From postconf-devel at de.postfix.org Sat Mar 3 23:00:02 2012
From: postconf-devel at de.postfix.org (postconf-devel at de.postfix.org)
Date: Sat, 3 Mar 2012 23:00:02 +0100
Subject: [postconf-devel] [postconf.5.html] UPDATE
Message-ID: <20120303220002.46B933DA45@de.postfix.org>
An embedded and charset-unspecified text was scrubbed...
Name: not available
URL:
> - The numerical Postfix SMTP server response code for
> - an access(5) map "defer" action, including "defer_if_permit"
> - or "defer_if_reject". Prior to Postfix 2.6, the response
> - is hard-coded as "450".
> -
> - Do not change this unless you have a complete understanding of RFC 2821.
> -
> - This feature is available in Postfix 2.6 and later.
> -
> ! The numerical Postfix SMTP server response code for
> ! an access(5) map "reject" action.
>
> ! The numerical Postfix SMTP server response code when a client
> ! is rejected by an access(5) map restriction.
> The amount of time between verify(8) address verification
> - database cleanup runs. This feature requires that the database
> - supports the "delete" and "sequence" operators. Specify a zero
> - interval to disable database cleanup. After each database cleanup run, the verify(8) daemon logs the
> - number of entries that were retained and dropped. A cleanup run is
> - logged as "partial" when the daemon terminates early after "postfix
> - reload", "postfix stop", or no requests for $max_idle
> - seconds. Time units: s (seconds), m (minutes), h (hours), d (days), w
> - (weeks). This feature is available in Postfix 2.7.
> ! Lookup table for persistent address verification status
> storage. The table is maintained by the verify(8) service, and
> --- 133,138 ----
>
> ! Optional lookup table for persistent address verification status
> storage. The table is maintained by the verify(8) service, and
> ***************
> *** 185,190 ****
>
> ! The lookup table is persistent by default (Postfix 2.7 and later).
> ! Specify an empty table name to keep the information in volatile
> ! memory which is lost after "postfix reload" or "postfix
> ! stop". This is the default with Postfix version 2.6 and earlier.
>
> ! By default, the information is kept in volatile memory, and is lost
> ! after "postfix reload" or "postfix stop".
>
Postfix daemon processes do not use root privileges when opening > ! this file (Postfix 2.5 and later). The file must therefore be > ! stored under a Postfix-owned directory such as the data_directory. > ! As a migration aid, an attempt to open the file under a non-Postfix > ! directory is redirected to the Postfix-owned data_directory, and a > ! warning is logged.
> > --- 149,158 ---- > database becomes corrupted, the world comes to an end. To recover > ! delete the file and do "postfix reload". > > > !As of version 2.5, Postfix no longer uses root privileges when > ! opening this file. The file should now be stored under the Postfix-owned > ! data_directory. As a migration aid, an attempt to open the file > ! under a non-Postfix directory is redirected to the Postfix-owned > ! data_directory, and a warning is logged.
> > *************** > *** 276,278 **** >By default, the Postfix SMTP server polls the verify(8) service > ! up to three times under non-overload conditions, and only once when > ! under overload. With Postfix version 2.5 and earlier, the SMTP > ! server always polls the verify(8) service up to three times by > ! default.
> > --- 237,241 ---- > > !> ! The default poll count is 3. > !
> > *************** > *** 291,293 **** > Specify 1 to implement a crude form of greylisting, that is, always > ! defer the first delivery request for a new address. > > --- 243,245 ---- > Specify 1 to implement a crude form of greylisting, that is, always > ! defer the first delivery request for a never seen before address. > > *************** > *** 295,297 **** >> ! Examples: >
> --- 247,249 ---- >> ! Example: >
> *************** > *** 299,303 **** >> - # Postfix ≤ 2.6 default > - address_verify_poll_count = 3 > - # Poor man's greylisting > address_verify_poll_count = 1 > --- 251,252 ---- > *************** > *** 435,447 **** > > -
Overrides the sender_dependent_default_transport_maps parameter > - setting for address verification probes.
> - > -This feature is available in Postfix 2.7 and later.
> - > - > -The time between changes in the time-dependent portion of address > - verification probe sender addresses. The time-dependent portion is > - appended to the localpart of the address specified with the > - address_verify_sender parameter. This feature is ignored when the > - probe sender addresses is the null sender, i.e. the address_verify_sender > - value is empty or <>.
> - > -Historically, the probe sender address was fixed. This has > - caused such addresses to end up on spammer mailing lists, and has > - resulted in wasted network and processing resources.
> - > -To enable time-dependent probe sender addresses, specify a > - non-zero time value (an integral value plus an optional one-letter > - suffix that specifies the time unit). Specify a value of at least > - several hours, to avoid problems with senders that use greylisting. > - Avoid nice TTL values, to make the result less predictable. Time > - units are: s (seconds), m (minutes), h (hours), d (days), w (weeks). > -
> - > -This feature is available in Postfix 2.9 and later.
> - > - > -To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > --- 606,608 ---- >To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > *************** > *** 749,762 **** > > -Always add (Resent-) From:, To:, Date: or Message-ID: headers > - when not present. Postfix 2.6 and later add these headers only > - when clients match the local_header_rewrite_clients parameter > - setting. Earlier Postfix versions always add these headers; this > - may break DKIM signatures that cover non-existent headers.
> - > - > -To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > --- 758,760 ---- >To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > *************** > *** 896,898 **** >To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > --- 795,797 ---- >To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > *************** > *** 906,908 **** > How long the postkick(1) command waits for a request to enter the > ! Postfix daemon process input buffer before giving up. > > --- 805,807 ---- > How long the postkick(1) command waits for a request to enter the > ! server's input buffer before giving up. > > *************** > *** 922,924 **** >> ! authorized_submit_users = !www, static:all >> --- 920,922 ---- >
> ! authorized_submit_users = !www, static:all >> *************** > *** 1034,1036 **** > > !
What remote SMTP clients are allowed to specify the XVERP command. > This command requests that mail be delivered one recipient at a > --- 933,935 ---- > > !
What SMTP clients are allowed to specify the XVERP command. > This command requests that mail be delivered one recipient at a > *************** > *** 1246,1252 **** >
The maximal amount of original message text that is sent in a > ! non-delivery notification. Specify a byte count. A message is > ! returned as either message/rfc822 (the complete original) or as > ! text/rfc822-headers (the headers only). With Postfix version 2.4 > ! and earlier, a message is always returned as message/rfc822 and is > ! truncated when it exceeds the size limit. >
> --- 1145,1151 ---- >The maximal amount of original message text that is sent in a > ! non-delivery notification. Specify a byte count. With Postfix 2.4 > ! and later, a message is returned as either message/rfc822 (the > ! complete original) or as text/rfc822-headers (the headers only). > ! With earlier Postfix versions, a message is always returned as > ! message/rfc822 and is truncated when it exceeds the size limit. >
> *************** > *** 1293,1295 **** >> ! Enable inter-operability with remote SMTP clients that implement an obsolete > version of the AUTH command (RFC 4954). Examples of such clients > --- 1192,1194 ---- >
> ! Enable inter-operability with SMTP clients that implement an obsolete > version of the AUTH command (RFC 4954). Examples of such clients > *************** > *** 1360,1362 **** >
To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > --- 1259,1261 ---- >To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > *************** > *** 1537,1540 **** > > -This feature is available in Postfix 2.2 and later.
> - > > --- 1436,1437 ---- > *************** > *** 1568,1593 **** > > !After the message is queued, send the entire message to the > ! specified transport:destination. The transport name > ! specifies the first field of a mail delivery agent definition in > ! master.cf; the syntax of the next-hop destination is described > ! in the manual page of the corresponding delivery agent. More > ! information about external content filters is in the Postfix > ! FILTER_README file.
> ! > !Notes:
> ! > !This setting has lower precedence than a FILTER action > ! that is specified in an access(5), header_checks(5) or body_checks(5) > ! table.
> ! > !The meaning of an empty next-hop filter destination > ! is version dependent. Postfix 2.7 and later will use the recipient > ! domain; earlier versions will use $myhostname. Specify > ! "default_filter_nexthop = $myhostname" for compatibility with Postfix > ! 2.6 or earlier, or specify a content_filter value with an explicit > ! next-hop destination.
> > !> ! The name of a mail delivery transport that filters mail after > ! it is queued. > !
> > !> ! This parameter uses the same syntax as the right-hand side of a > ! Postfix transport(5) table. This setting has a lower precedence > ! than a content filter that is specified with an access(5) table or > ! in a header_checks(5) or body_checks(5) table. > !
> > *************** > *** 1622,1656 **** > > -How a Postfix daemon process handles errors while opening lookup > - tables: gradual degradation or immediate termination.
> - > - Gradual degradation: a
> - daemon process logs a message of type "error" and continues execution
> - with reduced functionality. Features that do not depend on the
> - unavailable table will work normally, while features that depend
> - on the table will result in a type "warning" message.
When
> - the notify_classes parameter value contains the "data" class, the
> - Postfix SMTP server and client will report transcripts of sessions
> - with an error because a table is unavailable.
Immediate > - termination: a daemon process logs a type "fatal" message and > - terminates immediately. This option reduces the number of possible > - code paths through Postfix, and may therefore be slightly more > - secure than the default.
For the sake of sanity, the number of type "error" messages is > - limited to 13 over the lifetime of a daemon process.
> - > -This feature is available in Postfix 2.9 and later.
> - > - > -Use transport_destination_concurrency_negative_feedback > to specify a transport-specific override, where transport > --- 1811,1813 ---- > > !
Use transport_destination_concurrency_negative_feedback > to specify a transport-specific override, where transport > *************** > *** 2033,2036 **** >
NOTE: the delay is enforced by the queue manager. The delay > ! timer state does not survive "postfix reload" or "postfix > ! stop". >
> --- 1884,1886 ---- >NOTE: the delay is enforced by the queue manager. The delay > ! timer state does not survive "postfix reload" or "postfix stop". >
> *************** > *** 2042,2048 **** > > -NOTE: with a non-zero _destination_rate_delay, specify a > - transport_destination_concurrency_failed_cohort_limit of 10 > - or more to prevent Postfix from deferring all mail for the same > - destination after only one connection or handshake error.
> - >This feature is available in Postfix 2.5 and later.
> --- 1892,1893 ---- > *************** > *** 2093,2109 **** > > -When a content_filter or FILTER request specifies no explicit > - next-hop destination, use $default_filter_nexthop instead; when > - that value is empty, use the domain in the recipient address. > - Specify "default_filter_nexthop = $myhostname" for compatibility > - with Postfix version 2.6 and earlier, or specify an explicit next-hop > - destination with each content_filter value or FILTER action.
> - > -This feature is available in Postfix 2.7 and later.
> - > - > -> ! The default Postfix SMTP server response template for a request that is > rejected by an RBL-based restriction. This template can be overruled > --- 1986,1988 ---- >
> ! The default SMTP server response template for a request that is > rejected by an RBL-based restriction. This template can be overruled > *************** > *** 2346,2356 **** > $proxy_interfaces, $virtual_alias_domains, $virtual_mailbox_domains, > ! or $relay_domains. This information can be overruled with the > ! sender_dependent_default_transport_maps parameter and with the > ! transport(5) table.
> ! > !> ! In order of decreasing precedence, the nexthop destination is taken > ! from $sender_dependent_default_transport_maps, $default_transport, > $sender_dependent_relayhost_maps, $relayhost, or from the recipient > ! domain. >
> --- 2176,2182 ---- > $proxy_interfaces, $virtual_alias_domains, $virtual_mailbox_domains, > ! or $relay_domains. In order of decreasing precedence, the nexthop > ! destination is taken from $default_transport, > $sender_dependent_relayhost_maps, $relayhost, or from the recipient > ! domain. This information can be overruled with the transport(5) > ! table. > > *************** > *** 2360,2363 **** > is the name of a mail delivery transport defined in master.cf. > ! The :nexthop destination is optional; its syntax is documented > ! in the manual page of the corresponding delivery agent. > > --- 2186,2189 ---- > is the name of a mail delivery transport defined in master.cf. > ! The :nexthop part is optional. For more details see the > ! transport(5) manual page. > > *************** > *** 2462,2464 **** > > !A debugging aid to artifically delay DNS responses.
> - > -This feature is available in Postfix 2.8.
> - > - > -The name of the dnsblog(8) service entry in master.cf. This > - service performs DNS white/blacklist lookups.
> - > -This feature is available in Postfix 2.8 and later.
> - > - > -The sender_dependent_default_transport_maps search string that > - will be used instead of the null sender address.
> - > -This feature is available in Postfix 2.7 and later.
> - > - > -Enable long, non-repeating, queue IDs (queue file names). The > - benefit of non-repeating names is simpler logfile analysis and > - easier queue migration (there is no need to run "postsuper" to > - change queue file names that don't match their message file inode > - number).
> - > -Note: see below for how to prepare long queue file names > - for migration to Postfix ≤ 2.8.
> - > -Changing the parameter value to "yes" has the following effects: > -
> - > -Existing queue file names are not affected.
> - > -New queue files are created with names such as 3Pt2mN2VXxznjll. > - These are encoded in a 52-character alphabet that contains digits > - (0-9), upper-case letters (B-Z) and lower-case letters (b-z). For > - safety reasons the vowels (AEIOUaeiou) are excluded from the alphabet. > - The name format is: 6 or more characters for the time in seconds, > - 4 characters for the time in microseconds, the 'z'; the remainder > - is the file inode number encoded in the first 51 characters of the > - 52-character alphabet.
> - > -New messages have a Message-ID header with > - queueID@myhostname.
> - > -The mailq (postqueue -p) output has a wider Queue ID column. > - The number of whitespace-separated fields is not changed.
> - > -
The hash_queue_depth algorithm uses the first characters > - of the queue file creation time in microseconds, after conversion > - into hexadecimal representation. This produces the same queue hashing > - behavior as if the queue file name was created with "enable_long_queue_ids > - = no".
> - > -Changing the parameter value to "no" has the following effects: > -
> - > -Existing long queue file names are renamed to the short > - form (while running "postfix reload" or "postsuper").
> - > -New queue files are created with names such as C3CD21F3E90 > - from a hexadecimal alphabet that contains digits (0-9) and upper-case > - letters (A-F). The name format is: 5 characters for the time in > - microseconds; the remainder is the file inode number.
> - > -New messages have a Message-ID header with > - YYYYMMDDHHMMSS.queueid@myhostname, where > - YYYYMMDDHHMMSS are the year, month, day, hour, minute and > - second. > - > -
The mailq (postqueue -p) output has the same format as > - with Postfix ≤ 2.8.
> - > -
The hash_queue_depth algorithm uses the first characters > - of the queue file name, with the hexadecimal representation of the > - file creation time in microseconds.
> - > -Before migration to Postfix ≤ 2.8, the following commands > - are required to convert long queue file names into short names:
> - > -> - # postfix stop > - # postconf enable_long_queue_ids=no > - # postsuper > -> - > -
Repeat the postsuper command until it reports no more queue file > - name changes.
> - > -This feature is available in Postfix 2.9 and later.
> - > - > -With long queue file names, queue hashing produces the same > ! results as with short names. The file creation time in microseconds > ! is converted into hexadecimal form before the result is used for > ! queue hashing. The base 16 encoding gives finer control over the > ! number of subdirectories than is possible with the base 52 encoding > ! of long queue file names.
> > --- 2962,2965 ---- > The number of subdirectory levels for queue directories listed with > ! the hash_queue_names parameter. > ! > > *************** > *** 3460,3462 **** >> ! With the default 100 Postfix SMTP server process limit, "in_flow_delay > = 1s" limits the mail inflow to 100 messages per second above the > --- 3158,3160 ---- >
> ! With the default 100 SMTP server process limit, "in_flow_delay > = 1s" limits the mail inflow to 100 messages per second above the > *************** > *** 3497,3500 **** > "inside" and "outside" interfaces, this can prevent each instance from > ! being able to reach remote SMTP servers on the "other side" of the > ! firewall. Setting > smtp_bind_address to 0.0.0.0 avoids the potential problem for > --- 3195,3197 ---- > "inside" and "outside" interfaces, this can prevent each instance from > ! being able to reach servers on the "other side" of the firewall. Setting > smtp_bind_address to 0.0.0.0 avoids the potential problem for > *************** > *** 3536,3538 **** >
With Postfix 2.8 and earlier the default is "ipv4". For backwards > - compatibility with these releases, the Postfix 2.9 and later upgrade > - procedure appends an explicit "inet_protocols = ipv4" setting to > - main.cf when no explicit setting is present. This compatibility > - workaround will be phased out as IPv6 deployment becomes more common. > -
> - >This feature is available in Postfix 2.2 and later.
> --- 3241,3242 ---- > *************** > *** 3564,3566 **** >When IPv4 support is enabled via the inet_protocols parameter, > ! Postfix will look up DNS type A records, and will convert > IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original > --- 3254,3256 ---- >
When IPv4 support is enabled via the inet_protocols parameter, > ! Postfix will to DNS type A record lookups, and will convert > IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original > *************** > *** 3581,3584 **** >
> ! inet_protocols = ipv4 > ! inet_protocols = all (DEFAULT) > inet_protocols = ipv6 > --- 3271,3274 ---- >> ! inet_protocols = ipv4 (DEFAULT) > ! inet_protocols = all > inet_protocols = ipv6 > *************** > *** 3659,3663 **** > The time after which a client closes an idle internal communication > ! channel. The purpose is to allow Postfix daemon processes to > ! terminate voluntarily after they become idle. This is used, for > ! example, by the Postfix address resolving and rewriting clients. > > --- 3349,3353 ---- > The time after which a client closes an idle internal communication > ! channel. The purpose is to allow servers to terminate voluntarily > ! after they become idle. This is used, for example, by the address > ! resolving and rewriting clients. > > *************** > *** 3697,3702 **** > The time after which a client closes an active internal communication > ! channel. The purpose is to allow Postfix daemon processes to > ! terminate voluntarily > after reaching their client limit. This is used, for example, by > ! the Postfix address resolving and rewriting clients. > > --- 3387,3391 ---- > The time after which a client closes an active internal communication > ! channel. The purpose is to allow servers to terminate voluntarily > after reaching their client limit. This is used, for example, by > ! the address resolving and rewriting clients. > > *************** > *** 3724,3749 **** > > -
The LMTP-specific version of the smtp_address_preference > - configuration parameter. See there for details.
> - > -This feature is available in Postfix 2.8 and later.
> - > - > -When a remote LMTP server announces no DSN support, assume that > - the > - server performs final delivery, and send "delivered" delivery status > - notifications instead of "relayed". The default setting is backwards > - compatible to avoid the infinetisimal possibility of breaking > - existing LMTP-based content filters.
> - > - > -The LMTP-specific version of the smtp_body_checks configuration > - parameter. See there for details.
> - > -This feature is available in Postfix 2.5 and later.
> - > - > -This parameter is available in Postfix version 2.2 and earlier. > - With Postfix version 2.3 and later, see lmtp_connection_cache_on_demand, > - lmtp_connection_cache_destinations, or lmtp_connection_reuse_time_limit. > -
> - >> The effectiveness of cached connections will be determined by the > ! number of remote LMTP servers in use, and the concurrency limit specified > ! for the Postfix LMTP client. Cached connections are closed under any of > the following conditions: > --- 3444,3449 ---- > >
> The effectiveness of cached connections will be determined by the > ! number of LMTP servers in use, and the concurrency limit specified > ! for the LMTP client. Cached connections are closed under any of > the following conditions: > *************** > *** 3804,3806 **** > > !
> ! Most of these limitations have been with the Postfix > a connection cache that is shared among multiple LMTP client > --- 3470,3472 ---- >
> ! Most of these limitations will be removed after Postfix implements > a connection cache that is shared among multiple LMTP client > *************** > *** 3843,3845 **** > > !
The Postfix LMTP client time limit for completing a TCP connection, or > zero (use the operating system built-in time limit). When no > --- 3492,3494 ---- > > !
The LMTP client time limit for completing a TCP connection, or > zero (use the operating system built-in time limit). When no > *************** > *** 3912,3917 **** > > !
The Postfix LMTP client time limit for sending the LMTP ".", > ! and for receiving the remote LMTP server response. When no response > ! is received within the deadline, a warning is logged that the mail > ! may be delivered multiple times.
> > --- 3561,3566 ---- > > !The LMTP client time limit for sending the LMTP ".", and for > ! receiving the server response. When no response is received within > ! the deadline, a warning is logged that the mail may be delivered > ! multiple times.
> > *************** > *** 3929,3933 **** >> ! The Postfix LMTP client time limit for sending the LMTP DATA command, > ! and > ! for receiving the remote LMTP server response. >
> --- 3578,3581 ---- >> ! The LMTP client time limit for sending the LMTP DATA command, and > ! for receiving the server response. >
> *************** > *** 3946,3949 **** >> ! The Postfix LMTP client time limit for sending the LMTP message > ! content. > When the connection stalls for more than $lmtp_data_xfer_timeout > --- 3594,3596 ---- >
> ! The LMTP client time limit for sending the LMTP message content. > When the connection stalls for more than $lmtp_data_xfer_timeout > *************** > *** 4002,4005 **** > case insensitive lists of LHLO keywords (pipelining, starttls, > ! auth, etc.) that the Postfix LMTP client will ignore in the LHLO > ! response > from a remote LMTP server. See lmtp_discard_lhlo_keywords for > --- 3649,3651 ---- > case insensitive lists of LHLO keywords (pipelining, starttls, > ! auth, etc.) that the LMTP client will ignore in the LHLO response > from a remote LMTP server. See lmtp_discard_lhlo_keywords for > *************** > *** 4017,4020 **** >
A case insensitive list of LHLO keywords (pipelining, starttls, > ! auth, etc.) that the Postfix LMTP client will ignore in the LHLO > ! response > from a remote LMTP server.
> --- 3663,3665 ---- >A case insensitive list of LHLO keywords (pipelining, starttls, > ! auth, etc.) that the LMTP client will ignore in the LHLO response > from a remote LMTP server.
> *************** > *** 4038,4050 **** > > -The LMTP-specific version of the smtp_dns_resolver_options > - configuration parameter. See there for details.
> - > -This feature is available in Postfix 2.8 and later.
> - > - > -The LMTP-specific version of the smtp_header_checks configuration > - parameter. See there for details.
> - > -This feature is available in Postfix 2.5 and later.
> - > - > -The Postfix LMTP client time limit for sending the LHLO command, > ! and for receiving the initial remote LMTP server response.
> > --- 3751,3754 ---- > > !The LMTP client time limit for sending the LHLO command, and > ! for receiving the initial server response.
> > *************** > *** 4152,4155 **** >> ! The Postfix LMTP client time limit for sending the MAIL FROM command, > ! and for receiving the remote LMTP server response. >
> --- 3775,3778 ---- >> ! The LMTP client time limit for sending the MAIL FROM command, and > ! for receiving the server response. >
> *************** > *** 4164,4176 **** > > -The LMTP-specific version of the smtp_mime_header_checks > - configuration parameter. See there for details.
> - > -This feature is available in Postfix 2.5 and later.
> - > - > -The LMTP-specific version of the smtp_nested_header_checks > - configuration parameter. See there for details.
> - > -This feature is available in Postfix 2.5 and later.
> - > - > -The LMTP-specific version of the smtp_per_record_deadline > - configuration parameter. See there for details.
> - > -This feature is available in Postfix 2.9 and later.
> - > - > -> ! The Postfix LMTP client time limit for sending the QUIT command, > ! and for receiving the remote LMTP server response. >
> --- 3857,3860 ---- >> ! The LMTP client time limit for sending the QUIT command, and for > ! receiving the server response. >
> *************** > *** 4305,4308 **** >> ! The Postfix LMTP client time limit for sending the RCPT TO command, > ! and for receiving the remote LMTP server response. >
> --- 3895,3898 ---- >> ! The LMTP client time limit for sending the RCPT TO command, and > ! for receiving the server response. >
> *************** > *** 4317,4329 **** > > -The LMTP-specific version of the smtp_reply_filter > - configuration parameter. See there for details.
> - > -This feature is available in Postfix 2.7 and later.
> - > - > -The Postfix LMTP client time limit for sending the RSET command, > ! and for receiving the remote LMTP server response. The LMTP client > ! sends RSET in > order to finish a recipient address probe, or to verify that a > --- 3910,3913 ---- > > !
The LMTP client time limit for sending the RSET command, and > ! for receiving the server response. The LMTP client sends RSET in > order to finish a recipient address probe, or to verify that a > *************** > *** 4403,4405 **** >
> ! Optional Postfix LMTP client lookup tables with one username:password entry > per host or domain. If a remote host or domain has no username:password > --- 3981,3983 ---- >
> ! Optional LMTP client lookup tables with one username:password entry > per host or domain. If a remote host or domain has no username:password > *************** > *** 4503,4515 **** > > -
The LMTP-specific version of the smtp_send_dummy_mail_auth > - configuration parameter. See there for details.
> - > -This feature is available in Postfix 2.9 and later.
> - > - > -> ! Send an XFORWARD command to the remote LMTP server when the LMTP LHLO > server response announces XFORWARD support. This allows an lmtp(8) > --- 4085,4087 ---- >
> ! Send an XFORWARD command to the LMTP server when the LMTP LHLO > server response announces XFORWARD support. This allows an lmtp(8) > *************** > *** 4609,4621 **** > > -
The LMTP-specific version of the smtp_tls_block_early_mail_reply > - configuration parameter. See there for details.
> - > -This feature is available in Postfix 2.7 and later.
> - > - > -The LMTP-specific version of the smtp_tls_ciphers configuration > - parameter. See there for details.
> - > -This feature is available in Postfix 2.6 and later.
> - > - > -The LMTP-specific version of the smtp_tls_eccert_file configuration > ! parameter. See there for details.
> > !This feature is available in Postfix 2.6 and later, when Postfix is > ! compiled and linked with OpenSSL 1.0.0 or later.
> > --- 4209,4217 ---- > > !The LMTP-specific version of the smtp_tls_enforce_peername > ! configuration parameter. See there for details.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 4676,4707 **** > > !The LMTP-specific version of the smtp_tls_eckey_file configuration > ! parameter. See there for details.
> > !This feature is available in Postfix 2.6 and later, when Postfix is > ! compiled and linked with OpenSSL 1.0.0 or later.
> ! > ! > !The LMTP-specific version of the smtp_tls_enforce_peername > ! configuration parameter. See there for details.
> ! > !This feature is available in Postfix 2.3 and later.
> ! > ! > !The LMTP-specific version of the smtp_tls_exclude_ciphers > ! configuration parameter. See there for details.
> ! > !This feature is available in Postfix 2.3 and later.
> > --- 4220,4228 ---- > > !The LMTP-specific version of the smtp_tls_exclude_ciphers > ! configuration parameter. See there for details.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 4820,4832 **** > > -The LMTP-specific version of the smtp_tls_protocols configuration > - parameter. See there for details.
> - > -This feature is available in Postfix 2.6 and later.
> - > - > -> ! The Postfix LMTP client time limit for sending the XFORWARD command, > ! and for receiving the remote LMTP server response. >
> --- 4422,4425 ---- >> ! The LMTP client time limit for sending the XFORWARD command, and > ! for receiving the server response. >
> *************** > *** 4939,4943 **** > By default, non-Postfix commands are executed directly; commands > ! are given to given to the default shell (typically, /bin/sh) only > ! when they contain shell meta characters or shell built-in commands. > ! > > --- 4449,4452 ---- > By default, non-Postfix commands are executed directly; commands > ! are given to given to /bin/sh only when they contain shell meta > ! characters or shell built-in commands. > > *************** > *** 4957,4959 **** > local_command_shell = /some/where/smrsh -c > - local_command_shell = /bin/bash -c > > --- 4466,4467 ---- > *************** > *** 5038,5041 **** >> ! local_header_rewrite_clients = static:all >> --- 4577,4579 ---- >
> ! local_header_rewrite_clients = static:all >> *************** > *** 5178,5181 **** > is the name of a mail delivery transport defined in master.cf. > ! The :nexthop destination is optional; its syntax is documented > ! in the manual page of the corresponding delivery agent. > > --- 4685,4688 ---- > is the name of a mail delivery transport defined in master.cf. > ! The :nexthop part is optional. For more details see the > ! transport(5) manual page. > > *************** > *** 5626,5629 **** > client request is blocked by the reject_rbl_client, reject_rhsbl_client, > ! reject_rhsbl_reverse_client, reject_rhsbl_sender or > ! reject_rhsbl_recipient restriction. > > --- 5133,5135 ---- > client request is blocked by the reject_rbl_client, reject_rhsbl_client, > ! reject_rhsbl_sender or reject_rhsbl_recipient restriction. > > *************** > *** 5715,5717 **** >
To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > --- 5221,5223 ---- >To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > *************** > *** 5763,5797 **** > > -Selectively disable master(8) listener ports by service type > - or by service name and type. Specify a list of service types > - ("inet", "unix", "fifo", or "pass") or "name.type" tuples, where > - "name" is the first field of a master.cf entry and "type" is a > - service type. As with other Postfix matchlists, a search stops at > - the first match. Specify "!pattern" to exclude a service from the > - list. By default, all master(8) listener ports are enabled.
> - > -Note: this feature does not support "/file/name" or "type:table" > - patterns, nor does it support wildcards such as "*" or "all". This > - is intentional.
> - > -Examples:
> - > -> - # Turn on all master(8) listener ports (the default). > - master_service_disable = > - # Turn off only the main SMTP listener port. > - master_service_disable = smtp.inet > - # Turn off all TCP/IP listener ports. > - master_service_disable = inet > - # Turn off all TCP/IP listener ports except "foo". > - master_service_disable = !foo.inet, inet > -> - > -
This feature is available in Postfix 2.6 and later.
> - > - > -Note 1: this feature does not recognize text that requires MIME > - decoding. It inspects raw message content, just like header_checks > - and body_checks.
> - > -Note 2: this feature is disabled with "receive_override_options > - = no_header_body_checks".
> - >Example:
> --- 5347,5348 ---- > *************** > *** 5915,5923 **** > > -Note 1: this feature does not recognize text that requires MIME > - decoding. It inspects raw message content, just like header_checks > - and body_checks.
> - > -Note 2: this feature is disabled with "receive_override_options > - = no_header_body_checks".
> - >Example:
> --- 5381,5382 ---- > *************** > *** 5951,5953 **** >Optional lookup tables for content inspection of message headers > - that are produced by Milter applications. See the header_checks(5) > - manual page available actions. Currently, PREPEND is not implemented. > -
> - > -The following example sends all mail that is marked as SPAM to > - a spam handling machine. Note that matches are case-insensitive > - by default.
> - > -> - /etc/postfix/main.cf: > - milter_header_checks = pcre:/etc/postfix/milter_header_checks > -> - > -
> - /etc/postfix/milter_header_checks: > - /^X-SPAM-FLAG:\s+YES/ FILTER mysmtp:sanitizer.example.com:25 > -> - > -
The milter_header_checks mechanism could also be used for > - whitelisting. For example it could be used to skip heavy content > - inspection for DKIM-signed mail from known friendly domains.
> - > -This feature is available in Postfix 2.7, and as an optional > - patch for Postfix 2.6.
> - > - > -The mail filter protocol version and optional protocol extensions > ! for communication with a Milter application; prior to Postfix 2.6 > ! the default protocol is 2. Postfix > sends this version number during the initial protocol handshake. > --- 5565,5570 ---- >
The mail filter protocol version and optional protocol extensions > ! for communication with a Milter (mail filter) application. Postfix > sends this version number during the initial protocol handshake. > *************** > *** 6155,6158 **** >
An optional list of non-default Postfix configuration directories; > - these directories belong to additional Postfix instances that share > - the Postfix executable files and documentation with the default > - Postfix instance, and that are started, stopped, etc., together > - with the default Postfix instance. Specify a list of pathnames > - separated by comma or whitespace.
> - > -When $multi_instance_directories is empty, the postfix(1) command > - runs in single-instance mode and operates on a single Postfix > - instance only. Otherwise, the postfix(1) command runs in multi-instance > - mode and invokes the multi-instance manager specified with the > - multi_instance_wrapper parameter. The multi-instance manager in > - turn executes postfix(1) commands for the default instance and for > - all Postfix instances in $multi_instance_directories.
> - > -Currently, this parameter setting is ignored except for the > - default main.cf file.
> - > -This feature is available in Postfix 2.6 and later.
> - > - > -Allow this Postfix instance to be started, stopped, etc., by a > - multi-instance manager. By default, new instances are created in > - a safe state that prevents them from being started inadvertently. > - This parameter is reserved for the multi-instance manager.
> - > -This feature is available in Postfix 2.6 and later.
> - > - > -The optional instance group name of this Postfix instance. A > - group identifies closely-related Postfix instances that the > - multi-instance manager can start, stop, etc., as a unit. This > - parameter is reserved for the multi-instance manager.
> - > -This feature is available in Postfix 2.6 and later.
> - > - > -The optional instance name of this Postfix instance. This name > - becomes also the default value for the syslog_name parameter.
> - > -This feature is available in Postfix 2.6 and later.
> - > - > -The pathname of a multi-instance manager command that the > - postfix(1) command invokes when the multi_instance_directories > - parameter value is non-empty. The pathname may be followed by > - initial command arguments separated by whitespace; shell > - metacharacters such as quotes are not supported in this context. > -
> - > -The postfix(1) command invokes the manager command with the > - postfix(1) non-option command arguments on the manager command line, > - and with all installation configuration parameters exported into > - the manager command process environment. The manager command in > - turn invokes the postfix(1) command for individual Postfix instances > - as "postfix -c config_directory command".
> - > -This feature is available in Postfix 2.6 and later.
> - > - > -> ! myhostname = host.example.com >> --- 5815,5817 ---- >
> ! myhostname = host.domain.tld >> *************** > *** 6490,6492 **** >
> ! The list of "trusted" remote SMTP clients that have more privileges than > "strangers". > --- 5825,5827 ---- >
> ! The list of "trusted" SMTP clients that have more privileges than > "strangers". > *************** > *** 6559,6561 **** >
Specify "mynetworks_style = subnet" when Postfix > ! should "trust" remote SMTP clients in the same IP subnetworks as the local > machine. On Linux, this works correctly only with interfaces > --- 5894,5896 ---- >
Specify "mynetworks_style = subnet" when Postfix > ! should "trust" SMTP clients in the same IP subnetworks as the local > machine. On Linux, this works correctly only with interfaces > *************** > *** 6564,6566 **** >
Specify "mynetworks_style = class" when Postfix should > ! "trust" remote SMTP clients in the same IP class A/B/C networks as the > local machine. Don't do this with a dialup site - it would cause > --- 5899,5901 ---- >
Specify "mynetworks_style = class" when Postfix should > ! "trust" SMTP clients in the same IP class A/B/C networks as the > local machine. Don't do this with a dialup site - it would cause > *************** > *** 6645,6648 **** > via the Postfix qmqpd(8) server, and old mail that is re-injected > ! into the queue with "postsuper -r". Specify space or comma as > ! separator. See the MILTER_README document for details.
> > --- 5980,5983 ---- > via the Postfix qmqpd(8) server, and old mail that is re-injected > ! into the queue with "postsuper -r". See the MILTER_README document > ! for details. > > *************** > *** 6688,6697 **** > > -The postfix(1) commands that the postmulti(1) instance manager > ! treats as "control" commands, that operate on running instances. For > ! these commands, disabled instances are skipped.
> ! > !This feature is available in Postfix 2.6 and later.
> > > !The postfix(1) commands that the postmulti(1) instance manager treats > ! as "start" commands. For these commands, disabled instances are "checked" > ! rather than "started", and failure to "start" a member instance of an > ! instance group will abort the start-up of later instances.
> > !This feature is available in Postfix 2.6 and later.
> > --- 6138,6165 ---- > > !The message delivery contexts where the Postfix local(8) delivery > + agent prepends a Delivered-To: message header with the address > + that the mail was delivered to. This information is used for mail > + delivery loop detection.
> > !> ! By default, the Postfix local delivery agent prepends a Delivered-To: > ! header when forwarding mail and when delivering to file (mailbox) > ! and command. Turning off the Delivered-To: header when forwarding > ! mail is not recommended. > !
> > !> ! Specify zero or more of forward, file, or command. > !
> > !> ! Example: > !
> > !> ! prepend_delivered_header = forward > !> > *************** > *** 6837,6846 **** > > !
The postfix(1) commands that the postmulti(1) instance manager treats > ! as "stop" commands. For these commands, disabled instances are skipped, > ! and enabled instances are processed in reverse order.
> > !This feature is available in Postfix 2.6 and later.
> > --- 6168,6175 ---- > > !> ! The process ID of a Postfix command or daemon process. > !
> > *************** > *** 6849,6945 **** > > !Permanent white/blacklist for remote SMTP client IP addresses. > ! postscreen(8) searches this list immediately after a remote SMTP > ! client connects. Specify a comma- or whitespace-separated list of > ! commands (in upper or lower case) or lookup tables. The search stops > ! upon the first command that fires for the client IP address.
> > -Example:
> > !> ! /etc/postfix/main.cf: > ! postscreen_access_list = permit_mynetworks, > ! cidr:/etc/postfix/postscreen_access.cidr > ! postscreen_blacklist_action = enforce > !> > !
> ! /etc/postfix/postscreen_access.cidr: > ! # Rules are evaluated in the order as specified. > ! # Blacklist 192.168.* except 192.168.0.1. > ! 192.168.0.1 dunno > ! 192.168.0.0/16 reject > !> > !
This feature is available in Postfix 2.8.
> > > !The action that postscreen(8) takes when a remote SMTP client sends > ! a bare newline character, that is, a newline not preceded by carriage > ! return. Specify one of the following:
> > !This feature is available in Postfix 2.8.
> > --- 6178,6265 ---- > > !> ! The location of Postfix PID files relative to $queue_directory. > ! This is a read-only parameter. > !
> > > !> ! The process name of a Postfix command or daemon process. > !
> > > !> ! What address lookup tables copy an address extension from the lookup > ! key to the lookup result. > !
> > +> + For example, with a virtual(5) mapping of "joe at example.com => > + joe.user at example.net", the address "joe+foo at example.com" > + would rewrite to "joe.user+foo at example.net". > +
> > !> ! Specify zero or more of canonical, virtual, alias, > ! forward, include or generic. These cause > ! address extension > ! propagation with canonical(5), virtual(5), and aliases(5) maps, > ! with local(8) .forward and :include: file lookups, and with smtp(8) > ! generic maps, respectively.
> > !> ! Note: enabling this feature for types other than canonical > ! and virtual is likely to cause problems when mail is forwarded > ! to other sites, especially with mail that is sent to a mailing list > ! exploder address. > !
> > !> ! Examples: > !
> > !> ! propagate_unmatched_extensions = canonical, virtual, alias, > ! forward, include > ! propagate_unmatched_extensions = canonical, virtual > !> > > !
> ! The network interface addresses that this mail system receives mail > ! on by way of a proxy or network address translation unit. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > !You must specify your "outside" proxy/NAT addresses when your > ! system is a backup MX host for other domains, otherwise mail delivery > ! loops will happen when the primary MX host is down.
> > !> ! Example: > !
> > !> ! proxy_interfaces = 1.2.3.4 > !> > *************** > *** 6948,6959 **** > > !
Enable "bare newline" SMTP protocol tests in the postscreen(8) > ! server. These tests are expensive: a remote SMTP client must > ! disconnect after > ! it passes the test, before it can talk to a real Postfix SMTP server. >
> > !This feature is available in Postfix 2.8.
> > --- 6268,6281 ---- > > !> ! The lookup tables that the proxymap(8) server is allowed to > ! access for the read-only service. > ! Table references that don't begin with proxy: are ignored. >
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > *************** > *** 6962,6978 **** > > !The amount of time that postscreen(8) will use the result from > ! a successful "bare newline" SMTP protocol test. During this > ! time, the client IP address is excluded from this test. The default > ! is long because a remote SMTP client must disconnect after it passes > ! the test, > ! before it can talk to a real Postfix SMTP server.
> > !Specify a non-zero time value (an integral value plus an optional > ! one-letter suffix that specifies the time unit). Time units: s > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > !This feature is available in Postfix 2.8.
> > --- 6284,6296 ---- > > !The lookup tables that the proxymap(8) server is allowed to > ! access for the read-write service. Postfix-owned local database > ! files should be stored under the Postfix-owned data_directory. > ! Table references that don't begin with proxy: are ignored.
> > !> ! This feature is available in Postfix 2.5 and later. > !
> > *************** > *** 6981,7012 **** > > !The action that postscreen(8) takes when a remote SMTP client is > ! permanently blacklisted with the postscreen_access_list parameter. > ! Specify one of the following:
> > !This feature is available in Postfix 2.8.
> > --- 6299,6332 ---- > > !> ! The minimal delay between warnings that a specific destination is > ! clogging up the Postfix active queue. Specify 0 to disable. > !
> > !> ! This feature is enabled with the helpful_warnings parameter. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > > !> ! Obsolete feature: the percentage of delivery resources that a busy > ! mail system will use up for delivery of a large mailing list > ! message. > !
> > !> ! This feature exists only in the oqmgr(8) old queue manager. The > ! current queue manager solves the problem in a better way. > !
> > *************** > *** 7015,7035 **** > > !The amount of time between postscreen(8) cache cleanup runs. > ! Cache cleanup increases the load on the cache database and should > ! therefore not be run frequently. This feature requires that the > ! cache database supports the "delete" and "sequence" operators. > ! Specify a zero interval to disable cache cleanup.
> ! > !After each cache cleanup run, the postscreen(8) daemon logs the > ! number of entries that were retained and dropped. A cleanup run is > ! logged as "partial" when the daemon terminates early after "postfix > ! reload", "postfix stop", or no requests for $max_idle > ! seconds.
> ! > !Time units: s (seconds), m (minutes), h (hours), d (days), w > ! (weeks).
> > !This feature is available in Postfix 2.8.
> > --- 6335,6342 ---- > > !> ! The maximal number of messages in the active queue. > !
> > *************** > *** 7038,7084 **** > > !Persistent storage for the postscreen(8) server decisions.
> > -To share a postscreen(8) cache between multiple postscreen(8) > - instances, use "postscreen_cache_map = proxy:btree:/path/to/file". > - This requires Postfix version 2.9 or later; earlier proxymap(8) > - implementations don't support cache cleanup. For an alternative > - approach see the memcache_table(5) manpage.
> > !This feature is available in Postfix 2.8.
> > > !The amount of time that postscreen(8) will cache an expired > ! temporary whitelist entry before it is removed. This prevents clients > ! from being logged as "NEW" just because their cache entry expired > ! an hour ago. It also prevents the cache from filling up with clients > ! that passed some deep protocol test once and never came back.
> > !Time units: s (seconds), m (minutes), h (hours), d (days), w > ! (weeks).
> > !This feature is available in Postfix 2.8.
> > > !How many simultaneous connections any remote SMTP client is > ! allowed to have > ! with the postscreen(8) daemon. By default, this limit is the same > ! as with the Postfix SMTP server. Note that the triage process can > ! take several seconds, with the time spent in postscreen_greet_wait > ! delay, and with the time spent talking to the postscreen(8) built-in > ! dummy SMTP protocol engine.
> > !This feature is available in Postfix 2.8.
> > --- 6345,6404 ---- > > !The maximal number of recipients held in memory by the Postfix > ! queue manager, and the maximal size of the size of the short-term, > ! in-memory "dead" destination status cache.
> > > !> ! The minimal number of in-memory recipients for any message. This > ! takes priority over any other in-memory recipient limits (i.e., > ! the global qmgr_message_recipient_limit and the per transport > ! _recipient_limit) if necessary. The minimum value allowed for this > ! parameter is 1. > !
> > > !> ! What clients are allowed to connect to the QMQP server port. > !
> > +> + By default, no client is allowed to use the service. This is > + because the QMQP server will relay mail to any destination. > +
> > !> ! Specify a list of client patterns. A list pattern specifies a host > ! name, a domain name, an internet address, or a network/mask pattern, > ! where the mask specifies the number of bits in the network part. > ! When a pattern specifies a file name, its contents are substituted > ! for the file name; when a pattern is a "type:table" table specification, > ! table lookup is used instead.
> > !> ! Patterns are separated by whitespace and/or commas. In order to > ! reverse the result, precede a pattern with an > ! exclamation point (!). The form "!/file/name" is supported only > ! in Postfix version 2.4 and later. > !
> > !> ! Example: > !
> > !> ! qmqpd_authorized_clients = !192.168.0.1, 192.168.0.0/24 > !> > *************** > *** 7087,7098 **** > > !
The limit on the total number of commands per SMTP session for > ! postscreen(8)'s built-in SMTP protocol engine. This SMTP engine > ! defers or rejects all attempts to deliver mail, therefore there is > ! no need to enforce separate limits on the number of junk commands > ! and error commands.
> > !This feature is available in Postfix 2.8.
> > --- 6407,6416 ---- > > !Enable logging of the remote QMQP client port in addition to > ! the hostname and IP address. The logging format is "host[address]:port". > !
> > !This feature is available in Postfix 2.5 and later.
> > *************** > *** 7101,7109 **** > > !A mechanism to transform commands from remote SMTP clients. > ! See smtpd_command_filter for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 6419,6433 ---- > > !> ! How long the QMQP server will pause before sending a negative reply > ! to the client. The purpose is to slow down confused or malicious > ! clients. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > *************** > *** 7112,7120 **** > > !The time limit to read an entire command line with postscreen(8)'s > ! built-in SMTP protocol engine.
> > !This feature is available in Postfix 2.8.
> > --- 6436,6450 ---- > > !> ! The time limit for sending or receiving information over the network. > ! If a read or write operation blocks for more than $qmqpd_timeout > ! seconds the QMQP server gives up and disconnects. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > *************** > *** 7123,7131 **** > > !Disable the SMTP VRFY command in the postscreen(8) daemon. See > ! disable_vrfy_command for details.
> > !This feature is available in Postfix 2.8.
> > --- 6453,6461 ---- > > !> ! The location of the Postfix top-level queue directory. This is the > ! root directory of Postfix daemon processes that run chrooted. > !
> > *************** > *** 7134,7145 **** > > !Lookup tables, indexed by the remote SMTP client address, with > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > ! etc.) that the postscreen(8) server will not send in the EHLO response > ! to a remote SMTP client. See smtpd_discard_ehlo_keywords for details. > ! The table is not searched by hostname for robustness reasons.
> > !This feature is available in Postfix 2.8 and later.
> > --- 6464,6477 ---- > > !> ! The maximal number of (name=value) attributes that may be stored > ! in a Postfix queue file. The limit is enforced by the cleanup(8) > ! server. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > *************** > *** 7148,7193 **** > > !A case insensitive list of EHLO keywords (pipelining, starttls, > ! auth, etc.) that the postscreen(8) server will not send in the EHLO > ! response to a remote SMTP client. See smtpd_discard_ehlo_keywords > ! for details.
> > !This feature is available in Postfix 2.8 and later.
> > > !The action that postscreen(8) takes when a remote SMTP client's combined > ! DNSBL score is equal to or greater than a threshold (as defined > ! with the postscreen_dnsbl_sites and postscreen_dnsbl_threshold > ! parameters). Specify one of the following:
> > !This feature is available in Postfix 2.8.
> > --- 6480,6535 ---- > > !> ! The minimal amount of free space in bytes in the queue file system > ! that is needed to receive mail. This is currently used by the SMTP > ! server to decide if it will accept any mail at all. > !
> > +> + By default, the Postfix version 2.1 SMTP server rejects MAIL FROM commands > + when the amount of free space is less than 1.5*$message_size_limit. > + To specify a higher minimum free space limit, specify a queue_minfree > + value that is at least 1.5*$message_size_limit. > +
> > !> ! With Postfix versions 2.0 and earlier, a queue_minfree value of > ! zero means there is no minimum required amount of free space. > !
> > > !> ! The time between deferred queue scans by the queue manager; > ! prior to Postfix 2.4 the default value was 1000s. > !
> > !This parameter should be set less than or equal to > ! $minimal_backoff_time. See also $maximal_backoff_time.
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > > !> ! The name of the qmgr(8) service. This service manages the Postfix > ! queue and schedules delivery requests. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > *************** > *** 7196,7224 **** > > !A mapping from actual DNSBL domain name which includes a secret > ! password, to the DNSBL domain name that postscreen will reply with > ! when it rejects mail. When no mapping is found, the actual DNSBL > ! domain will be used.
> > !For maximal stability it is best to use a file that is read > ! into memory such as pcre:, regexp: or texthash: (texthash: is similar > ! to hash:, except a) there is no need to run postmap(1) before the > ! file can be used, and b) texthash: does not detect changes after > ! the file is read).
> > -Example:
> > !> ! /etc/postfix/main.cf: > ! postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply > !> > !
> ! /etc/postfix/dnsbl_reply: > ! secret.zen.spamhaus.org zen.spamhaus.org > !> > !
This feature is available in Postfix 2.8.
> > --- 6538,6564 ---- > > !> ! Optional lookup tables with RBL response templates. The tables are > ! indexed by the RBL domain name. By default, Postfix uses the default > ! template as specified with the default_rbl_reply configuration > ! parameter. See there for a discussion of the syntax of RBL reply > ! templates. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > > !> ! The location of Postfix README files that describe how to build, > ! configure or operate a specific Postfix subsystem or feature. > !
> > *************** > *** 7227,7286 **** > > !Optional list of DNS white/blacklist domains, filters and weight > ! factors. When the list is non-empty, the dnsblog(8) daemon will > ! query these domains with the IP addresses of remote SMTP clients, > ! and postscreen(8) will update an SMTP client's DNSBL score with > ! each non-error reply.
> > !Caution: when postscreen rejects mail, it replies with the DNSBL > ! domain name. Use the postscreen_dnsbl_reply_map feature to hide > ! "password" information in DNSBL domain names.
> > !When a client's score is equal to or greater than the threshold > ! specified with postscreen_dnsbl_threshold, postscreen(8) can drop > ! the connection with the remote SMTP client.
> > !Specify a list of domain=filter*weight entries, separated by > ! comma or whitespace.
> > !When no "=filter" is specified, postscreen(8) will use any > ! non-error DNSBL reply. Otherwise, postscreen(8) uses only DNSBL > ! replies that match the filter. The filter has the form d.d.d.d, > ! where each d is a number, or a pattern inside [] that contains one > ! or more ";"-separated numbers or number..number ranges.
> ! > !When no "*weight" is specified, postscreen(8) increments > ! the remote SMTP client's DNSBL score by 1. Otherwise, the weight must be > ! an integral number, and postscreen(8) adds the specified weight to > ! the remote SMTP client's DNSBL score. Specify a negative number for > ! whitelisting.
> > !When one postscreen_dnsbl_sites entry produces multiple > ! DNSBL responses, postscreen(8) applies the weight at most once. > !
> > !Examples:
> > !To use example.com as a high-confidence blocklist, and to > ! block mail with example.net and example.org only when both agree: > !
> > !> ! postscreen_dnsbl_threshold = 2 > ! postscreen_dnsbl_sites = example.com*2, example.net, example.org > !> > !
To filter only DNSBL replies containing 127.0.0.4:
> >> ! postscreen_dnsbl_sites = example.com=127.0.0.4 >> > !
This feature is available in Postfix 2.8.
> > --- 6567,6628 ---- > > !Enable or disable recipient validation, built-in content > ! filtering, or address mapping. Typically, these are specified in > ! master.cf as command-line arguments for the smtpd(8), qmqpd(8) or > ! pickup(8) daemons.
> ! > !Specify zero or more of the following options. The options > ! override main.cf settings and are either implemented by smtpd(8), > ! qmqpd(8), or pickup(8) themselves, or they are forwarded to the > ! cleanup server.
> ! > !> ! Note: when the "BEFORE content filter" receive_override_options > ! setting is specified in the main.cf file, specify the "AFTER content > ! filter" receive_override_options setting in master.cf (and vice > ! versa). > !
> > !> ! Examples: > !
> >> ! receive_override_options = > ! no_unknown_recipient_checks, no_header_body_checks > ! receive_override_options = no_address_mappings >> > !
> ! This feature is available in Postfix 2.1 and later. > !
> > *************** > *** 7289,7341 **** > > !The inclusive lower bound for blocking a remote SMTP client, based on > ! its combined DNSBL score as defined with the postscreen_dnsbl_sites > ! parameter.
> ! > !This feature is available in Postfix 2.8.
> ! > > !The amount of time that postscreen(8) will use the result from > ! a successful DNS blocklist test. During this time, the client IP address > ! is excluded from this test. The default is relatively short, because a > ! good client can immediately talk to a real Postfix SMTP server. >
> > !Specify a non-zero time value (an integral value plus an optional > ! one-letter suffix that specifies the time unit). Time units: s > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > !This feature is available in Postfix 2.8.
> > > !Mandatory TLS: announce STARTTLS support to remote SMTP clients, and > ! require that clients use TLS encryption. See smtpd_postscreen_enforce_tls > ! for details.
> > !This feature is available in Postfix 2.8 and later. > ! Preferably, use postscreen_tls_security_level instead.
> > > !List of characters that are permitted in postscreen_reject_footer > ! attribute expansions. See smtpd_expansion_filter for further > ! details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 6631,6690 ---- > > !> ! Optional BCC (blind carbon-copy) address lookup tables, indexed by > ! recipient address. The BCC address (multiple results are not > ! supported) is added when mail enters from outside of Postfix. > !
> > !> ! This feature is available in Postfix 2.1 and later. > !
> > !> ! The table search order is as follows: >
> > !> + Specify the types and names of databases to use. After change, > + run "postmap /etc/postfix/recipient_bcc". > +
> > !> ! Note: if mail to the BCC address bounces it will be returned to > ! the sender. > !
> > !Note: automatic BCC recipients are produced only for new mail. > ! To avoid mailer loops, automatic BCC recipients are not generated > ! for mail that Postfix forwards internally, nor for mail that Postfix > ! generates itself.
> > !> ! Example: > !
> > !> ! recipient_bcc_maps = hash:/etc/postfix/recipient_bcc > !> > *************** > *** 7344,7354 **** > > !
List of commands that the postscreen(8) server considers in > ! violation of the SMTP protocol. See smtpd_forbidden_commands for > ! syntax, and postscreen_non_smtp_command_action for possible actions. >
> > !This feature is available in Postfix 2.8.
> > --- 6693,6706 ---- > > !What addresses are subject to recipient_canonical_maps address > ! mapping. By default, recipient_canonical_maps address mapping is > ! applied to envelope recipient addresses, and to header recipient > ! addresses.
> > !Specify one or more of: envelope_recipient, header_recipient >
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 7357,7391 **** > > !The action that postscreen(8) takes when a remote SMTP client speaks > ! before its turn within the time specified with the postscreen_greet_wait > ! parameter. Specify one of the following:
> > !In either case, postscreen(8) will not whitelist the remote SMTP client > ! IP address.
> > !This feature is available in Postfix 2.8.
> > --- 6709,6752 ---- > > !> ! Optional address mapping lookup tables for envelope and header > ! recipient addresses. > ! The table format and lookups are documented in canonical(5). > !
> > !> ! Note: $recipient_canonical_maps is processed before $canonical_maps. > !
> > !> ! Example: > !
> > !> ! recipient_canonical_maps = hash:/etc/postfix/recipient_canonical > !> > > !
> ! The separator between user names and address extensions (user+foo). > ! See canonical(5), local(8), relocated(5) and virtual(5) for the > ! effects this has on aliases, canonical, virtual, relocated and > ! on .forward file lookups. Basically, the software tries user+foo > ! and .forward+foo before trying user and .forward. > !
> > !> ! Example: > !
> > !> ! recipient_delimiter = + > !> > *************** > *** 7394,7406 **** > > !
The text in the optional "220-text..." server > ! response that > ! postscreen(8) sends ahead of the real Postfix SMTP server's "220 > ! text..." response, in an attempt to confuse bad SMTP clients so > ! that they speak before their turn (pre-greet). Specify an empty > ! value to disable this feature.
> > !This feature is available in Postfix 2.8.
> > --- 6755,6767 ---- > > !> ! The numerical Postfix SMTP server response code when a remote SMTP > ! client request is rejected by the "reject" restriction. > !
> > !> ! Do not change this unless you have a complete understanding of RFC 2821. > !
> > *************** > *** 7409,7442 **** > > !The amount of time that postscreen(8) will use the result from > ! a successful PREGREET test. During this time, the client IP address > ! is excluded from this test. The default is relatively short, because > ! a good client can immediately talk to a real Postfix SMTP server.
> ! > !Specify a non-zero time value (an integral value plus an optional > ! one-letter suffix that specifies the time unit). Time units: s > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> ! > !This feature is available in Postfix 2.8.
> ! > > !The amount of time that postscreen(8) will wait for an SMTP > ! client to send a command before its turn, and for DNS blocklist > ! lookup results to arrive (default: up to 2 seconds under stress, > ! up to 6 seconds otherwise).
> > !
Specify a non-zero time value (an integral value plus an optional > ! one-letter suffix that specifies the time unit).
> > !Time units: s (seconds), m (minutes), h (hours), d (days), w > ! (weeks).
> > !This feature is available in Postfix 2.8.
> > --- 6770,6797 ---- > > !List of tables with remote SMTP client-certificate fingerprints > ! for which the Postfix SMTP server will allow access with the > ! permit_tls_clientcerts feature. > ! The fingerprint digest algorithm is configurable via the > ! smtpd_tls_fingerprint_digest parameter (hard-coded as md5 prior to > ! Postfix version 2.5).
> > !Postfix lookup tables are in the form of (key, value) pairs. > ! Since we only need the key, the value can be chosen freely, e.g. > ! the name of the user or host: > ! D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home
> > !Example:
> > !> ! relay_clientcerts = hash:/etc/postfix/relay_clientcerts > !> > !
For more fine-grained control, use check_ccert_access to select > ! an appropriate access(5) policy for each client. > ! See RESTRICTION_CLASS_README.
> > !This feature is available with Postfix version 2.2.
> > *************** > *** 7445,7453 **** > > !Require that a remote SMTP client sends HELO or EHLO before > ! commencing a MAIL transaction.
> > !This feature is available in Postfix 2.8.
> > --- 6800,6810 ---- > > !The maximal number of parallel deliveries to the same destination > ! via the relay message delivery transport. This limit is enforced > ! by the queue manager. The message delivery transport name is the > ! first field in the entry in the master.cf file.
> > !This feature is available in Postfix 2.0 and later.
> > *************** > *** 7456,7502 **** > > !The action that postscreen(8) takes when a remote SMTP client sends > ! non-SMTP commands as specified with the postscreen_forbidden_commands > ! parameter. Specify one of the following:
> > !This feature is available in Postfix 2.8.
> > > !Enable "non-SMTP command" tests in the postscreen(8) server. These > ! tests are expensive: a client must disconnect after it passes the > ! test, before it can talk to a real Postfix SMTP server.
> > !This feature is available in Postfix 2.8.
> > --- 6813,6859 ---- > > !The maximal number of recipients per message for the relay > ! message delivery transport. This limit is enforced by the queue > ! manager. The message delivery transport name is the first field in > ! the entry in the master.cf file.
> > !Setting this parameter to a value of 1 changes the meaning of > ! relay_destination_concurrency_limit from concurrency per domain > ! into concurrency per recipient.
> > !This feature is available in Postfix 2.0 and later.
> > > !What destination domains (and subdomains thereof) this system > ! will relay mail to. Subdomain matching is controlled with the > ! parent_domain_matches_subdomains parameter. For details about how > ! the relay_domains value is used, see the description of the > ! permit_auth_destination and reject_unauth_destination SMTP recipient > ! restrictions.
> > !Domains that match $relay_domains are delivered with the > ! $relay_transport mail delivery transport. The SMTP server validates > ! recipient addresses with $relay_recipient_maps and rejects non-existent > ! recipients. See also the relay domains address class in the > ! ADDRESS_CLASS_README file.
> > !Note: Postfix will not automatically forward mail for domains > ! that list this system as their primary or backup MX host. See the > ! permit_mx_backup restriction in the postconf(5) manual page.
> > !Specify a list of host or domain names, "/file/name" patterns > ! or "type:table" lookup tables, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. A > ! "/file/name" pattern is replaced by its contents; a "type:table" > ! lookup table is matched when a (parent) domain appears as lookup > ! key. Specify "!pattern" to exclude a domain from the list. The form > ! "!/file/name" is supported only in Postfix version 2.4 and later. > !
> > *************** > *** 7505,7520 **** > > !The amount of time that postscreen(8) will use the result from > ! a successful "non_smtp_command" SMTP protocol test. During this > ! time, the client IP address is excluded from this test. The default > ! is long because a client must disconnect after it passes the test, > ! before it can talk to a real Postfix SMTP server.
> > !Specify a non-zero time value (an integral value plus an optional > ! one-letter suffix that specifies the time unit). Time units: s > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > !This feature is available in Postfix 2.8.
> > --- 6862,6875 ---- > > !> ! The numerical Postfix SMTP server response code when a client > ! request is rejected by the reject_unauth_destination recipient > ! restriction. > !
> > !> ! Do not change this unless you have a complete understanding of RFC 2821. > !
> > *************** > *** 7523,7569 **** > > !The action that postscreen(8) takes when a remote SMTP client > ! sends > ! multiple commands instead of sending one command and waiting for > ! the server to respond. Specify one of the following:
> ! > !This feature is available in Postfix 2.8.
> > > !Enable "pipelining" SMTP protocol tests in the postscreen(8) > ! server. These tests are expensive: a good client must disconnect > ! after it passes the test, before it can talk to a real Postfix SMTP > ! server.
> > !This feature is available in Postfix 2.8.
> > --- 6878,6944 ---- > > !Optional lookup tables with all valid addresses in the domains > ! that match $relay_domains. Specify @domain as a wild-card for > ! domains that have no valid recipient list, and become a source of > ! backscatter mail: Postfix accepts spam for non-existent recipients > ! and then floods innocent people with undeliverable mail. Technically, > ! tables > ! listed with $relay_recipient_maps are used as lists: Postfix needs > ! to know only if a lookup string is found or not, but it does not > ! use the result from table lookup.
> > !> ! If this parameter is non-empty, then the Postfix SMTP server will reject > ! mail to unknown relay users. This feature is off by default. > !
> > !> ! See also the relay domains address class in the ADDRESS_CLASS_README > ! file. > !
> > !> ! Example: > !
> > !> ! relay_recipient_maps = hash:/etc/postfix/relay_recipients > !> > !
> ! This feature is available in Postfix 2.0 and later. > !
> > > !> ! The default mail delivery transport and next-hop destination for > ! remote delivery to domains listed with $relay_domains. In order of > ! decreasing precedence, the nexthop destination is taken from > ! $relay_transport, $sender_dependent_relayhost_maps, $relayhost, or > ! from the recipient domain. This information can be overruled with > ! the transport(5) table. > !
> > !> ! Specify a string of the form transport:nexthop, where transport > ! is the name of a mail delivery transport defined in master.cf. > ! The :nexthop part is optional. For more details see the > ! transport(5) manual page. > !
> > !> ! See also the relay domains address class in the ADDRESS_CLASS_README > ! file. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > *************** > *** 7572,7614 **** > > !The amount of time that postscreen(8) will use the result from > ! a successful "pipelining" SMTP protocol test. During this time, the > ! client IP address is excluded from this test. The default is > ! long because a good client must disconnect after it passes the test, > ! before it can talk to a real Postfix SMTP server.
> > !Specify a non-zero time value (an integral value plus an optional > ! one-letter suffix that specifies the time unit). Time units: s > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > !This feature is available in Postfix 2.8.
> > > !The number of clients that can be waiting for service from a > - real Postfix SMTP server process. When this queue is full, all > - clients will > - receive a 421 reponse.
> > !This feature is available in Postfix 2.8.
> > > !The number of non-whitelisted clients that can be waiting for > ! a decision whether they will receive service from a real Postfix > ! SMTP server > ! process. When this queue is full, all non-whitelisted clients will > ! receive a 421 reponse.
> > !This feature is available in Postfix 2.8.
> > --- 6947,7012 ---- > > !> ! The next-hop destination of non-local mail; overrides non-local > ! domains in recipient addresses. This information is overruled with > ! relay_transport, default_transport, sender_dependent_relayhost_maps > ! and with the transport(5) table. > !
> > !> ! On an intranet, specify the organizational domain name. If your > ! internal DNS uses no MX records, specify the name of the intranet > ! gateway host instead. > !
> > !> ! In the case of SMTP, specify a domain name, hostname, hostname:port, > ! [hostname]:port, [hostaddress] or [hostaddress]:port. The form > ! [hostname] turns off MX lookups. > !
> > +> + If you're connected via UUCP, see the UUCP_README file for useful > + information. > +
> > !> ! Examples: > !
> > !> ! relayhost = $mydomain > ! relayhost = [gateway.my.domain] > ! relayhost = uucphost > ! relayhost = [an.ip.add.ress] > !> > > !
> ! Optional lookup tables with new contact information for users or > ! domains that no longer exist. The table format and lookups are > ! documented in relocated(5). > !
> > !> ! If you use this feature, run "postmap /etc/postfix/relocated" to > ! build the necessary DBM or DB file after change, then "postfix > ! reload" to make the changes visible. > !
> > !> ! Examples: > !
> > !> ! relocated_maps = dbm:/etc/postfix/relocated > ! relocated_maps = hash:/etc/postfix/relocated > !> > *************** > *** 7617,7639 **** > > !
Optional information that is appended after a 4XX or 5XX > ! postscreen(8) server > ! response. See smtpd_reject_footer for further details.
> > !This feature is available in Postfix 2.8 and later.
> > > !The SMTP TLS security level for the postscreen(8) server; when > ! a non-empty value is specified, this overrides the obsolete parameters > ! postscreen_use_tls and postscreen_enforce_tls. See smtpd_tls_security_level > ! for details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 7015,7045 ---- > > !Don't rewrite message headers from remote clients at all when > ! this parameter is empty; otherwise, rewrite message headers and > ! append the specified domain name to incomplete addresses. The > ! local_header_rewrite_clients parameter controls what clients Postfix > ! considers local.
> > +Examples:
> > !The safe setting: append "domain.invalid" to incomplete header > ! addresses from remote SMTP clients, so that those addresses cannot > ! be confused with local addresses.
> > !> !> > !> ! remote_header_rewrite_domain = domain.invalid > !> !
The default, purist, setting: don't rewrite headers from remote > ! clients at all.
> > !> !> > *************** > *** 7642,7651 **** > > !> ! remote_header_rewrite_domain = > !> !
Opportunistic TLS: announce STARTTLS support to remote SMTP clients, > ! but do not require that clients use TLS encryption.
> > !This feature is available in Postfix 2.8 and later. > ! Preferably, use postscreen_tls_security_level instead.
> > --- 7048,7058 ---- > > !> ! Whether or not a local(8) recipient's home directory must exist > ! before mail delivery is attempted. By default this test is disabled. > ! It can be useful for environments that import home directories to > ! the mail server (NOT RECOMMENDED). > !
> > *************** > *** 7654,7671 **** > > !How much time a postscreen(8) process may take to respond to > ! a remote SMTP client command or to perform a cache operation before it > ! is terminated by a built-in watchdog timer. This is a safety > ! mechanism that prevents postscreen(8) from becoming non-responsive > ! due to a bug in Postfix itself or in system software. To avoid > ! false alarms and unnecessary cache corruption this limit cannot be > ! set under 10s.
> > !Specify a non-zero time value (an integral value plus an optional > ! one-letter suffix that specifies the time unit). Time units: s > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > !This feature is available in Postfix 2.8.
> > --- 7061,7079 ---- > > !Resolve a recipient address safely instead of correctly, by > ! looking inside quotes.
> > !By default, the Postfix address resolver does not quote the > ! address localpart as per RFC 822, so that additional @ or % or ! > ! operators remain visible. This behavior is safe but it is also > ! technically incorrect.
> > !If you specify "resolve_dequoted_address = no", then > ! the Postfix > ! resolver will not know about additional @ etc. operators in the > ! address localpart. This opens opportunities for obscure mail relay > ! attacks with user at domain@domain addresses when Postfix provides > ! backup MX service for Sendmail systems.
> > *************** > *** 7674,7724 **** > > !A list of local postscreen(8) server IP addresses where a > ! non-whitelisted remote SMTP client can obtain postscreen(8)'s temporary > ! whitelist status. This status is required before the client can > ! talk to a Postfix SMTP server process. By default, a client can > ! obtain postscreen(8)'s whitelist status on any local postscreen(8) > ! server IP address.
> > !When postscreen(8) listens on both primary and backup MX > ! addresses, the postscreen_whitelist_interfaces parameter can be > ! configured to give the temporary whitelist status only when a client > ! connects to a primary MX address. Once a client is whitelisted it > ! can talk to a Postfix SMTP server on any address. Thus, clients > ! that connect only to backup MX addresses will never become whitelisted, > ! and will never be allowed to talk to a Postfix SMTP server process. > !
> > !Example:
> > -> - /etc/postfix/main.cf: > - # Don't whitelist connections to the backup IP address. > - postscreen_whitelist_interfaces = !168.100.189.8, static:all > -> > !
This feature is available in Postfix 2.9 and later.
> > > !The message delivery contexts where the Postfix local(8) delivery > - agent prepends a Delivered-To: message header with the address > - that the mail was delivered to. This information is used for mail > - delivery loop detection.
> > !> ! By default, the Postfix local delivery agent prepends a Delivered-To: > ! header when forwarding mail and when delivering to file (mailbox) > ! and command. Turning off the Delivered-To: header when forwarding > ! mail is not recommended. > !
> >> ! Specify zero or more of forward, file, or command. >
> --- 7082,7119 ---- > > !Resolve an address that ends in the "@" null domain as if the > ! local hostname were specified, instead of rejecting the address as > ! invalid.
> > !This feature is available in Postfix 2.1 and later. > ! Earlier versions always resolve the null domain as the local > ! hostname.
> > !The Postfix SMTP server uses this feature to reject mail from > ! or to addresses that end in the "@" null domain, and from addresses > ! that rewrite into a form that ends in the "@" null domain.
> > > !Resolve "user at ipaddress" as "user@[ipaddress]", instead of > ! rejecting the address as invalid.
> > !This feature is available in Postfix 2.3 and later. > > > !
> ! The name of the address rewriting service. This service rewrites > ! addresses to standard form and resolves them to a (delivery method, > ! next-hop host, recipient) triple. >
> *************** > *** 7726,7734 **** >> ! Example: >
> > -> - prepend_delivered_header = forward > -> - > > --- 7121,7125 ---- >
> ! This feature is available in Postfix 2.0 and later. >
> > > *************** > *** 7736,7742 **** > > !> ! The process ID of a Postfix command or daemon process. >
> --- 7127,7133 ---- > > !> ! The name of the directory with example Postfix configuration files. >
> *************** > *** 7746,7755 **** > > !> ! The location of Postfix PID files relative to $queue_directory. > ! This is a read-only parameter. >
> > > --- 7137,7153 ---- > > !When authenticating to a remote SMTP or LMTP server with the > ! default setting "no", send no SASL authoriZation ID (authzid); send > ! only the SASL authentiCation ID (authcid) plus the authcid's password. >
> > +The non-default setting "yes" enables the behavior of older > + Postfix versions. These always send a SASL authzid that is equal > + to the SASL authcid, but this causes inter-operability problems > + with some SMTP servers.
> + > +This feature is available in Postfix 2.4.4 and later.
> + > > *************** > *** 7757,7763 **** > > !> ! The process name of a Postfix command or daemon process. >
> --- 7155,7162 ---- > > !> ! This parameter should not be used. It was replaced by sender_dependent_relayhost_maps > ! in Postfix version 2.3. >
> *************** > *** 7767,7774 **** > > !> ! What address lookup tables copy an address extension from the lookup > ! key to the lookup result. >
> --- 7166,7176 ---- > > !Optional BCC (blind carbon-copy) address lookup tables, indexed > ! by sender address. The BCC address (multiple results are not > ! supported) is added when mail enters from outside of Postfix.
> >> ! This feature is available in Postfix 2.1 and later. >
> *************** > *** 7776,7816 **** >> ! For example, with a virtual(5) mapping of "joe at example.com => > ! joe.user at example.net", the address "joe+foo at example.com" > ! would rewrite to "joe.user+foo at example.net". >
> > !> ! Specify zero or more of canonical, virtual, alias, > ! forward, include or generic. These cause > ! address extension > ! propagation with canonical(5), virtual(5), and aliases(5) maps, > ! with local(8) .forward and :include: file lookups, and with smtp(8) > ! generic maps, respectively.
> > !> ! Note: enabling this feature for types other than canonical > ! and virtual is likely to cause problems when mail is forwarded > ! to other sites, especially with mail that is sent to a mailing list > ! exploder address. > !
> > !> ! Examples: > !
> > !> ! propagate_unmatched_extensions = canonical, virtual, alias, > ! forward, include > ! propagate_unmatched_extensions = canonical, virtual > !> > > !
> ! The network interface addresses that this mail system receives mail > ! on by way of a proxy or network address translation unit. >
> --- 7178,7204 ---- >> ! The table search order is as follows: >
> > !> ! Specify the types and names of databases to use. After change, > ! run "postmap /etc/postfix/sender_bcc". >
> *************** > *** 7818,7825 **** >> ! This feature is available in Postfix 2.0 and later. >
> > !You must specify your "outside" proxy/NAT addresses when your > ! system is a backup MX host for other domains, otherwise mail delivery > ! loops will happen when the primary MX host is down.
> > --- 7206,7215 ---- >> ! Note: if mail to the BCC address bounces it will be returned to > ! the sender. >
> > !Note: automatic BCC recipients are produced only for new mail. > ! To avoid mailer loops, automatic BCC recipients are not generated > ! for mail that Postfix forwards internally, nor for mail that Postfix > ! generates itself.
> > *************** > *** 7830,7832 **** >> ! proxy_interfaces = 1.2.3.4 >> --- 7220,7222 ---- >
> ! sender_bcc_maps = hash:/etc/postfix/sender_bcc >> *************** > *** 7836,7875 **** > > !
> ! The lookup tables that the proxymap(8) server is allowed to > ! access for the read-only service. > ! Table references that don't begin with proxy: are ignored. >
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > > -The lookup tables that the proxymap(8) server is allowed to > ! access for the read-write service. Postfix-owned local database > ! files should be stored under the Postfix-owned data_directory. > ! Table references that don't begin with proxy: are ignored.
> >> ! This feature is available in Postfix 2.5 and later. >
> > > !The name of the proxymap read-only table lookup service. This > ! service is normally implemented by the proxymap(8) daemon.
> ! > !This feature is available in Postfix 2.6 and later.
> > --- 7226,7268 ---- > > !What addresses are subject to sender_canonical_maps address > ! mapping. By default, sender_canonical_maps address mapping is > ! applied to envelope sender addresses, and to header sender addresses. >
> > !Specify one or more of: envelope_sender, header_sender
> > +This feature is available in Postfix 2.2 and later.
> > > !> ! Optional address mapping lookup tables for envelope and header > ! sender addresses. > ! The table format and lookups are documented in canonical(5). >
> > +> + Example: you want to rewrite the SENDER address "user at ugly.domain" > + to "user at pretty.domain", while still being able to send mail to > + the RECIPIENT address "user at ugly.domain". > +
> > !> ! Note: $sender_canonical_maps is processed before $canonical_maps. > !
> > !> ! Example: > !
> > !> ! sender_canonical_maps = hash:/etc/postfix/sender_canonical > !> > *************** > *** 7878,7905 **** > > !
The name of the proxywrite read-write table lookup service. > ! This service is normally implemented by the proxymap(8) daemon. > !
> ! > !This feature is available in Postfix 2.6 and later.
> ! > > !> ! The minimal delay between warnings that a specific destination is > ! clogging up the Postfix active queue. Specify 0 to disable. >
> > !> ! This feature is enabled with the helpful_warnings parameter. > !
> >> ! This feature is available in Postfix 2.0 and later. >
> --- 7271,7297 ---- > > !A sender-dependent override for the global relayhost parameter > ! setting. The tables are searched by the envelope sender address and > ! @domain. This information is overruled with relay_transport, > ! default_transport and with the transport(5) table.
> > !For safety reasons, this feature does not allow $number > ! substitutions in regular expression maps.
> >> ! This feature is available in Postfix 2.3 and later. >
> > ! > !> ! A Sendmail compatibility feature that specifies the location of > ! the Postfix sendmail(1) command. This command can be used to > ! submit mail into the Postfix queue. >
> *************** > *** 7909,7915 **** > > !How much time a Postfix queue manager process may take to handle > ! a request before it is terminated by a built-in watchdog timer. >
> --- 7301,7308 ---- > > !> ! How long the Postfix master(8) waits before forking a server that > ! appears to be malfunctioning. >
> *************** > *** 7921,7924 **** > > -This feature is available in Postfix 2.8 and later.
> - > > --- 7314,7315 ---- > *************** > *** 7926,7939 **** > > !> ! Obsolete feature: the percentage of delivery resources that a busy > ! mail system will use up for delivery of a large mailing list > ! message. > !
> >> ! This feature exists only in the oqmgr(8) old queue manager. The > ! current queue manager solves the problem in a better way. >
> --- 7317,7326 ---- > > !> ! The group ownership of set-gid Postfix commands and of group-writable > ! Postfix directories. When this parameter value is changed you need > ! to re-run "postfix set-permissions" (with Postfix version 2.0 and > ! earlier: "/etc/postfix/post-install set-permissions". >
> *************** > *** 7943,7967 **** > > !The time limit for the queue manager to send or receive information > ! over an internal communication channel. The purpose is to break > ! out of deadlock situations. If the time limit is exceeded the > ! software either retries or aborts the operation.
> >> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> > -This feature is available in Postfix 2.8 and later.
> - > - > -> ! The maximal number of messages in the active queue. >
> --- 7330,7342 ---- > > !> ! Display the name of the recipient table in the "User unknown" > ! responses. The extra detail makes trouble shooting easier but also > ! reveals information that is nobody elses business. >
> >> ! This feature is available in Postfix 2.0 and later. >
> *************** > *** 7971,7991 **** > > !The maximal number of recipients held in memory by the Postfix > ! queue manager, and the maximal size of the size of the short-term, > ! in-memory "dead" destination status cache.
> ! > ! > !> ! The minimal number of in-memory recipients for any message. This > ! takes priority over any other in-memory recipient limits (i.e., > ! the global qmgr_message_recipient_limit and the per transport > ! _recipient_limit) if necessary. The minimum value allowed for this > ! parameter is 1. >
> --- 7346,7357 ---- > > !> ! The name of the showq(8) service. This service produces mail queue > ! status reports. > !
> >> ! This feature is available in Postfix 2.0 and later. >
> *************** > *** 7995,8002 **** > > !> ! What remote QMQP clients are allowed to connect to the Postfix QMQP > ! server port. >
> --- 7361,7367 ---- > > !> ! Always send EHLO at the start of an SMTP session. >
> *************** > *** 8004,8022 **** >> ! By default, no client is allowed to use the service. This is > ! because the QMQP server will relay mail to any destination. >
> > !> ! Specify a list of client patterns. A list pattern specifies a host > ! name, a domain name, an internet address, or a network/mask pattern, > ! where the mask specifies the number of bits in the network part. > ! When a pattern specifies a file name, its contents are substituted > ! for the file name; when a pattern is a "type:table" table specification, > ! table lookup is used instead.
> >> ! Patterns are separated by whitespace and/or commas. In order to > ! reverse the result, precede a pattern with an > ! exclamation point (!). The form "!/file/name" is supported only > ! in Postfix version 2.4 and later. >
> --- 7369,7384 ---- >> ! With "smtp_always_send_ehlo = no", Postfix sends EHLO only when > ! the word "ESMTP" appears in the server greeting banner (example: > ! 220 spike.porcupine.org ESMTP Postfix). >
> > ! > !> ! An optional numerical network address that the Postfix SMTP client > ! should bind to when making an IPv4 connection. >
> *************** > *** 8024,8043 **** >> ! Example: >
> >> ! qmqpd_authorized_clients = !192.168.0.1, 192.168.0.0/24 >> > > !
Enable logging of the remote QMQP client port in addition to > ! the hostname and IP address. The logging format is "host[address]:port". > !
> ! > !This feature is available in Postfix 2.5 and later.
> > --- 7386,7407 ---- >> ! This can be specified in the main.cf file for all SMTP clients, or > ! it can be specified in the master.cf file for a specific client, > ! for example: >
> > +>> > +> ! /etc/postfix/master.cf: > ! smtp ... smtp -o smtp_bind_address=11.22.33.44 >> +
Note 1: when inet_interfaces specifies no more than one IPv4 > + address, and that address is a non-loopback address, it is > + automatically used as the smtp_bind_address. This supports virtual > + IP hosting, but can be a problem on multi-homed firewalls. See the > + inet_interfaces documentation for more detail.
> > !Note 2: address information may be enclosed inside [], > ! but this form is not required here.
> > *************** > *** 8046,8088 **** > > !> ! How long the Postfix QMQP server will pause before sending a negative > ! reply to the remote QMQP client. The purpose is to slow down confused > ! or malicious clients. > !
> >> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> > ! > !> ! The time limit for sending or receiving information over the network. > ! If a read or write operation blocks for more than $qmqpd_timeout > ! seconds the Postfix QMQP server gives up and disconnects. > !
> >> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> > > !> ! The location of the Postfix top-level queue directory. This is the > ! root directory of Postfix daemon processes that run chrooted. > !
> > --- 7410,7442 ---- > > !> ! An optional numerical network address that the Postfix SMTP client > ! should bind to when making an IPv6 connection. >
> > !This feature is available in Postfix 2.2 and later.
> >> ! This can be specified in the main.cf file for all SMTP clients, or > ! it can be specified in the master.cf file for a specific client, > ! for example: >
> > +> +> > !> + /etc/postfix/master.cf: > + smtp ... smtp -o smtp_bind_address6=1:2:3:4:5:6:7:8 > +> +
Note 1: when inet_interfaces specifies no more than one IPv6 > ! address, and that address is a non-loopback address, it is > ! automatically used as the smtp_bind_address6. This supports virtual > ! IP hosting, but can be a problem on multi-homed firewalls. See the > ! inet_interfaces documentation for more detail.
> > !Note 2: address information may be enclosed inside [], > ! but this form is not recommended here.
> > *************** > *** 8091,8104 **** > > !> ! The maximal number of (name=value) attributes that may be stored > ! in a Postfix queue file. The limit is enforced by the cleanup(8) > ! server. >
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > --- 7445,7455 ---- > > !Restricted body_checks(5) tables for the Postfix SMTP client. > ! These tables are searched while mail is being delivered. Actions > ! that change the delivery time or destination are not available. >
> > !This feature is available in Postfix 2.5 and later.
> > *************** > *** 8107,8129 **** > > !> ! The minimal amount of free space in bytes in the queue file system > ! that is needed to receive mail. This is currently used by the > ! Postfix SMTP server to decide if it will accept any mail at all. > !
> > !> ! By default, the Postfix SMTP server rejects MAIL FROM commands when > ! the amount of free space is less than 1.5*$message_size_limit > ! (Postfix version 2.1 and later). > ! To specify a higher minimum free space limit, specify a queue_minfree > ! value that is at least 1.5*$message_size_limit. > !
> > !> ! With Postfix versions 2.0 and earlier, a queue_minfree value of > ! zero means there is no minimum required amount of free space. > !
> > --- 7458,7471 ---- > > !Allow DNS CNAME records to override the servername that the > ! Postfix SMTP client uses for logging, SASL password lookup, TLS > ! policy decisions, or TLS certificate verification. The value "no" > ! hardens Postfix smtp_tls_per_site hostname-based policies against > ! false hostname information in DNS CNAME records, and makes SASL > ! password file lookups more predictable. This is the default setting > ! as of Postfix 2.3.
> > !This feature is available in Postfix 2.2.9 and later.
> > *************** > *** 8132,8143 **** > > !> ! The time between deferred queue scans by the queue manager; > ! prior to Postfix 2.4 the default value was 1000s. >
> > !This parameter should be set less than or equal to > ! $minimal_backoff_time. See also $maximal_backoff_time.
> > --- 7474,7490 ---- > > !> ! The SMTP client time limit for completing a TCP connection, or > ! zero (use the operating system built-in time limit). >
> > !> ! When no connection can be made within the deadline, the Postfix > ! SMTP client > ! tries the next address on the mail exchanger list. Specify 0 to > ! disable the time limit (i.e. use whatever timeout is implemented by > ! the operating system). > !
> > *************** > *** 8151,8181 **** > > !> ! The name of the qmgr(8) service. This service manages the Postfix > ! queue and schedules delivery requests. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > > !> ! Optional lookup tables with RBL response templates. The tables are > ! indexed by the RBL domain name. By default, Postfix uses the default > ! template as specified with the default_rbl_reply configuration > ! parameter. See there for a discussion of the syntax of RBL reply > ! templates. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > --- 7498,7535 ---- > > !Permanently enable SMTP connection caching for the specified > ! destinations. With SMTP connection caching, a connection is not > ! closed immediately after completion of a mail transaction. Instead, > ! the connection is kept open for up to $smtp_connection_cache_time_limit > ! seconds. This allows connections to be reused for other deliveries, > ! and can improve mail delivery performance.
> > !Specify a comma or white space separated list of destinations > ! or pseudo-destinations:
> > +This feature is available in Postfix 2.2 and later.
> > *************** > *** 8184,8192 **** > > !> ! The location of Postfix README files that describe how to build, > ! configure or operate a specific Postfix subsystem or feature. > !
> > --- 7538,7551 ---- > > !Temporarily enable SMTP connection caching while a destination > ! has a high volume of mail in the active queue. With SMTP connection > ! caching, a connection is not closed immediately after completion > ! of a mail transaction. Instead, the connection is kept open for > ! up to $smtp_connection_cache_time_limit seconds. This allows > ! connections to be reused for other deliveries, and can improve mail > ! delivery performance.
> ! > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 8195,8256 **** > > !Enable or disable recipient validation, built-in content > ! filtering, or address mapping. Typically, these are specified in > ! master.cf as command-line arguments for the smtpd(8), qmqpd(8) or > ! pickup(8) daemons.
> > !Specify zero or more of the following options. The options > ! override main.cf settings and are either implemented by smtpd(8), > ! qmqpd(8), or pickup(8) themselves, or they are forwarded to the > ! cleanup server.
> > -> ! Note: when the "BEFORE content filter" receive_override_options > ! setting is specified in the main.cf file, specify the "AFTER content > ! filter" receive_override_options setting in master.cf (and vice > ! versa). > !
> > !> ! Examples: > !
> > !> ! receive_override_options = > ! no_unknown_recipient_checks, no_header_body_checks > ! receive_override_options = no_address_mappings > !> > !
> ! This feature is available in Postfix 2.1 and later. > !
> > --- 7554,7629 ---- > > !When SMTP connection caching is enabled, the number of times that > ! an SMTP session may be reused before it is closed. > !
> > !This feature is available in Postfix 2.2. In Postfix 2.3 it is > ! replaced by $smtp_connection_reuse_time_limit.
> > > !When SMTP connection caching is enabled, the amount of time that > ! an unused SMTP client socket is kept open before it is closed. Do > ! not specify larger values without permission from the remote sites. > !
> > !This feature is available in Postfix 2.2 and later.
> > > !The amount of time during which Postfix will use an SMTP > ! connection repeatedly. The timer starts when the connection is > ! initiated (i.e. it includes the connect, greeting and helo latency, > ! in addition to the latencies of subsequent mail delivery transactions). > !
> > !This feature addresses a performance stability problem with > ! remote SMTP servers. This problem is not specific to Postfix: it > ! can happen when any MTA sends large amounts of SMTP email to a site > ! that has multiple MX hosts.
> > !The problem starts when one of a set of MX hosts becomes slower > ! than the rest. Even though SMTP clients connect to fast and slow > ! MX hosts with equal probability, the slow MX host ends up with more > ! simultaneous inbound connections than the faster MX hosts, because > ! the slow MX host needs more time to serve each client request.
> > !The slow MX host becomes a connection attractor. If one MX > ! host becomes N times slower than the rest, it dominates mail delivery > ! latency unless there are more than N fast MX hosts to counter the > ! effect. And if the number of MX hosts is smaller than N, the mail > ! delivery latency becomes effectively that of the slowest MX host > ! divided by the total number of MX hosts.
> > !The solution uses connection caching in a way that differs from > ! Postfix version 2.2. By limiting the amount of time during which a connection > ! can be used repeatedly (instead of limiting the number of deliveries > ! over that connection), Postfix not only restores fairness in the > ! distribution of simultaneous connections across a set of MX hosts, > ! it also favors deliveries over connections that perform well, which > ! is exactly what we want.
> > !The default reuse time limit, 300s, is comparable to the various > ! smtp transaction timeouts which are fair estimates of maximum excess > ! latency for a slow delivery. Note that hosts may accept thousands > ! of messages over a single connection within the default connection > ! reuse time limit. This number is much larger than the default Postfix > ! version 2.2 limit of 10 messages per cached connection. It may prove necessary > ! to lower the limit to avoid interoperability issues with MTAs that > ! exhibit bugs when many messages are delivered via a single connection. > ! A lower reuse time limit risks losing the benefit of connection > ! reuse when the average connection and mail delivery latency exceeds > ! the reuse time limit.
> ! > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 8259,8267 **** > > !> ! Optional BCC (blind carbon-copy) address lookup tables, indexed by > ! recipient address. The BCC address (multiple results are not > ! supported) is added when mail enters from outside of Postfix. >
> --- 7632,7639 ---- > > !> ! The SMTP client time limit for sending the SMTP ".", and for receiving > ! the server response. >
> *************** > *** 8269,8271 **** >> ! This feature is available in Postfix 2.1 and later. >
> --- 7641,7644 ---- >> ! When no response is received within the deadline, a warning is > ! logged that the mail may be delivered multiple times. >
> *************** > *** 8273,8319 **** >> ! The table search order is as follows: >
> > -> ! Specify the types and names of databases to use. After change, > ! run "postmap /etc/postfix/recipient_bcc". > !
> >> ! Note: if mail to the BCC address bounces it will be returned to > ! the sender. >
> > -Note: automatic BCC recipients are produced only for new mail. > - To avoid mailer loops, automatic BCC recipients are not generated > - after Postfix forwards mail internally, or after Postfix generates > - mail itself.
> - >> ! Example: >
> > -> - recipient_bcc_maps = hash:/etc/postfix/recipient_bcc > -> - > > --- 7646,7667 ---- >
> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> > > !> ! The SMTP client time limit for sending the SMTP DATA command, and for > ! receiving the server response. >
> >> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> > > *************** > *** 8321,8334 **** > > !What addresses are subject to recipient_canonical_maps address > ! mapping. By default, recipient_canonical_maps address mapping is > ! applied to envelope recipient addresses, and to header recipient > ! addresses.
> > !Specify one or more of: envelope_recipient, header_recipient >
> > !This feature is available in Postfix 2.2 and later.
> > --- 7669,7683 ---- > > !> ! The SMTP client time limit for sending the SMTP message content. > ! When the connection makes no progress for more than $smtp_data_xfer_timeout > ! seconds the Postfix SMTP client terminates the transfer. >
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > *************** > *** 8337,8345 **** > > !> ! Optional address mapping lookup tables for envelope and header > ! recipient addresses. > ! The table format and lookups are documented in canonical(5). >
> --- 7686,7692 ---- > > !> ! Defer mail delivery when no MX record resolves to an IP address. >
> *************** > *** 8347,8349 **** >> ! Note: $recipient_canonical_maps is processed before $canonical_maps. >
> --- 7694,7698 ---- >> ! The default (no) is to return the mail as undeliverable. With older > ! Postfix versions the default was to keep trying to deliver the mail > ! until someone fixed the MX record or until the mail was too old. >
> *************** > *** 8351,8358 **** >> ! Example: >
> > !> ! recipient_canonical_maps = hash:/etc/postfix/recipient_canonical > !> > --- 7700,7708 ---- >
> ! Note: Postfix always ignores MX records with equal or worse preference > ! than the local MTA itself. >
> > !> ! This feature is available in Postfix 2.1 and later. > !
> > *************** > *** 8361,8380 **** > > !> ! The separator between user names and address extensions (user+foo). > ! See canonical(5), local(8), relocated(5) and virtual(5) for the > ! effects this has on aliases, canonical, virtual, relocated and > ! on .forward file lookups. Basically, the software tries user+foo > ! and .forward+foo before trying user and .forward. > !
> ! > !> ! Example: > !
> > !> ! recipient_delimiter = + > !> > --- 7711,7719 ---- > > !
The maximal number of parallel deliveries to the same destination > ! via the smtp message delivery transport. This limit is enforced by > ! the queue manager. The message delivery transport name is the first > ! field in the entry in the master.cf file.
> > *************** > *** 8383,8395 **** > > !> ! The numerical Postfix SMTP server response code when a remote SMTP > ! client request is rejected by the "reject" restriction. > !
> > !> ! Do not change this unless you have a complete understanding of RFC 2821. > !
> > --- 7722,7734 ---- > > !The maximal number of recipients per message for the smtp > ! message delivery transport. This limit is enforced by the queue > ! manager. The message delivery transport name is the first field in > ! the entry in the master.cf file.
> > !Setting this parameter to a value of 1 changes the meaning of > ! smtp_destination_concurrency_limit from concurrency per domain > ! into concurrency per recipient.
> > *************** > *** 8398,8414 **** > > !The Postfix SMTP server's action when a reject-type restriction > ! fails due to a temporary error condition. Specify "defer" to defer > ! the remote SMTP client request immediately. With the default > ! "defer_if_permit" action, the Postfix SMTP server continues to look > ! for opportunities to reject mail, and defers the client request > ! only if it would otherwise be accepted.
> ! > !For finer control, see: unverified_recipient_tempfail_action, > ! unverified_sender_tempfail_action, unknown_address_tempfail_action, > ! and unknown_helo_hostname_tempfail_action.
> > !This feature is available in Postfix 2.6 and later.
> > --- 7737,7749 ---- > > !Lookup tables, indexed by the remote SMTP server address, with > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > ! etc.) that the Postfix SMTP client will ignore in the EHLO response from a > ! remote SMTP server. See smtp_discard_ehlo_keywords for details. The > ! table is not indexed by hostname for consistency with > ! smtpd_discard_ehlo_keyword_address_maps.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 8417,8444 **** > > !List of tables with remote SMTP client-certificate fingerprints or > ! public key fingerprints (Postfix 2.9 and later) for which the Postfix > ! SMTP server will allow access with the permit_tls_clientcerts > ! feature. The fingerprint digest algorithm is configurable via the > ! smtpd_tls_fingerprint_digest parameter (hard-coded as md5 prior to > ! Postfix version 2.5).
> > !Postfix lookup tables are in the form of (key, value) pairs. > ! Since we only need the key, the value can be chosen freely, e.g. > ! the name of the user or host: > ! D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home
> > !Example:
> > !> ! relay_clientcerts = hash:/etc/postfix/relay_clientcerts > !> > !
For more fine-grained control, use check_ccert_access to select > ! an appropriate access(5) policy for each client. > ! See RESTRICTION_CLASS_README.
> > !This feature is available with Postfix version 2.2.
> > --- 7752,7773 ---- > > !A case insensitive list of EHLO keywords (pipelining, starttls, > ! auth, etc.) that the Postfix SMTP client will ignore in the EHLO > ! response from a remote SMTP server.
> > !This feature is available in Postfix 2.2 and later.
> > !Notes:
> > !Specify the silent-discard pseudo keyword to prevent > ! this action from being logged.
> > !Use the smtp_discard_ehlo_keyword_address_maps feature to > ! discard EHLO keywords selectively.
> ! > !The maximal number of parallel deliveries to the same destination > ! via the relay message delivery transport. This limit is enforced > ! by the queue manager. The message delivery transport name is the > ! first field in the entry in the master.cf file.
> > !This feature is available in Postfix 2.0 and later.
> > --- 7776,7800 ---- > > !Enforcement mode: require that remote SMTP servers use TLS > ! encryption, and never send mail in the clear. This also requires > ! that the remote SMTP server hostname matches the information in > ! the remote server certificate, and that the remote SMTP server > ! certificate was issued by a CA that is trusted by the Postfix SMTP > ! client. If the certificate doesn't verify or the hostname doesn't > ! match, delivery is deferred and mail stays in the queue.
> > !The server hostname is matched against all names provided as > ! dNSNames in the SubjectAlternativeName. If no dNSNames are specified, > ! the CommonName is checked. The behavior may be changed with the > ! smtp_tls_enforce_peername option.
> ! > !This option is useful only if you are definitely sure that you > ! will only connect to servers that support RFC 2487 _and_ that > ! provide valid server certificates. Typical use is for clients that > ! send all their email to a dedicated mailhub.
> ! > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> > *************** > *** 8460,8506 **** > > !The maximal number of recipients per message for the relay > ! message delivery transport. This limit is enforced by the queue > ! manager. The message delivery transport name is the first field in > ! the entry in the master.cf file.
> > !Setting this parameter to a value of 1 changes the meaning of > ! relay_destination_concurrency_limit from concurrency per domain > ! into concurrency per recipient.
> > !This feature is available in Postfix 2.0 and later.
> > > -What destination domains (and subdomains thereof) this system > ! will relay mail to. Subdomain matching is controlled with the > ! parent_domain_matches_subdomains parameter. For details about how > ! the relay_domains value is used, see the description of the > ! permit_auth_destination and reject_unauth_destination SMTP recipient > ! restrictions.
> > !Domains that match $relay_domains are delivered with the > ! $relay_transport mail delivery transport. The SMTP server validates > ! recipient addresses with $relay_recipient_maps and rejects non-existent > ! recipients. See also the relay domains address class in the > ! ADDRESS_CLASS_README file.
> > !Note: Postfix will not automatically forward mail for domains > ! that list this system as their primary or backup MX host. See the > ! permit_mx_backup restriction in the postconf(5) manual page.
> > !Specify a list of host or domain names, "/file/name" patterns > ! or "type:table" lookup tables, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. A > ! "/file/name" pattern is replaced by its contents; a "type:table" > ! lookup table is matched when a (parent) domain appears as lookup > ! key. Specify "!pattern" to exclude a domain from the list. The form > ! "!/file/name" is supported only in Postfix version 2.4 and later. > !
> > --- 7803,7845 ---- > > !> ! Optional list of relay hosts for SMTP destinations that can't be > ! found or that are unreachable. With Postfix 2.2 and earlier this > ! parameter is called fallback_relay.
> > !> ! By default, mail is returned to the sender when a destination is > ! not found, and delivery is deferred when a destination is unreachable. > !
> > !The fallback relays must be SMTP destinations. Specify a domain, > ! host, host:port, [host]:port, [address] or [address]:port; the form > ! [host] turns off MX lookups. If you specify multiple SMTP > ! destinations, Postfix will try them in the specified order.
> > +To prevent mailer loops between MX hosts and fall-back hosts, > + Postfix version 2.2 and later will not use the fallback relays for > + destinations that it is MX host for (assuming DNS lookup is turned on). > +
> > > !Optional lookup tables that perform address rewriting in the > ! SMTP client, typically to transform a locally valid address into > ! a globally valid address when sending mail across the Internet. > ! This is needed when the local machine does not have its own Internet > ! domain name, but uses something like localdomain.local > ! instead.
> > !The table format and lookups are documented in generic(5); > ! examples are shown in the ADDRESS_REWRITING_README and > ! STANDARD_CONFIGURATION_README documents.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 8509,8522 **** > > !> ! The numerical Postfix SMTP server response code when a client > ! request is rejected by the reject_unauth_destination recipient > ! restriction. >
> > !> ! Do not change this unless you have a complete understanding of RFC 2821. > !
> > --- 7848,7858 ---- > > !Restricted header_checks(5) tables for the Postfix SMTP client. > ! These tables are searched while mail is being delivered. Actions > ! that change the delivery time or destination are not available. >
> > !This feature is available in Postfix 2.5 and later.
> > *************** > *** 8525,8542 **** > > !Optional lookup tables with all valid addresses in the domains > ! that match $relay_domains. Specify @domain as a wild-card for > ! domains that have no valid recipient list, and become a source of > ! backscatter mail: Postfix accepts spam for non-existent recipients > ! and then floods innocent people with undeliverable mail. Technically, > ! tables > ! listed with $relay_recipient_maps are used as lists: Postfix needs > ! to know only if a lookup string is found or not, but it does not > ! use the result from table lookup.
> >> ! If this parameter is non-empty, then the Postfix SMTP server will reject > ! mail to unknown relay users. This feature is off by default. >
> --- 7861,7867 ---- > > !> ! The hostname to send in the SMTP EHLO or HELO command. >
> *************** > *** 8544,8547 **** >> ! See also the relay domains address class in the ADDRESS_CLASS_README > ! file. >
> --- 7869,7872 ---- >> ! The default value is the machine hostname. Specify a hostname or > ! [ip.add.re.ss]. >
> *************** > *** 8549,8556 **** >> ! Example: >
> >> ! relay_recipient_maps = hash:/etc/postfix/relay_recipients >> > --- 7874,7886 ---- >
> ! This information can be specified in the main.cf file for all SMTP > ! clients, or it can be specified in the master.cf file for a specific > ! client, for example: >
> > +>> > *************** > *** 8563,8586 **** > > !> ! /etc/postfix/master.cf: > ! mysmtp ... smtp -o smtp_helo_name=foo.bar.com >> +
> ! The default mail delivery transport and next-hop destination for > ! remote delivery to domains listed with $relay_domains. In order of > ! decreasing precedence, the nexthop destination is taken from > ! $relay_transport, $sender_dependent_relayhost_maps, $relayhost, or > ! from the recipient domain. This information can be overruled with > ! the transport(5) table. > !
> ! > !> ! Specify a string of the form transport:nexthop, where transport > ! is the name of a mail delivery transport defined in master.cf. > ! The :nexthop destination is optional; its syntax is documented > ! in the manual page of the corresponding delivery agent. > !
> >> ! See also the relay domains address class in the ADDRESS_CLASS_README > ! file. >
> --- 7893,7900 ---- > > !> ! The SMTP client time limit for sending the HELO or EHLO command, > ! and for receiving the initial server response. >
> *************** > *** 8588,8590 **** >> ! This feature is available in Postfix 2.0 and later. >
> --- 7902,7905 ---- >> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> *************** > *** 8594,8604 **** > > !> ! The next-hop destination of non-local mail; overrides non-local > ! domains in recipient addresses. This information is overruled with > ! relay_transport, sender_dependent_default_transport_maps, > ! default_transport, sender_dependent_relayhost_maps > ! and with the transport(5) table. >
> --- 7909,7916 ---- > > !> ! What mechanisms when the Postfix SMTP client uses to look up a host's IP > ! address. This parameter is ignored when DNS lookups are disabled. >
> *************** > *** 8606,8650 **** >> ! On an intranet, specify the organizational domain name. If your > ! internal DNS uses no MX records, specify the name of the intranet > ! gateway host instead. >
> > !> ! In the case of SMTP, specify a domain name, hostname, hostname:port, > ! [hostname]:port, [hostaddress] or [hostaddress]:port. The form > ! [hostname] turns off MX lookups. > !
> > !> ! If you're connected via UUCP, see the UUCP_README file for useful > ! information. > !
> > !> ! Examples: > !
> > !> ! relayhost = $mydomain > ! relayhost = [gateway.example.com] > ! relayhost = uucphost > ! relayhost = [an.ip.add.ress] > !> > > !
> ! Optional lookup tables with new contact information for users or > ! domains that no longer exist. The table format and lookups are > ! documented in relocated(5). >
> >> ! If you use this feature, run "postmap /etc/postfix/relocated" to > ! build the necessary DBM or DB file after change, then "postfix > ! reload" to make the changes visible. >
> --- 7918,7954 ---- >> ! Specify one of the following: >
> > !> ! This feature is available in Postfix 2.1 and later. >
> > + > +> ! The maximal length of message header and body lines that Postfix > ! will send via SMTP. Longer lines are broken by inserting > ! "<CR><LF><SPACE>". This minimizes the damage to > ! MIME formatted mail. >
> *************** > *** 8652,8661 **** >> ! Examples: >
> > -> - relocated_maps = dbm:/etc/postfix/relocated > - relocated_maps = hash:/etc/postfix/relocated > -> - > > --- 7956,7961 ---- >
> ! By default, the line length is limited to 990 characters, because > ! some server implementations cannot receive mail with long lines. >
> > > *************** > *** 8663,8693 **** > > !Don't rewrite message headers from remote clients at all when > ! this parameter is empty; otherwise, rewrite message headers and > ! append the specified domain name to incomplete addresses. The > ! local_header_rewrite_clients parameter controls what clients Postfix > ! considers local.
> > !Examples:
> > -The safe setting: append "domain.invalid" to incomplete header > - addresses from remote SMTP clients, so that those addresses cannot > - be confused with local addresses.
> > !> !> > !> ! remote_header_rewrite_domain = domain.invalid > !> !
The default, purist, setting: don't rewrite headers from remote > ! clients at all.
> > !> !> > --- 7963,7989 ---- > > !> ! remote_header_rewrite_domain = > !> !
> ! The SMTP client time limit for sending the MAIL FROM command, and > ! for receiving the server response. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > > !Restricted mime_header_checks(5) tables for the Postfix SMTP > ! client. These tables are searched while mail is being delivered. > ! Actions that change the delivery time or destination are not > ! available.
> ! > !This feature is available in Postfix 2.5 and later.
> > *************** > *** 8696,8759 **** > > !> ! Require that a local(8) recipient's home directory exists > ! before mail delivery is attempted. By default this test is disabled. > ! It can be useful for environments that import home directories to > ! the mail server (IMPORTING HOME DIRECTORIES IS NOT RECOMMENDED). >
> > > -Reset the local(8) delivery agent's idea of the owner-alias > ! attribute, when delivering mail to a child alias that does not have > ! its own owner alias.
> > !This feature is available in Postfix 2.8 and later. With older > ! Postfix releases, the behavior is as if this parameter is set to > ! "yes".
> > !As documented in aliases(5), when an alias name has a > ! companion alias named owner-name, delivery errors will be > ! reported to the owner alias instead of the sender. This configuration > ! is recommended for mailing lists.
> ! > !
A less known property of the owner alias is that it also forces > ! the local(8) delivery agent to write local and remote addresses > ! from alias expansion to a new queue file, instead of attempting to > ! deliver mail to local addresses as soon as they come out of alias > ! expansion.
> ! > !Writing local addresses from alias expansion to a new queue > ! file allows for robust handling of temporary delivery errors: errors > ! with one local member have no effect on deliveries to other members > ! of the list. On the other hand, delivery to local addresses as > ! soon as they come out of alias expansion is fragile: a temporary > ! error with one local address from alias expansion will cause the > ! entire alias to be expanded repeatedly until the error goes away, > ! or until the message expires in the queue. In that case, a problem > ! with one list member results in multiple message deliveries to other > ! list members.
> ! > !The default behavior of Postfix 2.8 and later is to keep the > ! owner-alias attribute of the parent alias, when delivering mail to > ! a child alias that does not have its own owner alias. Then, local > ! addresses from that child alias will be written to a new queue file, > ! and a temporary error with one local address will not affect delivery > ! to other mailing list members.
> ! > !Unfortunately, older Postfix releases reset the owner-alias > ! attribute when delivering mail to a child alias that does not have > ! its own owner alias. The local(8) delivery agent then attempts to > ! deliver local addresses as soon as they come out of child alias > ! expansion. If delivery to any address from child alias expansion > ! fails with a temporary error condition, the entire mailing list may > ! be expanded repeatedly until the mail expires in the queue, resulting > ! in multiple deliveries of the same message to mailing list members. > !
> > --- 7992,8019 ---- > > !> ! The maximal number of MX (mail exchanger) IP addresses that can > ! result from mail exchanger lookups, or zero (no limit). Prior to > ! Postfix version 2.3, this limit was disabled by default. >
> > +> + This feature is available in Postfix 2.1 and later. > +
> > > !The maximal number of SMTP sessions per delivery request before > ! giving up or delivering to a fall-back relay host, or zero (no > ! limit). This restriction ignores sessions that fail to complete the > ! SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to > ! complete the EHLO and TLS handshake (Postfix version 2.3 and later).
> > !This feature is available in Postfix 2.1 and later.
> > *************** > *** 8762,8780 **** > > !Resolve a recipient address safely instead of correctly, by > ! looking inside quotes.
> > !By default, the Postfix address resolver does not quote the > ! address localpart as per RFC 822, so that additional @ or % or ! > ! operators remain visible. This behavior is safe but it is also > ! technically incorrect.
> > !If you specify "resolve_dequoted_address = no", then > ! the Postfix > ! resolver will not know about additional @ etc. operators in the > ! address localpart. This opens opportunities for obscure mail relay > ! attacks with user at domain@domain addresses when Postfix provides > ! backup MX service for Sendmail systems.
> > --- 8022,8032 ---- > > !Restricted nested_header_checks(5) tables for the Postfix SMTP > ! client. These tables are searched while mail is being delivered. > ! Actions that change the delivery time or destination are not > ! available.
> > !This feature is available in Postfix 2.5 and later.
> > *************** > *** 8783,8798 **** > > !Resolve an address that ends in the "@" null domain as if the > ! local hostname were specified, instead of rejecting the address as > ! invalid.
> > -This feature is available in Postfix 2.1 and later. > - Earlier versions always resolve the null domain as the local > - hostname.
> > !The Postfix SMTP server uses this feature to reject mail from > ! or to addresses that end in the "@" null domain, and from addresses > ! that rewrite into a form that ends in the "@" null domain.
> > --- 8035,8058 ---- > > !Never send EHLO at the start of an SMTP session. See also the > ! smtp_always_send_ehlo parameter.
> > > !> ! How long the Postfix SMTP client pauses before sending > ! ".<CR><LF>" in order to work around the PIX firewall > ! "<CR><LF>.<CR><LF>" bug. > !
> ! > !> ! Choosing a too short time makes this workaround ineffective when > ! sending large messages over slow network connections. > !
> > *************** > *** 8801,8809 **** > > !Resolve "user at ipaddress" as "user@[ipaddress]", instead of > ! rejecting the address as invalid.
> > !This feature is available in Postfix 2.3 and later. > > --- 8061,8071 ---- > > !
Lookup tables, indexed by the remote SMTP server address, with > ! per-destination workarounds for CISCO PIX firewall bugs. The table > ! is not indexed by hostname for consistency with > ! smtp_discard_ehlo_keyword_address_maps.
> > !This feature is available in Postfix 2.4 and later.
> > *************** > *** 8812,8820 **** > > !> ! The name of the address rewriting service. This service rewrites > ! addresses to standard form and resolves them to a (delivery method, > ! next-hop host, recipient) triple. >
> --- 8074,8087 ---- > > !How long a message must be queued before the Postfix SMTP client > ! turns on the PIX firewall "<CR><LF>.<CR><LF>" > ! bug workaround for delivery through firewalls with "smtp fixup" > ! mode turned on.
> >> ! By default, the workaround is turned off for mail that is queued > ! for less than 500 seconds. In other words, the workaround is normally > ! turned off for the first delivery attempt. >
> *************** > *** 8822,8824 **** >> ! This feature is available in Postfix 2.0 and later. >
> --- 8089,8093 ---- >> ! Specify 0 to enable the PIX firewall > ! "<CR><LF>.<CR><LF>" bug workaround upon the > ! first delivery attempt. >
> *************** > *** 8828,8855 **** > > !> ! The name of the directory with example Postfix configuration files. > ! Starting with Postfix 2.1, these files have been replaced with the > ! postconf(5) manual page. > !
> > > !When authenticating to a remote SMTP or LMTP server with the > ! default setting "no", send no SASL authoriZation ID (authzid); send > ! only the SASL authentiCation ID (authcid) plus the authcid's password. > !
> > !The non-default setting "yes" enables the behavior of older > ! Postfix versions. These always send a SASL authzid that is equal > ! to the SASL authcid, but this causes inter-operability problems > ! with some SMTP servers.
> > !This feature is available in Postfix 2.4.4 and later.
> > --- 8097,8122 ---- > > !A list that specifies zero or more workarounds for CISCO PIX > + firewall bugs. These workarounds are implemented by the Postfix > + SMTP client. Workaround names are separated by comma or space, and > + are case insensitive. This parameter setting can be overruled with > + per-destination smtp_pix_workaround_maps settings.
> > !This feature is available in Postfix 2.4 and later. The default > ! settings are backwards compatible with earlier Postfix versions. > !
> > *************** > *** 8858,8865 **** > > !> ! This parameter should not be used. It was replaced by sender_dependent_relayhost_maps > ! in Postfix version 2.3. >
> --- 8125,8137 ---- > > !> ! The SMTP client time limit for sending the QUIT command, and for > ! receiving the server response. > !
> ! > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> *************** > *** 8869,8879 **** > > !Optional BCC (blind carbon-copy) address lookup tables, indexed > ! by sender address. The BCC address (multiple results are not > ! supported) is added when mail enters from outside of Postfix.
> >> ! This feature is available in Postfix 2.1 and later. >
> --- 8141,8149 ---- > > !> ! Quote addresses in SMTP MAIL FROM and RCPT TO commands as required > ! by RFC 2821. This includes putting quotes around an address localpart > ! that ends in ".". >
> *************** > *** 8881,8926 **** >> ! The table search order is as follows: >
> > !> ! Specify the types and names of databases to use. After change, > ! run "postmap /etc/postfix/sender_bcc". >
> > -> - Note: if mail to the BCC address bounces it will be returned to > - the sender. > -
> > !Note: automatic BCC recipients are produced only for new mail. > ! To avoid mailer loops, automatic BCC recipients are not generated > ! after Postfix forwards mail internally, or after Postfix generates > ! mail itself.
> >> ! Example: >
> > !> ! sender_bcc_maps = hash:/etc/postfix/sender_bcc > !> > --- 8151,8198 ---- >
> ! The default is to comply with RFC 2821. If you have to send mail to > ! a broken SMTP server, configure a special SMTP client in master.cf: >
> > !> !> > !> ! /etc/postfix/master.cf: > ! broken-smtp . . . smtp -o smtp_quote_rfc821_envelope=no > !> !
> ! and route mail for the destination in question to the "broken-smtp" > ! message delivery with a transport(5) table. > !
> > !> ! This feature is available in Postfix 2.1 and later. > !
> > > !> ! Randomize the order of equal-preference MX host addresses. This > ! is a performance feature of the Postfix SMTP client. >
> > > !> ! The SMTP client time limit for sending the SMTP RCPT TO command, and > ! for receiving the server response. >
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > *************** > *** 8929,8941 **** > > !What addresses are subject to sender_canonical_maps address > ! mapping. By default, sender_canonical_maps address mapping is > ! applied to envelope sender addresses, and to header sender addresses. > !
> > !Specify one or more of: envelope_sender, header_sender
> > !This feature is available in Postfix 2.2 and later.
> > --- 8201,8211 ---- > > !The SMTP client time limit for sending the RSET command, and > ! for receiving the server response. The SMTP client sends RSET in > ! order to finish a recipient address probe, or to verify that a > ! cached session is still usable.
> > !This feature is available in Postfix 2.1 and later.
> > *************** > *** 8944,8972 **** > > !> ! Optional address mapping lookup tables for envelope and header > ! sender addresses. > ! The table format and lookups are documented in canonical(5). > !
> > !> ! Example: you want to rewrite the SENDER address "user at ugly.domain" > ! to "user at pretty.domain", while still being able to send mail to > ! the RECIPIENT address "user at ugly.domain". >
> > !> ! Note: $sender_canonical_maps is processed before $canonical_maps. > !
> > !> ! Example: >
> >> ! sender_canonical_maps = hash:/etc/postfix/sender_canonical >> > > --- 8214,8253 ---- > > !
An optional table to prevent repeated SASL authentication > ! failures with the same remote SMTP server hostname, username and > ! password. Each table (key, value) pair contains a server name, a > ! username and password, and the full server response. This information > ! is stored when a remote SMTP server rejects an authentication attempt > ! with a 535 reply code. As long as the smtp_sasl_password_maps > ! information does no change, and as long as the smtp_sasl_auth_cache_name > ! information does not expire (see smtp_sasl_auth_cache_time) the > ! Postfix SMTP client avoids SASL authentication attempts with the > ! same server, username and password, and instead bounces or defers > ! mail as controlled with the smtp_sasl_auth_soft_bounce configuration > ! parameter.
> > !Use a per-destination delivery concurrency of 1 (for example, > ! "smtp_destination_concurrency_limit = 1", > ! "relay_destination_concurrency_limit = 1", etc.), otherwise multiple > ! delivery agents may experience a login failure at the same time. >
> > !The table must be accessed via the proxywrite service, i.e. the > ! map name must start with "proxy:". The table should be stored under > ! the directory specified with the data_directory parameter.
> > !This feature uses cryptographic hashing to protect plain-text > ! passwords, and requires that Postfix is compiled with TLS support. >
> > +Example:
> + >> ! smtp_sasl_auth_cache_name = proxy:btree:/var/lib/postfix/sasl_auth_cache >> > +
This feature is available in Postfix 2.5 and later.
> + > > *************** > *** 8974,8994 **** > > !A sender-dependent override for the global default_transport > ! parameter setting. The tables are searched by the envelope sender > ! address and @domain. A lookup result of DUNNO terminates the search > ! without overriding the global default_transport parameter setting. > ! This information is overruled with the transport(5) table.
> ! > !Note: this overrides default_transport, not transport_maps, and > ! therefore the expected syntax is that of default_transport, not the > ! syntax of transport_maps. Specifically, this does not support the > ! transport_maps syntax for null transport, null nexthop, or null > ! email addresses.
> > !For safety reasons, this feature does not allow $number > ! substitutions in regular expression maps.
> > !This feature is available in Postfix 2.7 and later.
> > --- 8255,8263 ---- > > !The maximal age of an smtp_sasl_auth_cache_name entry before it > ! is removed.
> > !This feature is available in Postfix 2.5 and later.
> > *************** > *** 8997,9016 **** > > !A sender-dependent override for the global relayhost parameter > ! setting. The tables are searched by the envelope sender address and > ! @domain. A lookup result of DUNNO terminates the search without > ! overriding the global relayhost parameter setting (Postfix 2.6 and > ! later). This information is overruled with relay_transport, > ! sender_dependent_default_transport_maps, default_transport and with > ! the transport(5) table.
> > !For safety reasons, this feature does not allow $number > ! substitutions in regular expression maps.
> >> ! This feature is available in Postfix 2.3 and later. >
> > > --- 8266,8283 ---- > > !> ! Enable SASL authentication in the Postfix SMTP client. By default, > ! the Postfix SMTP client uses no authentication. > !
> >> ! Example: >
> > +> + smtp_sasl_auth_enable = yes > +> + > > *************** > *** 9018,9044 **** > > !
Controls how the Postfix sendmail command converts email message > ! line endings from <CR><LF> into UNIX format (<LF>). > !
> > !This feature is available in Postfix 2.9 and later.
> > --- 8285,8307 ---- > > !When a remote SMTP server rejects a SASL authentication request > ! with a 535 reply code, defer mail delivery instead of returning > ! mail as undeliverable. The latter behavior was hard-coded prior to > ! Postfix version 2.5.
> > !Note: the setting "yes" overrides the global soft_bounce > ! parameter, but the setting "no" does not.
> > !Example:
> > !> ! # Default as of Postfix 2.5 > ! smtp_sasl_auth_soft_bounce = yes > ! # The old hard-coded default > ! smtp_sasl_auth_soft_bounce = no > !> > !
This feature is available in Postfix 2.5 and later.
> > *************** > *** 9047,9057 **** > > !> ! A Sendmail compatibility feature that specifies the location of > ! the Postfix sendmail(1) command. This command can be used to > ! submit mail into the Postfix queue. >
> > > --- 8310,8340 ---- > > !> ! If non-empty, a Postfix SMTP client filter for the remote SMTP > ! server's list of offered SASL mechanisms. Different client and > ! server implementations may support different mechanism lists. By > ! default, the Postfix SMTP client will use the intersection of the > ! two. smtp_sasl_mechanism_filter further restricts what server > ! mechanisms the client will take into consideration.
> ! > !Specify mechanism names, "/file/name" patterns or "type:table" > ! lookup tables. The right-hand side result from "type:table" lookups > ! is ignored. Specify "!pattern" to exclude a mechanism name from the > ! list. The form "!/file/name" is supported only in Postfix version > ! 2.4 and later.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > !> ! Examples: >
> > +> + smtp_sasl_mechanism_filter = plain, login > + smtp_sasl_mechanism_filter = /etc/postfix/smtp_mechs > + smtp_sasl_mechanism_filter = !gssapi, !login, static:rest > +> + > > *************** > *** 9059,9066 **** > > !
> ! How long the Postfix master(8) waits before forking a server that > ! appears to be malfunctioning. >
> --- 8342,8352 ---- > > !> ! Optional SMTP client lookup tables with one username:password entry > ! per remote hostname or domain, or sender address when sender-dependent > ! authentication is enabled. If no username:password entry is found, > ! then the Postfix SMTP client will not > ! attempt to authenticate to the remote host. >
> *************** > *** 9068,9071 **** >> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> --- 8354,8357 ---- >> ! The Postfix SMTP client opens the lookup table before going to > ! chroot jail, so you can leave the password file in /etc/postfix. >
> *************** > *** 9075,9085 **** > > !> ! The group ownership of set-gid Postfix commands and of group-writable > ! Postfix directories. When this parameter value is changed you need > ! to re-run "postfix set-permissions" (with Postfix version 2.0 and > ! earlier: "/etc/postfix/post-install set-permissions". > !
> > --- 8361,8372 ---- > > !Implementation-specific information that the Postfix SMTP client > ! passes through to > ! the SASL plug-in implementation that is selected with > ! smtp_sasl_type. Typically this specifies the name of a > ! configuration file or rendezvous point.
> ! > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 9088,9147 **** > > !> ! Display the name of the recipient table in the "User unknown" > ! responses. The extra detail makes trouble shooting easier but also > ! reveals information that is nobody elses business. > !
> >> ! This feature is available in Postfix 2.0 and later. >
> > > !> ! The name of the showq(8) service. This service produces mail queue > ! status reports. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > > !The address type ("ipv6", "ipv4" or "any") that the Postfix > ! SMTP client will try first, when a destination has IPv6 and IPv4 > ! addresses with equal MX preference. This feature has no effect > ! unless the inet_protocols setting enables both IPv4 and IPv6. > ! With Postfix 2.8 the default is "ipv6".
> > !This feature is available in Postfix 2.8 and later.
> > > !> ! Always send EHLO at the start of an SMTP session. >
> > !> ! With "smtp_always_send_ehlo = no", the Postfix SMTP client sends > ! EHLO only when > ! the word "ESMTP" appears in the server greeting banner (example: > ! 220 spike.porcupine.org ESMTP Postfix). > !
> > --- 8375,8424 ---- > > !Postfix SMTP client SASL security options; as of Postfix 2.3 > ! the list of available > ! features depends on the SASL client implementation that is selected > ! with smtp_sasl_type.
> ! > !The following security features are defined for the cyrus > ! client SASL implementation:
> >> ! Specify zero or more of the following: >
> > +> ! Example: >
> > !> ! smtp_sasl_security_options = noplaintext > !> > *************** > *** 9150,9180 **** > > !
> ! An optional numerical network address that the Postfix SMTP client > ! should bind to when making an IPv4 connection. > !
> ! > !> ! This can be specified in the main.cf file for all SMTP clients, or > ! it can be specified in the master.cf file for a specific client, > ! for example: > !
> ! > !> !> > !> ! /etc/postfix/master.cf: > ! smtp ... smtp -o smtp_bind_address=11.22.33.44 > !> !
Note 1: when inet_interfaces specifies no more than one IPv4 > ! address, and that address is a non-loopback address, it is > ! automatically used as the smtp_bind_address. This supports virtual > ! IP hosting, but can be a problem on multi-homed firewalls. See the > ! inet_interfaces documentation for more detail.
> > !Note 2: address information may be enclosed inside [], > ! but this form is not required here.
> > --- 8427,8435 ---- > > !The SASL authentication security options that the Postfix SMTP > ! client uses for TLS encrypted SMTP sessions.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 9183,9215 **** > > !> ! An optional numerical network address that the Postfix SMTP client > ! should bind to when making an IPv6 connection. > !
> > -This feature is available in Postfix 2.2 and later.
> > !> ! This can be specified in the main.cf file for all SMTP clients, or > ! it can be specified in the master.cf file for a specific client, > ! for example: > !
> > !> !> > !> ! /etc/postfix/master.cf: > ! smtp ... smtp -o smtp_bind_address6=1:2:3:4:5:6:7:8 > !> !
Note 1: when inet_interfaces specifies no more than one IPv6 > ! address, and that address is a non-loopback address, it is > ! automatically used as the smtp_bind_address6. This supports virtual > ! IP hosting, but can be a problem on multi-homed firewalls. See the > ! inet_interfaces documentation for more detail.
> > !Note 2: address information may be enclosed inside [], > ! but this form is not recommended here.
> > --- 8438,8458 ---- > > !The SASL authentication security options that the Postfix SMTP > ! client uses for TLS encrypted SMTP sessions with a verified server > ! certificate. This feature is under construction as of Postfix version > ! 2.3.
> > > !The SASL plug-in type that the Postfix SMTP client should use > ! for authentication. The available types are listed with the > ! "postconf -A" command.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 9218,9228 **** > > !Restricted body_checks(5) tables for the Postfix SMTP client. > ! These tables are searched while mail is being delivered. Actions > ! that change the delivery time or destination are not available. >
> > !This feature is available in Postfix 2.5 and later.
> > --- 8461,8481 ---- > > !> ! Send the non-standard XFORWARD command when the Postfix SMTP server > ! EHLO response announces XFORWARD support. >
> > !> ! This allows an "smtp" delivery agent, used for injecting mail into > ! a content filter, to forward the name, address, protocol and HELO > ! name of the original client to the content filter and downstream > ! queuing SMTP server. This can produce more useful logging than > ! localhost[127.0.0.1] etc. > !
> ! > !> ! This feature is available in Postfix 2.1 and later. > !
> > *************** > *** 9231,9244 **** > > !Allow DNS CNAME records to override the servername that the > ! Postfix SMTP client uses for logging, SASL password lookup, TLS > ! policy decisions, or TLS certificate verification. The value "no" > ! hardens Postfix smtp_tls_per_site hostname-based policies against > ! false hostname information in DNS CNAME records, and makes SASL > ! password file lookups more predictable. This is the default setting > ! as of Postfix 2.3.
> > !This feature is available in Postfix 2.2.9 and later.
> > --- 8484,8497 ---- > > !> ! Enable sender-dependent authentication in the Postfix SMTP client; this is > ! available only with SASL authentication, and disables SMTP connection > ! caching to ensure that mail from different senders will use the > ! appropriate credentials.
> > !> ! This feature is available in Postfix 2.3 and later. > !
> > *************** > *** 9247,9254 **** > > !> ! The Postfix SMTP client time limit for completing a TCP connection, or > ! zero (use the operating system built-in time limit). >
> --- 8500,8507 ---- > > !> ! Skip SMTP servers that greet with a 4XX status code (go away, try > ! again later). >
> *************** > *** 9256,9268 **** >> ! When no connection can be made within the deadline, the Postfix > ! SMTP client > ! tries the next address on the mail exchanger list. Specify 0 to > ! disable the time limit (i.e. use whatever timeout is implemented by > ! the operating system). >
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > --- 8509,8518 ---- >> ! By default, Postfix moves on the next mail exchanger. Specify > ! "smtp_skip_4xx_greeting = no" if Postfix should defer delivery > ! immediately. >
> > !This feature is available in Postfix 2.0 and earlier. > ! Later Postfix versions always skip SMTP servers that greet with a > ! 4XX status code.
> > *************** > *** 9271,9308 **** > > !Permanently enable SMTP connection caching for the specified > ! destinations. With SMTP connection caching, a connection is not > ! closed immediately after completion of a mail transaction. Instead, > ! the connection is kept open for up to $smtp_connection_cache_time_limit > ! seconds. This allows connections to be reused for other deliveries, > ! and can improve mail delivery performance.
> > !Specify a comma or white space separated list of destinations > ! or pseudo-destinations:
> > -This feature is available in Postfix 2.2 and later.
> > --- 8521,8555 ---- > > !> ! Skip SMTP servers that greet with a 5XX status code (go away, do > ! not try again later). > !
> > !By default, the Postfix SMTP client moves on the next mail > ! exchanger. Specify "smtp_skip_5xx_greeting = no" if Postfix should > ! bounce the mail immediately. The default setting is incorrect, but > ! it is what a lot of people expect to happen.
> > > !> ! Do not wait for the response to the SMTP QUIT command. > !
> > > !Time limit for Postfix SMTP client write and read operations > ! during TLS startup and shutdown handshake procedures.
> ! > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 9311,9350 **** > > !Temporarily enable SMTP connection caching while a destination > ! has a high volume of mail in the active queue. With SMTP connection > ! caching, a connection is not closed immediately after completion > ! of a mail transaction. Instead, the connection is kept open for > ! up to $smtp_connection_cache_time_limit seconds. This allows > ! connections to be reused for other deliveries, and can improve mail > ! delivery performance.
> > !This feature is available in Postfix 2.2 and later.
> > > !When SMTP connection caching is enabled, the number of times that > ! an SMTP session may be reused before it is closed. > !
> > !This feature is available in Postfix 2.2. In Postfix 2.3 it is > ! replaced by $smtp_connection_reuse_time_limit.
> > > !When SMTP connection caching is enabled, the amount of time that > ! an unused SMTP client socket is kept open before it is closed. Do > ! not specify larger values without permission from the remote sites. > !
> > !This feature is available in Postfix 2.2 and later.
> > --- 8558,8597 ---- > > !The file with the certificate of the certification authority > ! (CA) that issued the Postfix SMTP client certificate. This is > ! needed only when the CA certificate is not already present in the > ! client certificate file.
> > !Example:
> > +> + smtp_tls_CAfile = /etc/postfix/CAcert.pem > +> > !
This feature is available in Postfix 2.2 and later.
> > > !Directory with PEM format certificate authority certificates > + that the Postfix SMTP client uses to verify a remote SMTP server > + certificate. Don't forget to create the necessary "hash" links > + with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". > +
> > !To use this option in chroot mode, this directory (or a copy) > ! must be inside the chroot jail.
> > !Example:
> > !> ! smtp_tls_CApath = /etc/postfix/certs > !> > !
This feature is available in Postfix 2.2 and later.
> > *************** > *** 9353,9423 **** > > !The amount of time during which Postfix will use an SMTP > ! connection repeatedly. The timer starts when the connection is > ! initiated (i.e. it includes the connect, greeting and helo latency, > ! in addition to the latencies of subsequent mail delivery transactions). > !
> > !This feature addresses a performance stability problem with > ! remote SMTP servers. This problem is not specific to Postfix: it > ! can happen when any MTA sends large amounts of SMTP email to a site > ! that has multiple MX hosts.
> > !The problem starts when one of a set of MX hosts becomes slower > ! than the rest. Even though SMTP clients connect to fast and slow > ! MX hosts with equal probability, the slow MX host ends up with more > ! simultaneous inbound connections than the faster MX hosts, because > ! the slow MX host needs more time to serve each client request.
> ! > !The slow MX host becomes a connection attractor. If one MX > ! host becomes N times slower than the rest, it dominates mail delivery > ! latency unless there are more than N fast MX hosts to counter the > ! effect. And if the number of MX hosts is smaller than N, the mail > ! delivery latency becomes effectively that of the slowest MX host > ! divided by the total number of MX hosts.
> ! > !The solution uses connection caching in a way that differs from > ! Postfix version 2.2. By limiting the amount of time during which a connection > ! can be used repeatedly (instead of limiting the number of deliveries > ! over that connection), Postfix not only restores fairness in the > ! distribution of simultaneous connections across a set of MX hosts, > ! it also favors deliveries over connections that perform well, which > ! is exactly what we want.
> > !The default reuse time limit, 300s, is comparable to the various > ! smtp transaction timeouts which are fair estimates of maximum excess > ! latency for a slow delivery. Note that hosts may accept thousands > ! of messages over a single connection within the default connection > ! reuse time limit. This number is much larger than the default Postfix > ! version 2.2 limit of 10 messages per cached connection. It may prove necessary > ! to lower the limit to avoid interoperability issues with MTAs that > ! exhibit bugs when many messages are delivered via a single connection. > ! A lower reuse time limit risks losing the benefit of connection > ! reuse when the average connection and mail delivery latency exceeds > ! the reuse time limit.
> > !This feature is available in Postfix 2.3 and later.
> > > !> ! The Postfix SMTP client time limit for sending the SMTP ".", and > ! for receiving the remote SMTP server response. > !
> > !> ! When no response is received within the deadline, a warning is > ! logged that the mail may be delivered multiple times. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > --- 8600,8651 ---- > > !File with the Postfix SMTP client RSA certificate in PEM format. > ! This file may also contain the Postfix SMTP client private RSA key, > ! and these may be the same as the Postfix SMTP server RSA certificate and key > ! file.
> > !Do not configure client certificates unless you must present > ! client TLS certificates to one or more servers. Client certificates are > ! not usually needed, and can cause problems in configurations that work > ! well without them. The recommended setting is to let the defaults stand:
> > !> !> > !> ! smtp_tls_cert_file = > ! smtp_tls_dcert_file = > ! smtp_tls_key_file = > ! smtp_tls_dkey_file = > !> !
The best way to use the default settings is to comment out the above > ! parameters in main.cf if present.
> > !In order to verify certificates, the CA certificate (in case > ! of a certificate chain, all CA certificates) must be available. > ! You should add these certificates to the client certificate, the > ! client certificate first, then the issuing CA(s).
> > +Example: the certificate for "client.dom.ain" was issued by > + "intermediate CA" which itself has a certificate of "root CA". > + Create the client.pem file with "cat client_cert.pem intermediate_CA.pem > + root_CA.pem > client.pem".
> > !If you also want to verify remote SMTP server certificates issued by > ! these CAs, you can also add the CA certificates to the smtp_tls_CAfile, > ! in which case it is not necessary to have them in the smtp_tls_cert_file > ! or smtp_tls_dcert_file.
> > !A certificate supplied here must be usable as an SSL client certificate > ! and hence pass the "openssl verify -purpose sslclient ..." test.
> > !Example:
> > !> ! smtp_tls_cert_file = /etc/postfix/client.pem > !> > !
This feature is available in Postfix 2.2 and later.
> > *************** > *** 9426,9456 **** > > !> ! The Postfix SMTP client time limit for sending the SMTP DATA command, > ! and for receiving the remote SMTP server response. > !
> ! > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> ! > ! > !> ! The Postfix SMTP client time limit for sending the SMTP message content. > ! When the connection makes no progress for more than $smtp_data_xfer_timeout > ! seconds the Postfix SMTP client terminates the transfer. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > --- 8654,8671 ---- > > !Obsolete Postfix < 2.3 control for the Postfix SMTP client TLS > ! cipher list. As this feature applies to all TLS security levels, it is easy > ! to create inter-operability problems by choosing a non-default cipher > ! list. Do not use a non-default TLS cipher list on hosts that deliver email > ! to the public Internet: you will be unable to send email to servers that > ! only support the ciphers you exclude. Using a restricted cipher list > ! may be more appropriate for an internal MTA, where one can exert some > ! control over the TLS software and settings of the peer servers.
> > !Note: do not use "" quotes around the parameter value.
> > !This feature is available in Postfix version 2.2. It is not used with > ! Postfix 2.3 and later; use smtp_tls_mandatory_ciphers instead.
> > *************** > *** 9459,9482 **** > > !> ! Defer mail delivery when no MX record resolves to an IP address. > !
> > !> ! The default (no) is to return the mail as undeliverable. With older > ! Postfix versions the default was to keep trying to deliver the mail > ! until someone fixed the MX record or until the mail was too old. >
> > !> ! Note: the Postfix SMTP client always ignores MX records with equal > ! or worse preference > ! than the local MTA itself. > !
> > !> ! This feature is available in Postfix 2.1 and later. > !
> > --- 8674,8691 ---- > > !File with the Postfix SMTP client DSA certificate in PEM format. > ! This file may also contain the Postfix SMTP client private DSA key.
> > !See the discussion under smtp_tls_cert_file for more details. >
> > !Example:
> > !> ! smtp_tls_dcert_file = /etc/postfix/client-dsa.pem > !> ! > !
This feature is available in Postfix 2.2 and later.
> > *************** > *** 9485,9523 **** > > !The maximal number of parallel deliveries to the same destination > ! via the smtp message delivery transport. This limit is enforced by > ! the queue manager. The message delivery transport name is the first > ! field in the entry in the master.cf file.
> > > !The maximal number of recipients per message for the smtp > - message delivery transport. This limit is enforced by the queue > - manager. The message delivery transport name is the first field in > - the entry in the master.cf file.
> > !Setting this parameter to a value of 1 changes the meaning of > ! smtp_destination_concurrency_limit from concurrency per domain > ! into concurrency per recipient.
> > > !Lookup tables, indexed by the remote SMTP server address, with > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > ! etc.) that the Postfix SMTP client will ignore in the EHLO response from a > ! remote SMTP server. See smtp_discard_ehlo_keywords for details. The > ! table is not indexed by hostname for consistency with > ! smtpd_discard_ehlo_keyword_address_maps.
> > !This feature is available in Postfix 2.2 and later.
> > --- 8694,8730 ---- > > !File with the Postfix SMTP client DSA private key in PEM format. > + This file may be combined with the Postfix SMTP client DSA certificate > + file specified with $smtp_tls_dcert_file.
> > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted, but file permissions should grant read/write > ! access only to the system superuser account ("root").
> > !This feature is available in Postfix 2.2 and later.
> > > !With mandatory TLS encryption, require that the remote SMTP > ! server hostname matches the information in the remote SMTP server > ! certificate. As of RFC 2487 the requirements for hostname checking > ! for MTA clients are not specified.
> > !This option can be set to "no" to disable strict peer name > ! checking. This setting has no effect on sessions that are controlled > ! via the smtp_tls_per_site table.
> > !Disabling the hostname verification can make sense in closed > ! environment where special CAs are created. If not used carefully, > ! this option opens the danger of a "man-in-the-middle" attack (the > ! CommonName of this attacker will be logged).
> > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> > *************** > *** 9526,9547 **** > > !A case insensitive list of EHLO keywords (pipelining, starttls, > ! auth, etc.) that the Postfix SMTP client will ignore in the EHLO > ! response from a remote SMTP server.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > !Notes:
> > !Specify the silent-discard pseudo keyword to prevent > ! this action from being logged.
> > !Use the smtp_discard_ehlo_keyword_address_maps feature to > ! discard EHLO keywords selectively.
> > !List of ciphers or cipher types to exclude from the Postfix > ! SMTP client cipher > ! list at all TLS security levels. This is not an OpenSSL cipherlist, it is > ! a simple list separated by whitespace and/or commas. The elements are a > ! single cipher, or one or more "+" separated cipher properties, in which > ! case only ciphers matching all the properties are excluded.
> > !Examples (some of these will cause problems):
> > !> !> > !> ! smtp_tls_exclude_ciphers = aNULL > ! smtp_tls_exclude_ciphers = MD5, DES > ! smtp_tls_exclude_ciphers = DES+MD5 > ! smtp_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 > ! smtp_tls_exclude_ciphers = kEDH+aRSA > !> !
The first setting, disables anonymous ciphers. The next setting > ! disables ciphers that use the MD5 digest algorithm or the (single) DES > ! encryption algorithm. The next setting disables ciphers that use MD5 and > ! DES together. The next setting disables the two ciphers "AES256-SHA" > ! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" > ! key exchange with RSA authentication.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 9550,9576 **** > > !DNS Resolver options for the Postfix SMTP client. Specify zero > ! or more of the following options, separated by comma or whitespace. > ! Option names are case-sensitive. Some options refer to domain names > ! that are specified in the file /etc/resolv.conf or equivalent.
> > !This feature is available in Postfix 2.8 and later.
> > --- 8767,8825 ---- > > !List of acceptable remote SMTP server certificate fingerprints > ! for the "fingerprint" TLS security level (smtp_tls_security_level = > ! fingerprint). At this security level, certificate authorities are > ! not used, and certificate expiration times are ignored. Instead, > ! server certificates are verified directly via their "fingerprint". The > ! fingerprint is a message digest of the server certificate. The digest > ! algorithm is selected via the smtp_tls_fingerprint_digest > ! parameter.
> > !When an smtp_tls_policy_maps table entry specifies the > ! "fingerprint" security level, any "match" attributes in that entry specify > ! the list of valid fingerprints for the corresponding destination. Multiple > ! fingerprints can be combined with a "|" delimiter in a single match > ! attribute, or multiple match attributes can be employed.
> > !Example: Certificate fingerprint verification with internal mailhub. > ! Two matching fingerprints are listed. The relayhost may be multiple > ! physical hosts behind a load-balancer, each with its own private/public > ! key and self-signed certificate. Alternatively, a single relayhost may > ! be in the process of switching from one set of private/public keys to > ! another, and both keys are trusted just prior to the transition.
> > !> !> > !> ! relayhost = [mailhub.example.com] > ! smtp_tls_security_level = fingerprint > ! smtp_tls_fingerprint_digest = md5 > ! smtp_tls_fingerprint_cert_match = > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > !> !
Example: Certificate fingerprint verification with selected destinations. > ! As in the example above, we show two matching fingerprints:
> > !> !> > !> ! /etc/postfix/main.cf: > ! smtp_tls_policy_maps = hash:/etc/postfix/tls_policy > ! smtp_tls_fingerprint_digest = md5 > !> !
> !> > !> ! /etc/postfix/tls_policy: > ! example.com fingerprint > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > !> !
This feature is available in Postfix 2.5 and later.
> > *************** > *** 9579,9661 **** > > !Enforcement mode: require that remote SMTP servers use TLS > ! encryption, and never send mail in the clear. This also requires > ! that the remote SMTP server hostname matches the information in > ! the remote server certificate, and that the remote SMTP server > ! certificate was issued by a CA that is trusted by the Postfix SMTP > ! client. If the certificate doesn't verify or the hostname doesn't > ! match, delivery is deferred and mail stays in the queue.
> ! > !The server hostname is matched against all names provided as > ! dNSNames in the SubjectAlternativeName. If no dNSNames are specified, > ! the CommonName is checked. The behavior may be changed with the > ! smtp_tls_enforce_peername option.
> ! > !This option is useful only if you are definitely sure that you > ! will only connect to servers that support RFC 2487 _and_ that > ! provide valid server certificates. Typical use is for clients that > ! send all their email to a dedicated mailhub.
> ! > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> ! > ! > !> ! Optional list of relay hosts for SMTP destinations that can't be > ! found or that are unreachable. With Postfix 2.2 and earlier this > ! parameter is called fallback_relay.
> > !> ! By default, mail is returned to the sender when a destination is > ! not found, and delivery is deferred when a destination is unreachable. >
> > !The fallback relays must be SMTP destinations. Specify a domain, > ! host, host:port, [host]:port, [address] or [address]:port; the form > ! [host] turns off MX lookups. If you specify multiple SMTP > ! destinations, Postfix will try them in the specified order.
> > !To prevent mailer loops between MX hosts and fall-back hosts, > ! Postfix version 2.2 and later will not use the fallback relays for > ! destinations that it is MX host for (assuming DNS lookup is turned on). >
> > > !Optional lookup tables that perform address rewriting in the > - Postfix SMTP client, typically to transform a locally valid address into > - a globally valid address when sending mail across the Internet. > - This is needed when the local machine does not have its own Internet > - domain name, but uses something like localdomain.local > - instead.
> > !The table format and lookups are documented in generic(5); > ! examples are shown in the ADDRESS_REWRITING_README and > ! STANDARD_CONFIGURATION_README documents.
> > !This feature is available in Postfix 2.2 and later.
> > > !Restricted header_checks(5) tables for the Postfix SMTP client. > ! These tables are searched while mail is being delivered. Actions > ! that change the delivery time or destination are not available. > !
> > !This feature is available in Postfix 2.5 and later.
> > --- 8828,8898 ---- > > !The message digest algorithm used to construct remote SMTP server > ! certificate fingerprints. At the "fingerprint" TLS security level > ! (smtp_tls_security_level = fingerprint), the server certificate is > ! verified by directly matching its fingerprint. The fingerprint > ! is the message digest of the server certificate using the selected > ! algorithm. With a digest algorithm resistant to "second pre-image" > ! attacks, it is not feasible to create a new public key and a matching > ! certificate that has the same fingerprint.
> > !The default algorithm is md5; this is consistent with > ! the backwards compatible setting of the digest used to verify client > ! certificates in the SMTP server.
> > !The best practice algorithm is now sha1. Recent advances in hash > ! function cryptanalysis have led to md5 being deprecated in favor of sha1. > ! However, as long as there are no known "second pre-image" attacks > ! against md5, its use in this context can still be considered safe. >
> > !While additional digest algorithms are often available with OpenSSL's > ! libcrypto, only those used by libssl in SSL cipher suites are available to > ! Postfix. For now this means just md5 or sha1.
> > !To find the fingerprint of a specific certificate file, with a > ! specific digest algorithm, run: >
> > +> +> + > +> + $ openssl x509 -noout -fingerprint -digest -in certfile.pem > +> +
The text to the right of "=" sign is the desired fingerprint. > + For example:
> > !> !> > !> ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A > !> !
This feature is available in Postfix 2.5 and later.
> > > !File with the Postfix SMTP client RSA private key in PEM format. > + This file may be combined with the Postfix SMTP client RSA certificate > + file specified with $smtp_tls_cert_file.
> > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted, but file permissions should grant read/write > ! access only to the system superuser account ("root").
> > !Example:
> > !> ! smtp_tls_key_file = $smtp_tls_cert_file > !> > !
This feature is available in Postfix 2.2 and later.
> > *************** > *** 9664,9709 **** > > !> ! The hostname to send in the SMTP EHLO or HELO command. > !
> > !> ! The default value is the machine hostname. Specify a hostname or > ! [ip.add.re.ss]. > !
> > !> ! This information can be specified in the main.cf file for all SMTP > ! clients, or it can be specified in the master.cf file for a specific > ! client, for example: > !
> > !> !> > !> ! /etc/postfix/master.cf: > ! mysmtp ... smtp -o smtp_helo_name=foo.bar.com > !> !
> ! This feature is available in Postfix 2.0 and later. > !
> > > !> ! The Postfix SMTP client time limit for sending the HELO or EHLO command, > ! and for receiving the initial remote SMTP server response. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > --- 8901,8929 ---- > > !Enable additional Postfix SMTP client logging of TLS activity. > ! Each logging level also includes the information that is logged at > ! a lower logging level.
> > !Use "smtp_tls_loglevel = 3" only in case of problems. Use of > ! loglevel 4 is strongly discouraged.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 9712,9740 **** > > !> ! What mechanisms the Postfix SMTP client uses to look up a host's IP > ! address. This parameter is ignored when DNS lookups are disabled > ! (see: disable_dns_lookups). > !
> > !> ! Specify one of the following: > !
> >The minimum TLS cipher grade that the Postfix SMTP client will > ! use with > ! mandatory TLS encryption. The default value "medium" is suitable > ! for most destinations with which you may want to enforce TLS, and > ! is beyond the reach of today's crypt-analytic methods. See > ! smtp_tls_policy_maps for information on how to configure ciphers > ! on a per-destination basis.
> > !The following cipher grades are supported:
> >> ! This feature is available in Postfix 2.1 and later. > !
> > --- 9003,9005 ---- > > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 9749,9767 **** > > !> ! The maximal length of message header and body lines that Postfix > ! will send via SMTP. This limit does not include the <CR><LF> > ! at the end of each line. Longer lines are broken by inserting > ! "<CR><LF><SPACE>", to minimize the damage to MIME > ! formatted mail. > !
> > !> ! The Postfix limit of 998 characters not including <CR><LF> > ! is consistent with the SMTP limit of 1000 characters including > ! <CR><LF>. The Postfix limit was 990 with Postfix 2.8 > ! and earlier. > !
> > --- 9008,9018 ---- > > !Additional list of ciphers or cipher types to exclude from the > ! SMTP client cipher list at mandatory TLS security levels. This list > ! works in addition to the exclusions listed with smtp_tls_exclude_ciphers > ! (see there for syntax details).
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 9770,9796 **** > > !> ! The Postfix SMTP client time limit for sending the MAIL FROM command, > ! and for receiving the remote SMTP server response. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > > !Restricted mime_header_checks(5) tables for the Postfix SMTP > ! client. These tables are searched while mail is being delivered. > ! Actions that change the delivery time or destination are not > ! available.
> > !This feature is available in Postfix 2.5 and later.
> > --- 9021,9056 ---- > > !List of SSL/TLS protocols that the Postfix SMTP client will use with > ! mandatory TLS encryption. In main.cf the values are separated by > ! whitespace, commas or colons. In the policy table "protocols" attribute > ! (see smtp_tls_policy_maps) the only valid separator is colon. An > ! empty value means allow all protocols. The valid protocol names, (see > ! SSL_get_version(3)), are "SSLv2", "SSLv3" and "TLSv1".
> > !With Postfix ≥ 2.5 the parameter syntax is expanded to support > ! protocol exclusions. One can now explicitly exclude SSLv2 by setting > ! "smtp_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and > ! SSLv3 set "smtp_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing > ! the protocols to include, rather than protocols to exclude, is still > ! supported; use the form you find more intuitive.
> > +Since SSL version 2 has known protocol weaknesses and is now > + deprecated, the default setting excludes "SSLv2". This means that by > + default, SSL version 2 will not be used at the "encrypt" security level > + and higher.
> > !See the documentation of the smtp_tls_policy_maps parameter and > ! TLS_README for more information about security levels.
> > !Example:
> > !> ! smtp_tls_mandatory_protocols = TLSv1 > ! # Alternative form with Postfix ≥ 2.5: > ! smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 > !> > !
This feature is available in Postfix 2.3 and later.
> > *************** > *** 9799,9828 **** > > !> ! The maximal number of MX (mail exchanger) IP addresses that can > ! result from Postfix SMTP client mail exchanger lookups, or zero (no > ! limit). Prior to > ! Postfix version 2.3, this limit was disabled by default. > !
> ! > !> ! This feature is available in Postfix 2.1 and later. > !
> ! > > !The maximal number of SMTP sessions per delivery request before > ! the Postfix SMTP client > ! gives up or delivers to a fall-back relay host, or zero (no > ! limit). This restriction ignores sessions that fail to complete the > ! SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to > ! complete the EHLO and TLS handshake (Postfix version 2.3 and later).
> > !This feature is available in Postfix 2.1 and later.
> > --- 9059,9073 ---- > > !Log the hostname of a remote SMTP server that offers STARTTLS, > ! when TLS is not already enabled for that server.
> > !The logfile record looks like:
> > !> ! postfix/smtp[pid]: Host offered STARTTLS: [name.of.host] > !> > !
This feature is available in Postfix 2.2 and later.
> > *************** > *** 9831,9890 **** > > !Restricted nested_header_checks(5) tables for the Postfix SMTP > ! client. These tables are searched while mail is being delivered. > ! Actions that change the delivery time or destination are not > ! available.
> ! > !This feature is available in Postfix 2.5 and later.
> ! > ! > !Never send EHLO at the start of an SMTP session. See also the > ! smtp_always_send_ehlo parameter.
> > > !Change the behavior of the smtp_*_timeout time limits, from a > ! time limit per read or write system call, to a time limit to send > ! or receive a complete record (an SMTP command line, SMTP response > ! line, SMTP message content line, or TLS protocol message). This > ! limits the impact from hostile peers that trickle data one byte at > ! a time.
> ! > !Note: when per-record deadlines are enabled, a short timeout > ! may cause problems with TLS over very slow network connections. > ! The reasons are that a TLS protocol message can be up to 16 kbytes > ! long (with TLSv1), and that an entire TLS protocol message must be > ! sent or received within the per-record deadline.
> > !This feature is available in Postfix 2.9 and later. With older > ! Postfix releases, the behavior is as if this parameter is set to > ! "no".
> > > !> ! How long the Postfix SMTP client pauses before sending > ! ".<CR><LF>" in order to work around the PIX firewall > ! "<CR><LF>.<CR><LF>" bug. > !
> > !> ! Choosing a too short time makes this workaround ineffective when > ! sending large messages over slow network connections. > !
> > --- 9076,9151 ---- > > !Optional lookup tables with the Postfix SMTP client TLS usage > ! policy by next-hop destination and by remote SMTP server hostname. > ! When both lookups succeed, the more specific per-site policy (NONE, > ! MUST, etc) overrides the less specific one (MAY), and the more secure > ! per-site policy (MUST, etc) overrides the less secure one (NONE). > ! With Postfix 2.3 and later smtp_tls_per_site is strongly discouraged: > ! use smtp_tls_policy_maps instead.
> > !Use of the bare hostname as the per-site table lookup key is > ! discouraged. Always use the full destination nexthop (enclosed in > ! [] with a possible ":port" suffix). A recipient domain or MX-enabled > ! transport next-hop with no port suffix may look like a bare hostname, > ! but is still a suitable destination.
> > +Specify a next-hop destination or server hostname on the left-hand > + side; no wildcards are allowed. The next-hop destination is either > + the recipient domain, or the destination specified with a transport(5) > + table, the relayhost parameter, or the relay_transport parameter. > + On the right hand side specify one of the following keywords:
> > !The above keywords correspond to the "none", "may", "encrypt" and > ! "verify" security levels for the new smtp_tls_security_level parameter > ! introduced in Postfix 2.3. Starting with Postfix 2.3, and independently > ! of how the policy is specified, the smtp_tls_mandatory_ciphers and > ! smtp_tls_mandatory_protocols parameters only apply when TLS encryption > ! is mandatory. Connections for which encryption is optional enable > ! all "export" grade and better ciphers.
> > !As long as no secure DNS lookup mechanism is available, false > ! hostnames in MX or CNAME responses can change the server hostname > ! that Postfix uses for TLS policy lookup and server certificate > ! verification. Even with a perfect match between the server hostname and > ! the server certificate, there is no guarantee that Postfix is connected > ! to the right server. See TLS_README (Closing a DNS loophole with obsolete > ! per-site TLS policies) for a possible work-around.
> > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtp_tls_policy_maps instead.
> > *************** > *** 9893,9938 **** > > !Lookup tables, indexed by the remote SMTP server address, with > ! per-destination workarounds for CISCO PIX firewall bugs. The table > ! is not indexed by hostname for consistency with > ! smtp_discard_ehlo_keyword_address_maps.
> ! > !This feature is available in Postfix 2.4 and later.
> ! > ! > !How long a message must be queued before the Postfix SMTP client > ! turns on the PIX firewall "<CR><LF>.<CR><LF>" > ! bug workaround for delivery through firewalls with "smtp fixup" > ! mode turned on.
> ! > !> ! By default, the workaround is turned off for mail that is queued > ! for less than 500 seconds. In other words, the workaround is normally > ! turned off for the first delivery attempt. > !
> ! > !> ! Specify 0 to enable the PIX firewall > ! "<CR><LF>.<CR><LF>" bug workaround upon the > ! first delivery attempt. >
> > > !A list that specifies zero or more workarounds for CISCO PIX > ! firewall bugs. These workarounds are implemented by the Postfix > ! SMTP client. Workaround names are separated by comma or space, and > ! are case insensitive. This parameter setting can be overruled with > ! per-destination smtp_pix_workaround_maps settings.
> > --- 9154,9188 ---- > > !Optional lookup tables with the Postfix SMTP client TLS security > ! policy by next-hop destination; when a non-empty value is specified, > ! this overrides the obsolete smtp_tls_per_site parameter. See > ! TLS_README for a more detailed discussion of TLS security levels. >
> > +The TLS policy table is indexed by the full next-hop destination, > + which is either the recipient domain, or the verbatim next-hop > + specified in the transport table, $local_transport, $virtual_transport, > + $relay_transport or $default_transport. This includes any enclosing > + square brackets and any non-default destination server port suffix. The > + LMTP socket type prefix (inet: or unix:) is not included in the lookup > + key.
> > !Only the next-hop domain, or $myhostname with LMTP over UNIX-domain > ! sockets, is used as the nexthop name for certificate verification. The > ! port and any enclosing square brackets are used in the table lookup key, > ! but are not used for server name verification.
> > !When the lookup key is a domain name without enclosing square brackets > ! or any :port suffix (typically the recipient domain), and the full > ! domain is not found in the table, just as with the transport(5) table, > ! the parent domain starting with a leading "." is matched recursively. This > ! allows one to specify a security policy for a recipient domain and all > ! its sub-domains.
> > !The lookup result is a security level, followed by an optional list > ! of whitespace and/or comma separated name=value attributes that override > ! related main.cf settings. The TLS security levels in order of increasing > ! security are:
> > *************** > *** 9940,12458 **** > > !This feature is available in Postfix 2.4 and later. The default > ! settings are backwards compatible with earlier Postfix versions. > !
> > > !> ! The Postfix SMTP client time limit for sending the QUIT command, > ! and for receiving the remote SMTP server response. > !
> >> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> > ! > !> ! Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO commands > ! as required > ! by RFC 2821. This includes putting quotes around an address localpart > ! that ends in ".". > !
> ! > !> ! The default is to comply with RFC 2821. If you have to send mail to > ! a broken SMTP server, configure a special SMTP client in master.cf: > !
> ! > !> !> ! > !> ! /etc/postfix/master.cf: > ! broken-smtp . . . smtp -o smtp_quote_rfc821_envelope=no > !> !
> ! and route mail for the destination in question to the "broken-smtp" > ! message delivery with a transport(5) table. > !
> ! > !> ! This feature is available in Postfix 2.1 and later. > !
> ! > ! > !> ! Randomize the order of equal-preference MX host addresses. This > ! is a performance feature of the Postfix SMTP client. > !
> ! > ! > !> ! The Postfix SMTP client time limit for sending the SMTP RCPT TO > ! command, and for receiving the remote SMTP server response. > !
> ! > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> ! > ! > !A mechanism to transform replies from remote SMTP servers one > ! line at a time. This is a last-resort tool to work around server > ! replies that break inter-operability with the Postfix SMTP client. > ! Other uses involve fault injection to test Postfix's handling of > ! invalid responses.
> ! > !Notes:
> ! > !In the case of a multi-line reply, the Postfix SMTP client > ! uses the final reply line's numerical SMTP reply code and enhanced > ! status code.
> ! > !The numerical SMTP reply code (XYZ) takes precedence over > ! the enhanced status code (X.Y.Z). When the enhanced status code > ! initial digit differs from the SMTP reply code initial digit, or > ! when no enhanced status code is present, the Postfix SMTP client > ! uses a generic enhanced status code (X.0.0) instead.
> ! > !Specify the name of a "type:table" lookup table. The search > ! string is a single SMTP reply line as received from the remote SMTP > ! server, except that the trailing <CR><LF> are removed. > ! When the lookup succeeds, the result replaces the single SMTP reply > ! line.
> ! > !Examples:
> ! > !> ! /etc/postfix/main.cf: > ! smtp_reply_filter = pcre:/etc/postfix/reply_filter > !> ! > !
> ! /etc/postfix/reply_filter: > ! # Transform garbage into "250-filler..." so that it looks like > ! # one line from a multi-line reply. It does not matter what we > ! # substitute here as long it has the right syntax. The Postfix > ! # SMTP client will use the final line's numerical SMTP reply > ! # code and enhanced status code. > ! !/^([2-5][0-9][0-9]($|[- ]))/ 250-filler for garbage > !> ! > !
This feature is available in Postfix 2.7.
> ! > ! > !The Postfix SMTP client time limit for sending the RSET command, > ! and for receiving the remote SMTP server response. The SMTP client > ! sends RSET in > ! order to finish a recipient address probe, or to verify that a > ! cached session is still usable.
> ! > !This feature is available in Postfix 2.1 and later.
> ! > ! > !An optional table to prevent repeated SASL authentication > ! failures with the same remote SMTP server hostname, username and > ! password. Each table (key, value) pair contains a server name, a > ! username and password, and the full server response. This information > ! is stored when a remote SMTP server rejects an authentication attempt > ! with a 535 reply code. As long as the smtp_sasl_password_maps > ! information does no change, and as long as the smtp_sasl_auth_cache_name > ! information does not expire (see smtp_sasl_auth_cache_time) the > ! Postfix SMTP client avoids SASL authentication attempts with the > ! same server, username and password, and instead bounces or defers > ! mail as controlled with the smtp_sasl_auth_soft_bounce configuration > ! parameter.
> ! > !Use a per-destination delivery concurrency of 1 (for example, > ! "smtp_destination_concurrency_limit = 1", > ! "relay_destination_concurrency_limit = 1", etc.), otherwise multiple > ! delivery agents may experience a login failure at the same time. > !
> ! > !The table must be accessed via the proxywrite service, i.e. the > ! map name must start with "proxy:". The table should be stored under > ! the directory specified with the data_directory parameter.
> ! > !This feature uses cryptographic hashing to protect plain-text > ! passwords, and requires that Postfix is compiled with TLS support. > !
> ! > !Example:
> ! > !> ! smtp_sasl_auth_cache_name = proxy:btree:/var/lib/postfix/sasl_auth_cache > !> ! > !
This feature is available in Postfix 2.5 and later.
> ! > ! > !The maximal age of an smtp_sasl_auth_cache_name entry before it > ! is removed.
> ! > !This feature is available in Postfix 2.5 and later.
> ! > ! > !> ! Enable SASL authentication in the Postfix SMTP client. By default, > ! the Postfix SMTP client uses no authentication. > !
> ! > !> ! Example: > !
> ! > !> ! smtp_sasl_auth_enable = yes > !> ! > ! > !
When a remote SMTP server rejects a SASL authentication request > ! with a 535 reply code, defer mail delivery instead of returning > ! mail as undeliverable. The latter behavior was hard-coded prior to > ! Postfix version 2.5.
> ! > !Note: the setting "yes" overrides the global soft_bounce > ! parameter, but the setting "no" does not.
> ! > !Example:
> ! > !> ! # Default as of Postfix 2.5 > ! smtp_sasl_auth_soft_bounce = yes > ! # The old hard-coded default > ! smtp_sasl_auth_soft_bounce = no > !> ! > !
This feature is available in Postfix 2.5 and later.
> ! > ! > !> ! If non-empty, a Postfix SMTP client filter for the remote SMTP > ! server's list of offered SASL mechanisms. Different client and > ! server implementations may support different mechanism lists; by > ! default, the Postfix SMTP client will use the intersection of the > ! two. smtp_sasl_mechanism_filter specifies an optional third mechanism > ! list to intersect with.
> ! > !Specify mechanism names, "/file/name" patterns or "type:table" > ! lookup tables. The right-hand side result from "type:table" lookups > ! is ignored. Specify "!pattern" to exclude a mechanism name from the > ! list. The form "!/file/name" is supported only in Postfix version > ! 2.4 and later.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > !> ! Examples: > !
> ! > !> ! smtp_sasl_mechanism_filter = plain, login > ! smtp_sasl_mechanism_filter = /etc/postfix/smtp_mechs > ! smtp_sasl_mechanism_filter = !gssapi, !login, static:rest > !> ! > ! > !
> ! Optional Postfix SMTP client lookup tables with one username:password > ! entry > ! per remote hostname or domain, or sender address when sender-dependent > ! authentication is enabled. If no username:password entry is found, > ! then the Postfix SMTP client will not > ! attempt to authenticate to the remote host. > !
> ! > !> ! The Postfix SMTP client opens the lookup table before going to > ! chroot jail, so you can leave the password file in /etc/postfix. > !
> ! > ! > !Implementation-specific information that the Postfix SMTP client > ! passes through to > ! the SASL plug-in implementation that is selected with > ! smtp_sasl_type. Typically this specifies the name of a > ! configuration file or rendezvous point.
> ! > !This feature is available in Postfix 2.3 and later.
> ! > ! > !Postfix SMTP client SASL security options; as of Postfix 2.3 > ! the list of available > ! features depends on the SASL client implementation that is selected > ! with smtp_sasl_type.
> ! > !The following security features are defined for the cyrus > ! client SASL implementation:
> ! > !> ! Specify zero or more of the following: > !
> ! > !> ! Example: > !
> ! > !> ! smtp_sasl_security_options = noplaintext > !> ! > ! > !
The SASL authentication security options that the Postfix SMTP > ! client uses for TLS encrypted SMTP sessions.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > ! > !The SASL authentication security options that the Postfix SMTP > ! client uses for TLS encrypted SMTP sessions with a verified server > ! certificate.
> ! > !When mail is sent to the public MX host for the recipient's > ! domain, server certificates are by default optional, and delivery > ! proceeds even if certificate verification fails. For delivery via > ! a submission service that requires SASL authentication, it may be > ! appropriate to send plaintext passwords only when the connection > ! to the server is strongly encrypted and the server identity > ! is verified.
> ! > !The smtp_sasl_tls_verified_security_options parameter makes it > ! possible to only enable plaintext mechanisms when a secure connection > ! to the server is available. Submission servers subject to this > ! policy must either have verifiable certificates or offer suitable > ! non-plaintext SASL mechanisms.
> ! > !This feature is available in Postfix 2.6 and later.
> ! > ! > !The SASL plug-in type that the Postfix SMTP client should use > ! for authentication. The available types are listed with the > ! "postconf -A" command.
> ! > !This feature is available in Postfix 2.3 and later.
> ! > ! > !Whether or not to append the "AUTH=<>" option to the MAIL > ! FROM command in SASL-authenticated SMTP sessions. The default is > ! not to send this, to avoid problems with broken remote SMTP servers. > ! Before Postfix 2.9 the behavior is as if "smtp_send_dummy_mail_auth > ! = yes". > ! > !
This feature is available in Postfix 2.9 and later.
> ! > ! > !> ! Send the non-standard XFORWARD command when the Postfix SMTP server > ! EHLO response announces XFORWARD support. > !
> ! > !> ! This allows a Postfix SMTP delivery agent, used for injecting mail > ! into > ! a content filter, to forward the name, address, protocol and HELO > ! name of the original client to the content filter and downstream > ! queuing SMTP server. This can produce more useful logging than > ! localhost[127.0.0.1] etc. > !
> ! > !> ! This feature is available in Postfix 2.1 and later. > !
> ! > ! > !> ! Enable sender-dependent authentication in the Postfix SMTP client; this is > ! available only with SASL authentication, and disables SMTP connection > ! caching to ensure that mail from different senders will use the > ! appropriate credentials.
> ! > !> ! This feature is available in Postfix 2.3 and later. > !
> ! > ! > !> ! Skip SMTP servers that greet with a 4XX status code (go away, try > ! again later). > !
> ! > !> ! By default, the Postfix SMTP client moves on the next mail exchanger. > ! Specify > ! "smtp_skip_4xx_greeting = no" if Postfix should defer delivery > ! immediately. > !
> ! > !This feature is available in Postfix 2.0 and earlier. > ! Later Postfix versions always skip remote SMTP servers that greet > ! with a > ! 4XX status code.
> ! > ! > !> ! Skip remote SMTP servers that greet with a 5XX status code (go away, > ! do > ! not try again later). > !
> ! > !By default, the Postfix SMTP client moves on the next mail > ! exchanger. Specify "smtp_skip_5xx_greeting = no" if Postfix should > ! bounce the mail immediately. The default setting is incorrect, but > ! it is what a lot of people expect to happen.
> ! > ! > !> ! Do not wait for the response to the SMTP QUIT command. > !
> ! > ! > !Time limit for Postfix SMTP client write and read operations > ! during TLS startup and shutdown handshake procedures.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > ! > !A file containing CA certificates of root CAs trusted to sign > ! either remote SMTP server certificates or intermediate CA certificates. > ! These are loaded into memory before the smtp(8) client enters the > ! chroot jail. If the number of trusted roots is large, consider using > ! smtp_tls_CApath instead, but note that the latter directory must be > ! present in the chroot jail if the smtp(8) client is chrooted. This > ! file may also be used to augment the client certificate trust chain, > ! but it is best to include all the required certificates directly in > ! $smtp_tls_cert_file.
> ! > !Specify "smtp_tls_CAfile = /path/to/system_CA_file" to use > ! ONLY the system-supplied default certificate authority certificates. > !
> ! > !Specify "tls_append_default_CA = no" to prevent Postfix from > ! appending the system-supplied default CAs and trusting third-party > ! certificates.
> ! > !Example:
> ! > !> ! smtp_tls_CAfile = /etc/postfix/CAcert.pem > !> ! > !
This feature is available in Postfix 2.2 and later.
> ! > ! > !Directory with PEM format certificate authority certificates > ! that the Postfix SMTP client uses to verify a remote SMTP server > ! certificate. Don't forget to create the necessary "hash" links > ! with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". > !
> ! > !To use this option in chroot mode, this directory (or a copy) > ! must be inside the chroot jail.
> ! > !Specify "smtp_tls_CApath = /path/to/system_CA_directory" to > ! use ONLY the system-supplied default certificate authority certificates. > !
> ! > !Specify "tls_append_default_CA = no" to prevent Postfix from > ! appending the system-supplied default CAs and trusting third-party > ! certificates.
> ! > !Example:
> ! > !> ! smtp_tls_CApath = /etc/postfix/certs > !> ! > !
This feature is available in Postfix 2.2 and later.
> ! > ! > !Try to detect a mail hijacking attack based on a TLS protocol > ! vulnerability (CVE-2009-3555), where an attacker prepends malicious > ! HELO, MAIL, RCPT, DATA commands to a Postfix SMTP client TLS session. > ! The attack would succeed with non-Postfix SMTP servers that reply > ! to the malicious HELO, MAIL, RCPT, DATA commands after negotiating > ! the Postfix SMTP client TLS session.
> ! > !This feature is available in Postfix 2.7.
> ! > ! > !File with the Postfix SMTP client RSA certificate in PEM format. > ! This file may also contain the Postfix SMTP client private RSA key, > ! and these may be the same as the Postfix SMTP server RSA certificate and key > ! file.
> ! > !Do not configure client certificates unless you must present > ! client TLS certificates to one or more servers. Client certificates are > ! not usually needed, and can cause problems in configurations that work > ! well without them. The recommended setting is to let the defaults stand:
> ! > !> !> ! > !> ! smtp_tls_cert_file = > ! smtp_tls_key_file = > ! smtp_tls_dcert_file = > ! smtp_tls_dkey_file = > ! smtp_tls_eccert_file = > ! smtp_tls_eckey_file = > !> !
The best way to use the default settings is to comment out the above > ! parameters in main.cf if present.
> ! > !To enable remote SMTP servers to verify the Postfix SMTP client > ! certificate, the issuing CA certificates must be made available to the > ! server. You should include the required certificates in the client > ! certificate file, the client certificate first, then the issuing > ! CA(s) (bottom-up order).
> ! > !Example: the certificate for "client.example.com" was issued by > ! "intermediate CA" which itself has a certificate issued by "root CA". > ! Create the client.pem file with "cat client_cert.pem intermediate_CA.pem > ! root_CA.pem > client.pem".
> ! > !If you also want to verify remote SMTP server certificates issued by > ! these CAs, you can add the CA certificates to the smtp_tls_CAfile, in > ! which case it is not necessary to have them in the smtp_tls_cert_file, > ! smtp_tls_dcert_file or smtp_tls_eccert_file.
> ! > !A certificate supplied here must be usable as an SSL client certificate > ! and hence pass the "openssl verify -purpose sslclient ..." test.
> ! > !Example:
> ! > !> ! smtp_tls_cert_file = /etc/postfix/client.pem > !> ! > !
This feature is available in Postfix 2.2 and later.
> ! > ! > !Obsolete Postfix < 2.3 control for the Postfix SMTP client TLS > ! cipher list. As this feature applies to all TLS security levels, it is easy > ! to create inter-operability problems by choosing a non-default cipher > ! list. Do not use a non-default TLS cipher list on hosts that deliver email > ! to the public Internet: you will be unable to send email to servers that > ! only support the ciphers you exclude. Using a restricted cipher list > ! may be more appropriate for an internal MTA, where one can exert some > ! control over the TLS software and settings of the peer servers.
> ! > !Note: do not use "" quotes around the parameter value.
> ! > !This feature is available in Postfix version 2.2. It is not used with > ! Postfix 2.3 and later; use smtp_tls_mandatory_ciphers instead.
> ! > ! > !The minimum TLS cipher grade that the Postfix SMTP client > ! will use with opportunistic TLS encryption. Cipher types listed in > ! smtp_tls_exclude_ciphers are excluded from the base definition of > ! the selected cipher grade. The default value "export" ensures maximum > ! inter-operability. Because encryption is optional, stronger controls > ! are not appropriate, and this setting SHOULD NOT be changed unless the > ! change is essential.
> ! > !When TLS is mandatory the cipher grade is chosen via the > ! smtp_tls_mandatory_ciphers configuration parameter, see there for syntax > ! details. See smtp_tls_policy_maps for information on how to configure > ! ciphers on a per-destination basis.
> ! > !Example:
> !> ! smtp_tls_ciphers = export > !> ! > !
This feature is available in Postfix 2.6 and later. With earlier Postfix > ! releases only the smtp_tls_mandatory_ciphers parameter is implemented, > ! and opportunistic TLS always uses "export" or better (i.e. all) ciphers.
> ! > ! > !File with the Postfix SMTP client DSA certificate in PEM format. > ! This file may also contain the Postfix SMTP client private DSA key.
> ! > !See the discussion under smtp_tls_cert_file for more details. > !
> ! > !Example:
> ! > !> ! smtp_tls_dcert_file = /etc/postfix/client-dsa.pem > !> ! > !
This feature is available in Postfix 2.2 and later.
> ! > ! > !File with the Postfix SMTP client DSA private key in PEM format. > ! This file may be combined with the Postfix SMTP client DSA certificate > ! file specified with $smtp_tls_dcert_file.
> ! > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted. File permissions should grant read-only > ! access to the system superuser account ("root"), and no access > ! to anyone else.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > ! > !File with the Postfix SMTP client ECDSA certificate in PEM format. > ! This file may also contain the Postfix SMTP client ECDSA private key.
> ! > !See the discussion under smtp_tls_cert_file for more details. > !
> ! > !Example:
> ! > !> ! smtp_tls_eccert_file = /etc/postfix/ecdsa-ccert.pem > !> ! > !
This feature is available in Postfix 2.6 and later, when Postfix is > ! compiled and linked with OpenSSL 1.0.0 or later.
> ! > ! > !File with the Postfix SMTP client ECDSA private key in PEM format. > ! This file may be combined with the Postfix SMTP client ECDSA > ! certificate file specified with $smtp_tls_eccert_file.
> ! > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted. File permissions should grant read-only > ! access to the system superuser account ("root"), and no access > ! to anyone else.
> ! > !This feature is available in Postfix 2.6 and later, when Postfix is > ! compiled and linked with OpenSSL 1.0.0 or later.
> ! > ! > !With mandatory TLS encryption, require that the remote SMTP > ! server hostname matches the information in the remote SMTP server > ! certificate. As of RFC 2487 the requirements for hostname checking > ! for MTA clients are not specified.
> ! > !This option can be set to "no" to disable strict peer name > ! checking. This setting has no effect on sessions that are controlled > ! via the smtp_tls_per_site table.
> ! > !Disabling the hostname verification can make sense in closed > ! environment where special CAs are created. If not used carefully, > ! this option opens the danger of a "man-in-the-middle" attack (the > ! CommonName of this attacker will be logged).
> ! > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> ! > ! > !List of ciphers or cipher types to exclude from the Postfix > ! SMTP client cipher > ! list at all TLS security levels. This is not an OpenSSL cipherlist, it is > ! a simple list separated by whitespace and/or commas. The elements are a > ! single cipher, or one or more "+" separated cipher properties, in which > ! case only ciphers matching all the properties are excluded.
> ! > !Examples (some of these will cause problems):
> ! > !> !> ! > !> ! smtp_tls_exclude_ciphers = aNULL > ! smtp_tls_exclude_ciphers = MD5, DES > ! smtp_tls_exclude_ciphers = DES+MD5 > ! smtp_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 > ! smtp_tls_exclude_ciphers = kEDH+aRSA > !> !
The first setting, disables anonymous ciphers. The next setting > ! disables ciphers that use the MD5 digest algorithm or the (single) DES > ! encryption algorithm. The next setting disables ciphers that use MD5 and > ! DES together. The next setting disables the two ciphers "AES256-SHA" > ! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" > ! key exchange with RSA authentication.
> ! > !This feature is available in Postfix 2.3 and later.
> ! > ! > !List of acceptable remote SMTP server certificate fingerprints for > ! the "fingerprint" TLS security level (smtp_tls_security_level = > ! fingerprint). At this security level, certificate authorities are not > ! used, and certificate expiration times are ignored. Instead, server > ! certificates are verified directly via their certificate fingerprint > ! or public key fingerprint (Postfix 2.9 and later). The fingerprint > ! is a message digest of the server certificate (or public key). The > ! digest algorithm is selected via the smtp_tls_fingerprint_digest > ! parameter.
> ! > !When an smtp_tls_policy_maps table entry specifies the > ! "fingerprint" security level, any "match" attributes in that entry specify > ! the list of valid fingerprints for the corresponding destination. Multiple > ! fingerprints can be combined with a "|" delimiter in a single match > ! attribute, or multiple match attributes can be employed.
> ! > !Example: Certificate fingerprint verification with internal mailhub. > ! Two matching fingerprints are listed. The relayhost may be multiple > ! physical hosts behind a load-balancer, each with its own private/public > ! key and self-signed certificate. Alternatively, a single relayhost may > ! be in the process of switching from one set of private/public keys to > ! another, and both keys are trusted just prior to the transition.
> ! > !> !> ! > !> ! relayhost = [mailhub.example.com] > ! smtp_tls_security_level = fingerprint > ! smtp_tls_fingerprint_digest = md5 > ! smtp_tls_fingerprint_cert_match = > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > !> !
Example: Certificate fingerprint verification with selected destinations. > ! As in the example above, we show two matching fingerprints:
> ! > !> !> ! > !> ! /etc/postfix/main.cf: > ! smtp_tls_policy_maps = hash:/etc/postfix/tls_policy > ! smtp_tls_fingerprint_digest = md5 > !> !
> !> ! > !> ! /etc/postfix/tls_policy: > ! example.com fingerprint > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > !> !
This feature is available in Postfix 2.5 and later.
> ! > ! > !The message digest algorithm used to construct remote SMTP server > ! certificate fingerprints. At the "fingerprint" TLS security level > ! (smtp_tls_security_level = fingerprint), the server certificate is > ! verified by directly matching its certificate fingerprint or its public > ! key fingerprint (Postfix 2.9 and later). The fingerprint is the > ! message digest of the server certificate (or its public key) > ! using the selected > ! algorithm. With a digest algorithm resistant to "second pre-image" > ! attacks, it is not feasible to create a new public key and a matching > ! certificate (or public/private key-pair) that has the same fingerprint.
> ! > !The default algorithm is md5; this is consistent with > ! the backwards compatible setting of the digest used to verify client > ! certificates in the SMTP server.
> ! > !The best practice algorithm is now sha1. Recent advances in hash > ! function cryptanalysis have led to md5 being deprecated in favor of sha1. > ! However, as long as there are no known "second pre-image" attacks > ! against md5, its use in this context can still be considered safe. > !
> ! > !While additional digest algorithms are often available with OpenSSL's > ! libcrypto, only those used by libssl in SSL cipher suites are available to > ! Postfix. For now this means just md5 or sha1.
> ! > !To find the fingerprint of a specific certificate file, with a > ! specific digest algorithm, run: > !
> ! > !> !> ! > !> ! $ openssl x509 -noout -fingerprint -digest -in certfile.pem > !> !
The text to the right of "=" sign is the desired fingerprint. > ! For example:
> ! > !> !> ! > !> ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A > !> !
Public key fingerprints are more difficult to extract, however, > ! the SHA-1 public key fingerprint is often present as the value of the > ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix > ! SMTP server and client log the peer certificate fingerprint and public > ! key fingerprint when TLS loglevel is 1 or higher.
> ! > !This feature is available in Postfix 2.5 and later.
> ! > ! > !File with the Postfix SMTP client RSA private key in PEM format. > ! This file may be combined with the Postfix SMTP client RSA certificate > ! file specified with $smtp_tls_cert_file.
> ! > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted. File permissions should grant read-only > ! access to the system superuser account ("root"), and no access > ! to anyone else.
> ! > !Example:
> ! > !> ! smtp_tls_key_file = $smtp_tls_cert_file > !> ! > !
This feature is available in Postfix 2.2 and later.
> ! > ! > !Enable additional Postfix SMTP client logging of TLS activity. > ! Each logging level also includes the information that is logged at > ! a lower logging level.
> ! > !Do not use "smtp_tls_loglevel = 2" or higher except in case of > ! problems. Use of loglevel 4 is strongly discouraged.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > ! > !The minimum TLS cipher grade that the Postfix SMTP client will > ! use with > ! mandatory TLS encryption. The default value "medium" is suitable > ! for most destinations with which you may want to enforce TLS, and > ! is beyond the reach of today's cryptanalytic methods. See > ! smtp_tls_policy_maps for information on how to configure ciphers > ! on a per-destination basis.
> ! > !The following cipher grades are supported:
> ! > !The underlying cipherlists for grades other than "null" include > ! anonymous ciphers, but these are automatically filtered out if the > ! Postfix SMTP client is configured to verify server certificates. > ! You are very unlikely to need to take any steps to exclude anonymous > ! ciphers, they are excluded automatically as necessary. If you must > ! exclude anonymous ciphers at the "may" or "encrypt" security levels, > ! when the Postfix SMTP client does not need or use peer certificates, set > ! "smtp_tls_exclude_ciphers = aNULL". To exclude anonymous ciphers only when > ! TLS is enforced, set "smtp_tls_mandatory_exclude_ciphers = aNULL".
> ! > !This feature is available in Postfix 2.3 and later.
> ! > ! > !Additional list of ciphers or cipher types to exclude from the > ! Postfix SMTP client cipher list at mandatory TLS security levels. This list > ! works in addition to the exclusions listed with smtp_tls_exclude_ciphers > ! (see there for syntax details).
> ! > !Starting with Postfix 2.6, the mandatory cipher exclusions can be > ! specified on a per-destination basis via the TLS policy "exclude" > ! attribute. See smtp_tls_policy_maps for notes and examples.
> ! > !This feature is available in Postfix 2.3 and later.
> ! > ! > !List of SSL/TLS protocols that the Postfix SMTP client will use with > ! mandatory TLS encryption. In main.cf the values are separated by > ! whitespace, commas or colons. In the policy table "protocols" attribute > ! (see smtp_tls_policy_maps) the only valid separator is colon. An > ! empty value means allow all protocols. The valid protocol names, (see > ! SSL_get_version(3)), are "SSLv2", "SSLv3" and "TLSv1".
> ! > !With Postfix ≥ 2.5 the parameter syntax is expanded to support > ! protocol exclusions. One can now explicitly exclude SSLv2 by setting > ! "smtp_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and > ! SSLv3 set "smtp_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing > ! the protocols to include, rather than protocols to exclude, is still > ! supported; use the form you find more intuitive.
> ! > !Since SSL version 2 has known protocol weaknesses and is now > ! deprecated, the default setting excludes "SSLv2". This means that by > ! default, SSL version 2 will not be used at the "encrypt" security level > ! and higher.
> ! > !See the documentation of the smtp_tls_policy_maps parameter and > ! TLS_README for more information about security levels.
> ! > !Example:
> ! > !> ! smtp_tls_mandatory_protocols = TLSv1 > ! # Alternative form with Postfix ≥ 2.5: > ! smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 > !> ! > !
This feature is available in Postfix 2.3 and later.
> ! > ! > !Log the hostname of a remote SMTP server that offers STARTTLS, > ! when TLS is not already enabled for that server.
> ! > !The logfile record looks like:
> ! > !> ! postfix/smtp[pid]: Host offered STARTTLS: [name.of.host] > !> ! > !
This feature is available in Postfix 2.2 and later.
> ! > ! > !Optional lookup tables with the Postfix SMTP client TLS usage > ! policy by next-hop destination and by remote SMTP server hostname. > ! When both lookups succeed, the more specific per-site policy (NONE, > ! MUST, etc) overrides the less specific one (MAY), and the more secure > ! per-site policy (MUST, etc) overrides the less secure one (NONE). > ! With Postfix 2.3 and later smtp_tls_per_site is strongly discouraged: > ! use smtp_tls_policy_maps instead.
> ! > !Use of the bare hostname as the per-site table lookup key is > ! discouraged. Always use the full destination nexthop (enclosed in > ! [] with a possible ":port" suffix). A recipient domain or MX-enabled > ! transport next-hop with no port suffix may look like a bare hostname, > ! but is still a suitable destination.
> ! > !Specify a next-hop destination or server hostname on the left-hand > ! side; no wildcards are allowed. The next-hop destination is either > ! the recipient domain, or the destination specified with a transport(5) > ! table, the relayhost parameter, or the relay_transport parameter. > ! On the right hand side specify one of the following keywords:
> ! > !The above keywords correspond to the "none", "may", "encrypt" and > ! "verify" security levels for the new smtp_tls_security_level parameter > ! introduced in Postfix 2.3. Starting with Postfix 2.3, and independently > ! of how the policy is specified, the smtp_tls_mandatory_ciphers and > ! smtp_tls_mandatory_protocols parameters apply when TLS encryption > ! is mandatory. Connections for which encryption is optional typically > ! enable all "export" grade and better ciphers (see smtp_tls_ciphers > ! and smtp_tls_protocols).
> ! > !As long as no secure DNS lookup mechanism is available, false > ! hostnames in MX or CNAME responses can change the server hostname > ! that Postfix uses for TLS policy lookup and server certificate > ! verification. Even with a perfect match between the server hostname and > ! the server certificate, there is no guarantee that Postfix is connected > ! to the right server. See TLS_README (Closing a DNS loophole with obsolete > ! per-site TLS policies) for a possible work-around.
> ! > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtp_tls_policy_maps instead.
> ! > ! > !Optional lookup tables with the Postfix SMTP client TLS security > ! policy by next-hop destination; when a non-empty value is specified, > ! this overrides the obsolete smtp_tls_per_site parameter. See > ! TLS_README for a more detailed discussion of TLS security levels. > !
> ! > !The TLS policy table is indexed by the full next-hop destination, > ! which is either the recipient domain, or the verbatim next-hop > ! specified in the transport table, $local_transport, $virtual_transport, > ! $relay_transport or $default_transport. This includes any enclosing > ! square brackets and any non-default destination server port suffix. The > ! LMTP socket type prefix (inet: or unix:) is not included in the lookup > ! key.
> ! > !Only the next-hop domain, or $myhostname with LMTP over UNIX-domain > ! sockets, is used as the nexthop name for certificate verification. The > ! port and any enclosing square brackets are used in the table lookup key, > ! but are not used for server name verification.
> ! > !When the lookup key is a domain name without enclosing square brackets > ! or any :port suffix (typically the recipient domain), and the full > ! domain is not found in the table, just as with the transport(5) table, > ! the parent domain starting with a leading "." is matched recursively. This > ! allows one to specify a security policy for a recipient domain and all > ! its sub-domains.
> ! > !The lookup result is a security level, followed by an optional list > ! of whitespace and/or comma separated name=value attributes that override > ! related main.cf settings. The TLS security levels in order of increasing > ! security are:
> ! > !> ! Example: > !
> ! > !> ! /etc/postfix/main.cf: > ! smtp_tls_policy_maps = hash:/etc/postfix/tls_policy > ! # Postfix 2.5 and later > ! smtp_tls_fingerprint_digest = md5 > !> ! > !
> ! /etc/postfix/tls_policy: > ! example.edu none > ! example.mil may > ! example.gov encrypt protocols=TLSv1 > ! example.com verify ciphers=high > ! example.net secure > ! .example.net secure match=.example.net:example.net > ! [mail.example.org]:587 secure match=nexthop > ! # Postfix 2.5 and later > ! [thumb.example.org] fingerprint > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > !> ! > !
Note: The hostname strategy if listed in a non-default > ! setting of smtp_tls_secure_cert_match or in the match attribute > ! in the policy table can render the secure level vulnerable to > ! DNS forgery. Do not use the hostname strategy for secure-channel > ! configurations in environments where DNS security is not assured.
> ! > !This feature is available in Postfix 2.3 and later.
> ! > ! > !List of TLS protocols that the Postfix SMTP client will exclude or > ! include with opportunistic TLS encryption. Starting with Postfix 2.6, > ! the Postfix SMTP client will by default not use the obsolete SSLv2 > ! protocol.
> ! > !In main.cf the values are separated by whitespace, commas or > ! colons. In the policy table (see smtp_tls_policy_maps) the only valid > ! separator is colon. An empty value means allow all protocols. The valid > ! protocol names, (see SSL_get_version(3)), are "SSLv2", "SSLv3" > ! and "TLSv1".
> ! > !To include a protocol list its name, to exclude it, prefix the name > ! with a "!" character. To exclude SSLv2 even for opportunistic TLS set > ! "smtp_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set > ! "smtp_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to > ! include, is supported, but not recommended. OpenSSL provides no mechanisms > ! for excluding protocols not known at compile-time. If Postfix is linked > ! against an OpenSSL library that supports additional protocol versions, > ! they cannot be excluded using either syntax.
> ! > !Example:
> !> ! # TLSv1 only! > ! smtp_tls_protocols = !SSLv2, !SSLv3 > !> ! > !
This feature is available in Postfix 2.6 and later.
> ! > ! > !The verification depth for remote SMTP server certificates. A depth > ! of 1 is sufficient if the issuing CA is listed in a local CA file.
> ! > !The default verification depth is 9 (the OpenSSL default) for > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5, > ! the default value was 5, but the limit was not actually enforced. If > ! you have set this to a lower non-default value, certificates with longer > ! trust chains may now fail to verify. Certificate chains with 1 or 2 > ! CAs are common, deeper chains are more rare and any number between 5 > ! and 9 should suffice in practice. You can choose a lower number if, > ! for example, you trust certificates directly signed by an issuing CA > ! but not any CAs it delegates to.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > ! > !How the Postfix SMTP client verifies the server certificate > ! peername for the > ! "secure" TLS security level. In a "secure" TLS policy table > ! ($smtp_tls_policy_maps) entry the optional "match" attribute > ! overrides this main.cf setting.
> ! > !This parameter specifies one or more patterns or strategies separated > ! by commas, whitespace or colons. In the policy table the only valid > ! separator is the colon character.
> ! > !For a description of the pattern and strategy syntax see the > ! smtp_tls_verify_cert_match parameter. The "hostname" strategy should > ! be avoided in this context, as in the absence of a secure global DNS, using > ! the results of MX lookups in certificate verification is not immune to active > ! (man-in-the-middle) attacks on DNS.
> ! > !> ! Sample main.cf setting: > !
> ! > !> !> ! > !> ! smtp_tls_secure_cert_match = nexthop > !> !
> ! Sample policy table override: > !
> ! > !> !> ! > !> ! example.net secure match=example.com:.example.com > ! .example.net secure match=example.com:.example.com > !> !
This feature is available in Postfix 2.3 and later.
> ! > ! > !The default SMTP TLS security level for the Postfix SMTP client; > ! when a non-empty value is specified, this overrides the obsolete > ! parameters smtp_use_tls, smtp_enforce_tls, and smtp_tls_enforce_peername. > !
> ! > !Specify one of the following security levels:
> ! > !> ! Examples: > !
> ! > !> ! # No TLS. Formerly: smtp_use_tls=no and smtp_enforce_tls=no. > ! smtp_tls_security_level = none > !> ! > !
> ! # Opportunistic TLS. > ! smtp_tls_security_level = may > ! # Postfix ≥ 2.6: > ! # Do not tweak opportunistic ciphers or protocol unless it is essential > ! # to do so (if a security vulnerability is found in the SSL library that > ! # can be mitigated by disabling a particular protocol or raising the > ! # cipher grade from "export" to "low" or "medium"). > ! smtp_tls_ciphers = export > ! smtp_tls_protocols = !SSLv2 > !> ! > !
> ! # Mandatory (high-grade) TLS encryption. > ! smtp_tls_security_level = encrypt > ! smtp_tls_mandatory_ciphers = high > !> ! > !
> ! # Mandatory TLS verification of hostname or nexthop domain. > ! smtp_tls_security_level = verify > ! smtp_tls_mandatory_ciphers = high > ! smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop > !> ! > !
> ! # Secure channel TLS with exact nexthop name match. > ! smtp_tls_security_level = secure > ! smtp_tls_mandatory_protocols = TLSv1 > ! smtp_tls_mandatory_ciphers = high > ! smtp_tls_secure_cert_match = nexthop > !> ! > !
> ! # Certificate fingerprint verification (Postfix ≥ 2.5). > ! # The CA-less "fingerprint" security level only scales to a limited > ! # number of destinations. As a global default rather than a per-site > ! # setting, this is practical when mail for all recipients is sent > ! # to a central mail hub. > ! relayhost = [mailhub.example.com] > ! smtp_tls_security_level = fingerprint > ! smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 > ! smtp_tls_mandatory_ciphers = high > ! smtp_tls_fingerprint_cert_match = > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > !> ! > !
This feature is available in Postfix 2.3 and later.
> ! > ! > !Name of the file containing the optional Postfix SMTP client > ! TLS session cache. Specify a database type that supports enumeration, > ! such as btree or sdbm; there is no need to support > ! concurrent access. The file is created if it does not exist. The smtp(8) > ! daemon does not use this parameter directly, rather the cache is > ! implemented indirectly in the tlsmgr(8) daemon. This means that > ! per-smtp-instance master.cf overrides of this parameter are not effective. > ! Note, that each of the cache databases supported by tlsmgr(8) daemon: > ! $smtpd_tls_session_cache_database, $smtp_tls_session_cache_database > ! (and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to > ! be stored separately. It is not at this time possible to store multiple > ! caches in a single database.
> ! > !Note: dbm databases are not suitable. TLS > ! session objects are too large.
> ! > !As of version 2.5, Postfix no longer uses root privileges when > ! opening this file. The file should now be stored under the Postfix-owned > ! data_directory. As a migration aid, an attempt to open the file > ! under a non-Postfix directory is redirected to the Postfix-owned > ! data_directory, and a warning is logged.
> ! > !Example:
> ! > !> ! smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache > !> ! > !
This feature is available in Postfix 2.2 and later.
> ! > ! > !The expiration time of Postfix SMTP client TLS session cache > ! information. A cache cleanup is performed periodically > ! every $smtp_tls_session_cache_timeout seconds. As with > ! $smtp_tls_session_cache_database, this parameter is implemented in the > ! tlsmgr(8) daemon and therefore per-smtp-instance master.cf overrides > ! are not possible.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > ! > !How the Postfix SMTP client verifies the server certificate > ! peername for the > ! "verify" TLS security level. In a "verify" TLS policy table > ! ($smtp_tls_policy_maps) entry the optional "match" attribute > ! overrides this main.cf setting.
> ! > !This parameter specifies one or more patterns or strategies separated > ! by commas, whitespace or colons. In the policy table the only valid > ! separator is the colon character.
> ! > !Patterns specify domain names, or domain name suffixes:
> ! > !Strategies specify a transformation from the next-hop domain > ! to the expected name in the server certificate:
> ! > !> ! Sample main.cf setting: > !
> ! > !> ! smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop > !> ! > !
> ! Sample policy table override: > !
> ! > !> ! example.com verify match=hostname:nexthop > ! .example.com verify match=example.com:.example.com:hostname > !> ! > !
This feature is available in Postfix 2.3 and later.
> ! > ! > !Opportunistic mode: use TLS when a remote SMTP server announces > ! STARTTLS support, otherwise send the mail in the clear. Beware: > ! some SMTP servers offer STARTTLS even if it is not configured. With > ! Postfix < 2.3, if the TLS handshake fails, and no other server is > ! available, delivery is deferred and mail stays in the queue. If this > ! is a concern for you, use the smtp_tls_per_site feature instead.
> ! > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> ! > ! > !> ! The Postfix SMTP client time limit for sending the XFORWARD command, > ! and for receiving the remote SMTP server response. > !
> ! > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> ! > !> ! This feature is available in Postfix 2.1 and later. > !
> ! > ! > !What remote SMTP clients are allowed to specify the XVERP command. > ! This command requests that mail be delivered one recipient at a > ! time with a per recipient return address.
> ! > !By default, no clients are allowed to specify XVERP.
> ! > !This parameter was renamed with Postfix version 2.1. The default value > ! is backwards compatible with Postfix version 2.0.
> ! > !Specify a list of network/netmask patterns, separated by commas > ! and/or whitespace. The mask specifies the number of bits in the > ! network part of a host address. You can also specify hostnames or > ! .domain names (the initial dot causes the domain to match any name > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > ! pattern is replaced by its contents; a "type:table" lookup table > ! is matched when a table entry matches a lookup string (the lookup > ! result is ignored). Continue long lines by starting the next line > ! with whitespace. Specify "!pattern" to exclude an address or network > ! block from the list. The form "!/file/name" is supported only in > ! Postfix version 2.4 and later.
> ! > !Note: IP version 6 address information must be specified inside > ! [] in the smtpd_authorized_verp_clients value, and in > ! files specified with "/file/name". IP version 6 addresses contain > ! the ":" character, and would otherwise be confused with a "type:table" > ! pattern.
> ! > ! > !> ! What remote SMTP clients are allowed to use the XCLIENT feature. This > ! command overrides remote SMTP client information that is used for access > ! control. Typical use is for SMTP-based content filters, fetchmail-like > ! programs, or SMTP server access rule testing. See the XCLIENT_README > ! document for details. > !
> ! > !> ! This feature is available in Postfix 2.1 and later. > !
> ! > !> ! By default, no clients are allowed to specify XCLIENT. > !
> ! > !> ! Specify a list of network/netmask patterns, separated by commas > ! and/or whitespace. The mask specifies the number of bits in the > ! network part of a host address. You can also specify hostnames or > ! .domain names (the initial dot causes the domain to match any name > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > ! pattern is replaced by its contents; a "type:table" lookup table > ! is matched when a table entry matches a lookup string (the lookup > ! result is ignored). Continue long lines by starting the next line > ! with whitespace. Specify "!pattern" to exclude an address or network > ! block from the list. The form "!/file/name" is supported only in > ! Postfix version 2.4 and later.
> ! > !Note: IP version 6 address information must be specified inside > ! [] in the smtpd_authorized_xclient_hosts value, and in > ! files specified with "/file/name". IP version 6 addresses contain > ! the ":" character, and would otherwise be confused with a "type:table" > ! pattern.
> ! > ! > !> ! What remote SMTP clients are allowed to use the XFORWARD feature. This > ! command forwards information that is used to improve logging after > ! SMTP-based content filters. See the XFORWARD_README document for > ! details. > !
> ! > !> ! This feature is available in Postfix 2.1 and later. > !
> ! > !> ! By default, no clients are allowed to specify XFORWARD. > !
> ! > !> ! Specify a list of network/netmask patterns, separated by commas > ! and/or whitespace. The mask specifies the number of bits in the > ! network part of a host address. You can also specify hostnames or > ! .domain names (the initial dot causes the domain to match any name > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > ! pattern is replaced by its contents; a "type:table" lookup table > ! is matched when a table entry matches a lookup string (the lookup > ! result is ignored). Continue long lines by starting the next line > ! with whitespace. Specify "!pattern" to exclude an address or network > ! block from the list. The form "!/file/name" is supported only in > ! Postfix version 2.4 and later.
> ! > !Note: IP version 6 address information must be specified inside > ! [] in the smtpd_authorized_xforward_hosts value, and in > ! files specified with "/file/name". IP version 6 addresses contain > ! the ":" character, and would otherwise be confused with a "type:table" > ! pattern.
> ! > ! > !> ! The text that follows the 220 status code in the SMTP greeting > ! banner. Some people like to see the mail version advertised. By > ! default, Postfix shows no version. > !
> ! > !> ! You MUST specify $myhostname at the start of the text. This is > ! required by the SMTP protocol. > !
> ! > !> ! Example: > !
> ! > !> ! smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) > !> ! > ! > !
> ! How many simultaneous connections any client is allowed to > ! make to this service. By default, the limit is set to half > ! the default process limit value. > !
> ! > !> ! To disable this feature, specify a limit of 0. > !
> ! > !> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. > !
> ! > !> ! This feature is available in Postfix 2.2 and later. > !
> ! > ! > !> ! The maximal number of connection attempts any client is allowed to > ! make to this service per time unit. The time unit is specified > ! with the anvil_rate_time_unit configuration parameter. > !
> ! > !> ! By default, a client can make as many connections per time unit as > ! Postfix can accept. > !
> ! > !> ! To disable this feature, specify a limit of 0. > !
> ! > !> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. > !
> ! > !> ! This feature is available in Postfix 2.2 and later. > !
> ! > !> ! Example: > !
> ! > !> ! smtpd_client_connection_rate_limit = 1000 > !> ! > ! > !
> ! Clients that are excluded from smtpd_client_*_count/rate_limit > ! restrictions. See the mynetworks parameter > ! description for the parameter value syntax. > !
> ! > !> ! By default, clients in trusted networks are excluded. Specify a > ! list of network blocks, hostnames or .domain names (the initial > ! dot causes the domain to match any name below it). > !
> ! > !Note: IP version 6 address information must be specified inside > ! [] in the smtpd_client_event_limit_exceptions value, and > ! in files specified with "/file/name". IP version 6 addresses > ! contain the ":" character, and would otherwise be confused with a > ! "type:table" pattern.
> ! > !> ! This feature is available in Postfix 2.2 and later. > !
> ! > ! > !> ! The maximal number of message delivery requests that any client is > ! allowed to make to this service per time unit, regardless of whether > ! or not Postfix actually accepts those messages. The time unit is > ! specified with the anvil_rate_time_unit configuration parameter. > !
> ! > !> ! By default, a client can send as many message delivery requests > ! per time unit as Postfix can accept. > !
> ! > !> ! To disable this feature, specify a limit of 0. > !
> ! > !> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. > !
> ! > !> ! This feature is available in Postfix 2.2 and later. > !
> ! > !> ! Example: > !
> ! > !> ! smtpd_client_message_rate_limit = 1000 > !> ! > ! > !
> ! The maximal number of new (i.e., uncached) TLS sessions that a > ! remote SMTP client is allowed to negotiate with this service per > ! time unit. The time unit is specified with the anvil_rate_time_unit > ! configuration parameter. > !
> ! > !> ! By default, a remote SMTP client can negotiate as many new TLS > ! sessions per time unit as Postfix can accept. > !
> ! > !> ! To disable this feature, specify a limit of 0. Otherwise, specify > ! a limit that is at least the per-client concurrent session limit, > ! or else legitimate client sessions may be rejected. > !
> ! > !> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. > !
> ! > !> ! This feature is available in Postfix 2.3 and later. > !
> ! > !> ! Example: > !
> ! > !> ! smtpd_client_new_tls_session_rate_limit = 100 > !> ! > ! > !
Enable logging of the remote SMTP client port in addition to > ! the hostname and IP address. The logging format is "host[address]:port". > !
> ! > !This feature is available in Postfix 2.5 and later.
> ! > ! > !> ! The maximal number of recipient addresses that any client is allowed > ! to send to this service per time unit, regardless of whether or not > ! Postfix actually accepts those recipients. The time unit is specified > ! with the anvil_rate_time_unit configuration parameter. > !
> ! > !> ! By default, a client can send as many recipient addresses per time > ! unit as Postfix can accept. > !
> ! > !> ! To disable this feature, specify a limit of 0. > !
> ! > !> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. > !
> ! > !> ! This feature is available in Postfix 2.2 and later. > !
> ! > !> ! Example: > !
> >> ! smtpd_client_recipient_rate_limit = 1000 > !> ! > ! > !
> ! Optional Postfix SMTP server access restrictions in the context of > ! a remote SMTP client connection request. > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > ! restriction lists" for a discussion of evaluation context and time. > !
> ! > !> ! The default is to allow all connection requests. > !
> ! > !> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. > !
> ! > !> ! The following restrictions are specific to client hostname or > ! client network address information. > !
> ! > !> ! In addition, you can use any of the following > ! generic restrictions. These restrictions are applicable in > ! any SMTP command context. > !
> ! > !> ! /etc/postfix/main.cf: > ! smtpd_client_restrictions = > ! sleep 1, reject_unauth_pipelining > ! smtpd_delay_reject = no > !> ! This feature is available in Postfix 2.3.
> ! Other restrictions that are valid in this context: > !
> > !> ! Example: >
> >> ! smtpd_client_restrictions = permit_mynetworks, reject_unknown_client_hostname >> > --- 9190,9352 ---- > > !
> ! Example: >
> > !> ! /etc/postfix/main.cf: > ! smtp_tls_policy_maps = hash:/etc/postfix/tls_policy > ! # Postfix 2.5 and later > ! smtp_tls_fingerprint_digest = md5 > !> >
> ! /etc/postfix/tls_policy: > ! example.edu none > ! example.mil may > ! example.gov encrypt protocols=TLSv1 > ! example.com verify ciphers=high > ! example.net secure > ! .example.net secure match=.example.net:example.net > ! [mail.example.org]:587 secure match=nexthop > ! # Postfix 2.5 and later > ! [thumb.example.org] fingerprint > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > !> > !
Note: The hostname strategy if listed in a non-default > ! setting of smtp_tls_secure_cert_match or in the match attribute > ! in the policy table can render the secure level vulnerable to > ! DNS forgery. Do not use the hostname strategy for secure-channel > ! configurations in environments where DNS security is not assured.
> > !This feature is available in Postfix 2.3 and later.
> > > !The verification depth for remote SMTP server certificates. A depth > ! of 1 is sufficient if the issuing CA is listed in a local CA file.
> > !The default verification depth is 9 (the OpenSSL default) for > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5, > ! the default value was 5, but the limit was not actually enforced. If > ! you have set this to a lower non-default value, certificates with longer > ! trust chains may now fail to verify. Certificate chains with 1 or 2 > ! CAs are common, deeper chains are more rare and any number between 5 > ! and 9 should suffice in practice. You can choose a lower number if, > ! for example, you trust certificates directly signed by an issuing CA > ! but not any CAs it delegates to.
> > !This feature is available in Postfix 2.2 and later.
> > > !The server certificate peername verification method for the > ! "secure" TLS security level. In a "secure" TLS policy table > ! ($smtp_tls_policy_maps) entry the optional "match" attribute > ! overrides this main.cf setting.
> > !This parameter specifies one or more patterns or strategies separated > ! by commas, whitespace or colons. In the policy table the only valid > ! separator is the colon character.
> > !For a description of the pattern and strategy syntax see the > ! smtp_tls_verify_cert_match parameter. The "hostname" strategy should > ! be avoided in this context, as in the absence of a secure global DNS, using > ! the results of MX lookups in certificate verification is not immune to active > ! (man-in-the-middle) attacks on DNS.
> > !> ! Sample main.cf setting: > !
> ! > !> !> >> ! smtp_tls_secure_cert_match = nexthop > !> !
> ! Sample policy table override: >
> > +>> + > +> ! example.net secure match=example.com:.example.com > ! .example.net secure match=example.com:.example.com >> +
This feature is available in Postfix 2.3 and later.
> > *************** > *** 12461,12502 **** > > !A mechanism to transform commands from remote SMTP clients. > ! This is a last-resort tool to work around client commands that break > ! inter-operability with the Postfix SMTP server. Other uses involve > ! fault injection to test Postfix's handling of invalid commands. >
> > !Specify the name of a "type:table" lookup table. The search > ! string is the SMTP command as received from the remote SMTP client, > ! except that initial whitespace and the trailing <CR><LF> > ! are removed. The result value is executed by the Postfix SMTP > ! server.
> > !There is no need to use smtpd_command_filter for the following > ! cases:
> > !Use "resolve_numeric_domain = yes" to accept > ! "user at ipaddress".
> > !Postfix already accepts the correct form > ! "user@[ipaddress]". Use virtual_alias_maps or canonical_maps > ! to translate these into domain names if necessary.
> ! > !Use "strict_rfc821_envelopes = no" to accept "RCPT TO:<User > ! Name <user at example.com>>". Postfix will ignore the "User > ! Name" part and deliver to the <user at example.com> address. > !
> > !Examples of problems that can be solved with the smtpd_command_filter > ! feature:
> >> ! /etc/postfix/main.cf: > ! smtpd_command_filter = pcre:/etc/postfix/command_filter >> --- 9355,9428 ---- > > !
The default SMTP TLS security level for the Postfix SMTP client; > ! when a non-empty value is specified, this overrides the obsolete > ! parameters smtp_use_tls, smtp_enforce_tls, and smtp_tls_enforce_peername. >
> > !Specify one of the following security levels:
> ! > !> ! Examples: > !
> >> ! # No TLS. Formerly: smtp_use_tls=no and smtp_enforce_tls=no. > ! smtp_tls_security_level = none >> *************** > *** 12504,12508 **** >
> ! /etc/postfix/command_filter: > ! # Work around clients that send malformed HELO commands. > ! /^HELO\s*$/ HELO domain.invalid >> --- 9430,9433 ---- >
> ! # Opportunistic TLS. > ! smtp_tls_security_level = may >> *************** > *** 12510,12513 **** >
> ! # Work around clients that send empty lines. > ! /^\s*$/ NOOP >> --- 9435,9439 ---- >
> ! # Mandatory (high-grade) TLS encryption. > ! smtp_tls_security_level = encrypt > ! smtp_tls_mandatory_ciphers = high >> *************** > *** 12515,12519 **** >
> ! # Work around clients that send RCPT TO:<'user at domain'>. > ! # WARNING: do not lose the parameters that follow the address. > ! /^RCPT\s+TO:\s*<'([^[:space:]]+)'>(.*)/ RCPT TO:<$1>$2 >> --- 9441,9446 ---- >
> ! # Mandatory TLS verification of hostname or nexthop domain. > ! smtp_tls_security_level = verify > ! smtp_tls_mandatory_ciphers = high > ! smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop >> *************** > *** 12521,12525 **** >
> ! # Append XVERP to MAIL FROM commands to request VERP-style delivery. > ! # See VERP_README for more information on how to use Postfix VERP. > ! /^(MAIL FROM:<listname at example\.com>.*)/ $1 XVERP >> --- 9448,9454 ---- >
> ! # Secure channel TLS with exact nexthop name match. > ! smtp_tls_security_level = secure > ! smtp_tls_mandatory_protocols = TLSv1 > ! smtp_tls_mandatory_ciphers = high > ! smtp_tls_secure_cert_match = nexthop >> *************** > *** 12527,12535 **** >
> ! # Bounce-never mail sink. Use notify_classes=bounce,resource,software > ! # to send bounced mail to the postmaster (with message body removed). > ! /^(RCPT\s+TO:.*?)\bNOTIFY=\S+\b(.*)/ $1 NOTIFY=NEVER $2 > ! /^(RCPT\s+TO:.*)/ $1 NOTIFY=NEVER >> > !
This feature is available in Postfix 2.7.
> > --- 9456,9472 ---- >> ! # Certificate fingerprint verification (Postfix ≥ 2.5). > ! # The CA-less "fingerprint" security level only scales to a limited > ! # number of destinations. As a global default rather than a per-site > ! # setting, this is practical when mail for all recipients is sent > ! # to a central mail hub. > ! relayhost = [mailhub.example.com] > ! smtp_tls_security_level = fingerprint > ! smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 > ! smtp_tls_mandatory_ciphers = high > ! smtp_tls_fingerprint_cert_match = > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 >> > !
This feature is available in Postfix 2.3 and later.
> > *************** > *** 12538,12609 **** > > !> ! Optional access restrictions that the Postfix SMTP server applies > ! in the context of the SMTP DATA command. > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > ! restriction lists" for a discussion of evaluation context and time. > !
> ! > !> ! This feature is available in Postfix 2.0 and later. > !
> ! > !> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. > !
> ! > !> ! The following restrictions are valid in this context: > !
> ! > !> ! Examples: > !
> >> ! smtpd_data_restrictions = reject_unauth_pipelining > ! smtpd_data_restrictions = reject_multi_recipient_bounce >> > ! > !
Postpone the start of an SMTP mail transaction until a valid > ! RCPT TO command is received. Specify "no" to create a mail transaction > ! as soon as the Postfix SMTP server receives a valid MAIL FROM > ! command.
> ! > !With sites that reject lots of mail, the default setting reduces > ! the use of > ! disk, CPU and memory resources. The downside is that rejected > ! recipients are logged with NOQUEUE instead of a mail transaction > ! ID. This complicates the logfile analysis of multi-recipient mail. > !
> ! > !This feature is available in Postfix 2.3 and later.
> > --- 9475,9508 ---- > > !Name of the file containing the optional Postfix SMTP client > ! TLS session cache. Specify a database type that supports enumeration, > ! such as btree or sdbm; there is no need to support > ! concurrent access. The file is created if it does not exist. The smtp(8) > ! daemon does not use this parameter directly, rather the cache is > ! implemented indirectly in the tlsmgr(8) daemon. This means that > ! per-smtp-instance master.cf overrides of this parameter are not effective. > ! Note, that each of the cache databases supported by tlsmgr(8) daemon: > ! $smtpd_tls_session_cache_database, $smtp_tls_session_cache_database > ! (and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to > ! be stored separately. It is not at this time possible to store multiple > ! caches in a single database.
> > !Note: dbm databases are not suitable. TLS > ! session objects are too large.
> > !As of version 2.5, Postfix no longer uses root privileges when > ! opening this file. The file should now be stored under the Postfix-owned > ! data_directory. As a migration aid, an attempt to open the file > ! under a non-Postfix directory is redirected to the Postfix-owned > ! data_directory, and a warning is logged.
> > !Example:
> >> ! smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache >> > !
This feature is available in Postfix 2.2 and later.
> > *************** > *** 12612,12635 **** > > !> ! Wait until the RCPT TO command before evaluating > ! $smtpd_client_restrictions, $smtpd_helo_restrictions and > ! $smtpd_sender_restrictions, or wait until the ETRN command before > ! evaluating $smtpd_client_restrictions and $smtpd_helo_restrictions. > !
> > !> ! This feature is turned on by default because some clients apparently > ! mis-behave when the Postfix SMTP server rejects commands before > ! RCPT TO. > !
> > !> ! The default setting has one major benefit: it allows Postfix to log > ! recipient address information when rejecting a client name/address > ! or sender address, so that it is possible to find out whose mail > ! is being rejected. > !
> > --- 9511,9523 ---- > > !The expiration time of Postfix SMTP client TLS session cache > ! information. A cache cleanup is performed periodically > ! every $smtp_tls_session_cache_timeout seconds. As with > ! $smtp_tls_session_cache_database, this parameter is implemented in the > ! tlsmgr(8) daemon and therefore per-smtp-instance master.cf overrides > ! are not possible.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 12638,12691 **** > > !Lookup tables, indexed by the remote SMTP client address, with > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > ! etc.) that the Postfix SMTP server will not send in the EHLO response > ! to a > ! remote SMTP client. See smtpd_discard_ehlo_keywords for details. > ! The table is not searched by hostname for robustness reasons.
> > !This feature is available in Postfix 2.2 and later.
> > > !A case insensitive list of EHLO keywords (pipelining, starttls, > ! auth, etc.) that the Postfix SMTP server will not send in the EHLO > ! response > ! to a remote SMTP client.
> > !This feature is available in Postfix 2.2 and later.
> > !Notes:
> > !Specify the silent-discard pseudo keyword to prevent > ! this action from being logged.
> > !Use the smtpd_discard_ehlo_keyword_address_maps feature > ! to discard EHLO keywords selectively.
> > !Optional access restrictions that the Postfix SMTP server > ! applies in the context of the SMTP END-OF-DATA command. > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > ! restriction lists" for a discussion of evaluation context and time. >
> > !This feature is available in Postfix 2.2 and later.
> > !See smtpd_data_restrictions for details and limitations.
> > --- 9526,9603 ---- > > !The server certificate peername verification method for the > ! "verify" TLS security level. In a "verify" TLS policy table > ! ($smtp_tls_policy_maps) entry the optional "match" attribute > ! overrides this main.cf setting.
> > !This parameter specifies one or more patterns or strategies separated > ! by commas, whitespace or colons. In the policy table the only valid > ! separator is the colon character.
> > +Patterns specify domain names, or domain name suffixes:
> > !Strategies specify a transformation from the next-hop domain > ! to the expected name in the server certificate:
> > !> ! Sample main.cf setting: > !
> > !> ! smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop > !> > !
> ! Sample policy table override: >
> > !> ! example.com verify match=hostname:nexthop > ! .example.com verify match=example.com:.example.com:hostname > !> > !
This feature is available in Postfix 2.3 and later.
> > *************** > *** 12694,12727 **** > > !Mandatory TLS: announce STARTTLS support to remote SMTP clients, > ! and require that clients use TLS encryption. According to RFC 2487 > ! this MUST NOT be applied in case of a publicly-referenced SMTP > ! server. This option is therefore off by default.
> ! > !Note 1: "smtpd_enforce_tls = yes" implies "smtpd_tls_auth_only = yes".
> ! > !Note 2: when invoked via "sendmail -bs", Postfix will never offer > ! STARTTLS due to insufficient privileges to access the server private > ! key. This is intended behavior.
> >This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtpd_tls_security_level instead.
> ! > ! > !With Postfix version 2.1 and later: the SMTP server response delay after > ! a client has made more than $smtpd_soft_error_limit errors, and > ! fewer than $smtpd_hard_error_limit errors, without delivering mail. > !
> ! > !With Postfix version 2.0 and earlier: the SMTP server delay before > ! sending a reject (4xx or 5xx) response, when the client has made > ! fewer than $smtpd_soft_error_limit errors without delivering > ! mail.
> > --- 9606,9619 ---- > > !Opportunistic mode: use TLS when a remote SMTP server announces > ! STARTTLS support, otherwise send the mail in the clear. Beware: > ! some SMTP servers offer STARTTLS even if it is not configured. With > ! Postfix < 2.3, if the TLS handshake fails, and no other server is > ! available, delivery is deferred and mail stays in the queue. If this > ! is a concern for you, use the smtp_tls_per_site feature instead.
> >This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> > *************** > *** 12730,12745 **** > > !> ! Optional SMTP server access restrictions in the context of a client > ! ETRN request. > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > ! restriction lists" for a discussion of evaluation context and time. > !
> >> ! The Postfix ETRN implementation accepts only destinations that are > ! eligible for the Postfix "fast flush" service. See the ETRN_README > ! file for details. >
> --- 9622,9629 ---- > > !> ! The SMTP client time limit for sending the XFORWARD command, and > ! for receiving the server response. >
> *************** > *** 12747,12752 **** >> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. >
> --- 9631,9634 ---- >> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> *************** > *** 12754,12790 **** >> ! The following restrictions are specific to the domain name information > ! received with the ETRN command. >
> > -> ! Other restrictions that are valid in this context: > !
> > !> ! Example: > !
> > !> ! smtpd_etrn_restrictions = permit_mynetworks, reject > !> > --- 9636,9672 ---- >
> ! This feature is available in Postfix 2.1 and later. >
> > > !What SMTP clients are allowed to specify the XVERP command. > ! This command requests that mail be delivered one recipient at a > ! time with a per recipient return address.
> > !By default, no clients are allowed to specify XVERP.
> > !This parameter was renamed with Postfix version 2.1. The default value > ! is backwards compatible with Postfix version 2.0.
> > !Specify a list of network/netmask patterns, separated by commas > ! and/or whitespace. The mask specifies the number of bits in the > ! network part of a host address. You can also specify hostnames or > ! .domain names (the initial dot causes the domain to match any name > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > ! pattern is replaced by its contents; a "type:table" lookup table > ! is matched when a table entry matches a lookup string (the lookup > ! result is ignored). Continue long lines by starting the next line > ! with whitespace. Specify "!pattern" to exclude an address or network > ! block from the list. The form "!/file/name" is supported only in > ! Postfix version 2.4 and later.
> > !Note: IP version 6 address information must be specified inside > ! [] in the smtpd_authorized_verp_clients value, and in > ! files specified with "/file/name". IP version 6 addresses contain > ! the ":" character, and would otherwise be confused with a "type:table" > ! pattern.
> > *************** > *** 12793,12801 **** > > !> ! What characters are allowed in $name expansions of RBL reply > ! templates. Characters not in the allowed set are replaced by "_". > ! Use C like escapes to specify special characters such as whitespace. >
> --- 9675,9685 ---- > > !> ! What SMTP clients are allowed to use the XCLIENT feature. This > ! command overrides SMTP client information that is used for access > ! control. Typical use is for SMTP-based content filters, fetchmail-like > ! programs, or SMTP server access rule testing. See the XCLIENT_README > ! document for details. >
> *************** > *** 12803,12805 **** >> ! This parameter is not subjected to $parameter expansion. >
> --- 9687,9689 ---- >> ! This feature is available in Postfix 2.1 and later. >
> *************** > *** 12807,12811 **** >> ! This feature is available in Postfix 2.0 and later. >
> > > --- 9691,9714 ---- >> ! By default, no clients are allowed to specify XCLIENT. >
> > +> + Specify a list of network/netmask patterns, separated by commas > + and/or whitespace. The mask specifies the number of bits in the > + network part of a host address. You can also specify hostnames or > + .domain names (the initial dot causes the domain to match any name > + below it), "/file/name" or "type:table" patterns. A "/file/name" > + pattern is replaced by its contents; a "type:table" lookup table > + is matched when a table entry matches a lookup string (the lookup > + result is ignored). Continue long lines by starting the next line > + with whitespace. Specify "!pattern" to exclude an address or network > + block from the list. The form "!/file/name" is supported only in > + Postfix version 2.4 and later.
> + > +Note: IP version 6 address information must be specified inside > + [] in the smtpd_authorized_xclient_hosts value, and in > + files specified with "/file/name". IP version 6 addresses contain > + the ":" character, and would otherwise be confused with a "type:table" > + pattern.
> + > > *************** > *** 12813,12823 **** > > !> ! List of commands that cause the Postfix SMTP server to immediately > ! terminate the session with a 221 code. This can be used to disconnect > ! clients that obviously attempt to abuse the system. In addition to the > ! commands listed in this parameter, commands that follow the "Label:" > ! format of message headers will also cause a disconnect. >
> --- 9716,9725 ---- > > !> ! What SMTP clients are allowed to use the XFORWARD feature. This > ! command forwards information that is used to improve logging after > ! SMTP-based content filters. See the XFORWARD_README document for > ! details. >
> *************** > *** 12825,12843 **** >> ! This feature is available in Postfix 2.2 and later. >
> > ! > !> ! The maximal number of errors a remote SMTP client is allowed to > ! make without delivering mail. The Postfix SMTP server disconnects > ! when the limit is exceeded. Normally the default limit is 20, but > ! it changes under overload to just 1. With Postfix 2.5 and earlier, > ! the SMTP server always allows up to 20 errors by default. > > !
> > --- 9727,9753 ---- >> ! This feature is available in Postfix 2.1 and later. >
> > !> ! By default, no clients are allowed to specify XFORWARD. > !
> >> ! Specify a list of network/netmask patterns, separated by commas > ! and/or whitespace. The mask specifies the number of bits in the > ! network part of a host address. You can also specify hostnames or > ! .domain names (the initial dot causes the domain to match any name > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > ! pattern is replaced by its contents; a "type:table" lookup table > ! is matched when a table entry matches a lookup string (the lookup > ! result is ignored). Continue long lines by starting the next line > ! with whitespace. Specify "!pattern" to exclude an address or network > ! block from the list. The form "!/file/name" is supported only in > ! Postfix version 2.4 and later.
> > !Note: IP version 6 address information must be specified inside > ! [] in the smtpd_authorized_xforward_hosts value, and in > ! files specified with "/file/name". IP version 6 addresses contain > ! the ":" character, and would otherwise be confused with a "type:table" > ! pattern.
> > *************** > *** 12846,12854 **** > > !> ! Require that a remote SMTP client introduces itself with the HELO > ! or EHLO command before sending the MAIL command or other commands > ! that require EHLO negotiation. >
> --- 9756,9769 ---- > > !> ! The text that follows the 220 status code in the SMTP greeting > ! banner. Some people like to see the mail version advertised. By > ! default, Postfix shows no version. > !
> >> ! You MUST specify $myhostname at the start of the text. This is > ! required by the SMTP protocol. >
> *************** > *** 12860,12862 **** >> ! smtpd_helo_required = yes >> --- 9775,9777 ---- >
> ! smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) >> *************** > *** 12866,12875 **** > > !
> ! Optional restrictions that the Postfix SMTP server applies in the > ! context of the SMTP HELO command. > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > ! restriction lists" for a discussion of evaluation context and time. >
> --- 9781,9789 ---- > > !> ! How many simultaneous connections any client is allowed to > ! make to this service. By default, the limit is set to half > ! the default process limit value. >
> *************** > *** 12877,12884 **** >> ! The default is to permit everything. > !
> ! > !Note: specify "smtpd_helo_required = yes" to fully enforce this > ! restriction (without "smtpd_helo_required = yes", a client can > ! simply skip smtpd_helo_restrictions by not sending HELO or EHLO). >
> --- 9791,9793 ---- >> ! To disable this feature, specify a limit of 0. >
> *************** > *** 12886,12891 **** >> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. >
> --- 9795,9798 ---- >> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. >
> *************** > *** 12893,13086 **** >> ! The following restrictions are specific to the hostname information > ! received with the HELO or EHLO command. >
> > -> ! Other restrictions that are valid in this context: >
> > -> ! Examples: >
> > -> - smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname > - smtpd_helo_restrictions = permit_mynetworks, reject_unknown_helo_hostname > -> - > - > -
> ! The maximal number of lines in the Postfix SMTP server command history > ! before it is flushed upon receipt of EHLO, RSET, or end of DATA. >
> > - > -> ! The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote > ! SMTP client can send before the Postfix SMTP server starts to > ! increment the error counter with each junk command. The junk > ! command count is reset after mail is delivered. See also the > ! smtpd_error_sleep_time and smtpd_soft_error_limit configuration > ! parameters. Normally the default limit is 100, but it changes under > ! overload to just 1. With Postfix 2.5 and earlier, the SMTP server > ! always allows up to 100 junk commands by default.
> ! > ! > !Enable logging of the named "permit" actions in SMTP server > ! access lists. This does not affect conditional actions such as > ! "defer_if_permit".
> ! > !Specify a list of "permit" action names, "/file/name" or > ! "type:table" patterns, separated by commas and/or whitespace. The > ! list is matched left to right, and the search stops on the first > ! match. A "/file/name" pattern is replaced by its contents; a > ! "type:table" lookup table is matched when a name matches a lookup > ! key (the lookup result is ignored). Continue long lines by starting > ! the next line with whitespace. Specify "!pattern" to exclude a name > ! from the list.
> > !Examples:
> > !> ! /etc/postfix/main.cf: > ! # Log all "permit" actions. > ! smtpd_log_access_permit_actions = static:all > !> >
> ! /etc/postfix/main.cf: > ! # Log "permit_dnswl_client" only. > ! smtpd_log_access_permit_actions = permit_dnswl_client >> > -
This feature is available in Postfix 2.10 and later.
> - > - > -A list of Milter (mail filter) applications for new mail that > - arrives via the Postfix smtpd(8) server. Specify space or comma as > - separator. See the MILTER_README document for details.
> - > -This feature is available in Postfix 2.3 and later.
> - > > --- 9800,9842 ---- >> ! This feature is available in Postfix 2.2 and later. >
> > > !> ! The maximal number of connection attempts any client is allowed to > ! make to this service per time unit. The time unit is specified > ! with the anvil_rate_time_unit configuration parameter. >
> >> ! By default, a client can make as many connections per time unit as > ! Postfix can accept. >
> >> ! To disable this feature, specify a limit of 0. >
> >> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. > !
> > !> ! This feature is available in Postfix 2.2 and later. > !
> > !> ! Example: > !
> >> ! smtpd_client_connection_rate_limit = 1000 >> > > *************** > *** 13088,13145 **** > > !
> ! List of commands that the Postfix SMTP server replies to with "250 > ! Ok", without doing any syntax checks and without changing state. > ! This list overrides any commands built into the Postfix SMTP server. >
> > - > -> ! The lookup key to be used in SMTP access(5) tables instead of the > ! null sender address. >
> > > !Attempt to look up the remote SMTP client hostname, and verify that > ! the name matches the client IP address. A client name is set to > ! "unknown" when it cannot be looked up or verified, or when name > ! lookup is disabled. Turning off name lookup reduces delays due to > ! DNS lookup and increases the maximal inbound delivery rate.
> ! > !This feature is available in Postfix 2.3 and later.
> ! > ! > !Change the behavior of the smtpd_timeout time limit, from a > ! time limit per read or write system call, to a time limit to send > ! or receive a complete record (an SMTP command line, SMTP response > ! line, SMTP message content line, or TLS protocol message). This > ! limits the impact from hostile peers that trickle data one byte at > ! a time.
> ! > !Note: when per-record deadlines are enabled, a short timeout > ! may cause problems with TLS over very slow network connections. > ! The reasons are that a TLS protocol message can be up to 16 kbytes > ! long (with TLSv1), and that an entire TLS protocol message must be > ! sent or received within the per-record deadline.
> ! > !This feature is available in Postfix 2.9 and later. With older > ! Postfix releases, the behavior is as if this parameter is set to > ! "no".
> > --- 9844,9869 ---- > > !> ! Clients that are excluded from connection count, connection rate, > ! or SMTP request rate restrictions. See the mynetworks parameter > ! description for the parameter value syntax. >
> >> ! By default, clients in trusted networks are excluded. Specify a > ! list of network blocks, hostnames or .domain names (the initial > ! dot causes the domain to match any name below it). >
> > +Note: IP version 6 address information must be specified inside > + [] in the smtpd_client_event_limit_exceptions value, and > + in files specified with "/file/name". IP version 6 addresses > + contain the ":" character, and would otherwise be confused with a > + "type:table" pattern.
> > !> ! This feature is available in Postfix 2.2 and later. > !
> > *************** > *** 13148,13155 **** > > !> ! The time after which an idle SMTPD policy service connection is > ! closed. >
> --- 9872,9881 ---- > > !> ! The maximal number of message delivery requests that any client is > ! allowed to make to this service per time unit, regardless of whether > ! or not Postfix actually accepts those messages. The time unit is > ! specified with the anvil_rate_time_unit configuration parameter. >
> *************** > *** 13157,13170 **** >> ! This feature is available in Postfix 2.1 and later. >
> > > !> ! The time after which an active SMTPD policy service connection is > ! closed. >
> --- 9883,9899 ---- >> ! By default, a client can send as many message delivery requests > ! per time unit as Postfix can accept. >
> > +> + To disable this feature, specify a limit of 0. > +
> > !> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. > !
> >> ! This feature is available in Postfix 2.2 and later. >
> *************** > *** 13172,13176 **** >> ! This feature is available in Postfix 2.1 and later. >
> > > --- 9901,9909 ---- >> ! Example: >
> > +> + smtpd_client_message_rate_limit = 1000 > +> + > > *************** > *** 13178,13185 **** > > !
> ! The time limit for connecting to, writing to or receiving from a > ! delegated SMTPD policy server. >
> --- 9911,9920 ---- > > !> ! The maximal number of new (i.e., uncached) TLS sessions that a > ! remote SMTP client is allowed to negotiate with this service per > ! time unit. The time unit is specified with the anvil_rate_time_unit > ! configuration parameter. >
> *************** > *** 13187,13200 **** >> ! This feature is available in Postfix 2.1 and later. >
> > > !> ! How the Postfix SMTP server announces itself to the proxy filter. > ! By default, the Postfix hostname is used. >
> --- 9922,9940 ---- >> ! By default, a remote SMTP client can negotiate as many new TLS > ! sessions per time unit as Postfix can accept. >
> > +> + To disable this feature, specify a limit of 0. Otherwise, specify > + a limit that is at least the per-client concurrent session limit, > + or else legitimate client sessions may be rejected. > +
> > !> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. > !
> >> ! This feature is available in Postfix 2.3 and later. >
> *************** > *** 13202,13206 **** >> ! This feature is available in Postfix 2.1 and later. >
> > > --- 9942,9950 ---- >> ! Example: >
> > +> + smtpd_client_new_tls_session_rate_limit = 100 > +> + > > *************** > *** 13208,13228 **** > > !
The hostname and TCP port of the mail filtering proxy server. > ! The proxy receives all mail from the Postfix SMTP server, and is > ! supposed to give the result to another Postfix SMTP server process. >
> > !Specify "host:port" or "inet:host:port" for a TCP endpoint, or > ! "unix:pathname" for a UNIX-domain endpoint. The host can be specified > ! as an IP address or as a symbolic name; no MX lookups are done. > ! When no "host" or "host:" are specified, the local machine is > ! assumed. Pathname interpretation is relative to the Postfix queue > ! directory.
> ! > !This feature is available in Postfix 2.1 and later.
> ! > !The "inet:" and "unix:" prefixes are available in Postfix 2.3 > ! and later.
> > --- 9952,9961 ---- > > !Enable logging of the remote SMTP client port in addition to > ! the hostname and IP address. The logging format is "host[address]:port". >
> > !This feature is available in Postfix 2.5 and later.
> > *************** > *** 13231,13273 **** > > !> ! List of options that control how the Postfix SMTP server > ! communicates with a before-queue content filter. Specify zero or > ! more of the following, separated by comma or whitespace.
> ! > !Do not connect to a before-queue content filter until an entire > ! message has been received. This reduces the number of simultaneous > ! before-queue content filter processes.
> ! > !NOTE 1: A filter must not selectively reject recipients > ! of a multi-recipient message. Rejecting all recipients is OK, as > ! is accepting all recipients.
> ! > !NOTE 2: This feature increases the minimum amount of free queue > ! space by $message_size_limit. The extra space is needed to save the > ! message to a temporary file.
> ! This feature is available in Postfix 2.7 and later. >
> > - > -> ! The time limit for connecting to a proxy filter and for sending or > ! receiving information. When a connection fails the client gets a > ! generic error message while more detailed information is logged to > ! the maillog file. >
> --- 9964,9982 ---- > > !> ! The maximal number of recipient addresses that any client is allowed > ! to send to this service per time unit, regardless of whether or not > ! Postfix actually accepts those recipients. The time unit is specified > ! with the anvil_rate_time_unit configuration parameter. > !
> >> ! By default, a client can make as many recipient addresses per time > ! unit as Postfix can accept. >
> >> ! To disable this feature, specify a limit of 0. >
> *************** > *** 13275,13278 **** >> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). >
> --- 9984,9987 ---- >> ! WARNING: The purpose of this feature is to limit abuse. It must > ! not be used to regulate legitimate mail traffic. >
> *************** > *** 13280,13305 **** >> ! This feature is available in Postfix 2.1 and later. >
> > - > -> ! The maximal number of recipients that the Postfix SMTP server > ! accepts per message delivery request. >
> > ! > !The number of recipients that a remote SMTP client can send in > ! excess of the limit specified with $smtpd_recipient_limit, before > ! the Postfix SMTP server increments the per-session error count > ! for each excess recipient.
> > --- 9989,10000 ---- >> ! This feature is available in Postfix 2.2 and later. >
> >> ! Example: >
> > !> ! smtpd_client_recipient_rate_limit = 1000 > !> > *************** > *** 13308,13349 **** > > !
> ! The access restrictions that the Postfix SMTP server applies in > ! the context of the RCPT TO command. > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > ! restriction lists" for a discussion of evaluation context and time. > !
> >> ! By default, the Postfix SMTP server accepts: >
> > -> ! IMPORTANT: If you change this parameter setting, you must specify > ! at least one of the following restrictions. Otherwise Postfix will > ! refuse to receive mail: >
> > -> -> - >> - reject, defer, defer_if_permit, reject_unauth_destination > -> -
> --- 10003,10016 ---- > > !
> ! Optional SMTP server access restrictions in the context of a client > ! SMTP connection request. >
> >> ! The default is to allow all connection requests. >
> >> *************** > *** 13356,13359 **** >
> ! The following restrictions are specific to the recipient address > ! that is received with the RCPT TO command. >
> --- 10023,10026 ---- >> ! The following restrictions are specific to client hostname or > ! client network address information. >
> *************** > *** 13362,13503 **** > > !> ! In addition, you can use any of the following > ! generic restrictions. These restrictions are applicable in > ! any SMTP command context. > !
> > !> ! /etc/postfix/main.cf: > ! smtpd_client_restrictions = > ! sleep 1, reject_unauth_pipelining > ! smtpd_delay_reject = no > !> ! This feature is available in Postfix 2.3.
> ! smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination >> --- 10268,10270 ---- >
> ! smtpd_client_restrictions = permit_mynetworks, reject_unknown_client_hostname >> *************** > *** 13531,13608 **** > > !
Optional information that is appended after each Postfix SMTP > ! server > ! 4XX or 5XX response.
> > !Example:
> > !> ! /etc/postfix/main.cf: > ! smtpd_reject_footer = For assistance, call 800-555-0101. > ! Please provide the following information in your problem report: > ! time ($localtime), client ($client_address) and server > ! ($server_name). > !> > !
Server response:
> > !> ! 550-5.5.1 <user at example> Recipient address rejected: User unknown > ! 550 5.5.1 For assistance, call 800-555-0101. Please provide the > ! following information in your problem report: time (Jan 4 15:42:00), > ! client (192.168.1.248) and server (mail1.example.com). > !> > !
Note: the above text is meant to make it easier to find the > ! Postfix logfile records for a failed SMTP session. The text itself > ! is not logged to the Postfix SMTP server's maillog file.
> > !Be sure to keep the text as short as possible. Long text may > ! be truncated before it is logged to the remote SMTP client's maillog > ! file, or before it is returned to the sender in a delivery status > ! notification.
> > !This feature supports a limited number of $name attributes in > ! the footer text. These are replaced by their current value for the > ! SMTP session:
> > !Notes:
> > !NOT SUPPORTED are other attributes such as sender, recipient, > - or main.cf parameters.
> > !For safety reasons, text that does not match > ! $smtpd_expansion_filter is censored.
> > !This feature supports the two-character sequence \n as a request > ! for a line break in the footer text. Postfix automatically inserts > ! after each line break the three-digit SMTP reply code (and optional > ! enhanced status code) from the original Postfix reject message. >
> > !This feature is available in Postfix 2.8 and later.
> > --- 10274,10362 ---- > > !> ! Optional access restrictions that the Postfix SMTP server applies > ! in the context of the SMTP DATA command. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > !> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. > !
> > !> ! The following restrictions are valid in this context: > !
> > !> ! Examples: > !
> > !> ! smtpd_data_restrictions = reject_unauth_pipelining > ! smtpd_data_restrictions = reject_multi_recipient_bounce > !> > > !
Postpone the start of an SMTP mail transaction until a valid > ! RCPT TO command is received. Specify "no" to create a mail transaction > ! as soon as the SMTP server receives a valid MAIL FROM command.
> > !With sites that reject lots of mail, the default setting reduces > ! the use of > ! disk, CPU and memory resources. The downside is that rejected > ! recipients are logged with NOQUEUE instead of a mail transaction > ! ID. This complicates the logfile analysis of multi-recipient mail. > !
> > !This feature is available in Postfix 2.3 and later.
> > > !> ! Wait until the RCPT TO command before evaluating > ! $smtpd_client_restrictions, $smtpd_helo_restrictions and > ! $smtpd_sender_restrictions, or wait until the ETRN command before > ! evaluating $smtpd_client_restrictions and $smtpd_helo_restrictions. > !
> ! > !> ! This feature is turned on by default because some clients apparently > ! mis-behave when the Postfix SMTP server rejects commands before > ! RCPT TO. >
> > !> ! The default setting has one major benefit: it allows Postfix to log > ! recipient address information when rejecting a client name/address > ! or sender address, so that it is possible to find out whose mail > ! is being rejected. > !
> > *************** > *** 13611,13641 **** > > !> ! Request that the Postfix SMTP server rejects mail for unknown > ! recipient addresses, even when no explicit reject_unlisted_recipient > ! access restriction is specified. This prevents the Postfix queue > ! from filling up with undeliverable MAILER-DAEMON messages. > !
> > !An address is always considered "known" when it matches a > ! virtual(5) alias or a canonical(5) mapping. > > !
Lookup tables, indexed by the remote SMTP client address, with > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > ! etc.) that the SMTP server will not send in the EHLO response to a > ! remote SMTP client. See smtpd_discard_ehlo_keywords for details. > ! The table is not searched by hostname for robustness reasons.
> ! > !This feature is available in Postfix 2.2 and later.
> ! > ! > !A case insensitive list of EHLO keywords (pipelining, starttls, > ! auth, etc.) that the SMTP server will not send in the EHLO response > ! to a remote SMTP client.
> > !This feature is available in Postfix 2.2 and later.
> > !Notes:
> > !Specify the silent-discard pseudo keyword to prevent > ! this action from being logged.
> > !Use the smtpd_discard_ehlo_keyword_address_maps feature > ! to discard EHLO keywords selectively.
> > *************** > *** 13643,13648 **** > > -> - This feature is available in Postfix 2.1 and later. > -
> - > > --- 10400,10401 ---- > *************** > *** 13650,13684 **** > > !Request that the Postfix SMTP server rejects mail from unknown > ! sender addresses, even when no explicit reject_unlisted_sender > ! access restriction is specified. This can slow down an explosion > ! of forged mail from worms or viruses.
> > !An address is always considered "known" when it matches a > ! virtual(5) alias or a canonical(5) mapping. > > !
> ! This feature is available in Postfix 2.1 and later. > !
> > --- 10403,10434 ---- > > !Optional access restrictions that the Postfix SMTP server > ! applies in the context of the SMTP END-OF-DATA command.
> > !This feature is available in Postfix 2.2 and later.
> > !See smtpd_data_restrictions for syntax details.
> > > !Mandatory TLS: announce STARTTLS support to SMTP clients, > ! and require that clients use TLS encryption. According to RFC 2487 > ! this MUST NOT be applied in case of a publicly-referenced SMTP > ! server. This option is off by default and should be used only on > ! dedicated servers.
> > !Note 1: "smtpd_enforce_tls = yes" implies "smtpd_tls_auth_only = yes".
> > !Note 2: when invoked via "sendmail -bs", Postfix will never offer > ! STARTTLS due to insufficient privileges to access the server private > ! key. This is intended behavior.
> ! > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtpd_tls_security_level instead.
> > *************** > *** 13687,13701 **** > > !> ! User-defined aliases for groups of access restrictions. The aliases > ! can be specified in smtpd_recipient_restrictions etc., and on the > ! right-hand side of a Postfix access(5) table. >
> > !> ! One major application is for implementing per-recipient UCE control. > ! See the RESTRICTION_CLASS_README document for other examples. > !
> > --- 10437,10450 ---- > > !With Postfix version 2.1 and later: the SMTP server response delay after > ! a client has made more than $smtpd_soft_error_limit errors, and > ! fewer than $smtpd_hard_error_limit errors, without delivering mail. >
> > !With Postfix version 2.0 and earlier: the SMTP server delay before > ! sending a reject (4xx or 5xx) response, when the client has made > ! fewer than $smtpd_soft_error_limit errors without delivering > ! mail.
> > *************** > *** 13704,13714 **** > > !> ! The application name that the Postfix SMTP server uses for SASL > ! server initialization. This > ! controls the name of the SASL configuration file. The default value > ! is smtpd, corresponding to a SASL configuration file named > ! smtpd.conf. >
> --- 10453,10460 ---- > > !> ! Optional SMTP server access restrictions in the context of a client > ! ETRN request. >
> *************** > *** 13716,13730 **** >> ! This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3 > ! it was renamed to smtpd_sasl_path. >
> > - > -> ! Enable SASL authentication in the Postfix SMTP server. By default, > ! the Postfix SMTP server does not use authentication. >
> --- 10462,10473 ---- >> ! The Postfix ETRN implementation accepts only destinations that are > ! eligible for the Postfix "fast flush" service. See the ETRN_README > ! file for details. >
> >> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. >
> *************** > *** 13732,13768 **** >> ! If a remote SMTP client is authenticated, the permit_sasl_authenticated > ! access restriction can be used to permit relay access, like this: >
> > !> !> > !> ! smtpd_recipient_restrictions = > ! permit_mynetworks, permit_sasl_authenticated, ... > !> !
To reject all SMTP connections from unauthenticated clients, > ! specify "smtpd_delay_reject = yes" (which is the default) and use: > !
> > !> !> >> ! smtpd_client_restrictions = permit_sasl_authenticated, reject > !> !
> ! See the SASL_README file for SASL configuration and operation details. >
> > > !Report the SASL authenticated user name in the smtpd(8) Received > ! message header.
> > !This feature is available in Postfix 2.3 and later.
> > --- 10475,10511 ---- >> ! The following restrictions are specific to the domain name information > ! received with the ETRN command. >
> > !> ! Other restrictions that are valid in this context: >
> > +> ! Example: > !
> ! > !> ! smtpd_etrn_restrictions = permit_mynetworks, reject > !> > *************** > *** 13771,13778 **** > > !
> ! What remote SMTP clients the Postfix SMTP server will not offer > ! AUTH support to. >
> --- 10514,10522 ---- > > !> ! What characters are allowed in $name expansions of RBL reply > ! templates. Characters not in the allowed set are replaced by "_". > ! Use C like escapes to specify special characters such as whitespace. >
> *************** > *** 13780,13785 **** >> ! Some clients (Netscape 4 at least) have a bug that causes them to > ! require a login and password whenever AUTH is offered, whether it's > ! necessary or not. To work around this, specify, for example, > ! $mynetworks to prevent Postfix from offering AUTH to local clients. >
> --- 10524,10526 ---- >> ! This parameter is not subjected to $parameter expansion. >
> *************** > *** 13787,13815 **** >> ! Specify a list of network/netmask patterns, separated by commas > ! and/or whitespace. The mask specifies the number of bits in the > ! network part of a host address. You can also "/file/name" or > ! "type:table" patterns. A "/file/name" pattern is replaced by its > ! contents; a "type:table" lookup table is matched when a table entry > ! matches a lookup string (the lookup result is ignored). Continue > ! long lines by starting the next line with whitespace. Specify > ! "!pattern" to exclude an address or network block from the list. > ! The form "!/file/name" is supported only in Postfix version 2.4 and > ! later.
> > !Note: IP version 6 address information must be specified inside > ! [] in the smtpd_sasl_exceptions_networks value, and in > ! files specified with "/file/name". IP version 6 addresses contain > ! the ":" character, and would otherwise be confused with a "type:table" > ! pattern.
> >> ! Example: >
> > -> - smtpd_sasl_exceptions_networks = $mynetworks > -> - >
> ! This feature is available in Postfix 2.1 and later. >
> --- 10528,10548 ---- >> ! This feature is available in Postfix 2.0 and later. > !
> > ! > !> ! List of commands that causes the Postfix SMTP server to immediately > ! terminate the session with a 221 code. This can be used to disconnect > ! clients that obviously attempt to abuse the system. In addition to the > ! commands listed in this parameter, commands that follow the "Label:" > ! format of message headers will also cause a disconnect. >
> >> ! This feature is available in Postfix 2.2 and later. >
> *************** > *** 13819,13830 **** > > !> ! The name of the Postfix SMTP server's local SASL authentication > ! realm. >
> >> ! By default, the local authentication realm name is the null string. >
> --- 10552,10571 ---- > > !> ! The maximal number of errors a remote SMTP client is allowed to > ! make without delivering mail. The Postfix SMTP server disconnects > ! when the limit is exceeded. >
> > + > +> ! Require that a remote SMTP client introduces itself at the beginning > ! of an SMTP session with the HELO or EHLO command. >
> *************** > *** 13832,13834 **** >> ! Examples: >
> --- 10573,10575 ---- >> ! Example: >
> *************** > *** 13836,13839 **** >> ! smtpd_sasl_local_domain = $mydomain > ! smtpd_sasl_local_domain = $myhostname >> --- 10577,10579 ---- >
> ! smtpd_helo_required = yes >> *************** > *** 13843,13874 **** > > !
Implementation-specific information that the Postfix SMTP server > ! passes through to > ! the SASL plug-in implementation that is selected with > ! smtpd_sasl_type. Typically this specifies the name of a > ! configuration file or rendezvous point.
> ! > !This feature is available in Postfix 2.3 and later. In earlier > ! releases it was called smtpd_sasl_application_name.
> ! > ! > !Postfix SMTP server SASL security options; as of Postfix 2.3 > ! the list of available > ! features depends on the SASL server implementation that is selected > ! with smtpd_sasl_type.
> > !The following security features are defined for the cyrus > ! server SASL implementation:
> >> ! Restrict what authentication mechanisms the Postfix SMTP server > ! will offer to the client. The list of available authentication > ! mechanisms is system dependent. >
> --- 10583,10601 ---- > > !> ! Optional restrictions that the Postfix SMTP server applies in the > ! context of the SMTP HELO command. > !
> > !> ! The default is to permit everything. > !
> >> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. >
> *************** > *** 13876,13878 **** >> ! Specify zero or more of the following: >
> --- 10603,10606 ---- >> ! The following restrictions are specific to the hostname information > ! received with the HELO or EHLO command. >
> *************** > *** 13881,13907 **** > > !> ! By default, the Postfix SMTP server accepts plaintext passwords but > ! not anonymous logins. >
> > !> ! Warning: it appears that clients try authentication methods in the > ! order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5) > ! which means that if you disable plaintext passwords, clients will > ! log in anonymously, even when they should be able to use CRAM-MD5. > ! So, if you disable plaintext logins, disable anonymous logins too. > ! Postfix treats anonymous login as no authentication. > !
> >> ! Example: >
> --- 10664,10687 ---- >> ! Other restrictions that are valid in this context: >
> > !> ! Examples: >
> *************** > *** 13928,13930 **** >> ! smtpd_sasl_security_options = noanonymous, noplaintext >> --- 10689,10692 ---- >
> ! smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname > ! smtpd_helo_restrictions = permit_mynetworks, reject_unknown_helo_hostname >> *************** > *** 13934,13942 **** > > !
The SASL authentication security options that the Postfix SMTP > ! server uses for TLS encrypted SMTP sessions.
> > !This feature is available in Postfix 2.2 and later.
> > --- 10696,10719 ---- > > !> ! The maximal number of lines in the Postfix SMTP server command history > ! before it is flushed upon receipt of EHLO, RSET, or end of DATA. > !
> > ! > !> ! The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote > ! SMTP client can send before the Postfix SMTP server starts to > ! increment the error counter with each junk command. The junk > ! command count is reset after mail is delivered. See also the > ! smtpd_error_sleep_time and smtpd_soft_error_limit configuration > ! parameters. > !
> > *************** > *** 13945,13952 **** > > !The SASL plug-in type that the Postfix SMTP server should use > ! for authentication. The available types are listed with the > ! "postconf -a" command.
> > --- 10722,10729 ---- > > !A list of Milter (mail filter) applications for new mail that > ! arrives via the Postfix smtpd(8) server. See the MILTER_README > ! document for details.
> > *************** > *** 13957,13959 **** > > !> ! Optional lookup table with the SASL login names that own sender > ! (MAIL FROM) addresses. >
> >> ! Specify zero or more "type:table" lookup tables. With lookups from > ! indexed files such as DB or DBM, or from networked tables such as > ! NIS, LDAP or SQL, the following search operations are done with a > ! sender address of user at domain:
> > -> ! In all cases the result of table lookup must be either "not found" > ! or a list of SASL login names separated by comma and/or whitespace. >
> --- 10738,10782 ---- >> ! List of commands that the Postfix SMTP server replies to with "250 > ! Ok", without doing any syntax checks and without changing state. > ! This list overrides any commands built into the Postfix SMTP server. >
> > + > +> ! The lookup key to be used in SMTP access(5) tables instead of the > ! null sender address. > !
> > > !Attempt to look up the remote SMTP client hostname, and verify that > ! the name matches the client IP address. A client name is set to > ! "unknown" when it cannot be looked up or verified, or when name > ! lookup is disabled. Turning off name lookup reduces delays due to > ! DNS lookup and increases the maximal inbound delivery rate.
> > !This feature is available in Postfix 2.3 and later.
> > > !> ! The time after which an idle SMTPD policy service connection is > ! closed. > !
> ! > !> ! This feature is available in Postfix 2.1 and later. >
> *************** > *** 13997,14006 **** > > !> ! Optional restrictions that the Postfix SMTP server applies in the > ! context of the MAIL FROM command. > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > ! restriction lists" for a discussion of evaluation context and time. >
> --- 10786,10793 ---- > > !> ! The time after which an active SMTPD policy service connection is > ! closed. >
> *************** > *** 14008,14017 **** >> ! The default is to permit everything. >
> >> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. >
> --- 10795,10808 ---- >> ! This feature is available in Postfix 2.1 and later. >
> > + > +> ! The time limit for connecting to, writing to or receiving from a > ! delegated SMTPD policy server. >
> *************** > *** 14019,14130 **** >> ! The following restrictions are specific to the sender address > ! received with the MAIL FROM command. >
> > -> ! Other restrictions that are valid in this context: >
> --- 10810,10909 ---- >> ! This feature is available in Postfix 2.1 and later. >
> > > !> ! How the Postfix SMTP server announces itself to the proxy filter. > ! By default, the Postfix hostname is used. > !
> > !> ! This feature is available in Postfix 2.1 and later. > !
> > > !The hostname and TCP port of the mail filtering proxy server. > ! The proxy receives all mail from the Postfix SMTP server, and is > ! supposed to give the result to another Postfix SMTP server process. > !
> > !Specify "host:port" or "inet:host:port" for a TCP endpoint, or > ! "unix:pathname" for a UNIX-domain endpoint. The host can be specified > ! as an IP address or as a symbolic name; no MX lookups are done. > ! When no "host" or "host:" are specified, the local machine is > ! assumed. Pathname interpretation is relative to the Postfix queue > ! directory.
> > !This feature is available in Postfix 2.1 and later.
> ! > !The "inet:" and "unix:" prefixes are available in Postfix 2.3 > ! and later.
> ! > ! > !> ! The time limit for connecting to a proxy filter and for sending or > ! receiving information. When a connection fails the client gets a > ! generic error message while more detailed information is logged to > ! the maillog file. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > !> ! This feature is available in Postfix 2.1 and later. > !
> > > !> ! The maximal number of recipients that the Postfix SMTP server > ! accepts per message delivery request. > !
> > > !The number of recipients that a remote SMTP client can send in > ! excess of the limit specified with $smtpd_recipient_limit, before > ! the Postfix SMTP server increments the per-session error count > ! for each excess recipient.
> > > !> ! The access restrictions that the Postfix SMTP server applies in > ! the context of the RCPT TO command. > !
> ! > !> ! By default, the Postfix SMTP server accepts: >
> *************** > *** 14133,14145 **** > > !> ! Examples: >
> >> ! smtpd_sender_restrictions = reject_unknown_sender_domain > ! smtpd_sender_restrictions = reject_unknown_sender_domain, > ! check_sender_access hash:/etc/postfix/access >> > ! > !
The internal service that postscreen(8) hands off allowed > ! connections to. In a future version there may be different > ! classes of SMTP service.
> ! > !This feature is available in Postfix 2.8.
> ! > ! > !> ! The number of errors a remote SMTP client is allowed to make without > ! delivering mail before the Postfix SMTP server slows down all its > ! responses. >
> > !With Postfix version 2.1 and later, the Postfix SMTP server > ! delays all responses by $smtpd_error_sleep_time seconds.
> > !With Postfix versions 2.0 and earlier, the Postfix SMTP > ! server delays all responses by (number of errors) seconds.
> > !The time limit for Postfix SMTP server write and read operations > ! during TLS startup and shutdown handshake procedures. The current > ! default value is stress-dependent. Before Postfix version 2.8, it > ! was fixed at 300s.
> > !This feature is available in Postfix 2.2 and later.
> > > !> ! The time limit for sending a Postfix SMTP server response and for > ! receiving a remote SMTP client request. Normally the default limit > ! is 300s, but it changes under overload to just 10s. With Postfix > ! 2.5 and earlier, the SMTP server always uses a time limit of 300s > ! by default. > !
> > !> ! Note: if you set SMTP time limits to very large values you may have > ! to update the global ipc_timeout parameter. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > > !A file containing (PEM format) CA certificates of root CAs trusted > ! to sign either remote SMTP client certificates or intermediate CA > ! certificates. These are loaded into memory before the smtpd(8) server > ! enters the chroot jail. If the number of trusted roots is large, consider > ! using smtpd_tls_CApath instead, but note that the latter directory must > ! be present in the chroot jail if the smtpd(8) server is chrooted. This > ! file may also be used to augment the server certificate trust chain, > ! but it is best to include all the required certificates directly in the > ! server certificate file.
> ! > !Specify "smtpd_tls_CAfile = /path/to/system_CA_file" to use ONLY > ! the system-supplied default certificate authority certificates. > !
> ! > !Specify "tls_append_default_CA = no" to prevent Postfix from > ! appending the system-supplied default CAs and trusting third-party > ! certificates.
> ! > !By default (see smtpd_tls_ask_ccert), client certificates are not > ! requested, and smtpd_tls_CAfile should remain empty. If you do make use > ! of client certificates, the distinguished names (DNs) of the certificate > ! authorities listed in smtpd_tls_CAfile are sent to the remote SMTP client > ! in the client certificate request message. MUAs with multiple client > ! certificates may use the list of preferred certificate authorities > ! to select the correct client certificate. You may want to put your > ! "preferred" CA or CAs in this file, and install other trusted CAs in > ! $smtpd_tls_CApath.
> > !Example:
> > !> ! smtpd_tls_CAfile = /etc/postfix/CAcert.pem > !> > !
This feature is available in Postfix 2.2 and later.
> > > !A directory containing (PEM format) CA certificates of root CAs > ! trusted to sign either remote SMTP client certificates or intermediate CA > ! certificates. Do not forget to create the necessary "hash" links with, > ! for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use > ! smtpd_tls_CApath in chroot mode, this directory (or a copy) must be > ! inside the chroot jail.
> ! > !Specify "smtpd_tls_CApath = /path/to/system_CA_directory" to > ! use ONLY the system-supplied default certificate authority certificates. > !
> ! > !Specify "tls_append_default_CA = no" to prevent Postfix from > ! appending the system-supplied default CAs and trusting third-party > ! certificates.
> ! > !By default (see smtpd_tls_ask_ccert), client certificates are > ! not requested, and smtpd_tls_CApath should remain empty. In contrast > ! to smtpd_tls_CAfile, DNs of certificate authorities installed > ! in $smtpd_tls_CApath are not included in the client certificate > ! request message. MUAs with multiple client certificates may use the > ! list of preferred certificate authorities to select the correct > ! client certificate. You may want to put your "preferred" CA or > ! CAs in $smtpd_tls_CAfile, and install the remaining trusted CAs in > ! $smtpd_tls_CApath.
> > !Example:
> > !> ! smtpd_tls_CApath = /etc/postfix/certs > !> > !
This feature is available in Postfix 2.2 and later.
> > > !Force the Postfix SMTP server to issue a TLS session id, even > ! when TLS session caching is turned off (smtpd_tls_session_cache_database > ! is empty). This behavior is compatible with Postfix < 2.3.
> > !With Postfix 2.3 and later the Postfix SMTP server can disable > ! session id generation when TLS session caching is turned off. This > ! keeps remote SMTP clients from caching sessions that almost certainly cannot > ! be re-used.
> > !By default, the Postfix SMTP server always generates TLS session > ! ids. This works around a known defect in mail client applications > ! such as MS Outlook, and may also prevent interoperability issues > ! with other MTAs.
> > !Example:
> > !> ! smtpd_tls_always_issue_session_ids = no > !> > !
This feature is available in Postfix 2.3 and later.
> > > !Ask a remote SMTP client for a client certificate. This > ! information is needed for certificate based mail relaying with, > ! for example, the permit_tls_clientcerts feature.
> > !Some clients such as Netscape will either complain if no > ! certificate is available (for the list of CAs in $smtpd_tls_CAfile) > ! or will offer multiple client certificates to choose from. This > ! may be annoying, so this option is "off" by default.
> > !This feature is available in Postfix 2.2 and later.
> > --- 10925,11107 ---- >> ! IMPORTANT: If you change this parameter setting, you must specify > ! at least one of the following restrictions. Otherwise Postfix will > ! refuse to receive mail: >
> > +>> > !> ! reject, defer, defer_if_permit, reject_unauth_destination >> +
> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. > !
> >> ! The following restrictions are specific to the recipient address > ! that is received with the RCPT TO command. >
> > !> ! Other restrictions that are valid in this context: > !
> > +> ! Example: > !
> > !> ! smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination > !> > *************** > *** 14357,14388 **** > > !
When TLS encryption is optional in the Postfix SMTP server, do > ! not announce or accept SASL authentication over unencrypted > ! connections.
> > !This feature is available in Postfix 2.2 and later.
> > > !The verification depth for remote SMTP client certificates. A > ! depth of 1 is sufficient if the issuing CA is listed in a local CA > ! file.
> > !The default verification depth is 9 (the OpenSSL default) for > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5, > ! the default value was 5, but the limit was not actually enforced. If > ! you have set this to a lower non-default value, certificates with longer > ! trust chains may now fail to verify. Certificate chains with 1 or 2 > ! CAs are common, deeper chains are more rare and any number between 5 > ! and 9 should suffice in practice. You can choose a lower number if, > ! for example, you trust certificates directly signed by an issuing CA > ! but not any CAs it delegates to.
> > !This feature is available in Postfix 2.2 and later.
> > --- 11110,11143 ---- > > !> ! Request that the Postfix SMTP server rejects mail for unknown > ! recipient addresses, even when no explicit reject_unlisted_recipient > ! access restriction is specified. This prevents the Postfix queue > ! from filling up with undeliverable MAILER-DAEMON messages. > !
> > !> ! This feature is available in Postfix 2.1 and later. > !
> > *************** > *** 14391,14446 **** > > !File with the Postfix SMTP server RSA certificate in PEM format. > ! This file may also contain the Postfix SMTP server private RSA key.
> ! > !Public Internet MX hosts without certificates signed by a "reputable" > ! CA must generate, and be prepared to present to most clients, a > ! self-signed or private-CA signed certificate. The client will not be > ! able to authenticate the server, but unless it is running Postfix 2.3 or > ! similar software, it will still insist on a server certificate.
> ! > !For servers that are not public Internet MX hosts, Postfix > ! 2.3 supports configurations with no certificates. This entails the > ! use of just the anonymous TLS ciphers, which are not supported by > ! typical SMTP clients. Since such clients will not, as a rule, fall > ! back to plain text after a TLS handshake failure, the server will > ! be unable to receive email from TLS enabled clients. To avoid > ! accidental configurations with no certificates, Postfix 2.3 enables > ! certificate-less operation only when the administrator explicitly > ! sets "smtpd_tls_cert_file = none". This ensures that new Postfix > ! configurations will not accidentally run with no certificates.
> > !Both RSA and DSA certificates are supported. When both types > ! are present, the cipher used determines which certificate will be > ! presented to the client. For Netscape and OpenSSL clients without > ! special cipher choices the RSA certificate is preferred.
> > !To enable a remote SMTP client to verify the Postfix SMTP server > ! certificate, the issuing CA certificates must be made available to the > ! client. You should include the required certificates in the server > ! certificate file, the server certificate first, then the issuing > ! CA(s) (bottom-up order).
> > !Example: the certificate for "server.example.com" was issued by > ! "intermediate CA" which itself has a certificate of "root CA". > ! Create the server.pem file with "cat server_cert.pem intermediate_CA.pem > ! root_CA.pem > server.pem".
> > !If you also want to verify client certificates issued by these > ! CAs, you can add the CA certificates to the smtpd_tls_CAfile, in which > ! case it is not necessary to have them in the smtpd_tls_cert_file or > ! smtpd_tls_dcert_file.
> > !A certificate supplied here must be usable as an SSL server certificate > ! and hence pass the "openssl verify -purpose sslserver ..." test.
> > !Example:
> > !> ! smtpd_tls_cert_file = /etc/postfix/server.pem > !> > !
This feature is available in Postfix 2.2 and later.
> > --- 11146,11177 ---- > > !Request that the Postfix SMTP server rejects mail from unknown > ! sender addresses, even when no explicit reject_unlisted_sender > ! access restriction is specified. This can slow down an explosion > ! of forged mail from worms or viruses.
> > !> ! This feature is available in Postfix 2.1 and later. > !
> > *************** > *** 14449,14467 **** > > !Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS > ! cipher list. It is easy to create inter-operability problems by choosing > ! a non-default cipher list. Do not use a non-default TLS cipherlist for > ! MX hosts on the public Internet. Clients that begin the TLS handshake, > ! but are unable to agree on a common cipher, may not be able to send any > ! email to the SMTP server. Using a restricted cipher list may be more > ! appropriate for a dedicated MSA or an internal mailhub, where one can > ! exert some control over the TLS software and settings of the connecting > ! clients.
> ! > !Note: do not use "" quotes around the parameter value.
> > !This feature is available with Postfix version 2.2. It is not used with > ! Postfix 2.3 and later; use smtpd_tls_mandatory_ciphers instead.
> > --- 11180,11194 ---- > > !> ! User-defined aliases for groups of access restrictions. The aliases > ! can be specified in smtpd_recipient_restrictions etc., and on the > ! right-hand side of a Postfix access(5) table. > !
> > !> ! One major application is for implementing per-recipient UCE control. > ! See the RESTRICTION_CLASS_README document for other examples. > !
> > *************** > *** 14470,14494 **** > > !The minimum TLS cipher grade that the Postfix SMTP server > ! will use with opportunistic TLS encryption. Cipher types listed in > ! smtpd_tls_exclude_ciphers are excluded from the base definition of > ! the selected cipher grade. The default value "export" ensures maximum > ! inter-operability. Because encryption is optional, stronger controls > ! are not appropriate, and this setting SHOULD NOT be changed unless the > ! change is essential.
> ! > !When TLS is mandatory the cipher grade is chosen via the > ! smtpd_tls_mandatory_ciphers configuration parameter, see there for syntax > ! details.
> > !Example:
> !> ! smtpd_tls_ciphers = export > !> > !
This feature is available in Postfix 2.6 and later. With earlier Postfix > ! releases only the smtpd_tls_mandatory_ciphers parameter is implemented, > ! and opportunistic TLS always uses "export" or better (i.e. all) ciphers.
> > --- 11197,11213 ---- > > !> ! The application name that the Postfix SMTP server uses for SASL > ! server initialization. This > ! controls the name of the SASL configuration file. The default value > ! is smtpd, corresponding to a SASL configuration file named > ! smtpd.conf. > !
> > !> ! This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3 > ! it was renamed to smtpd_sasl_path. > !
> > *************** > *** 14497,14514 **** > > !File with the Postfix SMTP server DSA certificate in PEM format. > ! This file may also contain the Postfix SMTP server private DSA key.
> > !See the discussion under smtpd_tls_cert_file for more details. >
> > !Example:
> >> ! smtpd_tls_dcert_file = /etc/postfix/server-dsa.pem >> > !
This feature is available in Postfix 2.2 and later.
> > --- 11216,11250 ---- > > !> ! Enable SASL authentication in the Postfix SMTP server. By default, > ! the Postfix SMTP server does not use authentication. > !
> > !> ! If a remote SMTP client is authenticated, the permit_sasl_authenticated > ! access restriction can be used to permit relay access, like this: >
> > !> !> ! > !> ! smtpd_recipient_restrictions = > ! permit_mynetworks, permit_sasl_authenticated, ... > !> !
To reject all SMTP connections from unauthenticated clients, > ! specify "smtpd_delay_reject = yes" (which is the default) and use: > !
> > +>> > !> ! smtpd_client_restrictions = permit_sasl_authenticated, reject >> +
> ! See the SASL_README file for SASL configuration and operation details. > !
> > *************** > *** 14517,14546 **** > > !File with DH parameters that the Postfix SMTP server should > ! use with EDH ciphers.
> > !Instead of using the exact same parameter sets as distributed > ! with other TLS packages, it is more secure to generate your own > ! set of parameters with something like the following command:
> > !> !> > !> ! openssl gendh -out /etc/postfix/dh_1024.pem -2 1024 > !> !
Your actual source for entropy may differ. Some systems have > ! /dev/random; on other system you may consider using the "Entropy > ! Gathering Daemon EGD", available at http://egd.sourceforge.net/ >
> > -Example:
> - >> ! smtpd_tls_dh1024_param_file = /etc/postfix/dh_1024.pem >> > !
This feature is available with Postfix version 2.2.
> > --- 11253,11309 ---- > > !Report the SASL authenticated user name in the smtpd(8) Received > ! message header.
> ! > !This feature is available in Postfix 2.3 and later.
> ! > ! > !> ! What remote SMTP clients the Postfix SMTP server will not offer > ! AUTH support to. > !
> > !> ! Some clients (Netscape 4 at least) have a bug that causes them to > ! require a login and password whenever AUTH is offered, whether it's > ! necessary or not. To work around this, specify, for example, > ! $mynetworks to prevent Postfix from offering AUTH to local clients. > !
> > !> ! Specify a list of network/netmask patterns, separated by commas > ! and/or whitespace. The mask specifies the number of bits in the > ! network part of a host address. You can also "/file/name" or > ! "type:table" patterns. A "/file/name" pattern is replaced by its > ! contents; a "type:table" lookup table is matched when a table entry > ! matches a lookup string (the lookup result is ignored). Continue > ! long lines by starting the next line with whitespace. Specify > ! "!pattern" to exclude an address or network block from the list. > ! The form "!/file/name" is supported only in Postfix version 2.4 and > ! later.
> ! > !Note: IP version 6 address information must be specified inside > ! [] in the smtpd_sasl_exceptions_networks value, and in > ! files specified with "/file/name". IP version 6 addresses contain > ! the ":" character, and would otherwise be confused with a "type:table" > ! pattern.
> > !> ! Example: >
> >> ! smtpd_sasl_exceptions_networks = $mynetworks >> > !
> ! This feature is available in Postfix 2.1 and later. > !
> > *************** > *** 14549,14567 **** > > !File with DH parameters that the Postfix SMTP server should > ! use with EDH ciphers.
> > !See also the discussion under the smtpd_tls_dh1024_param_file > ! configuration parameter.
> > !Example:
> >> ! smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem >> > -
This feature is available with Postfix version 2.2.
> - > > --- 11312,11334 ---- > > !> ! The name of the Postfix SMTP server's local SASL authentication > ! realm. > !
> > !> ! By default, the local authentication realm name is the null string. > !
> > !> ! Examples: > !
> >> ! smtpd_sasl_local_domain = $mydomain > ! smtpd_sasl_local_domain = $myhostname >> > > *************** > *** 14569,14583 **** > > !
File with the Postfix SMTP server DSA private key in PEM format. > ! This file may be combined with the Postfix SMTP server DSA certificate > ! file specified with $smtpd_tls_dcert_file.
> > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted. File permissions should grant read-only > ! access to the system superuser account ("root"), and no access > ! to anyone else.
> > !This feature is available in Postfix 2.2 and later.
> > --- 11336,11348 ---- > > !Implementation-specific information that the Postfix SMTP server > ! passes through to > ! the SASL plug-in implementation that is selected with > ! smtpd_sasl_type. Typically this specifies the name of a > ! configuration file or rendezvous point.
> > !This feature is available in Postfix 2.3 and later. In earlier > ! releases it was called smtpd_sasl_application_name.
> > *************** > *** 14586,14650 **** > > !File with the Postfix SMTP server ECDSA certificate in PEM format. > ! This file may also contain the Postfix SMTP server private ECDSA key.
> ! > !See the discussion under smtpd_tls_cert_file for more details.
> ! > !Example:
> > !> ! smtpd_tls_eccert_file = /etc/postfix/ecdsa-scert.pem > !> > !
This feature is available in Postfix 2.6 and later, when Postfix is > ! compiled and linked with OpenSSL 1.0.0 or later.
> > > !File with the Postfix SMTP server ECDSA private key in PEM format. > ! This file may be combined with the Postfix SMTP server ECDSA certificate > ! file specified with $smtpd_tls_eccert_file.
> > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted. File permissions should grant read-only > ! access to the system superuser account ("root"), and no access > ! to anyone else.
> > !This feature is available in Postfix 2.6 and later, when Postfix is > ! compiled and linked with OpenSSL 1.0.0 or later.
> > > !The Postfix SMTP server security grade for ephemeral elliptic-curve > ! Diffie-Hellman (EECDH) key exchange.
> > !The available choices are:
> > !Postfix SMTP server SASL security options; as of Postfix 2.3 > ! the list of available > ! features depends on the SASL server implementation that is selected > ! with smtpd_sasl_type.
> > !The following security features are defined for the cyrus > ! server SASL implementation:
> > +> + Restrict what authentication mechanisms the Postfix SMTP server > + will offer to the client. The list of available authentication > + mechanisms is system dependent. > +
> > !> ! Specify zero or more of the following: > !
> > !This feature is available in Postfix 2.6 and later, when it is > ! compiled and linked with OpenSSL 1.0.0 or later.
> > > !List of ciphers or cipher types to exclude from the SMTP server > - cipher list at all TLS security levels. Excluding valid ciphers > - can create interoperability problems. DO NOT exclude ciphers unless it > - is essential to do so. This is not an OpenSSL cipherlist; it is a simple > - list separated by whitespace and/or commas. The elements are a single > - cipher, or one or more "+" separated cipher properties, in which case > - only ciphers matching all the properties are excluded.
> > !Examples (some of these will cause problems):
> > !> !> > !> ! smtpd_tls_exclude_ciphers = aNULL > ! smtpd_tls_exclude_ciphers = MD5, DES > ! smtpd_tls_exclude_ciphers = DES+MD5 > ! smtpd_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 > ! smtpd_tls_exclude_ciphers = kEDH+aRSA > !> !
The first setting disables anonymous ciphers. The next setting > ! disables ciphers that use the MD5 digest algorithm or the (single) DES > ! encryption algorithm. The next setting disables ciphers that use MD5 and > ! DES together. The next setting disables the two ciphers "AES256-SHA" > ! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" > ! key exchange with RSA authentication.
> > !This feature is available in Postfix 2.3 and later.
> > --- 11402,11435 ---- > > !> ! By default, the Postfix SMTP server accepts plaintext passwords but > ! not anonymous logins. > !
> > +> + Warning: it appears that clients try authentication methods in the > + order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5) > + which means that if you disable plaintext passwords, clients will > + log in anonymously, even when they should be able to use CRAM-MD5. > + So, if you disable plaintext logins, disable anonymous logins too. > + Postfix treats anonymous login as no authentication. > +
> > !> ! Example: > !
> > !> ! smtpd_sasl_security_options = noanonymous, noplaintext > !> > > !
The SASL authentication security options that the Postfix SMTP > ! server uses for TLS encrypted SMTP sessions.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 14693,14775 **** > > !The message digest algorithm to construct remote SMTP > ! client-certificate > ! fingerprints or public key fingerprints (Postfix 2.9 and later) > ! for check_ccert_access and permit_tls_clientcerts. The > ! default algorithm is md5, for backwards compatibility with Postfix > ! releases prior to 2.5.
> > !Advances in hash > ! function cryptanalysis have led to md5 being deprecated in favor of sha1. > ! However, as long as there are no known "second pre-image" attacks > ! against md5, its use in this context can still be considered safe. > !
> > -While additional digest algorithms are often available with OpenSSL's > - libcrypto, only those used by libssl in SSL cipher suites are available to > - Postfix.
> > !To find the fingerprint of a specific certificate file, with a > ! specific digest algorithm, run:
> > !> !> > !> ! $ openssl x509 -noout -fingerprint -digest -in certfile.pem > !> !
The text to the right of "=" sign is the desired fingerprint. > ! For example:
> > !> !> > !> ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A > !> !
Public key fingerprints are more difficult to extract, however, > ! the SHA-1 public key fingerprint is often present as the value of the > ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix > ! SMTP server and client log the peer certificate fingerprint and public > ! key fingerprint when TLS loglevel is 1 or higher.
> > !Example: client-certificate access table, with sha1 fingerprints:
> > !> !> > !> ! /etc/postfix/main.cf: > ! smtpd_tls_fingerprint_digest = sha1 > ! smtpd_client_restrictions = > ! check_ccert_access hash:/etc/postfix/access, > ! reject > !> !> ! /etc/postfix/access: > ! # Action folded to next line... > ! AF:88:7C:AD:51:95:6F:36:96:F6:01:FB:2E:48:CD:AB:49:25:A2:3B > ! OK > ! 85:16:78:FD:73:6E:CE:70:E0:31:5F:0D:3C:C8:6D:C4:2C:24:59:E1 > ! permit_auth_destination > !> !
This feature is available in Postfix 2.5 and later.
> > > !File with the Postfix SMTP server RSA private key in PEM format. > ! This file may be combined with the Postfix SMTP server RSA certificate > ! file specified with $smtpd_tls_cert_file.
> > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted. File permissions should grant read-only > ! access to the system superuser account ("root"), and no access > ! to anyone else.
> > --- 11438,11487 ---- > > !The SASL plug-in type that the Postfix SMTP server should use > ! for authentication. The available types are listed with the > ! "postconf -a" command.
> > !This feature is available in Postfix 2.3 and later.
> > > !> ! Optional lookup table with the SASL login names that own sender > ! (MAIL FROM) addresses. > !
> > !> ! Specify zero or more "type:table" lookup tables. With lookups from > ! indexed files such as DB or DBM, or from networked tables such as > ! NIS, LDAP or SQL, the following search operations are done with a > ! sender address of user at domain:
> > !> ! In all cases the result of table lookup must be either "not found" > ! or a list of SASL login names separated by comma and/or whitespace. > !
> > *************** > *** 14778,14936 **** > > !Enable additional Postfix SMTP server logging of TLS activity. > ! Each logging level also includes the information that is logged at > ! a lower logging level.
> > !Do not use "smtpd_tls_loglevel = 2" or higher except in case > ! of problems. Use of loglevel 4 is strongly discouraged.
> > !This feature is available in Postfix 2.2 and later.
> > > !The minimum TLS cipher grade that the Postfix SMTP server will > ! use with mandatory TLS encryption. The default grade ("medium") is > ! sufficiently strong that any benefit from globally restricting TLS > ! sessions to a more stringent grade is likely negligible, especially > ! given the fact that many implementations still do not offer any stronger > ! ("high" grade) ciphers, while those that do, will always use "high" > ! grade ciphers. So insisting on "high" grade ciphers is generally > ! counter-productive. Allowing "export" or "low" ciphers is typically > ! not a good idea, as systems limited to just these are limited to > ! obsolete browsers. No known SMTP clients fail to support at least > ! one "medium" or "high" grade cipher.
> > !The following cipher grades are supported:
> > !Cipher types listed in > ! smtpd_tls_mandatory_exclude_ciphers or smtpd_tls_exclude_ciphers are > ! excluded from the base definition of the selected cipher grade. See > ! smtpd_tls_ciphers for cipher controls that apply to opportunistic > ! TLS.
> > !The underlying cipherlists for grades other than "null" include > ! anonymous ciphers, but these are automatically filtered out if the > ! server is configured to ask for remote SMTP client certificates. You are very > ! unlikely to need to take any steps to exclude anonymous ciphers, they > ! are excluded automatically as required. If you must exclude anonymous > ! ciphers even when Postfix does not need or use peer certificates, set > ! "smtpd_tls_exclude_ciphers = aNULL". To exclude anonymous ciphers only > ! when TLS is enforced, set "smtpd_tls_mandatory_exclude_ciphers = aNULL".
> > !This feature is available in Postfix 2.3 and later.
> > > !Additional list of ciphers or cipher types to exclude from the > ! Postfix SMTP server cipher list at mandatory TLS security levels. > ! This list > ! works in addition to the exclusions listed with smtpd_tls_exclude_ciphers > ! (see there for syntax details).
> > !This feature is available in Postfix 2.3 and later.
> > > !The SSL/TLS protocols accepted by the Postfix SMTP server with > ! mandatory TLS encryption. If the list is empty, the server supports all > ! available SSL/TLS protocol versions. A non-empty value is a list > ! of protocol > ! names separated by whitespace, commas or colons. The supported protocol > ! names are "SSLv2", "SSLv3" and "TLSv1", and are not case sensitive.
> > !With Postfix ≥ 2.5 the parameter syntax is expanded to support > ! protocol exclusions. One can now explicitly exclude SSLv2 by setting > ! "smtpd_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and > ! SSLv3 set "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing > ! the protocols to include, rather than protocols to exclude, is still > ! supported, use the form you find more intuitive.
> > !Since SSL version 2 has known protocol weaknesses and is now > ! deprecated, the default setting excludes "SSLv2". This means that > ! by default, SSL version 2 will not be used at the "encrypt" security > ! level.
> > !Example:
> >> ! smtpd_tls_mandatory_protocols = TLSv1 > ! # Alternative form with Postfix ≥ 2.5: > ! smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 >> > -
This feature is available in Postfix 2.3 and later.
> - > > --- 11490,11641 ---- > > !> ! Optional restrictions that the Postfix SMTP server applies in the > ! context of the MAIL FROM command. > !
> > !> ! The default is to permit everything. > !
> > !> ! Specify a list of restrictions, separated by commas and/or whitespace. > ! Continue long lines by starting the next line with whitespace. > ! Restrictions are applied in the order as specified; the first > ! restriction that matches wins. > !
> > !> ! The following restrictions are specific to the sender address > ! received with the MAIL FROM command. > !
> > !> + Other restrictions that are valid in this context: > +
> > !> ! Examples: > !
> >> ! smtpd_sender_restrictions = reject_unknown_sender_domain > ! smtpd_sender_restrictions = reject_unknown_sender_domain, > ! check_sender_access hash:/etc/postfix/access >> > > *************** > *** 14938,14983 **** > > !
List of TLS protocols that the Postfix SMTP server will exclude > ! or include with opportunistic TLS encryption. This parameter SHOULD be > ! left at its default empty value, allowing all protocols to be used with > ! opportunistic TLS.
> ! > !In main.cf the values are separated by whitespace, commas or > ! colons. An empty value means allow all protocols. The valid protocol > ! names, (see SSL_get_version(3)), are "SSLv2", "SSLv3" and > ! "TLSv1". In smtp_tls_policy_maps table entries, "protocols" attribute > ! values are separated by a colon.
> ! > !To include a protocol list its name, to exclude it, prefix the name > ! with a "!" character. To exclude SSLv2 even for opportunistic TLS set > ! "smtpd_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set > ! "smtpd_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to > ! include, is supported, but not recommended. OpenSSL provides no mechanisms > ! for excluding protocols not known at compile-time. If Postfix is linked > ! against an OpenSSL library that supports additional protocol versions, > ! they cannot be excluded using either syntax.
> ! > !Example:
> !> ! smtpd_tls_protocols = !SSLv2 > !> ! > !
This feature is available in Postfix 2.6 and later.
> > > !Request that the Postfix SMTP server produces Received: message > ! headers that include information about the protocol and cipher used, > ! as well as the remote SMTP client CommonName and client certificate issuer > ! CommonName. This is disabled by default, as the information may > ! be modified in transit through other mail servers. Only information > ! that was recorded by the final destination can be trusted.
> > !This feature is available in Postfix 2.2 and later.
> > --- 11643,11662 ---- > > !> + The number of errors a remote SMTP client is allowed to make without > + delivering mail before the Postfix SMTP server slows down all its > + responses. > +
> > !With Postfix version 2.1 and later, the Postfix SMTP server > ! delays all responses by $smtpd_error_sleep_time seconds.
> > !With Postfix versions 2.0 and earlier, the Postfix SMTP > ! server delays all responses by (number of errors) seconds.
> > !With mandatory TLS encryption, require a trusted remote SMTP client > ! certificate in order to allow TLS connections to proceed. This > ! option implies "smtpd_tls_ask_ccert = yes".
> > !When TLS encryption is optional, this setting is ignored with > ! a warning written to the mail log.
> > --- 11665,11671 ---- > > !The time limit for Postfix SMTP server write and read operations > ! during TLS startup and shutdown handshake procedures.
> > *************** > *** 15001,15043 **** > > !The SMTP TLS security level for the Postfix SMTP server; when > ! a non-empty value is specified, this overrides the obsolete parameters > ! smtpd_use_tls and smtpd_enforce_tls. This parameter is ignored with > ! "smtpd_tls_wrappermode = yes".
> > !Specify one of the following security levels:
> > !Note 1: the "fingerprint", "verify" and "secure" levels are not > ! supported here. > ! The Postfix SMTP server logs a warning and uses "encrypt" instead. > ! To verify remote SMTP client certificates, see TLS_README for a discussion > ! of the smtpd_tls_ask_ccert, smtpd_tls_req_ccert, and permit_tls_clientcerts > ! features.
> > !Note 2: The parameter setting "smtpd_tls_security_level = > ! encrypt" implies "smtpd_tls_auth_only = yes".
> > !Note 3: when invoked via "sendmail -bs", Postfix will never > ! offer STARTTLS due to insufficient privileges to access the server > ! private key. This is intended behavior.
> > !This feature is available in Postfix 2.3 and later.
> > --- 11676,11715 ---- > > !> ! The time limit for sending a Postfix SMTP server response and for > ! receiving a remote SMTP client request. > !
> > !> ! Note: if you set SMTP time limits to very large values you may have > ! to update the global ipc_timeout parameter. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > > !The file with the certificate of the certification authority > ! (CA) that issued the Postfix SMTP server certificate. This is > ! needed only when the CA certificate is not already present in the > ! server certificate file. This file may also contain the CA > ! certificates of other trusted CAs. You must use this file for the > ! list of trusted CAs if you want to use chroot-mode.
> > !Example:
> > !> ! smtpd_tls_CAfile = /etc/postfix/CAcert.pem > !> > !
This feature is available in Postfix 2.2 and later.
> > *************** > *** 15046,15072 **** > > !Name of the file containing the optional Postfix SMTP server > ! TLS session cache. Specify a database type that supports enumeration, > ! such as btree or sdbm; there is no need to support > ! concurrent access. The file is created if it does not exist. The smtpd(8) > ! daemon does not use this parameter directly, rather the cache is > ! implemented indirectly in the tlsmgr(8) daemon. This means that > ! per-smtpd-instance master.cf overrides of this parameter are not > ! effective. Note, that each of the cache databases supported by tlsmgr(8) > ! daemon: $smtpd_tls_session_cache_database, $smtp_tls_session_cache_database > ! (and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to be > ! stored separately. It is not at this time possible to store multiple > ! caches in a single database.
> ! > !Note: dbm databases are not suitable. TLS > ! session objects are too large.
> ! > !As of version 2.5, Postfix no longer uses root privileges when > ! opening this file. The file should now be stored under the Postfix-owned > ! data_directory. As a migration aid, an attempt to open the file > ! under a non-Postfix directory is redirected to the Postfix-owned > ! data_directory, and a warning is logged.
> ! >Example:
> --- 11718,11734 ---- > > !Directory with PEM format certificate authority certificates > ! that the Postfix SMTP server offers to remote SMTP clients for the > ! purpose of client certificate verification. Do not forget to create > ! the necessary "hash" links with, for example, "$OPENSSL_HOME/bin/c_rehash > ! /etc/postfix/certs".
> ! > !To use this option in chroot mode, this directory (or a copy) > ! must be inside the chroot jail. Please note that in this case the > ! CA certificates are not offered to the client, so that e.g. Netscape > ! clients might not offer certificates issued by them. Use of this > ! feature is therefore not recommended.
> ! >Example:
> *************** > *** 15074,15076 **** >> ! smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache >> --- 11736,11738 ---- >
> ! smtpd_tls_CApath = /etc/postfix/certs >> *************** > *** 15082,15110 **** > > !
The expiration time of Postfix SMTP server TLS session cache > ! information. A cache cleanup is performed periodically > ! every $smtpd_tls_session_cache_timeout seconds. As with > ! $smtpd_tls_session_cache_database, this parameter is implemented in the > ! tlsmgr(8) daemon and therefore per-smtpd-instance master.cf overrides > ! are not possible.
> ! > !This feature is available in Postfix 2.2 and later.
> > > !Run the Postfix SMTP server in the non-standard "wrapper" mode, > ! instead of using the STARTTLS command.
> > !If you want to support this service, enable a special port in > ! master.cf, and specify "-o smtpd_tls_wrappermode=yes" on the SMTP > ! server's command line. Port 465 (smtps) was once chosen for this > ! purpose.
> > !This feature is available in Postfix 2.2 and later.
> > --- 11744,11769 ---- > > !Force the Postfix SMTP server to issue a TLS session id, even > + when TLS session caching is turned off (smtpd_tls_session_cache_database > + is empty). This behavior is compatible with Postfix < 2.3.
> > !With Postfix 2.3 and later the Postfix SMTP server can disable > ! session id generation when TLS session caching is turned off. This > ! keeps clients from caching sessions that almost certainly cannot > ! be re-used.
> > !By default, the Postfix SMTP server always generates TLS session > ! ids. This works around a known defect in mail client applications > ! such as MS Outlook, and may also prevent interoperability issues > ! with other MTAs.
> > !Example:
> > !> ! smtpd_tls_always_issue_session_ids = no > !> > !
This feature is available in Postfix 2.3 and later.
> > *************** > *** 15113,15126 **** > > !Opportunistic TLS: announce STARTTLS support to remote SMTP clients, > ! but do not require that clients use TLS encryption.
> > !Note: when invoked via "sendmail -bs", Postfix will never offer > ! STARTTLS due to insufficient privileges to access the server private > ! key. This is intended behavior.
> > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtpd_tls_security_level instead.
> > --- 11772,11786 ---- > > !Ask a remote SMTP client for a client certificate. This > ! information is needed for certificate based mail relaying with, > ! for example, the permit_tls_clientcerts feature.
> > !Some clients such as Netscape will either complain if no > ! certificate is available (for the list of CAs in $smtpd_tls_CAfile) > ! or will offer multiple client certificates to choose from. This > ! may be annoying, so this option is "off" by default.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 15129,15148 **** > > !> ! Safety net to keep mail queued that would otherwise be returned to > ! the sender. This parameter disables locally-generated bounces, > ! and prevents the Postfix SMTP server from rejecting mail permanently, > ! by changing 5xx reply codes into 4xx. However, soft_bounce is no > ! cure for address rewriting mistakes or mail routing mistakes. > !
> ! > !> ! Example: > !
> > !> ! soft_bounce = yes > !> > --- 11789,11798 ---- > > !
When TLS encryption is optional in the Postfix SMTP server, do > ! not announce or accept SASL authentication over unencrypted > ! connections.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 15151,15164 **** > > !> ! The time after which a stale exclusive mailbox lockfile is removed. > ! This is used for delivery to file or mailbox. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > --- 11801,11820 ---- > > !The verification depth for remote SMTP client certificates. A > ! depth of 1 is sufficient if the issuing CA is listed in a local CA > ! file.
> > !The default verification depth is 9 (the OpenSSL default) for > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5, > ! the default value was 5, but the limit was not actually enforced. If > ! you have set this to a lower non-default value, certificates with longer > ! trust chains may now fail to verify. Certificate chains with 1 or 2 > ! CAs are common, deeper chains are more rare and any number between 5 > ! and 9 should suffice in practice. You can choose a lower number if, > ! for example, you trust certificates directly signed by an issuing CA > ! but not any CAs it delegates to.
> ! > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 15167,15194 **** > > !This feature is documented in the STRESS_README document.
> > !This feature is available in Postfix 2.5 and later.
> > > !> ! Reject mail with 8-bit text in message headers. This blocks mail > ! from poorly written applications. > !
> > !> ! This feature should not be enabled on a general purpose mail server, > ! because it is likely to reject legitimate email. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > --- 11823,11877 ---- > > !File with the Postfix SMTP server RSA certificate in PEM format. > ! This file may also contain the Postfix SMTP server private RSA key.
> > !Public Internet MX hosts without certificates signed by a "reputable" > ! CA must generate, and be prepared to present to most clients, a > ! self-signed or private-CA signed certificate. The client will not be > ! able to authenticate the server, but unless it is running Postfix 2.3 or > ! similar software, it will still insist on a server certificate.
> > +For servers that are not public Internet MX hosts, Postfix > + 2.3 supports configurations with no certificates. This entails the > + use of just the anonymous TLS ciphers, which are not supported by > + typical SMTP clients. Since such clients will not, as a rule, fall > + back to plain text after a TLS handshake failure, the server will > + be unable to receive email from TLS enabled clients. To avoid > + accidental configurations with no certificates, Postfix 2.3 enables > + certificate-less operation only when the administrator explicitly > + sets "smtpd_tls_cert_file = none". This ensures that new Postfix > + configurations will not accidentally run with no certificates.
> > !Both RSA and DSA certificates are supported. When both types > ! are present, the cipher used determines which certificate will be > ! presented to the client. For Netscape and OpenSSL clients without > ! special cipher choices the RSA certificate is preferred.
> > !In order to verify a certificate, the CA certificate (in case > ! of a certificate chain, all CA certificates) must be available. > ! You should add these certificates to the server certificate, the > ! server certificate first, then the issuing CA(s).
> > !Example: the certificate for "server.dom.ain" was issued by > ! "intermediate CA" which itself has a certificate of "root CA". > ! Create the server.pem file with "cat server_cert.pem intermediate_CA.pem > ! root_CA.pem > server.pem".
> > !If you also want to verify client certificates issued by these > ! CAs, you can add the CA certificates to the smtpd_tls_CAfile, in which > ! case it is not necessary to have them in the smtpd_tls_cert_file or > ! smtpd_tls_dcert_file.
> > !A certificate supplied here must be usable as an SSL server certificate > ! and hence pass the "openssl verify -purpose sslserver ..." test.
> ! > !Example:
> ! > !> ! smtpd_tls_cert_file = /etc/postfix/server.pem > !> ! > !
This feature is available in Postfix 2.2 and later.
> > *************** > *** 15197,15213 **** > > !> ! Enable both strict_7bit_headers and strict_8bitmime_body. > !
> > !> ! This feature should not be enabled on a general purpose mail server, > ! because it is likely to reject legitimate email. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > --- 11880,11898 ---- > > !Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS > ! cipher list. It is easy to create inter-operability problems by choosing > ! a non-default cipher list. Do not use a non-default TLS cipherlist for > ! MX hosts on the public Internet. Clients that begin the TLS handshake, > ! but are unable to agree on a common cipher, may not be able to send any > ! email to the SMTP server. Using a restricted cipher list may be more > ! appropriate for a dedicated MSA or an internal mailhub, where one can > ! exert some control over the TLS software and settings of the connecting > ! clients.
> > !Note: do not use "" quotes around the parameter value.
> > !This feature is available with Postfix version 2.2. It is not used with > ! Postfix 2.3 and later; use smtpd_tls_mandatory_ciphers instead.
> > *************** > *** 15216,15301 **** > > !> ! Reject 8-bit message body text without 8-bit MIME content encoding > ! information. This blocks mail from poorly written applications. > !
> > !> ! Unfortunately, this also rejects majordomo approval requests when > ! the included request contains valid 8-bit MIME mail, and it rejects > ! bounces from mailers that do not MIME encapsulate 8-bit content > ! (for example, bounces from qmail or from old versions of Postfix). > !
> > !> ! This feature should not be enabled on a general purpose mail server, > ! because it is likely to reject legitimate email. >
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > > !Defer delivery when a mailbox file is not owned by its recipient. > ! The default setting is not backwards compatible.
> > !This feature is available in Postfix 2.5.3 and later.
> > > !> ! Reject mail with invalid Content-Transfer-Encoding: information > ! for the message/* or multipart/* MIME content types. This blocks > ! mail from poorly written software. >
> > !> ! This feature should not be enabled on a general purpose mail server, > ! because it will reject mail after a single violation. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > > -> ! Require that addresses received in SMTP MAIL FROM and RCPT TO > ! commands are enclosed with <>, and that those addresses do > ! not contain RFC 822 style comments or phrases. This stops mail > ! from poorly written software. > !
> > !> ! By default, the Postfix SMTP server accepts RFC 822 syntax in MAIL > ! FROM and RCPT TO addresses. > !
> > > !> ! Obsolete SUN mailtool compatibility feature. Instead, use > ! "mailbox_delivery_lock = dotlock". > !
> > --- 11901,11970 ---- > > !File with the Postfix SMTP server DSA certificate in PEM format. > ! This file may also contain the Postfix SMTP server private DSA key.
> > !See the discussion under smtpd_tls_cert_file for more details. >
> > !Example:
> > +> + smtpd_tls_dcert_file = /etc/postfix/server-dsa.pem > +> > !
This feature is available in Postfix 2.2 and later.
> > > !File with DH parameters that the Postfix SMTP server should > + use with EDH ciphers.
> > !Instead of using the exact same parameter sets as distributed > ! with other TLS packages, it is more secure to generate your own > ! set of parameters with something like the following command:
> > !> !> > !> ! openssl gendh -out /etc/postfix/dh_1024.pem -2 1024 > !> !
Your actual source for entropy may differ. Some systems have > ! /dev/random; on other system you may consider using the "Entropy > ! Gathering Daemon EGD", available at http://egd.sourceforge.net/ >
> > !Example:
> > !> ! smtpd_tls_dh1024_param_file = /etc/postfix/dh_1024.pem > !> > +
This feature is available with Postfix version 2.2.
> > > !File with DH parameters that the Postfix SMTP server should > ! use with EDH ciphers.
> > +See also the discussion under the smtpd_tls_dh1024_param_file > + configuration parameter.
> > !Example:
> > !> ! smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem > !> > !
This feature is available with Postfix version 2.2.
> > *************** > *** 15304,15358 **** > > !> ! Enable the rewriting of "site!user" into "user at site". This is > ! necessary if your machine is connected to UUCP networks. It is > ! enabled by default. > !
> > !Note: with Postfix version 2.2, message header address rewriting > ! happens only when one of the following conditions is true:
> > !To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > !> ! Example: > !
> >> ! swap_bangpath = no >> > > !
> ! The syslog facility of Postfix logging. Specify a facility as > ! defined in syslog.conf(5). The default facility is "mail". > !
> ! > !> ! Warning: a non-default syslog_facility setting takes effect only > ! after a Postfix process has completed initialization. Errors during > ! process initialization will be logged with the default facility. > ! Examples are errors while parsing the command line arguments, and > ! errors while accessing the Postfix main.cf configuration file. > !
> > --- 11973,12021 ---- > > !File with the Postfix SMTP server DSA private key in PEM format. > ! This file may be combined with the Postfix SMTP server DSA certificate > ! file specified with $smtpd_tls_dcert_file.
> > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted, but file permissions should grant read/write > ! access only to the system superuser account ("root").
> > !This feature is available in Postfix 2.2 and later.
> > > !List of ciphers or cipher types to exclude from the SMTP server > ! cipher list at all TLS security levels. Excluding valid ciphers > ! can create interoperability problems. DO NOT exclude ciphers unless it > ! is essential to do so. This is not an OpenSSL cipherlist; it is a simple > ! list separated by whitespace and/or commas. The elements are a single > ! cipher, or one or more "+" separated cipher properties, in which case > ! only ciphers matching all the properties are excluded.
> > !Examples (some of these will cause problems):
> > +>> > +> ! smtpd_tls_exclude_ciphers = aNULL > ! smtpd_tls_exclude_ciphers = MD5, DES > ! smtpd_tls_exclude_ciphers = DES+MD5 > ! smtpd_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 > ! smtpd_tls_exclude_ciphers = kEDH+aRSA >> +
The first setting disables anonymous ciphers. The next setting > + disables ciphers that use the MD5 digest algorithm or the (single) DES > + encryption algorithm. The next setting disables ciphers that use MD5 and > + DES together. The next setting disables the two ciphers "AES256-SHA" > + and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" > + key exchange with RSA authentication.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 15361,15391 **** > > !> ! The mail system name that is prepended to the process name in syslog > ! records, so that "smtpd" becomes, for example, "postfix/smtpd". >
> > !> ! Warning: a non-default syslog_name setting takes effect only after > ! a Postfix process has completed initialization. Errors during > ! process initialization will be logged with the default name. Examples > ! are errors while parsing the command line arguments, and errors > ! while accessing the Postfix main.cf configuration file. >
> > > !An optional workaround for routers that break TCP window scaling. > ! Specify a value > 0 and < 65536 to enable this feature. With > ! Postfix TCP servers (smtpd(8), qmqpd(8)), this feature is implemented > ! by the Postfix master(8) daemon.
> ! > !To change this parameter without stopping Postfix, you need to > ! first terminate all Postfix TCP servers:
> > --- 12024,12046 ---- > > !The message digest algorithm used to construct client-certificate > ! fingerprints for check_ccert_access and > ! permit_tls_clientcerts. The default algorithm is md5, > ! for backwards compatibility with Postfix releases prior to 2.5. >
> > !The best practice algorithm is now sha1. Recent advances in hash > ! function cryptanalysis have led to md5 being deprecated in favor of sha1. > ! However, as long as there are no known "second pre-image" attacks > ! against md5, its use in this context can still be considered safe. >
> > +While additional digest algorithms are often available with OpenSSL's > + libcrypto, only those used by libssl in SSL cipher suites are available to > + Postfix. For now this means just md5 or sha1.
> > !To find the fingerprint of a specific certificate file, with a > ! specific digest algorithm, run:
> > *************** > *** 15393,15396 **** >> ! # postconf -e master_service_disable=inet > ! # postfix reload >> --- 12048,12050 ---- >
> ! $ openssl x509 -noout -fingerprint -digest -in certfile.pem >> *************** > *** 15398,15402 **** > > !
This immediately terminates all processes that accept network > ! connections. Next, you enable Postfix TCP servers with the updated > ! tcp_windowsize setting:
> > --- 12052,12055 ---- > > !The text to the right of "=" sign is the desired fingerprint. > ! For example:
> > *************** > *** 15404,15407 **** >> ! # postconf -e tcp_windowsize=65535 master_service_disable= > ! # postfix reload >> --- 12057,12060 ---- >
> ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A >> *************** > *** 15409,15432 **** > > !
If you skip these steps with a running Postfix system, then the > ! tcp_windowsize change will work only for Postfix TCP clients (smtp(8), > ! lmtp(8)).
> ! > !This feature is available in Postfix 2.6 and later.
> ! > ! > !Append the system-supplied default certificate authority > ! certificates to the ones specified with *_tls_CApath or *_tls_CAfile. > ! The default is "no"; this prevents Postfix from trusting third-party > ! certificates and giving them relay permission with > ! permit_tls_all_clientcerts.
> ! > !This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8, > ! 2.7.2 and later versions. Specify "tls_append_default_CA = yes" for > ! backwards compatibility, to avoid breaking certificate verification > ! with sites that don't use permit_tls_all_clientcerts.
> > --- 12062,12084 ---- > > !Example: client-certificate access table, with sha1 fingerprints:
> > !> !> > !> ! /etc/postfix/main.cf: > ! smtpd_tls_fingerprint_digest = sha1 > ! smtpd_client_restrictions = > ! check_ccert_access hash:/etc/postfix/access, > ! reject > !> !> ! /etc/postfix/access: > ! # Action folded to next line... > ! AF:88:7C:AD:51:95:6F:36:96:F6:01:FB:2E:48:CD:AB:49:25:A2:3B > ! OK > ! 85:16:78:FD:73:6E:CE:70:E0:31:5F:0D:3C:C8:6D:C4:2C:24:59:E1 > ! permit_auth_destination > !> !
This feature is available in Postfix 2.5 and later.
> > *************** > *** 15435,15446 **** > > !The number of pseudo-random bytes that an smtp(8) or smtpd(8) > ! process requests from the tlsmgr(8) server in order to seed its > ! internal pseudo random number generator (PRNG). The default of 32 > ! bytes (equivalent to 256 bits) is sufficient to generate a 128bit > ! (or 168bit) session key.
> > !This feature is available in Postfix 2.2 and later.
> > --- 12087,12098 ---- > > !File with the Postfix SMTP server RSA private key in PEM format. > ! This file may be combined with the Postfix SMTP server RSA certificate > ! file specified with $smtpd_tls_cert_file.
> > !The private key must be accessible without a pass-phrase, i.e. it > ! must not be encrypted, but file permissions should grant read/write > ! access only to the system superuser account ("root").
> > *************** > *** 15449,15557 **** > > !List or bit-mask of OpenSSL bug work-arounds to disable.
> ! > !The OpenSSL toolkit includes a set of work-arounds for buggy SSL/TLS > ! implementations. Applications, such as Postfix, that want to maximize > ! interoperability ask the OpenSSL library to enable the full set of > ! recommended work-arounds.
> ! > !From time to time, it is discovered that a work-around creates a > ! security issue, and should no longer be used. If upgrading OpenSSL > ! to a fixed version is not an option or an upgrade is not available > ! in a timely manner, or in closed environments where no buggy clients > ! or servers exist, it may be appropriate to disable some or all of the > ! OpenSSL interoperability work-arounds. This parameter specifies which > ! bug work-arounds to disable.
> ! > !If the value of the parameter is a hexadecimal long integer starting > ! with "0x", the bug work-arounds corresponding to the bits specified in > ! its value are removed from the SSL_OP_ALL work-around bit-mask > ! (see openssl/ssl.h and SSL_CTX_set_options(3)). You can specify more > ! bits than are present in SSL_OP_ALL, excess bits are ignored. Specifying > ! 0xFFFFFFFF disables all bug-workarounds on a 32-bit system. This should > ! also be sufficient on 64-bit systems, until OpenSSL abandons support > ! for 32-bit systems and starts using the high 32 bits of a 64-bit > ! bug-workaround mask.
> ! > !Otherwise, the parameter is a white-space or comma separated list > ! of specific named bug work-arounds chosen from the list below. It > ! is possible that your OpenSSL version includes new bug work-arounds > ! added after your Postfix source code was last updated, in that case > ! you can only disable one of these via the hexadecimal syntax above.
> ! > !This feature is available in Postfix 2.8 and later.
> > > !The elliptic curve used by the Postfix SMTP server for sensibly > ! strong > ! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP > ! server when "smtpd_tls_eecdh_grade = strong". The phrase "sensibly > ! strong" means approximately 128-bit security based on best known > ! attacks. The selected curve must be implemented by OpenSSL (as > ! reported by ecparam(1) with the "-list_curves" option) and be one > ! of the curves listed in Section 5.1.1 of RFC 4492. You should not > ! generally change this setting.
> > !This default curve is specified in NSA "Suite B" Cryptography > ! (see http://www.nsa.gov/ia/industry/crypto_suite_b.cfm) for > ! information classified as SECRET.
> > !Note: elliptic curve names are poorly standardized; different > ! standards groups are assigning different names to the same underlying > ! curves. The curve with the X9.62 name "prime256v1" is also known > ! under the SECG name "secp256r1", but OpenSSL does not recognize the > ! latter name.
> > !This feature is available in Postfix 2.6 and later, when it is > ! compiled and linked with OpenSSL 1.0.0 or later.
> > --- 12101,12210 ---- > > !Enable additional Postfix SMTP server logging of TLS activity. > ! Each logging level also includes the information that is logged at > ! a lower logging level.
> > !Use "smtpd_tls_loglevel = 3" only in case of problems. Use of > ! loglevel 4 is strongly discouraged.
> > !This feature is available in Postfix 2.2 and later.
> > > !The minimum TLS cipher grade that the Postfix SMTP server will > ! use with mandatory > ! TLS encryption. Cipher types listed in smtpd_tls_mandatory_exclude_ciphers > ! or smtpd_tls_exclude_ciphers are excluded from the base definition > ! of the selected cipher grade. With opportunistic TLS encryption, > ! the "export" grade is used unconditionally with exclusions specified > ! only via smtpd_tls_exclude_ciphers.
> > !The following cipher grades are supported:
> > +This feature is available in Postfix 2.3 and later.
> > *************** > *** 15560,15581 **** > > !The elliptic curve used by the Postfix SMTP server for maximally > ! strong > ! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP > ! server when "smtpd_tls_eecdh_grade = ultra". The phrase "maximally > ! strong" means approximately 192-bit security based on best known attacks. > ! This additional strength comes at a significant computational cost, most > ! users should instead set "smtpd_tls_eecdh_grade = strong". The selected > ! curve must be implemented by OpenSSL (as reported by ecparam(1) with the > ! "-list_curves" option) and be one of the curves listed in Section 5.1.1 > ! of RFC 4492. You should not generally change this setting.
> > !This default "ultra" curve is specified in NSA "Suite B" Cryptography > ! (see http://www.nsa.gov/ia/industry/crypto_suite_b.cfm) for information > ! classified as TOP SECRET.
> > !This feature is available in Postfix 2.6 and later, when it is > ! compiled and linked with OpenSSL 1.0.0 or later.
> > --- 12213,12223 ---- > > !Additional list of ciphers or cipher types to exclude from the > ! SMTP server cipher list at mandatory TLS security levels. This list > ! works in addition to the exclusions listed with smtpd_tls_exclude_ciphers > ! (see there for syntax details).
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 15584,15615 **** > > !The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This > ! defines the meaning of the "export" setting in smtpd_tls_mandatory_ciphers, > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is > ! the cipherlist for the opportunistic ("may") TLS client security > ! level and is the default cipherlist for the SMTP server. You are > ! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and > ! later the cipherlist may start with an "aNULL:" prefix, which restores > ! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the > ! list when they are enabled. This prefix is not needed with previous > ! OpenSSL releases.
> > !This feature is available in Postfix 2.3 and later.
> > > !The OpenSSL cipherlist for "HIGH" grade ciphers. This defines > ! the meaning of the "high" setting in smtpd_tls_mandatory_ciphers, > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are > ! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and > ! later the cipherlist may start with an "aNULL:" prefix, which restores > ! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the > ! list when they are enabled. This prefix is not needed with previous > ! OpenSSL releases.
> > --- 12226,12256 ---- > > !The SSL/TLS protocols accepted by the Postfix SMTP server with > ! mandatory TLS encryption. If the list is empty, the server supports all > ! available SSL/TLS protocol versions. A non-empty value is a list > ! of protocol > ! names separated by whitespace, commas or colons. The supported protocol > ! names are "SSLv2", "SSLv3" and "TLSv1", and are not case sensitive.
> > +With Postfix ≥ 2.5 the parameter syntax is expanded to support > + protocol exclusions. One can now explicitly exclude SSLv2 by setting > + "smtpd_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and > + SSLv3 set "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing > + the protocols to include, rather than protocols to exclude, is still > + supported, use the form you find more intuitive.
> > !Since SSL version 2 has known protocol weaknesses and is now > ! deprecated, the default setting excludes "SSLv2". This means that > ! by default, SSL version 2 will not be used at the "encrypt" security > ! level.
> > !Example:
> > !> ! smtpd_tls_mandatory_protocols = TLSv1 > ! # Alternative form with Postfix ≥ 2.5: > ! smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 > !> > *************** > *** 15620,15634 **** > > !
The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines > ! the meaning of the "low" setting in smtpd_tls_mandatory_ciphers, > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are > ! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and > ! later the cipherlist may start with an "aNULL:" prefix, which restores > ! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the > ! list when they are enabled. This prefix is not needed with previous > ! OpenSSL releases.
> > !This feature is available in Postfix 2.3 and later.
> > --- 12261,12273 ---- > > !Request that the Postfix SMTP server produces Received: message > ! headers that include information about the protocol and cipher used, > ! as well as the client CommonName and client certificate issuer > ! CommonName. This is disabled by default, as the information may > ! be modified in transit through other mail servers. Only information > ! that was recorded by the final destination can be trusted.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 15637,15707 **** > > !The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This > ! defines the meaning of the "medium" setting in smtpd_tls_mandatory_ciphers, > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is > ! the default cipherlist for mandatory TLS encryption in the TLS > ! client (with anonymous ciphers disabled when verifying server > ! certificates). You are strongly encouraged to not change this > ! setting. With OpenSSL 1.0.0 and later the cipherlist may start with an > ! "aNULL:" prefix, which restores the 0.9.8-compatible ordering of the > ! aNULL ciphers to the top of the list when they are enabled. This prefix > ! is not needed with previous OpenSSL releases.
> > !This feature is available in Postfix 2.3 and later.
> > > -The OpenSSL cipherlist for "NULL" grade ciphers that provide > ! authentication without encryption. This defines the meaning of the "null" > ! setting in smtpd_mandatory_tls_ciphers, smtp_tls_mandatory_ciphers and > ! lmtp_tls_mandatory_ciphers. You are strongly encouraged to not > ! change this setting.
> > !This feature is available in Postfix 2.3 and later.
> > > !With SSLv3 and later, use the Postfix SMTP server's cipher > ! preference order instead of the remote client's cipher preference > ! order.
> ! > !By default, the OpenSSL server selects the client's most preferred > ! cipher that the server supports. With SSLv3 and later, the server may > ! choose its own most preferred cipher that is supported (offered) by > ! the client. Setting "tls_preempt_cipherlist = yes" enables server cipher > ! preferences.
> ! > !While server cipher selection may in some cases lead to a more secure > ! or performant cipher choice, there is some risk of interoperability > ! issues. In the past, some SSL clients have listed lower priority ciphers > ! that they did not implement correctly. If the server chooses a cipher > ! that the client prefers less, it may select a cipher whose client > ! implementation is flawed.
> > !This feature is available in Postfix 2.8 and later, in combination > ! with OpenSSL 0.9.7 and later.
> > > !The number of bytes that tlsmgr(8) reads from $tls_random_source > ! when (re)seeding the in-memory pseudo random number generator (PRNG) > ! pool. The default of 32 bytes (256 bits) is good enough for 128bit > ! symmetric keys. If using EGD or a device file, a maximum of 255 > ! bytes is read.
> > !This feature is available in Postfix 2.2 and later.
> > --- 12276,12333 ---- > > !With mandatory TLS encryption, require a trusted remote SMTP client > ! certificate in order to allow TLS connections to proceed. This > ! option implies "smtpd_tls_ask_ccert = yes".
> > !When TLS encryption is optional, this setting is ignored with > ! a warning written to the mail log.
> > +This feature is available in Postfix 2.2 and later.
> > > !The SMTP TLS security level for the Postfix SMTP server; when > ! a non-empty value is specified, this overrides the obsolete parameters > ! smtpd_use_tls and smtpd_enforce_tls. This parameter is ignored with > ! "smtpd_tls_wrappermode = yes".
> > +Specify one of the following security levels:
> > !Note 1: the "fingerprint", "verify" and "secure" levels are not > ! supported here. > ! The Postfix SMTP server logs a warning and uses "encrypt" instead. > ! To verify SMTP client certificates, see TLS_README for a discussion > ! of the smtpd_tls_ask_ccert, smtpd_tls_req_ccert, and permit_tls_clientcerts > ! features.
> > !Note 2: The parameter setting "smtpd_tls_security_level = > ! encrypt" implies "smtpd_tls_auth_only = yes".
> > !Note 3: when invoked via "sendmail -bs", Postfix will never > ! offer STARTTLS due to insufficient privileges to access the server > ! private key. This is intended behavior.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 15710,15736 **** > > !Name of the pseudo random number generator (PRNG) state file > ! that is maintained by tlsmgr(8). The file is created when it does > ! not exist, and its length is fixed at 1024 bytes.
> ! > !As of version 2.5, Postfix no longer uses root privileges when > ! opening this file, and the default file location was changed from > ! ${config_directory}/prng_exch to ${data_directory}/prng_exch. As > ! a migration aid, an attempt to open the file under a non-Postfix > ! directory is redirected to the Postfix-owned data_directory, and a > ! warning is logged.
> > !This feature is available in Postfix 2.2 and later.
> > > !The time between attempts by tlsmgr(8) to save the state of > ! the pseudo random number generator (PRNG) to the file specified > ! with $tls_random_exchange_name.
> > --- 12336,12367 ---- > > !Name of the file containing the optional Postfix SMTP server > ! TLS session cache. Specify a database type that supports enumeration, > ! such as btree or sdbm; there is no need to support > ! concurrent access. The file is created if it does not exist. The smtpd(8) > ! daemon does not use this parameter directly, rather the cache is > ! implemented indirectly in the tlsmgr(8) daemon. This means that > ! per-smtpd-instance master.cf overrides of this parameter are not > ! effective. Note, that each of the cache databases supported by tlsmgr(8) > ! daemon: $smtpd_tls_session_cache_database, $smtp_tls_session_cache_database > ! (and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to be > ! stored separately. It is not at this time possible to store multiple > ! caches in a single database.
> > +Note: dbm databases are not suitable. TLS > + session objects are too large.
> > !As of version 2.5, Postfix no longer uses root privileges when > ! opening this file. The file should now be stored under the Postfix-owned > ! data_directory. As a migration aid, an attempt to open the file > ! under a non-Postfix directory is redirected to the Postfix-owned > ! data_directory, and a warning is logged.
> > !Example:
> > !> ! smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache > !> > *************** > *** 15741,15749 **** > > !
The maximal time between attempts by tlsmgr(8) to re-seed the > ! in-memory pseudo random number generator (PRNG) pool from external > ! sources. The actual time between re-seeding attempts is calculated > ! using the PRNG, and is between 0 and the time specified.
> > --- 12372,12382 ---- > > !The expiration time of Postfix SMTP server TLS session cache > ! information. A cache cleanup is performed periodically > ! every $smtpd_tls_session_cache_timeout seconds. As with > ! $smtpd_tls_session_cache_database, this parameter is implemented in the > ! tlsmgr(8) daemon and therefore per-smtpd-instance master.cf overrides > ! are not possible.
> > *************** > *** 15754,15767 **** > > !The external entropy source for the in-memory tlsmgr(8) pseudo > ! random number generator (PRNG) pool. Be sure to specify a non-blocking > ! source. If this source is not a regular file, the entropy source > ! type must be prepended: egd:/path/to/egd_socket for a source with > ! EGD compatible socket interface, or dev:/path/to/device for a > ! device file.
> > !Note: on OpenBSD systems specify /dev/arandom when /dev/urandom > ! gives timeout errors.
> > --- 12387,12398 ---- > > !Run the Postfix SMTP server in the non-standard "wrapper" mode, > ! instead of using the STARTTLS command.
> > !If you want to support this service, enable a special port in > ! master.cf, and specify "-o smtpd_tls_wrappermode=yes" on the SMTP > ! server's command line. Port 465 (smtps) was once chosen for this > ! purpose.
> > *************** > *** 15772,15781 **** > > !Mandatory TLS: announce STARTTLS support to remote SMTP clients, and > ! require that clients use TLS encryption. See smtpd_enforce_tls for > ! further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12403,12416 ---- > > !Opportunistic TLS: announce STARTTLS support to SMTP clients, > ! but do not require that clients use TLS encryption.
> > !Note: when invoked via "sendmail -bs", Postfix will never offer > ! STARTTLS due to insufficient privileges to access the server private > ! key. This is intended behavior.
> > !This feature is available in Postfix 2.2 and later. With > ! Postfix 2.3 and later use smtpd_tls_security_level instead.
> > *************** > *** 15784,15792 **** > > !The name of the tlsproxy(8) service entry in master.cf. This > ! service performs plaintext <=> TLS ciphertext conversion.
> > !
This feature is available in Postfix 2.8 and later.
> > --- 12419,12438 ---- > > !> ! Safety net to keep mail queued that would otherwise be returned to > ! the sender. This parameter disables locally-generated bounces, > ! and prevents the Postfix SMTP server from rejecting mail permanently, > ! by changing 5xx reply codes into 4xx. However, soft_bounce is no > ! cure for address rewriting mistakes or mail routing mistakes. > !
> > !> ! Example: > !
> > !> ! soft_bounce = yes > !> > *************** > *** 15795,15804 **** > > !
A file containing (PEM format) CA certificates of root CAs > ! trusted to sign either remote SMTP client certificates or intermediate > ! CA certificates. See smtpd_tls_CAfile for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12441,12454 ---- > > !> ! The time after which a stale exclusive mailbox lockfile is removed. > ! This is used for delivery to file or mailbox. > !
> > !> ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > ! The default time unit is s (seconds). > !
> > *************** > *** 15807,15816 **** > > !A directory containing (PEM format) CA certificates of root CAs > ! trusted to sign either remote SMTP client certificates or intermediate > ! CA certificates. See smtpd_tls_CApath for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12457,12464 ---- > > !This feature is documented in the STRESS_README document.
> > !This feature is available in Postfix 2.5 and later.
> > *************** > *** 15819,15863 **** > > !Force the Postfix tlsproxy(8) server to issue a TLS session id, > ! even when TLS session caching is turned off. See > ! smtpd_tls_always_issue_session_ids for further details.
> > !This feature is available in Postfix 2.8 and later.
> > > !Ask a remote SMTP client for a client certificate. See > ! smtpd_tls_ask_ccert for further details.
> > !This feature is available in Postfix 2.8 and later.
> > > !The verification depth for remote SMTP client certificates. A > - depth of 1 is sufficient if the issuing CA is listed in a local CA > - file. See smtpd_tls_ccert_verifydepth for further details.
> > !This feature is available in Postfix 2.8 and later.
> > > !File with the Postfix tlsproxy(8) server RSA certificate in PEM > ! format. This file may also contain the Postfix tlsproxy(8) server > ! private RSA key. See smtpd_tls_cert_file for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12467,12530 ---- > > !> ! Reject mail with 8-bit text in message headers. This blocks mail > ! from poorly written applications. > !
> > +> + This feature should not be enabled on a general purpose mail server, > + because it is likely to reject legitimate email. > +
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > > !> + Enable both strict_7bit_headers and strict_8bitmime_body. > +
> > !> ! This feature should not be enabled on a general purpose mail server, > ! because it is likely to reject legitimate email. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > > !> ! Reject 8-bit message body text without 8-bit MIME content encoding > ! information. This blocks mail from poorly written applications. > !
> > !> ! Unfortunately, this also rejects majordomo approval requests when > ! the included request contains valid 8-bit MIME mail, and it rejects > ! bounces from mailers that do not MIME encapsulate 8-bit content > ! (for example, bounces from qmail or from old versions of Postfix). > !
> > !> ! This feature should not be enabled on a general purpose mail server, > ! because it is likely to reject legitimate email. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > *************** > *** 15866,15875 **** > > !The minimum TLS cipher grade that the Postfix tlsproxy(8) server > ! will use with opportunistic TLS encryption. See smtpd_tls_ciphers > ! for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12533,12541 ---- > > !Defer delivery when a mailbox file is not owned by its recipient. > ! The default setting is not backwards compatible.
> > !This feature is available in Postfix 2.5.3 and later.
> > *************** > *** 15878,15900 **** > > !File with the Postfix tlsproxy(8) server DSA certificate in PEM > ! format. This file may also contain the Postfix tlsproxy(8) server > ! private DSA key. See smtpd_tls_dcert_file for further details. >
> > !This feature is available in Postfix 2.8 and later.
> ! > ! > !File with DH parameters that the Postfix tlsproxy(8) server > ! should use with EDH ciphers. See smtpd_tls_dh1024_param_file for > ! further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12544,12562 ---- > > !> ! Reject mail with invalid Content-Transfer-Encoding: information > ! for the message/* or multipart/* MIME content types. This blocks > ! mail from poorly written software. >
> > !> ! This feature should not be enabled on a general purpose mail server, > ! because it will reject mail after a single violation. > !
> > !> ! This feature is available in Postfix 2.0 and later. > !
> > *************** > *** 15903,15912 **** > > !File with DH parameters that the Postfix tlsproxy(8) server > ! should use with EDH ciphers. See smtpd_tls_dh512_param_file for > ! further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12565,12580 ---- > > !> ! Require that addresses received in SMTP MAIL FROM and RCPT TO > ! commands are enclosed with <>, and that those addresses do > ! not contain RFC 822 style comments or phrases. This stops mail > ! from poorly written software. > !
> > !> ! By default, the Postfix SMTP server accepts RFC 822 syntax in MAIL > ! FROM and RCPT TO addresses. > !
> > *************** > *** 15915,15925 **** > > !File with the Postfix tlsproxy(8) server DSA private key in PEM > ! format. This file may be combined with the Postfix tlsproxy(8) > ! server DSA certificate file specified with $smtpd_tls_dcert_file. > ! See smtpd_tls_dkey_file for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12583,12591 ---- > > !> ! Obsolete SUN mailtool compatibility feature. Instead, use > ! "mailbox_delivery_lock = dotlock". > !
> > *************** > *** 15928,15963 **** > > !File with the Postfix tlsproxy(8) server ECDSA certificate in > ! PEM format. This file may also contain the Postfix tlsproxy(8) > ! server private ECDSA key. See smtpd_tls_eccert_file for further > ! details.
> ! > !This feature is available in Postfix 2.8 and later.
> > > !File with the Postfix tlsproxy(8) server ECDSA private key in > ! PEM format. This file may be combined with the Postfix tlsproxy(8) > ! server ECDSA certificate file specified with $smtpd_tls_eccert_file. > ! See smtpd_tls_eckey_file for further details.
> > !This feature is available in Postfix 2.8 and later.
> > > !The Postfix tlsproxy(8) server security grade for ephemeral > ! elliptic-curve Diffie-Hellman (EECDH) key exchange. See > ! smtpd_tls_eecdh_grade for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12594,12629 ---- > > !> + Enable the rewriting of "site!user" into "user at site". This is > + necessary if your machine is connected to UUCP networks. It is > + enabled by default. > +
> > !Note: with Postfix version 2.2, message header address rewriting > ! happens only when one of the following conditions is true:
> > !To get the behavior before Postfix version 2.2, specify > ! "local_header_rewrite_clients = static:all".
> > !> ! Example: > !
> > !> ! swap_bangpath = no > !> > *************** > *** 15966,15975 **** > > !
List of ciphers or cipher types to exclude from the tlsproxy(8) > ! server cipher list at all TLS security levels. See > ! smtpd_tls_exclude_ciphers for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12632,12648 ---- > > !> ! The syslog facility of Postfix logging. Specify a facility as > ! defined in syslog.conf(5). The default facility is "mail". > !
> > !> ! Warning: a non-default syslog_facility setting takes effect only > ! after a Postfix process has completed initialization. Errors during > ! process initialization will be logged with the default facility. > ! Examples are errors while parsing the command line arguments, and > ! errors while accessing the Postfix main.cf configuration file. > !
> > *************** > *** 15978,15988 **** > > !The message digest algorithm to construct remote SMTP > ! client-certificate > ! fingerprints. See smtpd_tls_fingerprint_digest for further details. >
> > !This feature is available in Postfix 2.8 and later.
> > --- 12651,12667 ---- > > !> ! The mail system name that is prepended to the process name in syslog > ! records, so that "smtpd" becomes, for example, "postfix/smtpd". >
> > !> ! Warning: a non-default syslog_name setting takes effect only after > ! a Postfix process has completed initialization. Errors during > ! process initialization will be logged with the default name. Examples > ! are errors while parsing the command line arguments, and errors > ! while accessing the Postfix main.cf configuration file. > !
> > *************** > *** 15991,16001 **** > > !File with the Postfix tlsproxy(8) server RSA private key in PEM > ! format. This file may be combined with the Postfix tlsproxy(8) > ! server RSA certificate file specified with $smtpd_tls_cert_file. > ! See smtpd_tls_key_file for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12670,12681 ---- > > !The number of pseudo-random bytes that an smtp(8) or smtpd(8) > ! process requests from the tlsmgr(8) server in order to seed its > ! internal pseudo random number generator (PRNG). The default of 32 > ! bytes (equivalent to 256 bits) is sufficient to generate a 128bit > ! (or 168bit) session key.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 16004,16014 **** > > !Enable additional Postfix tlsproxy(8) server logging of TLS > ! activity. Each logging level also includes the information that > ! is logged at a lower logging level. See smtpd_tls_loglevel for > ! further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12684,12696 ---- > > !The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This > ! defines the meaning of the "export" setting in smtpd_tls_mandatory_ciphers, > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is > ! the cipherlist for the opportunistic ("may") TLS client security > ! level and is the default cipherlist for the SMTP server. You are > ! strongly encouraged to not change this setting.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 16017,16026 **** > > !The minimum TLS cipher grade that the Postfix tlsproxy(8) server > ! will use with mandatory TLS encryption. See smtpd_tls_mandatory_ciphers > ! for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12699,12709 ---- > > !The OpenSSL cipherlist for "HIGH" grade ciphers. This defines > ! the meaning of the "high" setting in smtpd_tls_mandatory_ciphers, > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are > ! strongly encouraged to not change this setting.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 16029,16038 **** > > !Additional list of ciphers or cipher types to exclude from the > ! tlsproxy(8) server cipher list at mandatory TLS security levels. > ! See smtpd_tls_mandatory_exclude_ciphers for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12712,12722 ---- > > !The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines > ! the meaning of the "low" setting in smtpd_tls_mandatory_ciphers, > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are > ! strongly encouraged to not change this setting.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 16041,16051 **** > > !The SSL/TLS protocols accepted by the Postfix tlsproxy(8) server > ! with mandatory TLS encryption. If the list is empty, the server > ! supports all available SSL/TLS protocol versions. See > ! smtpd_tls_mandatory_protocols for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12725,12738 ---- > > !The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This > ! defines the meaning of the "medium" setting in smtpd_tls_mandatory_ciphers, > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is > ! the default cipherlist for mandatory TLS encryption in the TLS > ! client (with anonymous ciphers disabled when verifying server > ! certificates). You are strongly encouraged to not change this > ! setting.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 16054,16063 **** > > !List of TLS protocols that the Postfix tlsproxy(8) server will > ! exclude or include with opportunistic TLS encryption. See > ! smtpd_tls_protocols for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12741,12752 ---- > > !The OpenSSL cipherlist for "NULL" grade ciphers that provide > ! authentication without encryption. This defines the meaning of the "null" > ! setting in smtpd_mandatory_tls_ciphers, smtp_tls_mandatory_ciphers and > ! lmtp_tls_mandatory_ciphers. You are strongly encouraged to not > ! change this setting.
> > !This feature is available in Postfix 2.3 and later.
> > *************** > *** 16066,16075 **** > > !With mandatory TLS encryption, require a trusted remote SMTP > ! client certificate in order to allow TLS connections to proceed. > ! See smtpd_tls_req_ccert for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12755,12766 ---- > > !The number of bytes that tlsmgr(8) reads from $tls_random_source > ! when (re)seeding the in-memory pseudo random number generator (PRNG) > ! pool. The default of 32 bytes (256 bits) is good enough for 128bit > ! symmetric keys. If using EGD or a device file, a maximum of 255 > ! bytes is read.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 16078,16088 **** > > !The SMTP TLS security level for the Postfix tlsproxy(8) server; > ! when a non-empty value is specified, this overrides the obsolete > ! parameters smtpd_use_tls and smtpd_enforce_tls. See > ! smtpd_tls_security_level for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12769,12785 ---- > > !Name of the pseudo random number generator (PRNG) state file > ! that is maintained by tlsmgr(8). The file is created when it does > ! not exist, and its length is fixed at 1024 bytes.
> > !As of version 2.5, Postfix no longer uses root privileges when > ! opening this file, and the default file location was changed from > ! ${config_directory}/prng_exch to ${data_directory}/prng_exch. As > ! a migration aid, an attempt to open the file under a non-Postfix > ! directory is redirected to the Postfix-owned data_directory, and a > ! warning is logged.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 16091,16101 **** > > !The expiration time of Postfix tlsproxy(8) server TLS session > ! cache information. A cache cleanup is performed periodically every > ! $smtpd_tls_session_cache_timeout seconds. See > ! smtpd_tls_session_cache_timeout for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12788,12797 ---- > > !The time between attempts by tlsmgr(8) to save the state of > ! the pseudo random number generator (PRNG) to the file specified > ! with $tls_random_exchange_name.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 16104,16113 **** > > !Opportunistic TLS: announce STARTTLS support to remote SMTP clients, > ! but do not require that clients use TLS encryption. See smtpd_use_tls > ! for further details.
> > !This feature is available in Postfix 2.8 and later.
> > --- 12800,12810 ---- > > !The maximal time between attempts by tlsmgr(8) to re-seed the > ! in-memory pseudo random number generator (PRNG) pool from external > ! sources. The actual time between re-seeding attempts is calculated > ! using the PRNG, and is between 0 and the time specified.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 16116,16132 **** > > !How much time a tlsproxy(8) process may take to process local > ! or remote I/O before it is terminated by a built-in watchdog timer. > ! This is a safety mechanism that prevents tlsproxy(8) from becoming > ! non-responsive due to a bug in Postfix itself or in system software. > ! To avoid false alarms and unnecessary cache corruption this limit > ! cannot be set under 10s.
> > !Specify a non-zero time value (an integral value plus an optional > ! one-letter suffix that specifies the time unit). Time units: s > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > !This feature is available in Postfix 2.8.
> > --- 12813,12828 ---- > > !The external entropy source for the in-memory tlsmgr(8) pseudo > ! random number generator (PRNG) pool. Be sure to specify a non-blocking > ! source. If this source is not a regular file, the entropy source > ! type must be prepended: egd:/path/to/egd_socket for a source with > ! EGD compatible socket interface, or dev:/path/to/device for a > ! device file.
> > !Note: on OpenBSD systems specify /dev/arandom when /dev/urandom > ! gives timeout errors.
> > !This feature is available in Postfix 2.2 and later.
> > *************** > *** 16159,16166 **** > > -Note: transport_delivery_slot_cost parameters will not > - show up in "postconf" command output before Postfix version 2.9. > - This limitation applies to many parameters whose name is a combination > - of a master.cf service name and a built-in suffix (in this case: > - "_delivery_slot_cost").
> - > > --- 12855,12856 ---- > *************** > *** 16175,16182 **** > > -Note: transport_delivery_slot_discount parameters will > - not show up in "postconf" command output before Postfix version > - 2.9. This limitation applies to many parameters whose name is a > - combination of a master.cf service name and a built-in suffix (in > - this case: "_delivery_slot_discount").
> - > > --- 12865,12866 ---- > *************** > *** 16191,16198 **** > > -Note: transport_delivery_slot_loan parameters will not > - show up in "postconf" command output before Postfix version 2.9. > - This limitation applies to many parameters whose name is a combination > - of a master.cf service name and a built-in suffix (in this case: > - "_delivery_slot_loan").
> - > > --- 12875,12876 ---- > *************** > *** 16208,16216 **** > > -Note: some transport_destination_concurrency_failed_cohort_limit > - parameters will not show up in "postconf" command output before > - Postfix version 2.9. This limitation applies to many parameters > - whose name is a combination of a master.cf service name and a > - built-in suffix (in this case: > - "_destination_concurrency_failed_cohort_limit").
> - >This feature is available in Postfix 2.5 and later.
> --- 12886,12887 ---- > *************** > *** 16228,16236 **** > > -Note: some transport_destination_concurrency_limit > - parameters will not show up in "postconf" command output before > - Postfix version 2.9. This limitation applies to many parameters > - whose name is a combination of a master.cf service name and a > - built-in suffix (in this case: "_destination_concurrency_limit"). > -
> - > > --- 12899,12900 ---- > *************** > *** 16246,16254 **** > > -Note: some transport_destination_concurrency_negative_feedback > - parameters will not show up in "postconf" command output before > - Postfix version 2.9. This limitation applies to many parameters > - whose name is a combination of a master.cf service name and a > - built-in suffix (in this case: > - "_destination_concurrency_negative_feedback").
> - >This feature is available in Postfix 2.5 and later.
> --- 12910,12911 ---- > *************** > *** 16266,16274 **** > > -Note: some transport_destination_concurrency_positive_feedback > - parameters will not show up in "postconf" command output before > - Postfix version 2.9. This limitation applies to many parameters > - whose name is a combination of a master.cf service name and a > - built-in suffix (in this case: > - "_destination_concurrency_positive_feedback").
> - >This feature is available in Postfix 2.5 and later.
> --- 12923,12924 ---- > *************** > *** 16285,16292 **** > > -Note: some transport_destination_rate_delay parameters > - will not show up in "postconf" command output before Postfix version > - 2.9. This limitation applies to many parameters whose name is a > - combination of a master.cf service name and a built-in suffix (in > - this case: "_destination_rate_delay").
> - >This feature is available in Postfix 2.5 and later.
> --- 12935,12936 ---- > *************** > *** 16304,16311 **** > > -Note: some transport_destination_recipient_limit parameters > - will not show up in "postconf" command output before Postfix version > - 2.9. This limitation applies to many parameters whose name is a > - combination of a master.cf service name and a built-in suffix (in > - this case: "_destination_recipient_limit").
> - > > --- 12948,12949 ---- > *************** > *** 16320,16327 **** > > -Note: transport_extra_recipient_limit parameters will > - not show up in "postconf" command output before Postfix version > - 2.9. This limitation applies to many parameters whose name is a > - combination of a master.cf service name and a built-in suffix (in > - this case: "_extra_recipient_limit").
> - > > --- 12958,12959 ---- > *************** > *** 16336,16344 **** > > -Note: some transport_initial_destination_concurrency > - parameters will not show up in "postconf" command output before > - Postfix version 2.9. This limitation applies to many parameters > - whose name is a combination of a master.cf service name and a > - built-in suffix (in this case: "_initial_destination_concurrency"). > -
> - >This feature is available in Postfix 2.5 and later.
> --- 12968,12969 ---- > *************** > *** 16384,16391 **** > > -Note: transport_minimum_delivery_slots parameters will > - not show up in "postconf" command output before Postfix version > - 2.9. This limitation applies to many parameters whose name is a > - combination of a master.cf service name and a built-in suffix (in > - this case: "_minimum_delivery_slots").
> - > > --- 13009,13010 ---- > *************** > *** 16400,16407 **** > > -Note: some transport_recipient_limit parameters will not > - show up in "postconf" command output before Postfix version 2.9. > - This limitation applies to many parameters whose name is a combination > - of a master.cf service name and a built-in suffix (in this case: > - "_recipient_limit").
> - > > --- 13019,13020 ---- > *************** > *** 16416,16423 **** > > -Note: transport_recipient_refill_delay parameters will > - not show up in "postconf" command output before Postfix version > - 2.9. This limitation applies to many parameters whose name is a > - combination of a master.cf service name and a built-in suffix (in > - this case: "_recipient_refill_delay").
> - >This feature is available in Postfix 2.4 and later.
> --- 13029,13030 ---- > *************** > *** 16434,16441 **** > > -Note: transport_recipient_refill_limit parameters will > - not show up in "postconf" command output before Postfix version > - 2.9. This limitation applies to many parameters whose name is a > - combination of a master.cf service name and a built-in suffix (in > - this case: "_recipient_refill_limit").
> - >This feature is available in Postfix 2.4 and later.
> --- 13041,13042 ---- > *************** > *** 16468,16475 **** > > -Note: transport_time_limit parameters will not show up > - in "postconf" command output before Postfix version 2.9. This > - limitation applies to many parameters whose name is a combination > - of a master.cf service name and a built-in suffix (in this case: > - "_time_limit").
> - > > --- 13069,13070 ---- > *************** > *** 16496,16498 **** >Example:
> ! > !> ! # Default value before Postfix 2.8. > ! # Note: the ":" and ";" are both required. > ! undisclosed_recipients_header = To: undisclosed-recipients:; > !> > --- 13095,13098 ---- > Message header that the Postfix cleanup(8) server inserts when a > ! message contains no To: or Cc: message header. With Postfix 2.4 > ! and later, specify an empty value to disable this feature. > > *************** > *** 16532,16549 **** > > -
The Postfix SMTP server's action when reject_unknown_sender_domain > - or reject_unknown_recipient_domain fail due to a temporary error > - condition. Specify "defer" to defer the remote SMTP client request > - immediately. With the default "defer_if_permit" action, the Postfix > - SMTP server continues to look for opportunities to reject mail, and > - defers the client request only if it would otherwise be accepted. > -
> - > -This feature is available in Postfix 2.6 and later.
> - > - > -The Postfix SMTP server's action when reject_unknown_helo_hostname > - fails due to an temporary error condition. Specify "defer" to defer > - the remote SMTP client request immediately. With the default > - "defer_if_permit" action, the Postfix SMTP server continues to look > - for opportunities to reject mail, and defers the client request > - only if it would otherwise be accepted.
> - > -This feature is available in Postfix 2.6 and later.
> - > - > -> ! The Postfix SMTP server reply code when a recipient address matches > $virtual_alias_domains, and $virtual_alias_maps specifies a list > --- 13203,13205 ---- >
> ! The SMTP server reply code when a recipient address matches > $virtual_alias_domains, and $virtual_alias_maps specifies a list > *************** > *** 16664,16666 **** >
> ! The Postfix SMTP server reply code when a recipient address matches > $virtual_mailbox_domains, and $virtual_mailbox_maps specifies a list > --- 13219,13221 ---- >
> ! The SMTP server reply code when a recipient address matches > $virtual_mailbox_domains, and $virtual_mailbox_maps specifies a list > *************** > *** 16727,16753 **** > > !
The Postfix SMTP server's reply when rejecting mail with > ! reject_unverified_recipient. Do not include the numeric SMTP reply > ! code or the enhanced status code. By default, the response includes > ! actual address verification details. > ! > !
Example:
> ! > !> ! unverified_recipient_reject_reason = Recipient address lookup failed > !> ! > !
This feature is available in Postfix 2.6 and later.
> ! > ! > !The Postfix SMTP server's action when reject_unverified_recipient > ! fails due to a temporary error condition. Specify "defer" to defer > ! the remote SMTP client request immediately. With the default > ! "defer_if_permit" action, the Postfix SMTP server continues to look > ! for opportunities to reject mail, and defers the client request > ! only if it would otherwise be accepted.
> > --- 13282,13286 ---- > > !When rejecting mail with reject_unverified_recipient, reply > ! with this text as the reason, instead of actual address verification > ! details. > > *************** > *** 16809,16835 **** > > !
The Postfix SMTP server's reply when rejecting mail with > ! reject_unverified_sender. Do not include the numeric SMTP reply > ! code or the enhanced status code. By default, the response includes > ! actual address verification details. > ! > !
Example:
> ! > !> ! unverified_sender_reject_reason = Sender address lookup failed > !> ! > !
This feature is available in Postfix 2.6 and later.
> ! > ! > !The Postfix SMTP server's action when reject_unverified_sender > ! fails due to a temporary error condition. Specify "defer" to defer > ! the remote SMTP client request immediately. With the default > ! "defer_if_permit" action, the Postfix SMTP server continues to look > ! for opportunities to reject mail, and defers the client request > ! only if it would otherwise be accepted.
> > --- 13342,13346 ---- > > !When rejecting mail with reject_unverified_sender, reply with > ! this text as the reason, instead of actual address verification > ! details. > > *************** > *** 17079,17082 **** >
> ! The maximal size in bytes of an individual virtual(8) mailbox or > ! maildir file, or zero (no limit).
> > --- 13590,13594 ---- >> ! The maximal size in bytes of an individual mailbox or maildir file, > ! or zero (no limit). > !
> > *************** > *** 17196,17199 **** > is the name of a mail delivery transport defined in master.cf. > ! The :nexthop destination is optional; its syntax is documented > ! in the manual page of the corresponding delivery agent. > > --- 13708,13711 ---- > is the name of a mail delivery transport defined in master.cf. > ! The :nexthop part is optional. For more details see the > ! transport(5) manual page. > > > _______________________________________________ > postconf-devel mailing list > postconf-devel at de.postfix.org > http://de.postfix.org/cgi-bin/mailman/listinfo/postconf-devel -- Werner Detter IT-Consulting, IT-Services Lilienstra?e 4 Mobil: +49 151 19640507 81669 M?nchen Web: http://www.werner-detter.de Bashian Roulette? [ $(($RANDOM%10)) -eq 0 ] && rm -rf / -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature URL:> > - The numerical Postfix SMTP server response code for > > - an access(5) map "defer" action, including "defer_if_permit" > > - or "defer_if_reject". Prior to Postfix 2.6, the response > > - is hard-coded as "450". > > -
> > - > > -> > - Do not change this unless you have a complete understanding of RFC 2821. > > -
> > - > > -> > - This feature is available in Postfix 2.6 and later. > > -
> > - > > - > > -> > ! The numerical Postfix SMTP server response code for > > ! an access(5) map "reject" action. > >
> > --- 91,94 ---- > >> > ! The numerical Postfix SMTP server response code when a client > > ! is rejected by an access(5) map restriction. > >
> > *************** > > *** 123,146 **** > > > > -The amount of time between verify(8) address verification > > - database cleanup runs. This feature requires that the database > > - supports the "delete" and "sequence" operators. Specify a zero > > - interval to disable database cleanup.
> > - > > -After each database cleanup run, the verify(8) daemon logs the > > - number of entries that were retained and dropped. A cleanup run is > > - logged as "partial" when the daemon terminates early after "postfix > > - reload", "postfix stop", or no requests for $max_idle > > - seconds.
> > - > > -Time units: s (seconds), m (minutes), h (hours), d (days), w > > - (weeks).
> > - > > -This feature is available in Postfix 2.7.
> > - > > - > > -> > ! Lookup table for persistent address verification status > > storage. The table is maintained by the verify(8) service, and > > --- 133,138 ---- > >
> > ! Optional lookup table for persistent address verification status > > storage. The table is maintained by the verify(8) service, and > > *************** > > *** 185,190 **** > >
> > ! The lookup table is persistent by default (Postfix 2.7 and later). > > ! Specify an empty table name to keep the information in volatile > > ! memory which is lost after "postfix reload" or "postfix > > ! stop". This is the default with Postfix version 2.6 and earlier. > >
> > --- 142,145 ---- > >> > ! By default, the information is kept in volatile memory, and is lost > > ! after "postfix reload" or "postfix stop". > >
> > *************** > > *** 194,204 **** > > database becomes corrupted, the world comes to an end. To recover > > ! delete (NOT: truncate) the file and do "postfix reload". > > > > > > !Postfix daemon processes do not use root privileges when opening > > ! this file (Postfix 2.5 and later). The file must therefore be > > ! stored under a Postfix-owned directory such as the data_directory. > > ! As a migration aid, an attempt to open the file under a non-Postfix > > ! directory is redirected to the Postfix-owned data_directory, and a > > ! warning is logged.
> > > > --- 149,158 ---- > > database becomes corrupted, the world comes to an end. To recover > > ! delete the file and do "postfix reload". > > > > > > !As of version 2.5, Postfix no longer uses root privileges when > > ! opening this file. The file should now be stored under the Postfix-owned > > ! data_directory. As a migration aid, an attempt to open the file > > ! under a non-Postfix directory is redirected to the Postfix-owned > > ! data_directory, and a warning is logged.
> > > > *************** > > *** 276,278 **** > >By default, the Postfix SMTP server polls the verify(8) service > > ! up to three times under non-overload conditions, and only once when > > ! under overload. With Postfix version 2.5 and earlier, the SMTP > > ! server always polls the verify(8) service up to three times by > > ! default.
> > > > --- 237,241 ---- > > > > !> > ! The default poll count is 3. > > !
> > > > *************** > > *** 291,293 **** > > Specify 1 to implement a crude form of greylisting, that is, always > > ! defer the first delivery request for a new address. > > > > --- 243,245 ---- > > Specify 1 to implement a crude form of greylisting, that is, always > > ! defer the first delivery request for a never seen before address. > > > > *************** > > *** 295,297 **** > >> > ! Examples: > >
> > --- 247,249 ---- > >> > ! Example: > >
> > *************** > > *** 299,303 **** > >> > - # Postfix ≤ 2.6 default > > - address_verify_poll_count = 3 > > - # Poor man's greylisting > > address_verify_poll_count = 1 > > --- 251,252 ---- > > *************** > > *** 435,447 **** > > > > -
Overrides the sender_dependent_default_transport_maps parameter > > - setting for address verification probes.
> > - > > -This feature is available in Postfix 2.7 and later.
> > - > > - > > -The time between changes in the time-dependent portion of address > > - verification probe sender addresses. The time-dependent portion is > > - appended to the localpart of the address specified with the > > - address_verify_sender parameter. This feature is ignored when the > > - probe sender addresses is the null sender, i.e. the address_verify_sender > > - value is empty or <>.
> > - > > -Historically, the probe sender address was fixed. This has > > - caused such addresses to end up on spammer mailing lists, and has > > - resulted in wasted network and processing resources.
> > - > > -To enable time-dependent probe sender addresses, specify a > > - non-zero time value (an integral value plus an optional one-letter > > - suffix that specifies the time unit). Specify a value of at least > > - several hours, to avoid problems with senders that use greylisting. > > - Avoid nice TTL values, to make the result less predictable. Time > > - units are: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > -
> > - > > -This feature is available in Postfix 2.9 and later.
> > - > > - > > -To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > --- 606,608 ---- > >To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > *************** > > *** 749,762 **** > > > > -Always add (Resent-) From:, To:, Date: or Message-ID: headers > > - when not present. Postfix 2.6 and later add these headers only > > - when clients match the local_header_rewrite_clients parameter > > - setting. Earlier Postfix versions always add these headers; this > > - may break DKIM signatures that cover non-existent headers.
> > - > > - > > -To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > --- 758,760 ---- > >To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > *************** > > *** 896,898 **** > >To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > --- 795,797 ---- > >To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > *************** > > *** 906,908 **** > > How long the postkick(1) command waits for a request to enter the > > ! Postfix daemon process input buffer before giving up. > > > > --- 805,807 ---- > > How long the postkick(1) command waits for a request to enter the > > ! server's input buffer before giving up. > > > > *************** > > *** 922,924 **** > >> > ! authorized_submit_users = !www, static:all > >> > --- 920,922 ---- > >
> > ! authorized_submit_users = !www, static:all > >> > *************** > > *** 1034,1036 **** > > > > !
What remote SMTP clients are allowed to specify the XVERP command. > > This command requests that mail be delivered one recipient at a > > --- 933,935 ---- > > > > !
What SMTP clients are allowed to specify the XVERP command. > > This command requests that mail be delivered one recipient at a > > *************** > > *** 1246,1252 **** > >
The maximal amount of original message text that is sent in a > > ! non-delivery notification. Specify a byte count. A message is > > ! returned as either message/rfc822 (the complete original) or as > > ! text/rfc822-headers (the headers only). With Postfix version 2.4 > > ! and earlier, a message is always returned as message/rfc822 and is > > ! truncated when it exceeds the size limit. > >
> > --- 1145,1151 ---- > >The maximal amount of original message text that is sent in a > > ! non-delivery notification. Specify a byte count. With Postfix 2.4 > > ! and later, a message is returned as either message/rfc822 (the > > ! complete original) or as text/rfc822-headers (the headers only). > > ! With earlier Postfix versions, a message is always returned as > > ! message/rfc822 and is truncated when it exceeds the size limit. > >
> > *************** > > *** 1293,1295 **** > >> > ! Enable inter-operability with remote SMTP clients that implement an obsolete > > version of the AUTH command (RFC 4954). Examples of such clients > > --- 1192,1194 ---- > >
> > ! Enable inter-operability with SMTP clients that implement an obsolete > > version of the AUTH command (RFC 4954). Examples of such clients > > *************** > > *** 1360,1362 **** > >
To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > --- 1259,1261 ---- > >To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > *************** > > *** 1537,1540 **** > > > > -This feature is available in Postfix 2.2 and later.
> > - > > > > --- 1436,1437 ---- > > *************** > > *** 1568,1593 **** > > > > !After the message is queued, send the entire message to the > > ! specified transport:destination. The transport name > > ! specifies the first field of a mail delivery agent definition in > > ! master.cf; the syntax of the next-hop destination is described > > ! in the manual page of the corresponding delivery agent. More > > ! information about external content filters is in the Postfix > > ! FILTER_README file.
> > ! > > !Notes:
> > ! > > !This setting has lower precedence than a FILTER action > > ! that is specified in an access(5), header_checks(5) or body_checks(5) > > ! table.
> > ! > > !The meaning of an empty next-hop filter destination > > ! is version dependent. Postfix 2.7 and later will use the recipient > > ! domain; earlier versions will use $myhostname. Specify > > ! "default_filter_nexthop = $myhostname" for compatibility with Postfix > > ! 2.6 or earlier, or specify a content_filter value with an explicit > > ! next-hop destination.
> > > > !> > ! The name of a mail delivery transport that filters mail after > > ! it is queued. > > !
> > > > !> > ! This parameter uses the same syntax as the right-hand side of a > > ! Postfix transport(5) table. This setting has a lower precedence > > ! than a content filter that is specified with an access(5) table or > > ! in a header_checks(5) or body_checks(5) table. > > !
> > > > *************** > > *** 1622,1656 **** > > > > -How a Postfix daemon process handles errors while opening lookup > > - tables: gradual degradation or immediate termination.
> > - > > - Gradual degradation: a
> > - daemon process logs a message of type "error" and continues execution
> > - with reduced functionality. Features that do not depend on the
> > - unavailable table will work normally, while features that depend
> > - on the table will result in a type "warning" message.
When
> > - the notify_classes parameter value contains the "data" class, the
> > - Postfix SMTP server and client will report transcripts of sessions
> > - with an error because a table is unavailable.
Immediate > > - termination: a daemon process logs a type "fatal" message and > > - terminates immediately. This option reduces the number of possible > > - code paths through Postfix, and may therefore be slightly more > > - secure than the default.
For the sake of sanity, the number of type "error" messages is > > - limited to 13 over the lifetime of a daemon process.
> > - > > -This feature is available in Postfix 2.9 and later.
> > - > > - > > -Use transport_destination_concurrency_negative_feedback > > to specify a transport-specific override, where transport > > --- 1811,1813 ---- > > > > !
Use transport_destination_concurrency_negative_feedback > > to specify a transport-specific override, where transport > > *************** > > *** 2033,2036 **** > >
NOTE: the delay is enforced by the queue manager. The delay > > ! timer state does not survive "postfix reload" or "postfix > > ! stop". > >
> > --- 1884,1886 ---- > >NOTE: the delay is enforced by the queue manager. The delay > > ! timer state does not survive "postfix reload" or "postfix stop". > >
> > *************** > > *** 2042,2048 **** > > > > -NOTE: with a non-zero _destination_rate_delay, specify a > > - transport_destination_concurrency_failed_cohort_limit of 10 > > - or more to prevent Postfix from deferring all mail for the same > > - destination after only one connection or handshake error.
> > - > >This feature is available in Postfix 2.5 and later.
> > --- 1892,1893 ---- > > *************** > > *** 2093,2109 **** > > > > -When a content_filter or FILTER request specifies no explicit > > - next-hop destination, use $default_filter_nexthop instead; when > > - that value is empty, use the domain in the recipient address. > > - Specify "default_filter_nexthop = $myhostname" for compatibility > > - with Postfix version 2.6 and earlier, or specify an explicit next-hop > > - destination with each content_filter value or FILTER action.
> > - > > -This feature is available in Postfix 2.7 and later.
> > - > > - > > -> > ! The default Postfix SMTP server response template for a request that is > > rejected by an RBL-based restriction. This template can be overruled > > --- 1986,1988 ---- > >
> > ! The default SMTP server response template for a request that is > > rejected by an RBL-based restriction. This template can be overruled > > *************** > > *** 2346,2356 **** > > $proxy_interfaces, $virtual_alias_domains, $virtual_mailbox_domains, > > ! or $relay_domains. This information can be overruled with the > > ! sender_dependent_default_transport_maps parameter and with the > > ! transport(5) table.
> > ! > > !> > ! In order of decreasing precedence, the nexthop destination is taken > > ! from $sender_dependent_default_transport_maps, $default_transport, > > $sender_dependent_relayhost_maps, $relayhost, or from the recipient > > ! domain. > >
> > --- 2176,2182 ---- > > $proxy_interfaces, $virtual_alias_domains, $virtual_mailbox_domains, > > ! or $relay_domains. In order of decreasing precedence, the nexthop > > ! destination is taken from $default_transport, > > $sender_dependent_relayhost_maps, $relayhost, or from the recipient > > ! domain. This information can be overruled with the transport(5) > > ! table. > > > > *************** > > *** 2360,2363 **** > > is the name of a mail delivery transport defined in master.cf. > > ! The :nexthop destination is optional; its syntax is documented > > ! in the manual page of the corresponding delivery agent. > > > > --- 2186,2189 ---- > > is the name of a mail delivery transport defined in master.cf. > > ! The :nexthop part is optional. For more details see the > > ! transport(5) manual page. > > > > *************** > > *** 2462,2464 **** > > > > !A debugging aid to artifically delay DNS responses.
> > - > > -This feature is available in Postfix 2.8.
> > - > > - > > -The name of the dnsblog(8) service entry in master.cf. This > > - service performs DNS white/blacklist lookups.
> > - > > -This feature is available in Postfix 2.8 and later.
> > - > > - > > -The sender_dependent_default_transport_maps search string that > > - will be used instead of the null sender address.
> > - > > -This feature is available in Postfix 2.7 and later.
> > - > > - > > -Enable long, non-repeating, queue IDs (queue file names). The > > - benefit of non-repeating names is simpler logfile analysis and > > - easier queue migration (there is no need to run "postsuper" to > > - change queue file names that don't match their message file inode > > - number).
> > - > > -Note: see below for how to prepare long queue file names > > - for migration to Postfix ≤ 2.8.
> > - > > -Changing the parameter value to "yes" has the following effects: > > -
> > - > > -Existing queue file names are not affected.
> > - > > -New queue files are created with names such as 3Pt2mN2VXxznjll. > > - These are encoded in a 52-character alphabet that contains digits > > - (0-9), upper-case letters (B-Z) and lower-case letters (b-z). For > > - safety reasons the vowels (AEIOUaeiou) are excluded from the alphabet. > > - The name format is: 6 or more characters for the time in seconds, > > - 4 characters for the time in microseconds, the 'z'; the remainder > > - is the file inode number encoded in the first 51 characters of the > > - 52-character alphabet.
> > - > > -New messages have a Message-ID header with > > - queueID@myhostname.
> > - > > -The mailq (postqueue -p) output has a wider Queue ID column. > > - The number of whitespace-separated fields is not changed.
> > - > > -
The hash_queue_depth algorithm uses the first characters > > - of the queue file creation time in microseconds, after conversion > > - into hexadecimal representation. This produces the same queue hashing > > - behavior as if the queue file name was created with "enable_long_queue_ids > > - = no".
> > - > > -Changing the parameter value to "no" has the following effects: > > -
> > - > > -Existing long queue file names are renamed to the short > > - form (while running "postfix reload" or "postsuper").
> > - > > -New queue files are created with names such as C3CD21F3E90 > > - from a hexadecimal alphabet that contains digits (0-9) and upper-case > > - letters (A-F). The name format is: 5 characters for the time in > > - microseconds; the remainder is the file inode number.
> > - > > -New messages have a Message-ID header with > > - YYYYMMDDHHMMSS.queueid@myhostname, where > > - YYYYMMDDHHMMSS are the year, month, day, hour, minute and > > - second. > > - > > -
The mailq (postqueue -p) output has the same format as > > - with Postfix ≤ 2.8.
> > - > > -
The hash_queue_depth algorithm uses the first characters > > - of the queue file name, with the hexadecimal representation of the > > - file creation time in microseconds.
> > - > > -Before migration to Postfix ≤ 2.8, the following commands > > - are required to convert long queue file names into short names:
> > - > > -> > - # postfix stop > > - # postconf enable_long_queue_ids=no > > - # postsuper > > -> > - > > -
Repeat the postsuper command until it reports no more queue file > > - name changes.
> > - > > -This feature is available in Postfix 2.9 and later.
> > - > > - > > -With long queue file names, queue hashing produces the same > > ! results as with short names. The file creation time in microseconds > > ! is converted into hexadecimal form before the result is used for > > ! queue hashing. The base 16 encoding gives finer control over the > > ! number of subdirectories than is possible with the base 52 encoding > > ! of long queue file names.
> > > > --- 2962,2965 ---- > > The number of subdirectory levels for queue directories listed with > > ! the hash_queue_names parameter. > > ! > > > > *************** > > *** 3460,3462 **** > >> > ! With the default 100 Postfix SMTP server process limit, "in_flow_delay > > = 1s" limits the mail inflow to 100 messages per second above the > > --- 3158,3160 ---- > >
> > ! With the default 100 SMTP server process limit, "in_flow_delay > > = 1s" limits the mail inflow to 100 messages per second above the > > *************** > > *** 3497,3500 **** > > "inside" and "outside" interfaces, this can prevent each instance from > > ! being able to reach remote SMTP servers on the "other side" of the > > ! firewall. Setting > > smtp_bind_address to 0.0.0.0 avoids the potential problem for > > --- 3195,3197 ---- > > "inside" and "outside" interfaces, this can prevent each instance from > > ! being able to reach servers on the "other side" of the firewall. Setting > > smtp_bind_address to 0.0.0.0 avoids the potential problem for > > *************** > > *** 3536,3538 **** > >
With Postfix 2.8 and earlier the default is "ipv4". For backwards > > - compatibility with these releases, the Postfix 2.9 and later upgrade > > - procedure appends an explicit "inet_protocols = ipv4" setting to > > - main.cf when no explicit setting is present. This compatibility > > - workaround will be phased out as IPv6 deployment becomes more common. > > -
> > - > >This feature is available in Postfix 2.2 and later.
> > --- 3241,3242 ---- > > *************** > > *** 3564,3566 **** > >When IPv4 support is enabled via the inet_protocols parameter, > > ! Postfix will look up DNS type A records, and will convert > > IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original > > --- 3254,3256 ---- > >
When IPv4 support is enabled via the inet_protocols parameter, > > ! Postfix will to DNS type A record lookups, and will convert > > IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original > > *************** > > *** 3581,3584 **** > >
> > ! inet_protocols = ipv4 > > ! inet_protocols = all (DEFAULT) > > inet_protocols = ipv6 > > --- 3271,3274 ---- > >> > ! inet_protocols = ipv4 (DEFAULT) > > ! inet_protocols = all > > inet_protocols = ipv6 > > *************** > > *** 3659,3663 **** > > The time after which a client closes an idle internal communication > > ! channel. The purpose is to allow Postfix daemon processes to > > ! terminate voluntarily after they become idle. This is used, for > > ! example, by the Postfix address resolving and rewriting clients. > > > > --- 3349,3353 ---- > > The time after which a client closes an idle internal communication > > ! channel. The purpose is to allow servers to terminate voluntarily > > ! after they become idle. This is used, for example, by the address > > ! resolving and rewriting clients. > > > > *************** > > *** 3697,3702 **** > > The time after which a client closes an active internal communication > > ! channel. The purpose is to allow Postfix daemon processes to > > ! terminate voluntarily > > after reaching their client limit. This is used, for example, by > > ! the Postfix address resolving and rewriting clients. > > > > --- 3387,3391 ---- > > The time after which a client closes an active internal communication > > ! channel. The purpose is to allow servers to terminate voluntarily > > after reaching their client limit. This is used, for example, by > > ! the address resolving and rewriting clients. > > > > *************** > > *** 3724,3749 **** > > > > -
The LMTP-specific version of the smtp_address_preference > > - configuration parameter. See there for details.
> > - > > -This feature is available in Postfix 2.8 and later.
> > - > > - > > -When a remote LMTP server announces no DSN support, assume that > > - the > > - server performs final delivery, and send "delivered" delivery status > > - notifications instead of "relayed". The default setting is backwards > > - compatible to avoid the infinetisimal possibility of breaking > > - existing LMTP-based content filters.
> > - > > - > > -The LMTP-specific version of the smtp_body_checks configuration > > - parameter. See there for details.
> > - > > -This feature is available in Postfix 2.5 and later.
> > - > > - > > -This parameter is available in Postfix version 2.2 and earlier. > > - With Postfix version 2.3 and later, see lmtp_connection_cache_on_demand, > > - lmtp_connection_cache_destinations, or lmtp_connection_reuse_time_limit. > > -
> > - > >> > The effectiveness of cached connections will be determined by the > > ! number of remote LMTP servers in use, and the concurrency limit specified > > ! for the Postfix LMTP client. Cached connections are closed under any of > > the following conditions: > > --- 3444,3449 ---- > > > >
> > The effectiveness of cached connections will be determined by the > > ! number of LMTP servers in use, and the concurrency limit specified > > ! for the LMTP client. Cached connections are closed under any of > > the following conditions: > > *************** > > *** 3804,3806 **** > > > > !
> > ! Most of these limitations have been with the Postfix > > a connection cache that is shared among multiple LMTP client > > --- 3470,3472 ---- > >
> > ! Most of these limitations will be removed after Postfix implements > > a connection cache that is shared among multiple LMTP client > > *************** > > *** 3843,3845 **** > > > > !
The Postfix LMTP client time limit for completing a TCP connection, or > > zero (use the operating system built-in time limit). When no > > --- 3492,3494 ---- > > > > !
The LMTP client time limit for completing a TCP connection, or > > zero (use the operating system built-in time limit). When no > > *************** > > *** 3912,3917 **** > > > > !
The Postfix LMTP client time limit for sending the LMTP ".", > > ! and for receiving the remote LMTP server response. When no response > > ! is received within the deadline, a warning is logged that the mail > > ! may be delivered multiple times.
> > > > --- 3561,3566 ---- > > > > !The LMTP client time limit for sending the LMTP ".", and for > > ! receiving the server response. When no response is received within > > ! the deadline, a warning is logged that the mail may be delivered > > ! multiple times.
> > > > *************** > > *** 3929,3933 **** > >> > ! The Postfix LMTP client time limit for sending the LMTP DATA command, > > ! and > > ! for receiving the remote LMTP server response. > >
> > --- 3578,3581 ---- > >> > ! The LMTP client time limit for sending the LMTP DATA command, and > > ! for receiving the server response. > >
> > *************** > > *** 3946,3949 **** > >> > ! The Postfix LMTP client time limit for sending the LMTP message > > ! content. > > When the connection stalls for more than $lmtp_data_xfer_timeout > > --- 3594,3596 ---- > >
> > ! The LMTP client time limit for sending the LMTP message content. > > When the connection stalls for more than $lmtp_data_xfer_timeout > > *************** > > *** 4002,4005 **** > > case insensitive lists of LHLO keywords (pipelining, starttls, > > ! auth, etc.) that the Postfix LMTP client will ignore in the LHLO > > ! response > > from a remote LMTP server. See lmtp_discard_lhlo_keywords for > > --- 3649,3651 ---- > > case insensitive lists of LHLO keywords (pipelining, starttls, > > ! auth, etc.) that the LMTP client will ignore in the LHLO response > > from a remote LMTP server. See lmtp_discard_lhlo_keywords for > > *************** > > *** 4017,4020 **** > >
A case insensitive list of LHLO keywords (pipelining, starttls, > > ! auth, etc.) that the Postfix LMTP client will ignore in the LHLO > > ! response > > from a remote LMTP server.
> > --- 3663,3665 ---- > >A case insensitive list of LHLO keywords (pipelining, starttls, > > ! auth, etc.) that the LMTP client will ignore in the LHLO response > > from a remote LMTP server.
> > *************** > > *** 4038,4050 **** > > > > -The LMTP-specific version of the smtp_dns_resolver_options > > - configuration parameter. See there for details.
> > - > > -This feature is available in Postfix 2.8 and later.
> > - > > - > > -The LMTP-specific version of the smtp_header_checks configuration > > - parameter. See there for details.
> > - > > -This feature is available in Postfix 2.5 and later.
> > - > > - > > -The Postfix LMTP client time limit for sending the LHLO command, > > ! and for receiving the initial remote LMTP server response.
> > > > --- 3751,3754 ---- > > > > !The LMTP client time limit for sending the LHLO command, and > > ! for receiving the initial server response.
> > > > *************** > > *** 4152,4155 **** > >> > ! The Postfix LMTP client time limit for sending the MAIL FROM command, > > ! and for receiving the remote LMTP server response. > >
> > --- 3775,3778 ---- > >> > ! The LMTP client time limit for sending the MAIL FROM command, and > > ! for receiving the server response. > >
> > *************** > > *** 4164,4176 **** > > > > -The LMTP-specific version of the smtp_mime_header_checks > > - configuration parameter. See there for details.
> > - > > -This feature is available in Postfix 2.5 and later.
> > - > > - > > -The LMTP-specific version of the smtp_nested_header_checks > > - configuration parameter. See there for details.
> > - > > -This feature is available in Postfix 2.5 and later.
> > - > > - > > -The LMTP-specific version of the smtp_per_record_deadline > > - configuration parameter. See there for details.
> > - > > -This feature is available in Postfix 2.9 and later.
> > - > > - > > -> > ! The Postfix LMTP client time limit for sending the QUIT command, > > ! and for receiving the remote LMTP server response. > >
> > --- 3857,3860 ---- > >> > ! The LMTP client time limit for sending the QUIT command, and for > > ! receiving the server response. > >
> > *************** > > *** 4305,4308 **** > >> > ! The Postfix LMTP client time limit for sending the RCPT TO command, > > ! and for receiving the remote LMTP server response. > >
> > --- 3895,3898 ---- > >> > ! The LMTP client time limit for sending the RCPT TO command, and > > ! for receiving the server response. > >
> > *************** > > *** 4317,4329 **** > > > > -The LMTP-specific version of the smtp_reply_filter > > - configuration parameter. See there for details.
> > - > > -This feature is available in Postfix 2.7 and later.
> > - > > - > > -The Postfix LMTP client time limit for sending the RSET command, > > ! and for receiving the remote LMTP server response. The LMTP client > > ! sends RSET in > > order to finish a recipient address probe, or to verify that a > > --- 3910,3913 ---- > > > > !
The LMTP client time limit for sending the RSET command, and > > ! for receiving the server response. The LMTP client sends RSET in > > order to finish a recipient address probe, or to verify that a > > *************** > > *** 4403,4405 **** > >
> > ! Optional Postfix LMTP client lookup tables with one username:password entry > > per host or domain. If a remote host or domain has no username:password > > --- 3981,3983 ---- > >
> > ! Optional LMTP client lookup tables with one username:password entry > > per host or domain. If a remote host or domain has no username:password > > *************** > > *** 4503,4515 **** > > > > -
The LMTP-specific version of the smtp_send_dummy_mail_auth > > - configuration parameter. See there for details.
> > - > > -This feature is available in Postfix 2.9 and later.
> > - > > - > > -> > ! Send an XFORWARD command to the remote LMTP server when the LMTP LHLO > > server response announces XFORWARD support. This allows an lmtp(8) > > --- 4085,4087 ---- > >
> > ! Send an XFORWARD command to the LMTP server when the LMTP LHLO > > server response announces XFORWARD support. This allows an lmtp(8) > > *************** > > *** 4609,4621 **** > > > > -
The LMTP-specific version of the smtp_tls_block_early_mail_reply > > - configuration parameter. See there for details.
> > - > > -This feature is available in Postfix 2.7 and later.
> > - > > - > > -The LMTP-specific version of the smtp_tls_ciphers configuration > > - parameter. See there for details.
> > - > > -This feature is available in Postfix 2.6 and later.
> > - > > - > > -The LMTP-specific version of the smtp_tls_eccert_file configuration > > ! parameter. See there for details.
> > > > !This feature is available in Postfix 2.6 and later, when Postfix is > > ! compiled and linked with OpenSSL 1.0.0 or later.
> > > > --- 4209,4217 ---- > > > > !The LMTP-specific version of the smtp_tls_enforce_peername > > ! configuration parameter. See there for details.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 4676,4707 **** > > > > !The LMTP-specific version of the smtp_tls_eckey_file configuration > > ! parameter. See there for details.
> > > > !This feature is available in Postfix 2.6 and later, when Postfix is > > ! compiled and linked with OpenSSL 1.0.0 or later.
> > ! > > ! > > !The LMTP-specific version of the smtp_tls_enforce_peername > > ! configuration parameter. See there for details.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !The LMTP-specific version of the smtp_tls_exclude_ciphers > > ! configuration parameter. See there for details.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > > > --- 4220,4228 ---- > > > > !The LMTP-specific version of the smtp_tls_exclude_ciphers > > ! configuration parameter. See there for details.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 4820,4832 **** > > > > -The LMTP-specific version of the smtp_tls_protocols configuration > > - parameter. See there for details.
> > - > > -This feature is available in Postfix 2.6 and later.
> > - > > - > > -> > ! The Postfix LMTP client time limit for sending the XFORWARD command, > > ! and for receiving the remote LMTP server response. > >
> > --- 4422,4425 ---- > >> > ! The LMTP client time limit for sending the XFORWARD command, and > > ! for receiving the server response. > >
> > *************** > > *** 4939,4943 **** > > By default, non-Postfix commands are executed directly; commands > > ! are given to given to the default shell (typically, /bin/sh) only > > ! when they contain shell meta characters or shell built-in commands. > > ! > > > > --- 4449,4452 ---- > > By default, non-Postfix commands are executed directly; commands > > ! are given to given to /bin/sh only when they contain shell meta > > ! characters or shell built-in commands. > > > > *************** > > *** 4957,4959 **** > > local_command_shell = /some/where/smrsh -c > > - local_command_shell = /bin/bash -c > > > > --- 4466,4467 ---- > > *************** > > *** 5038,5041 **** > >> > ! local_header_rewrite_clients = static:all > >> > --- 4577,4579 ---- > >
> > ! local_header_rewrite_clients = static:all > >> > *************** > > *** 5178,5181 **** > > is the name of a mail delivery transport defined in master.cf. > > ! The :nexthop destination is optional; its syntax is documented > > ! in the manual page of the corresponding delivery agent. > > > > --- 4685,4688 ---- > > is the name of a mail delivery transport defined in master.cf. > > ! The :nexthop part is optional. For more details see the > > ! transport(5) manual page. > > > > *************** > > *** 5626,5629 **** > > client request is blocked by the reject_rbl_client, reject_rhsbl_client, > > ! reject_rhsbl_reverse_client, reject_rhsbl_sender or > > ! reject_rhsbl_recipient restriction. > > > > --- 5133,5135 ---- > > client request is blocked by the reject_rbl_client, reject_rhsbl_client, > > ! reject_rhsbl_sender or reject_rhsbl_recipient restriction. > > > > *************** > > *** 5715,5717 **** > >
To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > --- 5221,5223 ---- > >To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > *************** > > *** 5763,5797 **** > > > > -Selectively disable master(8) listener ports by service type > > - or by service name and type. Specify a list of service types > > - ("inet", "unix", "fifo", or "pass") or "name.type" tuples, where > > - "name" is the first field of a master.cf entry and "type" is a > > - service type. As with other Postfix matchlists, a search stops at > > - the first match. Specify "!pattern" to exclude a service from the > > - list. By default, all master(8) listener ports are enabled.
> > - > > -Note: this feature does not support "/file/name" or "type:table" > > - patterns, nor does it support wildcards such as "*" or "all". This > > - is intentional.
> > - > > -Examples:
> > - > > -> > - # Turn on all master(8) listener ports (the default). > > - master_service_disable = > > - # Turn off only the main SMTP listener port. > > - master_service_disable = smtp.inet > > - # Turn off all TCP/IP listener ports. > > - master_service_disable = inet > > - # Turn off all TCP/IP listener ports except "foo". > > - master_service_disable = !foo.inet, inet > > -> > - > > -
This feature is available in Postfix 2.6 and later.
> > - > > - > > -Note 1: this feature does not recognize text that requires MIME > > - decoding. It inspects raw message content, just like header_checks > > - and body_checks.
> > - > > -Note 2: this feature is disabled with "receive_override_options > > - = no_header_body_checks".
> > - > >Example:
> > --- 5347,5348 ---- > > *************** > > *** 5915,5923 **** > > > > -Note 1: this feature does not recognize text that requires MIME > > - decoding. It inspects raw message content, just like header_checks > > - and body_checks.
> > - > > -Note 2: this feature is disabled with "receive_override_options > > - = no_header_body_checks".
> > - > >Example:
> > --- 5381,5382 ---- > > *************** > > *** 5951,5953 **** > >Optional lookup tables for content inspection of message headers > > - that are produced by Milter applications. See the header_checks(5) > > - manual page available actions. Currently, PREPEND is not implemented. > > -
> > - > > -The following example sends all mail that is marked as SPAM to > > - a spam handling machine. Note that matches are case-insensitive > > - by default.
> > - > > -> > - /etc/postfix/main.cf: > > - milter_header_checks = pcre:/etc/postfix/milter_header_checks > > -> > - > > -
> > - /etc/postfix/milter_header_checks: > > - /^X-SPAM-FLAG:\s+YES/ FILTER mysmtp:sanitizer.example.com:25 > > -> > - > > -
The milter_header_checks mechanism could also be used for > > - whitelisting. For example it could be used to skip heavy content > > - inspection for DKIM-signed mail from known friendly domains.
> > - > > -This feature is available in Postfix 2.7, and as an optional > > - patch for Postfix 2.6.
> > - > > - > > -The mail filter protocol version and optional protocol extensions > > ! for communication with a Milter application; prior to Postfix 2.6 > > ! the default protocol is 2. Postfix > > sends this version number during the initial protocol handshake. > > --- 5565,5570 ---- > >
The mail filter protocol version and optional protocol extensions > > ! for communication with a Milter (mail filter) application. Postfix > > sends this version number during the initial protocol handshake. > > *************** > > *** 6155,6158 **** > >
An optional list of non-default Postfix configuration directories; > > - these directories belong to additional Postfix instances that share > > - the Postfix executable files and documentation with the default > > - Postfix instance, and that are started, stopped, etc., together > > - with the default Postfix instance. Specify a list of pathnames > > - separated by comma or whitespace.
> > - > > -When $multi_instance_directories is empty, the postfix(1) command > > - runs in single-instance mode and operates on a single Postfix > > - instance only. Otherwise, the postfix(1) command runs in multi-instance > > - mode and invokes the multi-instance manager specified with the > > - multi_instance_wrapper parameter. The multi-instance manager in > > - turn executes postfix(1) commands for the default instance and for > > - all Postfix instances in $multi_instance_directories.
> > - > > -Currently, this parameter setting is ignored except for the > > - default main.cf file.
> > - > > -This feature is available in Postfix 2.6 and later.
> > - > > - > > -Allow this Postfix instance to be started, stopped, etc., by a > > - multi-instance manager. By default, new instances are created in > > - a safe state that prevents them from being started inadvertently. > > - This parameter is reserved for the multi-instance manager.
> > - > > -This feature is available in Postfix 2.6 and later.
> > - > > - > > -The optional instance group name of this Postfix instance. A > > - group identifies closely-related Postfix instances that the > > - multi-instance manager can start, stop, etc., as a unit. This > > - parameter is reserved for the multi-instance manager.
> > - > > -This feature is available in Postfix 2.6 and later.
> > - > > - > > -The optional instance name of this Postfix instance. This name > > - becomes also the default value for the syslog_name parameter.
> > - > > -This feature is available in Postfix 2.6 and later.
> > - > > - > > -The pathname of a multi-instance manager command that the > > - postfix(1) command invokes when the multi_instance_directories > > - parameter value is non-empty. The pathname may be followed by > > - initial command arguments separated by whitespace; shell > > - metacharacters such as quotes are not supported in this context. > > -
> > - > > -The postfix(1) command invokes the manager command with the > > - postfix(1) non-option command arguments on the manager command line, > > - and with all installation configuration parameters exported into > > - the manager command process environment. The manager command in > > - turn invokes the postfix(1) command for individual Postfix instances > > - as "postfix -c config_directory command".
> > - > > -This feature is available in Postfix 2.6 and later.
> > - > > - > > -> > ! myhostname = host.example.com > >> > --- 5815,5817 ---- > >
> > ! myhostname = host.domain.tld > >> > *************** > > *** 6490,6492 **** > >
> > ! The list of "trusted" remote SMTP clients that have more privileges than > > "strangers". > > --- 5825,5827 ---- > >
> > ! The list of "trusted" SMTP clients that have more privileges than > > "strangers". > > *************** > > *** 6559,6561 **** > >
Specify "mynetworks_style = subnet" when Postfix > > ! should "trust" remote SMTP clients in the same IP subnetworks as the local > > machine. On Linux, this works correctly only with interfaces > > --- 5894,5896 ---- > >
Specify "mynetworks_style = subnet" when Postfix > > ! should "trust" SMTP clients in the same IP subnetworks as the local > > machine. On Linux, this works correctly only with interfaces > > *************** > > *** 6564,6566 **** > >
Specify "mynetworks_style = class" when Postfix should > > ! "trust" remote SMTP clients in the same IP class A/B/C networks as the > > local machine. Don't do this with a dialup site - it would cause > > --- 5899,5901 ---- > >
Specify "mynetworks_style = class" when Postfix should > > ! "trust" SMTP clients in the same IP class A/B/C networks as the > > local machine. Don't do this with a dialup site - it would cause > > *************** > > *** 6645,6648 **** > > via the Postfix qmqpd(8) server, and old mail that is re-injected > > ! into the queue with "postsuper -r". Specify space or comma as > > ! separator. See the MILTER_README document for details.
> > > > --- 5980,5983 ---- > > via the Postfix qmqpd(8) server, and old mail that is re-injected > > ! into the queue with "postsuper -r". See the MILTER_README document > > ! for details. > > > > *************** > > *** 6688,6697 **** > > > > -The postfix(1) commands that the postmulti(1) instance manager > > ! treats as "control" commands, that operate on running instances. For > > ! these commands, disabled instances are skipped.
> > ! > > !This feature is available in Postfix 2.6 and later.
> > > > > > !The postfix(1) commands that the postmulti(1) instance manager treats > > ! as "start" commands. For these commands, disabled instances are "checked" > > ! rather than "started", and failure to "start" a member instance of an > > ! instance group will abort the start-up of later instances.
> > > > !This feature is available in Postfix 2.6 and later.
> > > > --- 6138,6165 ---- > > > > !The message delivery contexts where the Postfix local(8) delivery > > + agent prepends a Delivered-To: message header with the address > > + that the mail was delivered to. This information is used for mail > > + delivery loop detection.
> > > > !> > ! By default, the Postfix local delivery agent prepends a Delivered-To: > > ! header when forwarding mail and when delivering to file (mailbox) > > ! and command. Turning off the Delivered-To: header when forwarding > > ! mail is not recommended. > > !
> > > > !> > ! Specify zero or more of forward, file, or command. > > !
> > > > !> > ! Example: > > !
> > > > !> > ! prepend_delivered_header = forward > > !> > > > *************** > > *** 6837,6846 **** > > > > !
The postfix(1) commands that the postmulti(1) instance manager treats > > ! as "stop" commands. For these commands, disabled instances are skipped, > > ! and enabled instances are processed in reverse order.
> > > > !This feature is available in Postfix 2.6 and later.
> > > > --- 6168,6175 ---- > > > > !> > ! The process ID of a Postfix command or daemon process. > > !
> > > > *************** > > *** 6849,6945 **** > > > > !Permanent white/blacklist for remote SMTP client IP addresses. > > ! postscreen(8) searches this list immediately after a remote SMTP > > ! client connects. Specify a comma- or whitespace-separated list of > > ! commands (in upper or lower case) or lookup tables. The search stops > > ! upon the first command that fires for the client IP address.
> > > > -Example:
> > > > !> > ! /etc/postfix/main.cf: > > ! postscreen_access_list = permit_mynetworks, > > ! cidr:/etc/postfix/postscreen_access.cidr > > ! postscreen_blacklist_action = enforce > > !> > > > !
> > ! /etc/postfix/postscreen_access.cidr: > > ! # Rules are evaluated in the order as specified. > > ! # Blacklist 192.168.* except 192.168.0.1. > > ! 192.168.0.1 dunno > > ! 192.168.0.0/16 reject > > !> > > > !
This feature is available in Postfix 2.8.
> > > > > > !The action that postscreen(8) takes when a remote SMTP client sends > > ! a bare newline character, that is, a newline not preceded by carriage > > ! return. Specify one of the following:
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6178,6265 ---- > > > > !> > ! The location of Postfix PID files relative to $queue_directory. > > ! This is a read-only parameter. > > !
> > > > > > !> > ! The process name of a Postfix command or daemon process. > > !
> > > > > > !> > ! What address lookup tables copy an address extension from the lookup > > ! key to the lookup result. > > !
> > > > +> > + For example, with a virtual(5) mapping of "joe at example.com => > > + joe.user at example.net", the address "joe+foo at example.com" > > + would rewrite to "joe.user+foo at example.net". > > +
> > > > !> > ! Specify zero or more of canonical, virtual, alias, > > ! forward, include or generic. These cause > > ! address extension > > ! propagation with canonical(5), virtual(5), and aliases(5) maps, > > ! with local(8) .forward and :include: file lookups, and with smtp(8) > > ! generic maps, respectively.
> > > > !> > ! Note: enabling this feature for types other than canonical > > ! and virtual is likely to cause problems when mail is forwarded > > ! to other sites, especially with mail that is sent to a mailing list > > ! exploder address. > > !
> > > > !> > ! Examples: > > !
> > > > !> > ! propagate_unmatched_extensions = canonical, virtual, alias, > > ! forward, include > > ! propagate_unmatched_extensions = canonical, virtual > > !> > > > > > !
> > ! The network interface addresses that this mail system receives mail > > ! on by way of a proxy or network address translation unit. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > !You must specify your "outside" proxy/NAT addresses when your > > ! system is a backup MX host for other domains, otherwise mail delivery > > ! loops will happen when the primary MX host is down.
> > > > !> > ! Example: > > !
> > > > !> > ! proxy_interfaces = 1.2.3.4 > > !> > > > *************** > > *** 6948,6959 **** > > > > !
Enable "bare newline" SMTP protocol tests in the postscreen(8) > > ! server. These tests are expensive: a remote SMTP client must > > ! disconnect after > > ! it passes the test, before it can talk to a real Postfix SMTP server. > >
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6268,6281 ---- > > > > !> > ! The lookup tables that the proxymap(8) server is allowed to > > ! access for the read-only service. > > ! Table references that don't begin with proxy: are ignored. > >
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > *************** > > *** 6962,6978 **** > > > > !The amount of time that postscreen(8) will use the result from > > ! a successful "bare newline" SMTP protocol test. During this > > ! time, the client IP address is excluded from this test. The default > > ! is long because a remote SMTP client must disconnect after it passes > > ! the test, > > ! before it can talk to a real Postfix SMTP server.
> > > > !Specify a non-zero time value (an integral value plus an optional > > ! one-letter suffix that specifies the time unit). Time units: s > > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6284,6296 ---- > > > > !The lookup tables that the proxymap(8) server is allowed to > > ! access for the read-write service. Postfix-owned local database > > ! files should be stored under the Postfix-owned data_directory. > > ! Table references that don't begin with proxy: are ignored.
> > > > !> > ! This feature is available in Postfix 2.5 and later. > > !
> > > > *************** > > *** 6981,7012 **** > > > > !The action that postscreen(8) takes when a remote SMTP client is > > ! permanently blacklisted with the postscreen_access_list parameter. > > ! Specify one of the following:
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6299,6332 ---- > > > > !> > ! The minimal delay between warnings that a specific destination is > > ! clogging up the Postfix active queue. Specify 0 to disable. > > !
> > > > !> > ! This feature is enabled with the helpful_warnings parameter. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > !> > ! Obsolete feature: the percentage of delivery resources that a busy > > ! mail system will use up for delivery of a large mailing list > > ! message. > > !
> > > > !> > ! This feature exists only in the oqmgr(8) old queue manager. The > > ! current queue manager solves the problem in a better way. > > !
> > > > *************** > > *** 7015,7035 **** > > > > !The amount of time between postscreen(8) cache cleanup runs. > > ! Cache cleanup increases the load on the cache database and should > > ! therefore not be run frequently. This feature requires that the > > ! cache database supports the "delete" and "sequence" operators. > > ! Specify a zero interval to disable cache cleanup.
> > ! > > !After each cache cleanup run, the postscreen(8) daemon logs the > > ! number of entries that were retained and dropped. A cleanup run is > > ! logged as "partial" when the daemon terminates early after "postfix > > ! reload", "postfix stop", or no requests for $max_idle > > ! seconds.
> > ! > > !Time units: s (seconds), m (minutes), h (hours), d (days), w > > ! (weeks).
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6335,6342 ---- > > > > !> > ! The maximal number of messages in the active queue. > > !
> > > > *************** > > *** 7038,7084 **** > > > > !Persistent storage for the postscreen(8) server decisions.
> > > > -To share a postscreen(8) cache between multiple postscreen(8) > > - instances, use "postscreen_cache_map = proxy:btree:/path/to/file". > > - This requires Postfix version 2.9 or later; earlier proxymap(8) > > - implementations don't support cache cleanup. For an alternative > > - approach see the memcache_table(5) manpage.
> > > > !This feature is available in Postfix 2.8.
> > > > > > !The amount of time that postscreen(8) will cache an expired > > ! temporary whitelist entry before it is removed. This prevents clients > > ! from being logged as "NEW" just because their cache entry expired > > ! an hour ago. It also prevents the cache from filling up with clients > > ! that passed some deep protocol test once and never came back.
> > > > !Time units: s (seconds), m (minutes), h (hours), d (days), w > > ! (weeks).
> > > > !This feature is available in Postfix 2.8.
> > > > > > !How many simultaneous connections any remote SMTP client is > > ! allowed to have > > ! with the postscreen(8) daemon. By default, this limit is the same > > ! as with the Postfix SMTP server. Note that the triage process can > > ! take several seconds, with the time spent in postscreen_greet_wait > > ! delay, and with the time spent talking to the postscreen(8) built-in > > ! dummy SMTP protocol engine.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6345,6404 ---- > > > > !The maximal number of recipients held in memory by the Postfix > > ! queue manager, and the maximal size of the size of the short-term, > > ! in-memory "dead" destination status cache.
> > > > > > !> > ! The minimal number of in-memory recipients for any message. This > > ! takes priority over any other in-memory recipient limits (i.e., > > ! the global qmgr_message_recipient_limit and the per transport > > ! _recipient_limit) if necessary. The minimum value allowed for this > > ! parameter is 1. > > !
> > > > > > !> > ! What clients are allowed to connect to the QMQP server port. > > !
> > > > +> > + By default, no client is allowed to use the service. This is > > + because the QMQP server will relay mail to any destination. > > +
> > > > !> > ! Specify a list of client patterns. A list pattern specifies a host > > ! name, a domain name, an internet address, or a network/mask pattern, > > ! where the mask specifies the number of bits in the network part. > > ! When a pattern specifies a file name, its contents are substituted > > ! for the file name; when a pattern is a "type:table" table specification, > > ! table lookup is used instead.
> > > > !> > ! Patterns are separated by whitespace and/or commas. In order to > > ! reverse the result, precede a pattern with an > > ! exclamation point (!). The form "!/file/name" is supported only > > ! in Postfix version 2.4 and later. > > !
> > > > !> > ! Example: > > !
> > > > !> > ! qmqpd_authorized_clients = !192.168.0.1, 192.168.0.0/24 > > !> > > > *************** > > *** 7087,7098 **** > > > > !
The limit on the total number of commands per SMTP session for > > ! postscreen(8)'s built-in SMTP protocol engine. This SMTP engine > > ! defers or rejects all attempts to deliver mail, therefore there is > > ! no need to enforce separate limits on the number of junk commands > > ! and error commands.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6407,6416 ---- > > > > !Enable logging of the remote QMQP client port in addition to > > ! the hostname and IP address. The logging format is "host[address]:port". > > !
> > > > !This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 7101,7109 **** > > > > !A mechanism to transform commands from remote SMTP clients. > > ! See smtpd_command_filter for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 6419,6433 ---- > > > > !> > ! How long the QMQP server will pause before sending a negative reply > > ! to the client. The purpose is to slow down confused or malicious > > ! clients. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > *************** > > *** 7112,7120 **** > > > > !The time limit to read an entire command line with postscreen(8)'s > > ! built-in SMTP protocol engine.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6436,6450 ---- > > > > !> > ! The time limit for sending or receiving information over the network. > > ! If a read or write operation blocks for more than $qmqpd_timeout > > ! seconds the QMQP server gives up and disconnects. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > *************** > > *** 7123,7131 **** > > > > !Disable the SMTP VRFY command in the postscreen(8) daemon. See > > ! disable_vrfy_command for details.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6453,6461 ---- > > > > !> > ! The location of the Postfix top-level queue directory. This is the > > ! root directory of Postfix daemon processes that run chrooted. > > !
> > > > *************** > > *** 7134,7145 **** > > > > !Lookup tables, indexed by the remote SMTP client address, with > > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > > ! etc.) that the postscreen(8) server will not send in the EHLO response > > ! to a remote SMTP client. See smtpd_discard_ehlo_keywords for details. > > ! The table is not searched by hostname for robustness reasons.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 6464,6477 ---- > > > > !> > ! The maximal number of (name=value) attributes that may be stored > > ! in a Postfix queue file. The limit is enforced by the cleanup(8) > > ! server. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > *************** > > *** 7148,7193 **** > > > > !A case insensitive list of EHLO keywords (pipelining, starttls, > > ! auth, etc.) that the postscreen(8) server will not send in the EHLO > > ! response to a remote SMTP client. See smtpd_discard_ehlo_keywords > > ! for details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > > > !The action that postscreen(8) takes when a remote SMTP client's combined > > ! DNSBL score is equal to or greater than a threshold (as defined > > ! with the postscreen_dnsbl_sites and postscreen_dnsbl_threshold > > ! parameters). Specify one of the following:
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6480,6535 ---- > > > > !> > ! The minimal amount of free space in bytes in the queue file system > > ! that is needed to receive mail. This is currently used by the SMTP > > ! server to decide if it will accept any mail at all. > > !
> > > > +> > + By default, the Postfix version 2.1 SMTP server rejects MAIL FROM commands > > + when the amount of free space is less than 1.5*$message_size_limit. > > + To specify a higher minimum free space limit, specify a queue_minfree > > + value that is at least 1.5*$message_size_limit. > > +
> > > > !> > ! With Postfix versions 2.0 and earlier, a queue_minfree value of > > ! zero means there is no minimum required amount of free space. > > !
> > > > > > !> > ! The time between deferred queue scans by the queue manager; > > ! prior to Postfix 2.4 the default value was 1000s. > > !
> > > > !This parameter should be set less than or equal to > > ! $minimal_backoff_time. See also $maximal_backoff_time.
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > > > !> > ! The name of the qmgr(8) service. This service manages the Postfix > > ! queue and schedules delivery requests. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > *************** > > *** 7196,7224 **** > > > > !A mapping from actual DNSBL domain name which includes a secret > > ! password, to the DNSBL domain name that postscreen will reply with > > ! when it rejects mail. When no mapping is found, the actual DNSBL > > ! domain will be used.
> > > > !For maximal stability it is best to use a file that is read > > ! into memory such as pcre:, regexp: or texthash: (texthash: is similar > > ! to hash:, except a) there is no need to run postmap(1) before the > > ! file can be used, and b) texthash: does not detect changes after > > ! the file is read).
> > > > -Example:
> > > > !> > ! /etc/postfix/main.cf: > > ! postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply > > !> > > > !
> > ! /etc/postfix/dnsbl_reply: > > ! secret.zen.spamhaus.org zen.spamhaus.org > > !> > > > !
This feature is available in Postfix 2.8.
> > > > --- 6538,6564 ---- > > > > !> > ! Optional lookup tables with RBL response templates. The tables are > > ! indexed by the RBL domain name. By default, Postfix uses the default > > ! template as specified with the default_rbl_reply configuration > > ! parameter. See there for a discussion of the syntax of RBL reply > > ! templates. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > !> > ! The location of Postfix README files that describe how to build, > > ! configure or operate a specific Postfix subsystem or feature. > > !
> > > > *************** > > *** 7227,7286 **** > > > > !Optional list of DNS white/blacklist domains, filters and weight > > ! factors. When the list is non-empty, the dnsblog(8) daemon will > > ! query these domains with the IP addresses of remote SMTP clients, > > ! and postscreen(8) will update an SMTP client's DNSBL score with > > ! each non-error reply.
> > > > !Caution: when postscreen rejects mail, it replies with the DNSBL > > ! domain name. Use the postscreen_dnsbl_reply_map feature to hide > > ! "password" information in DNSBL domain names.
> > > > !When a client's score is equal to or greater than the threshold > > ! specified with postscreen_dnsbl_threshold, postscreen(8) can drop > > ! the connection with the remote SMTP client.
> > > > !Specify a list of domain=filter*weight entries, separated by > > ! comma or whitespace.
> > > > !When no "=filter" is specified, postscreen(8) will use any > > ! non-error DNSBL reply. Otherwise, postscreen(8) uses only DNSBL > > ! replies that match the filter. The filter has the form d.d.d.d, > > ! where each d is a number, or a pattern inside [] that contains one > > ! or more ";"-separated numbers or number..number ranges.
> > ! > > !When no "*weight" is specified, postscreen(8) increments > > ! the remote SMTP client's DNSBL score by 1. Otherwise, the weight must be > > ! an integral number, and postscreen(8) adds the specified weight to > > ! the remote SMTP client's DNSBL score. Specify a negative number for > > ! whitelisting.
> > > > !When one postscreen_dnsbl_sites entry produces multiple > > ! DNSBL responses, postscreen(8) applies the weight at most once. > > !
> > > > !Examples:
> > > > !To use example.com as a high-confidence blocklist, and to > > ! block mail with example.net and example.org only when both agree: > > !
> > > > !> > ! postscreen_dnsbl_threshold = 2 > > ! postscreen_dnsbl_sites = example.com*2, example.net, example.org > > !> > > > !
To filter only DNSBL replies containing 127.0.0.4:
> > > >> > ! postscreen_dnsbl_sites = example.com=127.0.0.4 > >> > > > !
This feature is available in Postfix 2.8.
> > > > --- 6567,6628 ---- > > > > !Enable or disable recipient validation, built-in content > > ! filtering, or address mapping. Typically, these are specified in > > ! master.cf as command-line arguments for the smtpd(8), qmqpd(8) or > > ! pickup(8) daemons.
> > ! > > !Specify zero or more of the following options. The options > > ! override main.cf settings and are either implemented by smtpd(8), > > ! qmqpd(8), or pickup(8) themselves, or they are forwarded to the > > ! cleanup server.
> > ! > > !> > ! Note: when the "BEFORE content filter" receive_override_options > > ! setting is specified in the main.cf file, specify the "AFTER content > > ! filter" receive_override_options setting in master.cf (and vice > > ! versa). > > !
> > > > !> > ! Examples: > > !
> > > >> > ! receive_override_options = > > ! no_unknown_recipient_checks, no_header_body_checks > > ! receive_override_options = no_address_mappings > >> > > > !
> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > *************** > > *** 7289,7341 **** > > > > !The inclusive lower bound for blocking a remote SMTP client, based on > > ! its combined DNSBL score as defined with the postscreen_dnsbl_sites > > ! parameter.
> > ! > > !This feature is available in Postfix 2.8.
> > ! > > > > !The amount of time that postscreen(8) will use the result from > > ! a successful DNS blocklist test. During this time, the client IP address > > ! is excluded from this test. The default is relatively short, because a > > ! good client can immediately talk to a real Postfix SMTP server. > >
> > > > !Specify a non-zero time value (an integral value plus an optional > > ! one-letter suffix that specifies the time unit). Time units: s > > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > > > !This feature is available in Postfix 2.8.
> > > > > > !Mandatory TLS: announce STARTTLS support to remote SMTP clients, and > > ! require that clients use TLS encryption. See smtpd_postscreen_enforce_tls > > ! for details.
> > > > !This feature is available in Postfix 2.8 and later. > > ! Preferably, use postscreen_tls_security_level instead.
> > > > > > !List of characters that are permitted in postscreen_reject_footer > > ! attribute expansions. See smtpd_expansion_filter for further > > ! details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 6631,6690 ---- > > > > !> > ! Optional BCC (blind carbon-copy) address lookup tables, indexed by > > ! recipient address. The BCC address (multiple results are not > > ! supported) is added when mail enters from outside of Postfix. > > !
> > > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > !> > ! The table search order is as follows: > >
> > > > !> > + Specify the types and names of databases to use. After change, > > + run "postmap /etc/postfix/recipient_bcc". > > +
> > > > !> > ! Note: if mail to the BCC address bounces it will be returned to > > ! the sender. > > !
> > > > !Note: automatic BCC recipients are produced only for new mail. > > ! To avoid mailer loops, automatic BCC recipients are not generated > > ! for mail that Postfix forwards internally, nor for mail that Postfix > > ! generates itself.
> > > > !> > ! Example: > > !
> > > > !> > ! recipient_bcc_maps = hash:/etc/postfix/recipient_bcc > > !> > > > *************** > > *** 7344,7354 **** > > > > !
List of commands that the postscreen(8) server considers in > > ! violation of the SMTP protocol. See smtpd_forbidden_commands for > > ! syntax, and postscreen_non_smtp_command_action for possible actions. > >
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6693,6706 ---- > > > > !What addresses are subject to recipient_canonical_maps address > > ! mapping. By default, recipient_canonical_maps address mapping is > > ! applied to envelope recipient addresses, and to header recipient > > ! addresses.
> > > > !Specify one or more of: envelope_recipient, header_recipient > >
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 7357,7391 **** > > > > !The action that postscreen(8) takes when a remote SMTP client speaks > > ! before its turn within the time specified with the postscreen_greet_wait > > ! parameter. Specify one of the following:
> > > > !In either case, postscreen(8) will not whitelist the remote SMTP client > > ! IP address.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6709,6752 ---- > > > > !> > ! Optional address mapping lookup tables for envelope and header > > ! recipient addresses. > > ! The table format and lookups are documented in canonical(5). > > !
> > > > !> > ! Note: $recipient_canonical_maps is processed before $canonical_maps. > > !
> > > > !> > ! Example: > > !
> > > > !> > ! recipient_canonical_maps = hash:/etc/postfix/recipient_canonical > > !> > > > > > !
> > ! The separator between user names and address extensions (user+foo). > > ! See canonical(5), local(8), relocated(5) and virtual(5) for the > > ! effects this has on aliases, canonical, virtual, relocated and > > ! on .forward file lookups. Basically, the software tries user+foo > > ! and .forward+foo before trying user and .forward. > > !
> > > > !> > ! Example: > > !
> > > > !> > ! recipient_delimiter = + > > !> > > > *************** > > *** 7394,7406 **** > > > > !
The text in the optional "220-text..." server > > ! response that > > ! postscreen(8) sends ahead of the real Postfix SMTP server's "220 > > ! text..." response, in an attempt to confuse bad SMTP clients so > > ! that they speak before their turn (pre-greet). Specify an empty > > ! value to disable this feature.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6755,6767 ---- > > > > !> > ! The numerical Postfix SMTP server response code when a remote SMTP > > ! client request is rejected by the "reject" restriction. > > !
> > > > !> > ! Do not change this unless you have a complete understanding of RFC 2821. > > !
> > > > *************** > > *** 7409,7442 **** > > > > !The amount of time that postscreen(8) will use the result from > > ! a successful PREGREET test. During this time, the client IP address > > ! is excluded from this test. The default is relatively short, because > > ! a good client can immediately talk to a real Postfix SMTP server.
> > ! > > !Specify a non-zero time value (an integral value plus an optional > > ! one-letter suffix that specifies the time unit). Time units: s > > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! > > !This feature is available in Postfix 2.8.
> > ! > > > > !The amount of time that postscreen(8) will wait for an SMTP > > ! client to send a command before its turn, and for DNS blocklist > > ! lookup results to arrive (default: up to 2 seconds under stress, > > ! up to 6 seconds otherwise).
> > > > !
Specify a non-zero time value (an integral value plus an optional > > ! one-letter suffix that specifies the time unit).
> > > > !Time units: s (seconds), m (minutes), h (hours), d (days), w > > ! (weeks).
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6770,6797 ---- > > > > !List of tables with remote SMTP client-certificate fingerprints > > ! for which the Postfix SMTP server will allow access with the > > ! permit_tls_clientcerts feature. > > ! The fingerprint digest algorithm is configurable via the > > ! smtpd_tls_fingerprint_digest parameter (hard-coded as md5 prior to > > ! Postfix version 2.5).
> > > > !Postfix lookup tables are in the form of (key, value) pairs. > > ! Since we only need the key, the value can be chosen freely, e.g. > > ! the name of the user or host: > > ! D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home
> > > > !Example:
> > > > !> > ! relay_clientcerts = hash:/etc/postfix/relay_clientcerts > > !> > > > !
For more fine-grained control, use check_ccert_access to select > > ! an appropriate access(5) policy for each client. > > ! See RESTRICTION_CLASS_README.
> > > > !This feature is available with Postfix version 2.2.
> > > > *************** > > *** 7445,7453 **** > > > > !Require that a remote SMTP client sends HELO or EHLO before > > ! commencing a MAIL transaction.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6800,6810 ---- > > > > !The maximal number of parallel deliveries to the same destination > > ! via the relay message delivery transport. This limit is enforced > > ! by the queue manager. The message delivery transport name is the > > ! first field in the entry in the master.cf file.
> > > > !This feature is available in Postfix 2.0 and later.
> > > > *************** > > *** 7456,7502 **** > > > > !The action that postscreen(8) takes when a remote SMTP client sends > > ! non-SMTP commands as specified with the postscreen_forbidden_commands > > ! parameter. Specify one of the following:
> > > > !This feature is available in Postfix 2.8.
> > > > > > !Enable "non-SMTP command" tests in the postscreen(8) server. These > > ! tests are expensive: a client must disconnect after it passes the > > ! test, before it can talk to a real Postfix SMTP server.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6813,6859 ---- > > > > !The maximal number of recipients per message for the relay > > ! message delivery transport. This limit is enforced by the queue > > ! manager. The message delivery transport name is the first field in > > ! the entry in the master.cf file.
> > > > !Setting this parameter to a value of 1 changes the meaning of > > ! relay_destination_concurrency_limit from concurrency per domain > > ! into concurrency per recipient.
> > > > !This feature is available in Postfix 2.0 and later.
> > > > > > !What destination domains (and subdomains thereof) this system > > ! will relay mail to. Subdomain matching is controlled with the > > ! parent_domain_matches_subdomains parameter. For details about how > > ! the relay_domains value is used, see the description of the > > ! permit_auth_destination and reject_unauth_destination SMTP recipient > > ! restrictions.
> > > > !Domains that match $relay_domains are delivered with the > > ! $relay_transport mail delivery transport. The SMTP server validates > > ! recipient addresses with $relay_recipient_maps and rejects non-existent > > ! recipients. See also the relay domains address class in the > > ! ADDRESS_CLASS_README file.
> > > > !Note: Postfix will not automatically forward mail for domains > > ! that list this system as their primary or backup MX host. See the > > ! permit_mx_backup restriction in the postconf(5) manual page.
> > > > !Specify a list of host or domain names, "/file/name" patterns > > ! or "type:table" lookup tables, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. A > > ! "/file/name" pattern is replaced by its contents; a "type:table" > > ! lookup table is matched when a (parent) domain appears as lookup > > ! key. Specify "!pattern" to exclude a domain from the list. The form > > ! "!/file/name" is supported only in Postfix version 2.4 and later. > > !
> > > > *************** > > *** 7505,7520 **** > > > > !The amount of time that postscreen(8) will use the result from > > ! a successful "non_smtp_command" SMTP protocol test. During this > > ! time, the client IP address is excluded from this test. The default > > ! is long because a client must disconnect after it passes the test, > > ! before it can talk to a real Postfix SMTP server.
> > > > !Specify a non-zero time value (an integral value plus an optional > > ! one-letter suffix that specifies the time unit). Time units: s > > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6862,6875 ---- > > > > !> > ! The numerical Postfix SMTP server response code when a client > > ! request is rejected by the reject_unauth_destination recipient > > ! restriction. > > !
> > > > !> > ! Do not change this unless you have a complete understanding of RFC 2821. > > !
> > > > *************** > > *** 7523,7569 **** > > > > !The action that postscreen(8) takes when a remote SMTP client > > ! sends > > ! multiple commands instead of sending one command and waiting for > > ! the server to respond. Specify one of the following:
> > ! > > !This feature is available in Postfix 2.8.
> > > > > > !Enable "pipelining" SMTP protocol tests in the postscreen(8) > > ! server. These tests are expensive: a good client must disconnect > > ! after it passes the test, before it can talk to a real Postfix SMTP > > ! server.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6878,6944 ---- > > > > !Optional lookup tables with all valid addresses in the domains > > ! that match $relay_domains. Specify @domain as a wild-card for > > ! domains that have no valid recipient list, and become a source of > > ! backscatter mail: Postfix accepts spam for non-existent recipients > > ! and then floods innocent people with undeliverable mail. Technically, > > ! tables > > ! listed with $relay_recipient_maps are used as lists: Postfix needs > > ! to know only if a lookup string is found or not, but it does not > > ! use the result from table lookup.
> > > > !> > ! If this parameter is non-empty, then the Postfix SMTP server will reject > > ! mail to unknown relay users. This feature is off by default. > > !
> > > > !> > ! See also the relay domains address class in the ADDRESS_CLASS_README > > ! file. > > !
> > > > !> > ! Example: > > !
> > > > !> > ! relay_recipient_maps = hash:/etc/postfix/relay_recipients > > !> > > > !
> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > !> > ! The default mail delivery transport and next-hop destination for > > ! remote delivery to domains listed with $relay_domains. In order of > > ! decreasing precedence, the nexthop destination is taken from > > ! $relay_transport, $sender_dependent_relayhost_maps, $relayhost, or > > ! from the recipient domain. This information can be overruled with > > ! the transport(5) table. > > !
> > > > !> > ! Specify a string of the form transport:nexthop, where transport > > ! is the name of a mail delivery transport defined in master.cf. > > ! The :nexthop part is optional. For more details see the > > ! transport(5) manual page. > > !
> > > > !> > ! See also the relay domains address class in the ADDRESS_CLASS_README > > ! file. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > *************** > > *** 7572,7614 **** > > > > !The amount of time that postscreen(8) will use the result from > > ! a successful "pipelining" SMTP protocol test. During this time, the > > ! client IP address is excluded from this test. The default is > > ! long because a good client must disconnect after it passes the test, > > ! before it can talk to a real Postfix SMTP server.
> > > > !Specify a non-zero time value (an integral value plus an optional > > ! one-letter suffix that specifies the time unit). Time units: s > > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > > > !This feature is available in Postfix 2.8.
> > > > > > !The number of clients that can be waiting for service from a > > - real Postfix SMTP server process. When this queue is full, all > > - clients will > > - receive a 421 reponse.
> > > > !This feature is available in Postfix 2.8.
> > > > > > !The number of non-whitelisted clients that can be waiting for > > ! a decision whether they will receive service from a real Postfix > > ! SMTP server > > ! process. When this queue is full, all non-whitelisted clients will > > ! receive a 421 reponse.
> > > > !This feature is available in Postfix 2.8.
> > > > --- 6947,7012 ---- > > > > !> > ! The next-hop destination of non-local mail; overrides non-local > > ! domains in recipient addresses. This information is overruled with > > ! relay_transport, default_transport, sender_dependent_relayhost_maps > > ! and with the transport(5) table. > > !
> > > > !> > ! On an intranet, specify the organizational domain name. If your > > ! internal DNS uses no MX records, specify the name of the intranet > > ! gateway host instead. > > !
> > > > !> > ! In the case of SMTP, specify a domain name, hostname, hostname:port, > > ! [hostname]:port, [hostaddress] or [hostaddress]:port. The form > > ! [hostname] turns off MX lookups. > > !
> > > > +> > + If you're connected via UUCP, see the UUCP_README file for useful > > + information. > > +
> > > > !> > ! Examples: > > !
> > > > !> > ! relayhost = $mydomain > > ! relayhost = [gateway.my.domain] > > ! relayhost = uucphost > > ! relayhost = [an.ip.add.ress] > > !> > > > > > !
> > ! Optional lookup tables with new contact information for users or > > ! domains that no longer exist. The table format and lookups are > > ! documented in relocated(5). > > !
> > > > !> > ! If you use this feature, run "postmap /etc/postfix/relocated" to > > ! build the necessary DBM or DB file after change, then "postfix > > ! reload" to make the changes visible. > > !
> > > > !> > ! Examples: > > !
> > > > !> > ! relocated_maps = dbm:/etc/postfix/relocated > > ! relocated_maps = hash:/etc/postfix/relocated > > !> > > > *************** > > *** 7617,7639 **** > > > > !
Optional information that is appended after a 4XX or 5XX > > ! postscreen(8) server > > ! response. See smtpd_reject_footer for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > > > !The SMTP TLS security level for the postscreen(8) server; when > > ! a non-empty value is specified, this overrides the obsolete parameters > > ! postscreen_use_tls and postscreen_enforce_tls. See smtpd_tls_security_level > > ! for details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 7015,7045 ---- > > > > !Don't rewrite message headers from remote clients at all when > > ! this parameter is empty; otherwise, rewrite message headers and > > ! append the specified domain name to incomplete addresses. The > > ! local_header_rewrite_clients parameter controls what clients Postfix > > ! considers local.
> > > > +Examples:
> > > > !The safe setting: append "domain.invalid" to incomplete header > > ! addresses from remote SMTP clients, so that those addresses cannot > > ! be confused with local addresses.
> > > > !> > !> > > > !> > ! remote_header_rewrite_domain = domain.invalid > > !> > !
The default, purist, setting: don't rewrite headers from remote > > ! clients at all.
> > > > !> > !> > > > *************** > > *** 7642,7651 **** > > > > !> > ! remote_header_rewrite_domain = > > !> > !
Opportunistic TLS: announce STARTTLS support to remote SMTP clients, > > ! but do not require that clients use TLS encryption.
> > > > !This feature is available in Postfix 2.8 and later. > > ! Preferably, use postscreen_tls_security_level instead.
> > > > --- 7048,7058 ---- > > > > !> > ! Whether or not a local(8) recipient's home directory must exist > > ! before mail delivery is attempted. By default this test is disabled. > > ! It can be useful for environments that import home directories to > > ! the mail server (NOT RECOMMENDED). > > !
> > > > *************** > > *** 7654,7671 **** > > > > !How much time a postscreen(8) process may take to respond to > > ! a remote SMTP client command or to perform a cache operation before it > > ! is terminated by a built-in watchdog timer. This is a safety > > ! mechanism that prevents postscreen(8) from becoming non-responsive > > ! due to a bug in Postfix itself or in system software. To avoid > > ! false alarms and unnecessary cache corruption this limit cannot be > > ! set under 10s.
> > > > !Specify a non-zero time value (an integral value plus an optional > > ! one-letter suffix that specifies the time unit). Time units: s > > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > > > !This feature is available in Postfix 2.8.
> > > > --- 7061,7079 ---- > > > > !Resolve a recipient address safely instead of correctly, by > > ! looking inside quotes.
> > > > !By default, the Postfix address resolver does not quote the > > ! address localpart as per RFC 822, so that additional @ or % or ! > > ! operators remain visible. This behavior is safe but it is also > > ! technically incorrect.
> > > > !If you specify "resolve_dequoted_address = no", then > > ! the Postfix > > ! resolver will not know about additional @ etc. operators in the > > ! address localpart. This opens opportunities for obscure mail relay > > ! attacks with user at domain@domain addresses when Postfix provides > > ! backup MX service for Sendmail systems.
> > > > *************** > > *** 7674,7724 **** > > > > !A list of local postscreen(8) server IP addresses where a > > ! non-whitelisted remote SMTP client can obtain postscreen(8)'s temporary > > ! whitelist status. This status is required before the client can > > ! talk to a Postfix SMTP server process. By default, a client can > > ! obtain postscreen(8)'s whitelist status on any local postscreen(8) > > ! server IP address.
> > > > !When postscreen(8) listens on both primary and backup MX > > ! addresses, the postscreen_whitelist_interfaces parameter can be > > ! configured to give the temporary whitelist status only when a client > > ! connects to a primary MX address. Once a client is whitelisted it > > ! can talk to a Postfix SMTP server on any address. Thus, clients > > ! that connect only to backup MX addresses will never become whitelisted, > > ! and will never be allowed to talk to a Postfix SMTP server process. > > !
> > > > !Example:
> > > > -> > - /etc/postfix/main.cf: > > - # Don't whitelist connections to the backup IP address. > > - postscreen_whitelist_interfaces = !168.100.189.8, static:all > > -> > > > !
This feature is available in Postfix 2.9 and later.
> > > > > > !The message delivery contexts where the Postfix local(8) delivery > > - agent prepends a Delivered-To: message header with the address > > - that the mail was delivered to. This information is used for mail > > - delivery loop detection.
> > > > !> > ! By default, the Postfix local delivery agent prepends a Delivered-To: > > ! header when forwarding mail and when delivering to file (mailbox) > > ! and command. Turning off the Delivered-To: header when forwarding > > ! mail is not recommended. > > !
> > > >> > ! Specify zero or more of forward, file, or command. > >
> > --- 7082,7119 ---- > > > > !Resolve an address that ends in the "@" null domain as if the > > ! local hostname were specified, instead of rejecting the address as > > ! invalid.
> > > > !This feature is available in Postfix 2.1 and later. > > ! Earlier versions always resolve the null domain as the local > > ! hostname.
> > > > !The Postfix SMTP server uses this feature to reject mail from > > ! or to addresses that end in the "@" null domain, and from addresses > > ! that rewrite into a form that ends in the "@" null domain.
> > > > > > !Resolve "user at ipaddress" as "user@[ipaddress]", instead of > > ! rejecting the address as invalid.
> > > > !This feature is available in Postfix 2.3 and later. > > > > > > !
> > ! The name of the address rewriting service. This service rewrites > > ! addresses to standard form and resolves them to a (delivery method, > > ! next-hop host, recipient) triple. > >
> > *************** > > *** 7726,7734 **** > >> > ! Example: > >
> > > > -> > - prepend_delivered_header = forward > > -> > - > > > > --- 7121,7125 ---- > >
> > ! This feature is available in Postfix 2.0 and later. > >
> > > > > > *************** > > *** 7736,7742 **** > > > > !> > ! The process ID of a Postfix command or daemon process. > >
> > --- 7127,7133 ---- > > > > !> > ! The name of the directory with example Postfix configuration files. > >
> > *************** > > *** 7746,7755 **** > > > > !> > ! The location of Postfix PID files relative to $queue_directory. > > ! This is a read-only parameter. > >
> > > > > > --- 7137,7153 ---- > > > > !When authenticating to a remote SMTP or LMTP server with the > > ! default setting "no", send no SASL authoriZation ID (authzid); send > > ! only the SASL authentiCation ID (authcid) plus the authcid's password. > >
> > > > +The non-default setting "yes" enables the behavior of older > > + Postfix versions. These always send a SASL authzid that is equal > > + to the SASL authcid, but this causes inter-operability problems > > + with some SMTP servers.
> > + > > +This feature is available in Postfix 2.4.4 and later.
> > + > > > > *************** > > *** 7757,7763 **** > > > > !> > ! The process name of a Postfix command or daemon process. > >
> > --- 7155,7162 ---- > > > > !> > ! This parameter should not be used. It was replaced by sender_dependent_relayhost_maps > > ! in Postfix version 2.3. > >
> > *************** > > *** 7767,7774 **** > > > > !> > ! What address lookup tables copy an address extension from the lookup > > ! key to the lookup result. > >
> > --- 7166,7176 ---- > > > > !Optional BCC (blind carbon-copy) address lookup tables, indexed > > ! by sender address. The BCC address (multiple results are not > > ! supported) is added when mail enters from outside of Postfix.
> > > >> > ! This feature is available in Postfix 2.1 and later. > >
> > *************** > > *** 7776,7816 **** > >> > ! For example, with a virtual(5) mapping of "joe at example.com => > > ! joe.user at example.net", the address "joe+foo at example.com" > > ! would rewrite to "joe.user+foo at example.net". > >
> > > > !> > ! Specify zero or more of canonical, virtual, alias, > > ! forward, include or generic. These cause > > ! address extension > > ! propagation with canonical(5), virtual(5), and aliases(5) maps, > > ! with local(8) .forward and :include: file lookups, and with smtp(8) > > ! generic maps, respectively.
> > > > !> > ! Note: enabling this feature for types other than canonical > > ! and virtual is likely to cause problems when mail is forwarded > > ! to other sites, especially with mail that is sent to a mailing list > > ! exploder address. > > !
> > > > !> > ! Examples: > > !
> > > > !> > ! propagate_unmatched_extensions = canonical, virtual, alias, > > ! forward, include > > ! propagate_unmatched_extensions = canonical, virtual > > !> > > > > > !
> > ! The network interface addresses that this mail system receives mail > > ! on by way of a proxy or network address translation unit. > >
> > --- 7178,7204 ---- > >> > ! The table search order is as follows: > >
> > > > !> > ! Specify the types and names of databases to use. After change, > > ! run "postmap /etc/postfix/sender_bcc". > >
> > *************** > > *** 7818,7825 **** > >> > ! This feature is available in Postfix 2.0 and later. > >
> > > > !You must specify your "outside" proxy/NAT addresses when your > > ! system is a backup MX host for other domains, otherwise mail delivery > > ! loops will happen when the primary MX host is down.
> > > > --- 7206,7215 ---- > >> > ! Note: if mail to the BCC address bounces it will be returned to > > ! the sender. > >
> > > > !Note: automatic BCC recipients are produced only for new mail. > > ! To avoid mailer loops, automatic BCC recipients are not generated > > ! for mail that Postfix forwards internally, nor for mail that Postfix > > ! generates itself.
> > > > *************** > > *** 7830,7832 **** > >> > ! proxy_interfaces = 1.2.3.4 > >> > --- 7220,7222 ---- > >
> > ! sender_bcc_maps = hash:/etc/postfix/sender_bcc > >> > *************** > > *** 7836,7875 **** > > > > !
> > ! The lookup tables that the proxymap(8) server is allowed to > > ! access for the read-only service. > > ! Table references that don't begin with proxy: are ignored. > >
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > -The lookup tables that the proxymap(8) server is allowed to > > ! access for the read-write service. Postfix-owned local database > > ! files should be stored under the Postfix-owned data_directory. > > ! Table references that don't begin with proxy: are ignored.
> > > >> > ! This feature is available in Postfix 2.5 and later. > >
> > > > > > !The name of the proxymap read-only table lookup service. This > > ! service is normally implemented by the proxymap(8) daemon.
> > ! > > !This feature is available in Postfix 2.6 and later.
> > > > --- 7226,7268 ---- > > > > !What addresses are subject to sender_canonical_maps address > > ! mapping. By default, sender_canonical_maps address mapping is > > ! applied to envelope sender addresses, and to header sender addresses. > >
> > > > !Specify one or more of: envelope_sender, header_sender
> > > > +This feature is available in Postfix 2.2 and later.
> > > > > > !> > ! Optional address mapping lookup tables for envelope and header > > ! sender addresses. > > ! The table format and lookups are documented in canonical(5). > >
> > > > +> > + Example: you want to rewrite the SENDER address "user at ugly.domain" > > + to "user at pretty.domain", while still being able to send mail to > > + the RECIPIENT address "user at ugly.domain". > > +
> > > > !> > ! Note: $sender_canonical_maps is processed before $canonical_maps. > > !
> > > > !> > ! Example: > > !
> > > > !> > ! sender_canonical_maps = hash:/etc/postfix/sender_canonical > > !> > > > *************** > > *** 7878,7905 **** > > > > !
The name of the proxywrite read-write table lookup service. > > ! This service is normally implemented by the proxymap(8) daemon. > > !
> > ! > > !This feature is available in Postfix 2.6 and later.
> > ! > > > > !> > ! The minimal delay between warnings that a specific destination is > > ! clogging up the Postfix active queue. Specify 0 to disable. > >
> > > > !> > ! This feature is enabled with the helpful_warnings parameter. > > !
> > > >> > ! This feature is available in Postfix 2.0 and later. > >
> > --- 7271,7297 ---- > > > > !A sender-dependent override for the global relayhost parameter > > ! setting. The tables are searched by the envelope sender address and > > ! @domain. This information is overruled with relay_transport, > > ! default_transport and with the transport(5) table.
> > > > !For safety reasons, this feature does not allow $number > > ! substitutions in regular expression maps.
> > > >> > ! This feature is available in Postfix 2.3 and later. > >
> > > > ! > > !> > ! A Sendmail compatibility feature that specifies the location of > > ! the Postfix sendmail(1) command. This command can be used to > > ! submit mail into the Postfix queue. > >
> > *************** > > *** 7909,7915 **** > > > > !How much time a Postfix queue manager process may take to handle > > ! a request before it is terminated by a built-in watchdog timer. > >
> > --- 7301,7308 ---- > > > > !> > ! How long the Postfix master(8) waits before forking a server that > > ! appears to be malfunctioning. > >
> > *************** > > *** 7921,7924 **** > > > > -This feature is available in Postfix 2.8 and later.
> > - > > > > --- 7314,7315 ---- > > *************** > > *** 7926,7939 **** > > > > !> > ! Obsolete feature: the percentage of delivery resources that a busy > > ! mail system will use up for delivery of a large mailing list > > ! message. > > !
> > > >> > ! This feature exists only in the oqmgr(8) old queue manager. The > > ! current queue manager solves the problem in a better way. > >
> > --- 7317,7326 ---- > > > > !> > ! The group ownership of set-gid Postfix commands and of group-writable > > ! Postfix directories. When this parameter value is changed you need > > ! to re-run "postfix set-permissions" (with Postfix version 2.0 and > > ! earlier: "/etc/postfix/post-install set-permissions". > >
> > *************** > > *** 7943,7967 **** > > > > !The time limit for the queue manager to send or receive information > > ! over an internal communication channel. The purpose is to break > > ! out of deadlock situations. If the time limit is exceeded the > > ! software either retries or aborts the operation.
> > > >> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > > > -This feature is available in Postfix 2.8 and later.
> > - > > - > > -> > ! The maximal number of messages in the active queue. > >
> > --- 7330,7342 ---- > > > > !> > ! Display the name of the recipient table in the "User unknown" > > ! responses. The extra detail makes trouble shooting easier but also > > ! reveals information that is nobody elses business. > >
> > > >> > ! This feature is available in Postfix 2.0 and later. > >
> > *************** > > *** 7971,7991 **** > > > > !The maximal number of recipients held in memory by the Postfix > > ! queue manager, and the maximal size of the size of the short-term, > > ! in-memory "dead" destination status cache.
> > ! > > ! > > !> > ! The minimal number of in-memory recipients for any message. This > > ! takes priority over any other in-memory recipient limits (i.e., > > ! the global qmgr_message_recipient_limit and the per transport > > ! _recipient_limit) if necessary. The minimum value allowed for this > > ! parameter is 1. > >
> > --- 7346,7357 ---- > > > > !> > ! The name of the showq(8) service. This service produces mail queue > > ! status reports. > > !
> > > >> > ! This feature is available in Postfix 2.0 and later. > >
> > *************** > > *** 7995,8002 **** > > > > !> > ! What remote QMQP clients are allowed to connect to the Postfix QMQP > > ! server port. > >
> > --- 7361,7367 ---- > > > > !> > ! Always send EHLO at the start of an SMTP session. > >
> > *************** > > *** 8004,8022 **** > >> > ! By default, no client is allowed to use the service. This is > > ! because the QMQP server will relay mail to any destination. > >
> > > > !> > ! Specify a list of client patterns. A list pattern specifies a host > > ! name, a domain name, an internet address, or a network/mask pattern, > > ! where the mask specifies the number of bits in the network part. > > ! When a pattern specifies a file name, its contents are substituted > > ! for the file name; when a pattern is a "type:table" table specification, > > ! table lookup is used instead.
> > > >> > ! Patterns are separated by whitespace and/or commas. In order to > > ! reverse the result, precede a pattern with an > > ! exclamation point (!). The form "!/file/name" is supported only > > ! in Postfix version 2.4 and later. > >
> > --- 7369,7384 ---- > >> > ! With "smtp_always_send_ehlo = no", Postfix sends EHLO only when > > ! the word "ESMTP" appears in the server greeting banner (example: > > ! 220 spike.porcupine.org ESMTP Postfix). > >
> > > > ! > > !> > ! An optional numerical network address that the Postfix SMTP client > > ! should bind to when making an IPv4 connection. > >
> > *************** > > *** 8024,8043 **** > >> > ! Example: > >
> > > >> > ! qmqpd_authorized_clients = !192.168.0.1, 192.168.0.0/24 > >> > > > > > !
Enable logging of the remote QMQP client port in addition to > > ! the hostname and IP address. The logging format is "host[address]:port". > > !
> > ! > > !This feature is available in Postfix 2.5 and later.
> > > > --- 7386,7407 ---- > >> > ! This can be specified in the main.cf file for all SMTP clients, or > > ! it can be specified in the master.cf file for a specific client, > > ! for example: > >
> > > > +> >> > > > +> > ! /etc/postfix/master.cf: > > ! smtp ... smtp -o smtp_bind_address=11.22.33.44 > >> > +
Note 1: when inet_interfaces specifies no more than one IPv4 > > + address, and that address is a non-loopback address, it is > > + automatically used as the smtp_bind_address. This supports virtual > > + IP hosting, but can be a problem on multi-homed firewalls. See the > > + inet_interfaces documentation for more detail.
> > > > !Note 2: address information may be enclosed inside [], > > ! but this form is not required here.
> > > > *************** > > *** 8046,8088 **** > > > > !> > ! How long the Postfix QMQP server will pause before sending a negative > > ! reply to the remote QMQP client. The purpose is to slow down confused > > ! or malicious clients. > > !
> > > >> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > > > ! > > !> > ! The time limit for sending or receiving information over the network. > > ! If a read or write operation blocks for more than $qmqpd_timeout > > ! seconds the Postfix QMQP server gives up and disconnects. > > !
> > > >> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > > > > > !> > ! The location of the Postfix top-level queue directory. This is the > > ! root directory of Postfix daemon processes that run chrooted. > > !
> > > > --- 7410,7442 ---- > > > > !> > ! An optional numerical network address that the Postfix SMTP client > > ! should bind to when making an IPv6 connection. > >
> > > > !This feature is available in Postfix 2.2 and later.
> > > >> > ! This can be specified in the main.cf file for all SMTP clients, or > > ! it can be specified in the master.cf file for a specific client, > > ! for example: > >
> > > > +> > +> > > > !> > + /etc/postfix/master.cf: > > + smtp ... smtp -o smtp_bind_address6=1:2:3:4:5:6:7:8 > > +> > +
Note 1: when inet_interfaces specifies no more than one IPv6 > > ! address, and that address is a non-loopback address, it is > > ! automatically used as the smtp_bind_address6. This supports virtual > > ! IP hosting, but can be a problem on multi-homed firewalls. See the > > ! inet_interfaces documentation for more detail.
> > > > !Note 2: address information may be enclosed inside [], > > ! but this form is not recommended here.
> > > > *************** > > *** 8091,8104 **** > > > > !> > ! The maximal number of (name=value) attributes that may be stored > > ! in a Postfix queue file. The limit is enforced by the cleanup(8) > > ! server. > >
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > --- 7445,7455 ---- > > > > !Restricted body_checks(5) tables for the Postfix SMTP client. > > ! These tables are searched while mail is being delivered. Actions > > ! that change the delivery time or destination are not available. > >
> > > > !This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 8107,8129 **** > > > > !> > ! The minimal amount of free space in bytes in the queue file system > > ! that is needed to receive mail. This is currently used by the > > ! Postfix SMTP server to decide if it will accept any mail at all. > > !
> > > > !> > ! By default, the Postfix SMTP server rejects MAIL FROM commands when > > ! the amount of free space is less than 1.5*$message_size_limit > > ! (Postfix version 2.1 and later). > > ! To specify a higher minimum free space limit, specify a queue_minfree > > ! value that is at least 1.5*$message_size_limit. > > !
> > > > !> > ! With Postfix versions 2.0 and earlier, a queue_minfree value of > > ! zero means there is no minimum required amount of free space. > > !
> > > > --- 7458,7471 ---- > > > > !Allow DNS CNAME records to override the servername that the > > ! Postfix SMTP client uses for logging, SASL password lookup, TLS > > ! policy decisions, or TLS certificate verification. The value "no" > > ! hardens Postfix smtp_tls_per_site hostname-based policies against > > ! false hostname information in DNS CNAME records, and makes SASL > > ! password file lookups more predictable. This is the default setting > > ! as of Postfix 2.3.
> > > > !This feature is available in Postfix 2.2.9 and later.
> > > > *************** > > *** 8132,8143 **** > > > > !> > ! The time between deferred queue scans by the queue manager; > > ! prior to Postfix 2.4 the default value was 1000s. > >
> > > > !This parameter should be set less than or equal to > > ! $minimal_backoff_time. See also $maximal_backoff_time.
> > > > --- 7474,7490 ---- > > > > !> > ! The SMTP client time limit for completing a TCP connection, or > > ! zero (use the operating system built-in time limit). > >
> > > > !> > ! When no connection can be made within the deadline, the Postfix > > ! SMTP client > > ! tries the next address on the mail exchanger list. Specify 0 to > > ! disable the time limit (i.e. use whatever timeout is implemented by > > ! the operating system). > > !
> > > > *************** > > *** 8151,8181 **** > > > > !> > ! The name of the qmgr(8) service. This service manages the Postfix > > ! queue and schedules delivery requests. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > !> > ! Optional lookup tables with RBL response templates. The tables are > > ! indexed by the RBL domain name. By default, Postfix uses the default > > ! template as specified with the default_rbl_reply configuration > > ! parameter. See there for a discussion of the syntax of RBL reply > > ! templates. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > --- 7498,7535 ---- > > > > !Permanently enable SMTP connection caching for the specified > > ! destinations. With SMTP connection caching, a connection is not > > ! closed immediately after completion of a mail transaction. Instead, > > ! the connection is kept open for up to $smtp_connection_cache_time_limit > > ! seconds. This allows connections to be reused for other deliveries, > > ! and can improve mail delivery performance.
> > > > !Specify a comma or white space separated list of destinations > > ! or pseudo-destinations:
> > > > +This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 8184,8192 **** > > > > !> > ! The location of Postfix README files that describe how to build, > > ! configure or operate a specific Postfix subsystem or feature. > > !
> > > > --- 7538,7551 ---- > > > > !Temporarily enable SMTP connection caching while a destination > > ! has a high volume of mail in the active queue. With SMTP connection > > ! caching, a connection is not closed immediately after completion > > ! of a mail transaction. Instead, the connection is kept open for > > ! up to $smtp_connection_cache_time_limit seconds. This allows > > ! connections to be reused for other deliveries, and can improve mail > > ! delivery performance.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 8195,8256 **** > > > > !Enable or disable recipient validation, built-in content > > ! filtering, or address mapping. Typically, these are specified in > > ! master.cf as command-line arguments for the smtpd(8), qmqpd(8) or > > ! pickup(8) daemons.
> > > > !Specify zero or more of the following options. The options > > ! override main.cf settings and are either implemented by smtpd(8), > > ! qmqpd(8), or pickup(8) themselves, or they are forwarded to the > > ! cleanup server.
> > > > -> > ! Note: when the "BEFORE content filter" receive_override_options > > ! setting is specified in the main.cf file, specify the "AFTER content > > ! filter" receive_override_options setting in master.cf (and vice > > ! versa). > > !
> > > > !> > ! Examples: > > !
> > > > !> > ! receive_override_options = > > ! no_unknown_recipient_checks, no_header_body_checks > > ! receive_override_options = no_address_mappings > > !> > > > !
> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > --- 7554,7629 ---- > > > > !When SMTP connection caching is enabled, the number of times that > > ! an SMTP session may be reused before it is closed. > > !
> > > > !This feature is available in Postfix 2.2. In Postfix 2.3 it is > > ! replaced by $smtp_connection_reuse_time_limit.
> > > > > > !When SMTP connection caching is enabled, the amount of time that > > ! an unused SMTP client socket is kept open before it is closed. Do > > ! not specify larger values without permission from the remote sites. > > !
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !The amount of time during which Postfix will use an SMTP > > ! connection repeatedly. The timer starts when the connection is > > ! initiated (i.e. it includes the connect, greeting and helo latency, > > ! in addition to the latencies of subsequent mail delivery transactions). > > !
> > > > !This feature addresses a performance stability problem with > > ! remote SMTP servers. This problem is not specific to Postfix: it > > ! can happen when any MTA sends large amounts of SMTP email to a site > > ! that has multiple MX hosts.
> > > > !The problem starts when one of a set of MX hosts becomes slower > > ! than the rest. Even though SMTP clients connect to fast and slow > > ! MX hosts with equal probability, the slow MX host ends up with more > > ! simultaneous inbound connections than the faster MX hosts, because > > ! the slow MX host needs more time to serve each client request.
> > > > !The slow MX host becomes a connection attractor. If one MX > > ! host becomes N times slower than the rest, it dominates mail delivery > > ! latency unless there are more than N fast MX hosts to counter the > > ! effect. And if the number of MX hosts is smaller than N, the mail > > ! delivery latency becomes effectively that of the slowest MX host > > ! divided by the total number of MX hosts.
> > > > !The solution uses connection caching in a way that differs from > > ! Postfix version 2.2. By limiting the amount of time during which a connection > > ! can be used repeatedly (instead of limiting the number of deliveries > > ! over that connection), Postfix not only restores fairness in the > > ! distribution of simultaneous connections across a set of MX hosts, > > ! it also favors deliveries over connections that perform well, which > > ! is exactly what we want.
> > > > !The default reuse time limit, 300s, is comparable to the various > > ! smtp transaction timeouts which are fair estimates of maximum excess > > ! latency for a slow delivery. Note that hosts may accept thousands > > ! of messages over a single connection within the default connection > > ! reuse time limit. This number is much larger than the default Postfix > > ! version 2.2 limit of 10 messages per cached connection. It may prove necessary > > ! to lower the limit to avoid interoperability issues with MTAs that > > ! exhibit bugs when many messages are delivered via a single connection. > > ! A lower reuse time limit risks losing the benefit of connection > > ! reuse when the average connection and mail delivery latency exceeds > > ! the reuse time limit.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 8259,8267 **** > > > > !> > ! Optional BCC (blind carbon-copy) address lookup tables, indexed by > > ! recipient address. The BCC address (multiple results are not > > ! supported) is added when mail enters from outside of Postfix. > >
> > --- 7632,7639 ---- > > > > !> > ! The SMTP client time limit for sending the SMTP ".", and for receiving > > ! the server response. > >
> > *************** > > *** 8269,8271 **** > >> > ! This feature is available in Postfix 2.1 and later. > >
> > --- 7641,7644 ---- > >> > ! When no response is received within the deadline, a warning is > > ! logged that the mail may be delivered multiple times. > >
> > *************** > > *** 8273,8319 **** > >> > ! The table search order is as follows: > >
> > > > -> > ! Specify the types and names of databases to use. After change, > > ! run "postmap /etc/postfix/recipient_bcc". > > !
> > > >> > ! Note: if mail to the BCC address bounces it will be returned to > > ! the sender. > >
> > > > -Note: automatic BCC recipients are produced only for new mail. > > - To avoid mailer loops, automatic BCC recipients are not generated > > - after Postfix forwards mail internally, or after Postfix generates > > - mail itself.
> > - > >> > ! Example: > >
> > > > -> > - recipient_bcc_maps = hash:/etc/postfix/recipient_bcc > > -> > - > > > > --- 7646,7667 ---- > >
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > > > > > !> > ! The SMTP client time limit for sending the SMTP DATA command, and for > > ! receiving the server response. > >
> > > >> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > > > > > *************** > > *** 8321,8334 **** > > > > !What addresses are subject to recipient_canonical_maps address > > ! mapping. By default, recipient_canonical_maps address mapping is > > ! applied to envelope recipient addresses, and to header recipient > > ! addresses.
> > > > !Specify one or more of: envelope_recipient, header_recipient > >
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 7669,7683 ---- > > > > !> > ! The SMTP client time limit for sending the SMTP message content. > > ! When the connection makes no progress for more than $smtp_data_xfer_timeout > > ! seconds the Postfix SMTP client terminates the transfer. > >
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > *************** > > *** 8337,8345 **** > > > > !> > ! Optional address mapping lookup tables for envelope and header > > ! recipient addresses. > > ! The table format and lookups are documented in canonical(5). > >
> > --- 7686,7692 ---- > > > > !> > ! Defer mail delivery when no MX record resolves to an IP address. > >
> > *************** > > *** 8347,8349 **** > >> > ! Note: $recipient_canonical_maps is processed before $canonical_maps. > >
> > --- 7694,7698 ---- > >> > ! The default (no) is to return the mail as undeliverable. With older > > ! Postfix versions the default was to keep trying to deliver the mail > > ! until someone fixed the MX record or until the mail was too old. > >
> > *************** > > *** 8351,8358 **** > >> > ! Example: > >
> > > > !> > ! recipient_canonical_maps = hash:/etc/postfix/recipient_canonical > > !> > > > --- 7700,7708 ---- > >
> > ! Note: Postfix always ignores MX records with equal or worse preference > > ! than the local MTA itself. > >
> > > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > *************** > > *** 8361,8380 **** > > > > !> > ! The separator between user names and address extensions (user+foo). > > ! See canonical(5), local(8), relocated(5) and virtual(5) for the > > ! effects this has on aliases, canonical, virtual, relocated and > > ! on .forward file lookups. Basically, the software tries user+foo > > ! and .forward+foo before trying user and .forward. > > !
> > ! > > !> > ! Example: > > !
> > > > !> > ! recipient_delimiter = + > > !> > > > --- 7711,7719 ---- > > > > !
The maximal number of parallel deliveries to the same destination > > ! via the smtp message delivery transport. This limit is enforced by > > ! the queue manager. The message delivery transport name is the first > > ! field in the entry in the master.cf file.
> > > > *************** > > *** 8383,8395 **** > > > > !> > ! The numerical Postfix SMTP server response code when a remote SMTP > > ! client request is rejected by the "reject" restriction. > > !
> > > > !> > ! Do not change this unless you have a complete understanding of RFC 2821. > > !
> > > > --- 7722,7734 ---- > > > > !The maximal number of recipients per message for the smtp > > ! message delivery transport. This limit is enforced by the queue > > ! manager. The message delivery transport name is the first field in > > ! the entry in the master.cf file.
> > > > !Setting this parameter to a value of 1 changes the meaning of > > ! smtp_destination_concurrency_limit from concurrency per domain > > ! into concurrency per recipient.
> > > > *************** > > *** 8398,8414 **** > > > > !The Postfix SMTP server's action when a reject-type restriction > > ! fails due to a temporary error condition. Specify "defer" to defer > > ! the remote SMTP client request immediately. With the default > > ! "defer_if_permit" action, the Postfix SMTP server continues to look > > ! for opportunities to reject mail, and defers the client request > > ! only if it would otherwise be accepted.
> > ! > > !For finer control, see: unverified_recipient_tempfail_action, > > ! unverified_sender_tempfail_action, unknown_address_tempfail_action, > > ! and unknown_helo_hostname_tempfail_action.
> > > > !This feature is available in Postfix 2.6 and later.
> > > > --- 7737,7749 ---- > > > > !Lookup tables, indexed by the remote SMTP server address, with > > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > > ! etc.) that the Postfix SMTP client will ignore in the EHLO response from a > > ! remote SMTP server. See smtp_discard_ehlo_keywords for details. The > > ! table is not indexed by hostname for consistency with > > ! smtpd_discard_ehlo_keyword_address_maps.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 8417,8444 **** > > > > !List of tables with remote SMTP client-certificate fingerprints or > > ! public key fingerprints (Postfix 2.9 and later) for which the Postfix > > ! SMTP server will allow access with the permit_tls_clientcerts > > ! feature. The fingerprint digest algorithm is configurable via the > > ! smtpd_tls_fingerprint_digest parameter (hard-coded as md5 prior to > > ! Postfix version 2.5).
> > > > !Postfix lookup tables are in the form of (key, value) pairs. > > ! Since we only need the key, the value can be chosen freely, e.g. > > ! the name of the user or host: > > ! D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home
> > > > !Example:
> > > > !> > ! relay_clientcerts = hash:/etc/postfix/relay_clientcerts > > !> > > > !
For more fine-grained control, use check_ccert_access to select > > ! an appropriate access(5) policy for each client. > > ! See RESTRICTION_CLASS_README.
> > > > !This feature is available with Postfix version 2.2.
> > > > --- 7752,7773 ---- > > > > !A case insensitive list of EHLO keywords (pipelining, starttls, > > ! auth, etc.) that the Postfix SMTP client will ignore in the EHLO > > ! response from a remote SMTP server.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > !Notes:
> > > > !Specify the silent-discard pseudo keyword to prevent > > ! this action from being logged.
> > > > !Use the smtp_discard_ehlo_keyword_address_maps feature to > > ! discard EHLO keywords selectively.
> > ! > > !The maximal number of parallel deliveries to the same destination > > ! via the relay message delivery transport. This limit is enforced > > ! by the queue manager. The message delivery transport name is the > > ! first field in the entry in the master.cf file.
> > > > !This feature is available in Postfix 2.0 and later.
> > > > --- 7776,7800 ---- > > > > !Enforcement mode: require that remote SMTP servers use TLS > > ! encryption, and never send mail in the clear. This also requires > > ! that the remote SMTP server hostname matches the information in > > ! the remote server certificate, and that the remote SMTP server > > ! certificate was issued by a CA that is trusted by the Postfix SMTP > > ! client. If the certificate doesn't verify or the hostname doesn't > > ! match, delivery is deferred and mail stays in the queue.
> > > > !The server hostname is matched against all names provided as > > ! dNSNames in the SubjectAlternativeName. If no dNSNames are specified, > > ! the CommonName is checked. The behavior may be changed with the > > ! smtp_tls_enforce_peername option.
> > ! > > !This option is useful only if you are definitely sure that you > > ! will only connect to servers that support RFC 2487 _and_ that > > ! provide valid server certificates. Typical use is for clients that > > ! send all their email to a dedicated mailhub.
> > ! > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> > > > *************** > > *** 8460,8506 **** > > > > !The maximal number of recipients per message for the relay > > ! message delivery transport. This limit is enforced by the queue > > ! manager. The message delivery transport name is the first field in > > ! the entry in the master.cf file.
> > > > !Setting this parameter to a value of 1 changes the meaning of > > ! relay_destination_concurrency_limit from concurrency per domain > > ! into concurrency per recipient.
> > > > !This feature is available in Postfix 2.0 and later.
> > > > > > -What destination domains (and subdomains thereof) this system > > ! will relay mail to. Subdomain matching is controlled with the > > ! parent_domain_matches_subdomains parameter. For details about how > > ! the relay_domains value is used, see the description of the > > ! permit_auth_destination and reject_unauth_destination SMTP recipient > > ! restrictions.
> > > > !Domains that match $relay_domains are delivered with the > > ! $relay_transport mail delivery transport. The SMTP server validates > > ! recipient addresses with $relay_recipient_maps and rejects non-existent > > ! recipients. See also the relay domains address class in the > > ! ADDRESS_CLASS_README file.
> > > > !Note: Postfix will not automatically forward mail for domains > > ! that list this system as their primary or backup MX host. See the > > ! permit_mx_backup restriction in the postconf(5) manual page.
> > > > !Specify a list of host or domain names, "/file/name" patterns > > ! or "type:table" lookup tables, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. A > > ! "/file/name" pattern is replaced by its contents; a "type:table" > > ! lookup table is matched when a (parent) domain appears as lookup > > ! key. Specify "!pattern" to exclude a domain from the list. The form > > ! "!/file/name" is supported only in Postfix version 2.4 and later. > > !
> > > > --- 7803,7845 ---- > > > > !> > ! Optional list of relay hosts for SMTP destinations that can't be > > ! found or that are unreachable. With Postfix 2.2 and earlier this > > ! parameter is called fallback_relay.
> > > > !> > ! By default, mail is returned to the sender when a destination is > > ! not found, and delivery is deferred when a destination is unreachable. > > !
> > > > !The fallback relays must be SMTP destinations. Specify a domain, > > ! host, host:port, [host]:port, [address] or [address]:port; the form > > ! [host] turns off MX lookups. If you specify multiple SMTP > > ! destinations, Postfix will try them in the specified order.
> > > > +To prevent mailer loops between MX hosts and fall-back hosts, > > + Postfix version 2.2 and later will not use the fallback relays for > > + destinations that it is MX host for (assuming DNS lookup is turned on). > > +
> > > > > > !Optional lookup tables that perform address rewriting in the > > ! SMTP client, typically to transform a locally valid address into > > ! a globally valid address when sending mail across the Internet. > > ! This is needed when the local machine does not have its own Internet > > ! domain name, but uses something like localdomain.local > > ! instead.
> > > > !The table format and lookups are documented in generic(5); > > ! examples are shown in the ADDRESS_REWRITING_README and > > ! STANDARD_CONFIGURATION_README documents.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 8509,8522 **** > > > > !> > ! The numerical Postfix SMTP server response code when a client > > ! request is rejected by the reject_unauth_destination recipient > > ! restriction. > >
> > > > !> > ! Do not change this unless you have a complete understanding of RFC 2821. > > !
> > > > --- 7848,7858 ---- > > > > !Restricted header_checks(5) tables for the Postfix SMTP client. > > ! These tables are searched while mail is being delivered. Actions > > ! that change the delivery time or destination are not available. > >
> > > > !This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 8525,8542 **** > > > > !Optional lookup tables with all valid addresses in the domains > > ! that match $relay_domains. Specify @domain as a wild-card for > > ! domains that have no valid recipient list, and become a source of > > ! backscatter mail: Postfix accepts spam for non-existent recipients > > ! and then floods innocent people with undeliverable mail. Technically, > > ! tables > > ! listed with $relay_recipient_maps are used as lists: Postfix needs > > ! to know only if a lookup string is found or not, but it does not > > ! use the result from table lookup.
> > > >> > ! If this parameter is non-empty, then the Postfix SMTP server will reject > > ! mail to unknown relay users. This feature is off by default. > >
> > --- 7861,7867 ---- > > > > !> > ! The hostname to send in the SMTP EHLO or HELO command. > >
> > *************** > > *** 8544,8547 **** > >> > ! See also the relay domains address class in the ADDRESS_CLASS_README > > ! file. > >
> > --- 7869,7872 ---- > >> > ! The default value is the machine hostname. Specify a hostname or > > ! [ip.add.re.ss]. > >
> > *************** > > *** 8549,8556 **** > >> > ! Example: > >
> > > >> > ! relay_recipient_maps = hash:/etc/postfix/relay_recipients > >> > > > --- 7874,7886 ---- > >
> > ! This information can be specified in the main.cf file for all SMTP > > ! clients, or it can be specified in the master.cf file for a specific > > ! client, for example: > >
> > > > +> >> > > > *************** > > *** 8563,8586 **** > > > > !> > ! /etc/postfix/master.cf: > > ! mysmtp ... smtp -o smtp_helo_name=foo.bar.com > >> > +
> > ! The default mail delivery transport and next-hop destination for > > ! remote delivery to domains listed with $relay_domains. In order of > > ! decreasing precedence, the nexthop destination is taken from > > ! $relay_transport, $sender_dependent_relayhost_maps, $relayhost, or > > ! from the recipient domain. This information can be overruled with > > ! the transport(5) table. > > !
> > ! > > !> > ! Specify a string of the form transport:nexthop, where transport > > ! is the name of a mail delivery transport defined in master.cf. > > ! The :nexthop destination is optional; its syntax is documented > > ! in the manual page of the corresponding delivery agent. > > !
> > > >> > ! See also the relay domains address class in the ADDRESS_CLASS_README > > ! file. > >
> > --- 7893,7900 ---- > > > > !> > ! The SMTP client time limit for sending the HELO or EHLO command, > > ! and for receiving the initial server response. > >
> > *************** > > *** 8588,8590 **** > >> > ! This feature is available in Postfix 2.0 and later. > >
> > --- 7902,7905 ---- > >> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > *************** > > *** 8594,8604 **** > > > > !> > ! The next-hop destination of non-local mail; overrides non-local > > ! domains in recipient addresses. This information is overruled with > > ! relay_transport, sender_dependent_default_transport_maps, > > ! default_transport, sender_dependent_relayhost_maps > > ! and with the transport(5) table. > >
> > --- 7909,7916 ---- > > > > !> > ! What mechanisms when the Postfix SMTP client uses to look up a host's IP > > ! address. This parameter is ignored when DNS lookups are disabled. > >
> > *************** > > *** 8606,8650 **** > >> > ! On an intranet, specify the organizational domain name. If your > > ! internal DNS uses no MX records, specify the name of the intranet > > ! gateway host instead. > >
> > > > !> > ! In the case of SMTP, specify a domain name, hostname, hostname:port, > > ! [hostname]:port, [hostaddress] or [hostaddress]:port. The form > > ! [hostname] turns off MX lookups. > > !
> > > > !> > ! If you're connected via UUCP, see the UUCP_README file for useful > > ! information. > > !
> > > > !> > ! Examples: > > !
> > > > !> > ! relayhost = $mydomain > > ! relayhost = [gateway.example.com] > > ! relayhost = uucphost > > ! relayhost = [an.ip.add.ress] > > !> > > > > > !
> > ! Optional lookup tables with new contact information for users or > > ! domains that no longer exist. The table format and lookups are > > ! documented in relocated(5). > >
> > > >> > ! If you use this feature, run "postmap /etc/postfix/relocated" to > > ! build the necessary DBM or DB file after change, then "postfix > > ! reload" to make the changes visible. > >
> > --- 7918,7954 ---- > >> > ! Specify one of the following: > >
> > > > !> > ! This feature is available in Postfix 2.1 and later. > >
> > > > + > > +> > ! The maximal length of message header and body lines that Postfix > > ! will send via SMTP. Longer lines are broken by inserting > > ! "<CR><LF><SPACE>". This minimizes the damage to > > ! MIME formatted mail. > >
> > *************** > > *** 8652,8661 **** > >> > ! Examples: > >
> > > > -> > - relocated_maps = dbm:/etc/postfix/relocated > > - relocated_maps = hash:/etc/postfix/relocated > > -> > - > > > > --- 7956,7961 ---- > >
> > ! By default, the line length is limited to 990 characters, because > > ! some server implementations cannot receive mail with long lines. > >
> > > > > > *************** > > *** 8663,8693 **** > > > > !Don't rewrite message headers from remote clients at all when > > ! this parameter is empty; otherwise, rewrite message headers and > > ! append the specified domain name to incomplete addresses. The > > ! local_header_rewrite_clients parameter controls what clients Postfix > > ! considers local.
> > > > !Examples:
> > > > -The safe setting: append "domain.invalid" to incomplete header > > - addresses from remote SMTP clients, so that those addresses cannot > > - be confused with local addresses.
> > > > !> > !> > > > !> > ! remote_header_rewrite_domain = domain.invalid > > !> > !
The default, purist, setting: don't rewrite headers from remote > > ! clients at all.
> > > > !> > !> > > > --- 7963,7989 ---- > > > > !> > ! remote_header_rewrite_domain = > > !> > !
> > ! The SMTP client time limit for sending the MAIL FROM command, and > > ! for receiving the server response. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > > > !Restricted mime_header_checks(5) tables for the Postfix SMTP > > ! client. These tables are searched while mail is being delivered. > > ! Actions that change the delivery time or destination are not > > ! available.
> > ! > > !This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 8696,8759 **** > > > > !> > ! Require that a local(8) recipient's home directory exists > > ! before mail delivery is attempted. By default this test is disabled. > > ! It can be useful for environments that import home directories to > > ! the mail server (IMPORTING HOME DIRECTORIES IS NOT RECOMMENDED). > >
> > > > > > -Reset the local(8) delivery agent's idea of the owner-alias > > ! attribute, when delivering mail to a child alias that does not have > > ! its own owner alias.
> > > > !This feature is available in Postfix 2.8 and later. With older > > ! Postfix releases, the behavior is as if this parameter is set to > > ! "yes".
> > > > !As documented in aliases(5), when an alias name has a > > ! companion alias named owner-name, delivery errors will be > > ! reported to the owner alias instead of the sender. This configuration > > ! is recommended for mailing lists.
> > ! > > !
A less known property of the owner alias is that it also forces > > ! the local(8) delivery agent to write local and remote addresses > > ! from alias expansion to a new queue file, instead of attempting to > > ! deliver mail to local addresses as soon as they come out of alias > > ! expansion.
> > ! > > !Writing local addresses from alias expansion to a new queue > > ! file allows for robust handling of temporary delivery errors: errors > > ! with one local member have no effect on deliveries to other members > > ! of the list. On the other hand, delivery to local addresses as > > ! soon as they come out of alias expansion is fragile: a temporary > > ! error with one local address from alias expansion will cause the > > ! entire alias to be expanded repeatedly until the error goes away, > > ! or until the message expires in the queue. In that case, a problem > > ! with one list member results in multiple message deliveries to other > > ! list members.
> > ! > > !The default behavior of Postfix 2.8 and later is to keep the > > ! owner-alias attribute of the parent alias, when delivering mail to > > ! a child alias that does not have its own owner alias. Then, local > > ! addresses from that child alias will be written to a new queue file, > > ! and a temporary error with one local address will not affect delivery > > ! to other mailing list members.
> > ! > > !Unfortunately, older Postfix releases reset the owner-alias > > ! attribute when delivering mail to a child alias that does not have > > ! its own owner alias. The local(8) delivery agent then attempts to > > ! deliver local addresses as soon as they come out of child alias > > ! expansion. If delivery to any address from child alias expansion > > ! fails with a temporary error condition, the entire mailing list may > > ! be expanded repeatedly until the mail expires in the queue, resulting > > ! in multiple deliveries of the same message to mailing list members. > > !
> > > > --- 7992,8019 ---- > > > > !> > ! The maximal number of MX (mail exchanger) IP addresses that can > > ! result from mail exchanger lookups, or zero (no limit). Prior to > > ! Postfix version 2.3, this limit was disabled by default. > >
> > > > +> > + This feature is available in Postfix 2.1 and later. > > +
> > > > > > !The maximal number of SMTP sessions per delivery request before > > ! giving up or delivering to a fall-back relay host, or zero (no > > ! limit). This restriction ignores sessions that fail to complete the > > ! SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to > > ! complete the EHLO and TLS handshake (Postfix version 2.3 and later).
> > > > !This feature is available in Postfix 2.1 and later.
> > > > *************** > > *** 8762,8780 **** > > > > !Resolve a recipient address safely instead of correctly, by > > ! looking inside quotes.
> > > > !By default, the Postfix address resolver does not quote the > > ! address localpart as per RFC 822, so that additional @ or % or ! > > ! operators remain visible. This behavior is safe but it is also > > ! technically incorrect.
> > > > !If you specify "resolve_dequoted_address = no", then > > ! the Postfix > > ! resolver will not know about additional @ etc. operators in the > > ! address localpart. This opens opportunities for obscure mail relay > > ! attacks with user at domain@domain addresses when Postfix provides > > ! backup MX service for Sendmail systems.
> > > > --- 8022,8032 ---- > > > > !Restricted nested_header_checks(5) tables for the Postfix SMTP > > ! client. These tables are searched while mail is being delivered. > > ! Actions that change the delivery time or destination are not > > ! available.
> > > > !This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 8783,8798 **** > > > > !Resolve an address that ends in the "@" null domain as if the > > ! local hostname were specified, instead of rejecting the address as > > ! invalid.
> > > > -This feature is available in Postfix 2.1 and later. > > - Earlier versions always resolve the null domain as the local > > - hostname.
> > > > !The Postfix SMTP server uses this feature to reject mail from > > ! or to addresses that end in the "@" null domain, and from addresses > > ! that rewrite into a form that ends in the "@" null domain.
> > > > --- 8035,8058 ---- > > > > !Never send EHLO at the start of an SMTP session. See also the > > ! smtp_always_send_ehlo parameter.
> > > > > > !> > ! How long the Postfix SMTP client pauses before sending > > ! ".<CR><LF>" in order to work around the PIX firewall > > ! "<CR><LF>.<CR><LF>" bug. > > !
> > ! > > !> > ! Choosing a too short time makes this workaround ineffective when > > ! sending large messages over slow network connections. > > !
> > > > *************** > > *** 8801,8809 **** > > > > !Resolve "user at ipaddress" as "user@[ipaddress]", instead of > > ! rejecting the address as invalid.
> > > > !This feature is available in Postfix 2.3 and later. > > > > --- 8061,8071 ---- > > > > !
Lookup tables, indexed by the remote SMTP server address, with > > ! per-destination workarounds for CISCO PIX firewall bugs. The table > > ! is not indexed by hostname for consistency with > > ! smtp_discard_ehlo_keyword_address_maps.
> > > > !This feature is available in Postfix 2.4 and later.
> > > > *************** > > *** 8812,8820 **** > > > > !> > ! The name of the address rewriting service. This service rewrites > > ! addresses to standard form and resolves them to a (delivery method, > > ! next-hop host, recipient) triple. > >
> > --- 8074,8087 ---- > > > > !How long a message must be queued before the Postfix SMTP client > > ! turns on the PIX firewall "<CR><LF>.<CR><LF>" > > ! bug workaround for delivery through firewalls with "smtp fixup" > > ! mode turned on.
> > > >> > ! By default, the workaround is turned off for mail that is queued > > ! for less than 500 seconds. In other words, the workaround is normally > > ! turned off for the first delivery attempt. > >
> > *************** > > *** 8822,8824 **** > >> > ! This feature is available in Postfix 2.0 and later. > >
> > --- 8089,8093 ---- > >> > ! Specify 0 to enable the PIX firewall > > ! "<CR><LF>.<CR><LF>" bug workaround upon the > > ! first delivery attempt. > >
> > *************** > > *** 8828,8855 **** > > > > !> > ! The name of the directory with example Postfix configuration files. > > ! Starting with Postfix 2.1, these files have been replaced with the > > ! postconf(5) manual page. > > !
> > > > > > !When authenticating to a remote SMTP or LMTP server with the > > ! default setting "no", send no SASL authoriZation ID (authzid); send > > ! only the SASL authentiCation ID (authcid) plus the authcid's password. > > !
> > > > !The non-default setting "yes" enables the behavior of older > > ! Postfix versions. These always send a SASL authzid that is equal > > ! to the SASL authcid, but this causes inter-operability problems > > ! with some SMTP servers.
> > > > !This feature is available in Postfix 2.4.4 and later.
> > > > --- 8097,8122 ---- > > > > !A list that specifies zero or more workarounds for CISCO PIX > > + firewall bugs. These workarounds are implemented by the Postfix > > + SMTP client. Workaround names are separated by comma or space, and > > + are case insensitive. This parameter setting can be overruled with > > + per-destination smtp_pix_workaround_maps settings.
> > > > !This feature is available in Postfix 2.4 and later. The default > > ! settings are backwards compatible with earlier Postfix versions. > > !
> > > > *************** > > *** 8858,8865 **** > > > > !> > ! This parameter should not be used. It was replaced by sender_dependent_relayhost_maps > > ! in Postfix version 2.3. > >
> > --- 8125,8137 ---- > > > > !> > ! The SMTP client time limit for sending the QUIT command, and for > > ! receiving the server response. > > !
> > ! > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > *************** > > *** 8869,8879 **** > > > > !Optional BCC (blind carbon-copy) address lookup tables, indexed > > ! by sender address. The BCC address (multiple results are not > > ! supported) is added when mail enters from outside of Postfix.
> > > >> > ! This feature is available in Postfix 2.1 and later. > >
> > --- 8141,8149 ---- > > > > !> > ! Quote addresses in SMTP MAIL FROM and RCPT TO commands as required > > ! by RFC 2821. This includes putting quotes around an address localpart > > ! that ends in ".". > >
> > *************** > > *** 8881,8926 **** > >> > ! The table search order is as follows: > >
> > > > !> > ! Specify the types and names of databases to use. After change, > > ! run "postmap /etc/postfix/sender_bcc". > >
> > > > -> > - Note: if mail to the BCC address bounces it will be returned to > > - the sender. > > -
> > > > !Note: automatic BCC recipients are produced only for new mail. > > ! To avoid mailer loops, automatic BCC recipients are not generated > > ! after Postfix forwards mail internally, or after Postfix generates > > ! mail itself.
> > > >> > ! Example: > >
> > > > !> > ! sender_bcc_maps = hash:/etc/postfix/sender_bcc > > !> > > > --- 8151,8198 ---- > >
> > ! The default is to comply with RFC 2821. If you have to send mail to > > ! a broken SMTP server, configure a special SMTP client in master.cf: > >
> > > > !> > !> > > > !> > ! /etc/postfix/master.cf: > > ! broken-smtp . . . smtp -o smtp_quote_rfc821_envelope=no > > !> > !
> > ! and route mail for the destination in question to the "broken-smtp" > > ! message delivery with a transport(5) table. > > !
> > > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > > > !> > ! Randomize the order of equal-preference MX host addresses. This > > ! is a performance feature of the Postfix SMTP client. > >
> > > > > > !> > ! The SMTP client time limit for sending the SMTP RCPT TO command, and > > ! for receiving the server response. > >
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > *************** > > *** 8929,8941 **** > > > > !What addresses are subject to sender_canonical_maps address > > ! mapping. By default, sender_canonical_maps address mapping is > > ! applied to envelope sender addresses, and to header sender addresses. > > !
> > > > !Specify one or more of: envelope_sender, header_sender
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 8201,8211 ---- > > > > !The SMTP client time limit for sending the RSET command, and > > ! for receiving the server response. The SMTP client sends RSET in > > ! order to finish a recipient address probe, or to verify that a > > ! cached session is still usable.
> > > > !This feature is available in Postfix 2.1 and later.
> > > > *************** > > *** 8944,8972 **** > > > > !> > ! Optional address mapping lookup tables for envelope and header > > ! sender addresses. > > ! The table format and lookups are documented in canonical(5). > > !
> > > > !> > ! Example: you want to rewrite the SENDER address "user at ugly.domain" > > ! to "user at pretty.domain", while still being able to send mail to > > ! the RECIPIENT address "user at ugly.domain". > >
> > > > !> > ! Note: $sender_canonical_maps is processed before $canonical_maps. > > !
> > > > !> > ! Example: > >
> > > >> > ! sender_canonical_maps = hash:/etc/postfix/sender_canonical > >> > > > > > --- 8214,8253 ---- > > > > !
An optional table to prevent repeated SASL authentication > > ! failures with the same remote SMTP server hostname, username and > > ! password. Each table (key, value) pair contains a server name, a > > ! username and password, and the full server response. This information > > ! is stored when a remote SMTP server rejects an authentication attempt > > ! with a 535 reply code. As long as the smtp_sasl_password_maps > > ! information does no change, and as long as the smtp_sasl_auth_cache_name > > ! information does not expire (see smtp_sasl_auth_cache_time) the > > ! Postfix SMTP client avoids SASL authentication attempts with the > > ! same server, username and password, and instead bounces or defers > > ! mail as controlled with the smtp_sasl_auth_soft_bounce configuration > > ! parameter.
> > > > !Use a per-destination delivery concurrency of 1 (for example, > > ! "smtp_destination_concurrency_limit = 1", > > ! "relay_destination_concurrency_limit = 1", etc.), otherwise multiple > > ! delivery agents may experience a login failure at the same time. > >
> > > > !The table must be accessed via the proxywrite service, i.e. the > > ! map name must start with "proxy:". The table should be stored under > > ! the directory specified with the data_directory parameter.
> > > > !This feature uses cryptographic hashing to protect plain-text > > ! passwords, and requires that Postfix is compiled with TLS support. > >
> > > > +Example:
> > + > >> > ! smtp_sasl_auth_cache_name = proxy:btree:/var/lib/postfix/sasl_auth_cache > >> > > > +
This feature is available in Postfix 2.5 and later.
> > + > > > > *************** > > *** 8974,8994 **** > > > > !A sender-dependent override for the global default_transport > > ! parameter setting. The tables are searched by the envelope sender > > ! address and @domain. A lookup result of DUNNO terminates the search > > ! without overriding the global default_transport parameter setting. > > ! This information is overruled with the transport(5) table.
> > ! > > !Note: this overrides default_transport, not transport_maps, and > > ! therefore the expected syntax is that of default_transport, not the > > ! syntax of transport_maps. Specifically, this does not support the > > ! transport_maps syntax for null transport, null nexthop, or null > > ! email addresses.
> > > > !For safety reasons, this feature does not allow $number > > ! substitutions in regular expression maps.
> > > > !This feature is available in Postfix 2.7 and later.
> > > > --- 8255,8263 ---- > > > > !The maximal age of an smtp_sasl_auth_cache_name entry before it > > ! is removed.
> > > > !This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 8997,9016 **** > > > > !A sender-dependent override for the global relayhost parameter > > ! setting. The tables are searched by the envelope sender address and > > ! @domain. A lookup result of DUNNO terminates the search without > > ! overriding the global relayhost parameter setting (Postfix 2.6 and > > ! later). This information is overruled with relay_transport, > > ! sender_dependent_default_transport_maps, default_transport and with > > ! the transport(5) table.
> > > > !For safety reasons, this feature does not allow $number > > ! substitutions in regular expression maps.
> > > >> > ! This feature is available in Postfix 2.3 and later. > >
> > > > > > --- 8266,8283 ---- > > > > !> > ! Enable SASL authentication in the Postfix SMTP client. By default, > > ! the Postfix SMTP client uses no authentication. > > !
> > > >> > ! Example: > >
> > > > +> > + smtp_sasl_auth_enable = yes > > +> > + > > > > *************** > > *** 9018,9044 **** > > > > !
Controls how the Postfix sendmail command converts email message > > ! line endings from <CR><LF> into UNIX format (<LF>). > > !
> > > > !This feature is available in Postfix 2.9 and later.
> > > > --- 8285,8307 ---- > > > > !When a remote SMTP server rejects a SASL authentication request > > ! with a 535 reply code, defer mail delivery instead of returning > > ! mail as undeliverable. The latter behavior was hard-coded prior to > > ! Postfix version 2.5.
> > > > !Note: the setting "yes" overrides the global soft_bounce > > ! parameter, but the setting "no" does not.
> > > > !Example:
> > > > !> > ! # Default as of Postfix 2.5 > > ! smtp_sasl_auth_soft_bounce = yes > > ! # The old hard-coded default > > ! smtp_sasl_auth_soft_bounce = no > > !> > > > !
This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 9047,9057 **** > > > > !> > ! A Sendmail compatibility feature that specifies the location of > > ! the Postfix sendmail(1) command. This command can be used to > > ! submit mail into the Postfix queue. > >
> > > > > > --- 8310,8340 ---- > > > > !> > ! If non-empty, a Postfix SMTP client filter for the remote SMTP > > ! server's list of offered SASL mechanisms. Different client and > > ! server implementations may support different mechanism lists. By > > ! default, the Postfix SMTP client will use the intersection of the > > ! two. smtp_sasl_mechanism_filter further restricts what server > > ! mechanisms the client will take into consideration.
> > ! > > !Specify mechanism names, "/file/name" patterns or "type:table" > > ! lookup tables. The right-hand side result from "type:table" lookups > > ! is ignored. Specify "!pattern" to exclude a mechanism name from the > > ! list. The form "!/file/name" is supported only in Postfix version > > ! 2.4 and later.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > !> > ! Examples: > >
> > > > +> > + smtp_sasl_mechanism_filter = plain, login > > + smtp_sasl_mechanism_filter = /etc/postfix/smtp_mechs > > + smtp_sasl_mechanism_filter = !gssapi, !login, static:rest > > +> > + > > > > *************** > > *** 9059,9066 **** > > > > !
> > ! How long the Postfix master(8) waits before forking a server that > > ! appears to be malfunctioning. > >
> > --- 8342,8352 ---- > > > > !> > ! Optional SMTP client lookup tables with one username:password entry > > ! per remote hostname or domain, or sender address when sender-dependent > > ! authentication is enabled. If no username:password entry is found, > > ! then the Postfix SMTP client will not > > ! attempt to authenticate to the remote host. > >
> > *************** > > *** 9068,9071 **** > >> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > --- 8354,8357 ---- > >> > ! The Postfix SMTP client opens the lookup table before going to > > ! chroot jail, so you can leave the password file in /etc/postfix. > >
> > *************** > > *** 9075,9085 **** > > > > !> > ! The group ownership of set-gid Postfix commands and of group-writable > > ! Postfix directories. When this parameter value is changed you need > > ! to re-run "postfix set-permissions" (with Postfix version 2.0 and > > ! earlier: "/etc/postfix/post-install set-permissions". > > !
> > > > --- 8361,8372 ---- > > > > !Implementation-specific information that the Postfix SMTP client > > ! passes through to > > ! the SASL plug-in implementation that is selected with > > ! smtp_sasl_type. Typically this specifies the name of a > > ! configuration file or rendezvous point.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 9088,9147 **** > > > > !> > ! Display the name of the recipient table in the "User unknown" > > ! responses. The extra detail makes trouble shooting easier but also > > ! reveals information that is nobody elses business. > > !
> > > >> > ! This feature is available in Postfix 2.0 and later. > >
> > > > > > !> > ! The name of the showq(8) service. This service produces mail queue > > ! status reports. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > !The address type ("ipv6", "ipv4" or "any") that the Postfix > > ! SMTP client will try first, when a destination has IPv6 and IPv4 > > ! addresses with equal MX preference. This feature has no effect > > ! unless the inet_protocols setting enables both IPv4 and IPv6. > > ! With Postfix 2.8 the default is "ipv6".
> > > > !This feature is available in Postfix 2.8 and later.
> > > > > > !> > ! Always send EHLO at the start of an SMTP session. > >
> > > > !> > ! With "smtp_always_send_ehlo = no", the Postfix SMTP client sends > > ! EHLO only when > > ! the word "ESMTP" appears in the server greeting banner (example: > > ! 220 spike.porcupine.org ESMTP Postfix). > > !
> > > > --- 8375,8424 ---- > > > > !Postfix SMTP client SASL security options; as of Postfix 2.3 > > ! the list of available > > ! features depends on the SASL client implementation that is selected > > ! with smtp_sasl_type.
> > ! > > !The following security features are defined for the cyrus > > ! client SASL implementation:
> > > >> > ! Specify zero or more of the following: > >
> > > > +> > ! Example: > >
> > > > !> > ! smtp_sasl_security_options = noplaintext > > !> > > > *************** > > *** 9150,9180 **** > > > > !
> > ! An optional numerical network address that the Postfix SMTP client > > ! should bind to when making an IPv4 connection. > > !
> > ! > > !> > ! This can be specified in the main.cf file for all SMTP clients, or > > ! it can be specified in the master.cf file for a specific client, > > ! for example: > > !
> > ! > > !> > !> > > > !> > ! /etc/postfix/master.cf: > > ! smtp ... smtp -o smtp_bind_address=11.22.33.44 > > !> > !
Note 1: when inet_interfaces specifies no more than one IPv4 > > ! address, and that address is a non-loopback address, it is > > ! automatically used as the smtp_bind_address. This supports virtual > > ! IP hosting, but can be a problem on multi-homed firewalls. See the > > ! inet_interfaces documentation for more detail.
> > > > !Note 2: address information may be enclosed inside [], > > ! but this form is not required here.
> > > > --- 8427,8435 ---- > > > > !The SASL authentication security options that the Postfix SMTP > > ! client uses for TLS encrypted SMTP sessions.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 9183,9215 **** > > > > !> > ! An optional numerical network address that the Postfix SMTP client > > ! should bind to when making an IPv6 connection. > > !
> > > > -This feature is available in Postfix 2.2 and later.
> > > > !> > ! This can be specified in the main.cf file for all SMTP clients, or > > ! it can be specified in the master.cf file for a specific client, > > ! for example: > > !
> > > > !> > !> > > > !> > ! /etc/postfix/master.cf: > > ! smtp ... smtp -o smtp_bind_address6=1:2:3:4:5:6:7:8 > > !> > !
Note 1: when inet_interfaces specifies no more than one IPv6 > > ! address, and that address is a non-loopback address, it is > > ! automatically used as the smtp_bind_address6. This supports virtual > > ! IP hosting, but can be a problem on multi-homed firewalls. See the > > ! inet_interfaces documentation for more detail.
> > > > !Note 2: address information may be enclosed inside [], > > ! but this form is not recommended here.
> > > > --- 8438,8458 ---- > > > > !The SASL authentication security options that the Postfix SMTP > > ! client uses for TLS encrypted SMTP sessions with a verified server > > ! certificate. This feature is under construction as of Postfix version > > ! 2.3.
> > > > > > !The SASL plug-in type that the Postfix SMTP client should use > > ! for authentication. The available types are listed with the > > ! "postconf -A" command.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 9218,9228 **** > > > > !Restricted body_checks(5) tables for the Postfix SMTP client. > > ! These tables are searched while mail is being delivered. Actions > > ! that change the delivery time or destination are not available. > >
> > > > !This feature is available in Postfix 2.5 and later.
> > > > --- 8461,8481 ---- > > > > !> > ! Send the non-standard XFORWARD command when the Postfix SMTP server > > ! EHLO response announces XFORWARD support. > >
> > > > !> > ! This allows an "smtp" delivery agent, used for injecting mail into > > ! a content filter, to forward the name, address, protocol and HELO > > ! name of the original client to the content filter and downstream > > ! queuing SMTP server. This can produce more useful logging than > > ! localhost[127.0.0.1] etc. > > !
> > ! > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > *************** > > *** 9231,9244 **** > > > > !Allow DNS CNAME records to override the servername that the > > ! Postfix SMTP client uses for logging, SASL password lookup, TLS > > ! policy decisions, or TLS certificate verification. The value "no" > > ! hardens Postfix smtp_tls_per_site hostname-based policies against > > ! false hostname information in DNS CNAME records, and makes SASL > > ! password file lookups more predictable. This is the default setting > > ! as of Postfix 2.3.
> > > > !This feature is available in Postfix 2.2.9 and later.
> > > > --- 8484,8497 ---- > > > > !> > ! Enable sender-dependent authentication in the Postfix SMTP client; this is > > ! available only with SASL authentication, and disables SMTP connection > > ! caching to ensure that mail from different senders will use the > > ! appropriate credentials.
> > > > !> > ! This feature is available in Postfix 2.3 and later. > > !
> > > > *************** > > *** 9247,9254 **** > > > > !> > ! The Postfix SMTP client time limit for completing a TCP connection, or > > ! zero (use the operating system built-in time limit). > >
> > --- 8500,8507 ---- > > > > !> > ! Skip SMTP servers that greet with a 4XX status code (go away, try > > ! again later). > >
> > *************** > > *** 9256,9268 **** > >> > ! When no connection can be made within the deadline, the Postfix > > ! SMTP client > > ! tries the next address on the mail exchanger list. Specify 0 to > > ! disable the time limit (i.e. use whatever timeout is implemented by > > ! the operating system). > >
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > --- 8509,8518 ---- > >> > ! By default, Postfix moves on the next mail exchanger. Specify > > ! "smtp_skip_4xx_greeting = no" if Postfix should defer delivery > > ! immediately. > >
> > > > !This feature is available in Postfix 2.0 and earlier. > > ! Later Postfix versions always skip SMTP servers that greet with a > > ! 4XX status code.
> > > > *************** > > *** 9271,9308 **** > > > > !Permanently enable SMTP connection caching for the specified > > ! destinations. With SMTP connection caching, a connection is not > > ! closed immediately after completion of a mail transaction. Instead, > > ! the connection is kept open for up to $smtp_connection_cache_time_limit > > ! seconds. This allows connections to be reused for other deliveries, > > ! and can improve mail delivery performance.
> > > > !Specify a comma or white space separated list of destinations > > ! or pseudo-destinations:
> > > > -This feature is available in Postfix 2.2 and later.
> > > > --- 8521,8555 ---- > > > > !> > ! Skip SMTP servers that greet with a 5XX status code (go away, do > > ! not try again later). > > !
> > > > !By default, the Postfix SMTP client moves on the next mail > > ! exchanger. Specify "smtp_skip_5xx_greeting = no" if Postfix should > > ! bounce the mail immediately. The default setting is incorrect, but > > ! it is what a lot of people expect to happen.
> > > > > > !> > ! Do not wait for the response to the SMTP QUIT command. > > !
> > > > > > !Time limit for Postfix SMTP client write and read operations > > ! during TLS startup and shutdown handshake procedures.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 9311,9350 **** > > > > !Temporarily enable SMTP connection caching while a destination > > ! has a high volume of mail in the active queue. With SMTP connection > > ! caching, a connection is not closed immediately after completion > > ! of a mail transaction. Instead, the connection is kept open for > > ! up to $smtp_connection_cache_time_limit seconds. This allows > > ! connections to be reused for other deliveries, and can improve mail > > ! delivery performance.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !When SMTP connection caching is enabled, the number of times that > > ! an SMTP session may be reused before it is closed. > > !
> > > > !This feature is available in Postfix 2.2. In Postfix 2.3 it is > > ! replaced by $smtp_connection_reuse_time_limit.
> > > > > > !When SMTP connection caching is enabled, the amount of time that > > ! an unused SMTP client socket is kept open before it is closed. Do > > ! not specify larger values without permission from the remote sites. > > !
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 8558,8597 ---- > > > > !The file with the certificate of the certification authority > > ! (CA) that issued the Postfix SMTP client certificate. This is > > ! needed only when the CA certificate is not already present in the > > ! client certificate file.
> > > > !Example:
> > > > +> > + smtp_tls_CAfile = /etc/postfix/CAcert.pem > > +> > > > !
This feature is available in Postfix 2.2 and later.
> > > > > > !Directory with PEM format certificate authority certificates > > + that the Postfix SMTP client uses to verify a remote SMTP server > > + certificate. Don't forget to create the necessary "hash" links > > + with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". > > +
> > > > !To use this option in chroot mode, this directory (or a copy) > > ! must be inside the chroot jail.
> > > > !Example:
> > > > !> > ! smtp_tls_CApath = /etc/postfix/certs > > !> > > > !
This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 9353,9423 **** > > > > !The amount of time during which Postfix will use an SMTP > > ! connection repeatedly. The timer starts when the connection is > > ! initiated (i.e. it includes the connect, greeting and helo latency, > > ! in addition to the latencies of subsequent mail delivery transactions). > > !
> > > > !This feature addresses a performance stability problem with > > ! remote SMTP servers. This problem is not specific to Postfix: it > > ! can happen when any MTA sends large amounts of SMTP email to a site > > ! that has multiple MX hosts.
> > > > !The problem starts when one of a set of MX hosts becomes slower > > ! than the rest. Even though SMTP clients connect to fast and slow > > ! MX hosts with equal probability, the slow MX host ends up with more > > ! simultaneous inbound connections than the faster MX hosts, because > > ! the slow MX host needs more time to serve each client request.
> > ! > > !The slow MX host becomes a connection attractor. If one MX > > ! host becomes N times slower than the rest, it dominates mail delivery > > ! latency unless there are more than N fast MX hosts to counter the > > ! effect. And if the number of MX hosts is smaller than N, the mail > > ! delivery latency becomes effectively that of the slowest MX host > > ! divided by the total number of MX hosts.
> > ! > > !The solution uses connection caching in a way that differs from > > ! Postfix version 2.2. By limiting the amount of time during which a connection > > ! can be used repeatedly (instead of limiting the number of deliveries > > ! over that connection), Postfix not only restores fairness in the > > ! distribution of simultaneous connections across a set of MX hosts, > > ! it also favors deliveries over connections that perform well, which > > ! is exactly what we want.
> > > > !The default reuse time limit, 300s, is comparable to the various > > ! smtp transaction timeouts which are fair estimates of maximum excess > > ! latency for a slow delivery. Note that hosts may accept thousands > > ! of messages over a single connection within the default connection > > ! reuse time limit. This number is much larger than the default Postfix > > ! version 2.2 limit of 10 messages per cached connection. It may prove necessary > > ! to lower the limit to avoid interoperability issues with MTAs that > > ! exhibit bugs when many messages are delivered via a single connection. > > ! A lower reuse time limit risks losing the benefit of connection > > ! reuse when the average connection and mail delivery latency exceeds > > ! the reuse time limit.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > !> > ! The Postfix SMTP client time limit for sending the SMTP ".", and > > ! for receiving the remote SMTP server response. > > !
> > > > !> > ! When no response is received within the deadline, a warning is > > ! logged that the mail may be delivered multiple times. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > --- 8600,8651 ---- > > > > !File with the Postfix SMTP client RSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP client private RSA key, > > ! and these may be the same as the Postfix SMTP server RSA certificate and key > > ! file.
> > > > !Do not configure client certificates unless you must present > > ! client TLS certificates to one or more servers. Client certificates are > > ! not usually needed, and can cause problems in configurations that work > > ! well without them. The recommended setting is to let the defaults stand:
> > > > !> > !> > > > !> > ! smtp_tls_cert_file = > > ! smtp_tls_dcert_file = > > ! smtp_tls_key_file = > > ! smtp_tls_dkey_file = > > !> > !
The best way to use the default settings is to comment out the above > > ! parameters in main.cf if present.
> > > > !In order to verify certificates, the CA certificate (in case > > ! of a certificate chain, all CA certificates) must be available. > > ! You should add these certificates to the client certificate, the > > ! client certificate first, then the issuing CA(s).
> > > > +Example: the certificate for "client.dom.ain" was issued by > > + "intermediate CA" which itself has a certificate of "root CA". > > + Create the client.pem file with "cat client_cert.pem intermediate_CA.pem > > + root_CA.pem > client.pem".
> > > > !If you also want to verify remote SMTP server certificates issued by > > ! these CAs, you can also add the CA certificates to the smtp_tls_CAfile, > > ! in which case it is not necessary to have them in the smtp_tls_cert_file > > ! or smtp_tls_dcert_file.
> > > > !A certificate supplied here must be usable as an SSL client certificate > > ! and hence pass the "openssl verify -purpose sslclient ..." test.
> > > > !Example:
> > > > !> > ! smtp_tls_cert_file = /etc/postfix/client.pem > > !> > > > !
This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 9426,9456 **** > > > > !> > ! The Postfix SMTP client time limit for sending the SMTP DATA command, > > ! and for receiving the remote SMTP server response. > > !
> > ! > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > ! > > ! > > !> > ! The Postfix SMTP client time limit for sending the SMTP message content. > > ! When the connection makes no progress for more than $smtp_data_xfer_timeout > > ! seconds the Postfix SMTP client terminates the transfer. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > --- 8654,8671 ---- > > > > !Obsolete Postfix < 2.3 control for the Postfix SMTP client TLS > > ! cipher list. As this feature applies to all TLS security levels, it is easy > > ! to create inter-operability problems by choosing a non-default cipher > > ! list. Do not use a non-default TLS cipher list on hosts that deliver email > > ! to the public Internet: you will be unable to send email to servers that > > ! only support the ciphers you exclude. Using a restricted cipher list > > ! may be more appropriate for an internal MTA, where one can exert some > > ! control over the TLS software and settings of the peer servers.
> > > > !Note: do not use "" quotes around the parameter value.
> > > > !This feature is available in Postfix version 2.2. It is not used with > > ! Postfix 2.3 and later; use smtp_tls_mandatory_ciphers instead.
> > > > *************** > > *** 9459,9482 **** > > > > !> > ! Defer mail delivery when no MX record resolves to an IP address. > > !
> > > > !> > ! The default (no) is to return the mail as undeliverable. With older > > ! Postfix versions the default was to keep trying to deliver the mail > > ! until someone fixed the MX record or until the mail was too old. > >
> > > > !> > ! Note: the Postfix SMTP client always ignores MX records with equal > > ! or worse preference > > ! than the local MTA itself. > > !
> > > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > --- 8674,8691 ---- > > > > !File with the Postfix SMTP client DSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP client private DSA key.
> > > > !See the discussion under smtp_tls_cert_file for more details. > >
> > > > !Example:
> > > > !> > ! smtp_tls_dcert_file = /etc/postfix/client-dsa.pem > > !> > ! > > !
This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 9485,9523 **** > > > > !The maximal number of parallel deliveries to the same destination > > ! via the smtp message delivery transport. This limit is enforced by > > ! the queue manager. The message delivery transport name is the first > > ! field in the entry in the master.cf file.
> > > > > > !The maximal number of recipients per message for the smtp > > - message delivery transport. This limit is enforced by the queue > > - manager. The message delivery transport name is the first field in > > - the entry in the master.cf file.
> > > > !Setting this parameter to a value of 1 changes the meaning of > > ! smtp_destination_concurrency_limit from concurrency per domain > > ! into concurrency per recipient.
> > > > > > !Lookup tables, indexed by the remote SMTP server address, with > > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > > ! etc.) that the Postfix SMTP client will ignore in the EHLO response from a > > ! remote SMTP server. See smtp_discard_ehlo_keywords for details. The > > ! table is not indexed by hostname for consistency with > > ! smtpd_discard_ehlo_keyword_address_maps.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 8694,8730 ---- > > > > !File with the Postfix SMTP client DSA private key in PEM format. > > + This file may be combined with the Postfix SMTP client DSA certificate > > + file specified with $smtp_tls_dcert_file.
> > > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted, but file permissions should grant read/write > > ! access only to the system superuser account ("root").
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !With mandatory TLS encryption, require that the remote SMTP > > ! server hostname matches the information in the remote SMTP server > > ! certificate. As of RFC 2487 the requirements for hostname checking > > ! for MTA clients are not specified.
> > > > !This option can be set to "no" to disable strict peer name > > ! checking. This setting has no effect on sessions that are controlled > > ! via the smtp_tls_per_site table.
> > > > !Disabling the hostname verification can make sense in closed > > ! environment where special CAs are created. If not used carefully, > > ! this option opens the danger of a "man-in-the-middle" attack (the > > ! CommonName of this attacker will be logged).
> > > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> > > > *************** > > *** 9526,9547 **** > > > > !A case insensitive list of EHLO keywords (pipelining, starttls, > > ! auth, etc.) that the Postfix SMTP client will ignore in the EHLO > > ! response from a remote SMTP server.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > !Notes:
> > > > !Specify the silent-discard pseudo keyword to prevent > > ! this action from being logged.
> > > > !Use the smtp_discard_ehlo_keyword_address_maps feature to > > ! discard EHLO keywords selectively.
> > > > !List of ciphers or cipher types to exclude from the Postfix > > ! SMTP client cipher > > ! list at all TLS security levels. This is not an OpenSSL cipherlist, it is > > ! a simple list separated by whitespace and/or commas. The elements are a > > ! single cipher, or one or more "+" separated cipher properties, in which > > ! case only ciphers matching all the properties are excluded.
> > > > !Examples (some of these will cause problems):
> > > > !> > !> > > > !> > ! smtp_tls_exclude_ciphers = aNULL > > ! smtp_tls_exclude_ciphers = MD5, DES > > ! smtp_tls_exclude_ciphers = DES+MD5 > > ! smtp_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 > > ! smtp_tls_exclude_ciphers = kEDH+aRSA > > !> > !
The first setting, disables anonymous ciphers. The next setting > > ! disables ciphers that use the MD5 digest algorithm or the (single) DES > > ! encryption algorithm. The next setting disables ciphers that use MD5 and > > ! DES together. The next setting disables the two ciphers "AES256-SHA" > > ! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" > > ! key exchange with RSA authentication.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 9550,9576 **** > > > > !DNS Resolver options for the Postfix SMTP client. Specify zero > > ! or more of the following options, separated by comma or whitespace. > > ! Option names are case-sensitive. Some options refer to domain names > > ! that are specified in the file /etc/resolv.conf or equivalent.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 8767,8825 ---- > > > > !List of acceptable remote SMTP server certificate fingerprints > > ! for the "fingerprint" TLS security level (smtp_tls_security_level = > > ! fingerprint). At this security level, certificate authorities are > > ! not used, and certificate expiration times are ignored. Instead, > > ! server certificates are verified directly via their "fingerprint". The > > ! fingerprint is a message digest of the server certificate. The digest > > ! algorithm is selected via the smtp_tls_fingerprint_digest > > ! parameter.
> > > > !When an smtp_tls_policy_maps table entry specifies the > > ! "fingerprint" security level, any "match" attributes in that entry specify > > ! the list of valid fingerprints for the corresponding destination. Multiple > > ! fingerprints can be combined with a "|" delimiter in a single match > > ! attribute, or multiple match attributes can be employed.
> > > > !Example: Certificate fingerprint verification with internal mailhub. > > ! Two matching fingerprints are listed. The relayhost may be multiple > > ! physical hosts behind a load-balancer, each with its own private/public > > ! key and self-signed certificate. Alternatively, a single relayhost may > > ! be in the process of switching from one set of private/public keys to > > ! another, and both keys are trusted just prior to the transition.
> > > > !> > !> > > > !> > ! relayhost = [mailhub.example.com] > > ! smtp_tls_security_level = fingerprint > > ! smtp_tls_fingerprint_digest = md5 > > ! smtp_tls_fingerprint_cert_match = > > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > > !> > !
Example: Certificate fingerprint verification with selected destinations. > > ! As in the example above, we show two matching fingerprints:
> > > > !> > !> > > > !> > ! /etc/postfix/main.cf: > > ! smtp_tls_policy_maps = hash:/etc/postfix/tls_policy > > ! smtp_tls_fingerprint_digest = md5 > > !> > !
> > !> > > > !> > ! /etc/postfix/tls_policy: > > ! example.com fingerprint > > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > > !> > !
This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 9579,9661 **** > > > > !Enforcement mode: require that remote SMTP servers use TLS > > ! encryption, and never send mail in the clear. This also requires > > ! that the remote SMTP server hostname matches the information in > > ! the remote server certificate, and that the remote SMTP server > > ! certificate was issued by a CA that is trusted by the Postfix SMTP > > ! client. If the certificate doesn't verify or the hostname doesn't > > ! match, delivery is deferred and mail stays in the queue.
> > ! > > !The server hostname is matched against all names provided as > > ! dNSNames in the SubjectAlternativeName. If no dNSNames are specified, > > ! the CommonName is checked. The behavior may be changed with the > > ! smtp_tls_enforce_peername option.
> > ! > > !This option is useful only if you are definitely sure that you > > ! will only connect to servers that support RFC 2487 _and_ that > > ! provide valid server certificates. Typical use is for clients that > > ! send all their email to a dedicated mailhub.
> > ! > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> > ! > > ! > > !> > ! Optional list of relay hosts for SMTP destinations that can't be > > ! found or that are unreachable. With Postfix 2.2 and earlier this > > ! parameter is called fallback_relay.
> > > > !> > ! By default, mail is returned to the sender when a destination is > > ! not found, and delivery is deferred when a destination is unreachable. > >
> > > > !The fallback relays must be SMTP destinations. Specify a domain, > > ! host, host:port, [host]:port, [address] or [address]:port; the form > > ! [host] turns off MX lookups. If you specify multiple SMTP > > ! destinations, Postfix will try them in the specified order.
> > > > !To prevent mailer loops between MX hosts and fall-back hosts, > > ! Postfix version 2.2 and later will not use the fallback relays for > > ! destinations that it is MX host for (assuming DNS lookup is turned on). > >
> > > > > > !Optional lookup tables that perform address rewriting in the > > - Postfix SMTP client, typically to transform a locally valid address into > > - a globally valid address when sending mail across the Internet. > > - This is needed when the local machine does not have its own Internet > > - domain name, but uses something like localdomain.local > > - instead.
> > > > !The table format and lookups are documented in generic(5); > > ! examples are shown in the ADDRESS_REWRITING_README and > > ! STANDARD_CONFIGURATION_README documents.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !Restricted header_checks(5) tables for the Postfix SMTP client. > > ! These tables are searched while mail is being delivered. Actions > > ! that change the delivery time or destination are not available. > > !
> > > > !This feature is available in Postfix 2.5 and later.
> > > > --- 8828,8898 ---- > > > > !The message digest algorithm used to construct remote SMTP server > > ! certificate fingerprints. At the "fingerprint" TLS security level > > ! (smtp_tls_security_level = fingerprint), the server certificate is > > ! verified by directly matching its fingerprint. The fingerprint > > ! is the message digest of the server certificate using the selected > > ! algorithm. With a digest algorithm resistant to "second pre-image" > > ! attacks, it is not feasible to create a new public key and a matching > > ! certificate that has the same fingerprint.
> > > > !The default algorithm is md5; this is consistent with > > ! the backwards compatible setting of the digest used to verify client > > ! certificates in the SMTP server.
> > > > !The best practice algorithm is now sha1. Recent advances in hash > > ! function cryptanalysis have led to md5 being deprecated in favor of sha1. > > ! However, as long as there are no known "second pre-image" attacks > > ! against md5, its use in this context can still be considered safe. > >
> > > > !While additional digest algorithms are often available with OpenSSL's > > ! libcrypto, only those used by libssl in SSL cipher suites are available to > > ! Postfix. For now this means just md5 or sha1.
> > > > !To find the fingerprint of a specific certificate file, with a > > ! specific digest algorithm, run: > >
> > > > +> > +> > + > > +> > + $ openssl x509 -noout -fingerprint -digest -in certfile.pem > > +> > +
The text to the right of "=" sign is the desired fingerprint. > > + For example:
> > > > !> > !> > > > !> > ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem > > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A > > !> > !
This feature is available in Postfix 2.5 and later.
> > > > > > !File with the Postfix SMTP client RSA private key in PEM format. > > + This file may be combined with the Postfix SMTP client RSA certificate > > + file specified with $smtp_tls_cert_file.
> > > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted, but file permissions should grant read/write > > ! access only to the system superuser account ("root").
> > > > !Example:
> > > > !> > ! smtp_tls_key_file = $smtp_tls_cert_file > > !> > > > !
This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 9664,9709 **** > > > > !> > ! The hostname to send in the SMTP EHLO or HELO command. > > !
> > > > !> > ! The default value is the machine hostname. Specify a hostname or > > ! [ip.add.re.ss]. > > !
> > > > !> > ! This information can be specified in the main.cf file for all SMTP > > ! clients, or it can be specified in the master.cf file for a specific > > ! client, for example: > > !
> > > > !> > !> > > > !> > ! /etc/postfix/master.cf: > > ! mysmtp ... smtp -o smtp_helo_name=foo.bar.com > > !> > !
> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > !> > ! The Postfix SMTP client time limit for sending the HELO or EHLO command, > > ! and for receiving the initial remote SMTP server response. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > --- 8901,8929 ---- > > > > !Enable additional Postfix SMTP client logging of TLS activity. > > ! Each logging level also includes the information that is logged at > > ! a lower logging level.
> > > > !Use "smtp_tls_loglevel = 3" only in case of problems. Use of > > ! loglevel 4 is strongly discouraged.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 9712,9740 **** > > > > !> > ! What mechanisms the Postfix SMTP client uses to look up a host's IP > > ! address. This parameter is ignored when DNS lookups are disabled > > ! (see: disable_dns_lookups). > > !
> > > > !> > ! Specify one of the following: > > !
> > > >The minimum TLS cipher grade that the Postfix SMTP client will > > ! use with > > ! mandatory TLS encryption. The default value "medium" is suitable > > ! for most destinations with which you may want to enforce TLS, and > > ! is beyond the reach of today's crypt-analytic methods. See > > ! smtp_tls_policy_maps for information on how to configure ciphers > > ! on a per-destination basis.
> > > > !The following cipher grades are supported:
> > > >> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > --- 9003,9005 ---- > > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 9749,9767 **** > > > > !> > ! The maximal length of message header and body lines that Postfix > > ! will send via SMTP. This limit does not include the <CR><LF> > > ! at the end of each line. Longer lines are broken by inserting > > ! "<CR><LF><SPACE>", to minimize the damage to MIME > > ! formatted mail. > > !
> > > > !> > ! The Postfix limit of 998 characters not including <CR><LF> > > ! is consistent with the SMTP limit of 1000 characters including > > ! <CR><LF>. The Postfix limit was 990 with Postfix 2.8 > > ! and earlier. > > !
> > > > --- 9008,9018 ---- > > > > !Additional list of ciphers or cipher types to exclude from the > > ! SMTP client cipher list at mandatory TLS security levels. This list > > ! works in addition to the exclusions listed with smtp_tls_exclude_ciphers > > ! (see there for syntax details).
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 9770,9796 **** > > > > !> > ! The Postfix SMTP client time limit for sending the MAIL FROM command, > > ! and for receiving the remote SMTP server response. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > > > !Restricted mime_header_checks(5) tables for the Postfix SMTP > > ! client. These tables are searched while mail is being delivered. > > ! Actions that change the delivery time or destination are not > > ! available.
> > > > !This feature is available in Postfix 2.5 and later.
> > > > --- 9021,9056 ---- > > > > !List of SSL/TLS protocols that the Postfix SMTP client will use with > > ! mandatory TLS encryption. In main.cf the values are separated by > > ! whitespace, commas or colons. In the policy table "protocols" attribute > > ! (see smtp_tls_policy_maps) the only valid separator is colon. An > > ! empty value means allow all protocols. The valid protocol names, (see > > ! SSL_get_version(3)), are "SSLv2", "SSLv3" and "TLSv1".
> > > > !With Postfix ≥ 2.5 the parameter syntax is expanded to support > > ! protocol exclusions. One can now explicitly exclude SSLv2 by setting > > ! "smtp_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and > > ! SSLv3 set "smtp_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing > > ! the protocols to include, rather than protocols to exclude, is still > > ! supported; use the form you find more intuitive.
> > > > +Since SSL version 2 has known protocol weaknesses and is now > > + deprecated, the default setting excludes "SSLv2". This means that by > > + default, SSL version 2 will not be used at the "encrypt" security level > > + and higher.
> > > > !See the documentation of the smtp_tls_policy_maps parameter and > > ! TLS_README for more information about security levels.
> > > > !Example:
> > > > !> > ! smtp_tls_mandatory_protocols = TLSv1 > > ! # Alternative form with Postfix ≥ 2.5: > > ! smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 > > !> > > > !
This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 9799,9828 **** > > > > !> > ! The maximal number of MX (mail exchanger) IP addresses that can > > ! result from Postfix SMTP client mail exchanger lookups, or zero (no > > ! limit). Prior to > > ! Postfix version 2.3, this limit was disabled by default. > > !
> > ! > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > ! > > > > !The maximal number of SMTP sessions per delivery request before > > ! the Postfix SMTP client > > ! gives up or delivers to a fall-back relay host, or zero (no > > ! limit). This restriction ignores sessions that fail to complete the > > ! SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to > > ! complete the EHLO and TLS handshake (Postfix version 2.3 and later).
> > > > !This feature is available in Postfix 2.1 and later.
> > > > --- 9059,9073 ---- > > > > !Log the hostname of a remote SMTP server that offers STARTTLS, > > ! when TLS is not already enabled for that server.
> > > > !The logfile record looks like:
> > > > !> > ! postfix/smtp[pid]: Host offered STARTTLS: [name.of.host] > > !> > > > !
This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 9831,9890 **** > > > > !Restricted nested_header_checks(5) tables for the Postfix SMTP > > ! client. These tables are searched while mail is being delivered. > > ! Actions that change the delivery time or destination are not > > ! available.
> > ! > > !This feature is available in Postfix 2.5 and later.
> > ! > > ! > > !Never send EHLO at the start of an SMTP session. See also the > > ! smtp_always_send_ehlo parameter.
> > > > > > !Change the behavior of the smtp_*_timeout time limits, from a > > ! time limit per read or write system call, to a time limit to send > > ! or receive a complete record (an SMTP command line, SMTP response > > ! line, SMTP message content line, or TLS protocol message). This > > ! limits the impact from hostile peers that trickle data one byte at > > ! a time.
> > ! > > !Note: when per-record deadlines are enabled, a short timeout > > ! may cause problems with TLS over very slow network connections. > > ! The reasons are that a TLS protocol message can be up to 16 kbytes > > ! long (with TLSv1), and that an entire TLS protocol message must be > > ! sent or received within the per-record deadline.
> > > > !This feature is available in Postfix 2.9 and later. With older > > ! Postfix releases, the behavior is as if this parameter is set to > > ! "no".
> > > > > > !> > ! How long the Postfix SMTP client pauses before sending > > ! ".<CR><LF>" in order to work around the PIX firewall > > ! "<CR><LF>.<CR><LF>" bug. > > !
> > > > !> > ! Choosing a too short time makes this workaround ineffective when > > ! sending large messages over slow network connections. > > !
> > > > --- 9076,9151 ---- > > > > !Optional lookup tables with the Postfix SMTP client TLS usage > > ! policy by next-hop destination and by remote SMTP server hostname. > > ! When both lookups succeed, the more specific per-site policy (NONE, > > ! MUST, etc) overrides the less specific one (MAY), and the more secure > > ! per-site policy (MUST, etc) overrides the less secure one (NONE). > > ! With Postfix 2.3 and later smtp_tls_per_site is strongly discouraged: > > ! use smtp_tls_policy_maps instead.
> > > > !Use of the bare hostname as the per-site table lookup key is > > ! discouraged. Always use the full destination nexthop (enclosed in > > ! [] with a possible ":port" suffix). A recipient domain or MX-enabled > > ! transport next-hop with no port suffix may look like a bare hostname, > > ! but is still a suitable destination.
> > > > +Specify a next-hop destination or server hostname on the left-hand > > + side; no wildcards are allowed. The next-hop destination is either > > + the recipient domain, or the destination specified with a transport(5) > > + table, the relayhost parameter, or the relay_transport parameter. > > + On the right hand side specify one of the following keywords:
> > > > !The above keywords correspond to the "none", "may", "encrypt" and > > ! "verify" security levels for the new smtp_tls_security_level parameter > > ! introduced in Postfix 2.3. Starting with Postfix 2.3, and independently > > ! of how the policy is specified, the smtp_tls_mandatory_ciphers and > > ! smtp_tls_mandatory_protocols parameters only apply when TLS encryption > > ! is mandatory. Connections for which encryption is optional enable > > ! all "export" grade and better ciphers.
> > > > !As long as no secure DNS lookup mechanism is available, false > > ! hostnames in MX or CNAME responses can change the server hostname > > ! that Postfix uses for TLS policy lookup and server certificate > > ! verification. Even with a perfect match between the server hostname and > > ! the server certificate, there is no guarantee that Postfix is connected > > ! to the right server. See TLS_README (Closing a DNS loophole with obsolete > > ! per-site TLS policies) for a possible work-around.
> > > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtp_tls_policy_maps instead.
> > > > *************** > > *** 9893,9938 **** > > > > !Lookup tables, indexed by the remote SMTP server address, with > > ! per-destination workarounds for CISCO PIX firewall bugs. The table > > ! is not indexed by hostname for consistency with > > ! smtp_discard_ehlo_keyword_address_maps.
> > ! > > !This feature is available in Postfix 2.4 and later.
> > ! > > ! > > !How long a message must be queued before the Postfix SMTP client > > ! turns on the PIX firewall "<CR><LF>.<CR><LF>" > > ! bug workaround for delivery through firewalls with "smtp fixup" > > ! mode turned on.
> > ! > > !> > ! By default, the workaround is turned off for mail that is queued > > ! for less than 500 seconds. In other words, the workaround is normally > > ! turned off for the first delivery attempt. > > !
> > ! > > !> > ! Specify 0 to enable the PIX firewall > > ! "<CR><LF>.<CR><LF>" bug workaround upon the > > ! first delivery attempt. > >
> > > > > > !A list that specifies zero or more workarounds for CISCO PIX > > ! firewall bugs. These workarounds are implemented by the Postfix > > ! SMTP client. Workaround names are separated by comma or space, and > > ! are case insensitive. This parameter setting can be overruled with > > ! per-destination smtp_pix_workaround_maps settings.
> > > > --- 9154,9188 ---- > > > > !Optional lookup tables with the Postfix SMTP client TLS security > > ! policy by next-hop destination; when a non-empty value is specified, > > ! this overrides the obsolete smtp_tls_per_site parameter. See > > ! TLS_README for a more detailed discussion of TLS security levels. > >
> > > > +The TLS policy table is indexed by the full next-hop destination, > > + which is either the recipient domain, or the verbatim next-hop > > + specified in the transport table, $local_transport, $virtual_transport, > > + $relay_transport or $default_transport. This includes any enclosing > > + square brackets and any non-default destination server port suffix. The > > + LMTP socket type prefix (inet: or unix:) is not included in the lookup > > + key.
> > > > !Only the next-hop domain, or $myhostname with LMTP over UNIX-domain > > ! sockets, is used as the nexthop name for certificate verification. The > > ! port and any enclosing square brackets are used in the table lookup key, > > ! but are not used for server name verification.
> > > > !When the lookup key is a domain name without enclosing square brackets > > ! or any :port suffix (typically the recipient domain), and the full > > ! domain is not found in the table, just as with the transport(5) table, > > ! the parent domain starting with a leading "." is matched recursively. This > > ! allows one to specify a security policy for a recipient domain and all > > ! its sub-domains.
> > > > !The lookup result is a security level, followed by an optional list > > ! of whitespace and/or comma separated name=value attributes that override > > ! related main.cf settings. The TLS security levels in order of increasing > > ! security are:
> > > > *************** > > *** 9940,12458 **** > > > > !This feature is available in Postfix 2.4 and later. The default > > ! settings are backwards compatible with earlier Postfix versions. > > !
> > > > > > !> > ! The Postfix SMTP client time limit for sending the QUIT command, > > ! and for receiving the remote SMTP server response. > > !
> > > >> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > > > ! > > !> > ! Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO commands > > ! as required > > ! by RFC 2821. This includes putting quotes around an address localpart > > ! that ends in ".". > > !
> > ! > > !> > ! The default is to comply with RFC 2821. If you have to send mail to > > ! a broken SMTP server, configure a special SMTP client in master.cf: > > !
> > ! > > !> > !> > ! > > !> > ! /etc/postfix/master.cf: > > ! broken-smtp . . . smtp -o smtp_quote_rfc821_envelope=no > > !> > !
> > ! and route mail for the destination in question to the "broken-smtp" > > ! message delivery with a transport(5) table. > > !
> > ! > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > ! > > ! > > !> > ! Randomize the order of equal-preference MX host addresses. This > > ! is a performance feature of the Postfix SMTP client. > > !
> > ! > > ! > > !> > ! The Postfix SMTP client time limit for sending the SMTP RCPT TO > > ! command, and for receiving the remote SMTP server response. > > !
> > ! > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > ! > > ! > > !A mechanism to transform replies from remote SMTP servers one > > ! line at a time. This is a last-resort tool to work around server > > ! replies that break inter-operability with the Postfix SMTP client. > > ! Other uses involve fault injection to test Postfix's handling of > > ! invalid responses.
> > ! > > !Notes:
> > ! > > !In the case of a multi-line reply, the Postfix SMTP client > > ! uses the final reply line's numerical SMTP reply code and enhanced > > ! status code.
> > ! > > !The numerical SMTP reply code (XYZ) takes precedence over > > ! the enhanced status code (X.Y.Z). When the enhanced status code > > ! initial digit differs from the SMTP reply code initial digit, or > > ! when no enhanced status code is present, the Postfix SMTP client > > ! uses a generic enhanced status code (X.0.0) instead.
> > ! > > !Specify the name of a "type:table" lookup table. The search > > ! string is a single SMTP reply line as received from the remote SMTP > > ! server, except that the trailing <CR><LF> are removed. > > ! When the lookup succeeds, the result replaces the single SMTP reply > > ! line.
> > ! > > !Examples:
> > ! > > !> > ! /etc/postfix/main.cf: > > ! smtp_reply_filter = pcre:/etc/postfix/reply_filter > > !> > ! > > !
> > ! /etc/postfix/reply_filter: > > ! # Transform garbage into "250-filler..." so that it looks like > > ! # one line from a multi-line reply. It does not matter what we > > ! # substitute here as long it has the right syntax. The Postfix > > ! # SMTP client will use the final line's numerical SMTP reply > > ! # code and enhanced status code. > > ! !/^([2-5][0-9][0-9]($|[- ]))/ 250-filler for garbage > > !> > ! > > !
This feature is available in Postfix 2.7.
> > ! > > ! > > !The Postfix SMTP client time limit for sending the RSET command, > > ! and for receiving the remote SMTP server response. The SMTP client > > ! sends RSET in > > ! order to finish a recipient address probe, or to verify that a > > ! cached session is still usable.
> > ! > > !This feature is available in Postfix 2.1 and later.
> > ! > > ! > > !An optional table to prevent repeated SASL authentication > > ! failures with the same remote SMTP server hostname, username and > > ! password. Each table (key, value) pair contains a server name, a > > ! username and password, and the full server response. This information > > ! is stored when a remote SMTP server rejects an authentication attempt > > ! with a 535 reply code. As long as the smtp_sasl_password_maps > > ! information does no change, and as long as the smtp_sasl_auth_cache_name > > ! information does not expire (see smtp_sasl_auth_cache_time) the > > ! Postfix SMTP client avoids SASL authentication attempts with the > > ! same server, username and password, and instead bounces or defers > > ! mail as controlled with the smtp_sasl_auth_soft_bounce configuration > > ! parameter.
> > ! > > !Use a per-destination delivery concurrency of 1 (for example, > > ! "smtp_destination_concurrency_limit = 1", > > ! "relay_destination_concurrency_limit = 1", etc.), otherwise multiple > > ! delivery agents may experience a login failure at the same time. > > !
> > ! > > !The table must be accessed via the proxywrite service, i.e. the > > ! map name must start with "proxy:". The table should be stored under > > ! the directory specified with the data_directory parameter.
> > ! > > !This feature uses cryptographic hashing to protect plain-text > > ! passwords, and requires that Postfix is compiled with TLS support. > > !
> > ! > > !Example:
> > ! > > !> > ! smtp_sasl_auth_cache_name = proxy:btree:/var/lib/postfix/sasl_auth_cache > > !> > ! > > !
This feature is available in Postfix 2.5 and later.
> > ! > > ! > > !The maximal age of an smtp_sasl_auth_cache_name entry before it > > ! is removed.
> > ! > > !This feature is available in Postfix 2.5 and later.
> > ! > > ! > > !> > ! Enable SASL authentication in the Postfix SMTP client. By default, > > ! the Postfix SMTP client uses no authentication. > > !
> > ! > > !> > ! Example: > > !
> > ! > > !> > ! smtp_sasl_auth_enable = yes > > !> > ! > > ! > > !
When a remote SMTP server rejects a SASL authentication request > > ! with a 535 reply code, defer mail delivery instead of returning > > ! mail as undeliverable. The latter behavior was hard-coded prior to > > ! Postfix version 2.5.
> > ! > > !Note: the setting "yes" overrides the global soft_bounce > > ! parameter, but the setting "no" does not.
> > ! > > !Example:
> > ! > > !> > ! # Default as of Postfix 2.5 > > ! smtp_sasl_auth_soft_bounce = yes > > ! # The old hard-coded default > > ! smtp_sasl_auth_soft_bounce = no > > !> > ! > > !
This feature is available in Postfix 2.5 and later.
> > ! > > ! > > !> > ! If non-empty, a Postfix SMTP client filter for the remote SMTP > > ! server's list of offered SASL mechanisms. Different client and > > ! server implementations may support different mechanism lists; by > > ! default, the Postfix SMTP client will use the intersection of the > > ! two. smtp_sasl_mechanism_filter specifies an optional third mechanism > > ! list to intersect with.
> > ! > > !Specify mechanism names, "/file/name" patterns or "type:table" > > ! lookup tables. The right-hand side result from "type:table" lookups > > ! is ignored. Specify "!pattern" to exclude a mechanism name from the > > ! list. The form "!/file/name" is supported only in Postfix version > > ! 2.4 and later.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > !> > ! Examples: > > !
> > ! > > !> > ! smtp_sasl_mechanism_filter = plain, login > > ! smtp_sasl_mechanism_filter = /etc/postfix/smtp_mechs > > ! smtp_sasl_mechanism_filter = !gssapi, !login, static:rest > > !> > ! > > ! > > !
> > ! Optional Postfix SMTP client lookup tables with one username:password > > ! entry > > ! per remote hostname or domain, or sender address when sender-dependent > > ! authentication is enabled. If no username:password entry is found, > > ! then the Postfix SMTP client will not > > ! attempt to authenticate to the remote host. > > !
> > ! > > !> > ! The Postfix SMTP client opens the lookup table before going to > > ! chroot jail, so you can leave the password file in /etc/postfix. > > !
> > ! > > ! > > !Implementation-specific information that the Postfix SMTP client > > ! passes through to > > ! the SASL plug-in implementation that is selected with > > ! smtp_sasl_type. Typically this specifies the name of a > > ! configuration file or rendezvous point.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !Postfix SMTP client SASL security options; as of Postfix 2.3 > > ! the list of available > > ! features depends on the SASL client implementation that is selected > > ! with smtp_sasl_type.
> > ! > > !The following security features are defined for the cyrus > > ! client SASL implementation:
> > ! > > !> > ! Specify zero or more of the following: > > !
> > ! > > !> > ! Example: > > !
> > ! > > !> > ! smtp_sasl_security_options = noplaintext > > !> > ! > > ! > > !
The SASL authentication security options that the Postfix SMTP > > ! client uses for TLS encrypted SMTP sessions.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !The SASL authentication security options that the Postfix SMTP > > ! client uses for TLS encrypted SMTP sessions with a verified server > > ! certificate.
> > ! > > !When mail is sent to the public MX host for the recipient's > > ! domain, server certificates are by default optional, and delivery > > ! proceeds even if certificate verification fails. For delivery via > > ! a submission service that requires SASL authentication, it may be > > ! appropriate to send plaintext passwords only when the connection > > ! to the server is strongly encrypted and the server identity > > ! is verified.
> > ! > > !The smtp_sasl_tls_verified_security_options parameter makes it > > ! possible to only enable plaintext mechanisms when a secure connection > > ! to the server is available. Submission servers subject to this > > ! policy must either have verifiable certificates or offer suitable > > ! non-plaintext SASL mechanisms.
> > ! > > !This feature is available in Postfix 2.6 and later.
> > ! > > ! > > !The SASL plug-in type that the Postfix SMTP client should use > > ! for authentication. The available types are listed with the > > ! "postconf -A" command.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !Whether or not to append the "AUTH=<>" option to the MAIL > > ! FROM command in SASL-authenticated SMTP sessions. The default is > > ! not to send this, to avoid problems with broken remote SMTP servers. > > ! Before Postfix 2.9 the behavior is as if "smtp_send_dummy_mail_auth > > ! = yes". > > ! > > !
This feature is available in Postfix 2.9 and later.
> > ! > > ! > > !> > ! Send the non-standard XFORWARD command when the Postfix SMTP server > > ! EHLO response announces XFORWARD support. > > !
> > ! > > !> > ! This allows a Postfix SMTP delivery agent, used for injecting mail > > ! into > > ! a content filter, to forward the name, address, protocol and HELO > > ! name of the original client to the content filter and downstream > > ! queuing SMTP server. This can produce more useful logging than > > ! localhost[127.0.0.1] etc. > > !
> > ! > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > ! > > ! > > !> > ! Enable sender-dependent authentication in the Postfix SMTP client; this is > > ! available only with SASL authentication, and disables SMTP connection > > ! caching to ensure that mail from different senders will use the > > ! appropriate credentials.
> > ! > > !> > ! This feature is available in Postfix 2.3 and later. > > !
> > ! > > ! > > !> > ! Skip SMTP servers that greet with a 4XX status code (go away, try > > ! again later). > > !
> > ! > > !> > ! By default, the Postfix SMTP client moves on the next mail exchanger. > > ! Specify > > ! "smtp_skip_4xx_greeting = no" if Postfix should defer delivery > > ! immediately. > > !
> > ! > > !This feature is available in Postfix 2.0 and earlier. > > ! Later Postfix versions always skip remote SMTP servers that greet > > ! with a > > ! 4XX status code.
> > ! > > ! > > !> > ! Skip remote SMTP servers that greet with a 5XX status code (go away, > > ! do > > ! not try again later). > > !
> > ! > > !By default, the Postfix SMTP client moves on the next mail > > ! exchanger. Specify "smtp_skip_5xx_greeting = no" if Postfix should > > ! bounce the mail immediately. The default setting is incorrect, but > > ! it is what a lot of people expect to happen.
> > ! > > ! > > !> > ! Do not wait for the response to the SMTP QUIT command. > > !
> > ! > > ! > > !Time limit for Postfix SMTP client write and read operations > > ! during TLS startup and shutdown handshake procedures.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !A file containing CA certificates of root CAs trusted to sign > > ! either remote SMTP server certificates or intermediate CA certificates. > > ! These are loaded into memory before the smtp(8) client enters the > > ! chroot jail. If the number of trusted roots is large, consider using > > ! smtp_tls_CApath instead, but note that the latter directory must be > > ! present in the chroot jail if the smtp(8) client is chrooted. This > > ! file may also be used to augment the client certificate trust chain, > > ! but it is best to include all the required certificates directly in > > ! $smtp_tls_cert_file.
> > ! > > !Specify "smtp_tls_CAfile = /path/to/system_CA_file" to use > > ! ONLY the system-supplied default certificate authority certificates. > > !
> > ! > > !Specify "tls_append_default_CA = no" to prevent Postfix from > > ! appending the system-supplied default CAs and trusting third-party > > ! certificates.
> > ! > > !Example:
> > ! > > !> > ! smtp_tls_CAfile = /etc/postfix/CAcert.pem > > !> > ! > > !
This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !Directory with PEM format certificate authority certificates > > ! that the Postfix SMTP client uses to verify a remote SMTP server > > ! certificate. Don't forget to create the necessary "hash" links > > ! with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". > > !
> > ! > > !To use this option in chroot mode, this directory (or a copy) > > ! must be inside the chroot jail.
> > ! > > !Specify "smtp_tls_CApath = /path/to/system_CA_directory" to > > ! use ONLY the system-supplied default certificate authority certificates. > > !
> > ! > > !Specify "tls_append_default_CA = no" to prevent Postfix from > > ! appending the system-supplied default CAs and trusting third-party > > ! certificates.
> > ! > > !Example:
> > ! > > !> > ! smtp_tls_CApath = /etc/postfix/certs > > !> > ! > > !
This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !Try to detect a mail hijacking attack based on a TLS protocol > > ! vulnerability (CVE-2009-3555), where an attacker prepends malicious > > ! HELO, MAIL, RCPT, DATA commands to a Postfix SMTP client TLS session. > > ! The attack would succeed with non-Postfix SMTP servers that reply > > ! to the malicious HELO, MAIL, RCPT, DATA commands after negotiating > > ! the Postfix SMTP client TLS session.
> > ! > > !This feature is available in Postfix 2.7.
> > ! > > ! > > !File with the Postfix SMTP client RSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP client private RSA key, > > ! and these may be the same as the Postfix SMTP server RSA certificate and key > > ! file.
> > ! > > !Do not configure client certificates unless you must present > > ! client TLS certificates to one or more servers. Client certificates are > > ! not usually needed, and can cause problems in configurations that work > > ! well without them. The recommended setting is to let the defaults stand:
> > ! > > !> > !> > ! > > !> > ! smtp_tls_cert_file = > > ! smtp_tls_key_file = > > ! smtp_tls_dcert_file = > > ! smtp_tls_dkey_file = > > ! smtp_tls_eccert_file = > > ! smtp_tls_eckey_file = > > !> > !
The best way to use the default settings is to comment out the above > > ! parameters in main.cf if present.
> > ! > > !To enable remote SMTP servers to verify the Postfix SMTP client > > ! certificate, the issuing CA certificates must be made available to the > > ! server. You should include the required certificates in the client > > ! certificate file, the client certificate first, then the issuing > > ! CA(s) (bottom-up order).
> > ! > > !Example: the certificate for "client.example.com" was issued by > > ! "intermediate CA" which itself has a certificate issued by "root CA". > > ! Create the client.pem file with "cat client_cert.pem intermediate_CA.pem > > ! root_CA.pem > client.pem".
> > ! > > !If you also want to verify remote SMTP server certificates issued by > > ! these CAs, you can add the CA certificates to the smtp_tls_CAfile, in > > ! which case it is not necessary to have them in the smtp_tls_cert_file, > > ! smtp_tls_dcert_file or smtp_tls_eccert_file.
> > ! > > !A certificate supplied here must be usable as an SSL client certificate > > ! and hence pass the "openssl verify -purpose sslclient ..." test.
> > ! > > !Example:
> > ! > > !> > ! smtp_tls_cert_file = /etc/postfix/client.pem > > !> > ! > > !
This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !Obsolete Postfix < 2.3 control for the Postfix SMTP client TLS > > ! cipher list. As this feature applies to all TLS security levels, it is easy > > ! to create inter-operability problems by choosing a non-default cipher > > ! list. Do not use a non-default TLS cipher list on hosts that deliver email > > ! to the public Internet: you will be unable to send email to servers that > > ! only support the ciphers you exclude. Using a restricted cipher list > > ! may be more appropriate for an internal MTA, where one can exert some > > ! control over the TLS software and settings of the peer servers.
> > ! > > !Note: do not use "" quotes around the parameter value.
> > ! > > !This feature is available in Postfix version 2.2. It is not used with > > ! Postfix 2.3 and later; use smtp_tls_mandatory_ciphers instead.
> > ! > > ! > > !The minimum TLS cipher grade that the Postfix SMTP client > > ! will use with opportunistic TLS encryption. Cipher types listed in > > ! smtp_tls_exclude_ciphers are excluded from the base definition of > > ! the selected cipher grade. The default value "export" ensures maximum > > ! inter-operability. Because encryption is optional, stronger controls > > ! are not appropriate, and this setting SHOULD NOT be changed unless the > > ! change is essential.
> > ! > > !When TLS is mandatory the cipher grade is chosen via the > > ! smtp_tls_mandatory_ciphers configuration parameter, see there for syntax > > ! details. See smtp_tls_policy_maps for information on how to configure > > ! ciphers on a per-destination basis.
> > ! > > !Example:
> > !> > ! smtp_tls_ciphers = export > > !> > ! > > !
This feature is available in Postfix 2.6 and later. With earlier Postfix > > ! releases only the smtp_tls_mandatory_ciphers parameter is implemented, > > ! and opportunistic TLS always uses "export" or better (i.e. all) ciphers.
> > ! > > ! > > !File with the Postfix SMTP client DSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP client private DSA key.
> > ! > > !See the discussion under smtp_tls_cert_file for more details. > > !
> > ! > > !Example:
> > ! > > !> > ! smtp_tls_dcert_file = /etc/postfix/client-dsa.pem > > !> > ! > > !
This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !File with the Postfix SMTP client DSA private key in PEM format. > > ! This file may be combined with the Postfix SMTP client DSA certificate > > ! file specified with $smtp_tls_dcert_file.
> > ! > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted. File permissions should grant read-only > > ! access to the system superuser account ("root"), and no access > > ! to anyone else.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !File with the Postfix SMTP client ECDSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP client ECDSA private key.
> > ! > > !See the discussion under smtp_tls_cert_file for more details. > > !
> > ! > > !Example:
> > ! > > !> > ! smtp_tls_eccert_file = /etc/postfix/ecdsa-ccert.pem > > !> > ! > > !
This feature is available in Postfix 2.6 and later, when Postfix is > > ! compiled and linked with OpenSSL 1.0.0 or later.
> > ! > > ! > > !File with the Postfix SMTP client ECDSA private key in PEM format. > > ! This file may be combined with the Postfix SMTP client ECDSA > > ! certificate file specified with $smtp_tls_eccert_file.
> > ! > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted. File permissions should grant read-only > > ! access to the system superuser account ("root"), and no access > > ! to anyone else.
> > ! > > !This feature is available in Postfix 2.6 and later, when Postfix is > > ! compiled and linked with OpenSSL 1.0.0 or later.
> > ! > > ! > > !With mandatory TLS encryption, require that the remote SMTP > > ! server hostname matches the information in the remote SMTP server > > ! certificate. As of RFC 2487 the requirements for hostname checking > > ! for MTA clients are not specified.
> > ! > > !This option can be set to "no" to disable strict peer name > > ! checking. This setting has no effect on sessions that are controlled > > ! via the smtp_tls_per_site table.
> > ! > > !Disabling the hostname verification can make sense in closed > > ! environment where special CAs are created. If not used carefully, > > ! this option opens the danger of a "man-in-the-middle" attack (the > > ! CommonName of this attacker will be logged).
> > ! > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> > ! > > ! > > !List of ciphers or cipher types to exclude from the Postfix > > ! SMTP client cipher > > ! list at all TLS security levels. This is not an OpenSSL cipherlist, it is > > ! a simple list separated by whitespace and/or commas. The elements are a > > ! single cipher, or one or more "+" separated cipher properties, in which > > ! case only ciphers matching all the properties are excluded.
> > ! > > !Examples (some of these will cause problems):
> > ! > > !> > !> > ! > > !> > ! smtp_tls_exclude_ciphers = aNULL > > ! smtp_tls_exclude_ciphers = MD5, DES > > ! smtp_tls_exclude_ciphers = DES+MD5 > > ! smtp_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 > > ! smtp_tls_exclude_ciphers = kEDH+aRSA > > !> > !
The first setting, disables anonymous ciphers. The next setting > > ! disables ciphers that use the MD5 digest algorithm or the (single) DES > > ! encryption algorithm. The next setting disables ciphers that use MD5 and > > ! DES together. The next setting disables the two ciphers "AES256-SHA" > > ! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" > > ! key exchange with RSA authentication.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !List of acceptable remote SMTP server certificate fingerprints for > > ! the "fingerprint" TLS security level (smtp_tls_security_level = > > ! fingerprint). At this security level, certificate authorities are not > > ! used, and certificate expiration times are ignored. Instead, server > > ! certificates are verified directly via their certificate fingerprint > > ! or public key fingerprint (Postfix 2.9 and later). The fingerprint > > ! is a message digest of the server certificate (or public key). The > > ! digest algorithm is selected via the smtp_tls_fingerprint_digest > > ! parameter.
> > ! > > !When an smtp_tls_policy_maps table entry specifies the > > ! "fingerprint" security level, any "match" attributes in that entry specify > > ! the list of valid fingerprints for the corresponding destination. Multiple > > ! fingerprints can be combined with a "|" delimiter in a single match > > ! attribute, or multiple match attributes can be employed.
> > ! > > !Example: Certificate fingerprint verification with internal mailhub. > > ! Two matching fingerprints are listed. The relayhost may be multiple > > ! physical hosts behind a load-balancer, each with its own private/public > > ! key and self-signed certificate. Alternatively, a single relayhost may > > ! be in the process of switching from one set of private/public keys to > > ! another, and both keys are trusted just prior to the transition.
> > ! > > !> > !> > ! > > !> > ! relayhost = [mailhub.example.com] > > ! smtp_tls_security_level = fingerprint > > ! smtp_tls_fingerprint_digest = md5 > > ! smtp_tls_fingerprint_cert_match = > > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > > !> > !
Example: Certificate fingerprint verification with selected destinations. > > ! As in the example above, we show two matching fingerprints:
> > ! > > !> > !> > ! > > !> > ! /etc/postfix/main.cf: > > ! smtp_tls_policy_maps = hash:/etc/postfix/tls_policy > > ! smtp_tls_fingerprint_digest = md5 > > !> > !
> > !> > ! > > !> > ! /etc/postfix/tls_policy: > > ! example.com fingerprint > > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > > !> > !
This feature is available in Postfix 2.5 and later.
> > ! > > ! > > !The message digest algorithm used to construct remote SMTP server > > ! certificate fingerprints. At the "fingerprint" TLS security level > > ! (smtp_tls_security_level = fingerprint), the server certificate is > > ! verified by directly matching its certificate fingerprint or its public > > ! key fingerprint (Postfix 2.9 and later). The fingerprint is the > > ! message digest of the server certificate (or its public key) > > ! using the selected > > ! algorithm. With a digest algorithm resistant to "second pre-image" > > ! attacks, it is not feasible to create a new public key and a matching > > ! certificate (or public/private key-pair) that has the same fingerprint.
> > ! > > !The default algorithm is md5; this is consistent with > > ! the backwards compatible setting of the digest used to verify client > > ! certificates in the SMTP server.
> > ! > > !The best practice algorithm is now sha1. Recent advances in hash > > ! function cryptanalysis have led to md5 being deprecated in favor of sha1. > > ! However, as long as there are no known "second pre-image" attacks > > ! against md5, its use in this context can still be considered safe. > > !
> > ! > > !While additional digest algorithms are often available with OpenSSL's > > ! libcrypto, only those used by libssl in SSL cipher suites are available to > > ! Postfix. For now this means just md5 or sha1.
> > ! > > !To find the fingerprint of a specific certificate file, with a > > ! specific digest algorithm, run: > > !
> > ! > > !> > !> > ! > > !> > ! $ openssl x509 -noout -fingerprint -digest -in certfile.pem > > !> > !
The text to the right of "=" sign is the desired fingerprint. > > ! For example:
> > ! > > !> > !> > ! > > !> > ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem > > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A > > !> > !
Public key fingerprints are more difficult to extract, however, > > ! the SHA-1 public key fingerprint is often present as the value of the > > ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix > > ! SMTP server and client log the peer certificate fingerprint and public > > ! key fingerprint when TLS loglevel is 1 or higher.
> > ! > > !This feature is available in Postfix 2.5 and later.
> > ! > > ! > > !File with the Postfix SMTP client RSA private key in PEM format. > > ! This file may be combined with the Postfix SMTP client RSA certificate > > ! file specified with $smtp_tls_cert_file.
> > ! > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted. File permissions should grant read-only > > ! access to the system superuser account ("root"), and no access > > ! to anyone else.
> > ! > > !Example:
> > ! > > !> > ! smtp_tls_key_file = $smtp_tls_cert_file > > !> > ! > > !
This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !Enable additional Postfix SMTP client logging of TLS activity. > > ! Each logging level also includes the information that is logged at > > ! a lower logging level.
> > ! > > !Do not use "smtp_tls_loglevel = 2" or higher except in case of > > ! problems. Use of loglevel 4 is strongly discouraged.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !The minimum TLS cipher grade that the Postfix SMTP client will > > ! use with > > ! mandatory TLS encryption. The default value "medium" is suitable > > ! for most destinations with which you may want to enforce TLS, and > > ! is beyond the reach of today's cryptanalytic methods. See > > ! smtp_tls_policy_maps for information on how to configure ciphers > > ! on a per-destination basis.
> > ! > > !The following cipher grades are supported:
> > ! > > !The underlying cipherlists for grades other than "null" include > > ! anonymous ciphers, but these are automatically filtered out if the > > ! Postfix SMTP client is configured to verify server certificates. > > ! You are very unlikely to need to take any steps to exclude anonymous > > ! ciphers, they are excluded automatically as necessary. If you must > > ! exclude anonymous ciphers at the "may" or "encrypt" security levels, > > ! when the Postfix SMTP client does not need or use peer certificates, set > > ! "smtp_tls_exclude_ciphers = aNULL". To exclude anonymous ciphers only when > > ! TLS is enforced, set "smtp_tls_mandatory_exclude_ciphers = aNULL".
> > ! > > !This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !Additional list of ciphers or cipher types to exclude from the > > ! Postfix SMTP client cipher list at mandatory TLS security levels. This list > > ! works in addition to the exclusions listed with smtp_tls_exclude_ciphers > > ! (see there for syntax details).
> > ! > > !Starting with Postfix 2.6, the mandatory cipher exclusions can be > > ! specified on a per-destination basis via the TLS policy "exclude" > > ! attribute. See smtp_tls_policy_maps for notes and examples.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !List of SSL/TLS protocols that the Postfix SMTP client will use with > > ! mandatory TLS encryption. In main.cf the values are separated by > > ! whitespace, commas or colons. In the policy table "protocols" attribute > > ! (see smtp_tls_policy_maps) the only valid separator is colon. An > > ! empty value means allow all protocols. The valid protocol names, (see > > ! SSL_get_version(3)), are "SSLv2", "SSLv3" and "TLSv1".
> > ! > > !With Postfix ≥ 2.5 the parameter syntax is expanded to support > > ! protocol exclusions. One can now explicitly exclude SSLv2 by setting > > ! "smtp_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and > > ! SSLv3 set "smtp_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing > > ! the protocols to include, rather than protocols to exclude, is still > > ! supported; use the form you find more intuitive.
> > ! > > !Since SSL version 2 has known protocol weaknesses and is now > > ! deprecated, the default setting excludes "SSLv2". This means that by > > ! default, SSL version 2 will not be used at the "encrypt" security level > > ! and higher.
> > ! > > !See the documentation of the smtp_tls_policy_maps parameter and > > ! TLS_README for more information about security levels.
> > ! > > !Example:
> > ! > > !> > ! smtp_tls_mandatory_protocols = TLSv1 > > ! # Alternative form with Postfix ≥ 2.5: > > ! smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 > > !> > ! > > !
This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !Log the hostname of a remote SMTP server that offers STARTTLS, > > ! when TLS is not already enabled for that server.
> > ! > > !The logfile record looks like:
> > ! > > !> > ! postfix/smtp[pid]: Host offered STARTTLS: [name.of.host] > > !> > ! > > !
This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !Optional lookup tables with the Postfix SMTP client TLS usage > > ! policy by next-hop destination and by remote SMTP server hostname. > > ! When both lookups succeed, the more specific per-site policy (NONE, > > ! MUST, etc) overrides the less specific one (MAY), and the more secure > > ! per-site policy (MUST, etc) overrides the less secure one (NONE). > > ! With Postfix 2.3 and later smtp_tls_per_site is strongly discouraged: > > ! use smtp_tls_policy_maps instead.
> > ! > > !Use of the bare hostname as the per-site table lookup key is > > ! discouraged. Always use the full destination nexthop (enclosed in > > ! [] with a possible ":port" suffix). A recipient domain or MX-enabled > > ! transport next-hop with no port suffix may look like a bare hostname, > > ! but is still a suitable destination.
> > ! > > !Specify a next-hop destination or server hostname on the left-hand > > ! side; no wildcards are allowed. The next-hop destination is either > > ! the recipient domain, or the destination specified with a transport(5) > > ! table, the relayhost parameter, or the relay_transport parameter. > > ! On the right hand side specify one of the following keywords:
> > ! > > !The above keywords correspond to the "none", "may", "encrypt" and > > ! "verify" security levels for the new smtp_tls_security_level parameter > > ! introduced in Postfix 2.3. Starting with Postfix 2.3, and independently > > ! of how the policy is specified, the smtp_tls_mandatory_ciphers and > > ! smtp_tls_mandatory_protocols parameters apply when TLS encryption > > ! is mandatory. Connections for which encryption is optional typically > > ! enable all "export" grade and better ciphers (see smtp_tls_ciphers > > ! and smtp_tls_protocols).
> > ! > > !As long as no secure DNS lookup mechanism is available, false > > ! hostnames in MX or CNAME responses can change the server hostname > > ! that Postfix uses for TLS policy lookup and server certificate > > ! verification. Even with a perfect match between the server hostname and > > ! the server certificate, there is no guarantee that Postfix is connected > > ! to the right server. See TLS_README (Closing a DNS loophole with obsolete > > ! per-site TLS policies) for a possible work-around.
> > ! > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtp_tls_policy_maps instead.
> > ! > > ! > > !Optional lookup tables with the Postfix SMTP client TLS security > > ! policy by next-hop destination; when a non-empty value is specified, > > ! this overrides the obsolete smtp_tls_per_site parameter. See > > ! TLS_README for a more detailed discussion of TLS security levels. > > !
> > ! > > !The TLS policy table is indexed by the full next-hop destination, > > ! which is either the recipient domain, or the verbatim next-hop > > ! specified in the transport table, $local_transport, $virtual_transport, > > ! $relay_transport or $default_transport. This includes any enclosing > > ! square brackets and any non-default destination server port suffix. The > > ! LMTP socket type prefix (inet: or unix:) is not included in the lookup > > ! key.
> > ! > > !Only the next-hop domain, or $myhostname with LMTP over UNIX-domain > > ! sockets, is used as the nexthop name for certificate verification. The > > ! port and any enclosing square brackets are used in the table lookup key, > > ! but are not used for server name verification.
> > ! > > !When the lookup key is a domain name without enclosing square brackets > > ! or any :port suffix (typically the recipient domain), and the full > > ! domain is not found in the table, just as with the transport(5) table, > > ! the parent domain starting with a leading "." is matched recursively. This > > ! allows one to specify a security policy for a recipient domain and all > > ! its sub-domains.
> > ! > > !The lookup result is a security level, followed by an optional list > > ! of whitespace and/or comma separated name=value attributes that override > > ! related main.cf settings. The TLS security levels in order of increasing > > ! security are:
> > ! > > !> > ! Example: > > !
> > ! > > !> > ! /etc/postfix/main.cf: > > ! smtp_tls_policy_maps = hash:/etc/postfix/tls_policy > > ! # Postfix 2.5 and later > > ! smtp_tls_fingerprint_digest = md5 > > !> > ! > > !
> > ! /etc/postfix/tls_policy: > > ! example.edu none > > ! example.mil may > > ! example.gov encrypt protocols=TLSv1 > > ! example.com verify ciphers=high > > ! example.net secure > > ! .example.net secure match=.example.net:example.net > > ! [mail.example.org]:587 secure match=nexthop > > ! # Postfix 2.5 and later > > ! [thumb.example.org] fingerprint > > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > > !> > ! > > !
Note: The hostname strategy if listed in a non-default > > ! setting of smtp_tls_secure_cert_match or in the match attribute > > ! in the policy table can render the secure level vulnerable to > > ! DNS forgery. Do not use the hostname strategy for secure-channel > > ! configurations in environments where DNS security is not assured.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !List of TLS protocols that the Postfix SMTP client will exclude or > > ! include with opportunistic TLS encryption. Starting with Postfix 2.6, > > ! the Postfix SMTP client will by default not use the obsolete SSLv2 > > ! protocol.
> > ! > > !In main.cf the values are separated by whitespace, commas or > > ! colons. In the policy table (see smtp_tls_policy_maps) the only valid > > ! separator is colon. An empty value means allow all protocols. The valid > > ! protocol names, (see SSL_get_version(3)), are "SSLv2", "SSLv3" > > ! and "TLSv1".
> > ! > > !To include a protocol list its name, to exclude it, prefix the name > > ! with a "!" character. To exclude SSLv2 even for opportunistic TLS set > > ! "smtp_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set > > ! "smtp_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to > > ! include, is supported, but not recommended. OpenSSL provides no mechanisms > > ! for excluding protocols not known at compile-time. If Postfix is linked > > ! against an OpenSSL library that supports additional protocol versions, > > ! they cannot be excluded using either syntax.
> > ! > > !Example:
> > !> > ! # TLSv1 only! > > ! smtp_tls_protocols = !SSLv2, !SSLv3 > > !> > ! > > !
This feature is available in Postfix 2.6 and later.
> > ! > > ! > > !The verification depth for remote SMTP server certificates. A depth > > ! of 1 is sufficient if the issuing CA is listed in a local CA file.
> > ! > > !The default verification depth is 9 (the OpenSSL default) for > > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5, > > ! the default value was 5, but the limit was not actually enforced. If > > ! you have set this to a lower non-default value, certificates with longer > > ! trust chains may now fail to verify. Certificate chains with 1 or 2 > > ! CAs are common, deeper chains are more rare and any number between 5 > > ! and 9 should suffice in practice. You can choose a lower number if, > > ! for example, you trust certificates directly signed by an issuing CA > > ! but not any CAs it delegates to.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !How the Postfix SMTP client verifies the server certificate > > ! peername for the > > ! "secure" TLS security level. In a "secure" TLS policy table > > ! ($smtp_tls_policy_maps) entry the optional "match" attribute > > ! overrides this main.cf setting.
> > ! > > !This parameter specifies one or more patterns or strategies separated > > ! by commas, whitespace or colons. In the policy table the only valid > > ! separator is the colon character.
> > ! > > !For a description of the pattern and strategy syntax see the > > ! smtp_tls_verify_cert_match parameter. The "hostname" strategy should > > ! be avoided in this context, as in the absence of a secure global DNS, using > > ! the results of MX lookups in certificate verification is not immune to active > > ! (man-in-the-middle) attacks on DNS.
> > ! > > !> > ! Sample main.cf setting: > > !
> > ! > > !> > !> > ! > > !> > ! smtp_tls_secure_cert_match = nexthop > > !> > !
> > ! Sample policy table override: > > !
> > ! > > !> > !> > ! > > !> > ! example.net secure match=example.com:.example.com > > ! .example.net secure match=example.com:.example.com > > !> > !
This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !The default SMTP TLS security level for the Postfix SMTP client; > > ! when a non-empty value is specified, this overrides the obsolete > > ! parameters smtp_use_tls, smtp_enforce_tls, and smtp_tls_enforce_peername. > > !
> > ! > > !Specify one of the following security levels:
> > ! > > !> > ! Examples: > > !
> > ! > > !> > ! # No TLS. Formerly: smtp_use_tls=no and smtp_enforce_tls=no. > > ! smtp_tls_security_level = none > > !> > ! > > !
> > ! # Opportunistic TLS. > > ! smtp_tls_security_level = may > > ! # Postfix ≥ 2.6: > > ! # Do not tweak opportunistic ciphers or protocol unless it is essential > > ! # to do so (if a security vulnerability is found in the SSL library that > > ! # can be mitigated by disabling a particular protocol or raising the > > ! # cipher grade from "export" to "low" or "medium"). > > ! smtp_tls_ciphers = export > > ! smtp_tls_protocols = !SSLv2 > > !> > ! > > !
> > ! # Mandatory (high-grade) TLS encryption. > > ! smtp_tls_security_level = encrypt > > ! smtp_tls_mandatory_ciphers = high > > !> > ! > > !
> > ! # Mandatory TLS verification of hostname or nexthop domain. > > ! smtp_tls_security_level = verify > > ! smtp_tls_mandatory_ciphers = high > > ! smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop > > !> > ! > > !
> > ! # Secure channel TLS with exact nexthop name match. > > ! smtp_tls_security_level = secure > > ! smtp_tls_mandatory_protocols = TLSv1 > > ! smtp_tls_mandatory_ciphers = high > > ! smtp_tls_secure_cert_match = nexthop > > !> > ! > > !
> > ! # Certificate fingerprint verification (Postfix ≥ 2.5). > > ! # The CA-less "fingerprint" security level only scales to a limited > > ! # number of destinations. As a global default rather than a per-site > > ! # setting, this is practical when mail for all recipients is sent > > ! # to a central mail hub. > > ! relayhost = [mailhub.example.com] > > ! smtp_tls_security_level = fingerprint > > ! smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 > > ! smtp_tls_mandatory_ciphers = high > > ! smtp_tls_fingerprint_cert_match = > > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > > !> > ! > > !
This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !Name of the file containing the optional Postfix SMTP client > > ! TLS session cache. Specify a database type that supports enumeration, > > ! such as btree or sdbm; there is no need to support > > ! concurrent access. The file is created if it does not exist. The smtp(8) > > ! daemon does not use this parameter directly, rather the cache is > > ! implemented indirectly in the tlsmgr(8) daemon. This means that > > ! per-smtp-instance master.cf overrides of this parameter are not effective. > > ! Note, that each of the cache databases supported by tlsmgr(8) daemon: > > ! $smtpd_tls_session_cache_database, $smtp_tls_session_cache_database > > ! (and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to > > ! be stored separately. It is not at this time possible to store multiple > > ! caches in a single database.
> > ! > > !Note: dbm databases are not suitable. TLS > > ! session objects are too large.
> > ! > > !As of version 2.5, Postfix no longer uses root privileges when > > ! opening this file. The file should now be stored under the Postfix-owned > > ! data_directory. As a migration aid, an attempt to open the file > > ! under a non-Postfix directory is redirected to the Postfix-owned > > ! data_directory, and a warning is logged.
> > ! > > !Example:
> > ! > > !> > ! smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache > > !> > ! > > !
This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !The expiration time of Postfix SMTP client TLS session cache > > ! information. A cache cleanup is performed periodically > > ! every $smtp_tls_session_cache_timeout seconds. As with > > ! $smtp_tls_session_cache_database, this parameter is implemented in the > > ! tlsmgr(8) daemon and therefore per-smtp-instance master.cf overrides > > ! are not possible.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !How the Postfix SMTP client verifies the server certificate > > ! peername for the > > ! "verify" TLS security level. In a "verify" TLS policy table > > ! ($smtp_tls_policy_maps) entry the optional "match" attribute > > ! overrides this main.cf setting.
> > ! > > !This parameter specifies one or more patterns or strategies separated > > ! by commas, whitespace or colons. In the policy table the only valid > > ! separator is the colon character.
> > ! > > !Patterns specify domain names, or domain name suffixes:
> > ! > > !Strategies specify a transformation from the next-hop domain > > ! to the expected name in the server certificate:
> > ! > > !> > ! Sample main.cf setting: > > !
> > ! > > !> > ! smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop > > !> > ! > > !
> > ! Sample policy table override: > > !
> > ! > > !> > ! example.com verify match=hostname:nexthop > > ! .example.com verify match=example.com:.example.com:hostname > > !> > ! > > !
This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !Opportunistic mode: use TLS when a remote SMTP server announces > > ! STARTTLS support, otherwise send the mail in the clear. Beware: > > ! some SMTP servers offer STARTTLS even if it is not configured. With > > ! Postfix < 2.3, if the TLS handshake fails, and no other server is > > ! available, delivery is deferred and mail stays in the queue. If this > > ! is a concern for you, use the smtp_tls_per_site feature instead.
> > ! > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> > ! > > ! > > !> > ! The Postfix SMTP client time limit for sending the XFORWARD command, > > ! and for receiving the remote SMTP server response. > > !
> > ! > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > ! > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > ! > > ! > > !What remote SMTP clients are allowed to specify the XVERP command. > > ! This command requests that mail be delivered one recipient at a > > ! time with a per recipient return address.
> > ! > > !By default, no clients are allowed to specify XVERP.
> > ! > > !This parameter was renamed with Postfix version 2.1. The default value > > ! is backwards compatible with Postfix version 2.0.
> > ! > > !Specify a list of network/netmask patterns, separated by commas > > ! and/or whitespace. The mask specifies the number of bits in the > > ! network part of a host address. You can also specify hostnames or > > ! .domain names (the initial dot causes the domain to match any name > > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > > ! pattern is replaced by its contents; a "type:table" lookup table > > ! is matched when a table entry matches a lookup string (the lookup > > ! result is ignored). Continue long lines by starting the next line > > ! with whitespace. Specify "!pattern" to exclude an address or network > > ! block from the list. The form "!/file/name" is supported only in > > ! Postfix version 2.4 and later.
> > ! > > !Note: IP version 6 address information must be specified inside > > ! [] in the smtpd_authorized_verp_clients value, and in > > ! files specified with "/file/name". IP version 6 addresses contain > > ! the ":" character, and would otherwise be confused with a "type:table" > > ! pattern.
> > ! > > ! > > !> > ! What remote SMTP clients are allowed to use the XCLIENT feature. This > > ! command overrides remote SMTP client information that is used for access > > ! control. Typical use is for SMTP-based content filters, fetchmail-like > > ! programs, or SMTP server access rule testing. See the XCLIENT_README > > ! document for details. > > !
> > ! > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > ! > > !> > ! By default, no clients are allowed to specify XCLIENT. > > !
> > ! > > !> > ! Specify a list of network/netmask patterns, separated by commas > > ! and/or whitespace. The mask specifies the number of bits in the > > ! network part of a host address. You can also specify hostnames or > > ! .domain names (the initial dot causes the domain to match any name > > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > > ! pattern is replaced by its contents; a "type:table" lookup table > > ! is matched when a table entry matches a lookup string (the lookup > > ! result is ignored). Continue long lines by starting the next line > > ! with whitespace. Specify "!pattern" to exclude an address or network > > ! block from the list. The form "!/file/name" is supported only in > > ! Postfix version 2.4 and later.
> > ! > > !Note: IP version 6 address information must be specified inside > > ! [] in the smtpd_authorized_xclient_hosts value, and in > > ! files specified with "/file/name". IP version 6 addresses contain > > ! the ":" character, and would otherwise be confused with a "type:table" > > ! pattern.
> > ! > > ! > > !> > ! What remote SMTP clients are allowed to use the XFORWARD feature. This > > ! command forwards information that is used to improve logging after > > ! SMTP-based content filters. See the XFORWARD_README document for > > ! details. > > !
> > ! > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > ! > > !> > ! By default, no clients are allowed to specify XFORWARD. > > !
> > ! > > !> > ! Specify a list of network/netmask patterns, separated by commas > > ! and/or whitespace. The mask specifies the number of bits in the > > ! network part of a host address. You can also specify hostnames or > > ! .domain names (the initial dot causes the domain to match any name > > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > > ! pattern is replaced by its contents; a "type:table" lookup table > > ! is matched when a table entry matches a lookup string (the lookup > > ! result is ignored). Continue long lines by starting the next line > > ! with whitespace. Specify "!pattern" to exclude an address or network > > ! block from the list. The form "!/file/name" is supported only in > > ! Postfix version 2.4 and later.
> > ! > > !Note: IP version 6 address information must be specified inside > > ! [] in the smtpd_authorized_xforward_hosts value, and in > > ! files specified with "/file/name". IP version 6 addresses contain > > ! the ":" character, and would otherwise be confused with a "type:table" > > ! pattern.
> > ! > > ! > > !> > ! The text that follows the 220 status code in the SMTP greeting > > ! banner. Some people like to see the mail version advertised. By > > ! default, Postfix shows no version. > > !
> > ! > > !> > ! You MUST specify $myhostname at the start of the text. This is > > ! required by the SMTP protocol. > > !
> > ! > > !> > ! Example: > > !
> > ! > > !> > ! smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) > > !> > ! > > ! > > !
> > ! How many simultaneous connections any client is allowed to > > ! make to this service. By default, the limit is set to half > > ! the default process limit value. > > !
> > ! > > !> > ! To disable this feature, specify a limit of 0. > > !
> > ! > > !> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > > !
> > ! > > !> > ! This feature is available in Postfix 2.2 and later. > > !
> > ! > > ! > > !> > ! The maximal number of connection attempts any client is allowed to > > ! make to this service per time unit. The time unit is specified > > ! with the anvil_rate_time_unit configuration parameter. > > !
> > ! > > !> > ! By default, a client can make as many connections per time unit as > > ! Postfix can accept. > > !
> > ! > > !> > ! To disable this feature, specify a limit of 0. > > !
> > ! > > !> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > > !
> > ! > > !> > ! This feature is available in Postfix 2.2 and later. > > !
> > ! > > !> > ! Example: > > !
> > ! > > !> > ! smtpd_client_connection_rate_limit = 1000 > > !> > ! > > ! > > !
> > ! Clients that are excluded from smtpd_client_*_count/rate_limit > > ! restrictions. See the mynetworks parameter > > ! description for the parameter value syntax. > > !
> > ! > > !> > ! By default, clients in trusted networks are excluded. Specify a > > ! list of network blocks, hostnames or .domain names (the initial > > ! dot causes the domain to match any name below it). > > !
> > ! > > !Note: IP version 6 address information must be specified inside > > ! [] in the smtpd_client_event_limit_exceptions value, and > > ! in files specified with "/file/name". IP version 6 addresses > > ! contain the ":" character, and would otherwise be confused with a > > ! "type:table" pattern.
> > ! > > !> > ! This feature is available in Postfix 2.2 and later. > > !
> > ! > > ! > > !> > ! The maximal number of message delivery requests that any client is > > ! allowed to make to this service per time unit, regardless of whether > > ! or not Postfix actually accepts those messages. The time unit is > > ! specified with the anvil_rate_time_unit configuration parameter. > > !
> > ! > > !> > ! By default, a client can send as many message delivery requests > > ! per time unit as Postfix can accept. > > !
> > ! > > !> > ! To disable this feature, specify a limit of 0. > > !
> > ! > > !> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > > !
> > ! > > !> > ! This feature is available in Postfix 2.2 and later. > > !
> > ! > > !> > ! Example: > > !
> > ! > > !> > ! smtpd_client_message_rate_limit = 1000 > > !> > ! > > ! > > !
> > ! The maximal number of new (i.e., uncached) TLS sessions that a > > ! remote SMTP client is allowed to negotiate with this service per > > ! time unit. The time unit is specified with the anvil_rate_time_unit > > ! configuration parameter. > > !
> > ! > > !> > ! By default, a remote SMTP client can negotiate as many new TLS > > ! sessions per time unit as Postfix can accept. > > !
> > ! > > !> > ! To disable this feature, specify a limit of 0. Otherwise, specify > > ! a limit that is at least the per-client concurrent session limit, > > ! or else legitimate client sessions may be rejected. > > !
> > ! > > !> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > > !
> > ! > > !> > ! This feature is available in Postfix 2.3 and later. > > !
> > ! > > !> > ! Example: > > !
> > ! > > !> > ! smtpd_client_new_tls_session_rate_limit = 100 > > !> > ! > > ! > > !
Enable logging of the remote SMTP client port in addition to > > ! the hostname and IP address. The logging format is "host[address]:port". > > !
> > ! > > !This feature is available in Postfix 2.5 and later.
> > ! > > ! > > !> > ! The maximal number of recipient addresses that any client is allowed > > ! to send to this service per time unit, regardless of whether or not > > ! Postfix actually accepts those recipients. The time unit is specified > > ! with the anvil_rate_time_unit configuration parameter. > > !
> > ! > > !> > ! By default, a client can send as many recipient addresses per time > > ! unit as Postfix can accept. > > !
> > ! > > !> > ! To disable this feature, specify a limit of 0. > > !
> > ! > > !> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > > !
> > ! > > !> > ! This feature is available in Postfix 2.2 and later. > > !
> > ! > > !> > ! Example: > > !
> > > >> > ! smtpd_client_recipient_rate_limit = 1000 > > !> > ! > > ! > > !
> > ! Optional Postfix SMTP server access restrictions in the context of > > ! a remote SMTP client connection request. > > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > > ! restriction lists" for a discussion of evaluation context and time. > > !
> > ! > > !> > ! The default is to allow all connection requests. > > !
> > ! > > !> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > > !
> > ! > > !> > ! The following restrictions are specific to client hostname or > > ! client network address information. > > !
> > ! > > !> > ! In addition, you can use any of the following > > ! generic restrictions. These restrictions are applicable in > > ! any SMTP command context. > > !
> > ! > > !> > ! /etc/postfix/main.cf: > > ! smtpd_client_restrictions = > > ! sleep 1, reject_unauth_pipelining > > ! smtpd_delay_reject = no > > !> > ! This feature is available in Postfix 2.3.
> > ! Other restrictions that are valid in this context: > > !
> > > > !> > ! Example: > >
> > > >> > ! smtpd_client_restrictions = permit_mynetworks, reject_unknown_client_hostname > >> > > > --- 9190,9352 ---- > > > > !
> > ! Example: > >
> > > > !> > ! /etc/postfix/main.cf: > > ! smtp_tls_policy_maps = hash:/etc/postfix/tls_policy > > ! # Postfix 2.5 and later > > ! smtp_tls_fingerprint_digest = md5 > > !> > > >
> > ! /etc/postfix/tls_policy: > > ! example.edu none > > ! example.mil may > > ! example.gov encrypt protocols=TLSv1 > > ! example.com verify ciphers=high > > ! example.net secure > > ! .example.net secure match=.example.net:example.net > > ! [mail.example.org]:587 secure match=nexthop > > ! # Postfix 2.5 and later > > ! [thumb.example.org] fingerprint > > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > > !> > > > !
Note: The hostname strategy if listed in a non-default > > ! setting of smtp_tls_secure_cert_match or in the match attribute > > ! in the policy table can render the secure level vulnerable to > > ! DNS forgery. Do not use the hostname strategy for secure-channel > > ! configurations in environments where DNS security is not assured.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > !The verification depth for remote SMTP server certificates. A depth > > ! of 1 is sufficient if the issuing CA is listed in a local CA file.
> > > > !The default verification depth is 9 (the OpenSSL default) for > > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5, > > ! the default value was 5, but the limit was not actually enforced. If > > ! you have set this to a lower non-default value, certificates with longer > > ! trust chains may now fail to verify. Certificate chains with 1 or 2 > > ! CAs are common, deeper chains are more rare and any number between 5 > > ! and 9 should suffice in practice. You can choose a lower number if, > > ! for example, you trust certificates directly signed by an issuing CA > > ! but not any CAs it delegates to.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !The server certificate peername verification method for the > > ! "secure" TLS security level. In a "secure" TLS policy table > > ! ($smtp_tls_policy_maps) entry the optional "match" attribute > > ! overrides this main.cf setting.
> > > > !This parameter specifies one or more patterns or strategies separated > > ! by commas, whitespace or colons. In the policy table the only valid > > ! separator is the colon character.
> > > > !For a description of the pattern and strategy syntax see the > > ! smtp_tls_verify_cert_match parameter. The "hostname" strategy should > > ! be avoided in this context, as in the absence of a secure global DNS, using > > ! the results of MX lookups in certificate verification is not immune to active > > ! (man-in-the-middle) attacks on DNS.
> > > > !> > ! Sample main.cf setting: > > !
> > ! > > !> > !> > > >> > ! smtp_tls_secure_cert_match = nexthop > > !> > !
> > ! Sample policy table override: > >
> > > > +> >> > + > > +> > ! example.net secure match=example.com:.example.com > > ! .example.net secure match=example.com:.example.com > >> > +
This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 12461,12502 **** > > > > !A mechanism to transform commands from remote SMTP clients. > > ! This is a last-resort tool to work around client commands that break > > ! inter-operability with the Postfix SMTP server. Other uses involve > > ! fault injection to test Postfix's handling of invalid commands. > >
> > > > !Specify the name of a "type:table" lookup table. The search > > ! string is the SMTP command as received from the remote SMTP client, > > ! except that initial whitespace and the trailing <CR><LF> > > ! are removed. The result value is executed by the Postfix SMTP > > ! server.
> > > > !There is no need to use smtpd_command_filter for the following > > ! cases:
> > > > !Use "resolve_numeric_domain = yes" to accept > > ! "user at ipaddress".
> > > > !Postfix already accepts the correct form > > ! "user@[ipaddress]". Use virtual_alias_maps or canonical_maps > > ! to translate these into domain names if necessary.
> > ! > > !Use "strict_rfc821_envelopes = no" to accept "RCPT TO:<User > > ! Name <user at example.com>>". Postfix will ignore the "User > > ! Name" part and deliver to the <user at example.com> address. > > !
> > > > !Examples of problems that can be solved with the smtpd_command_filter > > ! feature:
> > > >> > ! /etc/postfix/main.cf: > > ! smtpd_command_filter = pcre:/etc/postfix/command_filter > >> > --- 9355,9428 ---- > > > > !
The default SMTP TLS security level for the Postfix SMTP client; > > ! when a non-empty value is specified, this overrides the obsolete > > ! parameters smtp_use_tls, smtp_enforce_tls, and smtp_tls_enforce_peername. > >
> > > > !Specify one of the following security levels:
> > ! > > !> > ! Examples: > > !
> > > >> > ! # No TLS. Formerly: smtp_use_tls=no and smtp_enforce_tls=no. > > ! smtp_tls_security_level = none > >> > *************** > > *** 12504,12508 **** > >
> > ! /etc/postfix/command_filter: > > ! # Work around clients that send malformed HELO commands. > > ! /^HELO\s*$/ HELO domain.invalid > >> > --- 9430,9433 ---- > >
> > ! # Opportunistic TLS. > > ! smtp_tls_security_level = may > >> > *************** > > *** 12510,12513 **** > >
> > ! # Work around clients that send empty lines. > > ! /^\s*$/ NOOP > >> > --- 9435,9439 ---- > >
> > ! # Mandatory (high-grade) TLS encryption. > > ! smtp_tls_security_level = encrypt > > ! smtp_tls_mandatory_ciphers = high > >> > *************** > > *** 12515,12519 **** > >
> > ! # Work around clients that send RCPT TO:<'user at domain'>. > > ! # WARNING: do not lose the parameters that follow the address. > > ! /^RCPT\s+TO:\s*<'([^[:space:]]+)'>(.*)/ RCPT TO:<$1>$2 > >> > --- 9441,9446 ---- > >
> > ! # Mandatory TLS verification of hostname or nexthop domain. > > ! smtp_tls_security_level = verify > > ! smtp_tls_mandatory_ciphers = high > > ! smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop > >> > *************** > > *** 12521,12525 **** > >
> > ! # Append XVERP to MAIL FROM commands to request VERP-style delivery. > > ! # See VERP_README for more information on how to use Postfix VERP. > > ! /^(MAIL FROM:<listname at example\.com>.*)/ $1 XVERP > >> > --- 9448,9454 ---- > >
> > ! # Secure channel TLS with exact nexthop name match. > > ! smtp_tls_security_level = secure > > ! smtp_tls_mandatory_protocols = TLSv1 > > ! smtp_tls_mandatory_ciphers = high > > ! smtp_tls_secure_cert_match = nexthop > >> > *************** > > *** 12527,12535 **** > >
> > ! # Bounce-never mail sink. Use notify_classes=bounce,resource,software > > ! # to send bounced mail to the postmaster (with message body removed). > > ! /^(RCPT\s+TO:.*?)\bNOTIFY=\S+\b(.*)/ $1 NOTIFY=NEVER $2 > > ! /^(RCPT\s+TO:.*)/ $1 NOTIFY=NEVER > >> > > > !
This feature is available in Postfix 2.7.
> > > > --- 9456,9472 ---- > >> > ! # Certificate fingerprint verification (Postfix ≥ 2.5). > > ! # The CA-less "fingerprint" security level only scales to a limited > > ! # number of destinations. As a global default rather than a per-site > > ! # setting, this is practical when mail for all recipients is sent > > ! # to a central mail hub. > > ! relayhost = [mailhub.example.com] > > ! smtp_tls_security_level = fingerprint > > ! smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 > > ! smtp_tls_mandatory_ciphers = high > > ! smtp_tls_fingerprint_cert_match = > > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 > > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 > >> > > > !
This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 12538,12609 **** > > > > !> > ! Optional access restrictions that the Postfix SMTP server applies > > ! in the context of the SMTP DATA command. > > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > > ! restriction lists" for a discussion of evaluation context and time. > > !
> > ! > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > ! > > !> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > > !
> > ! > > !> > ! The following restrictions are valid in this context: > > !
> > ! > > !> > ! Examples: > > !
> > > >> > ! smtpd_data_restrictions = reject_unauth_pipelining > > ! smtpd_data_restrictions = reject_multi_recipient_bounce > >> > > > ! > > !
Postpone the start of an SMTP mail transaction until a valid > > ! RCPT TO command is received. Specify "no" to create a mail transaction > > ! as soon as the Postfix SMTP server receives a valid MAIL FROM > > ! command.
> > ! > > !With sites that reject lots of mail, the default setting reduces > > ! the use of > > ! disk, CPU and memory resources. The downside is that rejected > > ! recipients are logged with NOQUEUE instead of a mail transaction > > ! ID. This complicates the logfile analysis of multi-recipient mail. > > !
> > ! > > !This feature is available in Postfix 2.3 and later.
> > > > --- 9475,9508 ---- > > > > !Name of the file containing the optional Postfix SMTP client > > ! TLS session cache. Specify a database type that supports enumeration, > > ! such as btree or sdbm; there is no need to support > > ! concurrent access. The file is created if it does not exist. The smtp(8) > > ! daemon does not use this parameter directly, rather the cache is > > ! implemented indirectly in the tlsmgr(8) daemon. This means that > > ! per-smtp-instance master.cf overrides of this parameter are not effective. > > ! Note, that each of the cache databases supported by tlsmgr(8) daemon: > > ! $smtpd_tls_session_cache_database, $smtp_tls_session_cache_database > > ! (and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to > > ! be stored separately. It is not at this time possible to store multiple > > ! caches in a single database.
> > > > !Note: dbm databases are not suitable. TLS > > ! session objects are too large.
> > > > !As of version 2.5, Postfix no longer uses root privileges when > > ! opening this file. The file should now be stored under the Postfix-owned > > ! data_directory. As a migration aid, an attempt to open the file > > ! under a non-Postfix directory is redirected to the Postfix-owned > > ! data_directory, and a warning is logged.
> > > > !Example:
> > > >> > ! smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache > >> > > > !
This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 12612,12635 **** > > > > !> > ! Wait until the RCPT TO command before evaluating > > ! $smtpd_client_restrictions, $smtpd_helo_restrictions and > > ! $smtpd_sender_restrictions, or wait until the ETRN command before > > ! evaluating $smtpd_client_restrictions and $smtpd_helo_restrictions. > > !
> > > > !> > ! This feature is turned on by default because some clients apparently > > ! mis-behave when the Postfix SMTP server rejects commands before > > ! RCPT TO. > > !
> > > > !> > ! The default setting has one major benefit: it allows Postfix to log > > ! recipient address information when rejecting a client name/address > > ! or sender address, so that it is possible to find out whose mail > > ! is being rejected. > > !
> > > > --- 9511,9523 ---- > > > > !The expiration time of Postfix SMTP client TLS session cache > > ! information. A cache cleanup is performed periodically > > ! every $smtp_tls_session_cache_timeout seconds. As with > > ! $smtp_tls_session_cache_database, this parameter is implemented in the > > ! tlsmgr(8) daemon and therefore per-smtp-instance master.cf overrides > > ! are not possible.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 12638,12691 **** > > > > !Lookup tables, indexed by the remote SMTP client address, with > > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > > ! etc.) that the Postfix SMTP server will not send in the EHLO response > > ! to a > > ! remote SMTP client. See smtpd_discard_ehlo_keywords for details. > > ! The table is not searched by hostname for robustness reasons.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !A case insensitive list of EHLO keywords (pipelining, starttls, > > ! auth, etc.) that the Postfix SMTP server will not send in the EHLO > > ! response > > ! to a remote SMTP client.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > !Notes:
> > > > !Specify the silent-discard pseudo keyword to prevent > > ! this action from being logged.
> > > > !Use the smtpd_discard_ehlo_keyword_address_maps feature > > ! to discard EHLO keywords selectively.
> > > > !Optional access restrictions that the Postfix SMTP server > > ! applies in the context of the SMTP END-OF-DATA command. > > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > > ! restriction lists" for a discussion of evaluation context and time. > >
> > > > !This feature is available in Postfix 2.2 and later.
> > > > !See smtpd_data_restrictions for details and limitations.
> > > > --- 9526,9603 ---- > > > > !The server certificate peername verification method for the > > ! "verify" TLS security level. In a "verify" TLS policy table > > ! ($smtp_tls_policy_maps) entry the optional "match" attribute > > ! overrides this main.cf setting.
> > > > !This parameter specifies one or more patterns or strategies separated > > ! by commas, whitespace or colons. In the policy table the only valid > > ! separator is the colon character.
> > > > +Patterns specify domain names, or domain name suffixes:
> > > > !Strategies specify a transformation from the next-hop domain > > ! to the expected name in the server certificate:
> > > > !> > ! Sample main.cf setting: > > !
> > > > !> > ! smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop > > !> > > > !
> > ! Sample policy table override: > >
> > > > !> > ! example.com verify match=hostname:nexthop > > ! .example.com verify match=example.com:.example.com:hostname > > !> > > > !
This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 12694,12727 **** > > > > !Mandatory TLS: announce STARTTLS support to remote SMTP clients, > > ! and require that clients use TLS encryption. According to RFC 2487 > > ! this MUST NOT be applied in case of a publicly-referenced SMTP > > ! server. This option is therefore off by default.
> > ! > > !Note 1: "smtpd_enforce_tls = yes" implies "smtpd_tls_auth_only = yes".
> > ! > > !Note 2: when invoked via "sendmail -bs", Postfix will never offer > > ! STARTTLS due to insufficient privileges to access the server private > > ! key. This is intended behavior.
> > > >This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtpd_tls_security_level instead.
> > ! > > ! > > !With Postfix version 2.1 and later: the SMTP server response delay after > > ! a client has made more than $smtpd_soft_error_limit errors, and > > ! fewer than $smtpd_hard_error_limit errors, without delivering mail. > > !
> > ! > > !With Postfix version 2.0 and earlier: the SMTP server delay before > > ! sending a reject (4xx or 5xx) response, when the client has made > > ! fewer than $smtpd_soft_error_limit errors without delivering > > ! mail.
> > > > --- 9606,9619 ---- > > > > !Opportunistic mode: use TLS when a remote SMTP server announces > > ! STARTTLS support, otherwise send the mail in the clear. Beware: > > ! some SMTP servers offer STARTTLS even if it is not configured. With > > ! Postfix < 2.3, if the TLS handshake fails, and no other server is > > ! available, delivery is deferred and mail stays in the queue. If this > > ! is a concern for you, use the smtp_tls_per_site feature instead.
> > > >This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtp_tls_security_level instead.
> > > > *************** > > *** 12730,12745 **** > > > > !> > ! Optional SMTP server access restrictions in the context of a client > > ! ETRN request. > > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > > ! restriction lists" for a discussion of evaluation context and time. > > !
> > > >> > ! The Postfix ETRN implementation accepts only destinations that are > > ! eligible for the Postfix "fast flush" service. See the ETRN_README > > ! file for details. > >
> > --- 9622,9629 ---- > > > > !> > ! The SMTP client time limit for sending the XFORWARD command, and > > ! for receiving the server response. > >
> > *************** > > *** 12747,12752 **** > >> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > >
> > --- 9631,9634 ---- > >> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > *************** > > *** 12754,12790 **** > >> > ! The following restrictions are specific to the domain name information > > ! received with the ETRN command. > >
> > > > -> > ! Other restrictions that are valid in this context: > > !
> > > > !> > ! Example: > > !
> > > > !> > ! smtpd_etrn_restrictions = permit_mynetworks, reject > > !> > > > --- 9636,9672 ---- > >
> > ! This feature is available in Postfix 2.1 and later. > >
> > > > > > !What SMTP clients are allowed to specify the XVERP command. > > ! This command requests that mail be delivered one recipient at a > > ! time with a per recipient return address.
> > > > !By default, no clients are allowed to specify XVERP.
> > > > !This parameter was renamed with Postfix version 2.1. The default value > > ! is backwards compatible with Postfix version 2.0.
> > > > !Specify a list of network/netmask patterns, separated by commas > > ! and/or whitespace. The mask specifies the number of bits in the > > ! network part of a host address. You can also specify hostnames or > > ! .domain names (the initial dot causes the domain to match any name > > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > > ! pattern is replaced by its contents; a "type:table" lookup table > > ! is matched when a table entry matches a lookup string (the lookup > > ! result is ignored). Continue long lines by starting the next line > > ! with whitespace. Specify "!pattern" to exclude an address or network > > ! block from the list. The form "!/file/name" is supported only in > > ! Postfix version 2.4 and later.
> > > > !Note: IP version 6 address information must be specified inside > > ! [] in the smtpd_authorized_verp_clients value, and in > > ! files specified with "/file/name". IP version 6 addresses contain > > ! the ":" character, and would otherwise be confused with a "type:table" > > ! pattern.
> > > > *************** > > *** 12793,12801 **** > > > > !> > ! What characters are allowed in $name expansions of RBL reply > > ! templates. Characters not in the allowed set are replaced by "_". > > ! Use C like escapes to specify special characters such as whitespace. > >
> > --- 9675,9685 ---- > > > > !> > ! What SMTP clients are allowed to use the XCLIENT feature. This > > ! command overrides SMTP client information that is used for access > > ! control. Typical use is for SMTP-based content filters, fetchmail-like > > ! programs, or SMTP server access rule testing. See the XCLIENT_README > > ! document for details. > >
> > *************** > > *** 12803,12805 **** > >> > ! This parameter is not subjected to $parameter expansion. > >
> > --- 9687,9689 ---- > >> > ! This feature is available in Postfix 2.1 and later. > >
> > *************** > > *** 12807,12811 **** > >> > ! This feature is available in Postfix 2.0 and later. > >
> > > > > > --- 9691,9714 ---- > >> > ! By default, no clients are allowed to specify XCLIENT. > >
> > > > +> > + Specify a list of network/netmask patterns, separated by commas > > + and/or whitespace. The mask specifies the number of bits in the > > + network part of a host address. You can also specify hostnames or > > + .domain names (the initial dot causes the domain to match any name > > + below it), "/file/name" or "type:table" patterns. A "/file/name" > > + pattern is replaced by its contents; a "type:table" lookup table > > + is matched when a table entry matches a lookup string (the lookup > > + result is ignored). Continue long lines by starting the next line > > + with whitespace. Specify "!pattern" to exclude an address or network > > + block from the list. The form "!/file/name" is supported only in > > + Postfix version 2.4 and later.
> > + > > +Note: IP version 6 address information must be specified inside > > + [] in the smtpd_authorized_xclient_hosts value, and in > > + files specified with "/file/name". IP version 6 addresses contain > > + the ":" character, and would otherwise be confused with a "type:table" > > + pattern.
> > + > > > > *************** > > *** 12813,12823 **** > > > > !> > ! List of commands that cause the Postfix SMTP server to immediately > > ! terminate the session with a 221 code. This can be used to disconnect > > ! clients that obviously attempt to abuse the system. In addition to the > > ! commands listed in this parameter, commands that follow the "Label:" > > ! format of message headers will also cause a disconnect. > >
> > --- 9716,9725 ---- > > > > !> > ! What SMTP clients are allowed to use the XFORWARD feature. This > > ! command forwards information that is used to improve logging after > > ! SMTP-based content filters. See the XFORWARD_README document for > > ! details. > >
> > *************** > > *** 12825,12843 **** > >> > ! This feature is available in Postfix 2.2 and later. > >
> > > > ! > > !> > ! The maximal number of errors a remote SMTP client is allowed to > > ! make without delivering mail. The Postfix SMTP server disconnects > > ! when the limit is exceeded. Normally the default limit is 20, but > > ! it changes under overload to just 1. With Postfix 2.5 and earlier, > > ! the SMTP server always allows up to 20 errors by default. > > > > !
> > > > --- 9727,9753 ---- > >> > ! This feature is available in Postfix 2.1 and later. > >
> > > > !> > ! By default, no clients are allowed to specify XFORWARD. > > !
> > > >> > ! Specify a list of network/netmask patterns, separated by commas > > ! and/or whitespace. The mask specifies the number of bits in the > > ! network part of a host address. You can also specify hostnames or > > ! .domain names (the initial dot causes the domain to match any name > > ! below it), "/file/name" or "type:table" patterns. A "/file/name" > > ! pattern is replaced by its contents; a "type:table" lookup table > > ! is matched when a table entry matches a lookup string (the lookup > > ! result is ignored). Continue long lines by starting the next line > > ! with whitespace. Specify "!pattern" to exclude an address or network > > ! block from the list. The form "!/file/name" is supported only in > > ! Postfix version 2.4 and later.
> > > > !Note: IP version 6 address information must be specified inside > > ! [] in the smtpd_authorized_xforward_hosts value, and in > > ! files specified with "/file/name". IP version 6 addresses contain > > ! the ":" character, and would otherwise be confused with a "type:table" > > ! pattern.
> > > > *************** > > *** 12846,12854 **** > > > > !> > ! Require that a remote SMTP client introduces itself with the HELO > > ! or EHLO command before sending the MAIL command or other commands > > ! that require EHLO negotiation. > >
> > --- 9756,9769 ---- > > > > !> > ! The text that follows the 220 status code in the SMTP greeting > > ! banner. Some people like to see the mail version advertised. By > > ! default, Postfix shows no version. > > !
> > > >> > ! You MUST specify $myhostname at the start of the text. This is > > ! required by the SMTP protocol. > >
> > *************** > > *** 12860,12862 **** > >> > ! smtpd_helo_required = yes > >> > --- 9775,9777 ---- > >
> > ! smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) > >> > *************** > > *** 12866,12875 **** > > > > !
> > ! Optional restrictions that the Postfix SMTP server applies in the > > ! context of the SMTP HELO command. > > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > > ! restriction lists" for a discussion of evaluation context and time. > >
> > --- 9781,9789 ---- > > > > !> > ! How many simultaneous connections any client is allowed to > > ! make to this service. By default, the limit is set to half > > ! the default process limit value. > >
> > *************** > > *** 12877,12884 **** > >> > ! The default is to permit everything. > > !
> > ! > > !Note: specify "smtpd_helo_required = yes" to fully enforce this > > ! restriction (without "smtpd_helo_required = yes", a client can > > ! simply skip smtpd_helo_restrictions by not sending HELO or EHLO). > >
> > --- 9791,9793 ---- > >> > ! To disable this feature, specify a limit of 0. > >
> > *************** > > *** 12886,12891 **** > >> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > >
> > --- 9795,9798 ---- > >> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > >
> > *************** > > *** 12893,13086 **** > >> > ! The following restrictions are specific to the hostname information > > ! received with the HELO or EHLO command. > >
> > > > -> > ! Other restrictions that are valid in this context: > >
> > > > -> > ! Examples: > >
> > > > -> > - smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname > > - smtpd_helo_restrictions = permit_mynetworks, reject_unknown_helo_hostname > > -> > - > > - > > -
> > ! The maximal number of lines in the Postfix SMTP server command history > > ! before it is flushed upon receipt of EHLO, RSET, or end of DATA. > >
> > > > - > > -> > ! The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote > > ! SMTP client can send before the Postfix SMTP server starts to > > ! increment the error counter with each junk command. The junk > > ! command count is reset after mail is delivered. See also the > > ! smtpd_error_sleep_time and smtpd_soft_error_limit configuration > > ! parameters. Normally the default limit is 100, but it changes under > > ! overload to just 1. With Postfix 2.5 and earlier, the SMTP server > > ! always allows up to 100 junk commands by default.
> > ! > > ! > > !Enable logging of the named "permit" actions in SMTP server > > ! access lists. This does not affect conditional actions such as > > ! "defer_if_permit".
> > ! > > !Specify a list of "permit" action names, "/file/name" or > > ! "type:table" patterns, separated by commas and/or whitespace. The > > ! list is matched left to right, and the search stops on the first > > ! match. A "/file/name" pattern is replaced by its contents; a > > ! "type:table" lookup table is matched when a name matches a lookup > > ! key (the lookup result is ignored). Continue long lines by starting > > ! the next line with whitespace. Specify "!pattern" to exclude a name > > ! from the list.
> > > > !Examples:
> > > > !> > ! /etc/postfix/main.cf: > > ! # Log all "permit" actions. > > ! smtpd_log_access_permit_actions = static:all > > !> > > >
> > ! /etc/postfix/main.cf: > > ! # Log "permit_dnswl_client" only. > > ! smtpd_log_access_permit_actions = permit_dnswl_client > >> > > > -
This feature is available in Postfix 2.10 and later.
> > - > > - > > -A list of Milter (mail filter) applications for new mail that > > - arrives via the Postfix smtpd(8) server. Specify space or comma as > > - separator. See the MILTER_README document for details.
> > - > > -This feature is available in Postfix 2.3 and later.
> > - > > > > --- 9800,9842 ---- > >> > ! This feature is available in Postfix 2.2 and later. > >
> > > > > > !> > ! The maximal number of connection attempts any client is allowed to > > ! make to this service per time unit. The time unit is specified > > ! with the anvil_rate_time_unit configuration parameter. > >
> > > >> > ! By default, a client can make as many connections per time unit as > > ! Postfix can accept. > >
> > > >> > ! To disable this feature, specify a limit of 0. > >
> > > >> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > > !
> > > > !> > ! This feature is available in Postfix 2.2 and later. > > !
> > > > !> > ! Example: > > !
> > > >> > ! smtpd_client_connection_rate_limit = 1000 > >> > > > > > *************** > > *** 13088,13145 **** > > > > !
> > ! List of commands that the Postfix SMTP server replies to with "250 > > ! Ok", without doing any syntax checks and without changing state. > > ! This list overrides any commands built into the Postfix SMTP server. > >
> > > > - > > -> > ! The lookup key to be used in SMTP access(5) tables instead of the > > ! null sender address. > >
> > > > > > !Attempt to look up the remote SMTP client hostname, and verify that > > ! the name matches the client IP address. A client name is set to > > ! "unknown" when it cannot be looked up or verified, or when name > > ! lookup is disabled. Turning off name lookup reduces delays due to > > ! DNS lookup and increases the maximal inbound delivery rate.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !Change the behavior of the smtpd_timeout time limit, from a > > ! time limit per read or write system call, to a time limit to send > > ! or receive a complete record (an SMTP command line, SMTP response > > ! line, SMTP message content line, or TLS protocol message). This > > ! limits the impact from hostile peers that trickle data one byte at > > ! a time.
> > ! > > !Note: when per-record deadlines are enabled, a short timeout > > ! may cause problems with TLS over very slow network connections. > > ! The reasons are that a TLS protocol message can be up to 16 kbytes > > ! long (with TLSv1), and that an entire TLS protocol message must be > > ! sent or received within the per-record deadline.
> > ! > > !This feature is available in Postfix 2.9 and later. With older > > ! Postfix releases, the behavior is as if this parameter is set to > > ! "no".
> > > > --- 9844,9869 ---- > > > > !> > ! Clients that are excluded from connection count, connection rate, > > ! or SMTP request rate restrictions. See the mynetworks parameter > > ! description for the parameter value syntax. > >
> > > >> > ! By default, clients in trusted networks are excluded. Specify a > > ! list of network blocks, hostnames or .domain names (the initial > > ! dot causes the domain to match any name below it). > >
> > > > +Note: IP version 6 address information must be specified inside > > + [] in the smtpd_client_event_limit_exceptions value, and > > + in files specified with "/file/name". IP version 6 addresses > > + contain the ":" character, and would otherwise be confused with a > > + "type:table" pattern.
> > > > !> > ! This feature is available in Postfix 2.2 and later. > > !
> > > > *************** > > *** 13148,13155 **** > > > > !> > ! The time after which an idle SMTPD policy service connection is > > ! closed. > >
> > --- 9872,9881 ---- > > > > !> > ! The maximal number of message delivery requests that any client is > > ! allowed to make to this service per time unit, regardless of whether > > ! or not Postfix actually accepts those messages. The time unit is > > ! specified with the anvil_rate_time_unit configuration parameter. > >
> > *************** > > *** 13157,13170 **** > >> > ! This feature is available in Postfix 2.1 and later. > >
> > > > > > !> > ! The time after which an active SMTPD policy service connection is > > ! closed. > >
> > --- 9883,9899 ---- > >> > ! By default, a client can send as many message delivery requests > > ! per time unit as Postfix can accept. > >
> > > > +> > + To disable this feature, specify a limit of 0. > > +
> > > > !> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > > !
> > > >> > ! This feature is available in Postfix 2.2 and later. > >
> > *************** > > *** 13172,13176 **** > >> > ! This feature is available in Postfix 2.1 and later. > >
> > > > > > --- 9901,9909 ---- > >> > ! Example: > >
> > > > +> > + smtpd_client_message_rate_limit = 1000 > > +> > + > > > > *************** > > *** 13178,13185 **** > > > > !
> > ! The time limit for connecting to, writing to or receiving from a > > ! delegated SMTPD policy server. > >
> > --- 9911,9920 ---- > > > > !> > ! The maximal number of new (i.e., uncached) TLS sessions that a > > ! remote SMTP client is allowed to negotiate with this service per > > ! time unit. The time unit is specified with the anvil_rate_time_unit > > ! configuration parameter. > >
> > *************** > > *** 13187,13200 **** > >> > ! This feature is available in Postfix 2.1 and later. > >
> > > > > > !> > ! How the Postfix SMTP server announces itself to the proxy filter. > > ! By default, the Postfix hostname is used. > >
> > --- 9922,9940 ---- > >> > ! By default, a remote SMTP client can negotiate as many new TLS > > ! sessions per time unit as Postfix can accept. > >
> > > > +> > + To disable this feature, specify a limit of 0. Otherwise, specify > > + a limit that is at least the per-client concurrent session limit, > > + or else legitimate client sessions may be rejected. > > +
> > > > !> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > > !
> > > >> > ! This feature is available in Postfix 2.3 and later. > >
> > *************** > > *** 13202,13206 **** > >> > ! This feature is available in Postfix 2.1 and later. > >
> > > > > > --- 9942,9950 ---- > >> > ! Example: > >
> > > > +> > + smtpd_client_new_tls_session_rate_limit = 100 > > +> > + > > > > *************** > > *** 13208,13228 **** > > > > !
The hostname and TCP port of the mail filtering proxy server. > > ! The proxy receives all mail from the Postfix SMTP server, and is > > ! supposed to give the result to another Postfix SMTP server process. > >
> > > > !Specify "host:port" or "inet:host:port" for a TCP endpoint, or > > ! "unix:pathname" for a UNIX-domain endpoint. The host can be specified > > ! as an IP address or as a symbolic name; no MX lookups are done. > > ! When no "host" or "host:" are specified, the local machine is > > ! assumed. Pathname interpretation is relative to the Postfix queue > > ! directory.
> > ! > > !This feature is available in Postfix 2.1 and later.
> > ! > > !The "inet:" and "unix:" prefixes are available in Postfix 2.3 > > ! and later.
> > > > --- 9952,9961 ---- > > > > !Enable logging of the remote SMTP client port in addition to > > ! the hostname and IP address. The logging format is "host[address]:port". > >
> > > > !This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 13231,13273 **** > > > > !> > ! List of options that control how the Postfix SMTP server > > ! communicates with a before-queue content filter. Specify zero or > > ! more of the following, separated by comma or whitespace.
> > ! > > !Do not connect to a before-queue content filter until an entire > > ! message has been received. This reduces the number of simultaneous > > ! before-queue content filter processes.
> > ! > > !NOTE 1: A filter must not selectively reject recipients > > ! of a multi-recipient message. Rejecting all recipients is OK, as > > ! is accepting all recipients.
> > ! > > !NOTE 2: This feature increases the minimum amount of free queue > > ! space by $message_size_limit. The extra space is needed to save the > > ! message to a temporary file.
> > ! This feature is available in Postfix 2.7 and later. > >
> > > > - > > -> > ! The time limit for connecting to a proxy filter and for sending or > > ! receiving information. When a connection fails the client gets a > > ! generic error message while more detailed information is logged to > > ! the maillog file. > >
> > --- 9964,9982 ---- > > > > !> > ! The maximal number of recipient addresses that any client is allowed > > ! to send to this service per time unit, regardless of whether or not > > ! Postfix actually accepts those recipients. The time unit is specified > > ! with the anvil_rate_time_unit configuration parameter. > > !
> > > >> > ! By default, a client can make as many recipient addresses per time > > ! unit as Postfix can accept. > >
> > > >> > ! To disable this feature, specify a limit of 0. > >
> > *************** > > *** 13275,13278 **** > >> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > >
> > --- 9984,9987 ---- > >> > ! WARNING: The purpose of this feature is to limit abuse. It must > > ! not be used to regulate legitimate mail traffic. > >
> > *************** > > *** 13280,13305 **** > >> > ! This feature is available in Postfix 2.1 and later. > >
> > > > - > > -> > ! The maximal number of recipients that the Postfix SMTP server > > ! accepts per message delivery request. > >
> > > > ! > > !The number of recipients that a remote SMTP client can send in > > ! excess of the limit specified with $smtpd_recipient_limit, before > > ! the Postfix SMTP server increments the per-session error count > > ! for each excess recipient.
> > > > --- 9989,10000 ---- > >> > ! This feature is available in Postfix 2.2 and later. > >
> > > >> > ! Example: > >
> > > > !> > ! smtpd_client_recipient_rate_limit = 1000 > > !> > > > *************** > > *** 13308,13349 **** > > > > !
> > ! The access restrictions that the Postfix SMTP server applies in > > ! the context of the RCPT TO command. > > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > > ! restriction lists" for a discussion of evaluation context and time. > > !
> > > >> > ! By default, the Postfix SMTP server accepts: > >
> > > > -> > ! IMPORTANT: If you change this parameter setting, you must specify > > ! at least one of the following restrictions. Otherwise Postfix will > > ! refuse to receive mail: > >
> > > > -> > -> > - > >> > - reject, defer, defer_if_permit, reject_unauth_destination > > -> > -
> > --- 10003,10016 ---- > > > > !
> > ! Optional SMTP server access restrictions in the context of a client > > ! SMTP connection request. > >
> > > >> > ! The default is to allow all connection requests. > >
> > > >> > *************** > > *** 13356,13359 **** > >
> > ! The following restrictions are specific to the recipient address > > ! that is received with the RCPT TO command. > >
> > --- 10023,10026 ---- > >> > ! The following restrictions are specific to client hostname or > > ! client network address information. > >
> > *************** > > *** 13362,13503 **** > > > > !> > ! In addition, you can use any of the following > > ! generic restrictions. These restrictions are applicable in > > ! any SMTP command context. > > !
> > > > !> > ! /etc/postfix/main.cf: > > ! smtpd_client_restrictions = > > ! sleep 1, reject_unauth_pipelining > > ! smtpd_delay_reject = no > > !> > ! This feature is available in Postfix 2.3.
> > ! smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination > >> > --- 10268,10270 ---- > >
> > ! smtpd_client_restrictions = permit_mynetworks, reject_unknown_client_hostname > >> > *************** > > *** 13531,13608 **** > > > > !
Optional information that is appended after each Postfix SMTP > > ! server > > ! 4XX or 5XX response.
> > > > !Example:
> > > > !> > ! /etc/postfix/main.cf: > > ! smtpd_reject_footer = For assistance, call 800-555-0101. > > ! Please provide the following information in your problem report: > > ! time ($localtime), client ($client_address) and server > > ! ($server_name). > > !> > > > !
Server response:
> > > > !> > ! 550-5.5.1 <user at example> Recipient address rejected: User unknown > > ! 550 5.5.1 For assistance, call 800-555-0101. Please provide the > > ! following information in your problem report: time (Jan 4 15:42:00), > > ! client (192.168.1.248) and server (mail1.example.com). > > !> > > > !
Note: the above text is meant to make it easier to find the > > ! Postfix logfile records for a failed SMTP session. The text itself > > ! is not logged to the Postfix SMTP server's maillog file.
> > > > !Be sure to keep the text as short as possible. Long text may > > ! be truncated before it is logged to the remote SMTP client's maillog > > ! file, or before it is returned to the sender in a delivery status > > ! notification.
> > > > !This feature supports a limited number of $name attributes in > > ! the footer text. These are replaced by their current value for the > > ! SMTP session:
> > > > !Notes:
> > > > !NOT SUPPORTED are other attributes such as sender, recipient, > > - or main.cf parameters.
> > > > !For safety reasons, text that does not match > > ! $smtpd_expansion_filter is censored.
> > > > !This feature supports the two-character sequence \n as a request > > ! for a line break in the footer text. Postfix automatically inserts > > ! after each line break the three-digit SMTP reply code (and optional > > ! enhanced status code) from the original Postfix reject message. > >
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 10274,10362 ---- > > > > !> > ! Optional access restrictions that the Postfix SMTP server applies > > ! in the context of the SMTP DATA command. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > !> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > > !
> > > > !> > ! The following restrictions are valid in this context: > > !
> > > > !> > ! Examples: > > !
> > > > !> > ! smtpd_data_restrictions = reject_unauth_pipelining > > ! smtpd_data_restrictions = reject_multi_recipient_bounce > > !> > > > > > !
Postpone the start of an SMTP mail transaction until a valid > > ! RCPT TO command is received. Specify "no" to create a mail transaction > > ! as soon as the SMTP server receives a valid MAIL FROM command.
> > > > !With sites that reject lots of mail, the default setting reduces > > ! the use of > > ! disk, CPU and memory resources. The downside is that rejected > > ! recipients are logged with NOQUEUE instead of a mail transaction > > ! ID. This complicates the logfile analysis of multi-recipient mail. > > !
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > !> > ! Wait until the RCPT TO command before evaluating > > ! $smtpd_client_restrictions, $smtpd_helo_restrictions and > > ! $smtpd_sender_restrictions, or wait until the ETRN command before > > ! evaluating $smtpd_client_restrictions and $smtpd_helo_restrictions. > > !
> > ! > > !> > ! This feature is turned on by default because some clients apparently > > ! mis-behave when the Postfix SMTP server rejects commands before > > ! RCPT TO. > >
> > > > !> > ! The default setting has one major benefit: it allows Postfix to log > > ! recipient address information when rejecting a client name/address > > ! or sender address, so that it is possible to find out whose mail > > ! is being rejected. > > !
> > > > *************** > > *** 13611,13641 **** > > > > !> > ! Request that the Postfix SMTP server rejects mail for unknown > > ! recipient addresses, even when no explicit reject_unlisted_recipient > > ! access restriction is specified. This prevents the Postfix queue > > ! from filling up with undeliverable MAILER-DAEMON messages. > > !
> > > > !An address is always considered "known" when it matches a > > ! virtual(5) alias or a canonical(5) mapping. > > > > !
Lookup tables, indexed by the remote SMTP client address, with > > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth, > > ! etc.) that the SMTP server will not send in the EHLO response to a > > ! remote SMTP client. See smtpd_discard_ehlo_keywords for details. > > ! The table is not searched by hostname for robustness reasons.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > ! > > ! > > !A case insensitive list of EHLO keywords (pipelining, starttls, > > ! auth, etc.) that the SMTP server will not send in the EHLO response > > ! to a remote SMTP client.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > !Notes:
> > > > !Specify the silent-discard pseudo keyword to prevent > > ! this action from being logged.
> > > > !Use the smtpd_discard_ehlo_keyword_address_maps feature > > ! to discard EHLO keywords selectively.
> > > > *************** > > *** 13643,13648 **** > > > > -> > - This feature is available in Postfix 2.1 and later. > > -
> > - > > > > --- 10400,10401 ---- > > *************** > > *** 13650,13684 **** > > > > !Request that the Postfix SMTP server rejects mail from unknown > > ! sender addresses, even when no explicit reject_unlisted_sender > > ! access restriction is specified. This can slow down an explosion > > ! of forged mail from worms or viruses.
> > > > !An address is always considered "known" when it matches a > > ! virtual(5) alias or a canonical(5) mapping. > > > > !
> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > --- 10403,10434 ---- > > > > !Optional access restrictions that the Postfix SMTP server > > ! applies in the context of the SMTP END-OF-DATA command.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > !See smtpd_data_restrictions for syntax details.
> > > > > > !Mandatory TLS: announce STARTTLS support to SMTP clients, > > ! and require that clients use TLS encryption. According to RFC 2487 > > ! this MUST NOT be applied in case of a publicly-referenced SMTP > > ! server. This option is off by default and should be used only on > > ! dedicated servers.
> > > > !Note 1: "smtpd_enforce_tls = yes" implies "smtpd_tls_auth_only = yes".
> > > > !Note 2: when invoked via "sendmail -bs", Postfix will never offer > > ! STARTTLS due to insufficient privileges to access the server private > > ! key. This is intended behavior.
> > ! > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtpd_tls_security_level instead.
> > > > *************** > > *** 13687,13701 **** > > > > !> > ! User-defined aliases for groups of access restrictions. The aliases > > ! can be specified in smtpd_recipient_restrictions etc., and on the > > ! right-hand side of a Postfix access(5) table. > >
> > > > !> > ! One major application is for implementing per-recipient UCE control. > > ! See the RESTRICTION_CLASS_README document for other examples. > > !
> > > > --- 10437,10450 ---- > > > > !With Postfix version 2.1 and later: the SMTP server response delay after > > ! a client has made more than $smtpd_soft_error_limit errors, and > > ! fewer than $smtpd_hard_error_limit errors, without delivering mail. > >
> > > > !With Postfix version 2.0 and earlier: the SMTP server delay before > > ! sending a reject (4xx or 5xx) response, when the client has made > > ! fewer than $smtpd_soft_error_limit errors without delivering > > ! mail.
> > > > *************** > > *** 13704,13714 **** > > > > !> > ! The application name that the Postfix SMTP server uses for SASL > > ! server initialization. This > > ! controls the name of the SASL configuration file. The default value > > ! is smtpd, corresponding to a SASL configuration file named > > ! smtpd.conf. > >
> > --- 10453,10460 ---- > > > > !> > ! Optional SMTP server access restrictions in the context of a client > > ! ETRN request. > >
> > *************** > > *** 13716,13730 **** > >> > ! This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3 > > ! it was renamed to smtpd_sasl_path. > >
> > > > - > > -> > ! Enable SASL authentication in the Postfix SMTP server. By default, > > ! the Postfix SMTP server does not use authentication. > >
> > --- 10462,10473 ---- > >> > ! The Postfix ETRN implementation accepts only destinations that are > > ! eligible for the Postfix "fast flush" service. See the ETRN_README > > ! file for details. > >
> > > >> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > >
> > *************** > > *** 13732,13768 **** > >> > ! If a remote SMTP client is authenticated, the permit_sasl_authenticated > > ! access restriction can be used to permit relay access, like this: > >
> > > > !> > !> > > > !> > ! smtpd_recipient_restrictions = > > ! permit_mynetworks, permit_sasl_authenticated, ... > > !> > !
To reject all SMTP connections from unauthenticated clients, > > ! specify "smtpd_delay_reject = yes" (which is the default) and use: > > !
> > > > !> > !> > > >> > ! smtpd_client_restrictions = permit_sasl_authenticated, reject > > !> > !
> > ! See the SASL_README file for SASL configuration and operation details. > >
> > > > > > !Report the SASL authenticated user name in the smtpd(8) Received > > ! message header.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > --- 10475,10511 ---- > >> > ! The following restrictions are specific to the domain name information > > ! received with the ETRN command. > >
> > > > !> > ! Other restrictions that are valid in this context: > >
> > > > +> > ! Example: > > !
> > ! > > !> > ! smtpd_etrn_restrictions = permit_mynetworks, reject > > !> > > > *************** > > *** 13771,13778 **** > > > > !
> > ! What remote SMTP clients the Postfix SMTP server will not offer > > ! AUTH support to. > >
> > --- 10514,10522 ---- > > > > !> > ! What characters are allowed in $name expansions of RBL reply > > ! templates. Characters not in the allowed set are replaced by "_". > > ! Use C like escapes to specify special characters such as whitespace. > >
> > *************** > > *** 13780,13785 **** > >> > ! Some clients (Netscape 4 at least) have a bug that causes them to > > ! require a login and password whenever AUTH is offered, whether it's > > ! necessary or not. To work around this, specify, for example, > > ! $mynetworks to prevent Postfix from offering AUTH to local clients. > >
> > --- 10524,10526 ---- > >> > ! This parameter is not subjected to $parameter expansion. > >
> > *************** > > *** 13787,13815 **** > >> > ! Specify a list of network/netmask patterns, separated by commas > > ! and/or whitespace. The mask specifies the number of bits in the > > ! network part of a host address. You can also "/file/name" or > > ! "type:table" patterns. A "/file/name" pattern is replaced by its > > ! contents; a "type:table" lookup table is matched when a table entry > > ! matches a lookup string (the lookup result is ignored). Continue > > ! long lines by starting the next line with whitespace. Specify > > ! "!pattern" to exclude an address or network block from the list. > > ! The form "!/file/name" is supported only in Postfix version 2.4 and > > ! later.
> > > > !Note: IP version 6 address information must be specified inside > > ! [] in the smtpd_sasl_exceptions_networks value, and in > > ! files specified with "/file/name". IP version 6 addresses contain > > ! the ":" character, and would otherwise be confused with a "type:table" > > ! pattern.
> > > >> > ! Example: > >
> > > > -> > - smtpd_sasl_exceptions_networks = $mynetworks > > -> > - > >
> > ! This feature is available in Postfix 2.1 and later. > >
> > --- 10528,10548 ---- > >> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > ! > > !> > ! List of commands that causes the Postfix SMTP server to immediately > > ! terminate the session with a 221 code. This can be used to disconnect > > ! clients that obviously attempt to abuse the system. In addition to the > > ! commands listed in this parameter, commands that follow the "Label:" > > ! format of message headers will also cause a disconnect. > >
> > > >> > ! This feature is available in Postfix 2.2 and later. > >
> > *************** > > *** 13819,13830 **** > > > > !> > ! The name of the Postfix SMTP server's local SASL authentication > > ! realm. > >
> > > >> > ! By default, the local authentication realm name is the null string. > >
> > --- 10552,10571 ---- > > > > !> > ! The maximal number of errors a remote SMTP client is allowed to > > ! make without delivering mail. The Postfix SMTP server disconnects > > ! when the limit is exceeded. > >
> > > > + > > +> > ! Require that a remote SMTP client introduces itself at the beginning > > ! of an SMTP session with the HELO or EHLO command. > >
> > *************** > > *** 13832,13834 **** > >> > ! Examples: > >
> > --- 10573,10575 ---- > >> > ! Example: > >
> > *************** > > *** 13836,13839 **** > >> > ! smtpd_sasl_local_domain = $mydomain > > ! smtpd_sasl_local_domain = $myhostname > >> > --- 10577,10579 ---- > >
> > ! smtpd_helo_required = yes > >> > *************** > > *** 13843,13874 **** > > > > !
Implementation-specific information that the Postfix SMTP server > > ! passes through to > > ! the SASL plug-in implementation that is selected with > > ! smtpd_sasl_type. Typically this specifies the name of a > > ! configuration file or rendezvous point.
> > ! > > !This feature is available in Postfix 2.3 and later. In earlier > > ! releases it was called smtpd_sasl_application_name.
> > ! > > ! > > !Postfix SMTP server SASL security options; as of Postfix 2.3 > > ! the list of available > > ! features depends on the SASL server implementation that is selected > > ! with smtpd_sasl_type.
> > > > !The following security features are defined for the cyrus > > ! server SASL implementation:
> > > >> > ! Restrict what authentication mechanisms the Postfix SMTP server > > ! will offer to the client. The list of available authentication > > ! mechanisms is system dependent. > >
> > --- 10583,10601 ---- > > > > !> > ! Optional restrictions that the Postfix SMTP server applies in the > > ! context of the SMTP HELO command. > > !
> > > > !> > ! The default is to permit everything. > > !
> > > >> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > >
> > *************** > > *** 13876,13878 **** > >> > ! Specify zero or more of the following: > >
> > --- 10603,10606 ---- > >> > ! The following restrictions are specific to the hostname information > > ! received with the HELO or EHLO command. > >
> > *************** > > *** 13881,13907 **** > > > > !> > ! By default, the Postfix SMTP server accepts plaintext passwords but > > ! not anonymous logins. > >
> > > > !> > ! Warning: it appears that clients try authentication methods in the > > ! order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5) > > ! which means that if you disable plaintext passwords, clients will > > ! log in anonymously, even when they should be able to use CRAM-MD5. > > ! So, if you disable plaintext logins, disable anonymous logins too. > > ! Postfix treats anonymous login as no authentication. > > !
> > > >> > ! Example: > >
> > --- 10664,10687 ---- > >> > ! Other restrictions that are valid in this context: > >
> > > > !> > ! Examples: > >
> > *************** > > *** 13928,13930 **** > >> > ! smtpd_sasl_security_options = noanonymous, noplaintext > >> > --- 10689,10692 ---- > >
> > ! smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname > > ! smtpd_helo_restrictions = permit_mynetworks, reject_unknown_helo_hostname > >> > *************** > > *** 13934,13942 **** > > > > !
The SASL authentication security options that the Postfix SMTP > > ! server uses for TLS encrypted SMTP sessions.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 10696,10719 ---- > > > > !> > ! The maximal number of lines in the Postfix SMTP server command history > > ! before it is flushed upon receipt of EHLO, RSET, or end of DATA. > > !
> > > > ! > > !> > ! The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote > > ! SMTP client can send before the Postfix SMTP server starts to > > ! increment the error counter with each junk command. The junk > > ! command count is reset after mail is delivered. See also the > > ! smtpd_error_sleep_time and smtpd_soft_error_limit configuration > > ! parameters. > > !
> > > > *************** > > *** 13945,13952 **** > > > > !The SASL plug-in type that the Postfix SMTP server should use > > ! for authentication. The available types are listed with the > > ! "postconf -a" command.
> > > > --- 10722,10729 ---- > > > > !A list of Milter (mail filter) applications for new mail that > > ! arrives via the Postfix smtpd(8) server. See the MILTER_README > > ! document for details.
> > > > *************** > > *** 13957,13959 **** > > > > !> > ! Optional lookup table with the SASL login names that own sender > > ! (MAIL FROM) addresses. > >
> > > >> > ! Specify zero or more "type:table" lookup tables. With lookups from > > ! indexed files such as DB or DBM, or from networked tables such as > > ! NIS, LDAP or SQL, the following search operations are done with a > > ! sender address of user at domain:
> > > > -> > ! In all cases the result of table lookup must be either "not found" > > ! or a list of SASL login names separated by comma and/or whitespace. > >
> > --- 10738,10782 ---- > >> > ! List of commands that the Postfix SMTP server replies to with "250 > > ! Ok", without doing any syntax checks and without changing state. > > ! This list overrides any commands built into the Postfix SMTP server. > >
> > > > + > > +> > ! The lookup key to be used in SMTP access(5) tables instead of the > > ! null sender address. > > !
> > > > > > !Attempt to look up the remote SMTP client hostname, and verify that > > ! the name matches the client IP address. A client name is set to > > ! "unknown" when it cannot be looked up or verified, or when name > > ! lookup is disabled. Turning off name lookup reduces delays due to > > ! DNS lookup and increases the maximal inbound delivery rate.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > !> > ! The time after which an idle SMTPD policy service connection is > > ! closed. > > !
> > ! > > !> > ! This feature is available in Postfix 2.1 and later. > >
> > *************** > > *** 13997,14006 **** > > > > !> > ! Optional restrictions that the Postfix SMTP server applies in the > > ! context of the MAIL FROM command. > > ! See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access > > ! restriction lists" for a discussion of evaluation context and time. > >
> > --- 10786,10793 ---- > > > > !> > ! The time after which an active SMTPD policy service connection is > > ! closed. > >
> > *************** > > *** 14008,14017 **** > >> > ! The default is to permit everything. > >
> > > >> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > >
> > --- 10795,10808 ---- > >> > ! This feature is available in Postfix 2.1 and later. > >
> > > > + > > +> > ! The time limit for connecting to, writing to or receiving from a > > ! delegated SMTPD policy server. > >
> > *************** > > *** 14019,14130 **** > >> > ! The following restrictions are specific to the sender address > > ! received with the MAIL FROM command. > >
> > > > -> > ! Other restrictions that are valid in this context: > >
> > --- 10810,10909 ---- > >> > ! This feature is available in Postfix 2.1 and later. > >
> > > > > > !> > ! How the Postfix SMTP server announces itself to the proxy filter. > > ! By default, the Postfix hostname is used. > > !
> > > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > > > !The hostname and TCP port of the mail filtering proxy server. > > ! The proxy receives all mail from the Postfix SMTP server, and is > > ! supposed to give the result to another Postfix SMTP server process. > > !
> > > > !Specify "host:port" or "inet:host:port" for a TCP endpoint, or > > ! "unix:pathname" for a UNIX-domain endpoint. The host can be specified > > ! as an IP address or as a symbolic name; no MX lookups are done. > > ! When no "host" or "host:" are specified, the local machine is > > ! assumed. Pathname interpretation is relative to the Postfix queue > > ! directory.
> > > > !This feature is available in Postfix 2.1 and later.
> > ! > > !The "inet:" and "unix:" prefixes are available in Postfix 2.3 > > ! and later.
> > ! > > ! > > !> > ! The time limit for connecting to a proxy filter and for sending or > > ! receiving information. When a connection fails the client gets a > > ! generic error message while more detailed information is logged to > > ! the maillog file. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > > > !> > ! The maximal number of recipients that the Postfix SMTP server > > ! accepts per message delivery request. > > !
> > > > > > !The number of recipients that a remote SMTP client can send in > > ! excess of the limit specified with $smtpd_recipient_limit, before > > ! the Postfix SMTP server increments the per-session error count > > ! for each excess recipient.
> > > > > > !> > ! The access restrictions that the Postfix SMTP server applies in > > ! the context of the RCPT TO command. > > !
> > ! > > !> > ! By default, the Postfix SMTP server accepts: > >
> > *************** > > *** 14133,14145 **** > > > > !> > ! Examples: > >
> > > >> > ! smtpd_sender_restrictions = reject_unknown_sender_domain > > ! smtpd_sender_restrictions = reject_unknown_sender_domain, > > ! check_sender_access hash:/etc/postfix/access > >> > > > ! > > !
The internal service that postscreen(8) hands off allowed > > ! connections to. In a future version there may be different > > ! classes of SMTP service.
> > ! > > !This feature is available in Postfix 2.8.
> > ! > > ! > > !> > ! The number of errors a remote SMTP client is allowed to make without > > ! delivering mail before the Postfix SMTP server slows down all its > > ! responses. > >
> > > > !With Postfix version 2.1 and later, the Postfix SMTP server > > ! delays all responses by $smtpd_error_sleep_time seconds.
> > > > !With Postfix versions 2.0 and earlier, the Postfix SMTP > > ! server delays all responses by (number of errors) seconds.
> > > > !The time limit for Postfix SMTP server write and read operations > > ! during TLS startup and shutdown handshake procedures. The current > > ! default value is stress-dependent. Before Postfix version 2.8, it > > ! was fixed at 300s.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !> > ! The time limit for sending a Postfix SMTP server response and for > > ! receiving a remote SMTP client request. Normally the default limit > > ! is 300s, but it changes under overload to just 10s. With Postfix > > ! 2.5 and earlier, the SMTP server always uses a time limit of 300s > > ! by default. > > !
> > > > !> > ! Note: if you set SMTP time limits to very large values you may have > > ! to update the global ipc_timeout parameter. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > > > !A file containing (PEM format) CA certificates of root CAs trusted > > ! to sign either remote SMTP client certificates or intermediate CA > > ! certificates. These are loaded into memory before the smtpd(8) server > > ! enters the chroot jail. If the number of trusted roots is large, consider > > ! using smtpd_tls_CApath instead, but note that the latter directory must > > ! be present in the chroot jail if the smtpd(8) server is chrooted. This > > ! file may also be used to augment the server certificate trust chain, > > ! but it is best to include all the required certificates directly in the > > ! server certificate file.
> > ! > > !Specify "smtpd_tls_CAfile = /path/to/system_CA_file" to use ONLY > > ! the system-supplied default certificate authority certificates. > > !
> > ! > > !Specify "tls_append_default_CA = no" to prevent Postfix from > > ! appending the system-supplied default CAs and trusting third-party > > ! certificates.
> > ! > > !By default (see smtpd_tls_ask_ccert), client certificates are not > > ! requested, and smtpd_tls_CAfile should remain empty. If you do make use > > ! of client certificates, the distinguished names (DNs) of the certificate > > ! authorities listed in smtpd_tls_CAfile are sent to the remote SMTP client > > ! in the client certificate request message. MUAs with multiple client > > ! certificates may use the list of preferred certificate authorities > > ! to select the correct client certificate. You may want to put your > > ! "preferred" CA or CAs in this file, and install other trusted CAs in > > ! $smtpd_tls_CApath.
> > > > !Example:
> > > > !> > ! smtpd_tls_CAfile = /etc/postfix/CAcert.pem > > !> > > > !
This feature is available in Postfix 2.2 and later.
> > > > > > !A directory containing (PEM format) CA certificates of root CAs > > ! trusted to sign either remote SMTP client certificates or intermediate CA > > ! certificates. Do not forget to create the necessary "hash" links with, > > ! for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use > > ! smtpd_tls_CApath in chroot mode, this directory (or a copy) must be > > ! inside the chroot jail.
> > ! > > !Specify "smtpd_tls_CApath = /path/to/system_CA_directory" to > > ! use ONLY the system-supplied default certificate authority certificates. > > !
> > ! > > !Specify "tls_append_default_CA = no" to prevent Postfix from > > ! appending the system-supplied default CAs and trusting third-party > > ! certificates.
> > ! > > !By default (see smtpd_tls_ask_ccert), client certificates are > > ! not requested, and smtpd_tls_CApath should remain empty. In contrast > > ! to smtpd_tls_CAfile, DNs of certificate authorities installed > > ! in $smtpd_tls_CApath are not included in the client certificate > > ! request message. MUAs with multiple client certificates may use the > > ! list of preferred certificate authorities to select the correct > > ! client certificate. You may want to put your "preferred" CA or > > ! CAs in $smtpd_tls_CAfile, and install the remaining trusted CAs in > > ! $smtpd_tls_CApath.
> > > > !Example:
> > > > !> > ! smtpd_tls_CApath = /etc/postfix/certs > > !> > > > !
This feature is available in Postfix 2.2 and later.
> > > > > > !Force the Postfix SMTP server to issue a TLS session id, even > > ! when TLS session caching is turned off (smtpd_tls_session_cache_database > > ! is empty). This behavior is compatible with Postfix < 2.3.
> > > > !With Postfix 2.3 and later the Postfix SMTP server can disable > > ! session id generation when TLS session caching is turned off. This > > ! keeps remote SMTP clients from caching sessions that almost certainly cannot > > ! be re-used.
> > > > !By default, the Postfix SMTP server always generates TLS session > > ! ids. This works around a known defect in mail client applications > > ! such as MS Outlook, and may also prevent interoperability issues > > ! with other MTAs.
> > > > !Example:
> > > > !> > ! smtpd_tls_always_issue_session_ids = no > > !> > > > !
This feature is available in Postfix 2.3 and later.
> > > > > > !Ask a remote SMTP client for a client certificate. This > > ! information is needed for certificate based mail relaying with, > > ! for example, the permit_tls_clientcerts feature.
> > > > !Some clients such as Netscape will either complain if no > > ! certificate is available (for the list of CAs in $smtpd_tls_CAfile) > > ! or will offer multiple client certificates to choose from. This > > ! may be annoying, so this option is "off" by default.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 10925,11107 ---- > >> > ! IMPORTANT: If you change this parameter setting, you must specify > > ! at least one of the following restrictions. Otherwise Postfix will > > ! refuse to receive mail: > >
> > > > +> >> > > > !> > ! reject, defer, defer_if_permit, reject_unauth_destination > >> > +
> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > > !
> > > >> > ! The following restrictions are specific to the recipient address > > ! that is received with the RCPT TO command. > >
> > > > !> > ! Other restrictions that are valid in this context: > > !
> > > > +> > ! Example: > > !
> > > > !> > ! smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination > > !> > > > *************** > > *** 14357,14388 **** > > > > !
When TLS encryption is optional in the Postfix SMTP server, do > > ! not announce or accept SASL authentication over unencrypted > > ! connections.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !The verification depth for remote SMTP client certificates. A > > ! depth of 1 is sufficient if the issuing CA is listed in a local CA > > ! file.
> > > > !The default verification depth is 9 (the OpenSSL default) for > > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5, > > ! the default value was 5, but the limit was not actually enforced. If > > ! you have set this to a lower non-default value, certificates with longer > > ! trust chains may now fail to verify. Certificate chains with 1 or 2 > > ! CAs are common, deeper chains are more rare and any number between 5 > > ! and 9 should suffice in practice. You can choose a lower number if, > > ! for example, you trust certificates directly signed by an issuing CA > > ! but not any CAs it delegates to.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 11110,11143 ---- > > > > !> > ! Request that the Postfix SMTP server rejects mail for unknown > > ! recipient addresses, even when no explicit reject_unlisted_recipient > > ! access restriction is specified. This prevents the Postfix queue > > ! from filling up with undeliverable MAILER-DAEMON messages. > > !
> > > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > *************** > > *** 14391,14446 **** > > > > !File with the Postfix SMTP server RSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP server private RSA key.
> > ! > > !Public Internet MX hosts without certificates signed by a "reputable" > > ! CA must generate, and be prepared to present to most clients, a > > ! self-signed or private-CA signed certificate. The client will not be > > ! able to authenticate the server, but unless it is running Postfix 2.3 or > > ! similar software, it will still insist on a server certificate.
> > ! > > !For servers that are not public Internet MX hosts, Postfix > > ! 2.3 supports configurations with no certificates. This entails the > > ! use of just the anonymous TLS ciphers, which are not supported by > > ! typical SMTP clients. Since such clients will not, as a rule, fall > > ! back to plain text after a TLS handshake failure, the server will > > ! be unable to receive email from TLS enabled clients. To avoid > > ! accidental configurations with no certificates, Postfix 2.3 enables > > ! certificate-less operation only when the administrator explicitly > > ! sets "smtpd_tls_cert_file = none". This ensures that new Postfix > > ! configurations will not accidentally run with no certificates.
> > > > !Both RSA and DSA certificates are supported. When both types > > ! are present, the cipher used determines which certificate will be > > ! presented to the client. For Netscape and OpenSSL clients without > > ! special cipher choices the RSA certificate is preferred.
> > > > !To enable a remote SMTP client to verify the Postfix SMTP server > > ! certificate, the issuing CA certificates must be made available to the > > ! client. You should include the required certificates in the server > > ! certificate file, the server certificate first, then the issuing > > ! CA(s) (bottom-up order).
> > > > !Example: the certificate for "server.example.com" was issued by > > ! "intermediate CA" which itself has a certificate of "root CA". > > ! Create the server.pem file with "cat server_cert.pem intermediate_CA.pem > > ! root_CA.pem > server.pem".
> > > > !If you also want to verify client certificates issued by these > > ! CAs, you can add the CA certificates to the smtpd_tls_CAfile, in which > > ! case it is not necessary to have them in the smtpd_tls_cert_file or > > ! smtpd_tls_dcert_file.
> > > > !A certificate supplied here must be usable as an SSL server certificate > > ! and hence pass the "openssl verify -purpose sslserver ..." test.
> > > > !Example:
> > > > !> > ! smtpd_tls_cert_file = /etc/postfix/server.pem > > !> > > > !
This feature is available in Postfix 2.2 and later.
> > > > --- 11146,11177 ---- > > > > !Request that the Postfix SMTP server rejects mail from unknown > > ! sender addresses, even when no explicit reject_unlisted_sender > > ! access restriction is specified. This can slow down an explosion > > ! of forged mail from worms or viruses.
> > > > !> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > *************** > > *** 14449,14467 **** > > > > !Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS > > ! cipher list. It is easy to create inter-operability problems by choosing > > ! a non-default cipher list. Do not use a non-default TLS cipherlist for > > ! MX hosts on the public Internet. Clients that begin the TLS handshake, > > ! but are unable to agree on a common cipher, may not be able to send any > > ! email to the SMTP server. Using a restricted cipher list may be more > > ! appropriate for a dedicated MSA or an internal mailhub, where one can > > ! exert some control over the TLS software and settings of the connecting > > ! clients.
> > ! > > !Note: do not use "" quotes around the parameter value.
> > > > !This feature is available with Postfix version 2.2. It is not used with > > ! Postfix 2.3 and later; use smtpd_tls_mandatory_ciphers instead.
> > > > --- 11180,11194 ---- > > > > !> > ! User-defined aliases for groups of access restrictions. The aliases > > ! can be specified in smtpd_recipient_restrictions etc., and on the > > ! right-hand side of a Postfix access(5) table. > > !
> > > > !> > ! One major application is for implementing per-recipient UCE control. > > ! See the RESTRICTION_CLASS_README document for other examples. > > !
> > > > *************** > > *** 14470,14494 **** > > > > !The minimum TLS cipher grade that the Postfix SMTP server > > ! will use with opportunistic TLS encryption. Cipher types listed in > > ! smtpd_tls_exclude_ciphers are excluded from the base definition of > > ! the selected cipher grade. The default value "export" ensures maximum > > ! inter-operability. Because encryption is optional, stronger controls > > ! are not appropriate, and this setting SHOULD NOT be changed unless the > > ! change is essential.
> > ! > > !When TLS is mandatory the cipher grade is chosen via the > > ! smtpd_tls_mandatory_ciphers configuration parameter, see there for syntax > > ! details.
> > > > !Example:
> > !> > ! smtpd_tls_ciphers = export > > !> > > > !
This feature is available in Postfix 2.6 and later. With earlier Postfix > > ! releases only the smtpd_tls_mandatory_ciphers parameter is implemented, > > ! and opportunistic TLS always uses "export" or better (i.e. all) ciphers.
> > > > --- 11197,11213 ---- > > > > !> > ! The application name that the Postfix SMTP server uses for SASL > > ! server initialization. This > > ! controls the name of the SASL configuration file. The default value > > ! is smtpd, corresponding to a SASL configuration file named > > ! smtpd.conf. > > !
> > > > !> > ! This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3 > > ! it was renamed to smtpd_sasl_path. > > !
> > > > *************** > > *** 14497,14514 **** > > > > !File with the Postfix SMTP server DSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP server private DSA key.
> > > > !See the discussion under smtpd_tls_cert_file for more details. > >
> > > > !Example:
> > > >> > ! smtpd_tls_dcert_file = /etc/postfix/server-dsa.pem > >> > > > !
This feature is available in Postfix 2.2 and later.
> > > > --- 11216,11250 ---- > > > > !> > ! Enable SASL authentication in the Postfix SMTP server. By default, > > ! the Postfix SMTP server does not use authentication. > > !
> > > > !> > ! If a remote SMTP client is authenticated, the permit_sasl_authenticated > > ! access restriction can be used to permit relay access, like this: > >
> > > > !> > !> > ! > > !> > ! smtpd_recipient_restrictions = > > ! permit_mynetworks, permit_sasl_authenticated, ... > > !> > !
To reject all SMTP connections from unauthenticated clients, > > ! specify "smtpd_delay_reject = yes" (which is the default) and use: > > !
> > > > +> >> > > > !> > ! smtpd_client_restrictions = permit_sasl_authenticated, reject > >> > +
> > ! See the SASL_README file for SASL configuration and operation details. > > !
> > > > *************** > > *** 14517,14546 **** > > > > !File with DH parameters that the Postfix SMTP server should > > ! use with EDH ciphers.
> > > > !Instead of using the exact same parameter sets as distributed > > ! with other TLS packages, it is more secure to generate your own > > ! set of parameters with something like the following command:
> > > > !> > !> > > > !> > ! openssl gendh -out /etc/postfix/dh_1024.pem -2 1024 > > !> > !
Your actual source for entropy may differ. Some systems have > > ! /dev/random; on other system you may consider using the "Entropy > > ! Gathering Daemon EGD", available at http://egd.sourceforge.net/ > >
> > > > -Example:
> > - > >> > ! smtpd_tls_dh1024_param_file = /etc/postfix/dh_1024.pem > >> > > > !
This feature is available with Postfix version 2.2.
> > > > --- 11253,11309 ---- > > > > !Report the SASL authenticated user name in the smtpd(8) Received > > ! message header.
> > ! > > !This feature is available in Postfix 2.3 and later.
> > ! > > ! > > !> > ! What remote SMTP clients the Postfix SMTP server will not offer > > ! AUTH support to. > > !
> > > > !> > ! Some clients (Netscape 4 at least) have a bug that causes them to > > ! require a login and password whenever AUTH is offered, whether it's > > ! necessary or not. To work around this, specify, for example, > > ! $mynetworks to prevent Postfix from offering AUTH to local clients. > > !
> > > > !> > ! Specify a list of network/netmask patterns, separated by commas > > ! and/or whitespace. The mask specifies the number of bits in the > > ! network part of a host address. You can also "/file/name" or > > ! "type:table" patterns. A "/file/name" pattern is replaced by its > > ! contents; a "type:table" lookup table is matched when a table entry > > ! matches a lookup string (the lookup result is ignored). Continue > > ! long lines by starting the next line with whitespace. Specify > > ! "!pattern" to exclude an address or network block from the list. > > ! The form "!/file/name" is supported only in Postfix version 2.4 and > > ! later.
> > ! > > !Note: IP version 6 address information must be specified inside > > ! [] in the smtpd_sasl_exceptions_networks value, and in > > ! files specified with "/file/name". IP version 6 addresses contain > > ! the ":" character, and would otherwise be confused with a "type:table" > > ! pattern.
> > > > !> > ! Example: > >
> > > >> > ! smtpd_sasl_exceptions_networks = $mynetworks > >> > > > !
> > ! This feature is available in Postfix 2.1 and later. > > !
> > > > *************** > > *** 14549,14567 **** > > > > !File with DH parameters that the Postfix SMTP server should > > ! use with EDH ciphers.
> > > > !See also the discussion under the smtpd_tls_dh1024_param_file > > ! configuration parameter.
> > > > !Example:
> > > >> > ! smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem > >> > > > -
This feature is available with Postfix version 2.2.
> > - > > > > --- 11312,11334 ---- > > > > !> > ! The name of the Postfix SMTP server's local SASL authentication > > ! realm. > > !
> > > > !> > ! By default, the local authentication realm name is the null string. > > !
> > > > !> > ! Examples: > > !
> > > >> > ! smtpd_sasl_local_domain = $mydomain > > ! smtpd_sasl_local_domain = $myhostname > >> > > > > > *************** > > *** 14569,14583 **** > > > > !
File with the Postfix SMTP server DSA private key in PEM format. > > ! This file may be combined with the Postfix SMTP server DSA certificate > > ! file specified with $smtpd_tls_dcert_file.
> > > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted. File permissions should grant read-only > > ! access to the system superuser account ("root"), and no access > > ! to anyone else.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 11336,11348 ---- > > > > !Implementation-specific information that the Postfix SMTP server > > ! passes through to > > ! the SASL plug-in implementation that is selected with > > ! smtpd_sasl_type. Typically this specifies the name of a > > ! configuration file or rendezvous point.
> > > > !This feature is available in Postfix 2.3 and later. In earlier > > ! releases it was called smtpd_sasl_application_name.
> > > > *************** > > *** 14586,14650 **** > > > > !File with the Postfix SMTP server ECDSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP server private ECDSA key.
> > ! > > !See the discussion under smtpd_tls_cert_file for more details.
> > ! > > !Example:
> > > > !> > ! smtpd_tls_eccert_file = /etc/postfix/ecdsa-scert.pem > > !> > > > !
This feature is available in Postfix 2.6 and later, when Postfix is > > ! compiled and linked with OpenSSL 1.0.0 or later.
> > > > > > !File with the Postfix SMTP server ECDSA private key in PEM format. > > ! This file may be combined with the Postfix SMTP server ECDSA certificate > > ! file specified with $smtpd_tls_eccert_file.
> > > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted. File permissions should grant read-only > > ! access to the system superuser account ("root"), and no access > > ! to anyone else.
> > > > !This feature is available in Postfix 2.6 and later, when Postfix is > > ! compiled and linked with OpenSSL 1.0.0 or later.
> > > > > > !The Postfix SMTP server security grade for ephemeral elliptic-curve > > ! Diffie-Hellman (EECDH) key exchange.
> > > > !The available choices are:
> > > > !Postfix SMTP server SASL security options; as of Postfix 2.3 > > ! the list of available > > ! features depends on the SASL server implementation that is selected > > ! with smtpd_sasl_type.
> > > > !The following security features are defined for the cyrus > > ! server SASL implementation:
> > > > +> > + Restrict what authentication mechanisms the Postfix SMTP server > > + will offer to the client. The list of available authentication > > + mechanisms is system dependent. > > +
> > > > !> > ! Specify zero or more of the following: > > !
> > > > !This feature is available in Postfix 2.6 and later, when it is > > ! compiled and linked with OpenSSL 1.0.0 or later.
> > > > > > !List of ciphers or cipher types to exclude from the SMTP server > > - cipher list at all TLS security levels. Excluding valid ciphers > > - can create interoperability problems. DO NOT exclude ciphers unless it > > - is essential to do so. This is not an OpenSSL cipherlist; it is a simple > > - list separated by whitespace and/or commas. The elements are a single > > - cipher, or one or more "+" separated cipher properties, in which case > > - only ciphers matching all the properties are excluded.
> > > > !Examples (some of these will cause problems):
> > > > !> > !> > > > !> > ! smtpd_tls_exclude_ciphers = aNULL > > ! smtpd_tls_exclude_ciphers = MD5, DES > > ! smtpd_tls_exclude_ciphers = DES+MD5 > > ! smtpd_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 > > ! smtpd_tls_exclude_ciphers = kEDH+aRSA > > !> > !
The first setting disables anonymous ciphers. The next setting > > ! disables ciphers that use the MD5 digest algorithm or the (single) DES > > ! encryption algorithm. The next setting disables ciphers that use MD5 and > > ! DES together. The next setting disables the two ciphers "AES256-SHA" > > ! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" > > ! key exchange with RSA authentication.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > --- 11402,11435 ---- > > > > !> > ! By default, the Postfix SMTP server accepts plaintext passwords but > > ! not anonymous logins. > > !
> > > > +> > + Warning: it appears that clients try authentication methods in the > > + order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5) > > + which means that if you disable plaintext passwords, clients will > > + log in anonymously, even when they should be able to use CRAM-MD5. > > + So, if you disable plaintext logins, disable anonymous logins too. > > + Postfix treats anonymous login as no authentication. > > +
> > > > !> > ! Example: > > !
> > > > !> > ! smtpd_sasl_security_options = noanonymous, noplaintext > > !> > > > > > !
The SASL authentication security options that the Postfix SMTP > > ! server uses for TLS encrypted SMTP sessions.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 14693,14775 **** > > > > !The message digest algorithm to construct remote SMTP > > ! client-certificate > > ! fingerprints or public key fingerprints (Postfix 2.9 and later) > > ! for check_ccert_access and permit_tls_clientcerts. The > > ! default algorithm is md5, for backwards compatibility with Postfix > > ! releases prior to 2.5.
> > > > !Advances in hash > > ! function cryptanalysis have led to md5 being deprecated in favor of sha1. > > ! However, as long as there are no known "second pre-image" attacks > > ! against md5, its use in this context can still be considered safe. > > !
> > > > -While additional digest algorithms are often available with OpenSSL's > > - libcrypto, only those used by libssl in SSL cipher suites are available to > > - Postfix.
> > > > !To find the fingerprint of a specific certificate file, with a > > ! specific digest algorithm, run:
> > > > !> > !> > > > !> > ! $ openssl x509 -noout -fingerprint -digest -in certfile.pem > > !> > !
The text to the right of "=" sign is the desired fingerprint. > > ! For example:
> > > > !> > !> > > > !> > ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem > > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A > > !> > !
Public key fingerprints are more difficult to extract, however, > > ! the SHA-1 public key fingerprint is often present as the value of the > > ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix > > ! SMTP server and client log the peer certificate fingerprint and public > > ! key fingerprint when TLS loglevel is 1 or higher.
> > > > !Example: client-certificate access table, with sha1 fingerprints:
> > > > !> > !> > > > !> > ! /etc/postfix/main.cf: > > ! smtpd_tls_fingerprint_digest = sha1 > > ! smtpd_client_restrictions = > > ! check_ccert_access hash:/etc/postfix/access, > > ! reject > > !> > !> > ! /etc/postfix/access: > > ! # Action folded to next line... > > ! AF:88:7C:AD:51:95:6F:36:96:F6:01:FB:2E:48:CD:AB:49:25:A2:3B > > ! OK > > ! 85:16:78:FD:73:6E:CE:70:E0:31:5F:0D:3C:C8:6D:C4:2C:24:59:E1 > > ! permit_auth_destination > > !> > !
This feature is available in Postfix 2.5 and later.
> > > > > > !File with the Postfix SMTP server RSA private key in PEM format. > > ! This file may be combined with the Postfix SMTP server RSA certificate > > ! file specified with $smtpd_tls_cert_file.
> > > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted. File permissions should grant read-only > > ! access to the system superuser account ("root"), and no access > > ! to anyone else.
> > > > --- 11438,11487 ---- > > > > !The SASL plug-in type that the Postfix SMTP server should use > > ! for authentication. The available types are listed with the > > ! "postconf -a" command.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > !> > ! Optional lookup table with the SASL login names that own sender > > ! (MAIL FROM) addresses. > > !
> > > > !> > ! Specify zero or more "type:table" lookup tables. With lookups from > > ! indexed files such as DB or DBM, or from networked tables such as > > ! NIS, LDAP or SQL, the following search operations are done with a > > ! sender address of user at domain:
> > > > !> > ! In all cases the result of table lookup must be either "not found" > > ! or a list of SASL login names separated by comma and/or whitespace. > > !
> > > > *************** > > *** 14778,14936 **** > > > > !Enable additional Postfix SMTP server logging of TLS activity. > > ! Each logging level also includes the information that is logged at > > ! a lower logging level.
> > > > !Do not use "smtpd_tls_loglevel = 2" or higher except in case > > ! of problems. Use of loglevel 4 is strongly discouraged.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !The minimum TLS cipher grade that the Postfix SMTP server will > > ! use with mandatory TLS encryption. The default grade ("medium") is > > ! sufficiently strong that any benefit from globally restricting TLS > > ! sessions to a more stringent grade is likely negligible, especially > > ! given the fact that many implementations still do not offer any stronger > > ! ("high" grade) ciphers, while those that do, will always use "high" > > ! grade ciphers. So insisting on "high" grade ciphers is generally > > ! counter-productive. Allowing "export" or "low" ciphers is typically > > ! not a good idea, as systems limited to just these are limited to > > ! obsolete browsers. No known SMTP clients fail to support at least > > ! one "medium" or "high" grade cipher.
> > > > !The following cipher grades are supported:
> > > > !Cipher types listed in > > ! smtpd_tls_mandatory_exclude_ciphers or smtpd_tls_exclude_ciphers are > > ! excluded from the base definition of the selected cipher grade. See > > ! smtpd_tls_ciphers for cipher controls that apply to opportunistic > > ! TLS.
> > > > !The underlying cipherlists for grades other than "null" include > > ! anonymous ciphers, but these are automatically filtered out if the > > ! server is configured to ask for remote SMTP client certificates. You are very > > ! unlikely to need to take any steps to exclude anonymous ciphers, they > > ! are excluded automatically as required. If you must exclude anonymous > > ! ciphers even when Postfix does not need or use peer certificates, set > > ! "smtpd_tls_exclude_ciphers = aNULL". To exclude anonymous ciphers only > > ! when TLS is enforced, set "smtpd_tls_mandatory_exclude_ciphers = aNULL".
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > !Additional list of ciphers or cipher types to exclude from the > > ! Postfix SMTP server cipher list at mandatory TLS security levels. > > ! This list > > ! works in addition to the exclusions listed with smtpd_tls_exclude_ciphers > > ! (see there for syntax details).
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > !The SSL/TLS protocols accepted by the Postfix SMTP server with > > ! mandatory TLS encryption. If the list is empty, the server supports all > > ! available SSL/TLS protocol versions. A non-empty value is a list > > ! of protocol > > ! names separated by whitespace, commas or colons. The supported protocol > > ! names are "SSLv2", "SSLv3" and "TLSv1", and are not case sensitive.
> > > > !With Postfix ≥ 2.5 the parameter syntax is expanded to support > > ! protocol exclusions. One can now explicitly exclude SSLv2 by setting > > ! "smtpd_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and > > ! SSLv3 set "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing > > ! the protocols to include, rather than protocols to exclude, is still > > ! supported, use the form you find more intuitive.
> > > > !Since SSL version 2 has known protocol weaknesses and is now > > ! deprecated, the default setting excludes "SSLv2". This means that > > ! by default, SSL version 2 will not be used at the "encrypt" security > > ! level.
> > > > !Example:
> > > >> > ! smtpd_tls_mandatory_protocols = TLSv1 > > ! # Alternative form with Postfix ≥ 2.5: > > ! smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 > >> > > > -
This feature is available in Postfix 2.3 and later.
> > - > > > > --- 11490,11641 ---- > > > > !> > ! Optional restrictions that the Postfix SMTP server applies in the > > ! context of the MAIL FROM command. > > !
> > > > !> > ! The default is to permit everything. > > !
> > > > !> > ! Specify a list of restrictions, separated by commas and/or whitespace. > > ! Continue long lines by starting the next line with whitespace. > > ! Restrictions are applied in the order as specified; the first > > ! restriction that matches wins. > > !
> > > > !> > ! The following restrictions are specific to the sender address > > ! received with the MAIL FROM command. > > !
> > > > !> > + Other restrictions that are valid in this context: > > +
> > > > !> > ! Examples: > > !
> > > >> > ! smtpd_sender_restrictions = reject_unknown_sender_domain > > ! smtpd_sender_restrictions = reject_unknown_sender_domain, > > ! check_sender_access hash:/etc/postfix/access > >> > > > > > *************** > > *** 14938,14983 **** > > > > !
List of TLS protocols that the Postfix SMTP server will exclude > > ! or include with opportunistic TLS encryption. This parameter SHOULD be > > ! left at its default empty value, allowing all protocols to be used with > > ! opportunistic TLS.
> > ! > > !In main.cf the values are separated by whitespace, commas or > > ! colons. An empty value means allow all protocols. The valid protocol > > ! names, (see SSL_get_version(3)), are "SSLv2", "SSLv3" and > > ! "TLSv1". In smtp_tls_policy_maps table entries, "protocols" attribute > > ! values are separated by a colon.
> > ! > > !To include a protocol list its name, to exclude it, prefix the name > > ! with a "!" character. To exclude SSLv2 even for opportunistic TLS set > > ! "smtpd_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set > > ! "smtpd_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to > > ! include, is supported, but not recommended. OpenSSL provides no mechanisms > > ! for excluding protocols not known at compile-time. If Postfix is linked > > ! against an OpenSSL library that supports additional protocol versions, > > ! they cannot be excluded using either syntax.
> > ! > > !Example:
> > !> > ! smtpd_tls_protocols = !SSLv2 > > !> > ! > > !
This feature is available in Postfix 2.6 and later.
> > > > > > !Request that the Postfix SMTP server produces Received: message > > ! headers that include information about the protocol and cipher used, > > ! as well as the remote SMTP client CommonName and client certificate issuer > > ! CommonName. This is disabled by default, as the information may > > ! be modified in transit through other mail servers. Only information > > ! that was recorded by the final destination can be trusted.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 11643,11662 ---- > > > > !> > + The number of errors a remote SMTP client is allowed to make without > > + delivering mail before the Postfix SMTP server slows down all its > > + responses. > > +
> > > > !With Postfix version 2.1 and later, the Postfix SMTP server > > ! delays all responses by $smtpd_error_sleep_time seconds.
> > > > !With Postfix versions 2.0 and earlier, the Postfix SMTP > > ! server delays all responses by (number of errors) seconds.
> > > > !With mandatory TLS encryption, require a trusted remote SMTP client > > ! certificate in order to allow TLS connections to proceed. This > > ! option implies "smtpd_tls_ask_ccert = yes".
> > > > !When TLS encryption is optional, this setting is ignored with > > ! a warning written to the mail log.
> > > > --- 11665,11671 ---- > > > > !The time limit for Postfix SMTP server write and read operations > > ! during TLS startup and shutdown handshake procedures.
> > > > *************** > > *** 15001,15043 **** > > > > !The SMTP TLS security level for the Postfix SMTP server; when > > ! a non-empty value is specified, this overrides the obsolete parameters > > ! smtpd_use_tls and smtpd_enforce_tls. This parameter is ignored with > > ! "smtpd_tls_wrappermode = yes".
> > > > !Specify one of the following security levels:
> > > > !Note 1: the "fingerprint", "verify" and "secure" levels are not > > ! supported here. > > ! The Postfix SMTP server logs a warning and uses "encrypt" instead. > > ! To verify remote SMTP client certificates, see TLS_README for a discussion > > ! of the smtpd_tls_ask_ccert, smtpd_tls_req_ccert, and permit_tls_clientcerts > > ! features.
> > > > !Note 2: The parameter setting "smtpd_tls_security_level = > > ! encrypt" implies "smtpd_tls_auth_only = yes".
> > > > !Note 3: when invoked via "sendmail -bs", Postfix will never > > ! offer STARTTLS due to insufficient privileges to access the server > > ! private key. This is intended behavior.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > --- 11676,11715 ---- > > > > !> > ! The time limit for sending a Postfix SMTP server response and for > > ! receiving a remote SMTP client request. > > !
> > > > !> > ! Note: if you set SMTP time limits to very large values you may have > > ! to update the global ipc_timeout parameter. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > > > !The file with the certificate of the certification authority > > ! (CA) that issued the Postfix SMTP server certificate. This is > > ! needed only when the CA certificate is not already present in the > > ! server certificate file. This file may also contain the CA > > ! certificates of other trusted CAs. You must use this file for the > > ! list of trusted CAs if you want to use chroot-mode.
> > > > !Example:
> > > > !> > ! smtpd_tls_CAfile = /etc/postfix/CAcert.pem > > !> > > > !
This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 15046,15072 **** > > > > !Name of the file containing the optional Postfix SMTP server > > ! TLS session cache. Specify a database type that supports enumeration, > > ! such as btree or sdbm; there is no need to support > > ! concurrent access. The file is created if it does not exist. The smtpd(8) > > ! daemon does not use this parameter directly, rather the cache is > > ! implemented indirectly in the tlsmgr(8) daemon. This means that > > ! per-smtpd-instance master.cf overrides of this parameter are not > > ! effective. Note, that each of the cache databases supported by tlsmgr(8) > > ! daemon: $smtpd_tls_session_cache_database, $smtp_tls_session_cache_database > > ! (and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to be > > ! stored separately. It is not at this time possible to store multiple > > ! caches in a single database.
> > ! > > !Note: dbm databases are not suitable. TLS > > ! session objects are too large.
> > ! > > !As of version 2.5, Postfix no longer uses root privileges when > > ! opening this file. The file should now be stored under the Postfix-owned > > ! data_directory. As a migration aid, an attempt to open the file > > ! under a non-Postfix directory is redirected to the Postfix-owned > > ! data_directory, and a warning is logged.
> > ! > >Example:
> > --- 11718,11734 ---- > > > > !Directory with PEM format certificate authority certificates > > ! that the Postfix SMTP server offers to remote SMTP clients for the > > ! purpose of client certificate verification. Do not forget to create > > ! the necessary "hash" links with, for example, "$OPENSSL_HOME/bin/c_rehash > > ! /etc/postfix/certs".
> > ! > > !To use this option in chroot mode, this directory (or a copy) > > ! must be inside the chroot jail. Please note that in this case the > > ! CA certificates are not offered to the client, so that e.g. Netscape > > ! clients might not offer certificates issued by them. Use of this > > ! feature is therefore not recommended.
> > ! > >Example:
> > *************** > > *** 15074,15076 **** > >> > ! smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache > >> > --- 11736,11738 ---- > >
> > ! smtpd_tls_CApath = /etc/postfix/certs > >> > *************** > > *** 15082,15110 **** > > > > !
The expiration time of Postfix SMTP server TLS session cache > > ! information. A cache cleanup is performed periodically > > ! every $smtpd_tls_session_cache_timeout seconds. As with > > ! $smtpd_tls_session_cache_database, this parameter is implemented in the > > ! tlsmgr(8) daemon and therefore per-smtpd-instance master.cf overrides > > ! are not possible.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > > > > > !Run the Postfix SMTP server in the non-standard "wrapper" mode, > > ! instead of using the STARTTLS command.
> > > > !If you want to support this service, enable a special port in > > ! master.cf, and specify "-o smtpd_tls_wrappermode=yes" on the SMTP > > ! server's command line. Port 465 (smtps) was once chosen for this > > ! purpose.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 11744,11769 ---- > > > > !Force the Postfix SMTP server to issue a TLS session id, even > > + when TLS session caching is turned off (smtpd_tls_session_cache_database > > + is empty). This behavior is compatible with Postfix < 2.3.
> > > > !With Postfix 2.3 and later the Postfix SMTP server can disable > > ! session id generation when TLS session caching is turned off. This > > ! keeps clients from caching sessions that almost certainly cannot > > ! be re-used.
> > > > !By default, the Postfix SMTP server always generates TLS session > > ! ids. This works around a known defect in mail client applications > > ! such as MS Outlook, and may also prevent interoperability issues > > ! with other MTAs.
> > > > !Example:
> > > > !> > ! smtpd_tls_always_issue_session_ids = no > > !> > > > !
This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 15113,15126 **** > > > > !Opportunistic TLS: announce STARTTLS support to remote SMTP clients, > > ! but do not require that clients use TLS encryption.
> > > > !Note: when invoked via "sendmail -bs", Postfix will never offer > > ! STARTTLS due to insufficient privileges to access the server private > > ! key. This is intended behavior.
> > > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtpd_tls_security_level instead.
> > > > --- 11772,11786 ---- > > > > !Ask a remote SMTP client for a client certificate. This > > ! information is needed for certificate based mail relaying with, > > ! for example, the permit_tls_clientcerts feature.
> > > > !Some clients such as Netscape will either complain if no > > ! certificate is available (for the list of CAs in $smtpd_tls_CAfile) > > ! or will offer multiple client certificates to choose from. This > > ! may be annoying, so this option is "off" by default.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 15129,15148 **** > > > > !> > ! Safety net to keep mail queued that would otherwise be returned to > > ! the sender. This parameter disables locally-generated bounces, > > ! and prevents the Postfix SMTP server from rejecting mail permanently, > > ! by changing 5xx reply codes into 4xx. However, soft_bounce is no > > ! cure for address rewriting mistakes or mail routing mistakes. > > !
> > ! > > !> > ! Example: > > !
> > > > !> > ! soft_bounce = yes > > !> > > > --- 11789,11798 ---- > > > > !
When TLS encryption is optional in the Postfix SMTP server, do > > ! not announce or accept SASL authentication over unencrypted > > ! connections.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 15151,15164 **** > > > > !> > ! The time after which a stale exclusive mailbox lockfile is removed. > > ! This is used for delivery to file or mailbox. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > --- 11801,11820 ---- > > > > !The verification depth for remote SMTP client certificates. A > > ! depth of 1 is sufficient if the issuing CA is listed in a local CA > > ! file.
> > > > !The default verification depth is 9 (the OpenSSL default) for > > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5, > > ! the default value was 5, but the limit was not actually enforced. If > > ! you have set this to a lower non-default value, certificates with longer > > ! trust chains may now fail to verify. Certificate chains with 1 or 2 > > ! CAs are common, deeper chains are more rare and any number between 5 > > ! and 9 should suffice in practice. You can choose a lower number if, > > ! for example, you trust certificates directly signed by an issuing CA > > ! but not any CAs it delegates to.
> > ! > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 15167,15194 **** > > > > !This feature is documented in the STRESS_README document.
> > > > !This feature is available in Postfix 2.5 and later.
> > > > > > !> > ! Reject mail with 8-bit text in message headers. This blocks mail > > ! from poorly written applications. > > !
> > > > !> > ! This feature should not be enabled on a general purpose mail server, > > ! because it is likely to reject legitimate email. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > --- 11823,11877 ---- > > > > !File with the Postfix SMTP server RSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP server private RSA key.
> > > > !Public Internet MX hosts without certificates signed by a "reputable" > > ! CA must generate, and be prepared to present to most clients, a > > ! self-signed or private-CA signed certificate. The client will not be > > ! able to authenticate the server, but unless it is running Postfix 2.3 or > > ! similar software, it will still insist on a server certificate.
> > > > +For servers that are not public Internet MX hosts, Postfix > > + 2.3 supports configurations with no certificates. This entails the > > + use of just the anonymous TLS ciphers, which are not supported by > > + typical SMTP clients. Since such clients will not, as a rule, fall > > + back to plain text after a TLS handshake failure, the server will > > + be unable to receive email from TLS enabled clients. To avoid > > + accidental configurations with no certificates, Postfix 2.3 enables > > + certificate-less operation only when the administrator explicitly > > + sets "smtpd_tls_cert_file = none". This ensures that new Postfix > > + configurations will not accidentally run with no certificates.
> > > > !Both RSA and DSA certificates are supported. When both types > > ! are present, the cipher used determines which certificate will be > > ! presented to the client. For Netscape and OpenSSL clients without > > ! special cipher choices the RSA certificate is preferred.
> > > > !In order to verify a certificate, the CA certificate (in case > > ! of a certificate chain, all CA certificates) must be available. > > ! You should add these certificates to the server certificate, the > > ! server certificate first, then the issuing CA(s).
> > > > !Example: the certificate for "server.dom.ain" was issued by > > ! "intermediate CA" which itself has a certificate of "root CA". > > ! Create the server.pem file with "cat server_cert.pem intermediate_CA.pem > > ! root_CA.pem > server.pem".
> > > > !If you also want to verify client certificates issued by these > > ! CAs, you can add the CA certificates to the smtpd_tls_CAfile, in which > > ! case it is not necessary to have them in the smtpd_tls_cert_file or > > ! smtpd_tls_dcert_file.
> > > > !A certificate supplied here must be usable as an SSL server certificate > > ! and hence pass the "openssl verify -purpose sslserver ..." test.
> > ! > > !Example:
> > ! > > !> > ! smtpd_tls_cert_file = /etc/postfix/server.pem > > !> > ! > > !
This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 15197,15213 **** > > > > !> > ! Enable both strict_7bit_headers and strict_8bitmime_body. > > !
> > > > !> > ! This feature should not be enabled on a general purpose mail server, > > ! because it is likely to reject legitimate email. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > --- 11880,11898 ---- > > > > !Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS > > ! cipher list. It is easy to create inter-operability problems by choosing > > ! a non-default cipher list. Do not use a non-default TLS cipherlist for > > ! MX hosts on the public Internet. Clients that begin the TLS handshake, > > ! but are unable to agree on a common cipher, may not be able to send any > > ! email to the SMTP server. Using a restricted cipher list may be more > > ! appropriate for a dedicated MSA or an internal mailhub, where one can > > ! exert some control over the TLS software and settings of the connecting > > ! clients.
> > > > !Note: do not use "" quotes around the parameter value.
> > > > !This feature is available with Postfix version 2.2. It is not used with > > ! Postfix 2.3 and later; use smtpd_tls_mandatory_ciphers instead.
> > > > *************** > > *** 15216,15301 **** > > > > !> > ! Reject 8-bit message body text without 8-bit MIME content encoding > > ! information. This blocks mail from poorly written applications. > > !
> > > > !> > ! Unfortunately, this also rejects majordomo approval requests when > > ! the included request contains valid 8-bit MIME mail, and it rejects > > ! bounces from mailers that do not MIME encapsulate 8-bit content > > ! (for example, bounces from qmail or from old versions of Postfix). > > !
> > > > !> > ! This feature should not be enabled on a general purpose mail server, > > ! because it is likely to reject legitimate email. > >
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > !Defer delivery when a mailbox file is not owned by its recipient. > > ! The default setting is not backwards compatible.
> > > > !This feature is available in Postfix 2.5.3 and later.
> > > > > > !> > ! Reject mail with invalid Content-Transfer-Encoding: information > > ! for the message/* or multipart/* MIME content types. This blocks > > ! mail from poorly written software. > >
> > > > !> > ! This feature should not be enabled on a general purpose mail server, > > ! because it will reject mail after a single violation. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > -> > ! Require that addresses received in SMTP MAIL FROM and RCPT TO > > ! commands are enclosed with <>, and that those addresses do > > ! not contain RFC 822 style comments or phrases. This stops mail > > ! from poorly written software. > > !
> > > > !> > ! By default, the Postfix SMTP server accepts RFC 822 syntax in MAIL > > ! FROM and RCPT TO addresses. > > !
> > > > > > !> > ! Obsolete SUN mailtool compatibility feature. Instead, use > > ! "mailbox_delivery_lock = dotlock". > > !
> > > > --- 11901,11970 ---- > > > > !File with the Postfix SMTP server DSA certificate in PEM format. > > ! This file may also contain the Postfix SMTP server private DSA key.
> > > > !See the discussion under smtpd_tls_cert_file for more details. > >
> > > > !Example:
> > > > +> > + smtpd_tls_dcert_file = /etc/postfix/server-dsa.pem > > +> > > > !
This feature is available in Postfix 2.2 and later.
> > > > > > !File with DH parameters that the Postfix SMTP server should > > + use with EDH ciphers.
> > > > !Instead of using the exact same parameter sets as distributed > > ! with other TLS packages, it is more secure to generate your own > > ! set of parameters with something like the following command:
> > > > !> > !> > > > !> > ! openssl gendh -out /etc/postfix/dh_1024.pem -2 1024 > > !> > !
Your actual source for entropy may differ. Some systems have > > ! /dev/random; on other system you may consider using the "Entropy > > ! Gathering Daemon EGD", available at http://egd.sourceforge.net/ > >
> > > > !Example:
> > > > !> > ! smtpd_tls_dh1024_param_file = /etc/postfix/dh_1024.pem > > !> > > > +
This feature is available with Postfix version 2.2.
> > > > > > !File with DH parameters that the Postfix SMTP server should > > ! use with EDH ciphers.
> > > > +See also the discussion under the smtpd_tls_dh1024_param_file > > + configuration parameter.
> > > > !Example:
> > > > !> > ! smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem > > !> > > > !
This feature is available with Postfix version 2.2.
> > > > *************** > > *** 15304,15358 **** > > > > !> > ! Enable the rewriting of "site!user" into "user at site". This is > > ! necessary if your machine is connected to UUCP networks. It is > > ! enabled by default. > > !
> > > > !Note: with Postfix version 2.2, message header address rewriting > > ! happens only when one of the following conditions is true:
> > > > !To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > !> > ! Example: > > !
> > > >> > ! swap_bangpath = no > >> > > > > > !
> > ! The syslog facility of Postfix logging. Specify a facility as > > ! defined in syslog.conf(5). The default facility is "mail". > > !
> > ! > > !> > ! Warning: a non-default syslog_facility setting takes effect only > > ! after a Postfix process has completed initialization. Errors during > > ! process initialization will be logged with the default facility. > > ! Examples are errors while parsing the command line arguments, and > > ! errors while accessing the Postfix main.cf configuration file. > > !
> > > > --- 11973,12021 ---- > > > > !File with the Postfix SMTP server DSA private key in PEM format. > > ! This file may be combined with the Postfix SMTP server DSA certificate > > ! file specified with $smtpd_tls_dcert_file.
> > > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted, but file permissions should grant read/write > > ! access only to the system superuser account ("root").
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !List of ciphers or cipher types to exclude from the SMTP server > > ! cipher list at all TLS security levels. Excluding valid ciphers > > ! can create interoperability problems. DO NOT exclude ciphers unless it > > ! is essential to do so. This is not an OpenSSL cipherlist; it is a simple > > ! list separated by whitespace and/or commas. The elements are a single > > ! cipher, or one or more "+" separated cipher properties, in which case > > ! only ciphers matching all the properties are excluded.
> > > > !Examples (some of these will cause problems):
> > > > +> >> > > > +> > ! smtpd_tls_exclude_ciphers = aNULL > > ! smtpd_tls_exclude_ciphers = MD5, DES > > ! smtpd_tls_exclude_ciphers = DES+MD5 > > ! smtpd_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 > > ! smtpd_tls_exclude_ciphers = kEDH+aRSA > >> > +
The first setting disables anonymous ciphers. The next setting > > + disables ciphers that use the MD5 digest algorithm or the (single) DES > > + encryption algorithm. The next setting disables ciphers that use MD5 and > > + DES together. The next setting disables the two ciphers "AES256-SHA" > > + and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" > > + key exchange with RSA authentication.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 15361,15391 **** > > > > !> > ! The mail system name that is prepended to the process name in syslog > > ! records, so that "smtpd" becomes, for example, "postfix/smtpd". > >
> > > > !> > ! Warning: a non-default syslog_name setting takes effect only after > > ! a Postfix process has completed initialization. Errors during > > ! process initialization will be logged with the default name. Examples > > ! are errors while parsing the command line arguments, and errors > > ! while accessing the Postfix main.cf configuration file. > >
> > > > > > !An optional workaround for routers that break TCP window scaling. > > ! Specify a value > 0 and < 65536 to enable this feature. With > > ! Postfix TCP servers (smtpd(8), qmqpd(8)), this feature is implemented > > ! by the Postfix master(8) daemon.
> > ! > > !To change this parameter without stopping Postfix, you need to > > ! first terminate all Postfix TCP servers:
> > > > --- 12024,12046 ---- > > > > !The message digest algorithm used to construct client-certificate > > ! fingerprints for check_ccert_access and > > ! permit_tls_clientcerts. The default algorithm is md5, > > ! for backwards compatibility with Postfix releases prior to 2.5. > >
> > > > !The best practice algorithm is now sha1. Recent advances in hash > > ! function cryptanalysis have led to md5 being deprecated in favor of sha1. > > ! However, as long as there are no known "second pre-image" attacks > > ! against md5, its use in this context can still be considered safe. > >
> > > > +While additional digest algorithms are often available with OpenSSL's > > + libcrypto, only those used by libssl in SSL cipher suites are available to > > + Postfix. For now this means just md5 or sha1.
> > > > !To find the fingerprint of a specific certificate file, with a > > ! specific digest algorithm, run:
> > > > *************** > > *** 15393,15396 **** > >> > ! # postconf -e master_service_disable=inet > > ! # postfix reload > >> > --- 12048,12050 ---- > >
> > ! $ openssl x509 -noout -fingerprint -digest -in certfile.pem > >> > *************** > > *** 15398,15402 **** > > > > !
This immediately terminates all processes that accept network > > ! connections. Next, you enable Postfix TCP servers with the updated > > ! tcp_windowsize setting:
> > > > --- 12052,12055 ---- > > > > !The text to the right of "=" sign is the desired fingerprint. > > ! For example:
> > > > *************** > > *** 15404,15407 **** > >> > ! # postconf -e tcp_windowsize=65535 master_service_disable= > > ! # postfix reload > >> > --- 12057,12060 ---- > >
> > ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem > > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A > >> > *************** > > *** 15409,15432 **** > > > > !
If you skip these steps with a running Postfix system, then the > > ! tcp_windowsize change will work only for Postfix TCP clients (smtp(8), > > ! lmtp(8)).
> > ! > > !This feature is available in Postfix 2.6 and later.
> > ! > > ! > > !Append the system-supplied default certificate authority > > ! certificates to the ones specified with *_tls_CApath or *_tls_CAfile. > > ! The default is "no"; this prevents Postfix from trusting third-party > > ! certificates and giving them relay permission with > > ! permit_tls_all_clientcerts.
> > ! > > !This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8, > > ! 2.7.2 and later versions. Specify "tls_append_default_CA = yes" for > > ! backwards compatibility, to avoid breaking certificate verification > > ! with sites that don't use permit_tls_all_clientcerts.
> > > > --- 12062,12084 ---- > > > > !Example: client-certificate access table, with sha1 fingerprints:
> > > > !> > !> > > > !> > ! /etc/postfix/main.cf: > > ! smtpd_tls_fingerprint_digest = sha1 > > ! smtpd_client_restrictions = > > ! check_ccert_access hash:/etc/postfix/access, > > ! reject > > !> > !> > ! /etc/postfix/access: > > ! # Action folded to next line... > > ! AF:88:7C:AD:51:95:6F:36:96:F6:01:FB:2E:48:CD:AB:49:25:A2:3B > > ! OK > > ! 85:16:78:FD:73:6E:CE:70:E0:31:5F:0D:3C:C8:6D:C4:2C:24:59:E1 > > ! permit_auth_destination > > !> > !
This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 15435,15446 **** > > > > !The number of pseudo-random bytes that an smtp(8) or smtpd(8) > > ! process requests from the tlsmgr(8) server in order to seed its > > ! internal pseudo random number generator (PRNG). The default of 32 > > ! bytes (equivalent to 256 bits) is sufficient to generate a 128bit > > ! (or 168bit) session key.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 12087,12098 ---- > > > > !File with the Postfix SMTP server RSA private key in PEM format. > > ! This file may be combined with the Postfix SMTP server RSA certificate > > ! file specified with $smtpd_tls_cert_file.
> > > > !The private key must be accessible without a pass-phrase, i.e. it > > ! must not be encrypted, but file permissions should grant read/write > > ! access only to the system superuser account ("root").
> > > > *************** > > *** 15449,15557 **** > > > > !List or bit-mask of OpenSSL bug work-arounds to disable.
> > ! > > !The OpenSSL toolkit includes a set of work-arounds for buggy SSL/TLS > > ! implementations. Applications, such as Postfix, that want to maximize > > ! interoperability ask the OpenSSL library to enable the full set of > > ! recommended work-arounds.
> > ! > > !From time to time, it is discovered that a work-around creates a > > ! security issue, and should no longer be used. If upgrading OpenSSL > > ! to a fixed version is not an option or an upgrade is not available > > ! in a timely manner, or in closed environments where no buggy clients > > ! or servers exist, it may be appropriate to disable some or all of the > > ! OpenSSL interoperability work-arounds. This parameter specifies which > > ! bug work-arounds to disable.
> > ! > > !If the value of the parameter is a hexadecimal long integer starting > > ! with "0x", the bug work-arounds corresponding to the bits specified in > > ! its value are removed from the SSL_OP_ALL work-around bit-mask > > ! (see openssl/ssl.h and SSL_CTX_set_options(3)). You can specify more > > ! bits than are present in SSL_OP_ALL, excess bits are ignored. Specifying > > ! 0xFFFFFFFF disables all bug-workarounds on a 32-bit system. This should > > ! also be sufficient on 64-bit systems, until OpenSSL abandons support > > ! for 32-bit systems and starts using the high 32 bits of a 64-bit > > ! bug-workaround mask.
> > ! > > !Otherwise, the parameter is a white-space or comma separated list > > ! of specific named bug work-arounds chosen from the list below. It > > ! is possible that your OpenSSL version includes new bug work-arounds > > ! added after your Postfix source code was last updated, in that case > > ! you can only disable one of these via the hexadecimal syntax above.
> > ! > > !This feature is available in Postfix 2.8 and later.
> > > > > > !The elliptic curve used by the Postfix SMTP server for sensibly > > ! strong > > ! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP > > ! server when "smtpd_tls_eecdh_grade = strong". The phrase "sensibly > > ! strong" means approximately 128-bit security based on best known > > ! attacks. The selected curve must be implemented by OpenSSL (as > > ! reported by ecparam(1) with the "-list_curves" option) and be one > > ! of the curves listed in Section 5.1.1 of RFC 4492. You should not > > ! generally change this setting.
> > > > !This default curve is specified in NSA "Suite B" Cryptography > > ! (see http://www.nsa.gov/ia/industry/crypto_suite_b.cfm) for > > ! information classified as SECRET.
> > > > !Note: elliptic curve names are poorly standardized; different > > ! standards groups are assigning different names to the same underlying > > ! curves. The curve with the X9.62 name "prime256v1" is also known > > ! under the SECG name "secp256r1", but OpenSSL does not recognize the > > ! latter name.
> > > > !This feature is available in Postfix 2.6 and later, when it is > > ! compiled and linked with OpenSSL 1.0.0 or later.
> > > > --- 12101,12210 ---- > > > > !Enable additional Postfix SMTP server logging of TLS activity. > > ! Each logging level also includes the information that is logged at > > ! a lower logging level.
> > > > !Use "smtpd_tls_loglevel = 3" only in case of problems. Use of > > ! loglevel 4 is strongly discouraged.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !The minimum TLS cipher grade that the Postfix SMTP server will > > ! use with mandatory > > ! TLS encryption. Cipher types listed in smtpd_tls_mandatory_exclude_ciphers > > ! or smtpd_tls_exclude_ciphers are excluded from the base definition > > ! of the selected cipher grade. With opportunistic TLS encryption, > > ! the "export" grade is used unconditionally with exclusions specified > > ! only via smtpd_tls_exclude_ciphers.
> > > > !The following cipher grades are supported:
> > > > +This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 15560,15581 **** > > > > !The elliptic curve used by the Postfix SMTP server for maximally > > ! strong > > ! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP > > ! server when "smtpd_tls_eecdh_grade = ultra". The phrase "maximally > > ! strong" means approximately 192-bit security based on best known attacks. > > ! This additional strength comes at a significant computational cost, most > > ! users should instead set "smtpd_tls_eecdh_grade = strong". The selected > > ! curve must be implemented by OpenSSL (as reported by ecparam(1) with the > > ! "-list_curves" option) and be one of the curves listed in Section 5.1.1 > > ! of RFC 4492. You should not generally change this setting.
> > > > !This default "ultra" curve is specified in NSA "Suite B" Cryptography > > ! (see http://www.nsa.gov/ia/industry/crypto_suite_b.cfm) for information > > ! classified as TOP SECRET.
> > > > !This feature is available in Postfix 2.6 and later, when it is > > ! compiled and linked with OpenSSL 1.0.0 or later.
> > > > --- 12213,12223 ---- > > > > !Additional list of ciphers or cipher types to exclude from the > > ! SMTP server cipher list at mandatory TLS security levels. This list > > ! works in addition to the exclusions listed with smtpd_tls_exclude_ciphers > > ! (see there for syntax details).
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 15584,15615 **** > > > > !The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This > > ! defines the meaning of the "export" setting in smtpd_tls_mandatory_ciphers, > > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is > > ! the cipherlist for the opportunistic ("may") TLS client security > > ! level and is the default cipherlist for the SMTP server. You are > > ! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and > > ! later the cipherlist may start with an "aNULL:" prefix, which restores > > ! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the > > ! list when they are enabled. This prefix is not needed with previous > > ! OpenSSL releases.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > !The OpenSSL cipherlist for "HIGH" grade ciphers. This defines > > ! the meaning of the "high" setting in smtpd_tls_mandatory_ciphers, > > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are > > ! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and > > ! later the cipherlist may start with an "aNULL:" prefix, which restores > > ! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the > > ! list when they are enabled. This prefix is not needed with previous > > ! OpenSSL releases.
> > > > --- 12226,12256 ---- > > > > !The SSL/TLS protocols accepted by the Postfix SMTP server with > > ! mandatory TLS encryption. If the list is empty, the server supports all > > ! available SSL/TLS protocol versions. A non-empty value is a list > > ! of protocol > > ! names separated by whitespace, commas or colons. The supported protocol > > ! names are "SSLv2", "SSLv3" and "TLSv1", and are not case sensitive.
> > > > +With Postfix ≥ 2.5 the parameter syntax is expanded to support > > + protocol exclusions. One can now explicitly exclude SSLv2 by setting > > + "smtpd_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and > > + SSLv3 set "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing > > + the protocols to include, rather than protocols to exclude, is still > > + supported, use the form you find more intuitive.
> > > > !Since SSL version 2 has known protocol weaknesses and is now > > ! deprecated, the default setting excludes "SSLv2". This means that > > ! by default, SSL version 2 will not be used at the "encrypt" security > > ! level.
> > > > !Example:
> > > > !> > ! smtpd_tls_mandatory_protocols = TLSv1 > > ! # Alternative form with Postfix ≥ 2.5: > > ! smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 > > !> > > > *************** > > *** 15620,15634 **** > > > > !
The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines > > ! the meaning of the "low" setting in smtpd_tls_mandatory_ciphers, > > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are > > ! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and > > ! later the cipherlist may start with an "aNULL:" prefix, which restores > > ! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the > > ! list when they are enabled. This prefix is not needed with previous > > ! OpenSSL releases.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > --- 12261,12273 ---- > > > > !Request that the Postfix SMTP server produces Received: message > > ! headers that include information about the protocol and cipher used, > > ! as well as the client CommonName and client certificate issuer > > ! CommonName. This is disabled by default, as the information may > > ! be modified in transit through other mail servers. Only information > > ! that was recorded by the final destination can be trusted.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 15637,15707 **** > > > > !The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This > > ! defines the meaning of the "medium" setting in smtpd_tls_mandatory_ciphers, > > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is > > ! the default cipherlist for mandatory TLS encryption in the TLS > > ! client (with anonymous ciphers disabled when verifying server > > ! certificates). You are strongly encouraged to not change this > > ! setting. With OpenSSL 1.0.0 and later the cipherlist may start with an > > ! "aNULL:" prefix, which restores the 0.9.8-compatible ordering of the > > ! aNULL ciphers to the top of the list when they are enabled. This prefix > > ! is not needed with previous OpenSSL releases.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > -The OpenSSL cipherlist for "NULL" grade ciphers that provide > > ! authentication without encryption. This defines the meaning of the "null" > > ! setting in smtpd_mandatory_tls_ciphers, smtp_tls_mandatory_ciphers and > > ! lmtp_tls_mandatory_ciphers. You are strongly encouraged to not > > ! change this setting.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > > > !With SSLv3 and later, use the Postfix SMTP server's cipher > > ! preference order instead of the remote client's cipher preference > > ! order.
> > ! > > !By default, the OpenSSL server selects the client's most preferred > > ! cipher that the server supports. With SSLv3 and later, the server may > > ! choose its own most preferred cipher that is supported (offered) by > > ! the client. Setting "tls_preempt_cipherlist = yes" enables server cipher > > ! preferences.
> > ! > > !While server cipher selection may in some cases lead to a more secure > > ! or performant cipher choice, there is some risk of interoperability > > ! issues. In the past, some SSL clients have listed lower priority ciphers > > ! that they did not implement correctly. If the server chooses a cipher > > ! that the client prefers less, it may select a cipher whose client > > ! implementation is flawed.
> > > > !This feature is available in Postfix 2.8 and later, in combination > > ! with OpenSSL 0.9.7 and later.
> > > > > > !The number of bytes that tlsmgr(8) reads from $tls_random_source > > ! when (re)seeding the in-memory pseudo random number generator (PRNG) > > ! pool. The default of 32 bytes (256 bits) is good enough for 128bit > > ! symmetric keys. If using EGD or a device file, a maximum of 255 > > ! bytes is read.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > --- 12276,12333 ---- > > > > !With mandatory TLS encryption, require a trusted remote SMTP client > > ! certificate in order to allow TLS connections to proceed. This > > ! option implies "smtpd_tls_ask_ccert = yes".
> > > > !When TLS encryption is optional, this setting is ignored with > > ! a warning written to the mail log.
> > > > +This feature is available in Postfix 2.2 and later.
> > > > > > !The SMTP TLS security level for the Postfix SMTP server; when > > ! a non-empty value is specified, this overrides the obsolete parameters > > ! smtpd_use_tls and smtpd_enforce_tls. This parameter is ignored with > > ! "smtpd_tls_wrappermode = yes".
> > > > +Specify one of the following security levels:
> > > > !Note 1: the "fingerprint", "verify" and "secure" levels are not > > ! supported here. > > ! The Postfix SMTP server logs a warning and uses "encrypt" instead. > > ! To verify SMTP client certificates, see TLS_README for a discussion > > ! of the smtpd_tls_ask_ccert, smtpd_tls_req_ccert, and permit_tls_clientcerts > > ! features.
> > > > !Note 2: The parameter setting "smtpd_tls_security_level = > > ! encrypt" implies "smtpd_tls_auth_only = yes".
> > > > !Note 3: when invoked via "sendmail -bs", Postfix will never > > ! offer STARTTLS due to insufficient privileges to access the server > > ! private key. This is intended behavior.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 15710,15736 **** > > > > !Name of the pseudo random number generator (PRNG) state file > > ! that is maintained by tlsmgr(8). The file is created when it does > > ! not exist, and its length is fixed at 1024 bytes.
> > ! > > !As of version 2.5, Postfix no longer uses root privileges when > > ! opening this file, and the default file location was changed from > > ! ${config_directory}/prng_exch to ${data_directory}/prng_exch. As > > ! a migration aid, an attempt to open the file under a non-Postfix > > ! directory is redirected to the Postfix-owned data_directory, and a > > ! warning is logged.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > > > !The time between attempts by tlsmgr(8) to save the state of > > ! the pseudo random number generator (PRNG) to the file specified > > ! with $tls_random_exchange_name.
> > > > --- 12336,12367 ---- > > > > !Name of the file containing the optional Postfix SMTP server > > ! TLS session cache. Specify a database type that supports enumeration, > > ! such as btree or sdbm; there is no need to support > > ! concurrent access. The file is created if it does not exist. The smtpd(8) > > ! daemon does not use this parameter directly, rather the cache is > > ! implemented indirectly in the tlsmgr(8) daemon. This means that > > ! per-smtpd-instance master.cf overrides of this parameter are not > > ! effective. Note, that each of the cache databases supported by tlsmgr(8) > > ! daemon: $smtpd_tls_session_cache_database, $smtp_tls_session_cache_database > > ! (and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to be > > ! stored separately. It is not at this time possible to store multiple > > ! caches in a single database.
> > > > +Note: dbm databases are not suitable. TLS > > + session objects are too large.
> > > > !As of version 2.5, Postfix no longer uses root privileges when > > ! opening this file. The file should now be stored under the Postfix-owned > > ! data_directory. As a migration aid, an attempt to open the file > > ! under a non-Postfix directory is redirected to the Postfix-owned > > ! data_directory, and a warning is logged.
> > > > !Example:
> > > > !> > ! smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache > > !> > > > *************** > > *** 15741,15749 **** > > > > !
The maximal time between attempts by tlsmgr(8) to re-seed the > > ! in-memory pseudo random number generator (PRNG) pool from external > > ! sources. The actual time between re-seeding attempts is calculated > > ! using the PRNG, and is between 0 and the time specified.
> > > > --- 12372,12382 ---- > > > > !The expiration time of Postfix SMTP server TLS session cache > > ! information. A cache cleanup is performed periodically > > ! every $smtpd_tls_session_cache_timeout seconds. As with > > ! $smtpd_tls_session_cache_database, this parameter is implemented in the > > ! tlsmgr(8) daemon and therefore per-smtpd-instance master.cf overrides > > ! are not possible.
> > > > *************** > > *** 15754,15767 **** > > > > !The external entropy source for the in-memory tlsmgr(8) pseudo > > ! random number generator (PRNG) pool. Be sure to specify a non-blocking > > ! source. If this source is not a regular file, the entropy source > > ! type must be prepended: egd:/path/to/egd_socket for a source with > > ! EGD compatible socket interface, or dev:/path/to/device for a > > ! device file.
> > > > !Note: on OpenBSD systems specify /dev/arandom when /dev/urandom > > ! gives timeout errors.
> > > > --- 12387,12398 ---- > > > > !Run the Postfix SMTP server in the non-standard "wrapper" mode, > > ! instead of using the STARTTLS command.
> > > > !If you want to support this service, enable a special port in > > ! master.cf, and specify "-o smtpd_tls_wrappermode=yes" on the SMTP > > ! server's command line. Port 465 (smtps) was once chosen for this > > ! purpose.
> > > > *************** > > *** 15772,15781 **** > > > > !Mandatory TLS: announce STARTTLS support to remote SMTP clients, and > > ! require that clients use TLS encryption. See smtpd_enforce_tls for > > ! further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12403,12416 ---- > > > > !Opportunistic TLS: announce STARTTLS support to SMTP clients, > > ! but do not require that clients use TLS encryption.
> > > > !Note: when invoked via "sendmail -bs", Postfix will never offer > > ! STARTTLS due to insufficient privileges to access the server private > > ! key. This is intended behavior.
> > > > !This feature is available in Postfix 2.2 and later. With > > ! Postfix 2.3 and later use smtpd_tls_security_level instead.
> > > > *************** > > *** 15784,15792 **** > > > > !The name of the tlsproxy(8) service entry in master.cf. This > > ! service performs plaintext <=> TLS ciphertext conversion.
> > > > !
This feature is available in Postfix 2.8 and later.
> > > > --- 12419,12438 ---- > > > > !> > ! Safety net to keep mail queued that would otherwise be returned to > > ! the sender. This parameter disables locally-generated bounces, > > ! and prevents the Postfix SMTP server from rejecting mail permanently, > > ! by changing 5xx reply codes into 4xx. However, soft_bounce is no > > ! cure for address rewriting mistakes or mail routing mistakes. > > !
> > > > !> > ! Example: > > !
> > > > !> > ! soft_bounce = yes > > !> > > > *************** > > *** 15795,15804 **** > > > > !
A file containing (PEM format) CA certificates of root CAs > > ! trusted to sign either remote SMTP client certificates or intermediate > > ! CA certificates. See smtpd_tls_CAfile for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12441,12454 ---- > > > > !> > ! The time after which a stale exclusive mailbox lockfile is removed. > > ! This is used for delivery to file or mailbox. > > !
> > > > !> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). > > ! The default time unit is s (seconds). > > !
> > > > *************** > > *** 15807,15816 **** > > > > !A directory containing (PEM format) CA certificates of root CAs > > ! trusted to sign either remote SMTP client certificates or intermediate > > ! CA certificates. See smtpd_tls_CApath for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12457,12464 ---- > > > > !This feature is documented in the STRESS_README document.
> > > > !This feature is available in Postfix 2.5 and later.
> > > > *************** > > *** 15819,15863 **** > > > > !Force the Postfix tlsproxy(8) server to issue a TLS session id, > > ! even when TLS session caching is turned off. See > > ! smtpd_tls_always_issue_session_ids for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > > > !Ask a remote SMTP client for a client certificate. See > > ! smtpd_tls_ask_ccert for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > > > !The verification depth for remote SMTP client certificates. A > > - depth of 1 is sufficient if the issuing CA is listed in a local CA > > - file. See smtpd_tls_ccert_verifydepth for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > > > !File with the Postfix tlsproxy(8) server RSA certificate in PEM > > ! format. This file may also contain the Postfix tlsproxy(8) server > > ! private RSA key. See smtpd_tls_cert_file for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12467,12530 ---- > > > > !> > ! Reject mail with 8-bit text in message headers. This blocks mail > > ! from poorly written applications. > > !
> > > > +> > + This feature should not be enabled on a general purpose mail server, > > + because it is likely to reject legitimate email. > > +
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > !> > + Enable both strict_7bit_headers and strict_8bitmime_body. > > +
> > > > !> > ! This feature should not be enabled on a general purpose mail server, > > ! because it is likely to reject legitimate email. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > > > !> > ! Reject 8-bit message body text without 8-bit MIME content encoding > > ! information. This blocks mail from poorly written applications. > > !
> > > > !> > ! Unfortunately, this also rejects majordomo approval requests when > > ! the included request contains valid 8-bit MIME mail, and it rejects > > ! bounces from mailers that do not MIME encapsulate 8-bit content > > ! (for example, bounces from qmail or from old versions of Postfix). > > !
> > > > !> > ! This feature should not be enabled on a general purpose mail server, > > ! because it is likely to reject legitimate email. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > *************** > > *** 15866,15875 **** > > > > !The minimum TLS cipher grade that the Postfix tlsproxy(8) server > > ! will use with opportunistic TLS encryption. See smtpd_tls_ciphers > > ! for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12533,12541 ---- > > > > !Defer delivery when a mailbox file is not owned by its recipient. > > ! The default setting is not backwards compatible.
> > > > !This feature is available in Postfix 2.5.3 and later.
> > > > *************** > > *** 15878,15900 **** > > > > !File with the Postfix tlsproxy(8) server DSA certificate in PEM > > ! format. This file may also contain the Postfix tlsproxy(8) server > > ! private DSA key. See smtpd_tls_dcert_file for further details. > >
> > > > !This feature is available in Postfix 2.8 and later.
> > ! > > ! > > !File with DH parameters that the Postfix tlsproxy(8) server > > ! should use with EDH ciphers. See smtpd_tls_dh1024_param_file for > > ! further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12544,12562 ---- > > > > !> > ! Reject mail with invalid Content-Transfer-Encoding: information > > ! for the message/* or multipart/* MIME content types. This blocks > > ! mail from poorly written software. > >
> > > > !> > ! This feature should not be enabled on a general purpose mail server, > > ! because it will reject mail after a single violation. > > !
> > > > !> > ! This feature is available in Postfix 2.0 and later. > > !
> > > > *************** > > *** 15903,15912 **** > > > > !File with DH parameters that the Postfix tlsproxy(8) server > > ! should use with EDH ciphers. See smtpd_tls_dh512_param_file for > > ! further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12565,12580 ---- > > > > !> > ! Require that addresses received in SMTP MAIL FROM and RCPT TO > > ! commands are enclosed with <>, and that those addresses do > > ! not contain RFC 822 style comments or phrases. This stops mail > > ! from poorly written software. > > !
> > > > !> > ! By default, the Postfix SMTP server accepts RFC 822 syntax in MAIL > > ! FROM and RCPT TO addresses. > > !
> > > > *************** > > *** 15915,15925 **** > > > > !File with the Postfix tlsproxy(8) server DSA private key in PEM > > ! format. This file may be combined with the Postfix tlsproxy(8) > > ! server DSA certificate file specified with $smtpd_tls_dcert_file. > > ! See smtpd_tls_dkey_file for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12583,12591 ---- > > > > !> > ! Obsolete SUN mailtool compatibility feature. Instead, use > > ! "mailbox_delivery_lock = dotlock". > > !
> > > > *************** > > *** 15928,15963 **** > > > > !File with the Postfix tlsproxy(8) server ECDSA certificate in > > ! PEM format. This file may also contain the Postfix tlsproxy(8) > > ! server private ECDSA key. See smtpd_tls_eccert_file for further > > ! details.
> > ! > > !This feature is available in Postfix 2.8 and later.
> > > > > > !File with the Postfix tlsproxy(8) server ECDSA private key in > > ! PEM format. This file may be combined with the Postfix tlsproxy(8) > > ! server ECDSA certificate file specified with $smtpd_tls_eccert_file. > > ! See smtpd_tls_eckey_file for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > > > !The Postfix tlsproxy(8) server security grade for ephemeral > > ! elliptic-curve Diffie-Hellman (EECDH) key exchange. See > > ! smtpd_tls_eecdh_grade for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12594,12629 ---- > > > > !> > + Enable the rewriting of "site!user" into "user at site". This is > > + necessary if your machine is connected to UUCP networks. It is > > + enabled by default. > > +
> > > > !Note: with Postfix version 2.2, message header address rewriting > > ! happens only when one of the following conditions is true:
> > > > !To get the behavior before Postfix version 2.2, specify > > ! "local_header_rewrite_clients = static:all".
> > > > !> > ! Example: > > !
> > > > !> > ! swap_bangpath = no > > !> > > > *************** > > *** 15966,15975 **** > > > > !
List of ciphers or cipher types to exclude from the tlsproxy(8) > > ! server cipher list at all TLS security levels. See > > ! smtpd_tls_exclude_ciphers for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12632,12648 ---- > > > > !> > ! The syslog facility of Postfix logging. Specify a facility as > > ! defined in syslog.conf(5). The default facility is "mail". > > !
> > > > !> > ! Warning: a non-default syslog_facility setting takes effect only > > ! after a Postfix process has completed initialization. Errors during > > ! process initialization will be logged with the default facility. > > ! Examples are errors while parsing the command line arguments, and > > ! errors while accessing the Postfix main.cf configuration file. > > !
> > > > *************** > > *** 15978,15988 **** > > > > !The message digest algorithm to construct remote SMTP > > ! client-certificate > > ! fingerprints. See smtpd_tls_fingerprint_digest for further details. > >
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12651,12667 ---- > > > > !> > ! The mail system name that is prepended to the process name in syslog > > ! records, so that "smtpd" becomes, for example, "postfix/smtpd". > >
> > > > !> > ! Warning: a non-default syslog_name setting takes effect only after > > ! a Postfix process has completed initialization. Errors during > > ! process initialization will be logged with the default name. Examples > > ! are errors while parsing the command line arguments, and errors > > ! while accessing the Postfix main.cf configuration file. > > !
> > > > *************** > > *** 15991,16001 **** > > > > !File with the Postfix tlsproxy(8) server RSA private key in PEM > > ! format. This file may be combined with the Postfix tlsproxy(8) > > ! server RSA certificate file specified with $smtpd_tls_cert_file. > > ! See smtpd_tls_key_file for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12670,12681 ---- > > > > !The number of pseudo-random bytes that an smtp(8) or smtpd(8) > > ! process requests from the tlsmgr(8) server in order to seed its > > ! internal pseudo random number generator (PRNG). The default of 32 > > ! bytes (equivalent to 256 bits) is sufficient to generate a 128bit > > ! (or 168bit) session key.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 16004,16014 **** > > > > !Enable additional Postfix tlsproxy(8) server logging of TLS > > ! activity. Each logging level also includes the information that > > ! is logged at a lower logging level. See smtpd_tls_loglevel for > > ! further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12684,12696 ---- > > > > !The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This > > ! defines the meaning of the "export" setting in smtpd_tls_mandatory_ciphers, > > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is > > ! the cipherlist for the opportunistic ("may") TLS client security > > ! level and is the default cipherlist for the SMTP server. You are > > ! strongly encouraged to not change this setting.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 16017,16026 **** > > > > !The minimum TLS cipher grade that the Postfix tlsproxy(8) server > > ! will use with mandatory TLS encryption. See smtpd_tls_mandatory_ciphers > > ! for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12699,12709 ---- > > > > !The OpenSSL cipherlist for "HIGH" grade ciphers. This defines > > ! the meaning of the "high" setting in smtpd_tls_mandatory_ciphers, > > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are > > ! strongly encouraged to not change this setting.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 16029,16038 **** > > > > !Additional list of ciphers or cipher types to exclude from the > > ! tlsproxy(8) server cipher list at mandatory TLS security levels. > > ! See smtpd_tls_mandatory_exclude_ciphers for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12712,12722 ---- > > > > !The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines > > ! the meaning of the "low" setting in smtpd_tls_mandatory_ciphers, > > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are > > ! strongly encouraged to not change this setting.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 16041,16051 **** > > > > !The SSL/TLS protocols accepted by the Postfix tlsproxy(8) server > > ! with mandatory TLS encryption. If the list is empty, the server > > ! supports all available SSL/TLS protocol versions. See > > ! smtpd_tls_mandatory_protocols for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12725,12738 ---- > > > > !The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This > > ! defines the meaning of the "medium" setting in smtpd_tls_mandatory_ciphers, > > ! smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is > > ! the default cipherlist for mandatory TLS encryption in the TLS > > ! client (with anonymous ciphers disabled when verifying server > > ! certificates). You are strongly encouraged to not change this > > ! setting.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 16054,16063 **** > > > > !List of TLS protocols that the Postfix tlsproxy(8) server will > > ! exclude or include with opportunistic TLS encryption. See > > ! smtpd_tls_protocols for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12741,12752 ---- > > > > !The OpenSSL cipherlist for "NULL" grade ciphers that provide > > ! authentication without encryption. This defines the meaning of the "null" > > ! setting in smtpd_mandatory_tls_ciphers, smtp_tls_mandatory_ciphers and > > ! lmtp_tls_mandatory_ciphers. You are strongly encouraged to not > > ! change this setting.
> > > > !This feature is available in Postfix 2.3 and later.
> > > > *************** > > *** 16066,16075 **** > > > > !With mandatory TLS encryption, require a trusted remote SMTP > > ! client certificate in order to allow TLS connections to proceed. > > ! See smtpd_tls_req_ccert for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12755,12766 ---- > > > > !The number of bytes that tlsmgr(8) reads from $tls_random_source > > ! when (re)seeding the in-memory pseudo random number generator (PRNG) > > ! pool. The default of 32 bytes (256 bits) is good enough for 128bit > > ! symmetric keys. If using EGD or a device file, a maximum of 255 > > ! bytes is read.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 16078,16088 **** > > > > !The SMTP TLS security level for the Postfix tlsproxy(8) server; > > ! when a non-empty value is specified, this overrides the obsolete > > ! parameters smtpd_use_tls and smtpd_enforce_tls. See > > ! smtpd_tls_security_level for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12769,12785 ---- > > > > !Name of the pseudo random number generator (PRNG) state file > > ! that is maintained by tlsmgr(8). The file is created when it does > > ! not exist, and its length is fixed at 1024 bytes.
> > > > !As of version 2.5, Postfix no longer uses root privileges when > > ! opening this file, and the default file location was changed from > > ! ${config_directory}/prng_exch to ${data_directory}/prng_exch. As > > ! a migration aid, an attempt to open the file under a non-Postfix > > ! directory is redirected to the Postfix-owned data_directory, and a > > ! warning is logged.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 16091,16101 **** > > > > !The expiration time of Postfix tlsproxy(8) server TLS session > > ! cache information. A cache cleanup is performed periodically every > > ! $smtpd_tls_session_cache_timeout seconds. See > > ! smtpd_tls_session_cache_timeout for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12788,12797 ---- > > > > !The time between attempts by tlsmgr(8) to save the state of > > ! the pseudo random number generator (PRNG) to the file specified > > ! with $tls_random_exchange_name.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 16104,16113 **** > > > > !Opportunistic TLS: announce STARTTLS support to remote SMTP clients, > > ! but do not require that clients use TLS encryption. See smtpd_use_tls > > ! for further details.
> > > > !This feature is available in Postfix 2.8 and later.
> > > > --- 12800,12810 ---- > > > > !The maximal time between attempts by tlsmgr(8) to re-seed the > > ! in-memory pseudo random number generator (PRNG) pool from external > > ! sources. The actual time between re-seeding attempts is calculated > > ! using the PRNG, and is between 0 and the time specified.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 16116,16132 **** > > > > !How much time a tlsproxy(8) process may take to process local > > ! or remote I/O before it is terminated by a built-in watchdog timer. > > ! This is a safety mechanism that prevents tlsproxy(8) from becoming > > ! non-responsive due to a bug in Postfix itself or in system software. > > ! To avoid false alarms and unnecessary cache corruption this limit > > ! cannot be set under 10s.
> > > > !Specify a non-zero time value (an integral value plus an optional > > ! one-letter suffix that specifies the time unit). Time units: s > > ! (seconds), m (minutes), h (hours), d (days), w (weeks).
> > > > !This feature is available in Postfix 2.8.
> > > > --- 12813,12828 ---- > > > > !The external entropy source for the in-memory tlsmgr(8) pseudo > > ! random number generator (PRNG) pool. Be sure to specify a non-blocking > > ! source. If this source is not a regular file, the entropy source > > ! type must be prepended: egd:/path/to/egd_socket for a source with > > ! EGD compatible socket interface, or dev:/path/to/device for a > > ! device file.
> > > > !Note: on OpenBSD systems specify /dev/arandom when /dev/urandom > > ! gives timeout errors.
> > > > !This feature is available in Postfix 2.2 and later.
> > > > *************** > > *** 16159,16166 **** > > > > -Note: transport_delivery_slot_cost parameters will not > > - show up in "postconf" command output before Postfix version 2.9. > > - This limitation applies to many parameters whose name is a combination > > - of a master.cf service name and a built-in suffix (in this case: > > - "_delivery_slot_cost").
> > - > > > > --- 12855,12856 ---- > > *************** > > *** 16175,16182 **** > > > > -Note: transport_delivery_slot_discount parameters will > > - not show up in "postconf" command output before Postfix version > > - 2.9. This limitation applies to many parameters whose name is a > > - combination of a master.cf service name and a built-in suffix (in > > - this case: "_delivery_slot_discount").
> > - > > > > --- 12865,12866 ---- > > *************** > > *** 16191,16198 **** > > > > -Note: transport_delivery_slot_loan parameters will not > > - show up in "postconf" command output before Postfix version 2.9. > > - This limitation applies to many parameters whose name is a combination > > - of a master.cf service name and a built-in suffix (in this case: > > - "_delivery_slot_loan").
> > - > > > > --- 12875,12876 ---- > > *************** > > *** 16208,16216 **** > > > > -Note: some transport_destination_concurrency_failed_cohort_limit > > - parameters will not show up in "postconf" command output before > > - Postfix version 2.9. This limitation applies to many parameters > > - whose name is a combination of a master.cf service name and a > > - built-in suffix (in this case: > > - "_destination_concurrency_failed_cohort_limit").
> > - > >This feature is available in Postfix 2.5 and later.
> > --- 12886,12887 ---- > > *************** > > *** 16228,16236 **** > > > > -Note: some transport_destination_concurrency_limit > > - parameters will not show up in "postconf" command output before > > - Postfix version 2.9. This limitation applies to many parameters > > - whose name is a combination of a master.cf service name and a > > - built-in suffix (in this case: "_destination_concurrency_limit"). > > -
> > - > > > > --- 12899,12900 ---- > > *************** > > *** 16246,16254 **** > > > > -Note: some transport_destination_concurrency_negative_feedback > > - parameters will not show up in "postconf" command output before > > - Postfix version 2.9. This limitation applies to many parameters > > - whose name is a combination of a master.cf service name and a > > - built-in suffix (in this case: > > - "_destination_concurrency_negative_feedback").
> > - > >This feature is available in Postfix 2.5 and later.
> > --- 12910,12911 ---- > > *************** > > *** 16266,16274 **** > > > > -Note: some transport_destination_concurrency_positive_feedback > > - parameters will not show up in "postconf" command output before > > - Postfix version 2.9. This limitation applies to many parameters > > - whose name is a combination of a master.cf service name and a > > - built-in suffix (in this case: > > - "_destination_concurrency_positive_feedback").
> > - > >This feature is available in Postfix 2.5 and later.
> > --- 12923,12924 ---- > > *************** > > *** 16285,16292 **** > > > > -Note: some transport_destination_rate_delay parameters > > - will not show up in "postconf" command output before Postfix version > > - 2.9. This limitation applies to many parameters whose name is a > > - combination of a master.cf service name and a built-in suffix (in > > - this case: "_destination_rate_delay").
> > - > >This feature is available in Postfix 2.5 and later.
> > --- 12935,12936 ---- > > *************** > > *** 16304,16311 **** > > > > -Note: some transport_destination_recipient_limit parameters > > - will not show up in "postconf" command output before Postfix version > > - 2.9. This limitation applies to many parameters whose name is a > > - combination of a master.cf service name and a built-in suffix (in > > - this case: "_destination_recipient_limit").
> > - > > > > --- 12948,12949 ---- > > *************** > > *** 16320,16327 **** > > > > -Note: transport_extra_recipient_limit parameters will > > - not show up in "postconf" command output before Postfix version > > - 2.9. This limitation applies to many parameters whose name is a > > - combination of a master.cf service name and a built-in suffix (in > > - this case: "_extra_recipient_limit").
> > - > > > > --- 12958,12959 ---- > > *************** > > *** 16336,16344 **** > > > > -Note: some transport_initial_destination_concurrency > > - parameters will not show up in "postconf" command output before > > - Postfix version 2.9. This limitation applies to many parameters > > - whose name is a combination of a master.cf service name and a > > - built-in suffix (in this case: "_initial_destination_concurrency"). > > -
> > - > >This feature is available in Postfix 2.5 and later.
> > --- 12968,12969 ---- > > *************** > > *** 16384,16391 **** > > > > -Note: transport_minimum_delivery_slots parameters will > > - not show up in "postconf" command output before Postfix version > > - 2.9. This limitation applies to many parameters whose name is a > > - combination of a master.cf service name and a built-in suffix (in > > - this case: "_minimum_delivery_slots").
> > - > > > > --- 13009,13010 ---- > > *************** > > *** 16400,16407 **** > > > > -Note: some transport_recipient_limit parameters will not > > - show up in "postconf" command output before Postfix version 2.9. > > - This limitation applies to many parameters whose name is a combination > > - of a master.cf service name and a built-in suffix (in this case: > > - "_recipient_limit").
> > - > > > > --- 13019,13020 ---- > > *************** > > *** 16416,16423 **** > > > > -Note: transport_recipient_refill_delay parameters will > > - not show up in "postconf" command output before Postfix version > > - 2.9. This limitation applies to many parameters whose name is a > > - combination of a master.cf service name and a built-in suffix (in > > - this case: "_recipient_refill_delay").
> > - > >This feature is available in Postfix 2.4 and later.
> > --- 13029,13030 ---- > > *************** > > *** 16434,16441 **** > > > > -Note: transport_recipient_refill_limit parameters will > > - not show up in "postconf" command output before Postfix version > > - 2.9. This limitation applies to many parameters whose name is a > > - combination of a master.cf service name and a built-in suffix (in > > - this case: "_recipient_refill_limit").
> > - > >This feature is available in Postfix 2.4 and later.
> > --- 13041,13042 ---- > > *************** > > *** 16468,16475 **** > > > > -Note: transport_time_limit parameters will not show up > > - in "postconf" command output before Postfix version 2.9. This > > - limitation applies to many parameters whose name is a combination > > - of a master.cf service name and a built-in suffix (in this case: > > - "_time_limit").
> > - > > > > --- 13069,13070 ---- > > *************** > > *** 16496,16498 **** > >Example:
> > ! > > !> > ! # Default value before Postfix 2.8. > > ! # Note: the ":" and ";" are both required. > > ! undisclosed_recipients_header = To: undisclosed-recipients:; > > !> > > > --- 13095,13098 ---- > > Message header that the Postfix cleanup(8) server inserts when a > > ! message contains no To: or Cc: message header. With Postfix 2.4 > > ! and later, specify an empty value to disable this feature. > > > > *************** > > *** 16532,16549 **** > > > > -
The Postfix SMTP server's action when reject_unknown_sender_domain > > - or reject_unknown_recipient_domain fail due to a temporary error > > - condition. Specify "defer" to defer the remote SMTP client request > > - immediately. With the default "defer_if_permit" action, the Postfix > > - SMTP server continues to look for opportunities to reject mail, and > > - defers the client request only if it would otherwise be accepted. > > -
> > - > > -This feature is available in Postfix 2.6 and later.
> > - > > - > > -The Postfix SMTP server's action when reject_unknown_helo_hostname > > - fails due to an temporary error condition. Specify "defer" to defer > > - the remote SMTP client request immediately. With the default > > - "defer_if_permit" action, the Postfix SMTP server continues to look > > - for opportunities to reject mail, and defers the client request > > - only if it would otherwise be accepted.
> > - > > -This feature is available in Postfix 2.6 and later.
> > - > > - > > -> > ! The Postfix SMTP server reply code when a recipient address matches > > $virtual_alias_domains, and $virtual_alias_maps specifies a list > > --- 13203,13205 ---- > >
> > ! The SMTP server reply code when a recipient address matches > > $virtual_alias_domains, and $virtual_alias_maps specifies a list > > *************** > > *** 16664,16666 **** > >
> > ! The Postfix SMTP server reply code when a recipient address matches > > $virtual_mailbox_domains, and $virtual_mailbox_maps specifies a list > > --- 13219,13221 ---- > >
> > ! The SMTP server reply code when a recipient address matches > > $virtual_mailbox_domains, and $virtual_mailbox_maps specifies a list > > *************** > > *** 16727,16753 **** > > > > !
The Postfix SMTP server's reply when rejecting mail with > > ! reject_unverified_recipient. Do not include the numeric SMTP reply > > ! code or the enhanced status code. By default, the response includes > > ! actual address verification details. > > ! > > !
Example:
> > ! > > !> > ! unverified_recipient_reject_reason = Recipient address lookup failed > > !> > ! > > !
This feature is available in Postfix 2.6 and later.
> > ! > > ! > > !The Postfix SMTP server's action when reject_unverified_recipient > > ! fails due to a temporary error condition. Specify "defer" to defer > > ! the remote SMTP client request immediately. With the default > > ! "defer_if_permit" action, the Postfix SMTP server continues to look > > ! for opportunities to reject mail, and defers the client request > > ! only if it would otherwise be accepted.
> > > > --- 13282,13286 ---- > > > > !When rejecting mail with reject_unverified_recipient, reply > > ! with this text as the reason, instead of actual address verification > > ! details. > > > > *************** > > *** 16809,16835 **** > > > > !
The Postfix SMTP server's reply when rejecting mail with > > ! reject_unverified_sender. Do not include the numeric SMTP reply > > ! code or the enhanced status code. By default, the response includes > > ! actual address verification details. > > ! > > !
Example:
> > ! > > !> > ! unverified_sender_reject_reason = Sender address lookup failed > > !> > ! > > !
This feature is available in Postfix 2.6 and later.
> > ! > > ! > > !The Postfix SMTP server's action when reject_unverified_sender > > ! fails due to a temporary error condition. Specify "defer" to defer > > ! the remote SMTP client request immediately. With the default > > ! "defer_if_permit" action, the Postfix SMTP server continues to look > > ! for opportunities to reject mail, and defers the client request > > ! only if it would otherwise be accepted.
> > > > --- 13342,13346 ---- > > > > !When rejecting mail with reject_unverified_sender, reply with > > ! this text as the reason, instead of actual address verification > > ! details. > > > > *************** > > *** 17079,17082 **** > >
> > ! The maximal size in bytes of an individual virtual(8) mailbox or > > ! maildir file, or zero (no limit).
> > > > --- 13590,13594 ---- > >> > ! The maximal size in bytes of an individual mailbox or maildir file, > > ! or zero (no limit). > > !
> > > > *************** > > *** 17196,17199 **** > > is the name of a mail delivery transport defined in master.cf. > > ! The :nexthop destination is optional; its syntax is documented > > ! in the manual page of the corresponding delivery agent. > > > > --- 13708,13711 ---- > > is the name of a mail delivery transport defined in master.cf. > > ! The :nexthop part is optional. For more details see the > > ! transport(5) manual page. > > > > > > _______________________________________________ > > postconf-devel mailing list > > postconf-devel at de.postfix.org > > http://de.postfix.org/cgi-bin/mailman/listinfo/postconf-devel > > > -- > Werner Detter > IT-Consulting, IT-Services > > Lilienstra?e 4 Mobil: +49 151 19640507 > 81669 M?nchen Web: http://www.werner-detter.de > > Bashian Roulette? > [ $(($RANDOM%10)) -eq 0 ] && rm -rf / > > _______________________________________________ > postconf-devel mailing list > postconf-devel at de.postfix.org > http://de.postfix.org/cgi-bin/mailman/listinfo/postconf-devel -- state of mind () http://www.state-of-mind.de Franziskanerstra?e 15 Telefon +49 89 3090 4664 81669 M?nchen Telefax +49 89 3090 4666 Amtsgericht M?nchen Partnerschaftsregister PR 563 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 316 bytes Desc: Digital signature URL: