diff -urN ../exim-4.94.2.orig/src/exim.c ./src/exim.c
--- ../exim-4.94.2.orig/src/exim.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/exim.c	2021-05-15 15:02:53.591242000 +0300
@@ -2789,9 +2789,11 @@
 		  else badarg = TRUE;
 		  break;
 
-    /* -MCG: set the queue name, to a non-default value */
+    /* -MCG: set the queue name, to a non-default value. Arguably, anything
+       from the commandline should be tainted - but we will need an untainted
+       value for the spoolfile when doing a -odi delivery process. */
 
-	case 'G': if (++i < argc) queue_name = string_copy_taint(exim_str_fail_toolong(argv[i], EXIM_DRIVERNAME_MAX, "-MCG"), TRUE);
+	case 'G': if (++i < argc) queue_name = string_copy_taint(exim_str_fail_toolong(argv[i], EXIM_DRIVERNAME_MAX, "-MCG"), FALSE);
 		  else badarg = TRUE;
 		  break;
 
diff -urN ../exim-4.94.2.orig/src/host.c ./src/host.c
--- ../exim-4.94.2.orig/src/host.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/host.c	2021-05-15 15:02:53.600417000 +0300
@@ -1197,9 +1197,9 @@
   c++;
   }
 
-c[-1] = '\0';	/* drop trailing colon */
+*--c = '\0';	/* drop trailing colon */
 
-/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, d, d + 2*(k+1)); */
+/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, buffer, buffer + 2*(k+1)); */
 if (k >= 0)
   {			/* collapse */
   c = d + 2*(k+1);
diff -urN ../exim-4.94.2.orig/src/transports/smtp.c ./src/transports/smtp.c
--- ../exim-4.94.2.orig/src/transports/smtp.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/transports/smtp.c	2021-05-15 15:02:53.629704000 +0300
@@ -2015,7 +2015,7 @@
       {
       case OK:		sx->conn_args.dane = TRUE;
 			ob->tls_tempfail_tryclear = FALSE;	/* force TLS */
-			ob->tls_sni = sx->first_addr->domain;	/* force SNI */
+                        ob->tls_sni = sx->conn_args.host->name; /* force SNI */
 			break;
       case FAIL_FORCED:	break;
       default:		set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
@@ -2097,7 +2097,7 @@
 	  {
 	  case OK:		sx->conn_args.dane = TRUE;
 				ob->tls_tempfail_tryclear = FALSE;	/* force TLS */
-				ob->tls_sni = sx->first_addr->domain;	/* force SNI */
+				ob->tls_sni = sx->conn_args.host->name; /* force SNI */
 				break;
 	  case FAIL_FORCED:	break;
 	  default:		set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
diff -urN ../exim-4.94.2.orig/src/version.h ./src/version.h
--- ../exim-4.94.2.orig/src/version.h	2021-04-30 15:11:38.000000000 +0300
+++ ./src/version.h	2021-05-15 15:02:54.093949000 +0300
@@ -1,5 +1,5 @@
 /* automatically generated file - see ../scripts/reversion */
-#define EXIM_RELEASE_VERSION "4.94.2"
+#define EXIM_RELEASE_VERSION "4.94.2-6-1e7013764"
 #ifdef EXIM_VARIANT_VERSION
 #define EXIM_VERSION_STR EXIM_RELEASE_VERSION "-" EXIM_VARIANT_VERSION
 #else
diff -urN ../exim-4.94.2.orig/src/version.sh ./src/version.sh
--- ../exim-4.94.2.orig/src/version.sh	2021-04-30 15:11:38.000000000 +0300
+++ ./src/version.sh	2021-05-15 15:02:54.093594000 +0300
@@ -1,3 +1,3 @@
 # automatically generated file - see ../scripts/reversion
-EXIM_RELEASE_VERSION="4.94.2"
+EXIM_RELEASE_VERSION="4.94.2-6-1e7013764"
 EXIM_COMPILE_NUMBER="1"