-- generated message --

postconf.5.html has been updated:

*** /tmp/postconf.5.html.orig	2011-09-04 20:09:00.000000000 +0200
--- /tmp/postconf.5.html	2011-09-15 11:15:24.000000000 +0200
***************
*** 87,109 ****
  
- <DT><b><a name="access_map_defer_code">access_map_defer_code</a>
- (default: 450)</b></DT><DD>
- 
- <p>
- The numerical Postfix SMTP server response code for
- an <a href="access.5.html">access(5)</a> map "defer" action, including "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>"
- or "<a href="postconf.5.html#defer_if_reject">defer_if_reject</a>". Prior to Postfix 2.6, the response
- is hard-coded as "450".
- </p>
- 
- <p>
- Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
- </p>
- 
- <p>
- This feature is available in Postfix 2.6 and later.
- </p>
- 
- 
- </DD>
- 
  <DT><b><a name="access_map_reject_code">access_map_reject_code</a>
--- 87,88 ----
***************
*** 112,115 ****
  <p>
! The numerical Postfix SMTP server response code for
! an <a href="access.5.html">access(5)</a> map "reject" action.
  </p>
--- 91,94 ----
  <p>
! The numerical Postfix SMTP server response code when a client
! is rejected by an <a href="access.5.html">access(5)</a> map restriction.
  </p>
***************
*** 123,146 ****
  
- <DT><b><a name="address_verify_cache_cleanup_interval">address_verify_cache_cleanup_interval</a>
- (default: 12h)</b></DT><DD>
- 
- <p> The amount of time between <a href="verify.8.html">verify(8)</a> address verification
- database cleanup runs. This feature requires that the database
- supports the "delete" and "sequence" operators.  Specify a zero
- interval to disable database cleanup. </p>
- 
- <p> After each database cleanup run, the <a href="verify.8.html">verify(8)</a> daemon logs the
- number of entries that were retained and dropped. A cleanup run is
- logged as "partial" when the daemon terminates early after "<b>postfix
- reload</b>", "<b>postfix stop</b>", or no requests for $<a href="postconf.5.html#max_idle">max_idle</a>
- seconds. </p>
- 
- <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
- (weeks). </p>
- 
- <p> This feature is available in Postfix 2.7. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="address_verify_default_transport">address_verify_default_transport</a>
--- 102,103 ----
***************
*** 176,181 ****
  <DT><b><a name="address_verify_map">address_verify_map</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
  <p>
! Lookup table for persistent address verification status
  storage.  The table is maintained by the <a href="verify.8.html">verify(8)</a> service, and
--- 133,138 ----
  <DT><b><a name="address_verify_map">address_verify_map</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional lookup table for persistent address verification status
  storage.  The table is maintained by the <a href="verify.8.html">verify(8)</a> service, and
***************
*** 185,190 ****
  <p>
! The lookup table is persistent by default (Postfix 2.7 and later).
! Specify an empty table name to keep the information in volatile
! memory which is lost after "<b>postfix reload</b>" or "<b>postfix
! stop</b>". This is the default with Postfix version 2.6 and earlier.
  </p>
--- 142,145 ----
  <p>
! By default, the information is kept in volatile memory, and is lost
! after "<b>postfix reload</b>" or "<b>postfix stop</b>".
  </p>
***************
*** 194,204 ****
  database becomes corrupted, the world comes to an end. To recover
! delete (NOT: truncate) the file and do "<b>postfix reload</b>".
  </p>
  
! <p> Postfix daemon processes do not use root privileges when opening
! this file (Postfix 2.5 and later).  The file must therefore be
! stored under a Postfix-owned directory such as the <a href="postconf.5.html#data_directory">data_directory</a>.
! As a migration aid, an attempt to open the file under a non-Postfix
! directory is redirected to the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>, and a
! warning is logged. </p>
  
--- 149,158 ----
  database becomes corrupted, the world comes to an end. To recover
! delete the file and do "<b>postfix reload</b>".
  </p>
  
! <p> As of version 2.5, Postfix no longer uses root privileges when
! opening this file. The file should now be stored under the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
! under a non-Postfix directory is redirected to the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
  
***************
*** 276,278 ****
  <DT><b><a name="address_verify_poll_count">address_verify_poll_count</a>
! (default: normal: 3, overload: 1)</b></DT><DD>
  
--- 230,232 ----
  <DT><b><a name="address_verify_poll_count">address_verify_poll_count</a>
! (default: 3)</b></DT><DD>
  
***************
*** 283,289 ****
  
! <p> By default, the Postfix SMTP server polls the <a href="verify.8.html">verify(8)</a> service
! up to three times under non-overload conditions, and only once when
! under overload.  With Postfix version 2.5 and earlier, the SMTP
! server always polls the <a href="verify.8.html">verify(8)</a> service up to three times by
! default.  </p>
  
--- 237,241 ----
  
! <p>
! The default poll count is 3.
! </p>
  
***************
*** 291,293 ****
  Specify 1 to implement a crude form of greylisting, that is, always
! defer the first delivery request for a new address.
  </p>
--- 243,245 ----
  Specify 1 to implement a crude form of greylisting, that is, always
! defer the first delivery request for a never seen before address.
  </p>
***************
*** 295,297 ****
  <p>
! Examples:
  </p>
--- 247,249 ----
  <p>
! Example:
  </p>
***************
*** 299,303 ****
  <pre>
- # Postfix &le; 2.6 default
- <a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> = 3
- # Poor man's greylisting
  <a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> = 1
--- 251,252 ----
***************
*** 435,447 ****
  
- <DT><b><a name="address_verify_sender_dependent_default_transport_maps">address_verify_sender_dependent_default_transport_maps</a>
- (default: $<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>)</b></DT><DD>
- 
- <p> Overrides the <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> parameter
- setting for address verification probes.  </p>
- 
- <p> This feature is available in Postfix 2.7 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="address_verify_sender_dependent_relayhost_maps">address_verify_sender_dependent_relayhost_maps</a>
--- 384,385 ----
***************
*** 668,670 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 606,608 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 722,735 ****
  
- <DT><b><a name="always_add_missing_headers">always_add_missing_headers</a>
- (default: no)</b></DT><DD>
- 
- <p> Always add (Resent-) From:, To:, Date: or Message-ID: headers
- when not present.  Postfix 2.6 and later add these headers only
- when clients match the <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> parameter
- setting.  Earlier Postfix versions always add these headers; this
- may break DKIM signatures that cover non-existent headers. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="always_bcc">always_bcc</a>
--- 660,661 ----
***************
*** 749,752 ****
  To avoid mailer loops, automatic BCC recipients are not generated
! after Postfix forwards mail internally, or after Postfix generates
! mail itself. </p>
  
--- 675,678 ----
  To avoid mailer loops, automatic BCC recipients are not generated
! for mail that Postfix forwards internally, nor for mail that Postfix
! generates itself. </p>
  
***************
*** 832,834 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 758,760 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 869,871 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 795,797 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 895,897 ****
  <DT><b><a name="authorized_flush_users">authorized_flush_users</a>
! (default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
  
--- 821,823 ----
  <DT><b><a name="authorized_flush_users">authorized_flush_users</a>
! (default: static:anyone)</b></DT><DD>
  
***************
*** 929,931 ****
  <DT><b><a name="authorized_mailq_users">authorized_mailq_users</a>
! (default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
  
--- 855,857 ----
  <DT><b><a name="authorized_mailq_users">authorized_mailq_users</a>
! (default: static:anyone)</b></DT><DD>
  
***************
*** 963,965 ****
  <DT><b><a name="authorized_submit_users">authorized_submit_users</a>
! (default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
  
--- 889,891 ----
  <DT><b><a name="authorized_submit_users">authorized_submit_users</a>
! (default: static:anyone)</b></DT><DD>
  
***************
*** 994,996 ****
  <pre>
! <a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> = !www, <a href="DATABASE_README.html#types">static</a>:all
  </pre>
--- 920,922 ----
  <pre>
! <a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> = !www, static:all
  </pre>
***************
*** 1219,1225 ****
  <p> The maximal amount of original message text that is sent in a
! non-delivery notification. Specify a byte count.  A message is
! returned as either message/rfc822 (the complete original) or as
! text/rfc822-headers (the headers only).  With Postfix version 2.4
! and earlier, a message is always returned as message/rfc822 and is
! truncated when it exceeds the size limit.
  </p>
--- 1145,1151 ----
  <p> The maximal amount of original message text that is sent in a
! non-delivery notification. Specify a byte count. With Postfix 2.4
! and later, a message is returned as either message/rfc822 (the
! complete original) or as text/rfc822-headers (the headers only).
! With earlier Postfix versions, a message is always returned as
! message/rfc822 and is truncated when it exceeds the size limit.
  </p>
***************
*** 1333,1335 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 1259,1261 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 1510,1513 ****
  
- <p> This feature is available in Postfix 2.2 and later. </p>
- 
  
--- 1436,1437 ----
***************
*** 1541,1566 ****
  
! <p> After the message is queued, send the entire message to the
! specified <i>transport:destination</i>. The <i>transport</i> name
! specifies the first field of a mail delivery agent definition in
! <a href="master.5.html">master.cf</a>; the syntax of the next-hop <i>destination</i> is described
! in the manual page of the corresponding delivery agent.  More
! information about external content filters is in the Postfix
! <a href="FILTER_README.html">FILTER_README</a> file.  </p>
! 
! <p> Notes: </p>
! 
! <ul>
! 
! <li> <p> This setting has lower precedence than a FILTER action
! that is specified in an <a href="access.5.html">access(5)</a>, <a href="header_checks.5.html">header_checks(5)</a> or <a href="header_checks.5.html">body_checks(5)</a>
! table. </p>
! 
! <li> <p> The meaning of an empty next-hop filter <i>destination</i>
! is version dependent.  Postfix 2.7 and later will use the recipient
! domain; earlier versions will use $<a href="postconf.5.html#myhostname">myhostname</a>.  Specify
! "<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> = $<a href="postconf.5.html#myhostname">myhostname</a>" for compatibility with Postfix
! 2.6 or earlier, or specify a <a href="postconf.5.html#content_filter">content_filter</a> value with an explicit
! next-hop <i>destination</i>.  </p>
  
! </ul>
  
--- 1465,1477 ----
  
! <p>
! The name of a mail delivery transport that filters mail after
! it is queued.
! </p>
  
! <p>
! This parameter uses the same syntax as the right-hand side of a
! Postfix <a href="transport.5.html">transport(5)</a> table. This setting has a lower precedence
! than a content filter that is specified with an <a href="access.5.html">access(5)</a> table or
! in a <a href="header_checks.5.html">header_checks(5)</a> or <a href="header_checks.5.html">body_checks(5)</a> table.
! </p>
  
***************
*** 1651,1653 ****
  <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = 127.0.0.1
! <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = example.com
  </pre>
--- 1562,1564 ----
  <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = 127.0.0.1
! <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = some.domain
  </pre>
***************
*** 1900,1902 ****
  
! <p> Use <a href="postconf.5.html#transport_destination_concurrency_negative_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
  to specify a transport-specific override, where <i>transport</i>
--- 1811,1813 ----
  
! <p> Use <a href="postconf.5.html#transport_destination_concurrency_positive_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
  to specify a transport-specific override, where <i>transport</i>
***************
*** 1973,1976 ****
  <p> NOTE: the delay is enforced by the queue manager. The delay
! timer state does not survive "<b>postfix reload</b>" or "<b>postfix
! stop</b>".
  </p>
--- 1884,1886 ----
  <p> NOTE: the delay is enforced by the queue manager. The delay
! timer state does not survive "postfix reload" or "postfix stop".
  </p>
***************
*** 1982,1988 ****
  
- <p> NOTE: with a non-zero _destination_rate_delay, specify a
- <a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a> of 10
- or more to prevent Postfix from deferring all mail for the same
- destination after only one connection or handshake error. </p>
- 
  <p> This feature is available in Postfix 2.5 and later. </p>
--- 1892,1893 ----
***************
*** 2033,2049 ****
  
- <DT><b><a name="default_filter_nexthop">default_filter_nexthop</a>
- (default: empty)</b></DT><DD>
- 
- <p> When a <a href="postconf.5.html#content_filter">content_filter</a> or FILTER request specifies no explicit
- next-hop destination, use $<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> instead; when
- that value is empty, use the domain in the recipient address.
- Specify "<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> = $<a href="postconf.5.html#myhostname">myhostname</a>" for compatibility
- with Postfix version 2.6 and earlier, or specify an explicit next-hop
- destination with each <a href="postconf.5.html#content_filter">content_filter</a> value or FILTER action. </p>
- 
- <p> This feature is available in Postfix 2.7 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="default_minimum_delivery_slots">default_minimum_delivery_slots</a>
--- 1938,1939 ----
***************
*** 2286,2296 ****
  $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
! or $<a href="postconf.5.html#relay_domains">relay_domains</a>.  This information can be overruled with the
! <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> parameter and with the
! <a href="transport.5.html">transport(5)</a> table. </p>
! 
! <p>
! In order of decreasing precedence, the nexthop destination is taken
! from $<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>, $<a href="postconf.5.html#default_transport">default_transport</a>,
  $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or from the recipient
! domain.
  </p>
--- 2176,2182 ----
  $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
! or $<a href="postconf.5.html#relay_domains">relay_domains</a>.  In order of decreasing precedence, the nexthop
! destination is taken from $<a href="postconf.5.html#default_transport">default_transport</a>,
  $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or from the recipient
! domain. This information can be overruled with the <a href="transport.5.html">transport(5)</a>
! table.
  </p>
***************
*** 2300,2303 ****
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> destination is optional; its syntax is documented
! in the manual page of the corresponding delivery agent.
  </p>
--- 2186,2189 ----
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> part is optional.  For more details see the
! <a href="transport.5.html">transport(5)</a> manual page.
  </p>
***************
*** 2402,2404 ****
  
! <li> c = time in connection setup, including DNS, EHLO and STARTTLS
  
--- 2288,2290 ----
  
! <li> c = time in connection setup, including DNS, EHLO and TLS
  
***************
*** 2591,2613 ****
  
- <DT><b><a name="dnsblog_reply_delay">dnsblog_reply_delay</a>
- (default: 0s)</b></DT><DD>
- 
- <p> A debugging aid to artifically delay DNS responses. </p>
- 
- <p> This feature is available in Postfix 2.8.  </p>
- 
- 
- </DD>
- 
- <DT><b><a name="dnsblog_service_name">dnsblog_service_name</a>
- (default: dnsblog)</b></DT><DD>
- 
- <p> The name of the <a href="dnsblog.8.html">dnsblog(8)</a> service entry in <a href="master.5.html">master.cf</a>. This
- service performs DNS white/blacklist lookups. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="dont_remove">dont_remove</a>
--- 2477,2478 ----
***************
*** 2644,2656 ****
  
- <DT><b><a name="empty_address_default_transport_maps_lookup_key">empty_address_default_transport_maps_lookup_key</a>
- (default: &lt;&gt;)</b></DT><DD>
- 
- <p> The <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> search string that
- will be used instead of the null sender address. </p>
- 
- <p> This feature is available in Postfix 2.7 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="empty_address_recipient">empty_address_recipient</a>
--- 2509,2510 ----
***************
*** 2692,2779 ****
  
- <DT><b><a name="enable_long_queue_ids">enable_long_queue_ids</a>
- (default: no)</b></DT><DD>
- 
- <p> Enable long, non-repeating, queue IDs (queue file names).  The
- benefit of non-repeating names is simpler logfile analysis and
- easier queue migration (there is no need to run "postsuper" to
- change queue file names that don't match their message file inode
- number).  </p>
- 
- <p> Note: see below for how to prepare long queue file names
- for migration to Postfix &le; 2.8. </p>
- 
- <p> Changing the parameter value to "yes" has the following effects:
- </p>
- 
- <ul>
- 
- <li> <p> Existing queue file names are not affected. </p>
- 
- <li> <p> New queue files are created with names such as 3Pt2mN2VXxznjll.
- These are encoded in a 52-character alphabet that contains digits
- (0-9), upper-case letters (B-Z) and lower-case letters (b-z). For
- safety reasons the vowels (AEIOUaeiou) are excluded from the alphabet.
- The name format is: 6 or more characters for the time in seconds,
- 4 characters for the time in microseconds, the 'z'; the remainder
- is the file inode number encoded in the first 51 characters of the
- 52-character alphabet.  </p>
- 
- <li> <p> New messages have a Message-ID header with
- <i>queueID</i>@<i><a href="postconf.5.html#myhostname">myhostname</a></i>.  </p>
- 
- <li> <p> The mailq (postqueue -p) output has a wider Queue ID column.
- The number of whitespace-separated fields is not changed. <p>
- 
- <li> <p> The <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> algorithm uses the first characters
- of the queue file creation time in microseconds, after conversion
- into hexadecimal representation. This produces the same queue hashing
- behavior as if the queue file name was created with "<a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>
- = no". </p>
- 
- </ul>
- 
- <p> Changing the parameter value to "no" has the following effects:
- </p>
- 
- <ul>
- 
- <li> <p> Existing long queue file names are renamed to the short
- form (while running "postfix reload" or "postsuper").  </p>
- 
- <li> New queue files are created with names such as C3CD21F3E90
- from a hexadecimal alphabet that contains digits (0-9) and upper-case
- letters (A-F). The name format is: 5 characters for the time in
- microseconds; the remainder is the file inode number. </p>
- 
- <li> <p> New messages have a Message-ID header with
- <i>YYYYMMDDHHMMSS.queueid</i>@<i><a href="postconf.5.html#myhostname">myhostname</a></i>, where
- <i>YYYYMMDDHHMMSS</i> are the year, month, day, hour, minute and
- second.
- 
- <li> <p> The mailq (postqueue -p) output has the same format as
- with Postfix &le; 2.8. <p>
- 
- <li> <p> The <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> algorithm uses the first characters
- of the queue file name, with the hexadecimal representation of the
- file creation time in microseconds.  </p>
- 
- </ul>
- 
- <p> Before migration to Postfix &le; 2.8, the following commands
- are required to convert long queue file names into short names: </p>
- 
- <pre>
- # postfix stop
- # postconf <a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>=no
- # postsuper
- </pre>
- 
- <p> Repeat the postsuper command until it reports no more queue file
- name changes. </p>
- 
- <p> This feature is available in Postfix 2.9 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="enable_original_recipient">enable_original_recipient</a>
--- 2546,2547 ----
***************
*** 3194,3207 ****
  The number of subdirectory levels for queue directories listed with
! the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> parameter. Queue hashing is implemented by
! creating one or more levels of directories with one-character names.
! Originally, these directory names were equal to the first characters
! of the queue file name, with the hexadecimal representation of the
! file creation time in microseconds. </p>
! 
! <p> With long queue file names, queue hashing produces the same
! results as with short names. The file creation time in microseconds
! is converted into hexadecimal form before the result is used for
! queue hashing.  The base 16 encoding gives finer control over the
! number of subdirectories than is possible with the base 52 encoding
! of long queue file names.  </p>
  
--- 2962,2965 ----
  The number of subdirectory levels for queue directories listed with
! the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> parameter.
! </p>
  
***************
*** 3655,3679 ****
  
- <DT><b><a name="lmtp_address_preference">lmtp_address_preference</a>
- (default: ipv6)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
- 
- </DD>
- 
- <DT><b><a name="lmtp_assume_final">lmtp_assume_final</a>
- (default: no)</b></DT><DD>
- 
- <p> When an LMTP server announces no DSN support, assume that the
- server performs final delivery, and send "delivered" delivery status
- notifications instead of "relayed". The default setting is backwards
- compatible to avoid the infinetisimal possibility of breaking
- existing LMTP-based content filters. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_bind_address">lmtp_bind_address</a>
--- 3413,3414 ----
***************
*** 3700,3712 ****
  
- <DT><b><a name="lmtp_body_checks">lmtp_body_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_body_checks">smtp_body_checks</a> configuration
- parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.5 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_cache_connection">lmtp_cache_connection</a>
--- 3435,3436 ----
***************
*** 3720,3726 ****
  
- <p> This parameter is available in Postfix version 2.2 and earlier.
- With Postfix version 2.3 and later, see <a href="postconf.5.html#lmtp_connection_cache_on_demand">lmtp_connection_cache_on_demand</a>,
- <a href="postconf.5.html#lmtp_connection_cache_destinations">lmtp_connection_cache_destinations</a>, or <a href="postconf.5.html#lmtp_connection_reuse_time_limit">lmtp_connection_reuse_time_limit</a>.
- </p>
- 
  <p>
--- 3444,3445 ----
***************
*** 3964,3976 ****
  
- <DT><b><a name="lmtp_dns_resolver_options">lmtp_dns_resolver_options</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_dns_resolver_options">smtp_dns_resolver_options</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_enforce_tls">lmtp_enforce_tls</a>
--- 3683,3684 ----
***************
*** 3997,4009 ****
  
- <DT><b><a name="lmtp_header_checks">lmtp_header_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_header_checks">smtp_header_checks</a> configuration
- parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.5 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_host_lookup">lmtp_host_lookup</a>
--- 3705,3706 ----
***************
*** 4040,4042 ****
  /etc/postfix/<a href="master.5.html">master.cf</a>:
!     mylmtp ... lmtp -o <a href="postconf.5.html#lmtp_lhlo_name">lmtp_lhlo_name</a>=foo.bar.com
  </pre>
--- 3737,3739 ----
  /etc/postfix/<a href="master.5.html">master.cf</a>:
!     mylmtp ... lmtp -o <a href="postconf.5.html#lmtp_lhloname">lmtp_lhlo_name</a>=foo.bar.com
  </pre>
***************
*** 4090,4102 ****
  
- <DT><b><a name="lmtp_mime_header_checks">lmtp_mime_header_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_mime_header_checks">smtp_mime_header_checks</a>
- configuration parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.5 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_mx_address_limit">lmtp_mx_address_limit</a>
--- 3787,3788 ----
***************
*** 4123,4146 ****
  
- <DT><b><a name="lmtp_nested_header_checks">lmtp_nested_header_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_nested_header_checks">smtp_nested_header_checks</a>
- configuration parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.5 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="lmtp_per_record_deadline">lmtp_per_record_deadline</a>
- (default: no)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.9 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_pix_workaround_delay_time">lmtp_pix_workaround_delay_time</a>
--- 3809,3810 ----
***************
*** 4243,4255 ****
  
- <DT><b><a name="lmtp_reply_filter">lmtp_reply_filter</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.7 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_rset_timeout">lmtp_rset_timeout</a>
--- 3907,3908 ----
***************
*** 4523,4535 ****
  
- <DT><b><a name="lmtp_tls_block_early_mail_reply">lmtp_tls_block_early_mail_reply</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_block_early_mail_reply">smtp_tls_block_early_mail_reply</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.7 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_tls_cert_file">lmtp_tls_cert_file</a>
--- 4176,4177 ----
***************
*** 4545,4557 ****
  
- <DT><b><a name="lmtp_tls_ciphers">lmtp_tls_ciphers</a>
- (default: export)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> configuration
- parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_tls_dcert_file">lmtp_tls_dcert_file</a>
--- 4187,4188 ----
***************
*** 4578,4603 ****
  
- <DT><b><a name="lmtp_tls_eccert_file">lmtp_tls_eccert_file</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> configuration
- parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.6 and later, when Postfix is
- compiled and linked with OpenSSL 1.0.0 or later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="lmtp_tls_eckey_file">lmtp_tls_eckey_file</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> configuration
- parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.6 and later, when Postfix is
- compiled and linked with OpenSSL 1.0.0 or later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_tls_enforce_peername">lmtp_tls_enforce_peername</a>
--- 4209,4210 ----
***************
*** 4734,4746 ****
  
- <DT><b><a name="lmtp_tls_protocols">lmtp_tls_protocols</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> configuration
- parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_tls_scert_verifydepth">lmtp_tls_scert_verifydepth</a>
--- 4341,4342 ----
***************
*** 4853,4857 ****
  By default, non-Postfix commands are executed directly; commands
! are given to given to the default shell (typically, /bin/sh) only
! when they contain shell meta characters or shell built-in commands.
! </p>
  
--- 4449,4452 ----
  By default, non-Postfix commands are executed directly; commands
! are given to given to /bin/sh only when they contain shell meta
! characters or shell built-in commands.  </p>
  
***************
*** 4871,4873 ****
  <a href="postconf.5.html#local_command_shell">local_command_shell</a> = /some/where/smrsh -c
- <a href="postconf.5.html#local_command_shell">local_command_shell</a> = /bin/bash -c
  </pre>
--- 4466,4467 ----
***************
*** 4983,4985 ****
  <pre>
! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all
  </pre>
--- 4577,4579 ----
  <pre>
! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all
  </pre>
***************
*** 5091,5094 ****
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> destination is optional; its syntax is documented
! in the manual page of the corresponding delivery agent.
  </p>
--- 4685,4688 ----
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> part is optional.  For more details see the
! <a href="transport.5.html">transport(5)</a> manual page.
  </p>
***************
*** 5539,5542 ****
  client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>,
! <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a>, <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or
! <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction.
  </p>
--- 5133,5135 ----
  client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>,
! <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction.
  </p>
***************
*** 5628,5630 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 5221,5223 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 5676,5710 ****
  
- <DT><b><a name="master_service_disable">master_service_disable</a>
- (default: empty)</b></DT><DD>
- 
- <p> Selectively disable <a href="master.8.html">master(8)</a> listener ports by service type
- or by service name and type.  Specify a list of service types
- ("inet", "unix", "fifo", or "pass") or "name.type" tuples, where
- "name" is the first field of a <a href="master.5.html">master.cf</a> entry and "type" is a
- service type. As with other Postfix matchlists, a search stops at
- the first match.  Specify "!pattern" to exclude a service from the
- list. By default, all <a href="master.8.html">master(8)</a> listener ports are enabled.  </p>
- 
- <p> Note: this feature does not support "/file/name" or "<a href="DATABASE_README.html">type:table</a>"
- patterns, nor does it support wildcards such as "*" or "all". This
- is intentional. </p>
- 
- <p> Examples: </p>
- 
- <pre>
- # Turn on all <a href="master.8.html">master(8)</a> listener ports (the default).
- <a href="postconf.5.html#master_service_disable">master_service_disable</a> =
- # Turn off only the main SMTP listener port.
- <a href="postconf.5.html#master_service_disable">master_service_disable</a> = smtp.inet
- # Turn off all TCP/IP listener ports.
- <a href="postconf.5.html#master_service_disable">master_service_disable</a> = inet
- # Turn off all TCP/IP listener ports except "foo".
- <a href="postconf.5.html#master_service_disable">master_service_disable</a> = !foo.inet, inet
- </pre>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="max_idle">max_idle</a>
--- 5269,5270 ----
***************
*** 5787,5795 ****
  
- <p> Note 1: this feature does not recognize text that requires MIME
- decoding. It inspects raw message content, just like <a href="postconf.5.html#header_checks">header_checks</a>
- and <a href="postconf.5.html#body_checks">body_checks</a>.  </p>
- 
- <p> Note 2: this feature is disabled with "<a href="postconf.5.html#receive_override_options">receive_override_options</a>
- = <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>".  </p>
- 
  <p> Example: </p>
--- 5347,5348 ----
***************
*** 5828,5836 ****
  
- <p> Note 1: this feature does not recognize text that requires MIME
- decoding. It inspects raw message content, just like <a href="postconf.5.html#header_checks">header_checks</a>
- and <a href="postconf.5.html#body_checks">body_checks</a>.  </p>
- 
- <p> Note 2: this feature is disabled with "<a href="postconf.5.html#receive_override_options">receive_override_options</a>
- = <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>".  </p>
- 
  <p> Example: </p>
--- 5381,5382 ----
***************
*** 5864,5866 ****
  <DT><b><a name="milter_connect_macros">milter_connect_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5410,5412 ----
  <DT><b><a name="milter_connect_macros">milter_connect_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 5910,5912 ****
  <DT><b><a name="milter_data_macros">milter_data_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5456,5458 ----
  <DT><b><a name="milter_data_macros">milter_data_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 5938,5942 ****
  
- <dt>quarantine</dt> <dd>Like "accept", but freeze the message in
- the "<a href="QSHAPE_README.html#hold_queue">hold" queue</a>. Available with Postfix 2.6 and later. </dd>
- 
  </dl>
--- 5484,5485 ----
***************
*** 5949,5951 ****
  <DT><b><a name="milter_end_of_data_macros">milter_end_of_data_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5492,5494 ----
  <DT><b><a name="milter_end_of_data_macros">milter_end_of_data_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 5961,5963 ****
  <DT><b><a name="milter_end_of_header_macros">milter_end_of_header_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5504,5506 ----
  <DT><b><a name="milter_end_of_header_macros">milter_end_of_header_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 5972,6007 ****
  
- <DT><b><a name="milter_header_checks">milter_header_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> Optional lookup tables for content inspection of message headers
- that are produced by Milter applications.  See the <a href="header_checks.5.html">header_checks(5)</a>
- manual page available actions. Currently, PREPEND is not implemented.
- </p>
- 
- <p> The following example sends all mail that is marked as SPAM to
- a spam handling machine. Note that matches are case-insensitive
- by default. </p>
- 
- <pre>
- /etc/postfix/<a href="postconf.5.html">main.cf</a>:
-     <a href="postconf.5.html#milter_header_checks">milter_header_checks</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/<a href="postconf.5.html#milter_header_checks">milter_header_checks</a>
- </pre>
- 
- <pre>
- /etc/postfix/<a href="postconf.5.html#milter_header_checks">milter_header_checks</a>:
-     /^X-SPAM-FLAG:\s+YES/ FILTER mysmtp:sanitizer.example.com:25
- </pre>
- 
- <p> The <a href="postconf.5.html#milter_header_checks">milter_header_checks</a> mechanism could also be used for
- whitelisting. For example it could be used to skip heavy content
- inspection for DKIM-signed mail from known friendly domains. </p>
- 
- <p> This feature is available in Postfix 2.7, and as an optional
- patch for Postfix 2.6. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="milter_helo_macros">milter_helo_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5515,5518 ----
  
  <DT><b><a name="milter_helo_macros">milter_helo_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6042,6044 ****
  <DT><b><a name="milter_mail_macros">milter_mail_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5553,5555 ----
  <DT><b><a name="milter_mail_macros">milter_mail_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6054,6060 ****
  <DT><b><a name="milter_protocol">milter_protocol</a>
! (default: 6)</b></DT><DD>
  
  <p> The mail filter protocol version and optional protocol extensions
! for communication with a Milter application; prior to Postfix 2.6
! the default protocol is 2. Postfix
  sends this version number during the initial protocol handshake.
--- 5565,5570 ----
  <DT><b><a name="milter_protocol">milter_protocol</a>
! (default: 2)</b></DT><DD>
  
  <p> The mail filter protocol version and optional protocol extensions
! for communication with a Milter (mail filter) application. Postfix
  sends this version number during the initial protocol handshake.
***************
*** 6068,6071 ****
  <dt>2</dt> <dd>Use Sendmail 8 mail filter protocol version 2 (default
! with Sendmail version 8.11 .. 8.13 and Postfix version 2.3 ..
! 2.5).</dd>
  
--- 5578,5580 ----
  <dt>2</dt> <dd>Use Sendmail 8 mail filter protocol version 2 (default
! as of Sendmail version 8.11).</dd>
  
***************
*** 6076,6078 ****
  <dt>6</dt> <dd>Use Sendmail 8 mail filter protocol version 6 (default
! with Sendmail version 8.14 and Postfix version 2.6).</dd>
  
--- 5585,5587 ----
  <dt>6</dt> <dd>Use Sendmail 8 mail filter protocol version 6 (default
! as of Sendmail version 8.14).</dd>
  
***************
*** 6095,6097 ****
  <DT><b><a name="milter_rcpt_macros">milter_rcpt_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5604,5606 ----
  <DT><b><a name="milter_rcpt_macros">milter_rcpt_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6107,6109 ****
  <DT><b><a name="milter_unknown_command_macros">milter_unknown_command_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5616,5618 ----
  <DT><b><a name="milter_unknown_command_macros">milter_unknown_command_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6188,6274 ****
  
- <DT><b><a name="multi_instance_directories">multi_instance_directories</a>
- (default: empty)</b></DT><DD>
- 
- <p> An optional list of non-default Postfix configuration directories;
- these directories belong to additional Postfix instances that share
- the Postfix executable files and documentation with the default
- Postfix instance, and that are started, stopped, etc., together
- with the default Postfix instance.  Specify a list of pathnames
- separated by comma or whitespace.  </p>
- 
- <p> When $<a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> is empty, the <a href="postfix.1.html">postfix(1)</a> command
- runs in single-instance mode and operates on a single Postfix
- instance only. Otherwise, the <a href="postfix.1.html">postfix(1)</a> command runs in multi-instance
- mode and invokes the multi-instance manager specified with the
- <a href="postconf.5.html#multi_instance_wrapper">multi_instance_wrapper</a> parameter. The multi-instance manager in
- turn executes <a href="postfix.1.html">postfix(1)</a> commands for the default instance and for
- all Postfix instances in $<a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>.  </p>
- 
- <p> Currently, this parameter setting is ignored except for the
- default <a href="postconf.5.html">main.cf</a> file. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="multi_instance_enable">multi_instance_enable</a>
- (default: no)</b></DT><DD>
- 
- <p> Allow this Postfix instance to be started, stopped, etc., by a
- multi-instance manager.  By default, new instances are created in
- a safe state that prevents them from being started inadvertently.
- This parameter is reserved for the multi-instance manager.  </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="multi_instance_group">multi_instance_group</a>
- (default: empty)</b></DT><DD>
- 
- <p> The optional instance group name of this Postfix instance. A
- group identifies closely-related Postfix instances that the
- multi-instance manager can start, stop, etc., as a unit.  This
- parameter is reserved for the multi-instance manager. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="multi_instance_name">multi_instance_name</a>
- (default: empty)</b></DT><DD>
- 
- <p> The optional instance name of this Postfix instance. This name
- becomes also the default value for the <a href="postconf.5.html#syslog_name">syslog_name</a> parameter. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="multi_instance_wrapper">multi_instance_wrapper</a>
- (default: empty)</b></DT><DD>
- 
- <p> The pathname of a multi-instance manager command that the
- <a href="postfix.1.html">postfix(1)</a> command invokes when the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>
- parameter value is non-empty. The pathname may be followed by
- initial command arguments separated by whitespace; shell
- metacharacters such as quotes are not supported in this context.
- </p>
- 
- <p> The <a href="postfix.1.html">postfix(1)</a> command invokes the manager command with the
- <a href="postfix.1.html">postfix(1)</a> non-option command arguments on the manager command line,
- and with all installation configuration parameters exported into
- the manager command process environment. The manager command in
- turn invokes the <a href="postfix.1.html">postfix(1)</a> command for individual Postfix instances
- as "postfix -c <i><a href="postconf.5.html#config_directory">config_directory</a></i> <i>command</i>".  </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a>
--- 5697,5698 ----
***************
*** 6362,6365 ****
  The internet domain name of this mail system.  The default is to
! use $<a href="postconf.5.html#myhostname">myhostname</a> minus the first component, or "localdomain" (Postfix
! 2.3 and later).  $<a href="postconf.5.html#mydomain">mydomain</a> is used as
  a default value for many other configuration parameters.
--- 5786,5788 ----
  The internet domain name of this mail system.  The default is to
! use $<a href="postconf.5.html#myhostname">myhostname</a> minus the first component.  $<a href="postconf.5.html#mydomain">mydomain</a> is used as
  a default value for many other configuration parameters.
***************
*** 6383,6388 ****
  The internet hostname of this mail system. The default is to use
! the fully-qualified domain name (FQDN) from gethostname(), or to
! use the non-FQDN result from gethostname() and append ".$<a href="postconf.5.html#mydomain">mydomain</a>".
! $<a href="postconf.5.html#myhostname">myhostname</a> is used as a default value for many other configuration
! parameters.  </p>
  
--- 5806,5810 ----
  The internet hostname of this mail system. The default is to use
! the fully-qualified domain name from gethostname(). $<a href="postconf.5.html#myhostname">myhostname</a> is
! used as a default value for many other configuration parameters.
! </p>
  
***************
*** 6393,6395 ****
  <pre>
! <a href="postconf.5.html#myhostname">myhostname</a> = host.example.com
  </pre>
--- 5815,5817 ----
  <pre>
! <a href="postconf.5.html#myhostname">myhostname</a> = host.domain.tld
  </pre>
***************
*** 6558,6561 ****
  via the Postfix <a href="qmqpd.8.html">qmqpd(8)</a> server, and old mail that is re-injected
! into the queue with "postsuper -r".  Specify space or comma as
! separator. See the <a href="MILTER_README.html">MILTER_README</a> document for details.  </p>
  
--- 5980,5983 ----
  via the Postfix <a href="qmqpd.8.html">qmqpd(8)</a> server, and old mail that is re-injected
! into the queue with "postsuper -r".  See the <a href="MILTER_README.html">MILTER_README</a> document
! for details.  </p>
  
***************
*** 6683,7542 ****
  only domains whose primary MX hosts match the listed networks.
! The parameter value syntax is the same as with the <a href="postconf.5.html#mynetworks">mynetworks</a>
! parameter; note, however, that the default value is empty.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="pickup_service_name">pickup_service_name</a>
! (default: pickup)</b></DT><DD>
! 
! <p>
! The name of the <a href="pickup.8.html">pickup(8)</a> service. This service picks up local mail
! submissions from the Postfix <a href="QSHAPE_README.html#maildrop_queue">maildrop queue</a>.
! </p>
! 
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="plaintext_reject_code">plaintext_reject_code</a>
! (default: 450)</b></DT><DD>
! 
! <p>
! The numerical Postfix SMTP server response code when a request
! is rejected by the <b><a href="postconf.5.html#reject_plaintext_session">reject_plaintext_session</a></b> restriction.
! </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postmulti_control_commands">postmulti_control_commands</a>
! (default: reload flush)</b></DT><DD>
! 
! <p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager
! treats as "control" commands, that operate on running instances. For
! these commands, disabled instances are skipped. </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postmulti_start_commands">postmulti_start_commands</a>
! (default: start)</b></DT><DD>
! 
! <p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager treats
! as "start" commands. For these commands, disabled instances are "checked"
! rather than "started", and failure to "start" a member instance of an
! instance group will abort the start-up of later instances. </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postmulti_stop_commands">postmulti_stop_commands</a>
! (default: see "postconf -d" output)</b></DT><DD>
! 
! <p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager treats
! as "stop" commands. For these commands, disabled instances are skipped,
! and enabled instances are processed in reverse order. </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_access_list">postscreen_access_list</a>
! (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>)</b></DT><DD>
! 
! <p> Permanent white/blacklist for remote SMTP client IP addresses.
! <a href="postscreen.8.html">postscreen(8)</a> searches this list immediately after a remote SMTP
! client connects.  Specify a comma- or whitespace-separated list of
! commands (in upper or lower case) or lookup tables. The search stops
! upon the first command that fires for the client IP address. </p>
! 
! <dl>
! 
! <dt> <b> <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a> </b> </dt> <dd> Whitelist the client and
! terminate the search if the client IP address matches $<a href="postconf.5.html#mynetworks">mynetworks</a>.
! Do not subject the client to any before/after 220 greeting tests.
! Pass the connection immediately to a Postfix SMTP server process.
! </dd>
! 
! <dt> <b> <a href="DATABASE_README.html">type:table</a> </b> </dt> <dd> Query the specified lookup
! table. Each table lookup result is an access list, except that
! access lists inside a table cannot specify <a href="DATABASE_README.html">type:table</a> entries.  <br>
! To discourage the use of hash, btree, etc. tables, there is no
! support for substring matching like <a href="smtpd.8.html">smtpd(8)</a>. Use CIDR tables
! instead.  </dd>
! 
! <dt> <b> permit </b> </dt> <dd> Whitelist the client and terminate
! the search. Do not subject the client to any before/after 220
! greeting tests. Pass the connection immediately to a Postfix SMTP
! server process. </dd>
! 
! <dt> <b> reject </b> </dt> <dd> Blacklist the client and terminate
! the search. Subject the client to the action configured with the
! <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> configuration parameter. </dd>
! 
! <dt> <b> dunno </b> </dt> <dd> All <a href="postscreen.8.html">postscreen(8)</a> access lists
! implicitly have this command at the end. <br> When <b> dunno </b>
! is executed inside a lookup table, return from the lookup table and
! evaluate the next command.  <br> When <b> dunno </b> is executed
! outside a lookup table, terminate the search, and subject the client
! to the configured before/after 220 greeting tests. </dd>
! 
! </dl>
! 
! <p> Example: </p>
! 
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,
! 		<a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr
! </pre>
! 
! <pre>
! /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>:
!     # Rules are evaluated in the order as specified.
!     # Blacklist 192.168.* except 192.168.0.1.
!     192.168.0.1         dunno
!     192.168.0.0/16      reject
! </pre>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_bare_newline_action">postscreen_bare_newline_action</a>
! (default: ignore)</b></DT><DD>
! 
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client sends
! a bare newline character, that is, a newline not preceded by carriage
! return.  Specify one of the following: </p>
! 
! <dl>
! 
! <dt> <b>ignore</b> </dt>
! 
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Do <i>not</i> repeat this test before some the result from some
! other test expires.
! This option is useful for testing and collecting statistics
! without blocking mail permanently. </dd>
! 
! <dt> <b>enforce</b> </dt>
! 
! <dd> Allow other tests to complete. Reject attempts to deliver mail
! with a 550 SMTP reply, and log the helo/sender/recipient information.
! Repeat this test the next time the client connects. </dd>
! 
! <dt> <b>drop</b> </dt>
! 
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects.  </dd>
! 
! </dl>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_bare_newline_enable">postscreen_bare_newline_enable</a>
! (default: no)</b></DT><DD>
! 
! <p> Enable "bare newline" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
! server. These tests are expensive: a client must disconnect after
! it passes the test, before it can talk to a real Postfix SMTP server.
! </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_bare_newline_ttl">postscreen_bare_newline_ttl</a>
! (default: 30d)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful "bare newline" SMTP protocol test. During this
! time, the client IP address is excluded from this test. The default
! is long because a client must disconnect after it passes the test,
! before it can talk to a real Postfix SMTP server. </p>
! 
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_blacklist_action">postscreen_blacklist_action</a>
! (default: ignore)</b></DT><DD>
! 
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client is
! permanently blacklisted with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter.
! Specify one of the following: </p>
! 
! <dl>
! 
! <dt> <b>ignore</b> (default) </dt>
! 
! <dd> Ignore  this result. Allow other tests to complete.  Repeat
! this test the next time the client connects.
! This option is useful for testing and collecting statistics
! without blocking mail. </dd>
! 
! <dt> <b>enforce</b> </dt>
! 
! <dd> Allow other tests to complete. Reject attempts to deliver mail
! with a 550 SMTP reply, and log the helo/sender/recipient information.
! Repeat this test the next time the client connects. </dd>
! 
! <dt> <b>drop</b> </dt>
! 
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. </dd>
! 
! </dl>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a>
! (default: 12h)</b></DT><DD>
! 
! <p> The amount of time between <a href="postscreen.8.html">postscreen(8)</a> cache cleanup runs.
! Cache cleanup increases the load on the cache database and should
! therefore not be run frequently. This feature requires that the
! cache database supports the "delete" and "sequence" operators.
! Specify a zero interval to disable cache cleanup. </p>
! 
! <p> After each cache cleanup run, the <a href="postscreen.8.html">postscreen(8)</a> daemon logs the
! number of entries that were retained and dropped. A cleanup run is
! logged as "partial" when the daemon terminates early after "<b>postfix
! reload</b>", "<b>postfix stop</b>", or no requests for $<a href="postconf.5.html#max_idle">max_idle</a>
! seconds. </p>
! 
! <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
! (weeks).  </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_cache_map">postscreen_cache_map</a>
! (default: btree:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache)</b></DT><DD>
! 
! <p> Persistent storage for the <a href="postscreen.8.html">postscreen(8)</a> server decisions. </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_cache_retention_time">postscreen_cache_retention_time</a>
! (default: 7d)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will cache an expired
! temporary whitelist entry before it is removed. This prevents clients
! from being logged as "NEW" just because their cache entry expired
! an hour ago. It also prevents the cache from filling up with clients
! that passed some deep protocol test once and never came back. </p>
! 
! <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
! (weeks).  </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a>
! (default: $<a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>)</b></DT><DD>
! 
! <p> How many simultaneous connections any client is allowed to have
! with the <a href="postscreen.8.html">postscreen(8)</a> daemon. By default, this limit is the same
! as with the Postfix SMTP server. Note that the triage process can
! take several seconds, with the time spent in <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
! delay, and with the time spent talking to the <a href="postscreen.8.html">postscreen(8)</a> built-in
! dummy SMTP protocol engine. </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_command_count_limit">postscreen_command_count_limit</a>
! (default: 20)</b></DT><DD>
! 
! <p> The limit on the total number of commands per SMTP session for
! <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP protocol engine.  This SMTP engine
! defers or rejects all attempts to deliver mail, therefore there is
! no need to enforce separate limits on the number of junk commands
! and error commands.  </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_command_filter">postscreen_command_filter</a>
! (default: $<a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a>)</b></DT><DD>
! 
! <p> A mechanism to transform commands from remote SMTP clients.
! See <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> for further details. </p>
! 
! <p> This feature is available in Postfix 2.8 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_command_time_limit">postscreen_command_time_limit</a>
! (default: ${stress?10}${stress:300}s)</b></DT><DD>
! 
! <p> The time limit to read an entire command line with <a href="postscreen.8.html">postscreen(8)</a>'s
! built-in SMTP protocol engine. </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_disable_vrfy_command">postscreen_disable_vrfy_command</a>
! (default: $<a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a>)</b></DT><DD>
! 
! <p> Disable the SMTP VRFY command in the <a href="postscreen.8.html">postscreen(8)</a> daemon.  See
! <a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a> for details.  </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_discard_ehlo_keyword_address_maps">postscreen_discard_ehlo_keyword_address_maps</a>
! (default: $<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>)</b></DT><DD>
! 
! <p> Lookup tables, indexed by the remote SMTP client address, with
! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
! etc.) that the <a href="postscreen.8.html">postscreen(8)</a> server will not send in the EHLO response
! to a remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
! The table is not searched by hostname for robustness reasons.  </p>
! 
! <p> This feature is available in Postfix 2.8 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_discard_ehlo_keywords">postscreen_discard_ehlo_keywords</a>
! (default: $<a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>)</b></DT><DD>
! 
! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
! auth, etc.) that the <a href="postscreen.8.html">postscreen(8)</a> server will not send in the EHLO
! response to a remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>
! for details. </p>
! 
! <p> This feature is available in Postfix 2.8 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_dnsbl_action">postscreen_dnsbl_action</a>
! (default: ignore)</b></DT><DD>
! 
! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client's combined
! DNSBL score is equal to or greater than a threshold (as defined
! with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> and <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>
! parameters).  Specify one of the following: </p>
! 
! <dl>
! 
! <dt> <b>ignore</b> (default) </dt>
! 
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Repeat this test the next time the client connects.
! This option is useful for testing and collecting statistics
! without blocking mail. </dd>
! 
! <dt> <b>enforce</b> </dt>
! 
! <dd> Allow other tests to complete. Reject attempts to deliver mail
! with a 550 SMTP reply, and log the helo/sender/recipient information.
! Repeat this test the next time the client connects. </dd>
! 
! <dt> <b>drop</b> </dt>
! 
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. </dd>
! 
! </dl>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a>
! (default: empty)</b></DT><DD>
! 
! <p> A mapping from actual DNSBL domain name which includes a secret
! password, to the DNSBL domain name that postscreen will reply with
! when it rejects mail.  When no mapping is found, the actual DNSBL
! domain will be used. </p>
! 
! <p> For maximal stability it is best to use a file that is read
! into memory such as <a href="pcre_table.5.html">pcre</a>:, <a href="regexp_table.5.html">regexp</a>: or <a href="DATABASE_README.html#types">texthash</a>: (<a href="DATABASE_README.html#types">texthash</a>: is similar
! to hash:, except a) there is no need to run <a href="postmap.1.html">postmap(1)</a> before the
! file can be used, and b) <a href="DATABASE_README.html#types">texthash</a>: does not detect changes after
! the file is read). </p>
! 
! <p> Example: </p>
! 
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply
! </pre>
! 
! <pre>
! /etc/postfix/dnsbl_reply:
!    secret.zen.spamhaus.org	zen.spamhaus.org
! </pre>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
! (default: empty)</b></DT><DD>
! 
! <p>Optional list of DNS white/blacklist domains, filters and weight
! factors. When the list is non-empty, the <a href="dnsblog.8.html">dnsblog(8)</a> daemon will
! query these domains with the IP addresses of remote SMTP clients,
! and <a href="postscreen.8.html">postscreen(8)</a> will update an SMTP client's DNSBL score with
! each non-error reply. </p>
! 
! <p> Caution: when postscreen rejects mail, it replies with the DNSBL
! domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to hide
! "password" information in DNSBL domain names. </p>
! 
! <p> When a client's score is equal to or greater than the threshold
! specified with <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>, <a href="postscreen.8.html">postscreen(8)</a> can drop
! the connection with the SMTP client. </p>
! 
! <p> Specify a list of domain=filter*weight entries, separated by
! comma or whitespace.  </p>
! 
! <ul>
! 
! <li> <p> When no "=filter" is specified, <a href="postscreen.8.html">postscreen(8)</a> will use any
! non-error DNSBL reply.  Otherwise, <a href="postscreen.8.html">postscreen(8)</a> uses only DNSBL
! replies that match the filter. The filter has the form d.d.d.d,
! where each d is a number, or a pattern inside [] that contains one
! or more ";"-separated numbers or number..number ranges.  </p>
! 
! <li> <p> When no "*weight" is specified, <a href="postscreen.8.html">postscreen(8)</a> increments
! the SMTP client's DNSBL score by 1.  Otherwise, the weight must be
! an integral number, and <a href="postscreen.8.html">postscreen(8)</a> adds the specified weight to
! the SMTP client's DNSBL score.  Specify a negative number for
! whitelisting.  </p>
! 
! <li> <p> When one <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> entry produces multiple
! DNSBL responses, <a href="postscreen.8.html">postscreen(8)</a> applies the weight at most once.
! </p>
! 
! </ul>
! 
! <p> Examples: </p>
! 
! <p> To use example.com as a high-confidence blocklist, and to
! block mail with example.net and example.org only when both agree:
! </p>
! 
! <pre>
! <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2
! <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = example.com*2, example.net, example.org
! </pre>
! 
! <p> To filter only DNSBL replies containing 127.0.0.4: </p>
! 
! <pre>
! <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = example.com=127.0.0.4
! </pre>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>
! (default: 1)</b></DT><DD>
! 
! <p> The inclusive lower bound for blocking an SMTP client, based on
! its combined DNSBL score as defined with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
! parameter. </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_dnsbl_ttl">postscreen_dnsbl_ttl</a>
! (default: 1h)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful DNS blocklist test. During this time, the client IP address
! is excluded from this test. The default is relatively short, because a
! good client can immediately talk to a real Postfix SMTP server.
! </p>
! 
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_enforce_tls">postscreen_enforce_tls</a>
! (default: $<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b></DT><DD>
! 
! <p> Mandatory TLS: announce STARTTLS support to SMTP clients, and
! require that clients use TLS encryption.  See smtpd_postscreen_enforce_tls
! for details.  </p>
! 
! <p> This feature is available in Postfix 2.8 and later.
! Preferably, use <a href="postconf.5.html#postscreen_tls_security_level">postscreen_tls_security_level</a> instead. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_expansion_filter">postscreen_expansion_filter</a>
! (default: see "postconf -d" output)</b></DT><DD>
! 
! <p> List of characters that are permitted in <a href="postconf.5.html#postscreen_reject_footer">postscreen_reject_footer</a>
! attribute expansions.  See <a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> for further
! details. </p>
! 
! <p> This feature is available in Postfix 2.8 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_forbidden_commands">postscreen_forbidden_commands</a>
! (default: $<a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a>)</b></DT><DD>
! 
! <p> List of commands that the <a href="postscreen.8.html">postscreen(8)</a> server considers in
! violation of the SMTP protocol. See <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> for
! syntax, and <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> for possible actions.
! </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_greet_action">postscreen_greet_action</a>
! (default: ignore)</b></DT><DD>
! 
! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client speaks
! before its turn within the time specified with the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
! parameter.  Specify one of the following: </p>
! 
! <dl>
! 
! <dt> <b>ignore</b> (default) </dt>
! 
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Repeat this test the next time the client connects.
! This option is useful for testing and collecting statistics
! without blocking mail. </dd>
! 
! <dt> <b>enforce</b> </dt>
! 
! <dd> Allow other tests to complete. Reject attempts to deliver mail
! with a 550 SMTP reply, and log the helo/sender/recipient information.
! Repeat this test the next time the client connects. </dd>
! 
! <dt> <b>drop</b> </dt>
! 
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. </dd>
! 
! </dl>
! 
! <p> In either case, <a href="postscreen.8.html">postscreen(8)</a> will not whitelist the SMTP client
! IP address. </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_greet_banner">postscreen_greet_banner</a>
! (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>)</b></DT><DD>
! 
! <p> The <i>text</i> in the optional "220-<i>text</i>..." server
! response that
! <a href="postscreen.8.html">postscreen(8)</a> sends ahead of the real Postfix SMTP server's "220
! text..." response, in an attempt to confuse bad SMTP clients so
! that they speak before their turn (pre-greet).  Specify an empty
! value to disable this feature.  </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_greet_ttl">postscreen_greet_ttl</a>
! (default: 1d)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful PREGREET test. During this time, the client IP address
! is excluded from this test. The default is relatively short, because
! a good client can immediately talk to a real Postfix SMTP server. </p>
! 
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_greet_wait">postscreen_greet_wait</a>
! (default: ${stress?2}${stress:6}s)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will wait for an SMTP
! client to send a command before its turn, and for DNS blocklist
! lookup results to arrive (default: up to 2 seconds under stress,
! up to 6 seconds otherwise).  <p>
! 
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  </p>
! 
! <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
! (weeks).  </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_helo_required">postscreen_helo_required</a>
! (default: $<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a>)</b></DT><DD>
! 
! <p> Require that a remote SMTP client sends HELO or EHLO before
! commencing a MAIL transaction. </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a>
! (default: drop)</b></DT><DD>
! 
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client sends
! non-SMTP commands as specified with the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a>
! parameter.  Specify one of the following: </p>
! 
! <dl>
! 
! <dt> <b>ignore</b> </dt>
! 
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Do <i>not</i> repeat this test before some the result from some
! other test expires.
! This option is useful for testing and collecting statistics
! without blocking mail permanently. </dd>
! 
! <dt> <b>enforce</b> </dt>
! 
! <dd> Allow other tests to complete. Reject attempts to deliver mail
! with a 550 SMTP reply, and log the helo/sender/recipient information.
! Repeat this test the next time the client connects. </dd>
! 
! <dt> <b>drop</b> </dt>
! 
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. This action is the
! same as with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a>
! feature.  </dd>
! 
! </dl>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a>
! (default: no)</b></DT><DD>
! 
! <p> Enable "non-SMTP command" tests in the <a href="postscreen.8.html">postscreen(8)</a> server. These
! tests are expensive: a client must disconnect after it passes the
! test, before it can talk to a real Postfix SMTP server. </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_non_smtp_command_ttl">postscreen_non_smtp_command_ttl</a>
! (default: 30d)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful "non_smtp_command" SMTP protocol test. During this
! time, the client IP address is excluded from this test. The default
! is long because a client must disconnect after it passes the test,
! before it can talk to a real Postfix SMTP server. </p>
! 
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_pipelining_action">postscreen_pipelining_action</a>
! (default: enforce)</b></DT><DD>
! 
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client sends
! multiple commands instead of sending one command and waiting for
! the server to respond.  Specify one of the following: </p>
! 
! <dl>
! 
! <dt> <b>ignore</b> </dt>
! 
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Do <i>not</i> repeat this test before some the result from some
! other test expires.
! This option is useful for testing and collecting statistics
! without blocking mail permanently. </dd>
! 
! <dt> <b>enforce</b> </dt>
! 
! <dd> Allow other tests to complete. Reject attempts to deliver mail
! with a 550 SMTP reply, and log the helo/sender/recipient information.
! Repeat this test the next time the client connects. </dd>
! 
! <dt> <b>drop</b> </dt>
! 
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. </dd>
! 
! </dl>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_pipelining_enable">postscreen_pipelining_enable</a>
! (default: no)</b></DT><DD>
! 
! <p> Enable "pipelining" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
! server. These tests are expensive: a good client must disconnect
! after it passes the test, before it can talk to a real Postfix SMTP
! server. </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_pipelining_ttl">postscreen_pipelining_ttl</a>
! (default: 30d)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful "pipelining" SMTP protocol test. During this time, the
! client IP address is excluded from this test. The default is
! long because a good client must disconnect after it passes the test,
! before it can talk to a real Postfix SMTP server. </p>
! 
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_post_queue_limit">postscreen_post_queue_limit</a>
! (default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b></DT><DD>
! 
! <p> The number of clients that can be waiting for service from a
! real SMTP server process. When this queue is full, all clients will
! receive a 421 reponse. </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_pre_queue_limit">postscreen_pre_queue_limit</a>
! (default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b></DT><DD>
! 
! <p> The number of non-whitelisted clients that can be waiting for
! a decision whether they will receive service from a real SMTP server
! process. When this queue is full, all non-whitelisted clients will
! receive a 421 reponse. </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_reject_footer">postscreen_reject_footer</a>
! (default: $<a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a>)</b></DT><DD>
! 
! <p> Optional information that is appended after a 4XX or 5XX server
! response. See <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> for further details.  </p>
! 
! <p> This feature is available in Postfix 2.8 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_tls_security_level">postscreen_tls_security_level</a>
! (default: $<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b></DT><DD>
! 
! <p> The SMTP TLS security level for the <a href="postscreen.8.html">postscreen(8)</a> server; when
! a non-empty value is specified, this overrides the obsolete parameters
! <a href="postconf.5.html#postscreen_use_tls">postscreen_use_tls</a> and <a href="postconf.5.html#postscreen_enforce_tls">postscreen_enforce_tls</a>. See <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>
! for details. </p>
! 
! <p> This feature is available in Postfix 2.8 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="postscreen_use_tls">postscreen_use_tls</a>
! (default: $<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b></DT><DD>
! 
! <p> Opportunistic TLS: announce STARTTLS support to SMTP clients,
! but do not require that clients use TLS encryption. </p>
! 
! <p> This feature is available in Postfix 2.8 and later.
! Preferably, use <a href="postconf.5.html#postscreen_tls_security_level">postscreen_tls_security_level</a> instead. </p>
  
--- 6105,6107 ----
  only domains whose primary MX hosts match the listed networks.
! </p>
  
***************
*** 7545,7562 ****
  
! <DT><b><a name="postscreen_watchdog_timeout">postscreen_watchdog_timeout</a>
! (default: 10s)</b></DT><DD>
! 
! <p> How much time a <a href="postscreen.8.html">postscreen(8)</a> process may take to respond to
! an SMTP client command or to perform a cache operation before it
! is terminated by a built-in watchdog timer.  This is a safety
! mechanism that prevents <a href="postscreen.8.html">postscreen(8)</a> from becoming non-responsive
! due to a bug in Postfix itself or in system software.  To avoid
! false alarms and unnecessary cache corruption this limit cannot be
! set under 10s.  </p>
  
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6110,6122 ----
  
! <DT><b><a name="pickup_service_name">pickup_service_name</a>
! (default: pickup)</b></DT><DD>
  
! <p>
! The name of the <a href="pickup.8.html">pickup(8)</a> service. This service picks up local mail
! submissions from the Postfix <a href="QSHAPE_README.html#maildrop_queue">maildrop queue</a>.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
***************
*** 7565,7594 ****
  
! <DT><b><a name="postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a>
! (default: <a href="DATABASE_README.html#types">static</a>:all)</b></DT><DD>
! 
! <p> A list of local <a href="postscreen.8.html">postscreen(8)</a> server IP addresses where a
! non-whitelisted SMTP client can obtain <a href="postscreen.8.html">postscreen(8)</a>'s temporary
! whitelist status. This status is required before the client can
! talk to a Postfix SMTP server process.  By default, a client can
! obtain <a href="postscreen.8.html">postscreen(8)</a>'s whitelist status on any local <a href="postscreen.8.html">postscreen(8)</a>
! server IP address. </p>
  
! <p> When <a href="postscreen.8.html">postscreen(8)</a> listens on both primary and backup MX
! addresses, the <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> parameter can be
! configured to give the temporary whitelist status only when a client
! connects to a primary MX address. Once a client is whitelisted it
! can talk to a Postfix SMTP server on any address. Thus, clients
! that connect only to backup MX addresses will never become whitelisted,
! and will never be allowed to talk to a Postfix SMTP server process.
  </p>
  
! <p> Example: </p>
! 
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     # Don't whitelist connections to the backup IP address.
!     <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> = !168.100.189.8, <a href="DATABASE_README.html#types">static</a>:all
! </pre>
! 
! <p> This feature is available in Postfix 2.9 and later.  </p>
  
--- 6125,6135 ----
  
! <DT><b><a name="plaintext_reject_code">plaintext_reject_code</a>
! (default: 450)</b></DT><DD>
  
! <p>
! The numerical Postfix SMTP server response code when a request
! is rejected by the <b><a href="postconf.5.html#reject_plaintext_session">reject_plaintext_session</a></b> restriction.
  </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 7758,7782 ****
  
- <DT><b><a name="proxymap_service_name">proxymap_service_name</a>
- (default: proxymap)</b></DT><DD>
- 
- <p> The name of the proxymap read-only table lookup service.  This
- service is normally implemented by the <a href="proxymap.8.html">proxymap(8)</a> daemon. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="proxywrite_service_name">proxywrite_service_name</a>
- (default: proxywrite)</b></DT><DD>
- 
- <p> The name of the proxywrite read-write table lookup service.
- This service is normally implemented by the <a href="proxymap.8.html">proxymap(8)</a> daemon.
- </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="qmgr_clog_warn_time">qmgr_clog_warn_time</a>
--- 6299,6300 ----
***************
*** 7800,7818 ****
  
- <DT><b><a name="qmgr_daemon_timeout">qmgr_daemon_timeout</a>
- (default: 1000s)</b></DT><DD>
- 
- <p> How much time a Postfix queue manager process may take to handle
- a request before it is terminated by a built-in watchdog timer.
- </p>
- 
- <p>
- Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
- The default time unit is s (seconds).
- </p>
- 
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="qmgr_fudge_factor">qmgr_fudge_factor</a>
--- 6318,6319 ----
***************
*** 7834,7853 ****
  
- <DT><b><a name="qmgr_ipc_timeout">qmgr_ipc_timeout</a>
- (default: 60s)</b></DT><DD>
- 
- <p> The time limit for the queue manager to send or receive information
- over an internal communication channel.  The purpose is to break
- out of deadlock situations. If the time limit is exceeded the
- software either retries or aborts the operation. </p>
- 
- <p>
- Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
- The default time unit is s (seconds).
- </p>
- 
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="qmgr_message_active_limit">qmgr_message_active_limit</a>
--- 6335,6336 ----
***************
*** 8007,8011 ****
  <p>
! By default, the Postfix SMTP server rejects MAIL FROM commands when
! the amount of free space is less than 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>
! (Postfix version 2.1 and later).
  To specify a higher minimum free space limit, specify a <a href="postconf.5.html#queue_minfree">queue_minfree</a>
--- 6490,6493 ----
  <p>
! By default, the Postfix version 2.1 SMTP server rejects MAIL FROM commands
! when the amount of free space is less than 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>.
  To specify a higher minimum free space limit, specify a <a href="postconf.5.html#queue_minfree">queue_minfree</a>
***************
*** 8197,8200 ****
  To avoid mailer loops, automatic BCC recipients are not generated
! after Postfix forwards mail internally, or after Postfix generates
! mail itself. </p>
  
--- 6679,6682 ----
  To avoid mailer loops, automatic BCC recipients are not generated
! for mail that Postfix forwards internally, nor for mail that Postfix
! generates itself. </p>
  
***************
*** 8288,8308 ****
  
- <DT><b><a name="reject_tempfail_action">reject_tempfail_action</a>
- (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>)</b></DT><DD>
- 
- <p> The Postfix SMTP server's action when a reject-type restriction
- fails due to a temporary error condition. Specify "defer" to defer
- the remote SMTP client request immediately. With the default
- "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
- for opportunities to reject mail, and defers the client request
- only if it would otherwise be accepted. </p>
- 
- <p> For finer control, see: <a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a>,
- <a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a>, <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a>,
- and <a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a>.  </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="relay_clientcerts">relay_clientcerts</a>
--- 6770,6771 ----
***************
*** 8468,8471 ****
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> destination is optional; its syntax is documented
! in the manual page of the corresponding delivery agent.
  </p>
--- 6931,6934 ----
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> part is optional.  For more details see the
! <a href="transport.5.html">transport(5)</a> manual page.
  </p>
***************
*** 8490,8493 ****
  domains in recipient addresses. This information is overruled with
! <a href="postconf.5.html#relay_transport">relay_transport</a>, <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>,
! <a href="postconf.5.html#default_transport">default_transport</a>, <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
  and with the <a href="transport.5.html">transport(5)</a> table.
--- 6953,6955 ----
  domains in recipient addresses. This information is overruled with
! <a href="postconf.5.html#relay_transport">relay_transport</a>, <a href="postconf.5.html#default_transport">default_transport</a>, <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
  and with the <a href="transport.5.html">transport(5)</a> table.
***************
*** 8518,8520 ****
  <a href="postconf.5.html#relayhost">relayhost</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
! <a href="postconf.5.html#relayhost">relayhost</a> = [gateway.example.com]
  <a href="postconf.5.html#relayhost">relayhost</a> = uucphost
--- 6980,6982 ----
  <a href="postconf.5.html#relayhost">relayhost</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
! <a href="postconf.5.html#relayhost">relayhost</a> = [gateway.my.domain]
  <a href="postconf.5.html#relayhost">relayhost</a> = uucphost
***************
*** 8590,8648 ****
  <p>
! Require that a <a href="local.8.html">local(8)</a> recipient's home directory exists
  before mail delivery is attempted. By default this test is disabled.
  It can be useful for environments that import home directories to
! the mail server (IMPORTING HOME DIRECTORIES IS NOT RECOMMENDED).
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="reset_owner_alias">reset_owner_alias</a>
! (default: no)</b></DT><DD>
! 
! <p> Reset the <a href="local.8.html">local(8)</a> delivery agent's idea of the owner-alias
! attribute, when delivering mail to a child alias that does not have
! its own owner alias. </p>
! 
! <p> This feature is available in Postfix 2.8 and later. With older
! Postfix releases, the behavior is as if this parameter is set to
! "yes". </p>
! 
! <p> As documented in <a href="aliases.5.html">aliases(5)</a>, when an alias <i>name</i> has a
! companion alias named owner-<i>name</i>, delivery errors will be
! reported to the owner alias instead of the sender. This configuration
! is recommended for mailing lists. <p>
! 
! <p> A less known property of the owner alias is that it also forces
! the <a href="local.8.html">local(8)</a> delivery agent to write local and remote addresses
! from alias expansion to a new queue file, instead of attempting to
! deliver mail to local addresses as soon as they come out of alias
! expansion.  </p>
! 
! <p> Writing local addresses from alias expansion to a new queue
! file allows for robust handling of temporary delivery errors: errors
! with one local member have no effect on deliveries to other members
! of the list.  On the other hand, delivery to local addresses as
! soon as they come out of alias expansion is fragile: a temporary
! error with one local address from alias expansion will cause the
! entire alias to be expanded repeatedly until the error goes away,
! or until the message expires in the queue.  In that case, a problem
! with one list member results in multiple message deliveries to other
! list members. </p>
! 
! <p> The default behavior of Postfix 2.8 and later is to keep the
! owner-alias attribute of the parent alias, when delivering mail to
! a child alias that does not have its own owner alias. Then, local
! addresses from that child alias will be written to a new queue file,
! and a temporary error with one local address will not affect delivery
! to other mailing list members. </p>
! 
! <p> Unfortunately, older Postfix releases reset the owner-alias
! attribute when delivering mail to a child alias that does not have
! its own owner alias.  The <a href="local.8.html">local(8)</a> delivery agent then attempts to
! deliver local addresses as soon as they come out of child alias
! expansion.  If delivery to any address from child alias expansion
! fails with a temporary error condition, the entire mailing list may
! be expanded repeatedly until the mail expires in the queue, resulting
! in multiple deliveries of the same message to mailing list members.
  </p>
--- 7052,7057 ----
  <p>
! Whether or not a <a href="local.8.html">local(8)</a> recipient's home directory must exist
  before mail delivery is attempted. By default this test is disabled.
  It can be useful for environments that import home directories to
! the mail server (NOT RECOMMENDED).
  </p>
***************
*** 8723,8726 ****
  The name of the directory with example Postfix configuration files.
- Starting with Postfix 2.1, these files have been replaced with the
- <a href="postconf.5.html">postconf(5)</a> manual page.
  </p>
--- 7132,7133 ----
***************
*** 8805,8808 ****
  To avoid mailer loops, automatic BCC recipients are not generated
! after Postfix forwards mail internally, or after Postfix generates
! mail itself. </p>
  
--- 7212,7215 ----
  To avoid mailer loops, automatic BCC recipients are not generated
! for mail that Postfix forwards internally, nor for mail that Postfix
! generates itself. </p>
  
***************
*** 8864,8888 ****
  
- <DT><b><a name="sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>
- (default: empty)</b></DT><DD>
- 
- <p> A sender-dependent override for the global <a href="postconf.5.html#default_transport">default_transport</a>
- parameter setting. The tables are searched by the envelope sender
- address and @domain. A lookup result of DUNNO terminates the search
- without overriding the global <a href="postconf.5.html#default_transport">default_transport</a> parameter setting.
- This information is overruled with the <a href="transport.5.html">transport(5)</a> table. </p>
- 
- <p> Note: this overrides <a href="postconf.5.html#default_transport">default_transport</a>, not <a href="postconf.5.html#transport_maps">transport_maps</a>, and
- therefore the expected syntax is that of <a href="postconf.5.html#default_transport">default_transport</a>, not the
- syntax of <a href="postconf.5.html#transport_maps">transport_maps</a>.  Specifically, this does not support the
- <a href="postconf.5.html#transport_maps">transport_maps</a> syntax for null transport, null nexthop, or null
- email addresses. </p>
- 
- <p> For safety reasons, this feature does not allow $number
- substitutions in regular expression maps. </p>
- 
- <p> This feature is available in Postfix 2.7 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
--- 7271,7272 ----
***************
*** 8892,8898 ****
  setting. The tables are searched by the envelope sender address and
! @domain. A lookup result of DUNNO terminates the search without
! overriding the global <a href="postconf.5.html#relayhost">relayhost</a> parameter setting (Postfix 2.6 and
! later). This information is overruled with <a href="postconf.5.html#relay_transport">relay_transport</a>,
! <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>, <a href="postconf.5.html#default_transport">default_transport</a> and with
! the <a href="transport.5.html">transport(5)</a> table. </p>
  
--- 7276,7279 ----
  setting. The tables are searched by the envelope sender address and
! @domain. This information is overruled with <a href="postconf.5.html#relay_transport">relay_transport</a>,
! <a href="postconf.5.html#default_transport">default_transport</a> and with the <a href="transport.5.html">transport(5)</a> table. </p>
  
***************
*** 8980,8994 ****
  
- <DT><b><a name="smtp_address_preference">smtp_address_preference</a>
- (default: ipv6)</b></DT><DD>
- 
- <p> The address type ("ipv6", "ipv4" or "any") that the Postfix
- SMTP client will try first, when a destination has IPv6 and IPv4
- addresses with equal MX preference. This feature has no effect
- unless the <a href="postconf.5.html#inet_protocols">inet_protocols</a> setting enables both IPv4 and IPv6.  </p>
- 
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtp_always_send_ehlo">smtp_always_send_ehlo</a>
--- 7361,7362 ----
***************
*** 9408,9438 ****
  
- <DT><b><a name="smtp_dns_resolver_options">smtp_dns_resolver_options</a>
- (default: empty)</b></DT><DD>
- 
- <p> DNS Resolver options for the Postfix SMTP client.  Specify zero
- or more of the following options, separated by comma or whitespace.
- Option names are case-sensitive. Some options refer to domain names
- that are specified in the file /etc/resolv.conf or equivalent. </p>
- 
- <dl>
- 
- <dt><b>res_defnames</b></dt>
- 
- <dd> Append the current domain name to single-component names (those
- that do not contain a "." character). This can produce incorrect
- results, and is the hard-coded behavior prior to Postfix 2.8. </dd>
- 
- <dt><b>res_dnsrch</b></dt>
- 
- <dd> Search for host names in the current domain and in parent
- domains. This can produce incorrect results and is therefore not
- recommended. </dd>
- 
- </dl>
- 
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtp_enforce_tls">smtp_enforce_tls</a>
--- 7776,7777 ----
***************
*** 9574,9578 ****
  <p>
! What mechanisms the Postfix SMTP client uses to look up a host's IP
! address.  This parameter is ignored when DNS lookups are disabled
! (see: <a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a>).
  </p>
--- 7913,7916 ----
  <p>
! What mechanisms when the Postfix SMTP client uses to look up a host's IP
! address.  This parameter is ignored when DNS lookups are disabled.
  </p>
***************
*** 9706,9730 ****
  
- <DT><b><a name="smtp_per_record_deadline">smtp_per_record_deadline</a>
- (default: no)</b></DT><DD>
- 
- <p> Change the behavior of the smtp_*_timeout time limits, from a
- time limit per read or write system call, to a time limit to send
- or receive a complete record (an SMTP command line, SMTP response
- line, SMTP message content line, or TLS protocol message).  This
- limits the impact from hostile peers that trickle data one byte at
- a time.  </p>
- 
- <p> Note: when per-record deadlines are enabled, a short timeout
- may cause problems with TLS over very slow network connections.
- The reasons are that a TLS protocol message can be up to 16 kbytes
- long (with TLSv1), and that an entire TLS protocol message must be
- sent or received within the per-record deadline.  </p>
- 
- <p> This feature is available in Postfix 2.9 and later. With older
- Postfix releases, the behavior is as if this parameter is set to
- "no". </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a>
--- 8044,8045 ----
***************
*** 9886,9940 ****
  
- <DT><b><a name="smtp_reply_filter">smtp_reply_filter</a>
- (default: empty)</b></DT><DD>
- 
- <p> A mechanism to transform replies from remote SMTP servers one
- line at a time.  This is a last-resort tool to work around server
- replies that break inter-operability with the Postfix SMTP client.
- Other uses involve fault injection to test Postfix's handling of
- invalid responses. </p>
- 
- <p> Notes: </p>
- 
- <ul>
- 
- <li> <p> In the case of a multi-line reply, the Postfix SMTP client
- uses the final reply line's numerical SMTP reply code and enhanced
- status code.  </p>
- 
- <li> <p> The numerical SMTP reply code (XYZ) takes precedence over
- the enhanced status code (X.Y.Z).  When the enhanced status code
- initial digit differs from the SMTP reply code initial digit, or
- when no enhanced status code is present, the Postfix SMTP client
- uses a generic enhanced status code (X.0.0) instead. </p>
- 
- </ul>
- 
- <p> Specify the name of a "<a href="DATABASE_README.html">type:table</a>" lookup table. The search
- string is a single SMTP reply line as received from the remote SMTP
- server, except that the trailing &lt;CR&gt;&lt;LF&gt; are removed.
- When the lookup succeeds, the result replaces the single SMTP reply
- line. </p>
- 
- <p> Examples: </p>
- 
- <pre>
- /etc/postfix/<a href="postconf.5.html">main.cf</a>:
-     <a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/reply_filter
- </pre>
- 
- <pre>
- /etc/postfix/reply_filter:
-     # Transform garbage into "250-filler..." so that it looks like
-     # one line from a multi-line reply. It does not matter what we
-     # substitute here as long it has the right syntax.  The Postfix
-     # SMTP client will use the final line's numerical SMTP reply
-     # code and enhanced status code.
-     !/^([2-5][0-9][0-9]($|[- ]))/ 250-filler for garbage
- </pre>
- 
- <p> This feature is available in Postfix 2.7. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtp_rset_timeout">smtp_rset_timeout</a>
--- 8201,8202 ----
***************
*** 10074,10076 ****
  <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = /etc/postfix/smtp_mechs
! <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = !gssapi, !login, <a href="DATABASE_README.html#types">static</a>:rest
  </pre>
--- 8336,8338 ----
  <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = /etc/postfix/smtp_mechs
! <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = !gssapi, !login, static:rest
  </pre>
***************
*** 10181,10199 ****
  client uses for TLS encrypted SMTP sessions with a verified server
! certificate. </p>
! 
! <p> When mail is sent to the public MX host for the recipient's
! domain, server certificates are by default optional, and delivery
! proceeds even if certificate verification fails. For delivery via
! a submission service that requires SASL authentication, it may be
! appropriate to send plaintext passwords only when the connection
! to the server is strongly encrypted <b>and</b> the server identity
! is verified. </p>
! 
! <p> The <a href="postconf.5.html#smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a> parameter makes it
! possible to only enable plaintext mechanisms when a secure connection
! to the server is available. Submission servers subject to this
! policy must either have verifiable certificates or offer suitable
! non-plaintext SASL mechanisms. </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
  
--- 8443,8446 ----
  client uses for TLS encrypted SMTP sessions with a verified server
! certificate. This feature is under construction as of Postfix version
! 2.3. </p>
  
***************
*** 10314,10328 ****
  
! <p> A file containing CA certificates of root CAs trusted to sign
! either remote SMTP server certificates or intermediate CA certificates.
! These are loaded into memory before the <a href="smtp.8.html">smtp(8)</a> client enters the
! chroot jail. If the number of trusted roots is large, consider using
! <a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> instead, but note that the latter directory must be
! present in the chroot jail if the <a href="smtp.8.html">smtp(8)</a> client is chrooted. This
! file may also be used to augment the client certificate trust chain,
! but it is best to include all the required certificates directly in
! $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>. </p>
! 
! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
! appending the system-supplied default CAs and trusting third-party
! certificates. </p>
  
--- 8561,8566 ----
  
! <p> The file with the certificate of the certification authority
! (CA) that issued the Postfix SMTP client certificate.  This is
! needed only when the CA certificate is not already present in the
! client certificate file.  </p>
  
***************
*** 10351,10356 ****
  
- <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
- appending the system-supplied default CAs and trusting third-party
- certificates. </p>
- 
  <p> Example: </p>
--- 8589,8590 ----
***************
*** 10366,10382 ****
  
- <DT><b><a name="smtp_tls_block_early_mail_reply">smtp_tls_block_early_mail_reply</a>
- (default: no)</b></DT><DD>
- 
- <p> Try to detect a mail hijacking attack based on a TLS protocol
- vulnerability (CVE-2009-3555), where an attacker prepends malicious
- HELO, MAIL, RCPT, DATA commands to a Postfix SMTP client TLS session.
- The attack would succeed with non-Postfix SMTP servers that reply
- to the malicious HELO, MAIL, RCPT, DATA commands after negotiating
- the Postfix SMTP client TLS session.  </p>
- 
- <p> This feature is available in Postfix 2.7. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtp_tls_cert_file">smtp_tls_cert_file</a>
--- 8600,8601 ----
***************
*** 10397,10403 ****
  <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> =
- <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> =
  <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> =
  <a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a> =
- <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> =
- <a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> =
  </pre>
--- 8616,8620 ----
  <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> =
  <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> =
+ <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> =
  <a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a> =
  </pre>
***************
*** 10408,10417 ****
  
! <p> To enable remote SMTP servers to verify the Postfix SMTP client
! certificate, the issuing CA certificates must be made available to the
! server. You should include the required certificates in the client
! certificate file, the client certificate first, then the issuing
! CA(s) (bottom-up order). </p>
  
! <p> Example: the certificate for "client.example.com" was issued by
! "intermediate CA" which itself has a certificate issued by "root CA".
  Create the client.pem file with "cat client_cert.pem intermediate_CA.pem
--- 8625,8633 ----
  
! <p> In order to verify certificates, the CA certificate (in case
! of a certificate chain, all CA certificates) must be available.
! You should add these certificates to the client certificate, the
! client certificate first, then the issuing CA(s). </p>
  
! <p> Example: the certificate for "client.dom.ain" was issued by
! "intermediate CA" which itself has a certificate of "root CA".
  Create the client.pem file with "cat client_cert.pem intermediate_CA.pem
***************
*** 10420,10424 ****
  <p> If you also want to verify remote SMTP server certificates issued by
! these CAs, you can add the CA certificates to the <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>, in
! which case it is not necessary to have them in the <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>,
! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> or <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>. </p>
  
--- 8636,8640 ----
  <p> If you also want to verify remote SMTP server certificates issued by
! these CAs, you can also add the CA certificates to the <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>,
! in which case it is not necessary to have them in the <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>
! or <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>. </p>
  
***************
*** 10458,10487 ****
  
- <DT><b><a name="smtp_tls_ciphers">smtp_tls_ciphers</a>
- (default: export)</b></DT><DD>
- 
- <p> The minimum TLS cipher grade that the Postfix SMTP client
- will use with opportunistic TLS encryption. Cipher types listed in
- <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> are excluded from the base definition of
- the selected cipher grade. The default value "export" ensures maximum
- inter-operability. Because encryption is optional, stronger controls
- are not appropriate, and this setting SHOULD NOT be changed unless the
- change is essential. </p>
- 
- <p> When TLS is mandatory the cipher grade is chosen via the
- <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
- details. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure
- ciphers on a per-destination basis. </p>
- 
- <p> Example: </p>
- <pre>
- <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = export
- </pre>
- 
- <p> This feature is available in Postfix 2.6 and later. With earlier Postfix
- releases only the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter is implemented,
- and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtp_tls_dcert_file">smtp_tls_dcert_file</a>
--- 8674,8675 ----
***************
*** 10514,10518 ****
  <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
  
--- 8702,8705 ----
  <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted, but file permissions should grant read/write
! access only to the system superuser account ("root"). </p>
  
***************
*** 10523,10563 ****
  
- <DT><b><a name="smtp_tls_eccert_file">smtp_tls_eccert_file</a>
- (default: empty)</b></DT><DD>
- 
- <p> File with the Postfix SMTP client ECDSA certificate in PEM format.
- This file may also contain the Postfix SMTP client ECDSA private key. </p>
- 
- <p> See the discussion under <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for more details.
- </p>
- 
- <p> Example: </p>
- 
- <pre>
- <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> = /etc/postfix/ecdsa-ccert.pem
- </pre>
- 
- <p> This feature is available in Postfix 2.6 and later, when Postfix is
- compiled and linked with OpenSSL 1.0.0 or later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="smtp_tls_eckey_file">smtp_tls_eckey_file</a>
- (default: $<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>)</b></DT><DD>
- 
- <p> File with the Postfix SMTP client ECDSA private key in PEM format.
- This file may be combined with the Postfix SMTP client ECDSA
- certificate file specified with $<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>. </p>
- 
- <p> The private key must be accessible without a pass-phrase, i.e. it
- must not be encrypted. File permissions should grant read-only
- access to the system superuser account ("root"), and no access
- to anyone else. </p>
- 
- <p> This feature is available in Postfix 2.6 and later, when Postfix is
- compiled and linked with OpenSSL 1.0.0 or later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
--- 8710,8711 ----
***************
*** 10739,10743 ****
  <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
  
--- 8887,8890 ----
  <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted, but file permissions should grant read/write
! access only to the system superuser account ("root"). </p>
  
***************
*** 10792,10794 ****
  for most destinations with which you may want to enforce TLS, and
! is beyond the reach of today's cryptanalytic methods. See
  <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure ciphers
--- 8939,8941 ----
  for most destinations with which you may want to enforce TLS, and
! is beyond the reach of today's crypt-analytic methods. See
  <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure ciphers
***************
*** 10800,10803 ****
  <dt><b>export</b></dt>
! <dd> Enable "EXPORT" grade or better OpenSSL
! ciphers.  This is the default for opportunistic encryption. It is
  not recommended for mandatory encryption unless you must enforce TLS
--- 8947,8950 ----
  <dt><b>export</b></dt>
! <dd> Enable the mainstream "EXPORT" grade or better OpenSSL
! ciphers.  This is always used for opportunistic encryption. It is
  not recommended for mandatory encryption unless you must enforce TLS
***************
*** 10805,10827 ****
  <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. </dd>
  
  <dt><b>low</b></dt>
! <dd> Enable "LOW" grade or better OpenSSL ciphers.  This
  setting is only appropriate for internal mail servers.  The underlying
  cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration
! parameter, which you are strongly encouraged to not change. </dd>
  
  <dt><b>medium</b></dt>
! <dd> Enable "MEDIUM" grade or better OpenSSL ciphers.
  The underlying cipherlist is specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
  configuration parameter, which you are strongly encouraged to not change.
! </dd>
  
  <dt><b>high</b></dt>
! <dd> Enable only "HIGH" grade OpenSSL ciphers.  This setting may
! be appropriate when all mandatory TLS destinations (e.g. when all
! mail is routed to a suitably capable <a href="postconf.5.html#relayhost">relayhost</a>) support at least one
! "HIGH" grade cipher. The underlying cipherlist is specified via the
! <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. </dd>
  
--- 8952,8989 ----
  <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. The default value of <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a>
! includes anonymous ciphers, but these are automatically filtered out if
! the client is configured to verify server certificates. If you must
! exclude anonymous ciphers also at the "encrypt" security level, set
! "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
  <dt><b>low</b></dt>
! <dd> Enable the mainstream "LOW" grade or better OpenSSL ciphers.  This
  setting is only appropriate for internal mail servers.  The underlying
  cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration
! parameter, which you are strongly encouraged to not change. The default
! value of <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> includes anonymous ciphers, but these are
! automatically filtered out if the client is configured to verify server
! certificates. If you must exclude anonymous ciphers also at the "encrypt"
! security level, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
  <dt><b>medium</b></dt>
! <dd> Enable the mainstream "MEDIUM" grade or better OpenSSL ciphers.
  The underlying cipherlist is specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
  configuration parameter, which you are strongly encouraged to not change.
! The default value of <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> includes anonymous ciphers,
! but these are automatically filtered out if the client is configured to
! verify server certificates. If you must exclude anonymous ciphers also
! at the "encrypt" security level, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>
! = aNULL". </dd>
  
  <dt><b>high</b></dt>
! <dd> Enable only the mainstream "HIGH" grade OpenSSL ciphers.  This
! setting is appropriate when all mandatory TLS destinations support
! some of "HIGH" grade ciphers, this is not uncommon. The underlying
! cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> configuration
! parameter, which you are strongly encouraged to not change. The default
! value of <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> includes anonymous ciphers, but these are
! automatically filtered out if the client is configured to verify server
! certificates. If you must exclude anonymous ciphers also at the "encrypt"
! security level, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
***************
*** 10835,10837 ****
  configuration parameter, which you are strongly encouraged to not
! change. </dd>
  
--- 8997,9001 ----
  configuration parameter, which you are strongly encouraged to not
! change. The default value of <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> excludes anonymous
! ciphers (OpenSSL 0.9.8 has NULL ciphers that offer data integrity without
! encryption or authentication). </dd>
  
***************
*** 10839,10850 ****
  
- <p> The underlying cipherlists for grades other than "null" include
- anonymous ciphers, but these are automatically filtered out if the
- Postfix SMTP client is configured to verify server certificates.
- You are very unlikely to need to take any steps to exclude anonymous
- ciphers, they are excluded automatically as necessary.  If you must
- exclude anonymous ciphers at the "may" or "encrypt" security levels,
- when the Postfix SMTP client does not need or use peer certificates, set
- "<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers only when
- TLS is enforced, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </p>
- 
  <p> This feature is available in Postfix 2.3 and later. </p>
--- 9003,9004 ----
***************
*** 10862,10867 ****
  
- <p> Starting with Postfix 2.6, the mandatory cipher exclusions can be
- specified on a per-destination basis via the TLS policy "exclude"
- attribute. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for notes and examples. </p>
- 
  <p> This feature is available in Postfix 2.3 and later. </p>
--- 9016,9017 ----
***************
*** 10986,10991 ****
  of how the policy is specified, the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters apply when TLS encryption
! is mandatory. Connections for which encryption is optional typically
! enable all "export" grade and better ciphers (see <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>
! and <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>). </p>
  
--- 9136,9140 ----
  of how the policy is specified, the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters only apply when TLS encryption
! is mandatory. Connections for which encryption is optional enable
! all "export" grade and better ciphers. </p>
  
***************
*** 11045,11053 ****
  <dt><b>may</b></dt>
! <dd>Opportunistic TLS. Since sending in the clear is acceptable,
! demanding stronger than default TLS security merely reduces
! inter-operability. The optional "ciphers", "exclude" and "protocols"
! attributes (available for opportunistic TLS with Postfix &ge; 2.6)
! override the "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>", "<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>" and
! "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>" configuration parameters. When opportunistic TLS
! handshakes fail, Postfix retries the connection with TLS disabled.
  This allows mail delivery to sites with non-interoperable TLS
--- 9194,9202 ----
  <dt><b>may</b></dt>
! <dd>Opportunistic TLS. No additional attributes are supported at this
! level. Since sending in the clear is acceptable, demanding stronger
! than default TLS security parameters merely reduces inter-operability.
! Postfix 2.3 and later ignore the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters at this security level; all
! protocols are allowed and "export" grade or better ciphers are used.
! When TLS handshakes fail, the connection is retried with TLS disabled.
  This allows mail delivery to sites with non-interoperable TLS
***************
*** 11056,11063 ****
  <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. At this level
! and higher, the optional "protocols" attribute overrides the <a href="postconf.5.html">main.cf</a>
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameter, the optional "ciphers" attribute
! overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter, and the
! optional "exclude" attribute (Postfix &ge; 2.6) overrides the <a href="postconf.5.html">main.cf</a>
! <a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> parameter. In the policy table,
! multiple protocols or excluded ciphers must be separated by colons,
  as attribute values may not contain whitespace or commas. </dd>
--- 9205,9210 ----
  <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. At this level
! and higher the optional "ciphers" attribute overrides the <a href="postconf.5.html">main.cf</a>
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter and the optional "protocols"
! keyword overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameter.
! In the policy table, multiple protocols must be separated by colons,
  as attribute values may not contain whitespace or commas. </dd>
***************
*** 11143,11178 ****
  
- <DT><b><a name="smtp_tls_protocols">smtp_tls_protocols</a>
- (default: !SSLv2)</b></DT><DD>
- 
- <p> List of TLS protocols that the Postfix SMTP client will exclude or
- include with opportunistic TLS encryption. Starting with Postfix 2.6,
- the Postfix SMTP client will by default not use the obsolete SSLv2
- protocol. </p>
- 
- <p> In <a href="postconf.5.html">main.cf</a> the values are separated by whitespace, commas or
- colons. In the policy table (see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid
- separator is colon. An empty value means allow all protocols. The valid
- protocol names, (see <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3"
- and "TLSv1". </p>
- 
- <p> To include a protocol list its name, to exclude it, prefix the name
- with a "!" character. To exclude SSLv2 even for opportunistic TLS set
- "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
- "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3". Explicitly listing the protocols to
- include, is supported, but not recommended. OpenSSL provides no mechanisms
- for excluding protocols not known at compile-time. If Postfix is linked
- against an OpenSSL library that supports additional protocol versions,
- they cannot be excluded using either syntax. </p>
- 
- <p> Example: </p>
- <pre>
- # TLSv1 only!
- <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3
- </pre>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>
--- 9290,9291 ----
***************
*** 11258,11268 ****
  <dt><b>may</b></dt>
! <dd> Opportunistic TLS. Use TLS if this is supported by the remote
! SMTP server, otherwise use plaintext. Since
  sending in the clear is acceptable, demanding stronger than default TLS
! security merely reduces inter-operability.
! The "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>" and "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>" (Postfix &ge; 2.6)
! configuration parameters provide control over the protocols and
! cipher grade used with opportunistic TLS.  With earlier releases the
! opportunistic TLS cipher grade is always "export" and no protocols
! are disabled.
  When TLS handshakes fail, the connection is retried with TLS disabled.
--- 9371,9378 ----
  <dt><b>may</b></dt>
! <dd> Opportunistic TLS. TLS will be used if supported by the server. Since
  sending in the clear is acceptable, demanding stronger than default TLS
! security parameters merely reduces inter-operability. Postfix 2.3 and
! later ignore the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters at this security level; all
! protocols are allowed and "export" grade or better ciphers are used.
  When TLS handshakes fail, the connection is retried with TLS disabled.
***************
*** 11272,11274 ****
  <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. Since a minimum
! level of security is intended, it is reasonable to be specific about
  sufficiently secure protocol versions and ciphers. At this security level
--- 9382,9384 ----
  <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. Since a minimum
! level of security is intended, it reasonable to be specific about
  sufficiently secure protocol versions and ciphers. At this security level
***************
*** 11322,11330 ****
  <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = may
- # Postfix &ge; 2.6:
- # Do not tweak opportunistic ciphers or protocol unless it is essential
- # to do so (if a security vulnerability is found in the SSL library that
- # can be mitigated by disabling a particular protocol or raising the
- # cipher grade from "export" to "low" or "medium").
- <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = export
- <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2
  </pre>
--- 9432,9433 ----
***************
*** 11745,11748 ****
  <p>
! Clients that are excluded from smtpd_client_*_count/rate_limit
! restrictions. See the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter
  description for the parameter value syntax.
--- 9848,9851 ----
  <p>
! Clients that are excluded from connection count, connection rate,
! or SMTP request rate restrictions. See the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter
  description for the parameter value syntax.
***************
*** 11872,11874 ****
  <p>
! By default, a client can send as many recipient addresses per time
  unit as Postfix can accept.
--- 9975,9977 ----
  <p>
! By default, a client can make as many recipient addresses per time
  unit as Postfix can accept.
***************
*** 11906,11909 ****
  SMTP connection request.
- See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
- restriction lists" for a discussion of evaluation context and time.
  </p>
--- 10009,10010 ----
***************
*** 11944,11961 ****
  
- <dt><b><a name="check_client_mx_access">check_client_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
- 
- <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for the
- client hostname, and execute the corresponding action.  Note: a result
- of "OK" is not allowed for safety reasons. Instead, use DUNNO in order
- to exclude specific hosts from blacklists.  This feature is available
- in Postfix 2.7 and later.  </dd>
- 
- <dt><b><a name="check_client_ns_access">check_client_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
- 
- <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers for
- the client hostname, and execute the corresponding action.  Note: a
- result of "OK" is not allowed for safety reasons. Instead, use DUNNO
- in order to exclude specific hosts from blacklists.  This feature is
- available in Postfix 2.7 and later.  </dd>
- 
  <dt><b><a name="check_reverse_client_hostname_access">check_reverse_client_hostname_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
--- 10045,10046 ----
***************
*** 11970,11987 ****
  
- <dt><b><a name="check_reverse_client_hostname_mx_access">check_reverse_client_hostname_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
- 
- <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for the
- unverified reverse client hostname, and execute the corresponding
- action.  Note: a result of "OK" is not allowed for safety reasons.
- Instead, use DUNNO in order to exclude specific hosts from blacklists.
- This feature is available in Postfix 2.7 and later.  </dd>
- 
- <dt><b><a name="check_reverse_client_hostname_ns_access">check_reverse_client_hostname_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
- 
- <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers for
- the unverified reverse client hostname, and execute the corresponding
- action.  Note: a result of "OK" is not allowed for safety reasons.
- Instead, use DUNNO in order to exclude specific hosts from blacklists.
- This feature is available in Postfix 2.7 and later.  </dd>
- 
  <dt><b><a name="permit_inet_interfaces">permit_inet_interfaces</a></b></dt>
--- 10055,10056 ----
***************
*** 12006,12012 ****
  CA issues the certificates and only this CA is listed as trusted
! CA. Otherwise, clients with a third-party certificate would also
! be allowed to relay.  Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" when the
! trusted CA is specified with <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> or <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>,
! to prevent Postfix from appending the system-supplied default CAs.
! This feature is available with Postfix version 2.2.</dd>
  
--- 10075,10078 ----
  CA issues the certificates and only this CA is listed as trusted
! CA, otherwise all clients with a recognized certificate would be
! allowed to relay. This feature is available with Postfix version 2.2.</dd>
  
***************
*** 12025,12032 ****
  listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
! (Postfix version 2.1 and later only).  Each "<i>d</i>" is a number,
! or a pattern inside "[]" that contains one or more ";"-separated
! numbers or number..number ranges (Postfix version 2.8 and later).
! If no "<i>=d.d.d.d</i>" is specified, reject the request when the
! reversed client network address is listed with any A record under
! <i>rbl_domain</i>. <br>
  The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
--- 10091,10095 ----
  listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
! (Postfix version 2.1 and later only).  If no "<i>=d.d.d.d</i>" is
! specified, reject the request when the reversed client network
! address is listed with any A record under <i>rbl_domain</i>. <br>
  The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
***************
*** 12037,12051 ****
  
- <dt><b><a name="permit_dnswl_client">permit_dnswl_client <i>dnswl_domain=d.d.d.d</i></a></b></dt>
- 
- <dd>Accept the request when the reversed client network address is
- listed with the A record "<i>d.d.d.d</i>" under <i>dnswl_domain</i>.
- Each "<i>d</i>" is a number, or a pattern inside "[]" that contains
- one or more ";"-separated numbers or number..number ranges.
- If no "<i>=d.d.d.d</i>" is specified, accept the request when the
- reversed client network address is listed with any A record under
- <i>dnswl_domain</i>. <br> For safety, <a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a> is silently
- ignored when it would override <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>.  The
- result is DEFER_IF_REJECT when whitelist lookup fails.  This feature
- is available in Postfix 2.8 and later.  </dd>
- 
  <dt><b><a name="reject_rhsbl_client">reject_rhsbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
--- 10100,10101 ----
***************
*** 12054,12094 ****
  A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
! 2.1 and later only).  Each "<i>d</i>" is a number, or a pattern
! inside "[]" that contains one or more ";"-separated numbers or
! number..number ranges (Postfix version 2.8 and later).  If no
! "<i>=d.d.d.d</i>" is specified, reject the request when the client
! hostname is listed with
  any A record under <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>
  description above for additional RBL related configuration parameters.
! This feature is available in Postfix 2.0 and later; with Postfix
! version 2.8 and later, <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a> will usually
! produce better results.  </dd>
! 
! <dt><b><a name="permit_rhswl_client">permit_rhswl_client <i>rhswl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Accept the request when the client hostname is listed with the
! A record "<i>d.d.d.d</i>" under <i>rhswl_domain</i>.  Each "<i>d</i>"
! is a number, or a pattern inside "[]" that contains one or more
! ";"-separated numbers or number..number ranges. If no
! "<i>=d.d.d.d</i>" is specified, accept the request when the client
! hostname is listed with any A record under <i>rhswl_domain</i>.
! <br> Caution: client name whitelisting is fragile, since the client
! name lookup can fail due to temporary outages.  Client name
! whitelisting should be used only to reduce false positives in e.g.
! DNS-based blocklists, and not for making access rule exceptions.
! <br> For safety, <a href="postconf.5.html#permit_rhswl_client">permit_rhswl_client</a> is silently ignored when it
! would override <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>.  The result is DEFER_IF_REJECT
! when whitelist lookup fails.  This feature is available in Postfix
! 2.8 and later.  </dd>
! 
! <dt><b><a name="reject_rhsbl_reverse_client">reject_rhsbl_reverse_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Reject the request when the unverified reverse client hostname
! is listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>.
! Each "<i>d</i>" is a number, or a pattern inside "[]" that contains
! one or more ";"-separated numbers or number..number ranges.
! If no "<i>=d.d.d.d</i>" is specified, reject the request when the
! unverified reverse client hostname is listed with any A record under
! <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description above for
! additional RBL related configuration parameters.  This feature is
! available in Postfix 2.8 and later.  </dd>
  
--- 10104,10110 ----
  A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
! 2.1 and later only).  If no "<i>=d.d.d.d</i>" is specified, reject
! the request when the client hostname is listed with
  any A record under <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>
  description above for additional RBL related configuration parameters.
! This feature is available in Postfix 2.0 and later.  </dd>
  
***************
*** 12195,12205 ****
  that improperly uses ESMTP command pipelining in order to speed up
! deliveries.
! <br> With Postfix 2.6 and later, the SMTP server sets a per-session
! flag whenever it detects illegal pipelining, including pipelined
! EHLO or HELO commands. The <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> feature simply
! tests whether the flag was set at any point in time during the
! session.
! <br> With older Postfix versions, <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> checks
! the current status of the input read queue, and its usage is not
! recommended in contexts other than <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a>.  </dd>
  
--- 10211,10217 ----
  that improperly uses ESMTP command pipelining in order to speed up
! deliveries. <br> Note: <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> is not useful
! outside <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> when 1) the client uses ESMTP (EHLO
! instead of HELO) and 2) with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes" (the
! default).  The use of <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> in the other
! restriction contexts is therefore not recommended.  </dd>
  
***************
*** 12209,12211 ****
  a restriction list, to make the default policy explicit.  The
! <a href="postconf.5.html#reject_code">reject_code</a> configuration parameter specifies the response code for
  rejected requests (default: 554).</dd>
--- 10221,10223 ----
  a restriction list, to make the default policy explicit.  The
! <a href="postconf.5.html#reject_code">reject_code</a> configuration parameter specifies the response code to
  rejected requests (default: 554).</dd>
***************
*** 12241,12331 ****
  
! <li> SMTP command specific restrictions that are described under
! the <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>, <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> parameters. When helo, sender or
! recipient restrictions are listed under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>,
! they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> is evaluated at the time of the RCPT TO
! command.
! 
! </ul>
! 
! <p>
! Example:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a>
! </pre>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_command_filter">smtpd_command_filter</a>
! (default: empty)</b></DT><DD>
! 
! <p> A mechanism to transform commands from remote SMTP clients.
! This is a last-resort tool to work around client commands that break
! inter-operability with the Postfix SMTP server.  Other uses involve
! fault injection to test Postfix's handling of invalid commands.
! </p>
! 
! <p> Specify the name of a "<a href="DATABASE_README.html">type:table</a>" lookup table. The search
! string is the SMTP command as received from the remote SMTP client,
! except that initial whitespace and the trailing &lt;CR&gt;&lt;LF&gt;
! are removed.  The result value is executed by the Postfix SMTP
! server.  </p>
! 
! <p> There is no need to use <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> for the following
! cases: </p>
! 
! <ul>
! 
! <li> <p> Use "<a href="postconf.5.html#resolve_numeric_domain">resolve_numeric_domain</a> = yes" to accept
! "<i>user@ipaddress</i>". </p>
! 
! <li> <p> Postfix already accepts the correct form
! "<i>user@[ipaddress]</i>". Use <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> or <a href="postconf.5.html#canonical_maps">canonical_maps</a>
! to translate these into domain names if necessary.  </p>
! 
! <li> <p> Use "<a href="postconf.5.html#strict_rfc821_envelopes">strict_rfc821_envelopes</a> = no" to accept "RCPT TO:&lt;<i>User
! Name &lt;user@example.com&gt;&gt;</i>". Postfix will ignore the "<i>User
! Name</i>" part and deliver to the <i>&lt;user@example.com&gt;</i> address.
! </p>
! 
! </ul>
! 
! <p> Examples of problems that can be solved with the <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a>
! feature: </p>
! 
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/command_filter
! </pre>
! 
! <pre>
! /etc/postfix/command_filter:
!     # Work around clients that send malformed HELO commands.
!     /^HELO\s*$/ HELO domain.invalid
! </pre>
  
! <pre>
!     # Work around clients that send empty lines.
!     /^\s*$/     NOOP
! </pre>
  
! <pre>
!     # Work around clients that send RCPT TO:&lt;'user@domain'&gt;.
!     # WARNING: do not lose the parameters that follow the address.
!     /^RCPT\s+TO:\s*&lt;'([^[:space:]]+)'&gt;(.*)/     RCPT TO:&lt;$1&gt;$2
! </pre>
  
  <pre>
!     # Bounce-never mail sink. Use <a href="postconf.5.html#notify_classes">notify_classes</a>=bounce,resource,software
!     # to send bounced mail to the postmaster (with message body removed).
!     /^(RCPT\s+TO:.*?)\bNOTIFY=\S+\b(.*)/ $1 NOTIFY=NEVER $2
!     /^(RCPT\s+TO:.*)/                    $1 NOTIFY=NEVER
  </pre>
  
- <p> This feature is available in Postfix 2.7. </p>
- 
  
--- 10253,10272 ----
  
! <li> SMTP command specific restrictions that are described under
! the <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>, <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> parameters. When helo, sender or
! recipient restrictions are listed under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>,
! they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> is evaluated at the time of the RCPT TO
! command.
  
! </ul>
  
! <p>
! Example:
! </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a>
  </pre>
  
  
***************
*** 12339,12342 ****
  in the context of the SMTP DATA command.
- See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
- restriction lists" for a discussion of evaluation context and time.
  </p>
--- 10280,10281 ----
***************
*** 12367,12374 ****
  
- <li>However, no recipient information is available in the case of
- multi-recipient mail. Acting on only one recipient would be misleading,
- because any decision will affect all recipients equally. Acting on
- all recipients would require a possibly very large amount of memory,
- and would also be misleading for the reasons mentioned before.
- 
  </ul>
--- 10306,10307 ----
***************
*** 12474,12479 ****
  <p> Optional access restrictions that the Postfix SMTP server
! applies in the context of the SMTP END-OF-DATA command.
! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
! restriction lists" for a discussion of evaluation context and time.
! </p>
  
--- 10407,10409 ----
  <p> Optional access restrictions that the Postfix SMTP server
! applies in the context of the SMTP END-OF-DATA command. </p>
  
***************
*** 12481,12483 ****
  
! <p> See <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> for details and limitations. </p>
  
--- 10411,10413 ----
  
! <p> See <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> for syntax details. </p>
  
***************
*** 12529,12532 ****
  ETRN request.
- See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
- restriction lists" for a discussion of evaluation context and time.
  </p>
--- 10459,10460 ----
***************
*** 12610,12612 ****
  <p>
! List of commands that cause the Postfix SMTP server to immediately
  terminate the session with a 221 code. This can be used to disconnect
--- 10538,10540 ----
  <p>
! List of commands that causes the Postfix SMTP server to immediately
  terminate the session with a 221 code. This can be used to disconnect
***************
*** 12625,12627 ****
  <DT><b><a name="smtpd_hard_error_limit">smtpd_hard_error_limit</a>
! (default: normal: 20, overload: 1)</b></DT><DD>
  
--- 10553,10555 ----
  <DT><b><a name="smtpd_hard_error_limit">smtpd_hard_error_limit</a>
! (default: 20)</b></DT><DD>
  
***************
*** 12630,12635 ****
  make without delivering mail. The Postfix SMTP server disconnects
! when the limit is exceeded. Normally the default limit is 20, but
! it changes under overload to just 1. With Postfix 2.5 and earlier,
! the SMTP server always allows up to 20 errors by default.
! 
  </p>
--- 10558,10560 ----
  make without delivering mail. The Postfix SMTP server disconnects
! when the limit is exceeded.
  </p>
***************
*** 12643,12647 ****
  <p>
! Require that a remote SMTP client introduces itself with the HELO
! or EHLO command before sending the MAIL command or other commands
! that require EHLO negotiation.
  </p>
--- 10568,10571 ----
  <p>
! Require that a remote SMTP client introduces itself at the beginning
! of an SMTP session with the HELO or EHLO command.
  </p>
***************
*** 12665,12668 ****
  context of the SMTP HELO command.
- See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
- restriction lists" for a discussion of evaluation context and time.
  </p>
--- 10589,10590 ----
***************
*** 12673,12679 ****
  
- <p> Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
- restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
- simply skip <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> by not sending HELO or EHLO).
- </p>
- 
  <p>
--- 10595,10596 ----
***************
*** 12696,12700 ****
  hostname or parent domains, and execute the corresponding action.
! Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
! restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
! simply skip <a href="postconf.5.html#check_helo_access">check_helo_access</a> by not sending HELO or EHLO).  </dd>
  
--- 10613,10615 ----
  hostname or parent domains, and execute the corresponding action.
! </dd>
  
***************
*** 12704,12712 ****
  the HELO or EHLO hostname, and execute the corresponding action.
! Note 1: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  Note
! 2: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
! restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
! simply skip <a href="postconf.5.html#check_helo_mx_access">check_helo_mx_access</a> by not sending HELO or EHLO).  This
! feature is available in Postfix 2.1 and later.
! </dd>
  
--- 10619,10623 ----
  the HELO or EHLO hostname, and execute the corresponding action.
! Note: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later.  </dd>
  
***************
*** 12716,12724 ****
  for the HELO or EHLO hostname, and execute the corresponding action.
! Note 1: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  Note
! 2: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
! restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
! simply skip <a href="postconf.5.html#check_helo_ns_access">check_helo_ns_access</a> by not sending HELO or EHLO). This
! feature is available in Postfix 2.1 and later.
! </dd>
  
--- 10627,10631 ----
  for the HELO or EHLO hostname, and execute the corresponding action.
! Note: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later.  </dd>
  
***************
*** 12727,12733 ****
  <dd>Reject the request when the HELO or EHLO hostname syntax is
! invalid. Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce
! this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can simply
! skip <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a> by not sending HELO or EHLO).
! <br> The <a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> specifies the response code
! for rejected requests (default: 501).</dd>
  
--- 10634,10637 ----
  <dd>Reject the request when the HELO or EHLO hostname syntax is
! invalid. <br> The <a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> specifies the response
! code to rejected requests (default: 501).</dd>
  
***************
*** 12736,12742 ****
  <dd>Reject the request when the HELO or EHLO hostname is not in
! fully-qualified domain form, as required by the RFC. Note: specify
! "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this restriction
! (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can simply skip
! <a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a> by not sending HELO or EHLO).  <br>
! The <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
  rejected requests (default: 504).</dd>
--- 10640,10643 ----
  <dd>Reject the request when the HELO or EHLO hostname is not in
! fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code to
  rejected requests (default: 504).</dd>
***************
*** 12747,12752 ****
  listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
! (Postfix version 2.1 and later only).  Each "<i>d</i>" is a number,
! or a pattern inside "[]" that contains one or more ";"-separated
! numbers or number..number ranges (Postfix version 2.8 and later).
! If no "<i>=d.d.d.d</i>" is
  specified, reject the request when the HELO or EHLO hostname is
--- 10648,10650 ----
  listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
! (Postfix version 2.1 and later only).  If no "<i>=d.d.d.d</i>" is
  specified, reject the request when the HELO or EHLO hostname is
***************
*** 12754,12760 ****
  <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description for additional RBL related configuration
! parameters.  Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully
! enforce this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a
! client can simply skip <a href="postconf.5.html#reject_rhsbl_helo">reject_rhsbl_helo</a> by not sending HELO or
! EHLO). This feature is available in Postfix 2.0
! and later.  </dd>
  
--- 10652,10655 ----
  <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description for additional RBL related configuration
! parameters.  This feature is available in Postfix 2.0 and later.
! </dd>
  
***************
*** 12763,12772 ****
  <dd>Reject the request when the HELO or EHLO hostname has no DNS A
! or MX record. <br> The <a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> parameter
! specifies the numerical response code for rejected requests (default:
! 450). <br> The <a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a> parameter
! specifies the action after a temporary DNS error (default:
! <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully
! enforce this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a
! client can simply skip <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a> by not sending
! HELO or EHLO). </dd>
  
--- 10658,10661 ----
  <dd>Reject the request when the HELO or EHLO hostname has no DNS A
! or MX record. <br> The <a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> specifies the
! response code to rejected requests (default: 450). </dd>
  
***************
*** 12819,12821 ****
  <DT><b><a name="smtpd_junk_command_limit">smtpd_junk_command_limit</a>
! (default: normal: 100, overload: 1)</b></DT><DD>
  
--- 10708,10710 ----
  <DT><b><a name="smtpd_junk_command_limit">smtpd_junk_command_limit</a>
! (default: 100)</b></DT><DD>
  
***************
*** 12827,12831 ****
  <a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> and <a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> configuration
! parameters.  Normally the default limit is 100, but it changes under
! overload to just 1. With Postfix 2.5 and earlier, the SMTP server
! always allows up to 100 junk commands by default.  </p>
  
--- 10716,10719 ----
  <a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> and <a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> configuration
! parameters.
! </p>
  
***************
*** 12838,12841 ****
  <p> A list of Milter (mail filter) applications for new mail that
! arrives via the Postfix <a href="smtpd.8.html">smtpd(8)</a> server. Specify space or comma as
! separator. See the <a href="MILTER_README.html">MILTER_README</a> document for details.  </p>
  
--- 10726,10729 ----
  <p> A list of Milter (mail filter) applications for new mail that
! arrives via the Postfix <a href="smtpd.8.html">smtpd(8)</a> server.  See the <a href="MILTER_README.html">MILTER_README</a>
! document for details.  </p>
  
***************
*** 12883,12907 ****
  
- <DT><b><a name="smtpd_per_record_deadline">smtpd_per_record_deadline</a>
- (default: normal: no, overload: yes)</b></DT><DD>
- 
- <p> Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> time limit, from a
- time limit per read or write system call, to a time limit to send
- or receive a complete record (an SMTP command line, SMTP response
- line, SMTP message content line, or TLS protocol message).  This
- limits the impact from hostile peers that trickle data one byte at
- a time.  </p>
- 
- <p> Note: when per-record deadlines are enabled, a short timeout
- may cause problems with TLS over very slow network connections.
- The reasons are that a TLS protocol message can be up to 16 kbytes
- long (with TLSv1), and that an entire TLS protocol message must be
- sent or received within the per-record deadline.  </p>
- 
- <p> This feature is available in Postfix 2.9 and later. With older
- Postfix releases, the behavior is as if this parameter is set to
- "no". </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a>
--- 10771,10772 ----
***************
*** 12989,13023 ****
  
- <DT><b><a name="smtpd_proxy_options">smtpd_proxy_options</a>
- (default: empty)</b></DT><DD>
- 
- <p>
- List of options that control how the Postfix SMTP server
- communicates with a before-queue content filter. Specify zero or
- more of the following, separated by comma or whitespace.  </p>
- 
- <dl>
- 
- <dt><b>speed_adjust</b></dt>
- 
- <dd> <p> Do not connect to a before-queue content filter until an entire
- message has been received. This reduces the number of simultaneous
- before-queue content filter processes. </p>
- 
- <p> NOTE 1: A filter must not <i>selectively</i> reject recipients
- of a multi-recipient message.  Rejecting all recipients is OK, as
- is accepting all recipients. </p>
- 
- <p> NOTE 2: This feature increases the minimum amount of free queue
- space by $<a href="postconf.5.html#message_size_limit">message_size_limit</a>. The extra space is needed to save the
- message to a temporary file. </p> </dd>
- 
- </dl>
- 
- <p>
- This feature is available in Postfix 2.7 and later.
- </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtpd_proxy_timeout">smtpd_proxy_timeout</a>
--- 10854,10855 ----
***************
*** 13072,13075 ****
  the context of the RCPT TO command.
- See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
- restriction lists" for a discussion of evaluation context and time.
  </p>
--- 10904,10905 ----
***************
*** 13188,13190 ****
  fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
  rejected requests (default: 504). </dd>
--- 11018,11020 ----
  fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code to
  rejected requests (default: 504). </dd>
***************
*** 13195,13200 ****
  A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
! 2.1 and later only).  Each "<i>d</i>" is a number, or a pattern
! inside "[]" that contains one or more ";"-separated numbers or
! number..number ranges (Postfix version 2.8 and later). If no
! "<i>=d.d.d.d</i>" is specified, reject
  the request when the RCPT TO domain is listed with
--- 11025,11027 ----
  A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
! 2.1 and later only).  If no "<i>=d.d.d.d</i>" is specified, reject
  the request when the RCPT TO domain is listed with
***************
*** 13231,13237 ****
  a zero-length MX hostname (Postfix version 2.3 and later). <br> The
! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the numerical
! response code for rejected requests (default: 450).  The response
! is always 450 in case of a temporary DNS error. <br> The
! <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> parameter specifies the action
! after a temporary DNS error (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>).  </dd>
  
--- 11058,11062 ----
  a zero-length MX hostname (Postfix version 2.3 and later). <br> The
! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the response code
! for rejected requests (default: 450).  The response is always 450
! in case of a temporary DNS error.</dd>
  
***************
*** 13250,13261 ****
  see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details.  <br> The
! <a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> parameter specifies the numerical
! response code when an address is known to bounce (default: 450,
! change into 550 when you are confident that it is safe to do so).
! <br>The <a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> parameter specifies the
! numerical response code when an address probe failed due to a
! temporary problem (default: 450). <br> The
! <a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a> parameter specifies the action
! after addres probe failure due to a temporary problem (default:
! <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>).  <br>  This feature is available in Postfix 2.1
! and later.  </dd>
  
--- 11075,11082 ----
  see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details.  <br> The
! <a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> parameter specifies the response
! when an address is known to bounce (default: 450, change into 550
! when you are confident that it is safe to do so).  The
! <a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> parameter specifies the response
! when an address probe failed due to a temporary problem (default:
! 450).  This feature is available in Postfix 2.1 and later.  </dd>
  
***************
*** 13289,13369 ****
  
- <DT><b><a name="smtpd_reject_footer">smtpd_reject_footer</a>
- (default: empty)</b></DT><DD>
- 
- <p> Optional information that is appended after each SMTP server
- 4XX or 5XX response. </p>
- 
- <p> Example: </p>
- 
- <pre>
- /etc/postfix/<a href="postconf.5.html">main.cf</a>:
-     <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> = For assistance, call 800-555-0101.
-      Please provide the following information in your problem report:
-      time ($localtime), client ($client_address) and server
-      ($server_name).
- </pre>
- 
- <p> Server response: </p>
- 
- <pre>
-     550-5.5.1 &lt;user@example&gt; Recipient address rejected: User unknown
-     550 5.5.1 For assistance, call 800-555-0101. Please provide the
-     following information in your problem report: time (Jan 4 15:42:00),
-     client (192.168.1.248) and server (mail1.example.com).
- </pre>
- 
- <p> Note: the above text is meant to make it easier to find the
- Postfix logfile records for a failed SMTP session. The text itself
- is not logged to the Postfix SMTP server's maillog file. </p>
- 
- <p> Be sure to keep the text as short as possible. Long text may
- be truncated before it is logged to the remote SMTP client's maillog
- file, or before it is returned to the sender in a delivery status
- notification.  </p>
- 
- <p> This feature supports a limited number of $name attributes in
- the footer text. These are replaced by their current value for the
- SMTP session: </p>
- 
- <dl>
- 
- <dt> <b>client_address</b> </dt> <dd> The Client IP address that
- is logged in the maillog file. </dd>
- 
- <dt> <b>client_port</b> </dt> <dd> The client TCP port that is
- logged in the maillog file. </dd>
- 
- <dt> <b>localtime</b> </dt> <dd> The server local time (Mmm dd
- hh:mm:ss) that is logged in the maillog file. </dd>
- 
- <dt> <b>server_name</b> </dt> <dd> The server's <a href="postconf.5.html#myhostname">myhostname</a> value.
- This attribute is made available for sites with multiple MTAs
- (perhaps behind a load-balancer), where the server name can help
- the server support team to quickly find the right log files.  </dd>
- 
- </dl>
- 
- <p> Notes: </p>
- 
- <ul>
- 
- <li> <p> NOT SUPPORTED are other attributes such as sender, recipient,
- or <a href="postconf.5.html">main.cf</a> parameters.  </p>
- 
- <li> <p> For safety reasons, text that does not match
- $<a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> is censored. </p>
- 
- </ul>
- 
- <p> This feature supports the two-character sequence \n as a request
- for a line break in the footer text. Postfix automatically inserts
- after each line break the three-digit SMTP reply code (and optional
- enhanced status code) from the original Postfix reject message.
- </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a>
--- 11110,11111 ----
***************
*** 13378,13382 ****
  
- <p> An address is always considered "known" when it matches a
- <a href="virtual.5.html">virtual(5)</a> alias or a <a href="canonical.5.html">canonical(5)</a> mapping.
- 
  <ul>
--- 11120,11121 ----
***************
*** 13415,13419 ****
  
- <p> An address is always considered "known" when it matches a
- <a href="virtual.5.html">virtual(5)</a> alias or a <a href="canonical.5.html">canonical(5)</a> mapping.
- 
  <ul>
--- 11154,11155 ----
***************
*** 13610,13612 ****
  <p> This feature is available in Postfix 2.3 and later. In earlier
! releases it was called <b><a href="postconf.5.html#smtpd_sasl_application_name">smtpd_sasl_application_name</a></b>. </p>
  
--- 11346,11348 ----
  <p> This feature is available in Postfix 2.3 and later. In earlier
! releases it was called <b>smtpd_sasl_application_name</b>. </p>
  
***************
*** 13760,13763 ****
  context of the MAIL FROM command.
- See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
- restriction lists" for a discussion of evaluation context and time.
  </p>
--- 11496,11497 ----
***************
*** 13814,13816 ****
  fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
  rejected requests (default: 504). </dd>
--- 11548,11550 ----
  fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code to
  rejected requests (default: 504). </dd>
***************
*** 13821,13826 ****
  the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix
! version 2.1 and later only).  Each "<i>d</i>" is a number, or a
! pattern inside "[]" that contains one or more ";"-separated numbers
! or number..number ranges (Postfix version 2.8 and later). If no
! "<i>=d.d.d.d</i>" is specified,
  reject the request when the MAIL FROM domain is
--- 11555,11557 ----
  the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix
! version 2.1 and later only).  If no "<i>=d.d.d.d</i>" is specified,
  reject the request when the MAIL FROM domain is
***************
*** 13853,13859 ****
  a zero-length MX hostname (Postfix version 2.3 and later). <br> The
! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the numerical
! response code for rejected requests (default: 450).  The response
! is always 450 in case of a temporary DNS error. <br> The
! <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> parameter specifies the action
! after a temporary DNS error (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). </dd>
  
--- 11584,11588 ----
  a zero-length MX hostname (Postfix version 2.3 and later). <br> The
! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the response code
! for rejected requests (default: 450).  The response is always 450
! in case of a temporary DNS error.  </dd>
  
***************
*** 13872,13882 ****
  see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
! <a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> parameter specifies the numerical
! response code when an address is known to bounce (default: 450,
! change into 550 when you are confident that it is safe to do so).
! <br>The <a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> specifies the numerical response
! code when an address address probe failed due to a temporary problem
! (default: 450).  <br> The <a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a> parameter
! specifies the action after address probe failure due to a temporary
! problem (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>).  <br> This feature is available
! in Postfix 2.1 and later.  </dd>
  
--- 11601,11608 ----
  see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
! <a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> parameter specifies the response when
! an address is known to bounce (default: 450, change into 550 when
! you are confident that it is safe to do so). The
! <a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> specifies the response when an address
! address probe failed due to a temporary problem (default: 450).
! This feature is available in Postfix 2.1 and later.  </dd>
  
***************
*** 13917,13930 ****
  
- <DT><b><a name="smtpd_service_name">smtpd_service_name</a>
- (default: smtpd)</b></DT><DD>
- 
- <p> The internal service that <a href="postscreen.8.html">postscreen(8)</a> hands off allowed
- connections to. In a future version there may be different
- classes of SMTP service. </p>
- 
- <p> This feature is available in Postfix 2.8. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtpd_soft_error_limit">smtpd_soft_error_limit</a>
--- 11643,11644 ----
***************
*** 13952,13959 ****
  <DT><b><a name="smtpd_starttls_timeout">smtpd_starttls_timeout</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
  <p> The time limit for Postfix SMTP server write and read operations
! during TLS startup and shutdown handshake procedures. The current
! default value is stress-dependent. Before Postfix version 2.8, it
! was fixed at 300s. </p>
  
--- 11666,11671 ----
  <DT><b><a name="smtpd_starttls_timeout">smtpd_starttls_timeout</a>
! (default: 300s)</b></DT><DD>
  
  <p> The time limit for Postfix SMTP server write and read operations
! during TLS startup and shutdown handshake procedures. </p>
  
***************
*** 13965,13967 ****
  <DT><b><a name="smtpd_timeout">smtpd_timeout</a>
! (default: normal: 300s, overload: 10s)</b></DT><DD>
  
--- 11677,11679 ----
  <DT><b><a name="smtpd_timeout">smtpd_timeout</a>
! (default: 300s)</b></DT><DD>
  
***************
*** 13969,13974 ****
  The time limit for sending a Postfix SMTP server response and for
! receiving a remote SMTP client request. Normally the default limit
! is 300s, but it changes under overload to just 10s. With Postfix
! 2.5 and earlier, the SMTP server always uses a time limit of 300s
! by default.
  </p>
--- 11681,11683 ----
  The time limit for sending a Postfix SMTP server response and for
! receiving a remote SMTP client request.
  </p>
***************
*** 13991,14015 ****
  
! <p> A file containing (PEM format) CA certificates of root CAs trusted
! to sign either remote SMTP client certificates or intermediate CA
! certificates.  These are loaded into memory before the <a href="smtpd.8.html">smtpd(8)</a> server
! enters the chroot jail. If the number of trusted roots is large, consider
! using <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> instead, but note that the latter directory must
! be present in the chroot jail if the <a href="smtpd.8.html">smtpd(8)</a> server is chrooted. This
! file may also be used to augment the server certificate trust chain,
! but it is best to include all the required certificates directly in the
! server certificate file. </p>
! 
! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
! appending the system-supplied default CAs and trusting third-party
! certificates. </p>
! 
! <p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are not
! requested, and <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> should remain empty. If you do make use
! of client certificates, the distinguished names (DNs) of the certificate
! authorities listed in <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> are sent to the remote SMTP client
! in the client certificate request message. MUAs with multiple client
! certificates may use the list of preferred certificate authorities
! to select the correct client certificate.  You may want to put your
! "preferred" CA or CAs in this file, and install other trusted CAs in
! $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>. </p>
  
--- 11700,11707 ----
  
! <p> The file with the certificate of the certification authority
! (CA) that issued the Postfix SMTP server certificate.  This is
! needed only when the CA certificate is not already present in the
! server certificate file.  This file may also contain the CA
! certificates of other trusted CAs.  You must use this file for the
! list of trusted CAs if you want to use chroot-mode. </p>
  
***************
*** 14029,14050 ****
  
! <p> A directory containing (PEM format) CA certificates of root CAs
! trusted to sign either remote SMTP client certificates or intermediate CA
! certificates. Do not forget to create the necessary "hash" links with,
! for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
! <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> in chroot mode, this directory (or a copy) must be
! inside the chroot jail. </p>
! 
! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
! appending the system-supplied default CAs and trusting third-party
! certificates. </p>
! 
! <p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are
! not requested, and <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> should remain empty. In contrast
! to <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, DNs of certificate authorities installed
! in $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> are not included in the client certificate
! request message. MUAs with multiple client certificates may use the
! list of preferred certificate authorities to select the correct
! client certificate.  You may want to put your "preferred" CA or
! CAs in $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, and install the remaining trusted CAs in
! $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>. </p>
  
--- 11721,11733 ----
  
! <p> Directory with PEM format certificate authority certificates
! that the Postfix SMTP server offers to remote SMTP clients for the
! purpose of client certificate verification.  Do not forget to create
! the necessary "hash" links with, for example, "$OPENSSL_HOME/bin/c_rehash
! /etc/postfix/certs".  </p>
! 
! <p> To use this option in chroot mode, this directory (or a copy)
! must be inside the chroot jail. Please note that in this case the
! CA certificates are not offered to the client, so that e.g.  Netscape
! clients might not offer certificates issued by them.  Use of this
! feature is therefore not recommended. </p>
  
***************
*** 14168,14176 ****
  
! <p> To enable a remote SMTP client to verify the Postfix SMTP server
! certificate, the issuing CA certificates must be made available to the
! client. You should include the required certificates in the server
! certificate file, the server certificate first, then the issuing
! CA(s) (bottom-up order). </p>
  
! <p> Example: the certificate for "server.example.com" was issued by
  "intermediate CA" which itself has a certificate of "root CA".
--- 11851,11858 ----
  
! <p> In order to verify a certificate, the CA certificate (in case
! of a certificate chain, all CA certificates) must be available.
! You should add these certificates to the server certificate, the
! server certificate first, then the issuing CA(s).  </p>
  
! <p> Example: the certificate for "server.dom.ain" was issued by
  "intermediate CA" which itself has a certificate of "root CA".
***************
*** 14219,14247 ****
  
- <DT><b><a name="smtpd_tls_ciphers">smtpd_tls_ciphers</a>
- (default: export)</b></DT><DD>
- 
- <p> The minimum TLS cipher grade that the Postfix SMTP server
- will use with opportunistic TLS encryption. Cipher types listed in
- <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are excluded from the base definition of
- the selected cipher grade. The default value "export" ensures maximum
- inter-operability. Because encryption is optional, stronger controls
- are not appropriate, and this setting SHOULD NOT be changed unless the
- change is essential. </p>
- 
- <p> When TLS is mandatory the cipher grade is chosen via the
- <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
- details. </p>
- 
- <p> Example: </p>
- <pre>
- <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> = export
- </pre>
- 
- <p> This feature is available in Postfix 2.6 and later. With earlier Postfix
- releases only the <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> parameter is implemented,
- and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>
--- 11901,11902 ----
***************
*** 14326,14330 ****
  <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
  
--- 11981,11984 ----
  <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted, but file permissions should grant read/write
! access only to the system superuser account ("root"). </p>
  
***************
*** 14335,14408 ****
  
- <DT><b><a name="smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>
- (default: empty)</b></DT><DD>
- 
- <p> File with the Postfix SMTP server ECDSA certificate in PEM format.
- This file may also contain the Postfix SMTP server private ECDSA key. </p>
- 
- <p> See the discussion under <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for more details. </p>
- 
- <p> Example: </p>
- 
- <pre>
- <a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> = /etc/postfix/ecdsa-scert.pem
- </pre>
- 
- <p> This feature is available in Postfix 2.6 and later, when Postfix is
- compiled and linked with OpenSSL 1.0.0 or later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="smtpd_tls_eckey_file">smtpd_tls_eckey_file</a>
- (default: $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b></DT><DD>
- 
- <p> File with the Postfix SMTP server ECDSA private key in PEM format.
- This file may be combined with the Postfix SMTP server ECDSA certificate
- file specified with $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>. </p>
- 
- <p> The private key must be accessible without a pass-phrase, i.e. it
- must not be encrypted. File permissions should grant read-only
- access to the system superuser account ("root"), and no access
- to anyone else. </p>
- 
- <p> This feature is available in Postfix 2.6 and later, when Postfix is
- compiled and linked with OpenSSL 1.0.0 or later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>
- (default: see "postconf -d" output)</b></DT><DD>
- 
- <p> The Postfix SMTP server security grade for ephemeral elliptic-curve
- Diffie-Hellman (EECDH) key exchange. </p>
- 
- <p> The available choices are: </p>
- 
- <dl>
- 
- <dt><b>none</b></dt> <dd> Don't use EECDH. Ciphers based on EECDH key
- exchange will be disabled. This is the default in Postfix versions
- 2.6 and 2.7. </dd>
- 
- <dt><b>strong</b></dt> <dd> Use EECDH with approximately 128
- bits of security at a reasonable computational cost. This is the
- current best-practice trade-off between security and computational
- efficiency. This is the default in Postfix version 2.8 and later.
- </dd>
- 
- <dt><b>ultra</b></dt> <dd> Use EECDH with approximately 192 bits of
- security at computational cost that is approximately twice as high
- as 128 bit strength ECC. Barring significant progress in attacks on
- elliptic curve crypto-systems, the "strong" curve is sufficient for most
- users. </dd>
- 
- </dl>
- 
- <p> This feature is available in Postfix 2.6 and later, when it is
- compiled and linked with OpenSSL 1.0.0 or later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
--- 11989,11990 ----
***************
*** 14513,14517 ****
  <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
  
--- 12095,12098 ----
  <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted, but file permissions should grant read/write
! access only to the system superuser account ("root"). </p>
  
***************
*** 14555,14566 ****
  <p> The minimum TLS cipher grade that the Postfix SMTP server will
! use with mandatory TLS encryption. The default grade ("medium") is
! sufficiently strong that any benefit from globally restricting TLS
! sessions to a more stringent grade is likely negligible, especially
! given the fact that many implementations still do not offer any stronger
! ("high" grade) ciphers, while those that do, will always use "high"
! grade ciphers. So insisting on "high" grade ciphers is generally
! counter-productive. Allowing "export" or "low" ciphers is typically
! not a good idea, as systems limited to just these are limited to
! obsolete browsers. No known SMTP clients fail to support at least
! one "medium" or "high" grade cipher. </p>
  
--- 12136,12143 ----
  <p> The minimum TLS cipher grade that the Postfix SMTP server will
! use with mandatory
! TLS encryption. Cipher types listed in <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>
! or <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are excluded from the base definition
! of the selected cipher grade. With opportunistic TLS encryption,
! the "export" grade is used unconditionally with exclusions specified
! only via <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>. </p>
  
***************
*** 14570,14572 ****
  <dt><b>export</b></dt>
! <dd> Enable "EXPORT" grade or stronger OpenSSL ciphers.
  This is the most appropriate setting for public MX hosts, and is always
--- 12147,12149 ----
  <dt><b>export</b></dt>
! <dd> Enable the mainstream "EXPORT" grade or better OpenSSL ciphers.
  This is the most appropriate setting for public MX hosts, and is always
***************
*** 14574,14595 ****
  is specified via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter,
! which you are strongly encouraged to not change. </dd>
  
  <dt><b>low</b></dt>
! <dd> Enable "LOW" grade or stronger OpenSSL ciphers. The
  underlying cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a>
  configuration parameter, which you are strongly encouraged to
! not change. </dd>
  
  <dt><b>medium</b></dt>
! <dd> Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit
! or longer symmetric bulk-encryption keys. This is the default minimum
! strength for mandatory TLS encryption. The underlying cipherlist is
! specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> configuration parameter, which
! you are strongly encouraged to not change. </dd>
  
  <dt><b>high</b></dt>
! <dd> Enable only "HIGH" grade OpenSSL ciphers. The
  underlying cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a>
  configuration parameter, which you are strongly encouraged to
! not change. </dd>
  
--- 12151,12196 ----
  is specified via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter,
! which you are strongly encouraged to not change. The default value
! of <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> includes anonymous ciphers, but these are
! automatically filtered out if the server is configured to ask for
! client certificates. If you must always exclude anonymous ciphers,
! set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers
! only when TLS is enforced, set "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> =
! aNULL". </dd>
  
  <dt><b>low</b></dt>
! <dd> Enable the mainstream "LOW" grade or better OpenSSL ciphers. The
  underlying cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a>
  configuration parameter, which you are strongly encouraged to
! not change. The default value of <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> includes
! anonymous ciphers, but these are automatically filtered out if the
! server is configured to ask for client certificates. If you must
! always exclude anonymous ciphers, set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> =
! aNULL". To exclude anonymous ciphers only when TLS is enforced, set
! "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
  <dt><b>medium</b></dt>
! <dd> Enable the mainstream "MEDIUM" grade or better OpenSSL ciphers. These
! are essentially the 128-bit or stronger ciphers. This is the default
! minimum strength for mandatory TLS encryption. MSAs that enforce
! TLS and have clients that do not support any "MEDIUM" or "HIGH"
! grade ciphers, may need to configure a weaker ("low" or "export")
! minimum cipher grade. The underlying cipherlist is specified via the
! <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. The default value of <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
! includes anonymous ciphers, but these are automatically filtered out if
! the server is configured to ask for client certificates. If you must
! always exclude anonymous ciphers, set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> =
! aNULL". To exclude anonymous ciphers only when TLS is enforced, set
! "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
  <dt><b>high</b></dt>
! <dd> Enable only the mainstream "HIGH" grade OpenSSL ciphers. The
  underlying cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a>
  configuration parameter, which you are strongly encouraged to
! not change. The default value of <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> includes
! anonymous ciphers, but these are automatically filtered out if the
! server is configured to ask for client certificates. If you must
! always exclude anonymous ciphers, set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> =
! aNULL". To exclude anonymous ciphers only when TLS is enforced, set
! "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
***************
*** 14601,14603 ****
  <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. </dd>
  
--- 12202,12206 ----
  <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. The default value of <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a>
! excludes anonymous ciphers (OpenSSL 0.9.8 has NULL ciphers that offer
! data integrity without encryption or authentication). </dd>
  
***************
*** 14605,14621 ****
  
- <p> Cipher types listed in
- <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> or <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are
- excluded from the base definition of the selected cipher grade. See
- <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> for cipher controls that apply to opportunistic
- TLS. </p>
- 
- <p> The underlying cipherlists for grades other than "null" include
- anonymous ciphers, but these are automatically filtered out if the
- server is configured to ask for client certificates.  You are very
- unlikely to need to take any steps to exclude anonymous ciphers, they
- are excluded automatically as required.  If you must exclude anonymous
- ciphers even when Postfix does not need or use peer certificates, set
- "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers only
- when TLS is enforced, set "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </p>
- 
  <p> This feature is available in Postfix 2.3 and later. </p>
--- 12208,12209 ----
***************
*** 14673,14707 ****
  
- <DT><b><a name="smtpd_tls_protocols">smtpd_tls_protocols</a>
- (default: empty)</b></DT><DD>
- 
- <p> List of TLS protocols that the Postfix SMTP server will exclude
- or include with opportunistic TLS encryption. This parameter SHOULD be
- left at its default empty value, allowing all protocols to be used with
- opportunistic TLS. </p>
- 
- <p> In <a href="postconf.5.html">main.cf</a> the values are separated by whitespace, commas or
- colons. An empty value means allow all protocols. The valid protocol
- names, (see <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and
- "TLSv1". In <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> table entries, "protocols" attribute
- values are separated by a colon. </p>
- 
- <p> To include a protocol list its name, to exclude it, prefix the name
- with a "!" character. To exclude SSLv2 even for opportunistic TLS set
- "<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
- "<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2, !SSLv3". Explicitly listing the protocols to
- include, is supported, but not recommended. OpenSSL provides no mechanisms
- for excluding protocols not known at compile-time. If Postfix is linked
- against an OpenSSL library that supports additional protocol versions,
- they cannot be excluded using either syntax. </p>
- 
- <p> Example: </p>
- <pre>
- <a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2
- </pre>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtpd_tls_received_header">smtpd_tls_received_header</a>
--- 12261,12262 ----
***************
*** 15064,15066 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 12619,12621 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 15097,15099 ****
  <DT><b><a name="syslog_name">syslog_name</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 12652,12654 ----
  <DT><b><a name="syslog_name">syslog_name</a>
! (default: postfix)</b></DT><DD>
  
***************
*** 15107,15291 ****
  a Postfix process has completed initialization. Errors during
! process initialization will be logged with the default name. Examples
! are errors while parsing the command line arguments, and errors
! while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="tcp_windowsize">tcp_windowsize</a>
! (default: 0)</b></DT><DD>
! 
! <p> An optional workaround for routers that break TCP window scaling.
! Specify a value &gt; 0 and &lt; 65536 to enable this feature.  With
! Postfix TCP servers (<a href="smtpd.8.html">smtpd(8)</a>, <a href="qmqpd.8.html">qmqpd(8)</a>), this feature is implemented
! by the Postfix <a href="master.8.html">master(8)</a> daemon.  </p>
! 
! <p> To change this parameter without stopping Postfix, you need to
! first terminate all Postfix TCP servers: </p>
! 
! <blockquote>
! <pre>
! # postconf -e <a href="postconf.5.html#master_service_disable">master_service_disable</a>=inet
! # postfix reload
! </pre>
! </blockquote>
! 
! <p> This immediately terminates all processes that accept network
! connections.  Next, you enable Postfix TCP servers with the updated
! <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> setting: </p>
! 
! <blockquote>
! <pre>
! # postconf -e <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a>=65535 <a href="postconf.5.html#master_service_disable">master_service_disable</a>=
! # postfix reload
! </pre>
! </blockquote>
! 
! <p> If you skip these steps with a running Postfix system, then the
! <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> change will work only for Postfix TCP clients (<a href="smtp.8.html">smtp(8)</a>,
! <a href="lmtp.8.html">lmtp(8)</a>).  </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="tls_append_default_CA">tls_append_default_CA</a>
! (default: no)</b></DT><DD>
! 
! <p> Append the system-supplied default certificate authority
! certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
! The default is "no"; this prevents Postfix from trusting third-party
! certificates and giving them relay permission with
! <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>.  </p>
! 
! <p> This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
! 2.7.2 and later versions. Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = yes" for
! backwards compatibility, to avoid breaking certificate verification
! with sites that don't use <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="tls_daemon_random_bytes">tls_daemon_random_bytes</a>
! (default: 32)</b></DT><DD>
! 
! <p> The number of pseudo-random bytes that an <a href="smtp.8.html">smtp(8)</a> or <a href="smtpd.8.html">smtpd(8)</a>
! process requests from the <a href="tlsmgr.8.html">tlsmgr(8)</a> server in order to seed its
! internal pseudo random number generator (PRNG).  The default of 32
! bytes (equivalent to 256 bits) is sufficient to generate a 128bit
! (or 168bit) session key. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="tls_disable_workarounds">tls_disable_workarounds</a>
! (default: see "postconf -d" output)</b></DT><DD>
! 
! <p> List or bit-mask of OpenSSL bug work-arounds to disable. </p>
! 
! <p> The OpenSSL toolkit includes a set of work-arounds for buggy SSL/TLS
! implementations. Applications, such as Postfix, that want to maximize
! interoperability ask the OpenSSL library to enable the full set of
! recommended work-arounds. </p>
! 
! <p> From time to time, it is discovered that a work-around creates a
! security issue, and should no longer be used. If upgrading OpenSSL
! to a fixed version is not an option or an upgrade is not available
! in a timely manner, or in closed environments where no buggy clients
! or servers exist, it may be appropriate to disable some or all of the
! OpenSSL interoperability work-arounds. This parameter specifies which
! bug work-arounds to disable. </p>
! 
! <p> If the value of the parameter is a hexadecimal long integer starting
! with "0x", the bug work-arounds corresponding to the bits specified in
! its value are removed from the <b>SSL_OP_ALL</b> work-around bit-mask
! (see openssl/ssl.h and SSL_CTX_set_options(3)). You can specify more
! bits than are present in SSL_OP_ALL, excess bits are ignored. Specifying
! 0xFFFFFFFF disables all bug-workarounds on a 32-bit system. This should
! also be sufficient on 64-bit systems, until OpenSSL abandons support
! for 32-bit systems and starts using the high 32 bits of a 64-bit
! bug-workaround mask. </p>
! 
! <p> Otherwise, the parameter is a white-space or comma separated list
! of specific named bug work-arounds chosen from the list below. It
! is possible that your OpenSSL version includes new bug work-arounds
! added after your Postfix source code was last updated, in that case
! you can only disable one of these via the hexadecimal syntax above. </p>
! 
! <dl>
! 
! <dt><b>MICROSOFT_SESS_ID_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
! 
! <dt><b>NETSCAPE_CHALLENGE_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
! 
! <dt><b>LEGACY_SERVER_CONNECT</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
! 
! <dt><b>NETSCAPE_REUSE_CIPHER_CHANGE_BUG</b></dt> <dd> also aliased
! as <b>CVE-2010-4180</b>. Postfix 2.8 disables this work-around by
! default with OpenSSL versions that may predate the fix. Fixed in
! OpenSSL 0.9.8q and OpenSSL 1.0.0c.</dd>
! 
! <dt><b>SSLREF2_REUSE_CERT_TYPE_BUG</b></dt> <dd>See
! SSL_CTX_set_options(3)</dd>
! 
! <dt><b>MICROSOFT_BIG_SSLV3_BUFFER</b></dt> <dd>See
! SSL_CTX_set_options(3)</dd>
! 
! <dt><b>MSIE_SSLV2_RSA_PADDING</b></dt> <dd> also aliased as
! <b>CVE-2005-2969</b>. Postfix 2.8 disables this work-around by
! default with OpenSSL versions that may predate the fix. Fixed in
! OpenSSL 0.9.7h and OpenSSL 0.9.8a.</dd>
! 
! <dt><b>SSLEAY_080_CLIENT_DH_BUG</b></dt> <dd>See
! SSL_CTX_set_options(3)</dd>
! 
! <dt><b>TLS_D5_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
! 
! <dt><b>TLS_BLOCK_PADDING_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
! 
! <dt><b>TLS_ROLLBACK_BUG</b></dt> <dd>See SSL_CTX_set_options(3).
! This is disabled in OpenSSL 0.9.7 and later. Nobody should still
! be using 0.9.6! </dd>
! 
! <dt><b>DONT_INSERT_EMPTY_FRAGMENTS</b></dt> <dd>See
! SSL_CTX_set_options(3)</dd>
! 
! <dt><b>CRYPTOPRO_TLSEXT_BUG</b></dt> <dd>New with GOST support in
! OpenSSL 1.0.0.</dd>
! 
! </dl>
! 
! <p> This feature is available in Postfix 2.8 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="tls_eecdh_strong_curve">tls_eecdh_strong_curve</a>
! (default: prime256v1)</b></DT><DD>
! 
! <p> The elliptic curve used by the SMTP server for sensibly strong
! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
! server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong". The phrase "sensibly
! strong" means approximately 128-bit security based on best known
! attacks. The selected curve must be implemented by OpenSSL (as
! reported by ecparam(1) with the "-list_curves" option) and be one
! of the curves listed in Section 5.1.1 of <a href="http://tools.ietf.org/html/rfc4492">RFC 4492</a>. You should not
! generally change this setting. </p>
! 
! <p> This default curve is specified in NSA "Suite B" Cryptography
! (see <a href="http://www.nsa.gov/ia/industry/crypto_suite_b.cfm">http://www.nsa.gov/ia/industry/crypto_suite_b.cfm</a>) for
! information classified as SECRET. </p>
! 
! <p> Note: elliptic curve names are poorly standardized; different
! standards groups are assigning different names to the same underlying
! curves.  The curve with the X9.62 name "prime256v1" is also known
! under the SECG name "secp256r1", but OpenSSL does not recognize the
! latter name. </p>
! 
! <p> This feature is available in Postfix 2.6 and later, when it is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
  
--- 12662,12667 ----
  a Postfix process has completed initialization. Errors during
! process initialization will be logged with the default name. Examples
! are errors while parsing the command line arguments, and errors
! while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
! </p>
  
***************
*** 15294,15314 ****
  
! <DT><b><a name="tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a>
! (default: secp384r1)</b></DT><DD>
! 
! <p> The elliptic curve used by the SMTP server for maximally strong
! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
! server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = ultra". The phrase "maximally
! strong" means approximately 192-bit security based on best known attacks.
! This additional strength comes at a significant computational cost, most
! users should instead set "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong".  The selected
! curve must be implemented by OpenSSL (as reported by ecparam(1) with the
! "-list_curves" option) and be one of the curves listed in Section 5.1.1
! of <a href="http://tools.ietf.org/html/rfc4492">RFC 4492</a>. You should not generally change this setting. </p>
  
! <p> This default "ultra" curve is specified in NSA "Suite B" Cryptography
! (see <a href="http://www.nsa.gov/ia/industry/crypto_suite_b.cfm">http://www.nsa.gov/ia/industry/crypto_suite_b.cfm</a>) for information
! classified as TOP SECRET. </p>
  
! <p> This feature is available in Postfix 2.6 and later, when it is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
  
--- 12670,12681 ----
  
! <DT><b><a name="tls_daemon_random_bytes">tls_daemon_random_bytes</a>
! (default: 32)</b></DT><DD>
  
! <p> The number of pseudo-random bytes that an <a href="smtp.8.html">smtp(8)</a> or <a href="smtpd.8.html">smtpd(8)</a>
! process requests from the <a href="tlsmgr.8.html">tlsmgr(8)</a> server in order to seed its
! internal pseudo random number generator (PRNG).  The default of 32
! bytes (equivalent to 256 bits) is sufficient to generate a 128bit
! (or 168bit) session key. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 15325,15331 ****
  level and is the default cipherlist for the SMTP server. You are
! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
! later the cipherlist may start with an "aNULL:" prefix, which restores
! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
! list when they are enabled. This prefix is not needed with previous
! OpenSSL releases. </p>
  
--- 12692,12694 ----
  level and is the default cipherlist for the SMTP server. You are
! strongly encouraged to not change this setting. </p>
  
***************
*** 15342,15348 ****
  <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
! later the cipherlist may start with an "aNULL:" prefix, which restores
! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
! list when they are enabled. This prefix is not needed with previous
! OpenSSL releases. </p>
  
--- 12705,12707 ----
  <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
! strongly encouraged to not change this setting. </p>
  
***************
*** 15359,15365 ****
  <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
! strongly encouraged to not change this setting.  With OpenSSL 1.0.0 and
! later the cipherlist may start with an "aNULL:" prefix, which restores
! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
! list when they are enabled. This prefix is not needed with previous
! OpenSSL releases. </p>
  
--- 12718,12720 ----
  <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
! strongly encouraged to not change this setting. </p>
  
***************
*** 15379,15384 ****
  certificates). You are strongly encouraged to not change this
! setting.  With OpenSSL 1.0.0 and later the cipherlist may start with an
! "aNULL:" prefix, which restores the 0.9.8-compatible ordering of the
! aNULL ciphers to the top of the list when they are enabled. This prefix
! is not needed with previous OpenSSL releases. </p>
  
--- 12734,12736 ----
  certificates). You are strongly encouraged to not change this
! setting. </p>
  
***************
*** 15403,15429 ****
  
- <DT><b><a name="tls_preempt_cipherlist">tls_preempt_cipherlist</a>
- (default: no)</b></DT><DD>
- 
- <p> With SSLv3 and later, use the server's cipher preference order
- instead of the client's cipher preference order. </p>
- 
- <p> By default, the OpenSSL server selects the client's most preferred
- cipher that the server supports. With SSLv3 and later, the server may
- choose its own most preferred cipher that is supported (offered) by
- the client. Setting "<a href="postconf.5.html#tls_preempt_cipherlist">tls_preempt_cipherlist</a> = yes" enables server cipher
- preferences. </p>
- 
- <p> While server cipher selection may in some cases lead to a more secure
- or performant cipher choice, there is some risk of interoperability
- issues. In the past, some SSL clients have listed lower priority ciphers
- that they did not implement correctly. If the server chooses a cipher
- that the client prefers less, it may select a cipher whose client
- implementation is flawed. </p>
- 
- <p> This feature is available in Postfix 2.8 and later, in combination
- with OpenSSL 0.9.7 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="tls_random_bytes">tls_random_bytes</a>
--- 12755,12756 ----
***************
*** 15504,15867 ****
  
- <DT><b><a name="tlsproxy_enforce_tls">tlsproxy_enforce_tls</a>
- (default: $<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b></DT><DD>
- 
- <p> Mandatory TLS: announce STARTTLS support to SMTP clients, and
- require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> for
- further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_service_name">tlsproxy_service_name</a>
- (default: tlsproxy)</b></DT><DD>
- 
- <p> The name of the <a href="tlsproxy.8.html">tlsproxy(8)</a> service entry in <a href="master.5.html">master.cf</a>. This
- service performs plaintext &lt;=&gt; TLS ciphertext conversion. <p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_CAfile">tlsproxy_tls_CAfile</a>
- (default: $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)</b></DT><DD>
- 
- <p> A file containing (PEM format) CA certificates of root CAs
- trusted to sign either remote SMTP client certificates or intermediate
- CA certificates.  See <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_CApath">tlsproxy_tls_CApath</a>
- (default: $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>)</b></DT><DD>
- 
- <p> A directory containing (PEM format) CA certificates of root CAs
- trusted to sign either remote SMTP client certificates or intermediate
- CA certificates. See <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_always_issue_session_ids">tlsproxy_tls_always_issue_session_ids</a>
- (default: $<a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>)</b></DT><DD>
- 
- <p> Force the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server to issue a TLS session id,
- even when TLS session caching is turned off. See
- <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_ask_ccert">tlsproxy_tls_ask_ccert</a>
- (default: $<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>)</b></DT><DD>
- 
- <p> Ask a remote SMTP client for a client certificate. See
- <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_ccert_verifydepth">tlsproxy_tls_ccert_verifydepth</a>
- (default: $<a href="postconf.5.html#smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a>)</b></DT><DD>
- 
- <p> The verification depth for remote SMTP client certificates. A
- depth of 1 is sufficient if the issuing CA is listed in a local CA
- file. See <a href="postconf.5.html#smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_cert_file">tlsproxy_tls_cert_file</a>
- (default: $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b></DT><DD>
- 
- <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server RSA certificate in PEM
- format.  This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
- private RSA key.  See <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for further details.  </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_ciphers">tlsproxy_tls_ciphers</a>
- (default: $<a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>)</b></DT><DD>
- 
- <p> The minimum TLS cipher grade that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
- will use with opportunistic TLS encryption. See <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>
- for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_dcert_file">tlsproxy_tls_dcert_file</a>
- (default: $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b></DT><DD>
- 
- <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server DSA certificate in PEM
- format.  This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
- private DSA key.  See <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> for further details.
- </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_dh1024_param_file">tlsproxy_tls_dh1024_param_file</a>
- (default: $<a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>)</b></DT><DD>
- 
- <p> File with DH parameters that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
- should use with EDH ciphers. See <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> for
- further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_dh512_param_file">tlsproxy_tls_dh512_param_file</a>
- (default: $<a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>)</b></DT><DD>
- 
- <p> File with DH parameters that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
- should use with EDH ciphers. See <a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> for
- further details.  </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_dkey_file">tlsproxy_tls_dkey_file</a>
- (default: $<a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>)</b></DT><DD>
- 
- <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server DSA private key in PEM
- format.  This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
- server DSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>.
- See <a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_eccert_file">tlsproxy_tls_eccert_file</a>
- (default: $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b></DT><DD>
- 
- <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server ECDSA certificate in
- PEM format.  This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
- server private ECDSA key.  See <a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> for further
- details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_eckey_file">tlsproxy_tls_eckey_file</a>
- (default: $<a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a>)</b></DT><DD>
- 
- <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server ECDSA private key in
- PEM format.  This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
- server ECDSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>.
- See <a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_eecdh_grade">tlsproxy_tls_eecdh_grade</a>
- (default: $<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>)</b></DT><DD>
- 
- <p> The Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server security grade for ephemeral
- elliptic-curve Diffie-Hellman (EECDH) key exchange. See
- <a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_exclude_ciphers">tlsproxy_tls_exclude_ciphers</a>
- (default: $<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>)</b></DT><DD>
- 
- <p> List of ciphers or cipher types to exclude from the <a href="tlsproxy.8.html">tlsproxy(8)</a>
- server cipher list at all TLS security levels. See
- <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_fingerprint_digest">tlsproxy_tls_fingerprint_digest</a>
- (default: $<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>)</b></DT><DD>
- 
- <p> The message digest algorithm used to construct client-certificate
- fingerprints. See <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> for further details.
- </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_key_file">tlsproxy_tls_key_file</a>
- (default: $<a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a>)</b></DT><DD>
- 
- <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server RSA private key in PEM
- format.  This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
- server RSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>.
- See <a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_loglevel">tlsproxy_tls_loglevel</a>
- (default: $<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a>)</b></DT><DD>
- 
- <p> Enable additional Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server logging of TLS
- activity.  Each logging level also includes the information that
- is logged at a lower logging level. See <a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> for
- further details.  </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_mandatory_ciphers">tlsproxy_tls_mandatory_ciphers</a>
- (default: $<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>)</b></DT><DD>
- 
- <p> The minimum TLS cipher grade that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
- will use with mandatory TLS encryption. See <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>
- for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_mandatory_exclude_ciphers">tlsproxy_tls_mandatory_exclude_ciphers</a>
- (default: $<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>)</b></DT><DD>
- 
- <p> Additional list of ciphers or cipher types to exclude from the
- <a href="tlsproxy.8.html">tlsproxy(8)</a> server cipher list at mandatory TLS security levels.
- See <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_mandatory_protocols">tlsproxy_tls_mandatory_protocols</a>
- (default: $<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>)</b></DT><DD>
- 
- <p> The SSL/TLS protocols accepted by the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
- with mandatory TLS encryption. If the list is empty, the server
- supports all available SSL/TLS protocol versions.  See
- <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_protocols">tlsproxy_tls_protocols</a>
- (default: $<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a>)</b></DT><DD>
- 
- <p> List of TLS protocols that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server will
- exclude or include with opportunistic TLS encryption. See
- <a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_req_ccert">tlsproxy_tls_req_ccert</a>
- (default: $<a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>)</b></DT><DD>
- 
- <p> With mandatory TLS encryption, require a trusted remote SMTP
- client certificate in order to allow TLS connections to proceed.
- See <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_security_level">tlsproxy_tls_security_level</a>
- (default: $<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b></DT><DD>
- 
- <p> The SMTP TLS security level for the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server;
- when a non-empty value is specified, this overrides the obsolete
- parameters <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. See
- <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_tls_session_cache_timeout">tlsproxy_tls_session_cache_timeout</a>
- (default: $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>)</b></DT><DD>
- 
- <p> The expiration time of Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server TLS session
- cache information. A cache cleanup is performed periodically every
- $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> seconds. See
- <a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_use_tls">tlsproxy_use_tls</a>
- (default: $<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b></DT><DD>
- 
- <p> Opportunistic TLS: announce STARTTLS support to SMTP clients,
- but do not require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>
- for further details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="tlsproxy_watchdog_timeout">tlsproxy_watchdog_timeout</a>
- (default: 10s)</b></DT><DD>
- 
- <p> How much time a <a href="tlsproxy.8.html">tlsproxy(8)</a> process may take to process local
- or remote I/O before it is terminated by a built-in watchdog timer.
- This is a safety mechanism that prevents <a href="tlsproxy.8.html">tlsproxy(8)</a> from becoming
- non-responsive due to a bug in Postfix itself or in system software.
- To avoid false alarms and unnecessary cache corruption this limit
- cannot be set under 10s.  </p>
- 
- <p> Specify a non-zero time value (an integral value plus an optional
- one-letter suffix that specifies the time unit).  Time units: s
- (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
- 
- <p> This feature is available in Postfix 2.8.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="trace_service_name">trace_service_name</a>
--- 12831,12832 ----
***************
*** 16126,16128 ****
  <DT><b><a name="undisclosed_recipients_header">undisclosed_recipients_header</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 13091,13093 ----
  <DT><b><a name="undisclosed_recipients_header">undisclosed_recipients_header</a>
! (default: To: undisclosed-recipients:;)</b></DT><DD>
  
***************
*** 16130,16142 ****
  Message header that the Postfix <a href="cleanup.8.html">cleanup(8)</a> server inserts when a
! message contains no To: or Cc: message header. With Postfix 2.8
! and later, the default value is empty. With Postfix 2.4-2.7,
! specify an empty value to disable this feature.  </p>
! 
! <p> Example: </p>
! 
! <pre>
! # Default value before Postfix 2.8.
! # Note: the ":" and ";" are both required.
! <a href="postconf.5.html#undisclosed_recipients_header">undisclosed_recipients_header</a> = To: undisclosed-recipients:;
! </pre>
  
--- 13095,13098 ----
  Message header that the Postfix <a href="cleanup.8.html">cleanup(8)</a> server inserts when a
! message contains no To: or Cc: message header. With Postfix 2.4
! and later, specify an empty value to disable this feature.  </p>
  
***************
*** 16162,16179 ****
  
- <DT><b><a name="unknown_address_tempfail_action">unknown_address_tempfail_action</a>
- (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
- 
- <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
- or <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a> fail due to a temporary error
- condition. Specify "defer" to defer the remote SMTP client request
- immediately. With the default "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix
- SMTP server continues to look for opportunities to reject mail, and
- defers the client request only if it would otherwise be accepted.
- </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="unknown_client_reject_code">unknown_client_reject_code</a>
--- 13118,13119 ----
***************
*** 16195,16211 ****
  
- <DT><b><a name="unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a>
- (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
- 
- <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>
- fails due to an temporary error condition. Specify "defer" to defer
- the remote SMTP client request immediately. With the default
- "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
- for opportunities to reject mail, and defers the client request
- only if it would otherwise be accepted. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="unknown_hostname_reject_code">unknown_hostname_reject_code</a>
--- 13135,13136 ----
***************
*** 16357,16383 ****
  
! <p> The Postfix SMTP server's reply when rejecting mail with
! <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>. Do not include the numeric SMTP reply
! code or the enhanced status code. By default, the response includes
! actual address verification details.
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#unverified_recipient_reject_reason">unverified_recipient_reject_reason</a> = Recipient address lookup failed
! </pre>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a>
! (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
! 
! <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>
! fails due to a temporary error condition. Specify "defer" to defer
! the remote SMTP client request immediately. With the default
! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
! for opportunities to reject mail, and defers the client request
! only if it would otherwise be accepted. </p>
  
--- 13282,13286 ----
  
! <p> When rejecting mail with <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>, reply
! with this text as the reason, instead of actual address verification
! details.
  
***************
*** 16439,16465 ****
  
! <p> The Postfix SMTP server's reply when rejecting mail with
! <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>. Do not include the numeric SMTP reply
! code or the enhanced status code. By default, the response includes
! actual address verification details.
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#unverified_sender_reject_reason">unverified_sender_reject_reason</a> = Sender address lookup failed
! </pre>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="unverified_sender_tempfail_action">unverified_sender_tempfail_action</a>
! (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
! 
! <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>
! fails due to a temporary error condition. Specify "defer" to defer
! the remote SMTP client request immediately. With the default
! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
! for opportunities to reject mail, and defers the client request
! only if it would otherwise be accepted. </p>
  
--- 13342,13346 ----
  
! <p> When rejecting mail with <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>, reply with
! this text as the reason, instead of actual address verification
! details.
  
***************
*** 16709,16712 ****
  <p>
! The maximal size in bytes of an individual <a href="virtual.8.html">virtual(8)</a> mailbox or
! maildir file, or zero (no limit).  </p>
  
--- 13590,13594 ----
  <p>
! The maximal size in bytes of an individual mailbox or maildir file,
! or zero (no limit).
! </p>
  
***************
*** 16826,16829 ****
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> destination is optional; its syntax is documented
! in the manual page of the corresponding delivery agent.
  </p>
--- 13708,13711 ----
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> part is optional.  For more details see the
! <a href="transport.5.html">transport(5)</a> manual page.
  </p>

