100644
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -577,6 +577,7 @@ time_t  deliver_frozen_at      = 0;
 uschar *deliver_home           = NULL;
 uschar *deliver_host           = NULL;
 uschar *deliver_host_address   = NULL;
+int     deliver_host_port      = 0;
 uschar *deliver_in_buffer      = NULL;
 ino_t   deliver_inode          = 0;
 uschar *deliver_localpart      = NULL;
@@ -1326,13 +1327,8 @@ BOOL    timestamps_utc         = FALSE;
 
 #ifdef EXPERIMENTAL_TPDA
 int     tpda_defer_errno        = 0;
-uschar *tpda_defer_errstr       = NULL;
-uschar *tpda_delivery_ip        = NULL;
-int     tpda_delivery_port      = 0;
-uschar *tpda_delivery_fqdn      = NULL;
-uschar *tpda_delivery_local_part= NULL;
-uschar *tpda_delivery_domain    = NULL;
-uschar *tpda_delivery_confirmation = NULL;
+uschar *tpda_event              = NULL;
+uschar *tpda_data               = NULL;
 #endif
 
 transport_instance  *transports = NULL;
diff --git a/src/src/globals.h b/src/src/globals.h
index 2bedcf523..f0a3091df 100644
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -328,6 +328,7 @@ extern uschar *deliver_home;           /* Home directory for pipes */
 extern uschar *deliver_host;           /* (First) host for routed local deliveries */
                                        /* Remote host for filter */
 extern uschar *deliver_host_address;   /* Address for remote delivery filter */
+extern int     deliver_host_port;      /* Address for remote delivery filter */
 extern uschar *deliver_in_buffer;      /* Buffer for copying file */
 extern ino_t   deliver_inode;          /* Inode for appendfile */
 extern uschar *deliver_localpart;      /* The local part for delivery */
@@ -870,13 +871,8 @@ extern BOOL    timestamps_utc;         /* Use UTC for all times */
 
 #ifdef EXPERIMENTAL_TPDA
 extern int     tpda_defer_errno;        /* error number set when a remote delivery is deferred with a host error */
-extern uschar *tpda_defer_errstr;       /* error string set when a remote delivery is deferred with a host error */
-extern uschar *tpda_delivery_ip;        /* IP of host, which has accepted delivery */
-extern int     tpda_delivery_port;       /* port of host, which has accepted delivery */
-extern uschar *tpda_delivery_fqdn;      /* FQDN of host, which has accepted delivery */
-extern uschar *tpda_delivery_local_part;/* local part of address being delivered */
-extern uschar *tpda_delivery_domain;    /* domain part of address being delivered */
-extern uschar *tpda_delivery_confirmation; /* SMTP confirmation message */
+extern uschar *tpda_event;		/* event classification */
+extern uschar *tpda_data;;		/* event data */
 #endif
 
 extern uschar *transport_name;         /* Name of transport last started */
diff --git a/src/src/smtp_out.c b/src/src/smtp_out.c
index b6ff51108..4920b7371 100644
--- a/src/src/smtp_out.c
+++ b/src/src/smtp_out.c
@@ -165,13 +165,18 @@ Arguments:
   timeout     timeout value or 0
   keepalive   TRUE to use keepalive
   dscp        DSCP value to assign to socket
+  tpda_event  event expansion
 
 Returns:      connected socket number, or -1 with errno set
 */
 
 int
 smtp_connect(host_item *host, int host_af, int port, uschar *interface,
-  int timeout, BOOL keepalive, const uschar *dscp)
+  int timeout, BOOL keepalive, const uschar *dscp
+#ifdef EXPERIMENTAL_TPDA
+  , uschar * tpda_event
+#endif
+  )
 {
 int on = 1;
 int save_errno = 0;
@@ -198,6 +203,13 @@ HDEBUG(D_transport|D_acl|D_v)
       host->address, port, interface);
   }
 
+#ifdef EXPERIMENTAL_TPDA
+  /*XXX Called from both delivery and verify.  Is that status observable? */
+  deliver_host_address = host->address;
+  deliver_host_port = port;
+  if (tpda_raise_event(tpda_event, US"tcp:connect", NULL) == DEFER) return -1;
+#endif
+
 /* Create the socket */
 
 if ((sock = ip_socket(SOCK_STREAM, host_af)) < 0) return -1;
diff --git a/src/src/structs.h b/src/src/structs.h
index 71ac5d8e3..80c23fb0a 100644
--- a/src/src/structs.h
+++ b/src/src/structs.h
@@ -188,7 +188,7 @@ typedef struct transport_instance {
   BOOL    log_defer_output;
   BOOL    retry_use_local_part;   /* Defaults true for local, false for remote */
 #ifdef EXPERIMENTAL_TPDA
-  uschar  *tpda_delivery_action;  /* String to expand on success */
+  uschar  *tpda_event_action;     /* String to expand on notable events */
 #endif
 } transport_instance;
 
diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 266ab8909..b7eae1793 100644
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -47,6 +47,10 @@ require current GnuTLS, then we'll drop support for the ancient libraries).
 # warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
 # define DISABLE_OCSP
 #endif
+#if GNUTLS_VERSION_NUMBER < 0x020a00 && defined(EXPERIMENTAL_TPDA)
+# warning "GnuTLS library version too old; TPDA tls:cert event unsupported"
+# undef EXPERIMENTAL_TPDA
+#endif
 
 #ifndef DISABLE_OCSP
 # include <gnutls/ocsp.h>
@@ -115,6 +119,9 @@ typedef struct exim_gnutls_state {
 #ifdef EXPERIMENTAL_CERTNAMES
   uschar *exp_tls_verify_cert_hostnames;
 #endif
+#ifdef EXPERIMENTAL_TPDA
+  uschar *event_action;
+#endif
 
   tls_support *tlsp;	/* set in tls_init() */
 
@@ -132,6 +139,9 @@ static const exim_gnutls_state_st exim_gnutls_state_init = {
   NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 #ifdef EXPERIMENTAL_CERTNAMES
                                             NULL,
+#endif
+#ifdef EXPERIMENTAL_TPDA
+                                            NULL,
 #endif
   NULL,
   NULL, 0, 0, 0, 0,
@@ -144,7 +154,9 @@ context we're currently dealing with" pointer and rely upon being
 single-threaded to keep from processing data on an inbound TLS connection while
 talking to another TLS connection for an outbound check.  This does mean that
 there's no way for heart-beats to be responded to, for the duration of the
-second connection. */
+second connection.
+XXX But see gnutls_session_get_ptr()
+*/
 
 static exim_gnutls_state_st state_server, state_client;
 
@@ -174,18 +186,18 @@ static BOOL exim_gnutls_base_init_done = FALSE;
 the library logging; a value less than 0 disables the calls to set up logging
 callbacks. */
 #ifndef EXIM_GNUTLS_LIBRARY_LOG_LEVEL
-#define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
+# define EXIM_GNUTLS_LIBRARY_LOG_LEVEL -1
 #endif
 
 #ifndef EXIM_CLIENT_DH_MIN_BITS
-#define EXIM_CLIENT_DH_MIN_BITS 1024
+# define EXIM_CLIENT_DH_MIN_BITS 1024
 #endif
 
 /* With GnuTLS 2.12.x+ we have gnutls_sec_param_to_pk_bits() with which we
 can ask for a bit-strength.  Without that, we stick to the constant we had
 before, for now. */
 #ifndef EXIM_SERVER_DH_BITS_PRE2_12
-#define EXIM_SERVER_DH_BITS_PRE2_12 1024
+# define EXIM_SERVER_DH_BITS_PRE2_12 1024
 #endif
 
 #define exim_gnutls_err_check(Label) do { \
@@ -1512,6 +1524,52 @@ return 0;
 #endif
 
 
+#ifdef EXPERIMENTAL_TPDA
+/*
+We use this callback to get observability and detail-level control
+for an exim client TLS connection, raising a TPDA tls:cert event
+for each cert in the chain presented by the server.  Any event
+can deny verification.
+
+Return 0 for the handshake to continue or non-zero to terminate.
+*/
+
+static int
+client_verify_cb(gnutls_session_t session)
+{
+const gnutls_datum * cert_list;
+unsigned int cert_list_size = 0;
+gnutls_x509_crt_t crt;
+int rc;
+exim_gnutls_state_st * state = gnutls_session_get_ptr(session);
+
+cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
+if (cert_list)
+  while (cert_list_size--)
+  {
+  rc = import_cert(&cert_list[cert_list_size], &crt);
+  if (rc != GNUTLS_E_SUCCESS)
+    {
+    DEBUG(D_tls) debug_printf("TLS: peer cert problem: depth %d: %s\n",
+      cert_list_size, gnutls_strerror(rc));
+    break;
+    }
+
+  state->tlsp->peercert = crt;
+  if (tpda_raise_event(state->event_action,
+	      US"tls:cert", string_sprintf("%d", cert_list_size)) == DEFER)
+    {
+    log_write(0, LOG_MAIN,
+	      "SSL verify denied by event-action: depth=%d", cert_list_size);
+    return 1;                     /* reject */
+    }
+  state->tlsp->peercert = NULL;
+  }
+
+return 0;
+}
+
+#endif
 
 
 
@@ -1694,7 +1752,7 @@ Arguments:
   fd                the fd of the connection
   host              connected host (for messages)
   addr              the first address (not used)
-  ob                smtp transport options
+  tb                transport (always smtp)
 
 Returns:            OK/DEFER/FAIL (because using common functions),
                     but for a client, DEFER and FAIL have the same meaning
@@ -1703,9 +1761,10 @@ Returns:            OK/DEFER/FAIL (because using common functions),
 int
 tls_client_start(int fd, host_item *host,
     address_item *addr ARG_UNUSED,
-    void *v_ob)
+    transport_instance *tb)
 {
-smtp_transport_options_block *ob = v_ob;
+smtp_transport_options_block *ob =
+  (smtp_transport_options_block *)tb->options_block;
 int rc;
 const char *error;
 exim_gnutls_state_st *state = NULL;
@@ -1804,6 +1863,15 @@ if (request_ocsp)
   }
 #endif
 
+#ifdef EXPERIMENTAL_TPDA
+if (tb->tpda_event_action)
+  {
+  state->event_action = tb->tpda_event_action;
+  gnutls_session_set_ptr(state->session, state);
+  gnutls_certificate_set_verify_function(state->x509_cred, client_verify_cb);
+  }
+#endif
+
 gnutls_transport_set_ptr(state->session, (gnutls_transport_ptr)(long) fd);
 state->fd_in = fd;
 state->fd_out = fd;
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index e562a8926..c031b8e4d 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -116,6 +116,9 @@ typedef struct tls_ext_ctx_cb {
 #ifdef EXPERIMENTAL_CERTNAMES
   uschar * verify_cert_hostnames;
 #endif
+#ifdef EXPERIMENTAL_TPDA
+  uschar * event_action;
+#endif
 } tls_ext_ctx_cb;
 
 /* should figure out a cleanup of API to handle state preserved per
@@ -262,6 +265,9 @@ when asked. We get here only if a certificate has been received. Handling of
 optional verification for this case is done when requesting SSL to verify, by
 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
 
+May be called multiple times for different issues with a certificate, even
+for a given "depth" in the certificate chain.
+
 Arguments:
   state      current yes/no state as 1/0
   x509ctx    certificate information.
@@ -275,6 +281,7 @@ verify_callback(int state, X509_STORE_CTX *x509ctx,
   tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
 {
 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
+int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 static uschar txt[256];
 
 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
@@ -282,7 +289,7 @@ X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 if (state == 0)
   {
   log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
-    X509_STORE_CTX_get_error_depth(x509ctx),
+    depth,
     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
     txt);
   tlsp->certificate_verified = FALSE;
@@ -296,10 +303,9 @@ if (state == 0)
     "tls_try_verify_hosts)\n");
   }
 
-else if (X509_STORE_CTX_get_error_depth(x509ctx) != 0)
+else if (depth != 0)
   {
-  DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n",
-     X509_STORE_CTX_get_error_depth(x509ctx), txt);
+  DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, txt);
 #ifndef DISABLE_OCSP
   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
     {	/* client, wanting stapling  */
@@ -310,6 +316,23 @@ else if (X509_STORE_CTX_get_error_depth(x509ctx) != 0)
                              cert))
       ERR_clear_error();
     }
+#endif
+#ifdef EXPERIMENTAL_TPDA
+  if (tlsp == &tls_out && client_static_cbinfo->event_action)
+    {
+    tlsp->peercert = X509_dup(cert);
+    if (tpda_raise_event(client_static_cbinfo->event_action,
+		    US"tls:cert", string_sprintf("%d", depth)) == DEFER)
+      {
+      log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
+			      "depth=%d cert=%s", depth, txt);
+      tlsp->certificate_verified = FALSE;
+      *calledp = TRUE;
+      return 0;			    /* reject */
+      }
+    X509_free(tlsp->peercert);
+    tlsp->peercert = NULL;
+    }
 #endif
   }
 else
@@ -361,6 +384,21 @@ else
       return 0;				/* reject */
       }
 # endif
+#endif	/*EXPERIMENTAL_CERTNAMES*/
+
+#ifdef EXPERIMENTAL_TPDA
+  if (tlsp == &tls_out)
+    {
+    if (tpda_raise_event(client_static_cbinfo->event_action,
+		    US"tls:cert", US"0") == DEFER)
+      {
+      log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
+			      "depth=0 cert=%s", txt);
+      tlsp->certificate_verified = FALSE;
+      *calledp = TRUE;
+      return 0;			    /* reject */
+      }
+    }
 #endif
 
   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
@@ -369,7 +407,7 @@ else
   *calledp = TRUE;
   }
 
-return 1;   /* accept */
+return 1;   /* accept, at least for this level */
 }
 
 static int
@@ -1032,7 +1070,7 @@ tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
 long init_options;
 int rc;
 BOOL okay;
-tls_ext_ctx_cb *cbinfo;
+tls_ext_ctx_cb * cbinfo;
 
 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
 cbinfo->certificate = certificate;
@@ -1050,6 +1088,9 @@ else
 cbinfo->dhparam = dhparam;
 cbinfo->server_cipher_list = NULL;
 cbinfo->host = host;
+#ifdef EXPERIMENTAL_TPDA
+cbinfo->event_action = NULL;
+#endif
 
 SSL_load_error_strings();          /* basic set up */
 OpenSSL_add_ssl_algorithms();
@@ -1546,7 +1587,7 @@ Argument:
   fd               the fd of the connection
   host             connected host (for messages)
   addr             the first address
-  ob               smtp transport options
+  tb               transport (always smtp)
 
 Returns:           OK on success
                    FAIL otherwise - note that tls_error() will not give DEFER
@@ -1555,9 +1596,10 @@ Returns:           OK on success
 
 int
 tls_client_start(int fd, host_item *host, address_item *addr,
-  void *v_ob)
+  transport_instance *tb)
 {
-smtp_transport_options_block * ob = v_ob;
+smtp_transport_options_block * ob =
+  (smtp_transport_options_block *)tb->options_block;
 static uschar txt[256];
 uschar *expciphers;
 X509* server_cert;
@@ -1672,6 +1714,10 @@ if (request_ocsp)
   }
 #endif
 
+#ifdef EXPERIMENTAL_TPDA
+client_static_cbinfo->event_action = tb->tpda_event_action;
+#endif
+
 /* There doesn't seem to be a built-in timeout on connection. */
 
 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
diff --git a/src/src/transport.c b/src/src/transport.c
index 3648bfc82..31437b146 100644
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -95,8 +95,8 @@ optionlist optionlist_transports[] = {
   { "shadow_transport", opt_stringptr|opt_public,
                  (void *)offsetof(transport_instance, shadow) },
 #ifdef EXPERIMENTAL_TPDA
-  { "tpda_delivery_action",opt_stringptr | opt_public,
-                 (void *)offsetof(transport_instance, tpda_delivery_action) },
+  { "tpda_event_action",opt_stringptr | opt_public,
+                 (void *)offsetof(transport_instance, tpda_event_action) },
 #endif
   { "transport_filter", opt_stringptr|opt_public,
                  (void *)offsetof(transport_instance, filter_command) },
diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 40eebe8b6..0dfa01958 100644
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -172,10 +172,6 @@ optionlist smtp_transport_options[] = {
   { "tls_verify_hosts",     opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, tls_verify_hosts) }
 #endif
-#ifdef EXPERIMENTAL_TPDA
- ,{ "tpda_host_defer_action", opt_stringptr,
-      (void *)offsetof(smtp_transport_options_block, tpda_host_defer_action) },
-#endif
 };
 
 /* Size of the options list. An extern variable has to be used so that its
@@ -261,9 +257,6 @@ smtp_transport_options_block smtp_transport_option_defaults = {
   NULL,                /* dkim_sign_headers */
   NULL                 /* dkim_strict */
 #endif
-#ifdef EXPERIMENTAL_TPDA
- ,NULL                 /* tpda_host_defer_action */
-#endif
 };
 
 #ifdef EXPERIMENTAL_DSN
@@ -485,7 +478,8 @@ Arguments:
 Returns:         TRUE if an SMTP "QUIT" command should be sent, else FALSE
 */
 
-static BOOL check_response(host_item *host, int *errno_value, int more_errno,
+static BOOL
+check_response(host_item *host, int *errno_value, int more_errno,
   uschar *buffer, int *yield, uschar **message, BOOL *pass_message)
 {
 uschar *pl = US"";
@@ -636,7 +630,6 @@ else
    It might, for example, be used to write to the database log.
 
 Arguments:
-  ob                    transport options block
   addr                  the address item containing error information
   host                  the current host
 
@@ -644,36 +637,39 @@ Returns:   nothing
 */
 
 static void
-tpda_deferred(smtp_transport_options_block *ob, address_item *addr, host_item *host)
+tpda_deferred(address_item *addr, host_item *host)
 {
-uschar *action = ob->tpda_host_defer_action;
+uschar * action = addr->transport->tpda_event_action;
+uschar * save_domain;
+uschar * save_local;
+
 if (!action)
-	return;
-
-tpda_delivery_ip =         string_copy(host->address);
-tpda_delivery_port =       (host->port == PORT_NONE)? 25 : host->port;
-tpda_delivery_fqdn =       string_copy(host->name);
-tpda_delivery_local_part = string_copy(addr->local_part);
-tpda_delivery_domain =     string_copy(addr->domain);
-tpda_defer_errno =         addr->basic_errno;
-
-tpda_defer_errstr = addr->message
-  ? addr->basic_errno > 0
-    ? string_sprintf("%s: %s", addr->message, strerror(addr->basic_errno))
-    : string_copy(addr->message)
-  : addr->basic_errno > 0
-    ? string_copy(US strerror(addr->basic_errno))
-    : NULL;
+  return;
 
-DEBUG(D_transport)
-  debug_printf("  TPDA(host defer): tpda_host_defer_action=|%s| tpda_delivery_IP=%s\n",
-    action, tpda_delivery_ip);
+save_domain = deliver_domain;
+save_local = deliver_localpart;
+
+/*XXX would ip & port already be set up? */
+deliver_host_address = string_copy(host->address);
+deliver_host_port =    (host->port == PORT_NONE)? 25 : host->port;
+tpda_defer_errno =     addr->basic_errno;
 
 router_name =    addr->router->name;
 transport_name = addr->transport->name;
-if (!expand_string(action) && *expand_string_message)
-  log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand tpda_defer_action in %s: %s\n",
-    transport_name, expand_string_message);
+deliver_domain = addr->domain;
+deliver_localpart = addr->local_part;
+
+(void) tpda_raise_event(action, US"msg:host:defer",
+    addr->message
+      ? addr->basic_errno > 0
+	? string_sprintf("%s: %s", addr->message, strerror(addr->basic_errno))
+	: string_copy(addr->message)
+      : addr->basic_errno > 0
+	? string_copy(US strerror(addr->basic_errno))
+	: NULL);
+
+deliver_localpart = save_local;
+deliver_domain =    save_domain;
 router_name = transport_name = NULL;
 }
 #endif
@@ -940,147 +936,147 @@ smtp_auth(uschar *buffer, unsigned bufsize, address_item *addrlist, host_item *h
     smtp_transport_options_block *ob, BOOL is_esmtp,
     smtp_inblock *ibp, smtp_outblock *obp)
 {
-  int require_auth;
-  uschar *fail_reason = US"server did not advertise AUTH support";
+int require_auth;
+uschar *fail_reason = US"server did not advertise AUTH support";
 
-  smtp_authenticated = FALSE;
-  client_authenticator = client_authenticated_id = client_authenticated_sender = NULL;
-  require_auth = verify_check_this_host(&(ob->hosts_require_auth), NULL,
-    host->name, host->address, NULL);
+smtp_authenticated = FALSE;
+client_authenticator = client_authenticated_id = client_authenticated_sender = NULL;
+require_auth = verify_check_this_host(&(ob->hosts_require_auth), NULL,
+  host->name, host->address, NULL);
 
-  if (is_esmtp && !regex_AUTH) regex_AUTH =
-      regex_must_compile(US"\\n250[\\s\\-]AUTH\\s+([\\-\\w\\s]+)(?:\\n|$)",
-            FALSE, TRUE);
+if (is_esmtp && !regex_AUTH) regex_AUTH =
+    regex_must_compile(US"\\n250[\\s\\-]AUTH\\s+([\\-\\w\\s]+)(?:\\n|$)",
+	  FALSE, TRUE);
 
-  if (is_esmtp && regex_match_and_setup(regex_AUTH, buffer, 0, -1))
-    {
-    uschar *names = string_copyn(expand_nstring[1], expand_nlength[1]);
-    expand_nmax = -1;                          /* reset */
+if (is_esmtp && regex_match_and_setup(regex_AUTH, buffer, 0, -1))
+  {
+  uschar *names = string_copyn(expand_nstring[1], expand_nlength[1]);
+  expand_nmax = -1;                          /* reset */
 
-    /* Must not do this check until after we have saved the result of the
-    regex match above. */
+  /* Must not do this check until after we have saved the result of the
+  regex match above. */
 
-    if (require_auth == OK ||
-        verify_check_this_host(&(ob->hosts_try_auth), NULL, host->name,
-          host->address, NULL) == OK)
-      {
-      auth_instance *au;
-      fail_reason = US"no common mechanisms were found";
+  if (require_auth == OK ||
+      verify_check_this_host(&(ob->hosts_try_auth), NULL, host->name,
+	host->address, NULL) == OK)
+    {
+    auth_instance *au;
+    fail_reason = US"no common mechanisms were found";
 
-      DEBUG(D_transport) debug_printf("scanning authentication mechanisms\n");
+    DEBUG(D_transport) debug_printf("scanning authentication mechanisms\n");
 
-      /* Scan the configured authenticators looking for one which is configured
-      for use as a client, which is not suppressed by client_condition, and
-      whose name matches an authentication mechanism supported by the server.
-      If one is found, attempt to authenticate by calling its client function.
-      */
+    /* Scan the configured authenticators looking for one which is configured
+    for use as a client, which is not suppressed by client_condition, and
+    whose name matches an authentication mechanism supported by the server.
+    If one is found, attempt to authenticate by calling its client function.
+    */
 
-      for (au = auths; !smtp_authenticated && au != NULL; au = au->next)
-        {
-        uschar *p = names;
-        if (!au->client ||
-            (au->client_condition != NULL &&
-             !expand_check_condition(au->client_condition, au->name,
-               US"client authenticator")))
-          {
-          DEBUG(D_transport) debug_printf("skipping %s authenticator: %s\n",
-            au->name,
-            (au->client)? "client_condition is false" :
-                          "not configured as a client");
-          continue;
-          }
+    for (au = auths; !smtp_authenticated && au != NULL; au = au->next)
+      {
+      uschar *p = names;
+      if (!au->client ||
+	  (au->client_condition != NULL &&
+	   !expand_check_condition(au->client_condition, au->name,
+	     US"client authenticator")))
+	{
+	DEBUG(D_transport) debug_printf("skipping %s authenticator: %s\n",
+	  au->name,
+	  (au->client)? "client_condition is false" :
+			"not configured as a client");
+	continue;
+	}
 
-        /* Loop to scan supported server mechanisms */
+      /* Loop to scan supported server mechanisms */
 
-        while (*p != 0)
-          {
-          int rc;
-          int len = Ustrlen(au->public_name);
-          while (isspace(*p)) p++;
+      while (*p != 0)
+	{
+	int rc;
+	int len = Ustrlen(au->public_name);
+	while (isspace(*p)) p++;
 
-          if (strncmpic(au->public_name, p, len) != 0 ||
-              (p[len] != 0 && !isspace(p[len])))
-            {
-            while (*p != 0 && !isspace(*p)) p++;
-            continue;
-            }
+	if (strncmpic(au->public_name, p, len) != 0 ||
+	    (p[len] != 0 && !isspace(p[len])))
+	  {
+	  while (*p != 0 && !isspace(*p)) p++;
+	  continue;
+	  }
 
-          /* Found data for a listed mechanism. Call its client entry. Set
-          a flag in the outblock so that data is overwritten after sending so
-          that reflections don't show it. */
+	/* Found data for a listed mechanism. Call its client entry. Set
+	a flag in the outblock so that data is overwritten after sending so
+	that reflections don't show it. */
 
-          fail_reason = US"authentication attempt(s) failed";
-          obp->authenticating = TRUE;
-          rc = (au->info->clientcode)(au, ibp, obp,
-            ob->command_timeout, buffer, bufsize);
-          obp->authenticating = FALSE;
-          DEBUG(D_transport) debug_printf("%s authenticator yielded %d\n",
-            au->name, rc);
+	fail_reason = US"authentication attempt(s) failed";
+	obp->authenticating = TRUE;
+	rc = (au->info->clientcode)(au, ibp, obp,
+	  ob->command_timeout, buffer, bufsize);
+	obp->authenticating = FALSE;
+	DEBUG(D_transport) debug_printf("%s authenticator yielded %d\n",
+	  au->name, rc);
 
-          /* A temporary authentication failure must hold up delivery to
-          this host. After a permanent authentication failure, we carry on
-          to try other authentication methods. If all fail hard, try to
-          deliver the message unauthenticated unless require_auth was set. */
+	/* A temporary authentication failure must hold up delivery to
+	this host. After a permanent authentication failure, we carry on
+	to try other authentication methods. If all fail hard, try to
+	deliver the message unauthenticated unless require_auth was set. */
 
-          switch(rc)
-            {
-            case OK:
-            smtp_authenticated = TRUE;   /* stops the outer loop */
-	    client_authenticator = au->name;
-	    if (au->set_client_id != NULL)
-	      client_authenticated_id = expand_string(au->set_client_id);
-            break;
-
-            /* Failure after writing a command */
-
-            case FAIL_SEND:
-            return FAIL_SEND;
-
-            /* Failure after reading a response */
-
-            case FAIL:
-            if (errno != 0 || buffer[0] != '5') return FAIL;
-            log_write(0, LOG_MAIN, "%s authenticator failed H=%s [%s] %s",
-              au->name, host->name, host->address, buffer);
-            break;
-
-            /* Failure by some other means. In effect, the authenticator
-            decided it wasn't prepared to handle this case. Typically this
-            is the result of "fail" in an expansion string. Do we need to
-            log anything here? Feb 2006: a message is now put in the buffer
-            if logging is required. */
-
-            case CANCELLED:
-            if (*buffer != 0)
-              log_write(0, LOG_MAIN, "%s authenticator cancelled "
-                "authentication H=%s [%s] %s", au->name, host->name,
-                host->address, buffer);
-            break;
-
-            /* Internal problem, message in buffer. */
-
-            case ERROR:
-            set_errno(addrlist, 0, string_copy(buffer), DEFER, FALSE);
-            return ERROR;
-            }
+	switch(rc)
+	  {
+	  case OK:
+	  smtp_authenticated = TRUE;   /* stops the outer loop */
+	  client_authenticator = au->name;
+	  if (au->set_client_id != NULL)
+	    client_authenticated_id = expand_string(au->set_client_id);
+	  break;
+
+	  /* Failure after writing a command */
+
+	  case FAIL_SEND:
+	  return FAIL_SEND;
+
+	  /* Failure after reading a response */
+
+	  case FAIL:
+	  if (errno != 0 || buffer[0] != '5') return FAIL;
+	  log_write(0, LOG_MAIN, "%s authenticator failed H=%s [%s] %s",
+	    au->name, host->name, host->address, buffer);
+	  break;
+
+	  /* Failure by some other means. In effect, the authenticator
+	  decided it wasn't prepared to handle this case. Typically this
+	  is the result of "fail" in an expansion string. Do we need to
+	  log anything here? Feb 2006: a message is now put in the buffer
+	  if logging is required. */
+
+	  case CANCELLED:
+	  if (*buffer != 0)
+	    log_write(0, LOG_MAIN, "%s authenticator cancelled "
+	      "authentication H=%s [%s] %s", au->name, host->name,
+	      host->address, buffer);
+	  break;
+
+	  /* Internal problem, message in buffer. */
+
+	  case ERROR:
+	  set_errno(addrlist, 0, string_copy(buffer), DEFER, FALSE);
+	  return ERROR;
+	  }
 
-          break;  /* If not authenticated, try next authenticator */
-          }       /* Loop for scanning supported server mechanisms */
-        }         /* Loop for further authenticators */
-      }
+	break;  /* If not authenticated, try next authenticator */
+	}       /* Loop for scanning supported server mechanisms */
+      }         /* Loop for further authenticators */
     }
+  }
 
-  /* If we haven't authenticated, but are required to, give up. */
+/* If we haven't authenticated, but are required to, give up. */
 
-  if (require_auth == OK && !smtp_authenticated)
-    {
-    set_errno(addrlist, ERRNO_AUTHFAIL,
-      string_sprintf("authentication required but %s", fail_reason), DEFER,
-      FALSE);
-    return DEFER;
-    }
+if (require_auth == OK && !smtp_authenticated)
+  {
+  set_errno(addrlist, ERRNO_AUTHFAIL,
+    string_sprintf("authentication required but %s", fail_reason), DEFER,
+    FALSE);
+  return DEFER;
+  }
 
-  return OK;
+return OK;
 }
 
 
@@ -1283,9 +1279,14 @@ specially so they can be identified for retries. */
 
 if (continue_hostname == NULL)
   {
+  /* This puts port into host->port */
   inblock.sock = outblock.sock =
     smtp_connect(host, host_af, port, interface, ob->connect_timeout,
-      ob->keepalive, ob->dscp);   /* This puts port into host->port */
+		  ob->keepalive, ob->dscp
+#ifdef EXPERIMENTAL_TPDA
+		  , tblock->tpda_event_action
+#endif
+		);
 
   if (inblock.sock < 0)
     {
@@ -1309,6 +1310,17 @@ if (continue_hostname == NULL)
     if (!smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
       ob->command_timeout)) goto RESPONSE_FAILED;
 
+#ifdef EXPERIMENTAL_TPDA
+    if (tpda_raise_event(tblock->tpda_event_action, US"smtp:connect", buffer)
+	== DEFER)
+	{
+	uschar *message = US"deferred by smtp:connect event expansion";
+	set_errno(addrlist, 0, message, DEFER, FALSE);
+	yield = DEFER;
+	goto SEND_QUIT;
+	}
+#endif
+
     /* Now check if the helo_data expansion went well, and sign off cleanly if
     it didn't. */
 
@@ -1363,7 +1375,7 @@ goto SEND_QUIT;
   /* Alas; be careful, since this goto is not an error-out, so conceivably
   we might set data between here and the target which we assume to exist
   and be usable.  I can see this coming back to bite us. */
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   if (smtps)
     {
     tls_offered = TRUE;
@@ -1372,7 +1384,7 @@ goto SEND_QUIT;
     smtp_command = US"SSL-on-connect";
     goto TLS_NEGOTIATE;
     }
-  #endif
+#endif
 
   if (esmtp)
     {
@@ -1409,13 +1421,13 @@ goto SEND_QUIT;
 
   /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   tls_offered = esmtp &&
     pcre_exec(regex_STARTTLS, NULL, CS buffer, Ustrlen(buffer), 0,
       PCRE_EOPT, NULL, 0) >= 0;
-  #endif
+#endif
 
-  #ifndef DISABLE_PRDR
+#ifndef DISABLE_PRDR
   prdr_offered = esmtp &&
     (pcre_exec(regex_PRDR, NULL, CS buffer, Ustrlen(buffer), 0,
       PCRE_EOPT, NULL, 0) >= 0) &&
@@ -1424,7 +1436,7 @@ goto SEND_QUIT;
 
   if (prdr_offered)
     {DEBUG(D_transport) debug_printf("PRDR usable\n");}
-  #endif
+#endif
   }
 
 /* For continuing deliveries down the same channel, the socket is the standard
@@ -1481,7 +1493,7 @@ if (tls_offered && !suppress_tls &&
   else
   TLS_NEGOTIATE:
     {
-    int rc = tls_client_start(inblock.sock, host, addrlist, ob);
+    int rc = tls_client_start(inblock.sock, host, addrlist, tblock);
 
     /* TLS negotiation failed; give an error. From outside, this function may
     be called again to try in clear on a new connection, if the options permit
@@ -1582,9 +1594,9 @@ continued session down a previously-used socket, we haven't just done EHLO, so
 we skip this. */
 
 if (continue_hostname == NULL
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     || tls_out.active >= 0
-    #endif
+#endif
     )
   {
   /* Set for IGNOREQUOTA if the response to LHLO specifies support and the
@@ -1721,12 +1733,11 @@ if (prdr_offered)
 	  {			/* at least two recipients to send */
 	  prdr_active = TRUE;
 	  sprintf(CS p, " PRDR"); p += 5;
-	  goto prdr_is_active;
+	  break;
 	  }
       break;
       }
   }
-prdr_is_active:
 #endif
 
 #ifdef EXPERIMENTAL_DSN
@@ -1769,7 +1780,10 @@ otherwise no check - this feature is expected to be used with LMTP and other
 cases where non-standard addresses (e.g. without domains) might be required. */
 
 if (smtp_mail_auth_str(p, sizeof(buffer) - (p-buffer), addrlist, ob))
-    return ERROR;
+  {
+  yield = ERROR;
+  goto SEND_QUIT;
+  }
 
 /* From here until we send the DATA command, we can make use of PIPELINING
 if the server host supports it. The code has to be able to check the responses
@@ -1823,25 +1837,22 @@ for (addr = first_addr;
   int count;
   BOOL no_flush;
 
-  #ifdef EXPERIMENTAL_DSN
-  if(smtp_use_dsn)
-    addr->dsn_aware = dsn_support_yes;
-  else
-    addr->dsn_aware = dsn_support_no;
-  #endif
+#ifdef EXPERIMENTAL_DSN
+  addr->dsn_aware = smtp_use_dsn ? dsn_support_yes : dsn_support_no;
+#endif
 
   if (addr->transport_return != PENDING_DEFER) continue;
 
   address_count++;
   no_flush = smtp_use_pipelining && (!mua_wrapper || addr->next != NULL);
 
-  #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
   /* Add any DSN flags to the rcpt command and add to the sent string */
 
   p = buffer;
   *p = 0;
 
-  if ((smtp_use_dsn) && ((addr->dsn_flags & rf_dsnlasthop) != 1))
+  if (smtp_use_dsn && (addr->dsn_flags & rf_dsnlasthop) != 1)
     {
     if ((addr->dsn_flags & rf_dsnflags) != 0)
       {
@@ -1850,7 +1861,6 @@ for (addr = first_addr;
       strcpy(p, " NOTIFY=");
       while (*p) p++;
       for (i = 0; i < 4; i++)
-        {
         if ((addr->dsn_flags & rf_list[i]) != 0)
           {
           if (!first) *p++ = ',';
@@ -1858,16 +1868,16 @@ for (addr = first_addr;
           strcpy(p, rf_names[i]);
           while (*p) p++;
           }
-        }
       }
 
-    if (addr->dsn_orcpt != NULL) {
+    if (addr->dsn_orcpt != NULL)
+      {
       string_format(p, sizeof(buffer) - (p-buffer), " ORCPT=%s",
         addr->dsn_orcpt);
       while (*p) p++;
       }
     }
-  #endif
+#endif
 
 
   /* Now send the RCPT command, and process outstanding responses when
@@ -1875,13 +1885,13 @@ for (addr = first_addr;
   yield as OK, because this error can often mean that there is a problem with
   just one address, so we don't want to delay the host. */
 
-  #ifdef EXPERIMENTAL_DSN
+#ifdef EXPERIMENTAL_DSN
   count = smtp_write_command(&outblock, no_flush, "RCPT TO:<%s>%s%s\r\n",
     transport_rcpt_address(addr, tblock->rcpt_include_affixes), igquotstr, buffer);
-  #else
+#else
   count = smtp_write_command(&outblock, no_flush, "RCPT TO:<%s>%s\r\n",
     transport_rcpt_address(addr, tblock->rcpt_include_affixes), igquotstr);
-  #endif
+#endif
 
   if (count < 0) goto SEND_FAILED;
   if (count > 0)
@@ -1972,6 +1982,7 @@ if (!ok) ok = TRUE; else
   DEBUG(D_transport|D_v)
     debug_printf("  SMTP>> writing message and terminating \".\"\n");
   transport_count = 0;
+
 #ifndef DISABLE_DKIM
   ok = dkim_transport_write_message(addrlist, inblock.sock,
     topt_use_crlf | topt_end_dot | topt_escape_headers |
@@ -2098,9 +2109,9 @@ if (!ok) ok = TRUE; else
     /* Set up confirmation if needed - applies only to SMTP */
 
     if (
-        #ifndef EXPERIMENTAL_TPDA
+#ifndef EXPERIMENTAL_TPDA
           (log_extra_selector & LX_smtp_confirmation) != 0 &&
-        #endif
+#endif
           !lmtp
        )
       {
@@ -2276,10 +2287,10 @@ if (!ok)
   in message and save_errno, and setting_up will always be true. Treat as
   a temporary error. */
 
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   TLS_FAILED:
   code = '4';
-  #endif
+#endif
 
   /* If the failure happened while setting up the call, see if the failure was
   a 5xx response (this will either be on connection, or following HELO - a 5xx
@@ -2472,7 +2483,7 @@ if (completed_address && ok && send_quit)
       when TLS is shut down. We test for this by sending a new EHLO. If we
       don't get a good response, we don't attempt to pass the socket on. */
 
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       if (tls_out.active >= 0)
         {
         tls_close(FALSE, TRUE);
@@ -2483,7 +2494,7 @@ if (completed_address && ok && send_quit)
                smtp_read_response(&inblock, buffer, sizeof(buffer), '2',
                  ob->command_timeout);
         }
-      #endif
+#endif
 
       /* If the socket is successfully passed, we musn't send QUIT (or
       indeed anything!) from here. */
@@ -2539,6 +2550,11 @@ specified in the transports, and therefore not visible at top level, in which
 case continue_more won't get set. */
 
 (void)close(inblock.sock);
+
+#ifdef EXPERIMENTAL_TPDA
+(void) tpda_raise_event(tblock->tpda_event_action, US"tcp:close", NULL);
+#endif
+
 continue_transport = NULL;
 continue_hostname = NULL;
 return yield;
@@ -2627,13 +2643,13 @@ for (addr = addrlist; addr != NULL; addr = addr->next)
   addr->basic_errno = 0;
   addr->more_errno = (host->mx >= 0)? 'M' : 'A';
   addr->message = NULL;
-  #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
   addr->cipher = NULL;
   addr->ourcert = NULL;
   addr->peercert = NULL;
   addr->peerdn = NULL;
   addr->ocsp = OCSP_NOT_REQ;
-  #endif
+#endif
   }
 return first_addr;
 }
@@ -3246,10 +3262,10 @@ for (cutoff_retry = 0; expired &&
                          first_addr->basic_errno != ERRNO_TLSFAILURE)
         write_logs(first_addr, host);
 
-      #ifdef EXPERIMENTAL_TPDA
+#ifdef EXPERIMENTAL_TPDA
       if (rc == DEFER)
-        tpda_deferred(ob, first_addr, host);
-      #endif
+        tpda_deferred(first_addr, host);
+#endif
 
       /* If STARTTLS was accepted, but there was a failure in setting up the
       TLS session (usually a certificate screwup), and the host is not in
@@ -3260,7 +3276,7 @@ for (cutoff_retry = 0; expired &&
       session, so the in-clear transmission after those errors, if permitted,
       happens inside smtp_deliver().] */
 
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       if (rc == DEFER && first_addr->basic_errno == ERRNO_TLSFAILURE &&
            ob->tls_tempfail_tryclear &&
            verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
@@ -3273,12 +3289,12 @@ for (cutoff_retry = 0; expired &&
           expanded_hosts != NULL, &message_defer, TRUE);
         if (rc == DEFER && first_addr->basic_errno != ERRNO_AUTHFAIL)
           write_logs(first_addr, host);
-        #ifdef EXPERIMENTAL_TPDA
+# ifdef EXPERIMENTAL_TPDA
         if (rc == DEFER)
-          tpda_deferred(ob, first_addr, host);
-        #endif
+          tpda_deferred(first_addr, host);
+# endif
         }
-      #endif
+#endif
       }
 
     /* Delivery attempt finished */
diff --git a/src/src/transports/smtp.h b/src/src/transports/smtp.h
index dd41e1f15..3030f3a91 100644
--- a/src/src/transports/smtp.h
+++ b/src/src/transports/smtp.h
@@ -81,9 +81,6 @@ typedef struct {
   uschar *dkim_sign_headers;
   uschar *dkim_strict;
 #endif
-#ifdef EXPERIMENTAL_TPDA
-  uschar *tpda_host_defer_action;
-#endif
 } smtp_transport_options_block;
 
 /* Data for reading the private options. */
diff --git a/src/src/verify.c b/src/src/verify.c
index b1b9f29a4..8564aacc2 100644
--- a/src/src/verify.c
+++ b/src/src/verify.c
@@ -462,6 +462,7 @@ else
 
     deliver_host = host->name;
     deliver_host_address = host->address;
+    deliver_host_port = host->port;
     deliver_domain = addr->domain;
 
     if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
@@ -501,7 +502,12 @@ else
     tls_retry_connection:
 
     inblock.sock = outblock.sock =
-      smtp_connect(host, host_af, port, interface, callout_connect, TRUE, NULL);
+      smtp_connect(host, host_af, port, interface, callout_connect, TRUE, NULL
+#ifdef EXPERIMENTAL_TPDA
+    /*XXX tpda action? NULL for now. */
+		  , NULL
+#endif
+		  );
     /* reconsider DSCP here */
     if (inblock.sock < 0)
       {
@@ -533,12 +539,23 @@ else
     /* Unless ssl-on-connect, wait for the initial greeting */
     smtps_redo_greeting:
 
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     if (!smtps || (smtps && tls_out.active >= 0))
-    #endif
+#endif
+      {
       if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
         goto RESPONSE_FAILED;
 
+#ifdef EXPERIMENTAL_TPDA
+      if (tpda_raise_event(addr->transport->tpda_event_action,
+			    US"smtp:connect", responsebuffer) == DEFER)
+	{
+	/* Logging?  Debug? */
+	goto RESPONSE_FAILED;
+	}
+#endif
+      }
+
     /* Not worth checking greeting line for ESMTP support */
     if (!(esmtp = verify_check_this_host(&(ob->hosts_avoid_esmtp), NULL,
       host->name, host->address, NULL) != OK))
@@ -547,14 +564,14 @@ else
 
     tls_redo_helo:
 
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     if (smtps  &&  tls_out.active < 0)	/* ssl-on-connect, first pass */
       {
       tls_offered = TRUE;
       ob->tls_tempfail_tryclear = FALSE;
       }
-      else				/* all other cases */
-    #endif
+    else				/* all other cases */
+#endif
 
       { esmtp_retry:
 
@@ -568,26 +585,26 @@ else
 	  done= FALSE;
 	  goto RESPONSE_FAILED;
 	  }
-        #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
         tls_offered = FALSE;
-        #endif
+#endif
         esmtp = FALSE;
         goto esmtp_retry;			/* fallback to HELO */
         }
 
       /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       if (esmtp && !suppress_tls &&  tls_out.active < 0)
-        {
-          if (regex_STARTTLS == NULL) regex_STARTTLS =
-	    regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
+	{
+	if (regex_STARTTLS == NULL) regex_STARTTLS =
+	  regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
 
-          tls_offered = pcre_exec(regex_STARTTLS, NULL, CS responsebuffer,
-			Ustrlen(responsebuffer), 0, PCRE_EOPT, NULL, 0) >= 0;
+	tls_offered = pcre_exec(regex_STARTTLS, NULL, CS responsebuffer,
+		      Ustrlen(responsebuffer), 0, PCRE_EOPT, NULL, 0) >= 0;
 	}
       else
         tls_offered = FALSE;
-      #endif
+#endif
       }
 
     /* If TLS is available on this connection attempt to
@@ -598,7 +615,7 @@ else
     the client not be required to use TLS. If the response is bad, copy the buffer
     for error analysis. */
 
-    #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
     if (tls_offered &&
     	verify_check_this_host(&(ob->hosts_avoid_tls), NULL, host->name,
   	  host->address, NULL) != OK &&
@@ -623,11 +640,11 @@ else
         {
         if (errno != 0 || buffer2[0] == 0 ||
         	(buffer2[0] == '4' && !ob->tls_tempfail_tryclear))
-  	{
-  	Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
-  	done= FALSE;
-  	goto RESPONSE_FAILED;
-  	}
+	  {
+	  Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
+	  done= FALSE;
+	  goto RESPONSE_FAILED;
+	  }
         }
 
        /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
@@ -637,29 +654,33 @@ else
 	int rc;
 
 	ob->command_timeout = callout;
-        rc = tls_client_start(inblock.sock, host, addr, ob);
+        rc = tls_client_start(inblock.sock, host, addr, addr->transport);
 	ob->command_timeout = oldtimeout;
 
         /* TLS negotiation failed; give an error.  Try in clear on a new connection,
            if the options permit it for this host. */
         if (rc != OK)
           {
-  	if (rc == DEFER && ob->tls_tempfail_tryclear && !smtps &&
-  	   verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
-  	     host->address, NULL) != OK)
-  	  {
-            (void)close(inblock.sock);
-  	  log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
-  	    "to %s [%s] (not in hosts_require_tls)", host->name, host->address);
-  	  suppress_tls = TRUE;
-  	  goto tls_retry_connection;
-  	  }
-  	/*save_errno = ERRNO_TLSFAILURE;*/
-  	/*message = US"failure while setting up TLS session";*/
-  	send_quit = FALSE;
-  	done= FALSE;
-  	goto TLS_FAILED;
-  	}
+	  if (rc == DEFER && ob->tls_tempfail_tryclear && !smtps &&
+	     verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
+	       host->address, NULL) != OK)
+	    {
+	    (void)close(inblock.sock);
+#ifdef EXPERIMENTAL_TPDA
+	    (void) tpda_raise_event(addr->transport->tpda_event_action,
+				    US"tcp:close", NULL);
+#endif
+	    log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
+	      "to %s [%s] (not in hosts_require_tls)", host->name, host->address);
+	    suppress_tls = TRUE;
+	    goto tls_retry_connection;
+	    }
+	  /*save_errno = ERRNO_TLSFAILURE;*/
+	  /*message = US"failure while setting up TLS session";*/
+	  send_quit = FALSE;
+	  done= FALSE;
+	  goto TLS_FAILED;
+	  }
 
         /* TLS session is set up.  Copy info for logging. */
         addr->cipher = tls_out.cipher;
@@ -667,7 +688,7 @@ else
 
         /* For SMTPS we need to wait for the initial OK response, then do HELO. */
         if (smtps)
-  	 goto smtps_redo_greeting;
+	  goto smtps_redo_greeting;
 
         /* For STARTTLS we need to redo EHLO */
         goto tls_redo_helo;
@@ -702,13 +723,13 @@ else
         cutthrough_delivery= FALSE;
         HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
         }
-      #ifndef DISABLE_DKIM
+#ifndef DISABLE_DKIM
       if (ob->dkim_domain)
         {
         cutthrough_delivery= FALSE;
         HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
         }
-      #endif
+#endif
       }
 
     SEND_FAILED:
@@ -994,10 +1015,14 @@ else
         cancel_cutthrough_connection("multiple verify calls");
       if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
 
-      #ifdef SUPPORT_TLS
+#ifdef SUPPORT_TLS
       tls_close(FALSE, TRUE);
-      #endif
+#endif
       (void)close(inblock.sock);
+#ifdef EXPERIMENTAL_TPDA
+      (void) tpda_raise_event(addr->transport->tpda_event_action,
+			      US"tcp:close", NULL);
+#endif
       }
 
     }    /* Loop through all hosts, while !done */
diff --git a/test/confs/5608 b/test/confs/5608
index 55d9a2015..272d5f638 100644
--- a/test/confs/5608
+++ b/test/confs/5608
@@ -55,6 +55,7 @@ check_data:
   accept
 
 logger:
+  accept condition = ${if !eq {msg} {${listextract{1}{$tpda_event}}}}
   warn	logwrite = client ocsp status: $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
@@ -100,8 +101,7 @@ send_to_server1:
   hosts_require_tls =	*
   hosts_request_ocsp =	:
   headers_add =			X-TLS-out: ocsp status $tls_out_ocsp
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =		${acl {logger}}
 
 # norequire: request stapling but do not verify
 send_to_server2:
@@ -113,8 +113,7 @@ send_to_server2:
   hosts_require_tls =	*
 # note no ocsp mention here
   headers_add =			X-TLS-out: ocsp status $tls_out_ocsp
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =		${acl {logger}}
 
 # (any other name): request and verify
 send_to_server3:
@@ -127,8 +126,7 @@ send_to_server3:
   hosts_require_tls =	*
   hosts_require_ocsp =	*
   headers_add =			X-TLS-out: ocsp status $tls_out_ocsp
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =		${acl {logger}}
 
 # (any other name): request and verify, ssl-on-connect
 send_to_server4:
@@ -142,8 +140,7 @@ send_to_server4:
   hosts_require_tls =  *
   hosts_require_ocsp = *
   headers_add =			X-TLS-out: ocsp status $tls_out_ocsp
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =		${acl {logger}}
 
 
 # ----- Retry -----
diff --git a/test/confs/5658 b/test/confs/5658
index e8f2494f6..e4c346a96 100644
--- a/test/confs/5658
+++ b/test/confs/5658
@@ -52,6 +52,7 @@ check_data:
   accept
 
 logger:
+  accept condition = ${if !eq {msg} {${listextract{1}{$tpda_event}}}}
   warn	logwrite = client ocsp status: $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
@@ -99,8 +100,7 @@ send_to_server1:
   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =	${acl {logger}}
 
 send_to_server2:
   driver = smtp
@@ -113,8 +113,7 @@ send_to_server2:
   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =	${acl {logger}}
 
 send_to_server3:
   driver = smtp
@@ -129,8 +128,7 @@ send_to_server3:
   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =	${acl {logger}}
 
 send_to_server4:
   driver = smtp
@@ -146,8 +144,7 @@ send_to_server4:
   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
     (${listextract {${eval:$tls_out_ocsp+1}} \
 		{notreq:notresp:vfynotdone:failed:verified}})
-  tpda_delivery_action =	${acl {logger}}
-  tpda_host_defer_action = 	${acl {logger}}
+  tpda_event_action =	${acl {logger}}
 
 
 # ----- Retry -----
diff --git a/test/confs/5700 b/test/confs/5700
index 52b28018a..0856bb056 100644
--- a/test/confs/5700
+++ b/test/confs/5700
@@ -18,22 +18,58 @@ acl_smtp_data = accept
 
 begin acl
 
-logger:
-    accept condition = ${if eq {$acl_arg2}{domain1}}
-	   logwrite = \
-	    $acl_arg1 \
-	    ip <$tpda_delivery_ip> \
-	    port <$tpda_delivery_port> \
-	    fqdn <$tpda_delivery_fqdn> \
-	    local_part <$tpda_delivery_local_part> \
-	    domain <$tpda_delivery_domain> \
-	    confirmation <$tpda_delivery_confirmation> \
+ev_tcp:
+    accept condition = ${if eq {$tpda_event}{tcp:connect}}
+	   logwrite = . [$host_address]:$sending_port
+    accept condition = ${if eq {$tpda_event}{tcp:close}}
+	   logwrite = . [$sending_ip_address] -> \
+			[$host_address]:$host_port
+    accept
+
+ev_smtp:
+    accept
+	   logwrite = . [$sending_ip_address] -> \
+			[$host_address]:$host_port
+	   logwrite = . banner <$tpda_data>
+
+ev_msg:
+    accept condition = ${if !eq {$acl_arg2}{domain1}}
+	   logwrite = $this_expansion_will_fail
+
+    accept condition = ${if eq {$acl_arg1}{msg:delivery}}
+	   logwrite = . \
+	    delivery \
+	    ip <$host_address> \
+	    port <$host_port> \
+	    fqdn <$host> \
+	    local_part <$local_part> \
+	    domain <$domain> \
+	    confirmation <$tpda_data> \
+	    router <$router_name> \
+	    transport <$transport_name>
+
+    accept condition = ${if eq {$acl_arg1}{msg:host:defer}}
+	   logwrite = . \
+	    deferral \
+	    ip <$host_address> \
+	    port <$host_port> \
+	    fqdn <$host> \
+	    local_part <$local_part> \
+	    domain <$domain> \
 	    errno <$tpda_defer_errno> \
-	    errstr <$tpda_defer_errstr> \
+	    errstr <$tpda_data> \
 	    router <$router_name> \
 	    transport <$transport_name>
 
-    accept logwrite = $this_expansion_will_fail
+logger:
+    warn   logwrite = event $tpda_event
+    accept condition = ${if eq {tcp} {${listextract{1}{$tpda_event}}}}
+	   acl = ev_tcp
+    accept condition = ${if eq {smtp} {${listextract{1}{$tpda_event}}}}
+	   acl = ev_smtp
+    accept condition = ${if eq {msg} {${listextract{1}{$tpda_event}}}}
+	   acl = ev_msg $tpda_event $acl_arg2
+
 
 # ----- Routers -----
 
@@ -61,7 +97,6 @@ smtp:
   port = PORT_S
   command_timeout = 1s
   final_timeout = 1s
-  tpda_delivery_action =   ${acl {logger} {delivery} {$domain} }
-  tpda_host_defer_action = ${acl {logger} {deferral} {$domain} }
+  tpda_event_action =   ${acl {logger} {$tpda_event} {$domain} }
 
 # End
diff --git a/test/confs/5750 b/test/confs/5750
index a8ff60350..bcb03ac5d 100644
--- a/test/confs/5750
+++ b/test/confs/5750
@@ -32,10 +32,16 @@ tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server2.example.com/
 #
 
 begin acl
-logger:
-  warn   logwrite =  $acl_arg1 $tpda_delivery_local_part
+
+ev_tls:
+  accept logwrite =  $tpda_event depth=$tpda_data \
+			<${certextract {subject} {$tls_out_peercert}}>
+#	 message = noooo
+
+ev_msg:
+  warn   logwrite =  $acl_arg1 $local_part
   warn   logwrite =  ${if !def:tls_out_ourcert \
-		{NO CLENT CERT presented} \
+		{NO CLIENT CERT presented} \
 		{Our cert SN: ${certextract{subject}{$tls_out_ourcert}}}}
   accept condition = ${if !def:tls_out_peercert}
 	 logwrite =  No Peer cert
@@ -51,6 +57,12 @@ logger:
 #	 logwrite =       ${certextract {ocsp_uri}	{$tls_out_peercert} {OCU <$value>}{(no OCU)}}
 	 logwrite =       ${certextract {crl_uri}	{$tls_out_peercert} {CRU <$value>}{(no CRU)}}
 
+logger:
+  accept condition = ${if eq {msg} {${listextract{1}{$tpda_event}}}}
+	 acl = ev_msg $tpda_event $acl_arg2
+  accept condition = ${if eq {tls} {${listextract{1}{$tpda_event}}}}
+	 message =   ${acl {ev_tls}}
+  accept
 
 # ----- Routers -----
 
@@ -81,8 +93,7 @@ send_to_server:
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}
 
-  tpda_delivery_action =   ${acl {logger} {delivery} {$domain} }
-  tpda_host_defer_action = ${acl {logger} {deferral} {$domain} }
+  tpda_event_action =   ${acl {logger} {$tpda_event} {$domain} }
 
 # ----- Retry -----
 
diff --git a/test/confs/5760 b/test/confs/5760
index e9868d109..c3b49d1b7 100644
--- a/test/confs/5760
+++ b/test/confs/5760
@@ -32,10 +32,16 @@ tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server2.example.com/
 #
 
 begin acl
-logger:
-  warn   logwrite =  $acl_arg1 $tpda_delivery_local_part
+
+ev_tls:
+  accept logwrite =  $tpda_event depth=$tpda_data \
+			<${certextract {subject} {$tls_out_peercert}}>
+#	 message = nooooo
+
+ev_msg:
+  warn   logwrite =  $acl_arg1 $local_part
   warn   logwrite =  ${if !def:tls_out_ourcert \
-		{NO CLENT CERT presented} \
+		{NO CLIENT CERT presented} \
 		{Our cert SN: ${certextract{subject}{$tls_out_ourcert}}}}
   accept condition = ${if !def:tls_out_peercert}
 	 logwrite =  No Peer cert
@@ -51,6 +57,12 @@ logger:
 	 logwrite =       ${certextract {ocsp_uri}	{$tls_out_peercert} {OCU <$value>}{(no OCU)}}
 	 logwrite =       ${certextract {crl_uri}	{$tls_out_peercert} {CRU <$value>}{(no CRU)}}
 
+logger:
+  accept condition = ${if eq {msg} {${listextract{1}{$tpda_event}}}}
+	 acl =	     ev_msg $tpda_event $acl_arg2
+  accept condition = ${if eq {tls} {${listextract{1}{$tpda_event}}}}
+	 message =   ${acl {ev_tls}}
+  accept
 
 # ----- Routers -----
 
@@ -81,8 +93,7 @@ send_to_server:
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}
 
-  tpda_delivery_action =   ${acl {logger} {delivery} {$domain} }
-  tpda_host_defer_action = ${acl {logger} {deferral} {$domain} }
+  tpda_event_action =   ${acl {logger} {$tpda_event} {$domain} }
 
 # ----- Retry -----
 
diff --git a/test/log/5700 b/test/log/5700
index d11936571..150aef773 100644
--- a/test/log/5700
+++ b/test/log/5700
@@ -1,19 +1,43 @@
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
+1999-03-02 09:44:33 10HmaY-0005vi-00 event tcp:connect
+1999-03-02 09:44:33 10HmaY-0005vi-00 . [127.0.0.1]:-1
+1999-03-02 09:44:33 10HmaY-0005vi-00 event smtp:connect
+1999-03-02 09:44:33 10HmaY-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
+1999-03-02 09:44:33 10HmaY-0005vi-00 . banner <220 ESMTP>
+1999-03-02 09:44:33 10HmaY-0005vi-00 event tcp:close
+1999-03-02 09:44:33 10HmaY-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
 1999-03-02 09:44:33 10HmaY-0005vi-00 => userx@domain1 R=others T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
-1999-03-02 09:44:33 10HmaY-0005vi-00 delivery ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> confirmation <250 OK> errno <0> errstr <> router <others> transport <smtp>
+1999-03-02 09:44:33 10HmaY-0005vi-00 event msg:delivery
+1999-03-02 09:44:33 10HmaY-0005vi-00 . delivery ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> confirmation <250 OK> router <others> transport <smtp>
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
+1999-03-02 09:44:33 10HmaX-0005vi-00 event tcp:connect
+1999-03-02 09:44:33 10HmaX-0005vi-00 . [127.0.0.1]:-1
+1999-03-02 09:44:33 10HmaX-0005vi-00 event smtp:connect
+1999-03-02 09:44:33 10HmaX-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
+1999-03-02 09:44:33 10HmaX-0005vi-00 . banner <220 ESMTP>
+1999-03-02 09:44:33 10HmaX-0005vi-00 event tcp:close
+1999-03-02 09:44:33 10HmaX-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@domain2 R=others T=smtp H=127.0.0.1 [127.0.0.1] C="250 OK"
-1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_deliver_action in smtp: error from acl "logger"
+1999-03-02 09:44:33 10HmaX-0005vi-00 event msg:delivery
+1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_event_action msg:delivery in smtp: error from acl "logger"
 
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 event tcp:connect
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . [127.0.0.1]:-1
+1999-03-02 09:44:33 10HmaZ-0005vi-00 event smtp:connect
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . banner <220 ESMTP>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 event tcp:close
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . [127.0.0.1] -> [127.0.0.1]:1224
 1999-03-02 09:44:33 10HmaZ-0005vi-00 SMTP timeout while connected to 127.0.0.1 [127.0.0.1] after EHLO the.local.host.name: Connection timed out
-1999-03-02 09:44:33 10HmaZ-0005vi-00 deferral ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> confirmation <> errno <110> errstr <SMTP timeout while connected to 127.0.0.1 [127.0.0.1] after EHLO the.local.host.name: Connection timed out> router <others> transport <smtp>
+1999-03-02 09:44:33 10HmaZ-0005vi-00 event msg:host:defer
+1999-03-02 09:44:33 10HmaZ-0005vi-00 . deferral ip <127.0.0.1> port <1224> fqdn <127.0.0.1> local_part <userx> domain <domain1> errno <110> errstr <SMTP timeout while connected to 127.0.0.1 [127.0.0.1] after EHLO the.local.host.name: Connection timed out> router <others> transport <smtp>
 1999-03-02 09:44:33 10HmaZ-0005vi-00 == userx@domain1 R=others T=smtp defer (dd): Connection timed out: SMTP timeout while connected to 127.0.0.1 [127.0.0.1] after EHLO the.local.host.name
 1999-03-02 09:44:33 10HmaZ-0005vi-00 ** userx@domain1: retry timeout exceeded
 1999-03-02 09:44:33 10HmbA-0005vi-00 <= <> R=10HmaZ-0005vi-00 U=EXIMUSER P=local S=sss
diff --git a/test/log/5750 b/test/log/5750
index 845624676..c13fe6a3b 100644
--- a/test/log/5750
+++ b/test/log/5750
@@ -1,9 +1,10 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 tls:cert depth=0 <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (certificate verification failed): certificate invalid
-1999-03-02 09:44:33 10HmaX-0005vi-00 deferral bad
-1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLENT CERT presented
+1999-03-02 09:44:33 10HmaX-0005vi-00 msg:host:defer bad
+1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLIENT CERT presented
 1999-03-02 09:44:33 10HmaX-0005vi-00 Peer cert:
 1999-03-02 09:44:33 10HmaX-0005vi-00 ver <3>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SN  <CN=server1.example.com>
@@ -16,12 +17,13 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 CRU <http://crl.example.com/latest.crl>
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
 1999-03-02 09:44:33 10HmaX-0005vi-00 => bad@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
-1999-03-02 09:44:33 10HmaX-0005vi-00 delivery bad
-1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLENT CERT presented
+1999-03-02 09:44:33 10HmaX-0005vi-00 msg:delivery bad
+1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLIENT CERT presented
 1999-03-02 09:44:33 10HmaX-0005vi-00 No Peer cert
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth=0 <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 => good@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 DN="CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
-1999-03-02 09:44:33 10HmaY-0005vi-00 delivery good
+1999-03-02 09:44:33 10HmaY-0005vi-00 msg:delivery good
 1999-03-02 09:44:33 10HmaY-0005vi-00 Our cert SN: CN=server2.example.com
 1999-03-02 09:44:33 10HmaY-0005vi-00 Peer cert:
 1999-03-02 09:44:33 10HmaY-0005vi-00 ver <3>
diff --git a/test/log/5760 b/test/log/5760
index 6b0b59597..e8fd95fd2 100644
--- a/test/log/5760
+++ b/test/log/5760
@@ -3,8 +3,8 @@
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=2 error=self signed certificate in certificate chain cert=/O=example.com/CN=clica CA
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (SSL_connect): error: <<detail omitted>>
-1999-03-02 09:44:33 10HmaX-0005vi-00 deferral bad
-1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLENT CERT presented
+1999-03-02 09:44:33 10HmaX-0005vi-00 msg:host:defer bad
+1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLIENT CERT presented
 1999-03-02 09:44:33 10HmaX-0005vi-00 Peer cert:
 1999-03-02 09:44:33 10HmaX-0005vi-00 ver <2>
 1999-03-02 09:44:33 10HmaX-0005vi-00 SN  <CN=clica CA,O=example.com>
@@ -18,12 +18,15 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 (no CRU)
 1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
 1999-03-02 09:44:33 10HmaX-0005vi-00 => bad@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaZ-0005vi-00"
-1999-03-02 09:44:33 10HmaX-0005vi-00 delivery bad
-1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLENT CERT presented
+1999-03-02 09:44:33 10HmaX-0005vi-00 msg:delivery bad
+1999-03-02 09:44:33 10HmaX-0005vi-00 NO CLIENT CERT presented
 1999-03-02 09:44:33 10HmaX-0005vi-00 No Peer cert
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth=2 <CN=clica CA,O=example.com>
+1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth=1 <CN=clica Signing Cert,O=example.com>
+1999-03-02 09:44:33 10HmaY-0005vi-00 tls:cert depth=0 <CN=server1.example.com>
 1999-03-02 09:44:33 10HmaY-0005vi-00 => good@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
-1999-03-02 09:44:33 10HmaY-0005vi-00 delivery good
+1999-03-02 09:44:33 10HmaY-0005vi-00 msg:delivery good
 1999-03-02 09:44:33 10HmaY-0005vi-00 Our cert SN: CN=server2.example.com
 1999-03-02 09:44:33 10HmaY-0005vi-00 Peer cert:
 1999-03-02 09:44:33 10HmaY-0005vi-00 ver <2>
diff --git a/test/paniclog/5700 b/test/paniclog/5700
index 4f28d19c4..dcb696955 100644
--- a/test/paniclog/5700
+++ b/test/paniclog/5700
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_deliver_action in smtp: error from acl "logger"
+1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_event_action msg:delivery in smtp: error from acl "logger"
 
diff --git a/test/runtest b/test/runtest
index c3faa4262..57caa2c1f 100755
--- a/test/runtest
+++ b/test/runtest
@@ -1293,7 +1293,7 @@ $munges =
     { 'mainlog' => 's/\(gnutls_handshake\): Error in the push function/\(gnutls_handshake\): A TLS packet with unexpected length was received/', },
 
     'tpda' =>
-    { 'stdout' => '/tpda_delivery_action =/', },
+    { 'stdout' => '/tpda_event_action =/', },
 
   };
 
diff --git a/test/stderr/0002 b/test/stderr/0002
index 023c001bd..a30eb7399 100644
--- a/test/stderr/0002
+++ b/test/stderr/0002
@@ -185,6 +185,7 @@ host in "<
  partial-lsearch;TESTSUITE/aux-fixed/0002.lsearch 
  1.2.3.4"? yes (matched "partial-lsearch;TESTSUITE/aux-fixed/0002.lsearch")
 deny: condition test succeeded in ACL "connect1"
+end of ACL "connect1": DENY
 SMTP>> 550 Administrative prohibition
 LOG: MAIN REJECT
   H=ten-1.test.ex [V4NET.0.0.1] rejected connection in "connect" ACL
@@ -245,8 +246,10 @@ search_tidyup called
 >>> using ACL "connect0"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "connect0"
+>>> end of ACL "connect0": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> using ACL "check_data"
 >>> processing "warn"
 >>> check logwrite = Subject is: "$h_subject:"
@@ -256,9 +259,11 @@ LOG: 10HmaX-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaX-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -269,9 +274,11 @@ LOG: 10HmaY-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaY-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<a@b>
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -282,9 +289,11 @@ LOG: 10HmaZ-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaZ-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<c@d>
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -295,9 +304,11 @@ LOG: 10HmbA-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbA-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -308,6 +319,7 @@ LOG: 10HmbB-0005vi-00 Subject is: ""
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbB-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<x@y>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -320,8 +332,10 @@ LOG: 10HmbB-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<x
 >>> using ACL "connect0"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "connect0"
+>>> end of ACL "connect0": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -332,6 +346,7 @@ LOG: 10HmbC-0005vi-00 Subject is: "=?iso-8859-8?Q?_here_we_go=3A_a_string_that_i
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbC-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -344,8 +359,10 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 >>> using ACL "connect0"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "connect0"
+>>> end of ACL "connect0": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -356,6 +373,7 @@ LOG: 10HmbD-0005vi-00 Subject is: " here we go: a string that is going to be enc
 >>> processing "deny"
 >>>   message: reply_address=<$reply_address>
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbD-0005vi-00 H=[V4NET.0.0.0] F=<> rejected after DATA: reply_address=<>
 Exim version x.yz ....
 changed uid/gid: -C, -D, -be or -bf forces real uid
diff --git a/test/stderr/0003 b/test/stderr/0003
index c149125a7..60cbaf3f9 100644
--- a/test/stderr/0003
+++ b/test/stderr/0003
@@ -16,6 +16,7 @@
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> a@b.c in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<a@b.c> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -27,6 +28,7 @@ LOG: H=[1.1.1.1] F=<a@b.c> rejected RCPT <x@test.ex>
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> a@B.C in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "check_recipient"
@@ -39,6 +41,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> A@b.c in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<A@b.c> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -50,6 +53,7 @@ LOG: H=[1.1.1.1] F=<A@b.c> rejected RCPT <x@test.ex>
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> A@B.C in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<A@B.C> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -61,6 +65,7 @@ LOG: H=[1.1.1.1] F=<A@B.C> rejected RCPT <x@test.ex>
 >>> y.z in "Y.Z"? yes (matched "Y.Z")
 >>> x@y.z in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "X@Y.Z")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<x@y.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -72,6 +77,7 @@ LOG: H=[1.1.1.1] F=<x@y.z> rejected RCPT <x@test.ex>
 >>> y.z in "Y.Z"? yes (matched "Y.Z")
 >>> x@Y.Z in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "X@Y.Z")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<x@Y.Z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -83,6 +89,7 @@ LOG: H=[1.1.1.1] F=<x@Y.Z> rejected RCPT <x@test.ex>
 >>> y.z in "Y.Z"? yes (matched "Y.Z")
 >>> X@y.z in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "X@Y.Z")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<X@y.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -94,6 +101,7 @@ LOG: H=[1.1.1.1] F=<X@y.z> rejected RCPT <x@test.ex>
 >>> y.z in "Y.Z"? yes (matched "Y.Z")
 >>> X@Y.Z in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "X@Y.Z")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<X@Y.Z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -104,6 +112,7 @@ LOG: H=[1.1.1.1] F=<X@Y.Z> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ax@e.f in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\Dx@e\.f")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -114,6 +123,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ay@g.h in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\DY@G\.H")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ay@g.h> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -124,6 +134,7 @@ LOG: H=[1.1.1.1] F=<ay@g.h> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> bX@E.F in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\Dx@e\.f")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<bX@E.F> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -134,6 +145,7 @@ LOG: H=[1.1.1.1] F=<bX@E.F> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> bY@G.H in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\DY@G\.H")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<bY@G.H> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -149,6 +161,7 @@ LOG: H=[1.1.1.1] F=<bY@G.H> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -163,6 +176,7 @@ LOG: H=[1.1.1.1] F=<bY@G.H> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -172,6 +186,7 @@ LOG: H=[1.1.1.1] F=<bY@G.H> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@aa.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@aa.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -182,6 +197,7 @@ LOG: H=[1.1.1.1] F=<q@aa.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@AA.COM in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@AA.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -192,6 +208,7 @@ LOG: H=[1.1.1.1] F=<q@AA.COM> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@bb.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@bb.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -202,6 +219,7 @@ LOG: H=[1.1.1.1] F=<Q@bb.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@BB.Com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@BB.Com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -212,6 +230,7 @@ LOG: H=[1.1.1.1] F=<Q@BB.Com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> cc@dd.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<cc@dd.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -222,6 +241,7 @@ LOG: H=[1.1.1.1] F=<cc@dd.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> CC@DD.COM in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -237,6 +257,7 @@ LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -246,6 +267,7 @@ LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@nn.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@nn.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -256,6 +278,7 @@ LOG: H=[1.1.1.1] F=<q@nn.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@NN.COM in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@NN.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -266,6 +289,7 @@ LOG: H=[1.1.1.1] F=<Q@NN.COM> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@MM.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@MM.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -276,6 +300,7 @@ LOG: H=[1.1.1.1] F=<q@MM.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Pp@Qq.com in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -286,6 +311,7 @@ LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> abcd@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<abcd@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -296,6 +322,7 @@ LOG: H=[1.1.1.1] F=<abcd@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ABCD@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ABCD@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -306,6 +333,7 @@ LOG: H=[1.1.1.1] F=<ABCD@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ax@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -316,6 +344,7 @@ LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> bX@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<bX@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -326,6 +355,7 @@ LOG: H=[1.1.1.1] F=<bX@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Ay@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Ay@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -336,6 +366,7 @@ LOG: H=[1.1.1.1] F=<Ay@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> BY@aa.bb in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -346,6 +377,7 @@ LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> blocked@xy.zz in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<blocked@xy.zz> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -356,4 +388,5 @@ LOG: H=[1.1.1.1] F=<blocked@xy.zz> rejected RCPT <x@test.ex>
 >>> check senders = a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> BLOCKED@zz.xy in "a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<BLOCKED@zz.xy> rejected RCPT <x@test.ex>
diff --git a/test/stderr/0004 b/test/stderr/0004
index 958ee7bc2..310a4ef29 100644
--- a/test/stderr/0004
+++ b/test/stderr/0004
@@ -16,6 +16,7 @@
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> a@b.c in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<a@b.c> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -27,6 +28,7 @@ LOG: H=[1.1.1.1] F=<a@b.c> rejected RCPT <x@test.ex>
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> a@B.C in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "a@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "check_recipient"
@@ -43,6 +45,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -57,6 +60,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -71,6 +75,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -85,6 +90,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -100,6 +106,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -115,6 +122,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -124,6 +132,7 @@ LOG: H=[1.1.1.1] F=<a@B.C> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ax@e.f in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "^\Dx@e\.f")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -139,6 +148,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -153,6 +163,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -167,6 +178,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -181,6 +193,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -195,6 +208,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -204,6 +218,7 @@ LOG: H=[1.1.1.1] F=<ax@e.f> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@aa.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@aa.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -214,6 +229,7 @@ LOG: H=[1.1.1.1] F=<q@aa.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@AA.COM in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@AA.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -224,6 +240,7 @@ LOG: H=[1.1.1.1] F=<q@AA.COM> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@bb.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@bb.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -234,6 +251,7 @@ LOG: H=[1.1.1.1] F=<Q@bb.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@BB.Com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@BB.Com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -244,6 +262,7 @@ LOG: H=[1.1.1.1] F=<Q@BB.Com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> cc@dd.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<cc@dd.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -254,6 +273,7 @@ LOG: H=[1.1.1.1] F=<cc@dd.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> CC@DD.COM in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -269,6 +289,7 @@ LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -278,6 +299,7 @@ LOG: H=[1.1.1.1] F=<CC@DD.COM> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@nn.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@nn.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -288,6 +310,7 @@ LOG: H=[1.1.1.1] F=<q@nn.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Q@NN.COM in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Q@NN.COM> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -298,6 +321,7 @@ LOG: H=[1.1.1.1] F=<Q@NN.COM> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@MM.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@MM.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -308,6 +332,7 @@ LOG: H=[1.1.1.1] F=<q@MM.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> q@mm.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<q@mm.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -318,6 +343,7 @@ LOG: H=[1.1.1.1] F=<q@mm.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> Pp@Qq.com in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -333,6 +359,7 @@ LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -347,6 +374,7 @@ LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -356,6 +384,7 @@ LOG: H=[1.1.1.1] F=<Pp@Qq.com> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> AbCd@aa.bb in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<AbCd@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -366,6 +395,7 @@ LOG: H=[1.1.1.1] F=<AbCd@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> ax@aa.bb in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -381,6 +411,7 @@ LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -395,6 +426,7 @@ LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -404,6 +436,7 @@ LOG: H=[1.1.1.1] F=<ax@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> BY@aa.bb in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -419,6 +452,7 @@ LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -433,6 +467,7 @@ LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -442,5 +477,6 @@ LOG: H=[1.1.1.1] F=<BY@aa.bb> rejected RCPT <x@test.ex>
 >>> check senders = +caseful: a@b.c : X@Y.Z : ^\\Dx@e\\.f : ^\\DY@G\\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain
 >>> BlOcKeD@zz.xy in "+caseful: a@b.c : X@Y.Z : ^\Dx@e\.f : ^\DY@G\.H :lsearch*@;TESTSUITE/aux-fixed/0003.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0003.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.1.1.1] F=<BlOcKeD@zz.xy> rejected RCPT <x@test.ex>
 LOG: unexpected disconnection while reading SMTP command from [1.1.1.1]
diff --git a/test/stderr/0018 b/test/stderr/0018
index 6ab981441..833a0a30c 100644
--- a/test/stderr/0018
+++ b/test/stderr/0018
@@ -21,5 +21,6 @@ MUNGED: ::1 will be omitted in what follows
 LOG: H=[127.0.0.1] Warning: accepted etrn #some.random.domain
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_etrn"
+>>> end of ACL "check_etrn": ACCEPT
 >>> ETRN command is: exim -R
 >>> ETRN command execution skipped
diff --git a/test/stderr/0020 b/test/stderr/0020
index 07c368482..cbab114bb 100644
--- a/test/stderr/0020
+++ b/test/stderr/0020
@@ -2107,3 +2107,4 @@ MUNGED: ::1 will be omitted in what follows
 >>> check hosts = 10.250.104.0/21
 >>> host in "10.250.104.0/21"? yes (matched "10.250.104.0/21")
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
diff --git a/test/stderr/0021 b/test/stderr/0021
index 3dbb81639..43331d4aa 100644
--- a/test/stderr/0021
+++ b/test/stderr/0021
@@ -28,6 +28,7 @@ check logwrite = $sender_host_address accepted by connect ACL
 LOG: MAIN
   10.9.8.8 accepted by connect ACL
 accept: condition test succeeded in ACL "connect"
+end of ACL "connect": ACCEPT
 using ACL "mail"
 processing "warn"
   message: added header line
@@ -66,6 +67,7 @@ check logwrite = :main,reject: mail accepted "$smtp_command" "$smtp_command_argu
 LOG: MAIN REJECT
   mail accepted "mail from:<ok@test1>" "<ok@test1>"
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 using ACL "rcpt"
 processing "accept"
 check senders = +ok_senders
@@ -82,6 +84,7 @@ check logwrite = :panic: rcpt accepted
 LOG: PANIC
   rcpt accepted
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 using ACL "rcpt"
 processing "accept"
 check senders = +ok_senders
@@ -95,6 +98,7 @@ check logwrite = :panic: rcpt accepted
 LOG: PANIC
   rcpt accepted
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 LOG: smtp_connection MAIN
   SMTP connection from CALLER closed by QUIT
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -129,6 +133,7 @@ check logwrite = $sender_host_address accepted by connect ACL
 LOG: MAIN
   10.9.8.8 accepted by connect ACL
 accept: condition test succeeded in ACL "connect"
+end of ACL "connect": ACCEPT
 using ACL "mail"
 processing "warn"
   message: added header line
@@ -153,6 +158,7 @@ check logwrite = :main,reject: mail accepted "$smtp_command" "$smtp_command_argu
 LOG: MAIN REJECT
   mail accepted "mail from:<ok@test3>" "<ok@test3>"
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 using ACL "rcpt"
 processing "accept"
 check senders = +ok_senders
@@ -171,6 +177,7 @@ check logwrite = :panic: rcpt accepted
 LOG: PANIC
   rcpt accepted
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 host in ignore_fromline_hosts? no (option unset)
 >>Headers added by MAIL or RCPT ACL:
   X-ACL-Warn: added header line
diff --git a/test/stderr/0022 b/test/stderr/0022
index 864e19762..65768e251 100644
--- a/test/stderr/0022
+++ b/test/stderr/0022
@@ -32,6 +32,7 @@ processing "warn"
 warn: condition test succeeded in ACL "warn_empty"
 processing "accept"
 accept: condition test succeeded in ACL "warn_empty"
+end of ACL "warn_empty": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -98,6 +99,7 @@ LOG: MAIN
   H=[V4NET.9.8.7] Warning: warn log message
 processing "accept"
 accept: condition test succeeded in ACL "warn_log"
+end of ACL "warn_log": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -162,6 +164,7 @@ processing "warn"
 warn: condition test succeeded in ACL "warn_user"
 processing "accept"
 accept: condition test succeeded in ACL "warn_user"
+end of ACL "warn_user": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -207,14 +210,17 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> processing "defer"
 >>>   message: forcibly deferred
 >>> defer: condition test succeeded in ACL "defer"
+>>> end of ACL "defer": DEFER
 LOG: H=[V4NET.9.8.7] F=<x@y> temporarily rejected RCPT <defer@y>: forcibly deferred
 >>> using ACL "accept"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "accept"
+>>> end of ACL "accept": ACCEPT
 >>> using ACL "drop"
 >>> processing "drop"
 >>>   message: forcibly dropped
 >>> drop: condition test succeeded in ACL "drop"
+>>> end of ACL "drop": DROP
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <drop@y>: forcibly dropped
 LOG: SMTP connection from [V4NET.9.8.7] closed by DROP in ACL
 >>> host in hosts_connection_nolog? no (end of list)
@@ -231,6 +237,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> check senders = :
 >>>  in ":"? yes (matched "")
 >>> defer: condition test succeeded in ACL "defer_senders"
+>>> end of ACL "defer_senders": DEFER
 LOG: H=[V4NET.9.8.7] F=<> temporarily rejected RCPT <defer_senders@y>
 LOG: SMTP connection from [V4NET.9.8.7] closed by QUIT
 >>> host in hosts_connection_nolog? no (end of list)
@@ -248,6 +255,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> delay modifier requests 1-second delay
 >>> delay skipped in -bh checking mode
 >>> accept: condition test succeeded in ACL "delay_accept"
+>>> end of ACL "delay_accept": ACCEPT
 >>> using ACL "delay_warn"
 >>> processing "warn"
 >>> check delay = 1s
@@ -256,6 +264,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> warn: condition test succeeded in ACL "delay_warn"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "delay_warn"
+>>> end of ACL "delay_warn": ACCEPT
 LOG: SMTP connection from [V4NET.9.8.7] closed by QUIT
 >>> host in hosts_connection_nolog? no (end of list)
 LOG: SMTP connection from [V4NET.9.8.7]
@@ -272,6 +281,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> host in "net-lsearch;TESTSUITE/aux-var/0022.hosts"? yes (matched "net-lsearch;TESTSUITE/aux-var/0022.hosts")
 >>>   message: host data >$host_data<
 >>> deny: condition test succeeded in ACL "host_check"
+>>> end of ACL "host_check": DENY
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check@y>: host data >A host-specific message<
 >>> using ACL "host_check"
 >>> processing "deny"
@@ -279,6 +289,7 @@ LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check@y>: host data >A host-spe
 >>> host in "net-lsearch;TESTSUITE/aux-var/0022.hosts"? yes (matched "net-lsearch;TESTSUITE/aux-var/0022.hosts")
 >>>   message: host data >$host_data<
 >>> deny: condition test succeeded in ACL "host_check"
+>>> end of ACL "host_check": DENY
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check@y>: host data >A host-specific message<
 >>> using ACL "host_check2"
 >>> processing "deny"
@@ -287,6 +298,7 @@ LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check@y>: host data >A host-spe
 >>> host in "net-lsearch;TESTSUITE/aux-var/0022.hosts"? yes (matched "net-lsearch;TESTSUITE/aux-var/0022.hosts")
 >>> host in "+some_hosts"? yes (matched "+some_hosts")
 >>> deny: condition test succeeded in ACL "host_check2"
+>>> end of ACL "host_check2": DENY
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check2@y>: host data >A host-specific message<
 >>> using ACL "host_check2"
 >>> processing "deny"
@@ -294,6 +306,7 @@ LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check2@y>: host data >A host-sp
 >>> check hosts = +some_hosts
 >>> host in "+some_hosts"? yes (matched "+some_hosts" - cached)
 >>> deny: condition test succeeded in ACL "host_check2"
+>>> end of ACL "host_check2": DENY
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <host_check2@y>: host data >A host-specific message<
 LOG: SMTP connection from [V4NET.9.8.7] closed by QUIT
 LOG: smtp_connection MAIN
@@ -340,6 +353,7 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> processing "drop"
 >>>   message: forcibly dropped
 >>> drop: condition test succeeded in ACL "drop"
+>>> end of ACL "drop": DROP
 >>> accept: condition test yielded "drop" in ACL "nested_drop"
 >>> accept: endpass encountered - denying access
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <nested_drop@y>: forcibly dropped
@@ -360,7 +374,9 @@ LOG: SMTP connection from [V4NET.9.8.7]
 >>> processing "drop"
 >>>   message: forcibly dropped
 >>> drop: condition test succeeded in ACL "drop"
+>>> end of ACL "drop": DROP
 >>> require: condition test yielded "drop" in ACL "nested_drop_require"
+>>> end of ACL "nested_drop_require": not OK
 LOG: H=[V4NET.9.8.7] F=<x@y> rejected RCPT <nested_drop_require@y>: forcibly dropped
 LOG: SMTP connection from [V4NET.9.8.7] closed by DROP in ACL
 
diff --git a/test/stderr/0023 b/test/stderr/0023
index 01994efe6..16c4abaf6 100644
--- a/test/stderr/0023
+++ b/test/stderr/0023
@@ -31,6 +31,7 @@
 >>> check domains = !refuse.test.ex
 >>> test.ex in "!refuse.test.ex"? yes (end of list)
 >>> accept: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": ACCEPT
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
 >>> check domains = !nopass
@@ -89,6 +90,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <z@z>
 >>> check domains = !refuse.test.ex
 >>> test.ex in "!refuse.test.ex"? yes (end of list)
 >>> accept: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": ACCEPT
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
 >>> check domains = !nopass
@@ -114,6 +116,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <z@z>
 >>> check domains = !refuse.test.ex
 >>> test.ex in "!refuse.test.ex"? yes (end of list)
 >>> accept: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": ACCEPT
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
 >>> check domains = !nopass
@@ -139,6 +142,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <z@z>
 >>> check domains = !refuse.test.ex
 >>> relay.test.ex in "!refuse.test.ex"? yes (end of list)
 >>> accept: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": ACCEPT
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
 >>> check domains = !nopass
@@ -156,6 +160,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <z@z>
 >>> check domains = deny.test.ex
 >>> deny.test.ex in "deny.test.ex"? yes (matched "deny.test.ex")
 >>> deny: condition test succeeded in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@deny.test.ex>: DOMAIN EXPLICITLY DENIED
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
@@ -189,6 +194,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@refuse.test.ex>: refuse.test.ex gets r
 >>> check domains = !nopass
 >>> nopass in "!nopass"? no (matched "!nopass")
 >>> require: condition test failed in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": not OK
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@nopass>
 >>> using ACL "acl_1_2_3"
 >>> processing "require"
@@ -200,6 +206,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@nopass>
 >>> check domains = !wontpass
 >>> wontpass in "!wontpass"? no (matched "!wontpass")
 >>> require: condition test failed in ACL "acl_1_2_3"
+>>> end of ACL "acl_1_2_3": not OK
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@wontpass>: x@wontpass shall not pass
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -232,6 +239,7 @@ LOG: H=[5.6.7.8] F=<x@y> rejected RCPT <x@test.ex>
 >>> check local_parts = $domain_data
 >>> userx in "userx : spqr"? yes (matched "userx")
 >>> accept: condition test succeeded in ACL "acl_5_6_7"
+>>> end of ACL "acl_5_6_7": ACCEPT
 >>> using ACL "acl_5_6_7"
 >>> processing "accept"
 >>> check domains = lsearch;TESTSUITE/aux-fixed/0023.doms
@@ -239,6 +247,7 @@ LOG: H=[5.6.7.8] F=<x@y> rejected RCPT <x@test.ex>
 >>> check local_parts = $domain_data
 >>> spqr in "userx : spqr"? yes (matched "spqr")
 >>> accept: condition test succeeded in ACL "acl_5_6_7"
+>>> end of ACL "acl_5_6_7": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -253,11 +262,13 @@ LOG: H=[5.6.7.8] F=<x@y> rejected RCPT <x@test.ex>
 >>> host in "9.9.9.9"? yes (matched "9.9.9.9")
 >>> host in "+ok9_hosts"? yes (matched "+ok9_hosts")
 >>> accept: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": ACCEPT
 >>> using ACL "acl_9_9_9"
 >>> processing "accept"
 >>> check hosts = +ok9_hosts
 >>> host in "+ok9_hosts"? yes (matched "+ok9_hosts" - cached)
 >>> accept: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -277,6 +288,7 @@ LOG: H=[5.6.7.8] F=<x@y> rejected RCPT <x@test.ex>
 >>> check hosts = 9.9.9.0/26
 >>> host in "9.9.9.0/26"? yes (matched "9.9.9.0/26")
 >>> deny: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": DENY
 LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <x@y>: don't like this host
 >>> using ACL "acl_9_9_9"
 >>> processing "accept"
@@ -288,6 +300,7 @@ LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <x@y>: don't like this host
 >>> check hosts = 9.9.9.0/26
 >>> host in "9.9.9.0/26"? yes (matched "9.9.9.0/26")
 >>> deny: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": DENY
 LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <a@b>: don't like this host
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -312,6 +325,7 @@ LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <a@b>: don't like this host
 >>> check hosts = 9.9.9.0/24
 >>> host in "9.9.9.0/24"? yes (matched "9.9.9.0/24")
 >>> accept: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": ACCEPT
 >>> using ACL "acl_9_9_9"
 >>> processing "accept"
 >>> check hosts = +ok9_hosts
@@ -326,6 +340,7 @@ LOG: H=[9.9.9.8] F=<x@y> rejected RCPT <a@b>: don't like this host
 >>> check hosts = 9.9.9.0/24
 >>> host in "9.9.9.0/24"? yes (matched "9.9.9.0/24")
 >>> accept: condition test succeeded in ACL "acl_9_9_9"
+>>> end of ACL "acl_9_9_9": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -357,6 +372,7 @@ LOG: H=[5.6.8.1] F=<x@y> rejected RCPT <y@x>
 >>> domain1 in "domain1"? yes (matched "domain1")
 >>> user1@domain1 in "user1@domain1 : domain2 : +ok_senders"? yes (matched "user1@domain1")
 >>> accept: condition test succeeded in ACL "acl_5_6_8"
+>>> end of ACL "acl_5_6_8": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "acl_5_6_8"
 >>> processing "accept"
@@ -374,6 +390,7 @@ LOG: H=[5.6.8.1] F=<user2@domain1> rejected RCPT <x@y>
 >>> domain2 in "domain2"? yes (matched "domain2")
 >>> user1@domain2 in "user1@domain1 : domain2 : +ok_senders"? yes (matched "domain2")
 >>> accept: condition test succeeded in ACL "acl_5_6_8"
+>>> end of ACL "acl_5_6_8": ACCEPT
 >>> using ACL "acl_5_6_8"
 >>> processing "accept"
 >>> check senders = user1@domain1 : domain2 : +ok_senders
@@ -382,12 +399,14 @@ LOG: H=[5.6.8.1] F=<user2@domain1> rejected RCPT <x@y>
 >>> ok@ok.ok in "ok@ok.ok"? yes (matched "ok@ok.ok")
 >>> ok@ok.ok in "user1@domain1 : domain2 : +ok_senders"? yes (matched "+ok_senders")
 >>> accept: condition test succeeded in ACL "acl_5_6_8"
+>>> end of ACL "acl_5_6_8": ACCEPT
 >>> using ACL "acl_5_6_8"
 >>> processing "accept"
 >>> check senders = user1@domain1 : domain2 : +ok_senders
 >>> ok.ok in "domain2"? no (end of list)
 >>> ok@ok.ok in "user1@domain1 : domain2 : +ok_senders"? yes (matched "+ok_senders" - cached)
 >>> accept: condition test succeeded in ACL "acl_5_6_8"
+>>> end of ACL "acl_5_6_8": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -401,11 +420,13 @@ LOG: H=[5.6.8.1] F=<user2@domain1> rejected RCPT <x@y>
 >>> check condition = ${if match{$local_part}{^x}{yes}{no}}
 >>>                 = yes
 >>> accept: condition test succeeded in ACL "acl_5_6_11"
+>>> end of ACL "acl_5_6_11": ACCEPT
 >>> using ACL "acl_5_6_11"
 >>> processing "accept"
 >>> check condition = ${if match{$local_part}{^x}{yes}{no}}
 >>>                 = yes
 >>> accept: condition test succeeded in ACL "acl_5_6_11"
+>>> end of ACL "acl_5_6_11": ACCEPT
 >>> using ACL "acl_5_6_11"
 >>> processing "accept"
 >>> check condition = ${if match{$local_part}{^x}{yes}{no}}
@@ -414,6 +435,7 @@ LOG: H=[5.6.8.1] F=<user2@domain1> rejected RCPT <x@y>
 >>> processing "deny"
 >>>   message: "local part of wrong type\n(quotes are literal)
 >>> deny: condition test succeeded in ACL "acl_5_6_11"
+>>> end of ACL "acl_5_6_11": DENY
 LOG: H=[5.6.11.1] F=<x@y> rejected RCPT <y2@y>: "local part of wrong type
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -434,7 +456,9 @@ LOG: H=[5.6.11.1] F=<x@y> rejected RCPT <y2@y>: "local part of wrong type
 >>> check domains = ok
 >>> ok in "ok"? yes (matched "ok")
 >>> accept: condition test succeeded in ACL "acl_5_6_12A"
+>>> end of ACL "acl_5_6_12A": ACCEPT
 >>> accept: condition test succeeded in ACL "acl_5_6_12"
+>>> end of ACL "acl_5_6_12": ACCEPT
 >>> using ACL "acl_5_6_12"
 >>> processing "accept"
 >>> check hosts = 5.6.12.1
@@ -465,6 +489,7 @@ LOG: H=[5.6.12.1] F=<x@y> rejected RCPT <x@y>: failed nested acl
 >>> accept: condition test failed in ACL "acl_5_6_12"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_5_6_12"
+>>> end of ACL "acl_5_6_12": ACCEPT
 >>> using ACL "acl_5_6_12"
 >>> processing "accept"
 >>> check hosts = 5.6.12.1
@@ -472,6 +497,7 @@ LOG: H=[5.6.12.1] F=<x@y> rejected RCPT <x@y>: failed nested acl
 >>> accept: condition test failed in ACL "acl_5_6_12"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_5_6_12"
+>>> end of ACL "acl_5_6_12": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -583,7 +609,9 @@ LOG: H=[8.8.8.8] F=<x@y> temporarily rejected RCPT <x@y>: ACL nested too deep: p
 >>> check local_parts = x
 >>> x in "x"? yes (matched "x")
 >>> accept: condition test succeeded in ACL "TESTSUITE/aux-fixed/0023.acl1"
+>>> end of ACL "TESTSUITE/aux-fixed/0023.acl1": ACCEPT
 >>> accept: condition test succeeded in ACL "acl_5_6_13"
+>>> end of ACL "acl_5_6_13": ACCEPT
 >>> using ACL "acl_5_6_13"
 >>> processing "accept"
 >>> check acl = TESTSUITE/aux-fixed/0023.acl1
@@ -630,6 +658,7 @@ LOG: H=[5.6.13.1] F=<x@y> rejected RCPT <x2@y>
 >>> DNS lookup for 13.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.13 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "acl_V4NET_11_12"
+>>> end of ACL "acl_V4NET_11_12": DENY
 LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x@y>: DNSLIST (rbl.test.ex: This is a test blacklisting message)
 >>> using ACL "acl_V4NET_11_12"
 >>> processing "deny"
@@ -641,6 +670,7 @@ LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x@y>: DNSLIST (rbl.test.ex: This
 >>> DNS lookup for 13.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.13 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "acl_V4NET_11_12"
+>>> end of ACL "acl_V4NET_11_12": DENY
 LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x1@y>: DNSLIST (rbl.test.ex: This is a test blacklisting message)
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -662,6 +692,7 @@ LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x1@y>: DNSLIST (rbl.test.ex: This
 >>> deny: condition test failed in ACL "acl_V4NET_11_12"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_V4NET_11_12"
+>>> end of ACL "acl_V4NET_11_12": ACCEPT
 >>> using ACL "acl_V4NET_11_12"
 >>> processing "deny"
 >>>   message: host in DNS list $dnslist_domain: $dnslist_text
@@ -674,6 +705,7 @@ LOG: H=[V4NET.11.12.13] F=<x@y> rejected RCPT <x1@y>: DNSLIST (rbl.test.ex: This
 >>> deny: condition test failed in ACL "acl_V4NET_11_12"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_V4NET_11_12"
+>>> end of ACL "acl_V4NET_11_12": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -751,6 +783,7 @@ LOG: H=[20.20.20.20] F=<userx@y> rejected RCPT <x1@y>: Unrouteable address
 >>> routed by r1 router
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "acl_20_20_20"
+>>> end of ACL "acl_20_20_20": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -793,6 +826,7 @@ LOG: H=[21.21.21.21] F=<userx@y> rejected RCPT <x1@y>: Unrouteable address
 >>> routed by r1 router
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "acl_21_21_21"
+>>> end of ACL "acl_21_21_21": ACCEPT
 >>> using ACL "acl_21_21_21"
 >>> processing "accept"
 >>> check verify = sender
@@ -867,6 +901,7 @@ LOG: H=[22.22.22.22] F=<userx@y> rejected RCPT <userx@y>
 >>> y in "y"? yes (matched "y")
 >>> x@y in "x@y"? yes (matched "x@y")
 >>> accept: condition test succeeded in ACL "acl_22_22_22"
+>>> end of ACL "acl_22_22_22": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -889,6 +924,7 @@ LOG: H=[22.22.22.22] F=<userx@y> rejected RCPT <userx@y>
 >>> no more routers
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "acl_23_23_23"
+>>> end of ACL "acl_23_23_23": DENY
 LOG: H=[23.23.23.0] sender verify fail for <x@y>: Unrouteable address
 LOG: H=[23.23.23.0] F=<x@y> rejected RCPT <userx@y>: Sender verify failed
 >>> using ACL "acl_23_23_23"
@@ -907,6 +943,7 @@ LOG: H=[23.23.23.0] F=<x@y> rejected RCPT <userx@y>: Sender verify failed
 >>> deny: condition test failed in ACL "acl_23_23_23"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_23_23_23"
+>>> end of ACL "acl_23_23_23": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -922,6 +959,7 @@ LOG: H=[23.23.23.0] F=<x@y> rejected RCPT <userx@y>: Sender verify failed
 >>> deny: condition test failed in ACL "acl_23_23_23"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_23_23_23"
+>>> end of ACL "acl_23_23_23": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -971,6 +1009,7 @@ LOG: H=[25.25.25.25] F=<x@y> rejected RCPT <x@y>
 >>> deny: condition test failed in ACL "acl_26_26_26"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_26_26_26"
+>>> end of ACL "acl_26_26_26": ACCEPT
 >>> using ACL "acl_26_26_26"
 >>> processing "deny"
 >>> check senders = :
@@ -979,6 +1018,7 @@ LOG: H=[25.25.25.25] F=<x@y> rejected RCPT <x@y>
 >>> check condition = ${if > {$recipients_count}{0}{yes}{no}}
 >>>                 = yes
 >>> deny: condition test succeeded in ACL "acl_26_26_26"
+>>> end of ACL "acl_26_26_26": DENY
 LOG: H=[26.26.26.26] F=<> rejected RCPT <y@y>: bounce messages can have only one recipient
 >>> using ACL "acl_26_26_26"
 >>> processing "deny"
@@ -988,6 +1028,7 @@ LOG: H=[26.26.26.26] F=<> rejected RCPT <y@y>: bounce messages can have only one
 >>> check condition = ${if > {$recipients_count}{0}{yes}{no}}
 >>>                 = yes
 >>> deny: condition test succeeded in ACL "acl_26_26_26"
+>>> end of ACL "acl_26_26_26": DENY
 LOG: H=[26.26.26.26] F=<> rejected RCPT <z@y>: bounce messages can have only one recipient
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -1004,6 +1045,7 @@ LOG: H=[26.26.26.26] F=<> rejected RCPT <z@y>: bounce messages can have only one
 >>> deny: condition test failed in ACL "acl_27_27_27"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_27_27_27"
+>>> end of ACL "acl_27_27_27": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1017,11 +1059,13 @@ LOG: H=[26.26.26.26] F=<> rejected RCPT <z@y>: bounce messages can have only one
 >>> check sender_domains = : okdomain
 >>>  in ": okdomain"? yes (matched "")
 >>> accept: condition test succeeded in ACL "acl_28_28_28"
+>>> end of ACL "acl_28_28_28": ACCEPT
 >>> using ACL "acl_28_28_28"
 >>> processing "accept"
 >>> check sender_domains = : okdomain
 >>> okdomain in ": okdomain"? yes (matched "okdomain")
 >>> accept: condition test succeeded in ACL "acl_28_28_28"
+>>> end of ACL "acl_28_28_28": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "acl_28_28_28"
 >>> processing "accept"
@@ -1058,6 +1102,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> require: condition test succeeded in ACL "acl_V4NET_0_0"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_V4NET_0_0"
+>>> end of ACL "acl_V4NET_0_0": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1073,6 +1118,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> looking up host name for V4NET.0.0.97
 LOG: no host name found for IP address V4NET.0.0.97
 >>> require: condition test failed in ACL "acl_V4NET_0_0"
+>>> end of ACL "acl_V4NET_0_0": not OK
 LOG: H=[V4NET.0.0.97] F=<> rejected RCPT <x@y>: host lookup failed for reverse lookup check (failed to find host name from IP address)
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -1091,6 +1137,7 @@ LOG: H=[V4NET.0.0.97] F=<> rejected RCPT <x@y>: host lookup failed for reverse l
 >>> DNS lookup for localhost.test.ex succeeded (yielding 127.0.0.1)
 >>> => that means localhost is listed at test.ex
 >>> deny: condition test succeeded in ACL "acl_29_29_29"
+>>> end of ACL "acl_29_29_29": DENY
 LOG: H=[29.29.29.29] F=<a@localhost> rejected RCPT <x@y>
 >>> using ACL "acl_29_29_29"
 >>> processing "deny"
@@ -1103,6 +1150,7 @@ LOG: H=[29.29.29.29] F=<a@localhost> rejected RCPT <x@y>
 >>> deny: condition test failed in ACL "acl_29_29_29"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_29_29_29"
+>>> end of ACL "acl_29_29_29": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1121,6 +1169,7 @@ LOG: H=[29.29.29.29] F=<a@localhost> rejected RCPT <x@y>
 >>> DNS lookup for ten-1.test.ex succeeded (yielding V4NET.0.0.1)
 >>> => that means ten-1 is listed at test.ex
 >>> deny: condition test succeeded in ACL "acl_30_30_30"
+>>> end of ACL "acl_30_30_30": DENY
 LOG: H=[30.30.30.30] F=<a@ten-1> rejected RCPT <x@y>: domain=test.ex
 >>> using ACL "acl_30_30_30"
 >>> processing "deny"
@@ -1135,6 +1184,7 @@ LOG: H=[30.30.30.30] F=<a@ten-1> rejected RCPT <x@y>: domain=test.ex
 >>> deny: condition test failed in ACL "acl_30_30_30"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_30_30_30"
+>>> end of ACL "acl_30_30_30": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "acl_30_30_30"
 >>> processing "deny"
@@ -1146,6 +1196,7 @@ LOG: H=[30.30.30.30] F=<a@ten-1> rejected RCPT <x@y>: domain=test.ex
 >>> DNS lookup for 13.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means 13.12.11.V4NET.rbl is listed at test.ex
 >>> deny: condition test succeeded in ACL "acl_30_30_30"
+>>> end of ACL "acl_30_30_30": DENY
 LOG: H=[30.30.30.30] F=<a@13.12.11.V4NET.rbl> rejected RCPT <x@y>: domain=test.ex
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -1164,6 +1215,7 @@ LOG: dnslist query is too long (ignored): y+extra+extra+extra+extra+extra+extra+
 >>> deny: condition test failed in ACL "acl_31_31_31"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_31_31_31"
+>>> end of ACL "acl_31_31_31": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1235,6 +1287,7 @@ LOG: DNS list lookup defer (probably timeout) for 1.44.44.44.test.again.dns: ret
 LOG: H=[44.44.44.1] Warning: ACL "warn" statement skipped: condition test deferred
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_44_44_44"
+>>> end of ACL "acl_44_44_44": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -1253,6 +1306,7 @@ LOG: H=[44.44.44.1] Warning: ACL "warn" statement skipped: condition test deferr
 >>> accept: condition test failed in ACL "TESTSUITE/aux-fixed/0023.acl2"
 >>> end of ACL "TESTSUITE/aux-fixed/0023.acl2": implicit DENY
 >>> accept: condition test succeeded in ACL "acl_60_60_60"
+>>> end of ACL "acl_60_60_60": ACCEPT
 >>> using ACL "acl_60_60_60"
 >>> processing "accept"
 >>> check !acl = TESTSUITE/aux-fixed/0023.acl2
@@ -1263,6 +1317,7 @@ LOG: H=[44.44.44.1] Warning: ACL "warn" statement skipped: condition test deferr
 >>> check local_parts = a
 >>> a in "a"? yes (matched "a")
 >>> accept: condition test succeeded in ACL "TESTSUITE/aux-fixed/0023.acl2"
+>>> end of ACL "TESTSUITE/aux-fixed/0023.acl2": ACCEPT
 >>> accept: condition test failed in ACL "acl_60_60_60"
 >>> end of ACL "acl_60_60_60": implicit DENY
 LOG: H=[60.60.60.60] F=<x@y> rejected RCPT <a@b>
diff --git a/test/stderr/0026 b/test/stderr/0026
index 328b169bd..26c27365d 100644
--- a/test/stderr/0026
+++ b/test/stderr/0026
@@ -8,6 +8,7 @@
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "acl_data"
 >>> processing "deny"
@@ -18,6 +19,7 @@
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "acl_data"
+>>> end of ACL "acl_data": not OK
 LOG: 10HmbH-0005vi-00 H=[10.0.0.0] F=<x@y> rejected after DATA: domain missing or malformed: failing address in "From:" header is: @
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -29,6 +31,7 @@ LOG: 10HmbH-0005vi-00 H=[10.0.0.0] F=<x@y> rejected after DATA: domain missing o
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "acl_data"
 >>> processing "deny"
@@ -36,4 +39,5 @@ LOG: 10HmbH-0005vi-00 H=[10.0.0.0] F=<x@y> rejected after DATA: domain missing o
 >>> check condition = ${if match{$message_body}{trigger}{yes}{no}}
 >>>                 = yes
 >>> deny: condition test succeeded in ACL "acl_data"
+>>> end of ACL "acl_data": DENY
 LOG: 10HmbI-0005vi-00 H=[10.0.0.0] F=<x@y> rejected after DATA: body contains trigger
diff --git a/test/stderr/0038 b/test/stderr/0038
index 727c1c6c3..2cde5de35 100644
--- a/test/stderr/0038
+++ b/test/stderr/0038
@@ -21,6 +21,7 @@
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -32,6 +33,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 LOG: 10HmaX-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaX-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -55,6 +57,7 @@ LOG: 10HmaX-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=2.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -66,6 +69,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=2.0 sender_rate_limit=
 LOG: 10HmaY-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=2.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaY-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -90,6 +94,7 @@ LOG: 10HmaY-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -101,6 +106,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 LOG: 10HmaZ-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmaZ-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -124,6 +130,7 @@ LOG: 10HmaZ-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=2.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -135,6 +142,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=2.0 sender_rate_limit=
 LOG: 10HmbA-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=2.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbA-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -159,6 +167,7 @@ LOG: 10HmbA-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> using ACL "check_rcpt"
 >>> processing "warn"
 >>> check ratelimit = 0/1h/per_rcpt
@@ -171,6 +180,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 >>> warn: condition test succeeded in ACL "check_rcpt"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> using ACL "check_rcpt"
 >>> processing "warn"
 >>> check ratelimit = 0/1h/per_rcpt
@@ -183,6 +193,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 >>> warn: condition test succeeded in ACL "check_rcpt"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -196,6 +207,7 @@ LOG: H=(test.ex) [V4NET.9.8.7] Warning: RCPT: sender_rate=1.0 sender_rate_limit=
 LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] Warning: DATA: sender_rate=3.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -223,6 +235,7 @@ LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> warn: condition test failed in ACL "check_rcpt2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt2"
+>>> end of ACL "check_rcpt2": ACCEPT
 >>> using ACL "check_rcpt2"
 >>> processing "warn"
 >>> check ratelimit = 1/1m/per_rcpt/noupdate
@@ -239,6 +252,7 @@ LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 >>> warn: condition test failed in ACL "check_rcpt2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt2"
+>>> end of ACL "check_rcpt2": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_data"
 >>> processing "warn"
@@ -253,4 +267,5 @@ LOG: 10HmbB-0005vi-00 H=(test.ex) [V4NET.9.8.7] F=<> rejected after DATA
 LOG: 10HmbC-0005vi-00 H=(test.ex) [V4NET.9.8.6] Warning: DATA: sender_rate=19.0 sender_rate_limit=0 sender_rate_period=1h
 >>> processing "deny"
 >>> deny: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": DENY
 LOG: 10HmbC-0005vi-00 H=(test.ex) [V4NET.9.8.6] F=<> rejected after DATA
diff --git a/test/stderr/0041 b/test/stderr/0041
index 621936924..4aacae883 100644
--- a/test/stderr/0041
+++ b/test/stderr/0041
@@ -30,6 +30,7 @@ LOG: H=[1.1.1.1] rejected EXPN postmaster
 >>> check hosts = 2.2.2.2
 >>> host in "2.2.2.2"? yes (matched "2.2.2.2")
 >>> accept: condition test succeeded in ACL "check_expn"
+>>> end of ACL "check_expn": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing list@test.ex
 >>> calling system_aliases router
diff --git a/test/stderr/0042 b/test/stderr/0042
index e3ee2b7a3..63eb0fbf8 100644
--- a/test/stderr/0042
+++ b/test/stderr/0042
@@ -9,6 +9,7 @@
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing userx@test.ex
 >>> test.ex in "test.ex"? yes (matched "test.ex")
@@ -19,6 +20,7 @@
 >>> routed by localuser router
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing junkjunk@test.ex
 >>> test.ex in "test.ex"? yes (matched "test.ex")
@@ -29,6 +31,7 @@
 LOG: VRFY failed for junkjunk@test.ex H=[1.1.1.1]
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing expan@test.ex
 >>> test.ex in "test.ex"? yes (matched "test.ex")
diff --git a/test/stderr/0043 b/test/stderr/0043
index 31ba8d9ce..6ea0099d2 100644
--- a/test/stderr/0043
+++ b/test/stderr/0043
@@ -25,6 +25,7 @@
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=(exim.test.ex) [V4NET.0.0.97] sender verify fail for <junkjunk@exim.test.ex>: Unrouteable address
 LOG: H=(exim.test.ex) [V4NET.0.0.97] F=<junkjunk@exim.test.ex> rejected RCPT <postmaster@exim.test.ex>: Sender verify failed
 LOG: H=(exim.test.ex) [V4NET.0.0.97] incomplete transaction (RSET) from <junkjunk@exim.test.ex>
@@ -77,6 +78,7 @@ LOG: H=(exim.test.ex) [V4NET.0.0.97] incomplete transaction (RSET) from <junkjun
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -99,6 +101,7 @@ LOG: H=(exim.test.ex) [V4NET.0.0.97] incomplete transaction (RSET) from <junkjun
 >>> no more routers
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.0.0.97] F=<postmaster@exim.test.ex> rejected RCPT junkjunk@exim.test.ex: Unrouteable address
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -120,5 +123,6 @@ LOG: H=(exim.test.ex) [V4NET.0.0.97] F=<postmaster@exim.test.ex> rejected RCPT j
 >>> system_aliases router forced address failure
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.0.0.97] F=<postmaster@exim.test.ex> rejected RCPT fail@exim.test.ex: this alias is forced to fail
 LOG: H=(exim.test.ex) [V4NET.0.0.97] incomplete transaction (QUIT) from <postmaster@exim.test.ex> for postmaster@exim.test.ex
diff --git a/test/stderr/0044 b/test/stderr/0044
index d8b7ebe80..71453d636 100644
--- a/test/stderr/0044
+++ b/test/stderr/0044
@@ -18,6 +18,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -39,6 +40,7 @@
 >>> DNS lookup for 13.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.13 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.11.12.13] F=<postmaster@exim.test.ex> rejected RCPT list@exim.test.ex: host is listed in rbl.test.ex
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.13] P=esmtp S=sss
@@ -66,5 +68,6 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> there.test.ex in "*"? yes (matched "*")
 >>> myfriend@there.test.ex in "myfriend@*"? yes (matched "myfriend@*")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= myfriend@there.test.ex H=(exim.test.ex) [V4NET.11.12.13] P=esmtp S=sss
diff --git a/test/stderr/0056 b/test/stderr/0056
index 6d75121b3..b23e4ca71 100644
--- a/test/stderr/0056
+++ b/test/stderr/0056
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -23,6 +24,7 @@
 >>> otherhost.example.com in "*"? yes (matched "*")
 >>> otherhost.example.com in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -34,4 +36,5 @@
 >>> 3rdhost.example.com in "*"? yes (matched "*")
 >>> 3rdhost.example.com in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
diff --git a/test/stderr/0057 b/test/stderr/0057
index 483ca182c..958a7cb67 100644
--- a/test/stderr/0057
+++ b/test/stderr/0057
@@ -13,6 +13,7 @@
 >>> test.ex in "test.ex : myhost.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> anotherhost.example.com in percent_hack_domains? no (end of list)
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -28,6 +29,7 @@
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 >>> 3rdhost.example.com in percent_hack_domains? no (end of list)
 >>> using ACL "check_recipient"
@@ -44,5 +46,6 @@ LOG: H=[V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@another
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@3rdhost.example.com>: relay not permitted
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
diff --git a/test/stderr/0058 b/test/stderr/0058
index 66aa2539e..1698bc1bc 100644
--- a/test/stderr/0058
+++ b/test/stderr/0058
@@ -17,6 +17,7 @@
 >>> host in "*"? yes (matched "*")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -28,4 +29,5 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> check hosts = +relay_hosts
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts" - cached)
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
diff --git a/test/stderr/0059 b/test/stderr/0059
index 34fffb580..9028e512b 100644
--- a/test/stderr/0059
+++ b/test/stderr/0059
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -31,5 +32,6 @@
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
diff --git a/test/stderr/0060 b/test/stderr/0060
index 7e3e5672f..4d6fc412b 100644
--- a/test/stderr/0060
+++ b/test/stderr/0060
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -31,6 +32,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "! V4NET.255.0.1 : !V4NET.255.0.2 : !TESTSUITE/aux-var/0060.d1 : ! TESTSUITE/aux-var/0060.d2 : ten-1.test.ex : ten-5-6.test.ex"? yes (matched "ten-1.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -46,6 +48,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -72,6 +75,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.2] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -88,6 +92,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.2] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -111,6 +116,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "! V4NET.255.0.1 : !V4NET.255.0.2 : !TESTSUITE/aux-var/0060.d1 : ! TESTSUITE/aux-var/0060.d2 : ten-1.test.ex : ten-5-6.test.ex"? yes (matched "ten-5-6.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -126,6 +132,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -149,6 +156,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "! V4NET.255.0.1 : !V4NET.255.0.2 : !TESTSUITE/aux-var/0060.d1 : ! TESTSUITE/aux-var/0060.d2 : ten-1.test.ex : ten-5-6.test.ex"? yes (matched "ten-5-6.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.6] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -164,6 +172,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.6] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -183,6 +192,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.6] P=smtp S=sss
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.255.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -199,6 +209,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.1] P=smtp S=s
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -218,6 +229,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.1] P=smtp S=s
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.255.0.2] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -234,6 +246,7 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.2] P=smtp S=s
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -253,6 +266,7 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.2] P=smtp S=s
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.255.0.3] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.3] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -269,6 +283,7 @@ LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.3] P=smtp S=s
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -288,5 +303,6 @@ LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.3] P=smtp S=s
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.255.0.4] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbE-0005vi-00 <= userx@somehost.example.com H=[V4NET.255.0.4] P=smtp S=sss
diff --git a/test/stderr/0061 b/test/stderr/0061
index 8e178fbc5..32c5f35c6 100644
--- a/test/stderr/0061
+++ b/test/stderr/0061
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -31,6 +32,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "@"? yes (matched "@")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -46,6 +48,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.1] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -68,5 +71,6 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.2] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.2] P=smtp S=sss
diff --git a/test/stderr/0062 b/test/stderr/0062
index 7343d7df2..38648d606 100644
--- a/test/stderr/0062
+++ b/test/stderr/0062
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -39,10 +40,12 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 >>> using ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -58,6 +61,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -82,9 +86,11 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "*-2.test.ex : *-3-alias.test.ex"? yes (matched "*-2.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=ten-2.test.ex [V4NET.0.0.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -100,6 +106,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=ten-2.test.ex [V4NET.0.0.2
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -130,7 +137,9 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "*-2.test.ex : *-3-alias.test.ex"? yes (matched "*-3-alias.test.ex")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=ten-3.test.ex [V4NET.0.0.3] P=smtp S=sss
diff --git a/test/stderr/0063 b/test/stderr/0063
index 2eb0b3160..16cf4808a 100644
--- a/test/stderr/0063
+++ b/test/stderr/0063
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -39,6 +40,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -55,6 +57,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -79,4 +82,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "^[^\d]+2"? yes (matched "^[^\d]+2")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=ten-2.test.ex [V4NET.0.0.2] P=smtp S=sss
diff --git a/test/stderr/0064 b/test/stderr/0064
index 6790f9495..47de0e789 100644
--- a/test/stderr/0064
+++ b/test/stderr/0064
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -39,6 +40,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -55,6 +57,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -79,4 +82,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "lsearch;TESTSUITE/aux-fixed/0064.hosts"? yes (matched "lsearch;TESTSUITE/aux-fixed/0064.hosts")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=ten-2.test.ex [V4NET.0.0.2] P=smtp S=sss
diff --git a/test/stderr/0065 b/test/stderr/0065
index ae6fc7f97..325ca98e7 100644
--- a/test/stderr/0065
+++ b/test/stderr/0065
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -28,6 +29,7 @@
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "1.2.3.4")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -43,6 +45,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -62,6 +65,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.5] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -78,6 +82,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -94,6 +99,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "1.2.0.0/16")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -109,6 +115,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -128,6 +135,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.3.2.4] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -144,6 +152,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -160,6 +169,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "net16-lsearch;TESTSUITE/aux-fixed/0065.nets")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -175,6 +185,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -191,6 +202,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "net24-lsearch;TESTSUITE/aux-fixed/0065.nets")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -206,6 +218,7 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=ss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -222,4 +235,5 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=ss
 >>> host in "1.2.3.4 : !1.2.3.0/24 : 1.2.0.0/16 : net16-lsearch;TESTSUITE/aux-fixed/0065.nets : net24-lsearch;TESTSUITE/aux-fixed/0065.nets : net-lsearch;TESTSUITE/aux-fixed/0065.nets"? yes (matched "net-lsearch;TESTSUITE/aux-fixed/0065.nets")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=[192.153.98.4] P=smtp S=sss
diff --git a/test/stderr/0066 b/test/stderr/0066
index 9dbb6f08b..b86c2d553 100644
--- a/test/stderr/0066
+++ b/test/stderr/0066
@@ -12,6 +12,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -34,6 +35,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "1.2.3.4" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -49,6 +51,7 @@ LOG: 10HmaX-0005vi-00 <= userx@somehost.example.com H=[1.2.3.4] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -74,6 +77,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.5] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -90,6 +94,7 @@ LOG: 10HmaY-0005vi-00 <= userx@somehost.example.com H=[1.2.3.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -112,6 +117,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "1.2.0.0/16" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -127,6 +133,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@somehost.example.com H=[1.2.4.5] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -155,6 +162,7 @@ LOG: no host name found for IP address 1.3.2.4
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.3.2.4] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -171,6 +179,7 @@ LOG: 10HmbA-0005vi-00 <= userx@somehost.example.com H=[1.3.2.4] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -193,6 +202,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "net16-lsearch;TESTSUITE/aux-fixed/0066.nets" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -208,6 +218,7 @@ LOG: 10HmbB-0005vi-00 <= userx@somehost.example.com H=[131.111.8.2] P=smtp S=sss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -230,6 +241,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "net24-lsearch;TESTSUITE/aux-fixed/0066.nets" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -245,6 +257,7 @@ LOG: 10HmbC-0005vi-00 <= userx@somehost.example.com H=[192.152.98.3] P=smtp S=ss
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -275,6 +288,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? yes (matched "*-1.test.ex" in TESTSUITE/aux-var/0066.hostnets)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -290,6 +304,7 @@ LOG: 10HmbD-0005vi-00 <= userx@somehost.example.com H=ten-1.test.ex [V4NET.0.0.1
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -312,6 +327,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.11.12.13] F=<userx@somehost.example.com> rejected RCPT <userx@anotherhost.example.com>: relay not permitted
 LOG: 10HmbE-0005vi-00 <= userx@somehost.example.com H=[V4NET.11.12.13] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -328,6 +344,7 @@ LOG: 10HmbE-0005vi-00 <= userx@somehost.example.com H=[V4NET.11.12.13] P=smtp S=
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +local_domains
@@ -350,4 +367,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> host in "!TESTSUITE/aux-fixed/0066.nothosts : TESTSUITE/aux-var/0066.hostnets"? no (matched "!ten-3.test.ex" in TESTSUITE/aux-fixed/0066.nothosts)
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmbF-0005vi-00 <= userx@somehost.example.com H=[V4NET.0.0.3] P=smtp S=sss
diff --git a/test/stderr/0067 b/test/stderr/0067
index b63242f08..252f07e5a 100644
--- a/test/stderr/0067
+++ b/test/stderr/0067
@@ -31,6 +31,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -54,6 +55,7 @@
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -69,6 +71,7 @@
 >>> b.c in "b.c"? yes (matched "b.c")
 >>> y@b.c in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "*@b.c")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<y@b.c> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -84,6 +87,7 @@ LOG: H=[1.2.3.4] F=<y@b.c> rejected RCPT <x@test.ex>
 >>> xy.z in "b.c"? no (end of list)
 >>> philip@xy.z in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "^(phil|quil)[^@]*@")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<philip@xy.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -99,6 +103,7 @@ LOG: H=[1.2.3.4] F=<philip@xy.z> rejected RCPT <x@test.ex>
 >>> patch.work in "b.c"? no (end of list)
 >>> quilt@patch.work in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "^(phil|quil)[^@]*@")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<quilt@patch.work> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -123,6 +128,7 @@ LOG: H=[1.2.3.4] F=<quilt@patch.work> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -137,6 +143,7 @@ LOG: H=[1.2.3.4] F=<quilt@patch.work> rejected RCPT <x@test.ex>
 >>> abc.def in "b.c"? no (end of list)
 >>> xx@abc.def in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<xx@abc.def> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -152,6 +159,7 @@ LOG: H=[1.2.3.4] F=<xx@abc.def> rejected RCPT <x@test.ex>
 >>> d.e.f in "b.c"? no (end of list)
 >>> abc@d.e.f in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<abc@d.e.f> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -178,6 +186,7 @@ LOG: H=[1.2.3.4] F=<abc@d.e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -202,6 +211,7 @@ LOG: H=[1.2.3.4] F=<abc@d.e.f> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -216,6 +226,7 @@ LOG: H=[1.2.3.4] F=<abc@d.e.f> rejected RCPT <x@test.ex>
 >>> z.z in "b.c"? no (end of list)
 >>> abc@z.z in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<abc@z.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -242,6 +253,7 @@ LOG: H=[1.2.3.4] F=<abc@z.z> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -256,6 +268,7 @@ LOG: H=[1.2.3.4] F=<abc@z.z> rejected RCPT <x@test.ex>
 >>> z.z in "b.c"? no (end of list)
 >>> xyz@z.z in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<xyz@z.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -271,6 +284,7 @@ LOG: H=[1.2.3.4] F=<xyz@z.z> rejected RCPT <x@test.ex>
 >>> p.q.r in "b.c"? no (end of list)
 >>> 12345678@p.q.r in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<12345678@p.q.r> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -286,6 +300,7 @@ LOG: H=[1.2.3.4] F=<12345678@p.q.r> rejected RCPT <x@test.ex>
 >>> z.z in "b.c"? no (end of list)
 >>> 12345678@z.z in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<12345678@z.z> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -313,6 +328,7 @@ LOG: H=[1.2.3.4] F=<12345678@z.z> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -334,6 +350,7 @@ LOG: H=[1.2.3.4] F=<12345678@z.z> rejected RCPT <x@test.ex>
 >>> m.n.o in "m.n.o"? yes (matched "m.n.o")
 >>> 1234@m.n.o in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "1234@m.n.o")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<1234@m.n.o> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -345,6 +362,7 @@ LOG: H=[1.2.3.4] F=<1234@m.n.o> rejected RCPT <userx@test.ex>
 >>> test.ex in "*"? yes (matched "*")
 >>> postmaster@test.ex in "postmaster@*"? yes (matched "postmaster@*")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -355,6 +373,7 @@ LOG: H=[1.2.3.4] F=<1234@m.n.o> rejected RCPT <userx@test.ex>
 >>> myhost.ex in "*"? yes (matched "*")
 >>> postmaster@myhost.ex in "postmaster@*"? yes (matched "postmaster@*")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -376,6 +395,7 @@ LOG: H=[1.2.3.4] F=<1234@m.n.o> rejected RCPT <userx@test.ex>
 >>> a.b.c in "a.b.c"? yes (matched "a.b.c")
 >>> rr01@a.b.c in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "rr01@a.b.c" in TESTSUITE/aux-fixed/0067.rejrec)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<rr01@a.b.c> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -402,6 +422,7 @@ LOG: H=[1.2.3.4] F=<rr01@a.b.c> rejected RCPT <userx@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -422,6 +443,7 @@ LOG: H=[1.2.3.4] F=<rr01@a.b.c> rejected RCPT <userx@test.ex>
 >>> check senders = 1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec
 >>> qq@a.b.c in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "^qq" in TESTSUITE/aux-fixed/0067.rejrec)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<qq@a.b.c> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -443,6 +465,7 @@ LOG: H=[1.2.3.4] F=<qq@a.b.c> rejected RCPT <userx@test.ex>
 >>> check senders = 1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec
 >>> !excl@z.z in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "^!excl" in TESTSUITE/aux-fixed/0067.rejrec)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<!excl@z.z> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -465,6 +488,7 @@ LOG: H=[1.2.3.4] F=<!excl@z.z> rejected RCPT <userx@test.ex>
 >>> y.p.s in "y.p.s"? yes (matched "y.p.s")
 >>> sh#rp@y.p.s in "1234@m.n.o : TESTSUITE/aux-fixed/0067.rejrec"? yes (matched "sh#rp@y.p.s" in TESTSUITE/aux-fixed/0067.rejrec)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<sh#rp@y.p.s> rejected RCPT <userx@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -491,6 +515,7 @@ LOG: H=[1.2.3.4] F=<sh#rp@y.p.s> rejected RCPT <userx@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -505,6 +530,7 @@ LOG: H=[1.2.3.4] F=<sh#rp@y.p.s> rejected RCPT <userx@test.ex>
 >>> xx.yy in "b.c"? no (end of list)
 >>> xyzbc@xx.yy in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<xyzbc@xx.yy> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -520,6 +546,7 @@ LOG: H=[1.2.3.4] F=<xyzbc@xx.yy> rejected RCPT <x@test.ex>
 >>> xx.yy in "b.c"? no (end of list)
 >>> aabc@xx.yy in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<aabc@xx.yy> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -546,6 +573,7 @@ LOG: H=[1.2.3.4] F=<aabc@xx.yy> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -561,6 +589,7 @@ LOG: H=[1.2.3.4] F=<aabc@xx.yy> rejected RCPT <x@test.ex>
 >>> bb.cc in "bb.cc"? yes (matched "bb.cc")
 >>> y@bb.cc in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "*@bb.cc")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<y@bb.cc> rejected RCPT <x@test.ex>
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -589,6 +618,7 @@ LOG: H=[1.2.3.4] F=<y@bb.cc> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -614,6 +644,7 @@ LOG: H=[1.2.3.4] F=<y@bb.cc> rejected RCPT <x@test.ex>
 >>> test.ex in "test.ex : myhost.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -630,4 +661,5 @@ LOG: H=[1.2.3.4] F=<y@bb.cc> rejected RCPT <x@test.ex>
 >>> bbb.ccc in "bbb.ccc"? yes (matched "bbb.ccc")
 >>> z@bbb.ccc in "!x@b.c : *@b.c :!^philip@a.b.c : ^(phil|quil)[^@]*@ :!yy@lsearch;TESTSUITE/aux-fixed/0067.rej.lsearch :lsearch*@;TESTSUITE/aux-fixed/0067.rej.lsearch :@@lsearch*;TESTSUITE/aux-fixed/0067.rej.bydomain : ! x@bb.cc : *@bb.cc :! TESTSUITE/aux-fixed/0067.not1 : !TESTSUITE/aux-fixed/0067.not2 : bbb.ccc"? yes (matched "bbb.ccc")
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[1.2.3.4] F=<z@bbb.ccc> rejected RCPT <x@test.ex>
diff --git a/test/stderr/0068 b/test/stderr/0068
index 8966ab413..fe81f4922 100644
--- a/test/stderr/0068
+++ b/test/stderr/0068
@@ -8,12 +8,17 @@
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 LOG: too many recipients: message rejected: sender=<x@y> H=[V4NET.10.10.10]
diff --git a/test/stderr/0069 b/test/stderr/0069
index 2355b74cd..0772c28b1 100644
--- a/test/stderr/0069
+++ b/test/stderr/0069
@@ -23,6 +23,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> check hosts = +include_unknown : ^ten-1\\.test\\.ex
 >>> host in "+include_unknown : ^ten-1\.test\.ex"? yes (matched "^ten-1\.test\.ex")
 >>> deny: condition test succeeded in ACL "check_recipientx"
+>>> end of ACL "check_recipientx": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<x@y> rejected RCPT <x@test.ex>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -47,6 +48,7 @@ LOG: failed to find host name for V4NET.0.0.13: accepted by +include_unknown
 >>> host in "+include_unknown : ^ten-1\.test\.ex"? yes (failed to find host name for V4NET.0.0.13)
 LOG: failed to find host name for V4NET.0.0.13: accepted by +include_unknown
 >>> deny: condition test succeeded in ACL "check_recipientx"
+>>> end of ACL "check_recipientx": DENY
 LOG: H=[V4NET.0.0.13] F=<userx@myhost.test.ex> rejected RCPT <x@test.ex>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -70,6 +72,7 @@ LOG: no IP address found for host non.existent.invalid (during SMTP connection f
 >>> processing "deny"
 >>>   message: "Denied"
 >>> deny: condition test succeeded in ACL "check_recipienty"
+>>> end of ACL "check_recipienty": DENY
 LOG: H=[V4NET.0.0.13] F=<userx@test.ex> rejected RCPT <y@test.ex>: "Denied"
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -91,6 +94,7 @@ LOG: no IP address found for host non.existent.invalid (during SMTP connection f
 >>> failed to find IP address for non.existent.invalid: item ignored by +ignore_unknown
 >>> host in "+ignore_unknown : non.existent.invalid : V4NET.0.0.13"? yes (matched "V4NET.0.0.13")
 >>> accept: condition test succeeded in ACL "check_recipientz"
+>>> end of ACL "check_recipientz": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -114,6 +118,7 @@ LOG: list matching forced to fail: failed to find IP address for non.existent.in
 >>> processing "deny"
 >>>   message: "Denied"
 >>> deny: condition test succeeded in ACL "check_recipienty"
+>>> end of ACL "check_recipienty": DENY
 LOG: H=[V4NET.0.0.13] F=<userx@test.ex> rejected RCPT <y@test.ex>: "Denied"
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -137,6 +142,7 @@ LOG: failed to find host name for V4NET.0.0.13: accepted by +include_unknown
 >>> test.again.dns in dns_again_means_nonexist? no (option unset)
 LOG: DNS lookup of test.again.dns deferred: accepted by +include_defer
 >>> deny: condition test succeeded in ACL "check_recipienta"
+>>> end of ACL "check_recipienta": DENY
 LOG: H=[V4NET.0.0.13] F=<userx@myhost.test.ex> rejected RCPT <a@test.ex>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -176,3 +182,4 @@ LOG: failed to find host name for V4NET.0.0.13: accepted by +include_unknown
 >>> DNS lookup of test.again.dns deferred: item ignored by +ignore_defer
 >>> host in "+ignore_defer : test.again.dns : V4NET.0.0.13"? yes (matched "V4NET.0.0.13")
 >>> accept: condition test succeeded in ACL "check_recipientc"
+>>> end of ACL "check_recipientc": ACCEPT
diff --git a/test/stderr/0070 b/test/stderr/0070
index bb6e554a8..ebab42f3e 100644
--- a/test/stderr/0070
+++ b/test/stderr/0070
@@ -33,6 +33,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> verifying EHLO/HELO argument "NULL"
 >>> no EHLO/HELO command was issued
 >>> require: condition test failed in ACL "rcpt"
+>>> end of ACL "rcpt": not OK
 LOG: H=[V4NET.0.0.13] F=<userx@cus.cam.ac.uk> rejected RCPT <a@b>: helo not verified
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -59,6 +60,7 @@ MUNGED: ::1 will be omitted in what follows
 >>>   message: helo not verified
 >>> check verify = helo
 >>> require: condition test failed in ACL "rcpt"
+>>> end of ACL "rcpt": not OK
 LOG: H=([V4NET.0.0.1]) [V4NET.0.0.2] F=<a@b> rejected RCPT <c@d>: helo not verified
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -88,6 +90,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: helo did verify
 >>> deny: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": DENY
 LOG: H=([V4NET.0.0.2]) [V4NET.0.0.2] F=<a@b> rejected RCPT <c@d>: helo did verify
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -213,6 +216,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> check verify = helo
 >>> verifying EHLO/HELO argument "[V4NET.0.0.99]"
 >>> require: condition test failed in ACL "rcpt"
+>>> end of ACL "rcpt": not OK
 LOG: H=([V4NET.0.0.99]) [V4NET.0.0.13] F=<a@b> rejected RCPT <c@d>: helo not verified
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -242,6 +246,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: helo did verify
 >>> deny: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": DENY
 LOG: H=([V4NET.0.0.13]) [V4NET.0.0.13] F=<a@b> rejected RCPT <c@d>: helo did verify
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -272,4 +277,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> getting IP address for rhubarb
 >>> no IP address found for host rhubarb (during SMTP connection from (rhubarb) [99.99.99.99])
 >>> require: condition test failed in ACL "rcpt"
+>>> end of ACL "rcpt": not OK
 LOG: H=(rhubarb) [99.99.99.99] F=<a@b> rejected RCPT <c@d>: helo not verified
diff --git a/test/stderr/0077 b/test/stderr/0077
index eabe6ae13..c8e30e996 100644
--- a/test/stderr/0077
+++ b/test/stderr/0077
@@ -22,6 +22,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> test.ex in "test.ex : myhost.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -43,6 +44,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> test.ex in "test.ex : myhost.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -62,4 +64,5 @@ MUNGED: ::1 will be omitted in what follows
 >>>   name=localhost address=127.0.0.1
 >>> host in "! @ : ! localhost"? yes (end of list)
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<x@test.ex> rejected RCPT <x@test.ex>
diff --git a/test/stderr/0079 b/test/stderr/0079
index e00d79050..15a8ba903 100644
--- a/test/stderr/0079
+++ b/test/stderr/0079
@@ -41,6 +41,7 @@ LOG: H=(exim.test.ex) [V4NET.11.12.14] Warning: accepting postmaster from host i
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -73,6 +74,7 @@ LOG: H=(exim.test.ex) [V4NET.11.12.14] Warning: accepting postmaster from host i
 >>> DNS lookup for 14.12.11.V4NET.rbl2.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl2.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.11.12.14] F=<postmaster@exim.test.ex> rejected RCPT list@exim.test.ex: host is listed in rbl2.test.ex
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmbB-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtp S=sss
diff --git a/test/stderr/0080 b/test/stderr/0080
index 0a0d03f47..718dbba6e 100644
--- a/test/stderr/0080
+++ b/test/stderr/0080
@@ -14,6 +14,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check recipients = postmaster@exim.test.ex
@@ -27,6 +28,7 @@
 >>> DNS lookup for 14.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.11.12.14] F=<postmaster@exim.test.ex> rejected RCPT list@exim.test.ex: host is listed in rbl.test.ex
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtp S=sss
diff --git a/test/stderr/0086 b/test/stderr/0086
index ec49cd32d..1d133ff73 100644
--- a/test/stderr/0086
+++ b/test/stderr/0086
@@ -8,11 +8,13 @@
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaY-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: '>' missing at end of address: failing address in "Cc:" header is: <abcd@x.y.z
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -24,11 +26,13 @@ LOG: 10HmaY-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaZ-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: '>' missing at end of address: failing address in "Cc:" header is: <abcd@x.y.z
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -40,11 +44,13 @@ LOG: 10HmaZ-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: '>' missing at end of address: failing address in "Resent-To:" header is: <xyz@a.b.c.d
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -56,11 +62,13 @@ LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbB-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: unmatched doublequote in local part: failing address in "Cc:" header begins: "abcd@x.y.z (missing quote),\n  longlonglonglonglong@long.long.long.long.long.long.long.long,\n  listlistlistlistlist@list.list.list.list.list.list.list.list,\n  ofofofofofofofofofof@of.of.of.of.of.of.of.of.of.of.of.of.of,\n  addressesaddresses@addresses.addresses.addresses.addresses,   \n  longlonglonglonglong@long.long.long.long.long.long.long.long,\n  listlistlistlistlist@list.list.list.list.list.list.list.list,\n  ofofofofofofofofofof@of.of.of.of.of.of.of.of.of.of.of.of.of,\n  addressesaddresses@addresses.addresses.addresses.addresses,   \n  longlonglonglonglong@long.long.long.long.long.long.long.long,\n  listlistlistlistlist@list.list.list.list.list.list.list.list,\n  ofofofofofofofofofof@of.of.of.of.of.of.of.of.of.of.of.of.of,\n  addressesaddresses@addresses.addresses.addresses.addresses,   \n  longlonglonglonglong@long.long.long.long.long.long.long.long,\n  listlistlistlistlist@list.list.list.list.list.list.list.list,\n  ofofofofofofofofofof@of.of.of.of.of.of.of.of.of.of.of.of.of,\n  addressesaddresses@addresses.addre
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -72,11 +80,13 @@ LOG: 10HmbB-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_syntax
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: unqualified address not permitted: failing address in "Cc:" header is: <abcd>
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -88,6 +98,7 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> host in helo_accept_junk_hosts? no (option unset)
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -95,4 +106,5 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.9] P=smtp S=sss
diff --git a/test/stderr/0087 b/test/stderr/0087
index ee44cf008..31cefea84 100644
--- a/test/stderr/0087
+++ b/test/stderr/0087
@@ -26,6 +26,7 @@
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -35,6 +36,7 @@
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -64,6 +66,7 @@ LOG: 10HmaX-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -73,6 +76,7 @@ LOG: 10HmaX-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -102,6 +106,7 @@ LOG: 10HmaY-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -113,6 +118,7 @@ LOG: 10HmaY-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> badbad in "userx"? no (end of list)
 >>> no more routers
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@test.ex> rejected after DATA: there is no valid sender in any header line
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -142,6 +148,7 @@ LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@test.ex> rejected after DATA:
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -157,6 +164,7 @@ LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@test.ex> rejected after DATA:
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -186,6 +194,7 @@ LOG: 10HmaZ-0005vi-00 <= userx@test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
diff --git a/test/stderr/0089 b/test/stderr/0089
index 83fc35df4..213760dae 100644
--- a/test/stderr/0089
+++ b/test/stderr/0089
@@ -23,6 +23,7 @@ LOG: rejected HELO from [V4NET.0.0.0]: syntactically invalid argument(s): @#$%^&
 >>> test.ex in "Test.ex : myhost.test.EX"? yes (matched "Test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -41,6 +42,7 @@ LOG: rejected HELO from [V4NET.0.0.0]: syntactically invalid argument(s): @#$%^&
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(abc_xyz) [V4NET.0.0.0] F=<userx@cus.cam.ac.uk> rejected RCPT <userx@else.where>: relay not permitted
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -73,6 +75,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> relay.one.ex in "Test.ex : Relay.one.ex"? yes (matched "Relay.one.ex")
 >>> relay.one.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -91,4 +94,5 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-99.test.ex (@#$%^&*()) [V4NET.0.0.99] F=<root@myhost.test.ex> rejected RCPT <yy@relay.two.ex>: relay not permitted
diff --git a/test/stderr/0091 b/test/stderr/0091
index 277cb8d70..4f6852885 100644
--- a/test/stderr/0091
+++ b/test/stderr/0091
@@ -16,6 +16,7 @@
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -26,6 +27,7 @@
 >>> junk in "userx"? no (end of list)
 >>> no more routers
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaY-0005vi-00 H=[V4NET.0.0.1] F=<junk@jink.jonk.test.ex> rejected after DATA: there is no valid sender in any header line
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -46,6 +48,7 @@ LOG: 10HmaY-0005vi-00 H=[V4NET.0.0.1] F=<junk@jink.jonk.test.ex> rejected after
 >>> no more routers
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.2] sender verify fail for <junk@jink.jonk.test.ex>: Unrouteable address
 LOG: H=[V4NET.0.0.2] F=<junk@jink.jonk.test.ex> rejected RCPT <root@test.ex>: Sender verify failed
 >>> host in hosts_connection_nolog? no (option unset)
@@ -73,6 +76,7 @@ LOG: H=[V4NET.0.0.2] F=<junk@jink.jonk.test.ex> rejected RCPT <root@test.ex>: Se
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -83,6 +87,7 @@ LOG: H=[V4NET.0.0.2] F=<junk@jink.jonk.test.ex> rejected RCPT <root@test.ex>: Se
 >>> junk in "userx"? no (end of list)
 >>> no more routers
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaZ-0005vi-00 H=[V4NET.0.0.2] F=<userx@test.ex> rejected after DATA: there is no valid sender in any header line
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -109,6 +114,7 @@ LOG: 10HmaZ-0005vi-00 H=[V4NET.0.0.2] F=<userx@test.ex> rejected after DATA: the
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -122,4 +128,5 @@ LOG: 10HmaZ-0005vi-00 H=[V4NET.0.0.2] F=<userx@test.ex> rejected after DATA: the
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@test.ex H=[V4NET.0.0.2] P=smtp S=sss
diff --git a/test/stderr/0092 b/test/stderr/0092
index f7bdef819..09bf352d1 100644
--- a/test/stderr/0092
+++ b/test/stderr/0092
@@ -30,6 +30,7 @@ LOG: SMTP command timeout on connection from [V4NET.0.0.1]
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: SMTP data timeout (message abandoned) on connection from [V4NET.0.0.1] F=<userx@test.ex>
 exim: timed out while reading - message abandoned
 exim: timed out while reading - message abandoned
@@ -61,6 +62,7 @@ exim: timed out while reading - message abandoned
 >>> no more routers
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.1] F=<userx@test.ex> rejected RCPT verify@test.ex: Unrouteable address
 LOG: SMTP command timeout on connection from [V4NET.0.0.1]
 An error was detected while processing a file of BSMTP input.
diff --git a/test/stderr/0094 b/test/stderr/0094
index 77ca6bc2a..8626c5ec1 100644
--- a/test/stderr/0094
+++ b/test/stderr/0094
@@ -27,6 +27,7 @@ LOG: no host name found for IP address V4NET.11.12.13
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.11.12.13] F=<userx@cam.ac.uk> rejected RCPT <userx@cam.ac.uk>: relay not permitted
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? yes (matched "0.0.0.0/0")
@@ -61,6 +62,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=ten-1.test.ex [V4NET.0.0.1] F=<userx@cam.ac.uk> rejected RCPT <userx@cam.ac.uk>: relay not permitted
 Exim version x.yz ....
 changed uid/gid: forcing real = effective
@@ -125,6 +127,7 @@ check domains = +local_domains
 test.ex in "test.ex"? yes (matched "test.ex")
 test.ex in "+local_domains"? yes (matched "+local_domains")
 accept: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<userx@cam.ac.uk>
 using ACL "check_recipient"
@@ -145,6 +148,7 @@ accept: condition test failed in ACL "check_recipient"
 processing "deny"
   message: relay not permitted
 deny: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": DENY
 SMTP>> 550 relay not permitted
 LOG: MAIN REJECT
   H=oneback.test.ex [V4NET.99.99.90] F=<userx@test.ex> rejected RCPT <userx@cam.ac.uk>: relay not permitted
diff --git a/test/stderr/0121 b/test/stderr/0121
index 39cdfba9b..a00b2faf1 100644
--- a/test/stderr/0121
+++ b/test/stderr/0121
@@ -18,6 +18,7 @@
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[127.0.0.1] sender verify fail for <unknown@test.ex>: Unrouteable address
 LOG: H=[127.0.0.1] F=<unknown@test.ex> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> using ACL "check_recipient"
@@ -31,6 +32,7 @@ LOG: H=[127.0.0.1] F=<unknown@test.ex> rejected RCPT <userx@test.ex>: Sender ver
 >>> fail_remote_domains router forced address failure
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[127.0.0.1] sender verify fail for <userx@unknown.dom.ain>: unrouteable mail domain "unknown.dom.ain"
 LOG: H=[127.0.0.1] F=<userx@unknown.dom.ain> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
@@ -46,6 +48,7 @@ LOG: H=[127.0.0.1] F=<userx@unknown.dom.ain> rejected RCPT <userx@test.ex>: Send
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[127.0.0.1] sender verify fail for <"unknown with spaces"@test.ex>: Unrouteable address
 LOG: H=[127.0.0.1] F=<"unknown with spaces"@test.ex> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> using ACL "check_recipient"
@@ -66,6 +69,7 @@ LOG: H=[127.0.0.1] F=<"unknown with spaces"@test.ex> rejected RCPT <userx@test.e
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -79,6 +83,7 @@ LOG: H=[127.0.0.1] F=<"unknown with spaces"@test.ex> rejected RCPT <userx@test.e
 >>> unknown in "userx"? no (end of list)
 >>> no more routers
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaX-0005vi-00 H=[127.0.0.1] F=<userx@test.ex> rejected after DATA: there is no valid sender in any header line
 >>> using ACL "check_recipient"
 >>> processing "require"
@@ -98,12 +103,14 @@ LOG: 10HmaX-0005vi-00 H=[127.0.0.1] F=<userx@test.ex> rejected after DATA: there
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>> check verify = header_sender
 >>> verifying From: header address <>
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmaY-0005vi-00 H=[127.0.0.1] F=<userx@test.ex> rejected after DATA: syntax error in 'From:' header when scanning for sender: missing or malformed local part in "<>"
 >>> using ACL "check_recipient"
 >>> processing "require"
@@ -138,6 +145,7 @@ LOG: H=[127.0.0.1] F=<defer@test.ex> temporarily rejected RCPT <userx@test.ex>:
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
diff --git a/test/stderr/0124 b/test/stderr/0124
index 328d78084..d259f4768 100644
--- a/test/stderr/0124
+++ b/test/stderr/0124
@@ -27,6 +27,7 @@ LOG: no host name found for IP address V4NET.0.0.97
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.97] F=<userx@test.ex> rejected RCPT <userx@external.test.ex>: relay not permitted
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -45,4 +46,5 @@ LOG: H=[V4NET.0.0.97] F=<userx@test.ex> rejected RCPT <userx@external.test.ex>:
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.97] F=<userx@test.ex> rejected RCPT <userx@external.test.ex>: relay not permitted
diff --git a/test/stderr/0138 b/test/stderr/0138
index 921115a6e..c84420ece 100644
--- a/test/stderr/0138
+++ b/test/stderr/0138
@@ -24,6 +24,7 @@
 >>> DNS lookup for 14.12.11.V4NET.rbl3.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl3.test.ex
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -40,6 +41,7 @@
 >>> DNS lookup for 14.12.11.V4NET.rbl3.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl3.test.ex
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -116,5 +118,6 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.13] P=esmtp S=sss
diff --git a/test/stderr/0139 b/test/stderr/0139
index c7f1f32eb..140f54673 100644
--- a/test/stderr/0139
+++ b/test/stderr/0139
@@ -37,6 +37,7 @@
 >>> warn: condition test failed in ACL "check_mail"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "warn"
 >>>   message: X-Warn: host is listed in $dnslist_domain but not =127.0.0.3${if def:dnslist_text{\n  $dnslist_text}}
@@ -87,6 +88,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "warn"
 >>>   message: X-Warn: host is listed in $dnslist_domain but not =127.0.0.3${if def:dnslist_text{\n  $dnslist_text}}
@@ -123,6 +125,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=[V4NET.11.12.14] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -164,6 +167,7 @@ LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=[V4NET.11.12.14] P=smtp S=sss
 >>> warn: condition test failed in ACL "check_mail"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "warn"
 >>>   message: X-Warn: host is listed in $dnslist_domain but not =127.0.0.3${if def:dnslist_text{\n  $dnslist_text}}
@@ -182,6 +186,7 @@ LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=[V4NET.11.12.14] P=smtp S=sss
 >>> DNS lookup for 15.12.11.V4NET.rbl3.test.ex succeeded (yielding 127.0.0.3)
 >>> => that means V4NET.11.12.15 is listed at rbl3.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.test.ex>: host is listed in rbl3.test.ex with value 127.0.0.3
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -226,6 +231,7 @@ LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.te
 >>> warn: condition test failed in ACL "check_mail"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -267,6 +273,7 @@ LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.te
 >>> warn: condition test failed in ACL "check_mail"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -290,6 +297,7 @@ LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.te
 >>> warn: condition test succeeded in ACL "check_helo"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_helo"
+>>> end of ACL "check_helo": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -361,6 +369,7 @@ LOG: H=[V4NET.11.12.15] F=<postmaster@exim.test.ex> rejected RCPT <userx@exim.te
 >>> warn: condition test failed in ACL "check_vrfy"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_vrfy"
+>>> end of ACL "check_vrfy": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing a@b
 >>> calling system_aliases router
diff --git a/test/stderr/0145 b/test/stderr/0145
index 129616bef..aa06f5a7f 100644
--- a/test/stderr/0145
+++ b/test/stderr/0145
@@ -17,6 +17,7 @@
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[V4NET.9.8.7] sender verify fail for <x@mxt10.test.ex>: all relevant MX records point to non-existent hosts or (invalidly) to IP addresses
 LOG: H=[V4NET.9.8.7] F=<x@mxt10.test.ex> rejected RCPT <x@y>: Sender verify failed
 >>> host in hosts_connection_nolog? no (option unset)
@@ -46,4 +47,5 @@ LOG: H=[V4NET.9.8.7] F=<x@mxt10.test.ex> rejected RCPT <x@y>: Sender verify fail
 >>> no more routers
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[V4NET.9.8.7] F=<x@ten-1.test.ex> rejected RCPT <x@mxt10.test.ex>: all relevant MX records point to non-existent hosts or (invalidly) to IP addresses
diff --git a/test/stderr/0157 b/test/stderr/0157
index bcd4f6f78..a36650c8a 100644
--- a/test/stderr/0157
+++ b/test/stderr/0157
@@ -43,6 +43,7 @@ LOG: H=[V4NET.0.0.1] F=<x@y.z> rejected RCPT <a@b.c>: invalid sender
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> userx@test.ex in "userx@test.ex"? yes (matched "userx@test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -70,6 +71,7 @@ LOG: H=[V4NET.0.0.1] F=<x@y.z> rejected RCPT <a@b.c>: invalid sender
 >>> host in "V4NET.0.0.1 : V4NET.0.0.2"? yes (matched "V4NET.0.0.2")
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -88,6 +90,7 @@ LOG: H=[V4NET.0.0.1] F=<x@y.z> rejected RCPT <a@b.c>: invalid sender
 >>> check hosts = +relay_hosts
 >>> host in "+relay_hosts"? yes (matched "+relay_hosts" - cached)
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -118,6 +121,7 @@ LOG: H=[V4NET.0.0.1] F=<x@y.z> rejected RCPT <a@b.c>: invalid sender
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.3] F=<x@y.z> rejected RCPT <a@b.c>: relay not permitted
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -140,4 +144,5 @@ LOG: H=[V4NET.0.0.3] F=<x@y.z> rejected RCPT <a@b.c>: relay not permitted
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.3] F=<userx@test.ex> rejected RCPT <a@b.c>: relay not permitted
diff --git a/test/stderr/0175 b/test/stderr/0175
index cbf66d591..9423139cf 100644
--- a/test/stderr/0175
+++ b/test/stderr/0175
@@ -23,6 +23,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> fail_sender router forced address failure
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[V4NET.0.0.0] sender verify fail for <user@bad.domain>: remote host address is the local host
 LOG: H=[V4NET.0.0.0] F=<user@bad.domain> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> host in hosts_connection_nolog? no (option unset)
@@ -53,6 +54,7 @@ MUNGED: ::1 will be omitted in what follows
 >>>   name=localhost address=127.0.0.1
 >>> ----------- end verify ------------
 >>> require: condition test failed in ACL "check_recipient"
+>>> end of ACL "check_recipient": not OK
 LOG: H=[V4NET.0.0.0] sender verify fail for <user@bad.domain2>: fail_sender2 router forced verify failure
 LOG: H=[V4NET.0.0.0] F=<user@bad.domain2> rejected RCPT <userx@test.ex>: Sender verify failed
 >>> host in hosts_connection_nolog? no (option unset)
@@ -87,4 +89,5 @@ LOG: H=[V4NET.0.0.0] F=<user@bad.domain2> rejected RCPT <userx@test.ex>: Sender
 >>> test.ex in "test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 LOG: 10HmaX-0005vi-00 <= user@ten-1.test.ex H=[V4NET.0.0.0] P=smtp S=sss
diff --git a/test/stderr/0234 b/test/stderr/0234
index 727641b57..b7c44c7a9 100644
--- a/test/stderr/0234
+++ b/test/stderr/0234
@@ -15,6 +15,7 @@
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=[V4NET.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -23,6 +24,7 @@ LOG: H=[V4NET.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
 >>> mxt1.test.ex in "@mx_any"? yes (matched "@mx_any")
 >>> mxt1.test.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check domains = +relay_domains
@@ -32,3 +34,4 @@ LOG: H=[V4NET.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
 >>> mxt6.test.ex in "@mx_any"? yes (matched "@mx_any")
 >>> mxt6.test.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
diff --git a/test/stderr/0243 b/test/stderr/0243
index b8aaf253c..605febbfe 100644
--- a/test/stderr/0243
+++ b/test/stderr/0243
@@ -29,3 +29,4 @@
 >>> nl.demon.net in "nl.demon.net"? yes (matched "nl.demon.net")
 >>> nl.demon.net in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
diff --git a/test/stderr/0251 b/test/stderr/0251
index 982d9af3d..6a509366b 100644
--- a/test/stderr/0251
+++ b/test/stderr/0251
@@ -32,6 +32,7 @@
 >>> listr.test.ex in "test.ex : *.test.ex"? yes (matched "*.test.ex")
 >>> listr.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "deny"
 >>>   message: unrouteable address
@@ -50,5 +51,6 @@
 >>> listr.test.ex in "test.ex : *.test.ex"? yes (matched "*.test.ex")
 >>> listr.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 
 ******** SERVER ********
diff --git a/test/stderr/0281 b/test/stderr/0281
index 88d08143f..9a3396bbb 100644
--- a/test/stderr/0281
+++ b/test/stderr/0281
@@ -14,6 +14,7 @@
 >>> require: condition test succeeded in ACL "acl_rcpt_1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_1"
+>>> end of ACL "acl_rcpt_1": ACCEPT
 >>> using ACL "acl_rcpt_1"
 >>> processing "require"
 >>>   message: domain doesn't match @ or @[]
@@ -22,12 +23,14 @@
 >>> require: condition test succeeded in ACL "acl_rcpt_1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_1"
+>>> end of ACL "acl_rcpt_1": ACCEPT
 >>> using ACL "acl_rcpt_1"
 >>> processing "require"
 >>>   message: domain doesn't match @ or @[]
 >>> check domains = @ : @[]
 >>> else.where in "@ : @[]"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_1"
+>>> end of ACL "acl_rcpt_1": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match @ or @[]
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
@@ -39,6 +42,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match
 >>> require: condition test succeeded in ACL "acl_rcpt_2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": ACCEPT
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_any
@@ -49,6 +53,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match
 >>> require: condition test succeeded in ACL "acl_rcpt_2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": ACCEPT
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_any
@@ -62,6 +67,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match
 >>> require: condition test succeeded in ACL "acl_rcpt_2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": ACCEPT
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_any
@@ -71,6 +77,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <1@else.where>: domain doesn't match
 >>> ten-3.test.ex in hosts_treat_as_local? no (end of list)
 >>> mxt9.test.ex in "@mx_any"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxt9.test.ex>: domain doesn't match @mx_any
 >>> using ACL "acl_rcpt_2"
 >>> processing "require"
@@ -78,6 +85,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxt9.test.ex>: domain doesn't matc
 >>> check domains = @mx_any
 >>> mxnone.test.ex in "@mx_any"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxnone.test.ex>: domain doesn't match @mx_any
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
@@ -90,6 +98,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxnone.test.ex>: domain doesn't ma
 >>> require: condition test succeeded in ACL "acl_rcpt_3"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": ACCEPT
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_primary
@@ -102,6 +111,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <2@mxnone.test.ex>: domain doesn't ma
 >>>   eximtesthost.test.ex ip4.ip4.ip4.ip4 6
 >>> mxt6.test.ex in "@mx_primary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt6.test.ex>: domain doesn't match @mx_primary
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
@@ -112,6 +122,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt6.test.ex>: domain doesn't matc
 >>> ten-3.test.ex in hosts_treat_as_local? no (end of list)
 >>> mxt9.test.ex in "@mx_primary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt9.test.ex>: domain doesn't match @mx_primary
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
@@ -119,6 +130,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt9.test.ex>: domain doesn't matc
 >>> check domains = @mx_primary
 >>> mxnone.test.ex in "@mx_primary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxnone.test.ex>: domain doesn't match @mx_primary
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
@@ -128,6 +140,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxnone.test.ex>: domain doesn't ma
 >>> local host has lowest MX
 >>> mxt5.test.ex in "@mx_secondary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt5.test.ex>: domain doesn't match @mx_secondary
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
@@ -143,6 +156,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt5.test.ex>: domain doesn't matc
 >>> require: condition test succeeded in ACL "acl_rcpt_4"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": ACCEPT
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_secondary
@@ -152,6 +166,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt5.test.ex>: domain doesn't matc
 >>> ten-3.test.ex in hosts_treat_as_local? no (end of list)
 >>> mxt9.test.ex in "@mx_secondary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt9.test.ex>: domain doesn't match @mx_secondary
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
@@ -159,6 +174,7 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxt9.test.ex>: domain doesn't matc
 >>> check domains = @mx_secondary
 >>> mxnone.test.ex in "@mx_secondary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <4@mxnone.test.ex>: domain doesn't match @mx_secondary
 >>> using ACL "acl_rcpt_5"
 >>> processing "require"
@@ -169,6 +185,7 @@ MUNGED: ::1 will be omitted in what follows
 >>>   name=myhost.test.ex address=V4NET.10.10.10
 >>> host in "@ : @[]"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_5"
+>>> end of ACL "acl_rcpt_5": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <5@myhost.test.ex>: host doesn't match @ or @[]
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -189,6 +206,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> require: condition test succeeded in ACL "acl_rcpt_5"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_5"
+>>> end of ACL "acl_rcpt_5": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -208,6 +226,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> require: condition test succeeded in ACL "acl_rcpt_5"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_5"
+>>> end of ACL "acl_rcpt_5": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -228,6 +247,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> require: condition test succeeded in ACL "acl_rcpt_2"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_2"
+>>> end of ACL "acl_rcpt_2": ACCEPT
 >>> using ACL "acl_rcpt_3"
 >>> processing "require"
 >>>   message: domain doesn't match @mx_primary
@@ -238,6 +258,7 @@ MUNGED: ::1 will be omitted in what follows
 >>>   eximtesthost.test.ex ip4.ip4.ip4.ip4 6
 >>> mxt3.test.ex in "@mx_primary"? no (end of list)
 >>> require: condition test failed in ACL "acl_rcpt_3"
+>>> end of ACL "acl_rcpt_3": not OK
 LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt3.test.ex>: domain doesn't match @mx_primary
 >>> using ACL "acl_rcpt_4"
 >>> processing "require"
@@ -251,3 +272,4 @@ LOG: H=[V4NET.1.1.1] F=<x@y> rejected RCPT <3@mxt3.test.ex>: domain doesn't matc
 >>> require: condition test succeeded in ACL "acl_rcpt_4"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl_rcpt_4"
+>>> end of ACL "acl_rcpt_4": ACCEPT
diff --git a/test/stderr/0294 b/test/stderr/0294
index 3b09873e2..362675064 100644
--- a/test/stderr/0294
+++ b/test/stderr/0294
@@ -110,6 +110,7 @@ one in "reject"? no (end of list)
 deny: condition test failed in inline ACL
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<one@z>
 host in smtp_ratelimit_hosts? no (end of list)
@@ -119,6 +120,7 @@ one in "reject"? no (end of list)
 deny: condition test failed in inline ACL
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
@@ -152,6 +154,7 @@ one in "reject"? no (end of list)
 deny: condition test failed in inline ACL
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<one@z>
 host in smtp_ratelimit_hosts? yes (matched "V4NET.9.8.7")
@@ -162,6 +165,7 @@ one in "reject"? no (end of list)
 deny: condition test failed in inline ACL
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/0303 b/test/stderr/0303
index bd6f78c4b..9893e6404 100644
--- a/test/stderr/0303
+++ b/test/stderr/0303
@@ -83,6 +83,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -152,6 +153,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0304 b/test/stderr/0304
index 253287df2..d82bb3ee9 100644
--- a/test/stderr/0304
+++ b/test/stderr/0304
@@ -47,6 +47,7 @@
 >>> x in "x"? yes (matched "x")
 >>> b1@x in "b1@x"? yes (matched "b1@x")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<> rejected RCPT <b1@x>: failed 7
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -96,6 +97,7 @@ LOG: H=[1.2.3.4] F=<> rejected RCPT <b1@x>: failed 7
 >>> x in "x"? yes (matched "x")
 >>> b2@x in "b2@x"? yes (matched "b2@x")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<> rejected RCPT <b2@x>: failed 8
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -162,12 +164,14 @@ LOG: H=[1.2.3.4] F=<> rejected RCPT <b2@x>: failed 8
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
 >>> check recipients = \N^abc.*@.*\.x\.y\.z\N : a@b
 >>> abc@w.x.y.z in "^abc.*@.*\.x\.y\.z : a@b"? yes (matched "^abc.*@.*\.x\.y\.z")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@w.x.y.z>: failed 1
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -175,6 +179,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@w.x.y.z>: failed 1
 >>> check recipients = \N^abc.*@.*\.x\.y\.z\N : a@b
 >>> abcdef@q.x.y.z in "^abc.*@.*\.x\.y\.z : a@b"? yes (matched "^abc.*@.*\.x\.y\.z")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcdef@q.x.y.z>: failed 1
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -183,6 +188,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcdef@q.x.y.z>: failed 1
 >>> b in "b"? yes (matched "b")
 >>> a@b in "^abc.*@.*\.x\.y\.z : a@b"? yes (matched "a@b")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@b>: failed 1
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -246,6 +252,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@b>: failed 1
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -257,6 +264,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@b>: failed 1
 >>> check recipients = lsearch*@;TESTSUITE/aux-fixed/0304.d1
 >>> x@a.b.c in "lsearch*@;TESTSUITE/aux-fixed/0304.d1"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0304.d1")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@a.b.c>: failed 2
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -269,6 +277,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@a.b.c>: failed 2
 >>> check recipients = lsearch*@;TESTSUITE/aux-fixed/0304.d1
 >>> abc@d.e.f in "lsearch*@;TESTSUITE/aux-fixed/0304.d1"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0304.d1")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@d.e.f>: failed 2
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -332,6 +341,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@d.e.f>: failed 2
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -348,6 +358,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@d.e.f>: failed 2
 >>> check recipients = @@lsearch;TESTSUITE/aux-fixed/0304.d2
 >>> abc@at.1 in "@@lsearch;TESTSUITE/aux-fixed/0304.d2"? yes (matched "@@lsearch;TESTSUITE/aux-fixed/0304.d2")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@at.1>: failed 3
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -365,6 +376,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@at.1>: failed 3
 >>> check recipients = @@lsearch;TESTSUITE/aux-fixed/0304.d2
 >>> xyz@at.1 in "@@lsearch;TESTSUITE/aux-fixed/0304.d2"? yes (matched "@@lsearch;TESTSUITE/aux-fixed/0304.d2")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@at.1>: failed 3
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -382,6 +394,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@at.1>: failed 3
 >>> check recipients = @@lsearch;TESTSUITE/aux-fixed/0304.d2
 >>> abcxyz@at.1 in "@@lsearch;TESTSUITE/aux-fixed/0304.d2"? yes (matched "@@lsearch;TESTSUITE/aux-fixed/0304.d2")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcxyz@at.1>: failed 3
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -445,6 +458,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcxyz@at.1>: failed 3
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -467,6 +481,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abcxyz@at.1>: failed 3
 >>> domain.only in "domain.only"? yes (matched "domain.only")
 >>> x@domain.only in "domain.only : *.domain2.only"? yes (matched "domain.only")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@domain.only>: failed 4
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -491,6 +506,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@domain.only>: failed 4
 >>> abc.domain2.only in "*.domain2.only"? yes (matched "*.domain2.only")
 >>> x@abc.domain2.only in "domain.only : *.domain2.only"? yes (matched "*.domain2.only")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@abc.domain2.only>: failed 4
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -554,6 +570,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@abc.domain2.only>: failed 4
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -583,6 +600,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@abc.domain2.only>: failed 4
 >>> domain3 in "domain3"? yes (matched "domain3")
 >>> abc@domain3 in "abc@domain3 : xyz@*.domain4"? yes (matched "abc@domain3")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@domain3>: failed 5
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -613,6 +631,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <abc@domain3>: failed 5
 >>> x.domain4 in "*.domain4"? yes (matched "*.domain4")
 >>> xyz@x.domain4 in "abc@domain3 : xyz@*.domain4"? yes (matched "xyz@*.domain4")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@x.domain4>: failed 5
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -677,6 +696,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@x.domain4>: failed 5
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -741,6 +761,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@x.domain4>: failed 5
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -775,6 +796,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@x.domain4>: failed 5
 >>> myhost.test.ex in "@"? yes (matched "@")
 >>> pqr@myhost.test.ex in "pqr@@"? yes (matched "pqr@@")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <pqr@myhost.test.ex>: failed 6
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -838,6 +860,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <pqr@myhost.test.ex>: failed 6
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -889,6 +912,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <pqr@myhost.test.ex>: failed 6
 >>> domain5 in "lsearch;TESTSUITE/aux-fixed/0304.d3"? yes (matched "lsearch;TESTSUITE/aux-fixed/0304.d3")
 >>> a@domain5 in "*@lsearch;TESTSUITE/aux-fixed/0304.d3"? yes (matched "*@lsearch;TESTSUITE/aux-fixed/0304.d3")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@domain5>: failed 9
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -947,6 +971,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <a@domain5>: failed 9
 >>> domain6 in "lsearch;TESTSUITE/aux-fixed/0304.d4"? yes (matched "lsearch;TESTSUITE/aux-fixed/0304.d4")
 >>> xyz@domain6 in "xyz@lsearch;TESTSUITE/aux-fixed/0304.d4"? yes (matched "xyz@lsearch;TESTSUITE/aux-fixed/0304.d4")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@domain6>: failed 10
 >>> using ACL "acl1"
 >>> processing "deny"
@@ -1011,6 +1036,7 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@domain6>: failed 10
 >>> deny: condition test failed in ACL "acl1"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "deny"
 >>>   message: failed 1
@@ -1071,4 +1097,5 @@ LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <xyz@domain6>: failed 10
 >>> check recipients = lsearch*@;TESTSUITE/aux-fixed/0304.d5
 >>> x@domain7 in "lsearch*@;TESTSUITE/aux-fixed/0304.d5"? yes (matched "lsearch*@;TESTSUITE/aux-fixed/0304.d5")
 >>> deny: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": DENY
 LOG: H=[1.2.3.4] F=<x@y> rejected RCPT <x@domain7>: failed 11
diff --git a/test/stderr/0305 b/test/stderr/0305
index ecf6bb944..7fc6cfc5b 100644
--- a/test/stderr/0305
+++ b/test/stderr/0305
@@ -12,6 +12,7 @@
 >>> ten-1.test.ex in "ten-1.test.ex"? yes (matched "ten-1.test.ex")
 >>> ten-1.test.ex in "+ok_domains"? yes (matched "+ok_domains")
 >>> accept: condition test succeeded in ACL "acl1"
+>>> end of ACL "acl1": ACCEPT
 >>> using ACL "acl1"
 >>> processing "accept"
 >>> check domains = +ok_domains
diff --git a/test/stderr/0306 b/test/stderr/0306
index e4207e42a..d2fcf91e5 100644
--- a/test/stderr/0306
+++ b/test/stderr/0306
@@ -24,6 +24,7 @@
 >>> routed by r5 router
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": ACCEPT
 >>> using ACL "rcpt"
 >>> processing "accept"
 >>> check verify = recipient
@@ -35,6 +36,7 @@
 >>> routed by r2 router
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "rcpt"
 >>> processing "accept"
diff --git a/test/stderr/0308 b/test/stderr/0308
index 4a89c24ea..2c800bb61 100644
--- a/test/stderr/0308
+++ b/test/stderr/0308
@@ -18,6 +18,7 @@ LOG: no host name found for IP address V4NET.0.0.97
 >>> check hosts = V4NET.0.0.97
 >>> host in "V4NET.0.0.97"? yes (matched "V4NET.0.0.97")
 >>> accept: condition test succeeded in ACL "acl_V4NET_0_0"
+>>> end of ACL "acl_V4NET_0_0": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -39,3 +40,4 @@ MUNGED: ::1 will be omitted in what follows
 >>>   V4NET.0.0.1 OK
 >>> host in "*.test.ex"? yes (matched "*.test.ex")
 >>> accept: condition test succeeded in ACL "acl_V4NET_0_0"
+>>> end of ACL "acl_V4NET_0_0": ACCEPT
diff --git a/test/stderr/0325 b/test/stderr/0325
index 727ee56b1..cd66e202c 100644
--- a/test/stderr/0325
+++ b/test/stderr/0325
@@ -32,4 +32,5 @@ r4: $local_part_data = LOCAL PART DATA
 >>> xxx in "+test_local_parts"? yes (matched "+test_local_parts" - cached)
 >>>   message: \$domain_data=$domain_data \$local_part_data=$local_part_data
 >>> deny: condition test succeeded in ACL "a1"
+>>> end of ACL "a1": DENY
 LOG: H=[V4NET.0.0.0] F=<a@b.c> rejected RCPT xxx@a.b.c: $domain_data=DOMAIN DATA $local_part_data=LOCAL PART DATA
diff --git a/test/stderr/0342 b/test/stderr/0342
index 1e84be464..dc772a105 100644
--- a/test/stderr/0342
+++ b/test/stderr/0342
@@ -22,3 +22,4 @@
 >>> deny: condition test failed in ACL "check_rcpt"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
diff --git a/test/stderr/0362 b/test/stderr/0362
index 14065094f..5f03562df 100644
--- a/test/stderr/0362
+++ b/test/stderr/0362
@@ -73,6 +73,7 @@ routed by r2 router
   transport: t2
 ----------- end verify ------------
 accept: condition test succeeded in ACL "check_rcpt"
+end of ACL "check_rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 the.local.host.name closing connection
diff --git a/test/stderr/0371 b/test/stderr/0371
index c4f9a93ac..df1a378c8 100644
--- a/test/stderr/0371
+++ b/test/stderr/0371
@@ -27,6 +27,7 @@ check set acl_c0 = $acl_c0; connect
 check set acl_c9 = $acl_c9; connect
                  = ; connect
 accept: condition test succeeded in ACL "connect"
+end of ACL "connect": ACCEPT
 SMTP>> 220 mail.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< ehlo something
@@ -50,6 +51,7 @@ check set acl_c9 = $acl_c9; mail
 check set acl_m0 = $acl_m0; mail
                  = ; mail
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 using ACL "rcpt"
@@ -61,6 +63,7 @@ check set acl_m9 = $acl_m9; rcpt
 check set acl_c0 = $acl_c0; rcpt
                  = ; connect; mail; rcpt
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -84,6 +87,7 @@ check set acl_m0 = $acl_m0; data
 check set acl_m9 = $acl_m9; data
                  = ; rcpt; data
 accept: condition test succeeded in ACL "data"
+end of ACL "data": ACCEPT
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
 LOG: MAIN
@@ -101,6 +105,7 @@ check set acl_c9 = $acl_c9; vrfy
 check set acl_m0 = $acl_m0; vrfy
                  = ; vrfy
 accept: condition test succeeded in ACL "vrfy"
+end of ACL "vrfy": ACCEPT
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 Verifying x@y
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
@@ -121,6 +126,7 @@ check set acl_c9 = $acl_c9; mail
 check set acl_m0 = $acl_m0; mail
                  = ; mail
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 SMTP>> 250 OK
 SMTP<< quit
 SMTP>> 221 mail.test.ex closing connection
diff --git a/test/stderr/0381 b/test/stderr/0381
index 7f6f680db..176287a50 100644
--- a/test/stderr/0381
+++ b/test/stderr/0381
@@ -73,6 +73,7 @@ host in "!*.co.uk.test.ex"? no (matched "!*.co.uk.test.ex")
 warn: condition test failed in ACL "check_rcpt"
 processing "accept"
 accept: condition test succeeded in ACL "check_rcpt"
+end of ACL "check_rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/0384 b/test/stderr/0384
index 8d556f5a0..7a0eb8339 100644
--- a/test/stderr/0384
+++ b/test/stderr/0384
@@ -15,3 +15,4 @@
 LOG: rejected "EHLO [1.2.3.4]" from ([1.2.3.4]) [V4NET.9.8.7]
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
diff --git a/test/stderr/0386 b/test/stderr/0386
index b796773d8..6084853e4 100644
--- a/test/stderr/0386
+++ b/test/stderr/0386
@@ -68,6 +68,7 @@ require: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl1"
 processing "deny"
   message: No such user here
 deny: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl1"
+end of ACL "TESTSUITE/aux-fixed/0386.acl1": DENY
 SMTP>> 550 No such user here
 LOG: MAIN REJECT
   H=[V4NET.9.8.7] F=<x@y> rejected RCPT <1@b>: No such user here
@@ -113,6 +114,7 @@ require: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl1"
 processing "deny"
   message: No such user here
 deny: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl1"
+end of ACL "TESTSUITE/aux-fixed/0386.acl1": DENY
 SMTP>> 550 No such user here
 LOG: MAIN REJECT
   H=[V4NET.9.8.7] F=<x@y> rejected RCPT <1@b>: No such user here
@@ -175,6 +177,7 @@ LOG: MAIN
 created log directory TESTSUITE/spool/log
 processing "accept"
 accept: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl2"
+end of ACL "TESTSUITE/aux-fixed/0386.acl2": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -335,6 +338,7 @@ LOG: MAIN
   H=[V4NET.11.12.13] U=CALLER Warning: found in rbl.test.ex: This is a test blacklisting message
 processing "accept"
 accept: condition test succeeded in ACL "TESTSUITE/aux-fixed/0386.acl2"
+end of ACL "TESTSUITE/aux-fixed/0386.acl2": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0391 b/test/stderr/0391
index e6fac476b..326807765 100644
--- a/test/stderr/0391
+++ b/test/stderr/0391
@@ -55,6 +55,7 @@ routed by r1 router
 ----------- end verify ------------
 sender U@W.x.y verified ok as U@x.y
 accept: condition test succeeded in ACL "acl_rcpt"
+end of ACL "acl_rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/0394 b/test/stderr/0394
index a51fcf45f..72ffbede4 100644
--- a/test/stderr/0394
+++ b/test/stderr/0394
@@ -13,6 +13,7 @@ LOG: no host name found for IP address V4NET.255.255.255
 >>> processing "require"
 >>> check verify = reverse_host_lookup
 >>> require: condition test failed in ACL "connect"
+>>> end of ACL "connect": not OK
 LOG: H=[V4NET.255.255.255] rejected connection in "connect" ACL: host lookup failed (failed to find host name from IP address)
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? yes (matched "*")
diff --git a/test/stderr/0398 b/test/stderr/0398
index 0acc6c21c..5118c1af7 100644
--- a/test/stderr/0398
+++ b/test/stderr/0398
@@ -156,6 +156,7 @@ address match test: subject=qq@remote pattern=qq@remote
 remote in "remote"? yes (matched "remote")
 qq@remote in "qq@remote"? yes (matched "qq@remote")
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<xyz@local>
 using ACL "rcpt"
@@ -234,6 +235,7 @@ address match test: subject=qq@remote pattern=qq@remote
 remote in "remote"? yes (matched "remote")
 qq@remote in "qq@remote"? yes (matched "qq@remote")
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 mail.test.ex closing connection
diff --git a/test/stderr/0401 b/test/stderr/0401
index 10afc1392..ef9181703 100644
--- a/test/stderr/0401
+++ b/test/stderr/0401
@@ -11,6 +11,7 @@
 >>> check hosts = TESTSUITE/aux-var/0401.hosts1
 >>> host in "TESTSUITE/aux-var/0401.hosts1"? yes (matched "V4NET.9.8.7" in TESTSUITE/aux-var/0401.hosts1)
 >>> accept: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": ACCEPT
 >>> xxx in helo_lookup_domains? no (end of list)
 >>> using ACL "mail"
 >>> processing "accept"
diff --git a/test/stderr/0420 b/test/stderr/0420
index fbb2bf6c6..34f575e01 100644
--- a/test/stderr/0420
+++ b/test/stderr/0420
@@ -27,6 +27,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -51,6 +52,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<x@y>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0422 b/test/stderr/0422
index 36cfef60e..ffb7de0a7 100644
--- a/test/stderr/0422
+++ b/test/stderr/0422
@@ -17,6 +17,7 @@
 >>> deny: condition test failed in ACL "connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -34,4 +35,5 @@
 >>> DNS lookup for 2.13.13.V4NET.rbl.test.ex succeeded (yielding 127.0.0.1, 127.0.0.2)
 >>> => that means V4NET.13.13.2 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": DENY
 LOG: H=[V4NET.13.13.2] rejected connection in "connect" ACL: dnslist_value is 127.0.0.1, 127.0.0.2
diff --git a/test/stderr/0423 b/test/stderr/0423
index 47e674e52..c9963ca86 100644
--- a/test/stderr/0423
+++ b/test/stderr/0423
@@ -10,4 +10,5 @@
 >>> processing "deny"
 >>>   message: xxxxxxxxxxxxxx has refused this message because it looks like it is infected with the Sobig.E worm. See http://www.xxxx.xxx/xxxxxxxx/xxxx/xxxx/w32.sobig.e@xx.html for details. If you feel this determination is in error, please forward the entire message to postmaster@xxxxxxxxxxxxx.com and include code \"xx#1\" in the Subject
 >>> deny: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": DENY
 LOG: H=[V4NET.13.13.1] rejected connection in "connect" ACL: xxxxxxxxxxxxxx has refused this message because it looks like it is infected with the Sobig.E worm. See http://www.xxxx.xxx/xxxxxxxx/xxxx/xxxx/w32.sobig.e@xx.html for details. If you feel this determination is in error, please forward the entire message to postmaster@xxxxxxxxxxxxx.com and include code "xx#1" in the Subject
diff --git a/test/stderr/0432 b/test/stderr/0432
index 759c9a819..a9581e9b4 100644
--- a/test/stderr/0432
+++ b/test/stderr/0432
@@ -23,6 +23,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> (Use -bhc if you want the callouts to happen.)
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
 Exim version x.yz ....
 changed uid/gid: forcing real = effective
   uid=uuuu gid=CALLER_GID pid=pppp
@@ -111,6 +112,7 @@ wrote positive callout cache address record
 ----------- end verify ------------
 sender x@y verified ok
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 SMTP>> 250 OK
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
@@ -185,6 +187,7 @@ callout cache: address record is positive
 ----------- end verify ------------
 sender x@y verified ok
 accept: condition test succeeded in ACL "mail"
+end of ACL "mail": ACCEPT
 SMTP>> 250 OK
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
@@ -218,6 +221,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> callout cache: address record is positive
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -258,6 +262,7 @@ MUNGED: ::1 will be omitted in what follows
 >>> wrote positive callout cache address record
 >>> ----------- end verify ------------
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
diff --git a/test/stderr/0445 b/test/stderr/0445
index f8b5c1d87..a78932683 100644
--- a/test/stderr/0445
+++ b/test/stderr/0445
@@ -16,6 +16,7 @@
 >>> bad_addresses router forced address failure
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": DENY
 LOG: H=[1.2.3.4] sender verify fail for <lp1@x.y>: 
 LOG: H=[1.2.3.4] F=<lp1@x.y> rejected RCPT <zz@x.y>: Sender verify failed
 >>> using ACL "rcpt"
@@ -28,5 +29,6 @@ LOG: H=[1.2.3.4] F=<lp1@x.y> rejected RCPT <zz@x.y>: Sender verify failed
 >>> bad_addresses router forced address failure
 >>> ----------- end verify ------------
 >>> deny: condition test succeeded in ACL "rcpt"
+>>> end of ACL "rcpt": DENY
 LOG: H=[1.2.3.4] sender verify fail for <lp2@x.y>: This is a message
 LOG: H=[1.2.3.4] F=<lp2@x.y> rejected RCPT <zz@x.y>: Sender verify failed
diff --git a/test/stderr/0464 b/test/stderr/0464
index 6d2746223..b405a8192 100644
--- a/test/stderr/0464
+++ b/test/stderr/0464
@@ -163,6 +163,7 @@ routed by r2 router
 require: condition test succeeded in ACL "rcpt"
 processing "accept"
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/0465 b/test/stderr/0465
index 070227068..634cd2103 100644
--- a/test/stderr/0465
+++ b/test/stderr/0465
@@ -52,6 +52,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<abc@domain.>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
@@ -76,6 +77,7 @@ using ACL "check_data"
 processing "accept"
 check verify = header_syntax
 accept: condition test succeeded in ACL "check_data"
+end of ACL "check_data": ACCEPT
 calling local_scan(); timeout=300
 local_scan() returned 0 NULL
 Writing spool header file
@@ -114,6 +116,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<abc@xyz>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0479 b/test/stderr/0479
index 92880ddb7..fe0190e97 100644
--- a/test/stderr/0479
+++ b/test/stderr/0479
@@ -67,6 +67,7 @@ sender a@b verified ok as rewritten-a@rewritten-b
 require: condition test succeeded in ACL "rcpt"
 processing "accept"
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<e@f>
 using ACL "rcpt"
@@ -80,6 +81,7 @@ using cached sender verify result
 require: condition test succeeded in ACL "rcpt"
 processing "accept"
 accept: condition test succeeded in ACL "rcpt"
+end of ACL "rcpt": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 the.local.host.name closing connection
diff --git a/test/stderr/0487 b/test/stderr/0487
index 448754ed5..4f2bbc2aa 100644
--- a/test/stderr/0487
+++ b/test/stderr/0487
@@ -30,6 +30,7 @@ SMTP>> 250 OK
 SMTP<< rcpt to:<userx@test.ex>
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
 SMTP>> 250 Accepted
 SMTP<< data
 SMTP>> 354 Enter message, ending with "." on a line by itself
diff --git a/test/stderr/0513 b/test/stderr/0513
index 5ee113b7c..b889bc065 100644
--- a/test/stderr/0513
+++ b/test/stderr/0513
@@ -19,4 +19,5 @@
 >>> ----------- end verify ------------
 >>>   message: >$acl_verify_message< ++++
 >>> defer: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": DEFER
 LOG: H=(a.b.c.d) [1.2.3.4] F=<> temporarily rejected RCPT <x@mxt2.test.ex>: all relevant MX records point to non-existent hosts
diff --git a/test/stderr/0524 b/test/stderr/0524
index d839bc3d3..22b7888de 100644
--- a/test/stderr/0524
+++ b/test/stderr/0524
@@ -13,6 +13,7 @@
 >>>   message: CSA status is $csa_status
 >>> check verify = csa
 >>> accept: condition test succeeded in ACL "check_mail"
+>>> end of ACL "check_mail": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> csa2.test.ex in helo_lookup_domains? no (end of list)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
diff --git a/test/stderr/0534 b/test/stderr/0534
index edda3c2a2..9296b5cd2 100644
--- a/test/stderr/0534
+++ b/test/stderr/0534
@@ -11,3 +11,4 @@
 >>> check hosts = 5.6.7.8
 >>> host in "5.6.7.8"? yes (matched "5.6.7.8")
 >>> accept: condition test succeeded in ACL "two"
+>>> end of ACL "two": ACCEPT
diff --git a/test/stderr/0537 b/test/stderr/0537
index a2fed387b..f6ad3ba90 100644
--- a/test/stderr/0537
+++ b/test/stderr/0537
@@ -40,7 +40,9 @@ LOG: sender_host_name=
 >>>                = sender_ident=
 LOG: sender_ident=
 >>> accept: condition test succeeded in ACL "log"
+>>> end of ACL "log": ACCEPT
 >>> accept: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -81,7 +83,9 @@ LOG: sender_host_name=hostname
 >>>                = sender_ident=ident
 LOG: sender_ident=ident
 >>> accept: condition test succeeded in ACL "log"
+>>> end of ACL "log": ACCEPT
 >>> accept: condition test succeeded in ACL "connect"
+>>> end of ACL "connect": ACCEPT
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> using ACL "mail"
 >>> processing "accept"
@@ -115,6 +119,7 @@ LOG: sender_host_name=hostname
 >>>                = sender_ident=ident
 LOG: sender_ident=ident
 >>> accept: condition test succeeded in ACL "log"
+>>> end of ACL "log": ACCEPT
 >>> check acl = auth
 >>> using ACL "auth"
 >>> processing "accept"
@@ -123,7 +128,9 @@ LOG: sender_ident=ident
 >>> check logwrite = +++ host is authenticated +++
 LOG: +++ host is authenticated +++
 >>> accept: condition test succeeded in ACL "auth"
+>>> end of ACL "auth": ACCEPT
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
 >>> using ACL "mail"
 >>> processing "accept"
 >>> check acl = log
@@ -156,6 +163,7 @@ LOG: sender_host_name=hostname
 >>>                = sender_ident=ident
 LOG: sender_ident=ident
 >>> accept: condition test succeeded in ACL "log"
+>>> end of ACL "log": ACCEPT
 >>> check acl = auth
 >>> using ACL "auth"
 >>> processing "accept"
@@ -164,4 +172,6 @@ LOG: sender_ident=ident
 >>> check logwrite = +++ host is authenticated +++
 LOG: +++ host is authenticated +++
 >>> accept: condition test succeeded in ACL "auth"
+>>> end of ACL "auth": ACCEPT
 >>> accept: condition test succeeded in ACL "mail"
+>>> end of ACL "mail": ACCEPT
diff --git a/test/stderr/0569 b/test/stderr/0569
index ea01fa87a..168f0eb53 100644
--- a/test/stderr/0569
+++ b/test/stderr/0569
@@ -13,8 +13,10 @@
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -23,6 +25,7 @@
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaX-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -39,14 +42,17 @@ LOG: 10HmaX-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>>   message: ${if def:acl_m_message {$acl_m_message}}
 >>> check verify = header_names_ascii
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: Invalid character in header "Received" found
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -63,14 +69,17 @@ LOG: 10HmbA-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> usery@exim.test.ex in "usery@exim.test.ex"? yes (matched "usery@exim.test.ex")
 >>> check set acl_m_message = I do not like your message
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>>   message: ${if def:acl_m_message {$acl_m_message}}
 >>> check verify = header_names_ascii
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbB-0005vi-00 H=[V4NET.10.10.10] F=<usery@exim.test.ex> rejected after DATA: Invalid character in header "Subjec⍅" found
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -87,14 +96,17 @@ LOG: 10HmbB-0005vi-00 H=[V4NET.10.10.10] F=<usery@exim.test.ex> rejected after D
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
 >>>   message: ${if def:acl_m_message {$acl_m_message}}
 >>> check verify = header_names_ascii
 >>> require: condition test failed in ACL "check_message"
+>>> end of ACL "check_message": not OK
 LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after DATA: Invalid character in header "Subjec⍅" found
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -111,8 +123,10 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -121,6 +135,7 @@ LOG: 10HmbC-0005vi-00 H=[V4NET.10.10.10] F=<userx@exim.test.ex> rejected after D
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaY-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
@@ -137,8 +152,10 @@ LOG: 10HmaY-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> accept: condition test failed in ACL "check_from"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_from"
+>>> end of ACL "check_from": ACCEPT
 >>> processing "accept"
 >>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 >>> using ACL "check_message"
 >>> processing "require"
@@ -147,4 +164,5 @@ LOG: 10HmaY-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
 >>> require: condition test succeeded in ACL "check_message"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_message"
+>>> end of ACL "check_message": ACCEPT
 LOG: 10HmaZ-0005vi-00 <= userx@exim.test.ex H=[V4NET.10.10.10] P=smtp S=sss
diff --git a/test/stderr/2600 b/test/stderr/2600
index a1adefa66..35b81412d 100644
--- a/test/stderr/2600
+++ b/test/stderr/2600
@@ -157,6 +157,7 @@ accept: condition test failed in ACL "check_recipient"
 processing "deny"
   message: relay not permitted
 deny: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": DENY
 SMTP>> 550 relay not permitted
 LOG: MAIN REJECT
   H=[10.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
@@ -186,6 +187,7 @@ accept: condition test failed in ACL "check_recipient"
 processing "deny"
   message: relay not permitted
 deny: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": DENY
 SMTP>> 550 relay not permitted
 LOG: MAIN REJECT
   H=[10.0.0.0] F=<a@b> rejected RCPT <c@d>: relay not permitted
@@ -244,6 +246,7 @@ lookup yielded: name=ok id=10.10.10.10
 host in "sqlite;TESTSUITE/aux-fixed/sqlitedb select * from them where id='10.10.10.10'"? yes (matched "sqlite;TESTSUITE/aux-fixed/sqlitedb select * from them where id='10.10.10.10'")
 host in "+relay_hosts"? yes (matched "+relay_hosts")
 accept: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< rcpt to:<c@d>
 using ACL "check_recipient"
@@ -267,6 +270,7 @@ lookup yielded: name=ok id=10.10.10.10
 host in "sqlite;TESTSUITE/aux-fixed/sqlitedb select * from them where id='10.10.10.10'"? yes (matched "sqlite;TESTSUITE/aux-fixed/sqlitedb select * from them where id='10.10.10.10'")
 host in "+relay_hosts"? yes (matched "+relay_hosts")
 accept: condition test succeeded in ACL "check_recipient"
+end of ACL "check_recipient": ACCEPT
 SMTP>> 250 Accepted
 SMTP<< quit
 SMTP>> 221 myhost.test.ex closing connection
diff --git a/test/stderr/3000 b/test/stderr/3000
index 47714a125..0b7c946d3 100644
--- a/test/stderr/3000
+++ b/test/stderr/3000
@@ -53,5 +53,6 @@ LOG: this is a warning at TESTSUITE/aux-fixed/3000.pl line 25.
 >>> check condition = ${if !eq {${perl{foo_warn}}}{}}
 >>>                 = true
 >>> accept: condition test succeeded in ACL "check_rcpt"
+>>> end of ACL "check_rcpt": ACCEPT
 
 ******** SERVER ********
diff --git a/test/stderr/3208 b/test/stderr/3208
index 7e12f1fe1..9b33e5f3d 100644
--- a/test/stderr/3208
+++ b/test/stderr/3208
@@ -19,6 +19,7 @@
 >>> test.ex in "!*relay.ex : test.ex : testhack.ex : testhack2.ex : testdb;defer"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> other.ex in percent_hack_domains? list match deferred for testdb;defer
 LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCPT <a@other.ex>: defer in percent_hack_domains check
 >>> testhack.ex in percent_hack_domains? yes (matched "testhack.ex")
@@ -35,6 +36,7 @@ LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCP
 >>> test.ex in "!*relay.ex : test.ex : testhack.ex : testhack2.ex : testdb;defer"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> testhack2.ex in percent_hack_domains? list match deferred for testdb;defer
 LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCPT <a%b@testhack2.ex>: defer in percent_hack_domains check
 >>> yesrelay.ex in percent_hack_domains? no (matched "!*relay.ex")
@@ -53,6 +55,7 @@ LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCP
 >>> yesrelay.ex in "test.ex : testhack.ex : testhack2.ex : yesrelay.ex : testdb;defer"? yes (matched "yesrelay.ex")
 >>> yesrelay.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> norelay.ex in percent_hack_domains? no (matched "!*relay.ex")
 >>> using ACL "check_recipient"
 >>> processing "accept"
@@ -87,6 +90,7 @@ LOG: H=(remote.host) [V4NET.0.0.1] F=<user@remote.host> temporarily rejected RCP
 >>> yesrelay.ex in "test.ex : testhack.ex : testhack2.ex : yesrelay.ex : testdb;defer"? yes (matched "yesrelay.ex")
 >>> yesrelay.ex in "+relay_domains"? yes (matched "+relay_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> testhack.ex in percent_hack_domains? yes (matched "testhack.ex")
 >>> norelay.ex in percent_hack_domains? no (matched "!*relay.ex")
 >>> using ACL "check_recipient"
diff --git a/test/stderr/3400 b/test/stderr/3400
index 529ce480c..138f2be2c 100644
--- a/test/stderr/3400
+++ b/test/stderr/3400
@@ -13,6 +13,7 @@
 >>> warn: condition test failed in ACL "check_connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
 >>> host in smtp_accept_max_nonmail_hosts? yes (matched "*")
 >>> using ACL "check_vrfy"
 >>> processing "deny"
@@ -22,6 +23,7 @@
 >>> deny: condition test failed in ACL "check_vrfy"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_vrfy"
+>>> end of ACL "check_vrfy": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing userx@test.ex
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
@@ -38,6 +40,7 @@
 >>> check hosts = 10.0.0.0/24
 >>> host in "10.0.0.0/24"? yes (matched "10.0.0.0/24")
 >>> accept: condition test succeeded in ACL "check_expn"
+>>> end of ACL "check_expn": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing list@test.ex
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
@@ -60,6 +63,7 @@ LOG: ETRN #abcd received from [10.0.0.2]
 LOG: H=[10.0.0.2] Warning: accepted ETRN #abcd
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_etrn"
+>>> end of ACL "check_etrn": ACCEPT
 >>> ETRN command is: exim -R
 >>> ETRN command execution skipped
 >>> host in hosts_connection_nolog? no (option unset)
@@ -77,6 +81,7 @@ LOG: H=[10.0.0.2] Warning: accepted ETRN #abcd
 >>> warn: condition test failed in ACL "check_connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
 >>> test.host in helo_lookup_domains? no (end of list)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in "10.0.0.1"? yes (matched "10.0.0.1")
@@ -89,6 +94,7 @@ LOG: H=[10.0.0.2] Warning: accepted ETRN #abcd
 >>>   message: authentication required
 >>> check !authenticated = *
 >>> deny: condition test succeeded in ACL "check_vrfy"
+>>> end of ACL "check_vrfy": DENY
 LOG: H=(test.host) [10.0.0.1] rejected VRFY userx@test.ex: authentication required
 >>> using ACL "check_expn"
 >>> processing "deny"
@@ -97,6 +103,7 @@ LOG: H=(test.host) [10.0.0.1] rejected VRFY userx@test.ex: authentication requir
 >>>   message: authentication required
 >>> check !authenticated = *
 >>> deny: condition test succeeded in ACL "check_expn"
+>>> end of ACL "check_expn": DENY
 LOG: H=(test.host) [10.0.0.1] rejected EXPN list@test.ex: authentication required
 LOG: ETRN abcd received from (test.host) [10.0.0.1]
 >>> using ACL "check_etrn"
@@ -106,6 +113,7 @@ LOG: ETRN abcd received from (test.host) [10.0.0.1]
 >>>   message: authentication required
 >>> check !authenticated = *
 >>> deny: condition test succeeded in ACL "check_etrn"
+>>> end of ACL "check_etrn": DENY
 LOG: H=(test.host) [10.0.0.1] rejected ETRN abcd: authentication required
 >>> using ACL "check_recipient"
 >>> processing "warn"
@@ -126,6 +134,7 @@ LOG: H=(test.host) [10.0.0.1] rejected ETRN abcd: authentication required
 >>>   message: authentication required
 >>> check !authenticated = *
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@test.ex>: authentication required
 >>> mylogin authenticator server_condition:
 >>>   $auth1 = userx secret
@@ -157,6 +166,7 @@ LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@te
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "warn"
 >>> check hosts = 10.0.0.5
@@ -195,6 +205,7 @@ LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@te
 >>> processing "deny"
 >>>   message: relay not permitted
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> A=mylogin rejected RCPT <userx@cus.cam.ac.uk>: relay not permitted
 >>> using ACL "check_vrfy"
 >>> processing "deny"
@@ -206,6 +217,7 @@ LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> A=mylogin rejected RCPT
 >>> deny: condition test failed in ACL "check_vrfy"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_vrfy"
+>>> end of ACL "check_vrfy": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing userx@test.ex
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
@@ -225,6 +237,7 @@ LOG: H=(test.host) [10.0.0.1] F=<junk@jink.jonk.test.ex> A=mylogin rejected RCPT
 >>> check hosts = 10.0.0.0/24
 >>> host in "10.0.0.0/24"? yes (matched "10.0.0.0/24")
 >>> accept: condition test succeeded in ACL "check_expn"
+>>> end of ACL "check_expn": ACCEPT
 >>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 >>> routing list@test.ex
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
@@ -250,6 +263,7 @@ LOG: ETRN #abcd received from (test.host) [10.0.0.1]
 LOG: H=(test.host) [10.0.0.1] Warning: accepted ETRN #abcd
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_etrn"
+>>> end of ACL "check_etrn": ACCEPT
 >>> ETRN command is: exim -R
 >>> ETRN command execution skipped
 >>> host in hosts_connection_nolog? no (option unset)
@@ -267,6 +281,7 @@ LOG: H=(test.host) [10.0.0.1] Warning: accepted ETRN #abcd
 >>> warn: condition test failed in ACL "check_connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
 >>> test.host in helo_lookup_domains? no (end of list)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in "10.0.0.1"? no (end of list)
@@ -345,6 +360,7 @@ LOG: H=(test.host) [10.0.0.3] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@cu
 >>> check authenticated = *
 >>> mylogin in "*"? yes (matched "*")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -360,6 +376,7 @@ LOG: H=(test.host) [10.0.0.3] F=<junk@jink.jonk.test.ex> rejected RCPT <userx@cu
 >>> warn: condition test failed in ACL "check_connect"
 >>> processing "accept"
 >>> accept: condition test succeeded in ACL "check_connect"
+>>> end of ACL "check_connect": ACCEPT
 >>> test.host in helo_lookup_domains? no (end of list)
 >>> host in pipelining_advertise_hosts? yes (matched "*")
 >>> host in "10.0.0.1"? no (end of list)
@@ -401,6 +418,7 @@ host in "10.0.0.6"? no (end of list)
 warn: condition test failed in ACL "check_connect"
 processing "accept"
 accept: condition test succeeded in ACL "check_connect"
+end of ACL "check_connect": ACCEPT
 SMTP>> 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
 smtp_setup_msg entered
 SMTP<< ehlo testing.testing
diff --git a/test/stderr/3408 b/test/stderr/3408
index 753824558..105c6ba99 100644
--- a/test/stderr/3408
+++ b/test/stderr/3408
@@ -19,6 +19,7 @@
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -37,6 +38,7 @@
 >>> DNS lookup for 14.12.11.V4NET.rbl.test.ex succeeded (yielding 127.0.0.2)
 >>> => that means V4NET.11.12.14 is listed at rbl.test.ex
 >>> deny: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": DENY
 LOG: H=(exim.test.ex) [V4NET.11.12.14] F=<postmaster@exim.test.ex> rejected RCPT userx@exim.test.ex: host is listed in rbl.test.ex
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtp S=sss
@@ -69,6 +71,7 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> postmaster@exim.test.ex in "postmaster@exim.test.ex"? yes (matched "postmaster@exim.test.ex")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> using ACL "check_recipient"
 >>> processing "accept"
 >>> check hosts = :
@@ -114,5 +117,6 @@ LOG: 10HmaX-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.1
 >>> exim.test.ex in "exim.test.ex"? yes (matched "exim.test.ex")
 >>> exim.test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= postmaster@exim.test.ex H=(exim.test.ex) [V4NET.11.12.14] P=esmtpa A=plain:userx S=sss
diff --git a/test/stderr/3410 b/test/stderr/3410
index e129996a7..618d18aca 100644
--- a/test/stderr/3410
+++ b/test/stderr/3410
@@ -30,6 +30,7 @@ LOG: H=[5.6.9.1] F=<x@y> rejected RCPT <x@y>: You must authenticate
 >>> check authenticated = *
 >>> auth1 in "*"? yes (matched "*")
 >>> accept: condition test succeeded in ACL "acl_5_6_9"
+>>> end of ACL "acl_5_6_9": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
@@ -60,6 +61,7 @@ LOG: H=[5.6.10.1] F=<x@y> rejected RCPT <x@y>
 >>> check authenticated = auth1
 >>> auth1 in "auth1"? yes (matched "auth1")
 >>> accept: condition test succeeded in ACL "acl_5_6_10"
+>>> end of ACL "acl_5_6_10": ACCEPT
 >>> host in hosts_connection_nolog? no (option unset)
 >>> host in host_lookup? no (option unset)
 >>> host in host_reject_connection? no (option unset)
diff --git a/test/stderr/3500 b/test/stderr/3500
index ee07be398..53c850879 100644
--- a/test/stderr/3500
+++ b/test/stderr/3500
@@ -58,6 +58,7 @@
 >>> test.ex in "test.ex : *.test.ex"? yes (matched "test.ex")
 >>> test.ex in "+local_domains"? yes (matched "+local_domains")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaY-0005vi-00 <= userx@some.domain H=(test.host) [10.0.0.1] P=esmtpa A=cram_md5:tim S=sss
 >>> host in hosts_connection_nolog? no (option unset)
@@ -93,5 +94,6 @@ LOG: cram_md5 authenticator failed for (test.host) [10.0.0.5]: 535 Incorrect aut
 >>> check hosts = 10.0.0.5
 >>> host in "10.0.0.5"? yes (matched "10.0.0.5")
 >>> accept: condition test succeeded in ACL "check_recipient"
+>>> end of ACL "check_recipient": ACCEPT
 >>> host in ignore_fromline_hosts? no (option unset)
 LOG: 10HmaZ-0005vi-00 <= userx@some.domain H=(test.host) [10.0.0.5] P=esmtp S=sss
diff --git a/test/stderr/5400 b/test/stderr/5400
index 1c9b0d83a..fc3b6063d 100644
--- a/test/stderr/5400
+++ b/test/stderr/5400
@@ -12,6 +12,7 @@ LOG: MAIN
   rcpt for userx@domain.com
 created log directory TESTSUITE/spool/log
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
@@ -24,6 +25,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Send data
 ----------- start cutthrough headers send -----------
@@ -57,6 +59,7 @@ check logwrite = rcpt for $local_part@$domain
 LOG: MAIN
   rcpt for userz@domain.com
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 SMTP only spoken here
@@ -71,6 +74,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Send data
 ----------- start cutthrough headers send -----------
@@ -104,6 +108,7 @@ check logwrite = rcpt for $local_part@$domain
 LOG: MAIN
   rcpt for usery@domain.com
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
@@ -122,6 +127,7 @@ check logwrite = rcpt for $local_part@$domain
 LOG: MAIN
   rcpt for userx@domain.com
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
   SMTP>> QUIT
 ----------- cutthrough shutdown (more than one recipient) ------------
 LOG: MAIN
@@ -186,6 +192,7 @@ check logwrite = rcpt for $local_part@$domain
 LOG: MAIN
   rcpt for userx@domain.com
 accept: condition test succeeded in ACL "ar"
+end of ACL "ar": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
@@ -198,6 +205,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Send data
 ----------- start cutthrough headers send -----------
diff --git a/test/stderr/5401 b/test/stderr/5401
index 1bd14f8d5..1b42441d9 100644
--- a/test/stderr/5401
+++ b/test/stderr/5401
@@ -9,6 +9,7 @@ check control = cutthrough_delivery
 check verify = recipient
 ----------- end verify ------------
 accept: condition test succeeded in ACL "acl_rcpt"
+end of ACL "acl_rcpt": ACCEPT
 ----------- start cutthrough setup ------------
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
@@ -21,6 +22,7 @@ Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Send data
 ----------- start cutthrough headers send -----------
diff --git a/test/stderr/5410 b/test/stderr/5410
index ddd6dbcc6..09685491d 100644
--- a/test/stderr/5410
+++ b/test/stderr/5410
@@ -32,6 +32,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -96,6 +97,7 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
@@ -190,6 +192,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -230,6 +233,7 @@ expanding: ${if eq {$address_data}{usery}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
@@ -324,6 +328,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -364,6 +369,7 @@ expanding: ${if eq {$address_data}{usery}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
diff --git a/test/stderr/5420 b/test/stderr/5420
index 9eea77d05..5694e911f 100644
--- a/test/stderr/5420
+++ b/test/stderr/5420
@@ -32,6 +32,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -98,6 +99,7 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
@@ -192,6 +194,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -232,6 +235,7 @@ expanding: ${if eq {$address_data}{usery}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
@@ -326,6 +330,7 @@ expanding: $local_part
 domain.com in "*"? yes (matched "*")
 ----------- end verify ------------
 accept: condition test succeeded in ACL "cutthrough"
+end of ACL "cutthrough": ACCEPT
 ----------- start cutthrough setup ------------
 domain.com in "test.ex : *.test.ex"? no (end of list)
 domain.com in "! +local_domains"? yes (end of list)
@@ -366,6 +371,7 @@ expanding: ${if eq {$address_data}{usery}{*}{:}}
 ----------- end cutthrough setup ------------
 processing "accept"
 accept: condition test succeeded in inline ACL
+end of inline ACL: ACCEPT
   SMTP>> DATA
   SMTP<< 354 Enter message, ending with "." on a line by itself
 expanding: ${tod_full}
diff --git a/test/stderr/5700 b/test/stderr/5700
index 4f28d19c4..dcb696955 100644
--- a/test/stderr/5700
+++ b/test/stderr/5700
@@ -1,2 +1,2 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_deliver_action in smtp: error from acl "logger"
+1999-03-02 09:44:33 10HmaX-0005vi-00 failed to expand tpda_event_action msg:delivery in smtp: error from acl "logger"
 
diff --git a/test/stdout/3450 b/test/stdout/3450
index 1bd2e21d2..24b1f8bf9 100644
--- a/test/stdout/3450
+++ b/test/stdout/3450
@@ -50,7 +50,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
diff --git a/test/stdout/3454 b/test/stdout/3454
index ae2eab337..5cdb2a760 100644
--- a/test/stdout/3454
+++ b/test/stdout/3454
@@ -22,7 +22,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
@@ -64,7 +63,6 @@ Connecting to 127.0.0.1 port 1225 ... connected
 Attempting to start TLS
 SSL info: before/connect initialization
 SSL info: before/connect initialization
-SSL info: SSLv2/v3 write client hello A
 SSL info: SSLv3 read server hello A
 SSL info: SSLv3 read server certificate A
 SSL info: SSLv3 read server key exchange A
-- 
cgit v1.2.3