-- generated message --

postconf.5.html has been updated:

*** /tmp/postconf.5.html.orig	2011-12-05 20:46:00.000000000 +0100
--- /tmp/postconf.5.html	2011-11-27 20:44:00.000000000 +0100
***************
*** 461,489 ****
  
- <DT><b><a name="address_verify_sender_ttl">address_verify_sender_ttl</a>
- (default: 0s)</b></DT><DD>
- 
- <p> The time between changes in the time-dependent portion of address
- verification probe sender addresses. The time-dependent portion is
- appended to the localpart of the address specified with the
- <a href="postconf.5.html#address_verify_sender">address_verify_sender</a> parameter. This feature is ignored when the
- probe sender addresses is the null sender, i.e. the <a href="postconf.5.html#address_verify_sender">address_verify_sender</a>
- value is empty or &lt;&gt;. </p>
- 
- <p> Historically, the probe sender address was fixed. This has
- caused such addresses to end up on spammer mailing lists, and has
- resulted in wasted network and processing resources.  </p>
- 
- <p> To enable time-dependent probe sender addresses, specify a
- non-zero time value (an integral value plus an optional one-letter
- suffix that specifies the time unit).  Specify a value of at least
- several hours, to avoid problems with senders that use greylisting.
- Avoid nice TTL values, to make the result less predictable.  Time
- units are: s (seconds), m (minutes), h (hours), d (days), w (weeks).
- </p>
- 
- <p> This feature is available in Postfix 2.9 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="address_verify_service_name">address_verify_service_name</a>
--- 461,462 ----
***************
*** 906,908 ****
  How long the <a href="postkick.1.html">postkick(1)</a> command waits for a request to enter the
! Postfix daemon process input buffer before giving up.
  </p>
--- 879,881 ----
  How long the <a href="postkick.1.html">postkick(1)</a> command waits for a request to enter the
! server's input buffer before giving up.
  </p>
***************
*** 1034,1036 ****
  
! <p> What remote SMTP clients are allowed to specify the XVERP command.
  This command requests that mail be delivered one recipient at a
--- 1007,1009 ----
  
! <p> What SMTP clients are allowed to specify the XVERP command.
  This command requests that mail be delivered one recipient at a
***************
*** 1293,1295 ****
  <p>
! Enable inter-operability with remote SMTP clients that implement an obsolete
  version of the AUTH command (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>). Examples of such clients
--- 1266,1268 ----
  <p>
! Enable inter-operability with SMTP clients that implement an obsolete
  version of the AUTH command (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>). Examples of such clients
***************
*** 2123,2125 ****
  <p>
! The default Postfix SMTP server response template for a request that is
  rejected by an RBL-based restriction. This template can be overruled
--- 2096,2098 ----
  <p>
! The default SMTP server response template for a request that is
  rejected by an RBL-based restriction. This template can be overruled
***************
*** 3427,3429 ****
  <p>
! With the default 100 Postfix SMTP server process limit, "<a href="postconf.5.html#in_flow_delay">in_flow_delay</a>
  = 1s" limits the mail inflow to 100 messages per second above the
--- 3400,3402 ----
  <p>
! With the default 100 SMTP server process limit, "<a href="postconf.5.html#in_flow_delay">in_flow_delay</a>
  = 1s" limits the mail inflow to 100 messages per second above the
***************
*** 3464,3467 ****
  "inside" and "outside" interfaces, this can prevent each instance from
! being able to reach remote SMTP servers on the "other side" of the
! firewall. Setting
  <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> to 0.0.0.0 avoids the potential problem for
--- 3437,3439 ----
  "inside" and "outside" interfaces, this can prevent each instance from
! being able to reach servers on the "other side" of the firewall. Setting
  <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> to 0.0.0.0 avoids the potential problem for
***************
*** 3626,3630 ****
  The time after which a client closes an idle internal communication
! channel.  The purpose is to allow Postfix daemon processes to
! terminate voluntarily after they become idle. This is used, for
! example, by the Postfix address resolving and rewriting clients.
  </p>
--- 3598,3602 ----
  The time after which a client closes an idle internal communication
! channel.  The purpose is to allow servers to terminate voluntarily
! after they become idle. This is used, for example, by the address
! resolving and rewriting clients.
  </p>
***************
*** 3664,3669 ****
  The time after which a client closes an active internal communication
! channel.  The purpose is to allow Postfix daemon processes to
! terminate voluntarily
  after reaching their client limit.  This is used, for example, by
! the Postfix address resolving and rewriting clients.
  </p>
--- 3636,3640 ----
  The time after which a client closes an active internal communication
! channel.  The purpose is to allow servers to terminate voluntarily
  after reaching their client limit.  This is used, for example, by
! the address resolving and rewriting clients.
  </p>
***************
*** 3705,3708 ****
  
! <p> When a remote LMTP server announces no DSN support, assume that
! the
  server performs final delivery, and send "delivered" delivery status
--- 3676,3678 ----
  
! <p> When an LMTP server announces no DSN support, assume that the
  server performs final delivery, and send "delivered" delivery status
***************
*** 3764,3767 ****
  The effectiveness of cached connections will be determined by the
! number of remote LMTP servers in use, and the concurrency limit specified
! for the Postfix LMTP client. Cached connections are closed under any of
  the following conditions:
--- 3734,3737 ----
  The effectiveness of cached connections will be determined by the
! number of LMTP servers in use, and the concurrency limit specified
! for the LMTP client. Cached connections are closed under any of
  the following conditions:
***************
*** 3771,3773 ****
  
! <li> The Postfix LMTP client idle time limit is reached.  This limit is
  specified with the Postfix <a href="postconf.5.html#max_idle">max_idle</a> configuration parameter.
--- 3741,3743 ----
  
! <li> The LMTP client idle time limit is reached.  This limit is
  specified with the Postfix <a href="postconf.5.html#max_idle">max_idle</a> configuration parameter.
***************
*** 3781,3783 ****
  
! <li> Upon the onset of another delivery request, the remote LMTP server
  associated with the current session does not respond to the RSET
--- 3751,3753 ----
  
! <li> Upon the onset of another delivery request, the LMTP server
  associated with the current session does not respond to the RSET
***************
*** 3788,3790 ****
  <p>
! Most of these limitations have been with the Postfix
  a connection cache that is shared among multiple LMTP client
--- 3758,3760 ----
  <p>
! Most of these limitations will be removed after Postfix implements
  a connection cache that is shared among multiple LMTP client
***************
*** 3810,3812 ****
  
! <p> The Postfix LMTP client time limit for completing a TCP connection, or
  zero (use the operating system built-in time limit).  When no
--- 3780,3782 ----
  
! <p> The LMTP client time limit for completing a TCP connection, or
  zero (use the operating system built-in time limit).  When no
***************
*** 3879,3884 ****
  
! <p> The Postfix LMTP client time limit for sending the LMTP ".",
! and for receiving the remote LMTP server response.  When no response
! is received within the deadline, a warning is logged that the mail
! may be delivered multiple times.  </p>
  
--- 3849,3854 ----
  
! <p> The LMTP client time limit for sending the LMTP ".", and for
! receiving the server response.  When no response is received within
! the deadline, a warning is logged that the mail may be delivered
! multiple times.  </p>
  
***************
*** 3896,3900 ****
  <p>
! The Postfix LMTP client time limit for sending the LMTP DATA command,
! and
! for receiving the remote LMTP server response.
  </p>
--- 3866,3869 ----
  <p>
! The LMTP client time limit for sending the LMTP DATA command, and
! for receiving the server response.
  </p>
***************
*** 3913,3916 ****
  <p>
! The Postfix LMTP client time limit for sending the LMTP message
! content.
  When the connection stalls for more than $<a href="postconf.5.html#lmtp_data_xfer_timeout">lmtp_data_xfer_timeout</a>
--- 3882,3884 ----
  <p>
! The LMTP client time limit for sending the LMTP message content.
  When the connection stalls for more than $<a href="postconf.5.html#lmtp_data_xfer_timeout">lmtp_data_xfer_timeout</a>
***************
*** 3969,3972 ****
  case insensitive lists of LHLO keywords (pipelining, starttls,
! auth, etc.) that the Postfix LMTP client will ignore in the LHLO
! response
  from a remote LMTP server. See <a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> for
--- 3937,3939 ----
  case insensitive lists of LHLO keywords (pipelining, starttls,
! auth, etc.) that the LMTP client will ignore in the LHLO response
  from a remote LMTP server. See <a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> for
***************
*** 3984,3987 ****
  <p> A case insensitive list of LHLO keywords (pipelining, starttls,
! auth, etc.) that the Postfix LMTP client will ignore in the LHLO
! response
  from a remote LMTP server. </p>
--- 3951,3953 ----
  <p> A case insensitive list of LHLO keywords (pipelining, starttls,
! auth, etc.) that the LMTP client will ignore in the LHLO response
  from a remote LMTP server. </p>
***************
*** 4095,4098 ****
  
! <p> The Postfix LMTP client time limit for sending the LHLO command,
! and for receiving the initial remote LMTP server response. </p>
  
--- 4061,4064 ----
  
! <p> The LMTP client time limit for sending the LHLO command, and
! for receiving the initial server response. </p>
  
***************
*** 4119,4122 ****
  <p>
! The Postfix LMTP client time limit for sending the MAIL FROM command,
! and for receiving the remote LMTP server response.
  </p>
--- 4085,4088 ----
  <p>
! The LMTP client time limit for sending the MAIL FROM command, and
! for receiving the server response.
  </p>
***************
*** 4234,4237 ****
  <p>
! The Postfix LMTP client time limit for sending the QUIT command,
! and for receiving the remote LMTP server response.
  </p>
--- 4200,4203 ----
  <p>
! The LMTP client time limit for sending the QUIT command, and for
! receiving the server response.
  </p>
***************
*** 4272,4275 ****
  <p>
! The Postfix LMTP client time limit for sending the RCPT TO command,
! and for receiving the remote LMTP server response.
  </p>
--- 4238,4241 ----
  <p>
! The LMTP client time limit for sending the RCPT TO command, and
! for receiving the server response.
  </p>
***************
*** 4298,4302 ****
  
! <p> The Postfix LMTP client time limit for sending the RSET command,
! and for receiving the remote LMTP server response. The LMTP client
! sends RSET in
  order to finish a recipient address probe, or to verify that a
--- 4264,4267 ----
  
! <p> The LMTP client time limit for sending the RSET command, and
! for receiving the server response. The LMTP client sends RSET in
  order to finish a recipient address probe, or to verify that a
***************
*** 4370,4372 ****
  <p>
! Optional Postfix LMTP client lookup tables with one username:password entry
  per host or domain.  If a remote host or domain has no username:password
--- 4335,4337 ----
  <p>
! Optional LMTP client lookup tables with one username:password entry
  per host or domain.  If a remote host or domain has no username:password
***************
*** 4485,4487 ****
  <p>
! Send an XFORWARD command to the remote LMTP server when the LMTP LHLO
  server response announces XFORWARD support.  This allows an <a href="lmtp.8.html">lmtp(8)</a>
--- 4450,4452 ----
  <p>
! Send an XFORWARD command to the LMTP server when the LMTP LHLO
  server response announces XFORWARD support.  This allows an <a href="lmtp.8.html">lmtp(8)</a>
***************
*** 4879,4882 ****
  <p>
! The Postfix LMTP client time limit for sending the XFORWARD command,
! and for receiving the remote LMTP server response.
  </p>
--- 4844,4847 ----
  <p>
! The LMTP client time limit for sending the XFORWARD command, and
! for receiving the server response.
  </p>
***************
*** 5005,5008 ****
  <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
! remote SMTP client TLS certificate fingerprint or public key fingerprint
! (Postfix 2.9 and later) is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
  The fingerprint digest algorithm is configurable via the
--- 4970,4972 ----
  <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
! client TLS certificate fingerprint is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
  The fingerprint digest algorithm is configurable via the
***************
*** 5014,5016 ****
  <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
! remote SMTP client TLS certificate is successfully verified, regardless of
  whether it is listed on the server, and regardless of the certifying
--- 4978,4980 ----
  <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
! client TLS certificate is successfully verified, regardless of
  whether it is listed on the server, and regardless of the certifying
***************
*** 6457,6459 ****
  <p>
! The list of "trusted" remote SMTP clients that have more privileges than
  "strangers".
--- 6421,6423 ----
  <p>
! The list of "trusted" SMTP clients that have more privileges than
  "strangers".
***************
*** 6526,6528 ****
  <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" when Postfix
! should "trust" remote SMTP clients in the same IP subnetworks as the local
  machine.  On Linux, this works correctly only with interfaces
--- 6490,6492 ----
  <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" when Postfix
! should "trust" SMTP clients in the same IP subnetworks as the local
  machine.  On Linux, this works correctly only with interfaces
***************
*** 6531,6533 ****
  <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = class" when Postfix should
! "trust" remote SMTP clients in the same IP class A/B/C networks as the
  local machine.  Don't do this with a dialup site - it would cause
--- 6495,6497 ----
  <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = class" when Postfix should
! "trust" SMTP clients in the same IP class A/B/C networks as the
  local machine.  Don't do this with a dialup site - it would cause
***************
*** 6875,6877 ****
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client sends
  a bare newline character, that is, a newline not preceded by carriage
--- 6839,6841 ----
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client sends
  a bare newline character, that is, a newline not preceded by carriage
***************
*** 6911,6914 ****
  <p> Enable "bare newline" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
! server. These tests are expensive: a remote SMTP client must
! disconnect after
  it passes the test, before it can talk to a real Postfix SMTP server.
--- 6875,6877 ----
  <p> Enable "bare newline" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
! server. These tests are expensive: a client must disconnect after
  it passes the test, before it can talk to a real Postfix SMTP server.
***************
*** 6927,6930 ****
  time, the client IP address is excluded from this test. The default
! is long because a remote SMTP client must disconnect after it passes
! the test,
  before it can talk to a real Postfix SMTP server. </p>
--- 6890,6892 ----
  time, the client IP address is excluded from this test. The default
! is long because a client must disconnect after it passes the test,
  before it can talk to a real Postfix SMTP server. </p>
***************
*** 6943,6945 ****
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client is
  permanently blacklisted with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter.
--- 6905,6907 ----
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client is
  permanently blacklisted with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter.
***************
*** 7027,7030 ****
  
! <p> How many simultaneous connections any remote SMTP client is
! allowed to have
  with the <a href="postscreen.8.html">postscreen(8)</a> daemon. By default, this limit is the same
--- 6989,6991 ----
  
! <p> How many simultaneous connections any client is allowed to have
  with the <a href="postscreen.8.html">postscreen(8)</a> daemon. By default, this limit is the same
***************
*** 7117,7119 ****
  
! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client's combined
  DNSBL score is equal to or greater than a threshold (as defined
--- 7078,7080 ----
  
! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client's combined
  DNSBL score is equal to or greater than a threshold (as defined
***************
*** 7195,7197 ****
  specified with <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>, <a href="postscreen.8.html">postscreen(8)</a> can drop
! the connection with the remote SMTP client. </p>
  
--- 7156,7158 ----
  specified with <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>, <a href="postscreen.8.html">postscreen(8)</a> can drop
! the connection with the SMTP client. </p>
  
***************
*** 7209,7213 ****
  <li> <p> When no "*weight" is specified, <a href="postscreen.8.html">postscreen(8)</a> increments
! the remote SMTP client's DNSBL score by 1.  Otherwise, the weight must be
  an integral number, and <a href="postscreen.8.html">postscreen(8)</a> adds the specified weight to
! the remote SMTP client's DNSBL score.  Specify a negative number for
  whitelisting.  </p>
--- 7170,7174 ----
  <li> <p> When no "*weight" is specified, <a href="postscreen.8.html">postscreen(8)</a> increments
! the SMTP client's DNSBL score by 1.  Otherwise, the weight must be
  an integral number, and <a href="postscreen.8.html">postscreen(8)</a> adds the specified weight to
! the SMTP client's DNSBL score.  Specify a negative number for
  whitelisting.  </p>
***************
*** 7245,7247 ****
  
! <p> The inclusive lower bound for blocking a remote SMTP client, based on
  its combined DNSBL score as defined with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
--- 7206,7208 ----
  
! <p> The inclusive lower bound for blocking an SMTP client, based on
  its combined DNSBL score as defined with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
***************
*** 7275,7277 ****
  
! <p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and
  require that clients use TLS encryption.  See smtpd_postscreen_enforce_tls
--- 7236,7238 ----
  
! <p> Mandatory TLS: announce STARTTLS support to SMTP clients, and
  require that clients use TLS encryption.  See smtpd_postscreen_enforce_tls
***************
*** 7313,7315 ****
  
! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client speaks
  before its turn within the time specified with the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
--- 7274,7276 ----
  
! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client speaks
  before its turn within the time specified with the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
***************
*** 7339,7341 ****
  
! <p> In either case, <a href="postscreen.8.html">postscreen(8)</a> will not whitelist the remote SMTP client
  IP address. </p>
--- 7300,7302 ----
  
! <p> In either case, <a href="postscreen.8.html">postscreen(8)</a> will not whitelist the SMTP client
  IP address. </p>
***************
*** 7412,7414 ****
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client sends
  non-SMTP commands as specified with the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a>
--- 7373,7375 ----
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client sends
  non-SMTP commands as specified with the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a>
***************
*** 7479,7482 ****
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client
! sends
  multiple commands instead of sending one command and waiting for
--- 7440,7442 ----
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when an SMTP client sends
  multiple commands instead of sending one command and waiting for
***************
*** 7547,7550 ****
  <p> The number of clients that can be waiting for service from a
! real Postfix SMTP server process. When this queue is full, all
! clients will
  receive a 421 reponse. </p>
--- 7507,7509 ----
  <p> The number of clients that can be waiting for service from a
! real SMTP server process. When this queue is full, all clients will
  receive a 421 reponse. </p>
***************
*** 7560,7563 ****
  <p> The number of non-whitelisted clients that can be waiting for
! a decision whether they will receive service from a real Postfix
! SMTP server
  process. When this queue is full, all non-whitelisted clients will
--- 7519,7521 ----
  <p> The number of non-whitelisted clients that can be waiting for
! a decision whether they will receive service from a real SMTP server
  process. When this queue is full, all non-whitelisted clients will
***************
*** 7573,7576 ****
  
! <p> Optional information that is appended after a 4XX or 5XX
! <a href="postscreen.8.html">postscreen(8)</a> server
  response. See <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> for further details.  </p>
--- 7531,7533 ----
  
! <p> Optional information that is appended after a 4XX or 5XX server
  response. See <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> for further details.  </p>
***************
*** 7598,7600 ****
  
! <p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
  but do not require that clients use TLS encryption. </p>
--- 7555,7557 ----
  
! <p> Opportunistic TLS: announce STARTTLS support to SMTP clients,
  but do not require that clients use TLS encryption. </p>
***************
*** 7611,7613 ****
  <p> How much time a <a href="postscreen.8.html">postscreen(8)</a> process may take to respond to
! a remote SMTP client command or to perform a cache operation before it
  is terminated by a built-in watchdog timer.  This is a safety
--- 7568,7570 ----
  <p> How much time a <a href="postscreen.8.html">postscreen(8)</a> process may take to respond to
! an SMTP client command or to perform a cache operation before it
  is terminated by a built-in watchdog timer.  This is a safety
***************
*** 7631,7633 ****
  <p> A list of local <a href="postscreen.8.html">postscreen(8)</a> server IP addresses where a
! non-whitelisted remote SMTP client can obtain <a href="postscreen.8.html">postscreen(8)</a>'s temporary
  whitelist status. This status is required before the client can
--- 7588,7590 ----
  <p> A list of local <a href="postscreen.8.html">postscreen(8)</a> server IP addresses where a
! non-whitelisted SMTP client can obtain <a href="postscreen.8.html">postscreen(8)</a>'s temporary
  whitelist status. This status is required before the client can
***************
*** 7952,7955 ****
  <p>
! What remote QMQP clients are allowed to connect to the Postfix QMQP
! server port.
  </p>
--- 7909,7911 ----
  <p>
! What clients are allowed to connect to the QMQP server port.
  </p>
***************
*** 8003,8007 ****
  <p>
! How long the Postfix QMQP server will pause before sending a negative
! reply to the remote QMQP client. The purpose is to slow down confused
! or malicious clients.
  </p>
--- 7959,7963 ----
  <p>
! How long the QMQP server will pause before sending a negative reply
! to the client. The purpose is to slow down confused or malicious
! clients.
  </p>
***************
*** 8022,8024 ****
  If a read or write operation blocks for more than $<a href="postconf.5.html#qmqpd_timeout">qmqpd_timeout</a>
! seconds the Postfix QMQP server gives up and disconnects.
  </p>
--- 7978,7980 ----
  If a read or write operation blocks for more than $<a href="postconf.5.html#qmqpd_timeout">qmqpd_timeout</a>
! seconds the QMQP server gives up and disconnects.
  </p>
***************
*** 8065,8068 ****
  The minimal amount of free space in bytes in the queue file system
! that is needed to receive mail.  This is currently used by the
! Postfix SMTP server to decide if it will accept any mail at all.
  </p>
--- 8021,8024 ----
  The minimal amount of free space in bytes in the queue file system
! that is needed to receive mail.  This is currently used by the SMTP
! server to decide if it will accept any mail at all.
  </p>
***************
*** 8373,8378 ****
  
! <p> List of tables with remote SMTP client-certificate fingerprints or
! public key fingerprints (Postfix 2.9 and later) for which the Postfix
! SMTP server will allow access with the <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
! feature.  The fingerprint digest algorithm is configurable via the
  <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
--- 8329,8334 ----
  
! <p> List of tables with remote SMTP client-certificate fingerprints
! for which the Postfix SMTP server will allow access with the
! <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> feature.
! The fingerprint digest algorithm is configurable via the
  <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
***************
*** 9094,9097 ****
  <p>
! With "<a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> = no", the Postfix SMTP client sends
! EHLO only when
  the word "ESMTP" appears in the server greeting banner (example:
--- 9050,9052 ----
  <p>
! With "<a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> = no", Postfix sends EHLO only when
  the word "ESMTP" appears in the server greeting banner (example:
***************
*** 9204,9206 ****
  <p>
! The Postfix SMTP client time limit for completing a TCP connection, or
  zero (use the operating system built-in time limit).
--- 9159,9161 ----
  <p>
! The SMTP client time limit for completing a TCP connection, or
  zero (use the operating system built-in time limit).
***************
*** 9362,9365 ****
  <p>
! The Postfix SMTP client time limit for sending the SMTP ".", and
! for receiving the remote SMTP server response.
  </p>
--- 9317,9320 ----
  <p>
! The SMTP client time limit for sending the SMTP ".", and for receiving
! the server response.
  </p>
***************
*** 9383,9386 ****
  <p>
! The Postfix SMTP client time limit for sending the SMTP DATA command,
! and for receiving the remote SMTP server response.
  </p>
--- 9338,9341 ----
  <p>
! The SMTP client time limit for sending the SMTP DATA command, and for
! receiving the server response.
  </p>
***************
*** 9399,9401 ****
  <p>
! The Postfix SMTP client time limit for sending the SMTP message content.
  When the connection makes no progress for more than $<a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
--- 9354,9356 ----
  <p>
! The SMTP client time limit for sending the SMTP message content.
  When the connection makes no progress for more than $<a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
***************
*** 9426,9429 ****
  <p>
! Note: the Postfix SMTP client always ignores MX records with equal
! or worse preference
  than the local MTA itself.
--- 9381,9383 ----
  <p>
! Note: Postfix always ignores MX records with equal or worse preference
  than the local MTA itself.
***************
*** 9589,9591 ****
  <p> Optional lookup tables that perform address rewriting in the
! Postfix SMTP client, typically to transform a locally valid address into
  a globally valid address when sending mail across the Internet.
--- 9543,9545 ----
  <p> Optional lookup tables that perform address rewriting in the
! SMTP client, typically to transform a locally valid address into
  a globally valid address when sending mail across the Internet.
***************
*** 9653,9656 ****
  <p>
! The Postfix SMTP client time limit for sending the HELO or EHLO command,
! and for receiving the initial remote SMTP server response.
  </p>
--- 9607,9610 ----
  <p>
! The SMTP client time limit for sending the HELO or EHLO command,
! and for receiving the initial server response.
  </p>
***************
*** 9727,9730 ****
  <p>
! The Postfix SMTP client time limit for sending the MAIL FROM command,
! and for receiving the remote SMTP server response.
  </p>
--- 9681,9684 ----
  <p>
! The SMTP client time limit for sending the MAIL FROM command, and
! for receiving the server response.
  </p>
***************
*** 9757,9760 ****
  The maximal number of MX (mail exchanger) IP addresses that can
! result from Postfix SMTP client mail exchanger lookups, or zero (no
! limit). Prior to
  Postfix version 2.3, this limit was disabled by default.
--- 9711,9713 ----
  The maximal number of MX (mail exchanger) IP addresses that can
! result from mail exchanger lookups, or zero (no limit). Prior to
  Postfix version 2.3, this limit was disabled by default.
***************
*** 9773,9776 ****
  <p> The maximal number of SMTP sessions per delivery request before
! the Postfix SMTP client
! gives up or delivers to a fall-back <a href="postconf.5.html#relayhost">relay host</a>, or zero (no
  limit). This restriction ignores sessions that fail to complete the
--- 9726,9728 ----
  <p> The maximal number of SMTP sessions per delivery request before
! giving up or delivering to a fall-back <a href="postconf.5.html#relayhost">relay host</a>, or zero (no
  limit). This restriction ignores sessions that fail to complete the
***************
*** 9914,9917 ****
  <p>
! The Postfix SMTP client time limit for sending the QUIT command,
! and for receiving the remote SMTP server response.
  </p>
--- 9866,9869 ----
  <p>
! The SMTP client time limit for sending the QUIT command, and for
! receiving the server response.
  </p>
***************
*** 9930,9933 ****
  <p>
! Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO commands
! as required
  by <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. This includes putting quotes around an address localpart
--- 9882,9884 ----
  <p>
! Quote addresses in SMTP MAIL FROM and RCPT TO commands as required
  by <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. This includes putting quotes around an address localpart
***************
*** 9975,9978 ****
  <p>
! The Postfix SMTP client time limit for sending the SMTP RCPT TO
! command, and for receiving the remote SMTP server response.
  </p>
--- 9926,9929 ----
  <p>
! The SMTP client time limit for sending the SMTP RCPT TO command, and
! for receiving the server response.
  </p>
***************
*** 10043,10047 ****
  
! <p> The Postfix SMTP client time limit for sending the RSET command,
! and for receiving the remote SMTP server response. The SMTP client
! sends RSET in
  order to finish a recipient address probe, or to verify that a
--- 9994,9997 ----
  
! <p> The SMTP client time limit for sending the RSET command, and
! for receiving the server response. The SMTP client sends RSET in
  order to finish a recipient address probe, or to verify that a
***************
*** 10186,10189 ****
  <p>
! Optional Postfix SMTP client lookup tables with one username:password
! entry
  per remote hostname or domain, or sender address when sender-dependent
--- 10136,10138 ----
  <p>
! Optional SMTP client lookup tables with one username:password entry
  per remote hostname or domain, or sender address when sender-dependent
***************
*** 10340,10343 ****
  <p>
! This allows a Postfix SMTP delivery agent, used for injecting mail
! into
  a content filter, to forward the name, address, protocol and HELO
--- 10289,10291 ----
  <p>
! This allows an "smtp" delivery agent, used for injecting mail into
  a content filter, to forward the name, address, protocol and HELO
***************
*** 10380,10383 ****
  <p>
! By default, the Postfix SMTP client moves on the next mail exchanger.
! Specify
  "<a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> = no" if Postfix should defer delivery
--- 10328,10330 ----
  <p>
! By default, Postfix moves on the next mail exchanger. Specify
  "<a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> = no" if Postfix should defer delivery
***************
*** 10387,10390 ****
  <p> This feature is available in Postfix 2.0 and earlier.
! Later Postfix versions always skip remote SMTP servers that greet
! with a
  4XX status code. </p>
--- 10334,10336 ----
  <p> This feature is available in Postfix 2.0 and earlier.
! Later Postfix versions always skip SMTP servers that greet with a
  4XX status code. </p>
***************
*** 10398,10401 ****
  <p>
! Skip remote SMTP servers that greet with a 5XX status code (go away,
! do
  not try again later).
--- 10344,10346 ----
  <p>
! Skip SMTP servers that greet with a 5XX status code (go away, do
  not try again later).
***************
*** 10743,10752 ****
  
! <p> List of acceptable remote SMTP server certificate fingerprints for
! the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> =
! fingerprint). At this security level, certificate authorities are not
! used, and certificate expiration times are ignored. Instead, server
! certificates are verified directly via their certificate fingerprint
! or public key fingerprint (Postfix 2.9 and later). The fingerprint
! is a message digest of the server certificate (or public key). The
! digest algorithm is selected via the <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b>
  parameter. </p>
--- 10688,10696 ----
  
! <p> List of acceptable remote SMTP server certificate fingerprints
! for the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> =
! fingerprint). At this security level, certificate authorities are
! not used, and certificate expiration times are ignored. Instead,
! server certificates are verified directly via their "fingerprint". The
! fingerprint is a message digest of the server certificate. The digest
! algorithm is selected via the <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b>
  parameter. </p>
***************
*** 10808,10816 ****
  (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> = fingerprint), the server certificate is
! verified by directly matching its certificate fingerprint or its public
! key fingerprint (Postfix 2.9 and later). The fingerprint is the
! message digest of the server certificate (or its public key)
! using the selected
  algorithm. With a digest algorithm resistant to "second pre-image"
  attacks, it is not feasible to create a new public key and a matching
! certificate (or public/private key-pair) that has the same fingerprint. </p>
  
--- 10752,10758 ----
  (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> = fingerprint), the server certificate is
! verified by directly matching its <i>fingerprint</i>. The fingerprint
! is the message digest of the server certificate using the selected
  algorithm. With a digest algorithm resistant to "second pre-image"
  attacks, it is not feasible to create a new public key and a matching
! certificate that has the same fingerprint. </p>
  
***************
*** 10850,10857 ****
  
- <p> Public key fingerprints are more difficult to extract, however,
- the SHA-1 public key fingerprint is often present as the value of the
- "Subject Key Identifier" extension in X.509v3 certificates. The Postfix
- SMTP server and client log the peer certificate fingerprint and public
- key fingerprint when TLS loglevel is 1 or higher. </p>
- 
  <p> This feature is available in Postfix 2.5 and later. </p>
--- 10792,10793 ----
***************
*** 10893,10909 ****
  
! <dt> </dt> <dd> 0 Log only a summary message on TLS handshake completion
! &mdash; no logging of remote SMTP server certificate trust-chain
! verification errors if server certificate verification is not required.
! With Postfix 2.8 and earlier, disable logging of TLS activity.  </dd>
! 
! <dt> </dt> <dd> 1 Also log remote SMTP server trust-chain verification
! errors and peer certificate summary information. With Postfix 2.8
! and earlier, log TLS handshake and certificate information.  </dd>
  
! <dt> </dt> <dd> 2 Also log levels during TLS negotiation.  </dd>
  
! <dt> </dt> <dd> 3 Also log hexadecimal and ASCII dump of TLS negotiation
  process.  </dd>
  
! <dt> </dt> <dd> 4 Also log hexadecimal and ASCII dump of complete
  transmission after STARTTLS. </dd>
--- 10829,10840 ----
  
! <dt> </dt> <dd> 0 Disable logging of TLS activity. </dd>
! 
! <dt> </dt> <dd> 1 Log TLS handshake and certificate information. </dd>
  
! <dt> </dt> <dd> 2 Log levels during TLS negotiation. </dd>
  
! <dt> </dt> <dd> 3 Log hexadecimal and ASCII dump of TLS negotiation
  process.  </dd>
  
! <dt> </dt> <dd> 4 Log hexadecimal and ASCII dump of complete
  transmission after STARTTLS. </dd>
***************
*** 10912,10915 ****
  
! <p> Do not use "<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> = 2" or higher except in case of
! problems. Use of loglevel 4 is strongly discouraged. </p>
  
--- 10843,10846 ----
  
! <p> Use "<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> = 3" only in case of problems. Use of
! loglevel 4 is strongly discouraged. </p>
  
***************
*** 10993,10995 ****
  <p> Additional list of ciphers or cipher types to exclude from the
! Postfix SMTP client cipher list at mandatory TLS security levels. This list
  works in addition to the exclusions listed with <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
--- 10924,10926 ----
  <p> Additional list of ciphers or cipher types to exclude from the
! SMTP client cipher list at mandatory TLS security levels. This list
  works in addition to the exclusions listed with <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
***************
*** 11204,11208 ****
  the optional <b>match</b> attribute, or else the <a href="postconf.5.html">main.cf</a>
! <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter, lists the certificate
! fingerprints or the public key fingerprint (Postfix 2.9 and later)
! of the valid server certificate. The digest
  algorithm used to calculate the fingerprint is selected by the
--- 11135,11138 ----
  the optional <b>match</b> attribute, or else the <a href="postconf.5.html">main.cf</a>
! <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter, lists the
! valid "fingerprints" of the server certificate. The digest
  algorithm used to calculate the fingerprint is selected by the
***************
*** 11337,11340 ****
  
! <p> How the Postfix SMTP client verifies the server certificate
! peername for the
  "secure" TLS security level. In a "secure" TLS policy table
--- 11267,11269 ----
  
! <p> The server certificate peername verification method for the
  "secure" TLS security level. In a "secure" TLS policy table
***************
*** 11420,11425 ****
  level, there are no trusted certificate authorities. The certificate
! trust chain, expiration date, ... are not checked. Instead, the
! <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter lists the certificate
! fingerprint or public key fingerprint (Postfix 2.9 and later) of
! the valid server certificate. The digest
  algorithm used to calculate the fingerprint is selected by the
--- 11349,11353 ----
  level, there are no trusted certificate authorities. The certificate
! trust chain, expiration date, ... are not checked. Instead,
! the <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter lists
! the valid "fingerprints" of the server certificate. The digest
  algorithm used to calculate the fingerprint is selected by the
***************
*** 11564,11567 ****
  
! <p> How the Postfix SMTP client verifies the server certificate
! peername for the
  "verify" TLS security level. In a "verify" TLS policy table
--- 11492,11494 ----
  
! <p> The server certificate peername verification method for the
  "verify" TLS security level. In a "verify" TLS policy table
***************
*** 11662,11665 ****
  <p>
! The Postfix SMTP client time limit for sending the XFORWARD command,
! and for receiving the remote SMTP server response.
  </p>
--- 11589,11592 ----
  <p>
! The SMTP client time limit for sending the XFORWARD command, and
! for receiving the server response.
  </p>
***************
*** 11681,11683 ****
  
! <p> What remote SMTP clients are allowed to specify the XVERP command.
  This command requests that mail be delivered one recipient at a
--- 11608,11610 ----
  
! <p> What SMTP clients are allowed to specify the XVERP command.
  This command requests that mail be delivered one recipient at a
***************
*** 11715,11718 ****
  <p>
! What remote SMTP clients are allowed to use the XCLIENT feature.  This
! command overrides remote SMTP client information that is used for access
  control. Typical use is for SMTP-based content filters, fetchmail-like
--- 11642,11645 ----
  <p>
! What SMTP clients are allowed to use the XCLIENT feature.  This
! command overrides SMTP client information that is used for access
  control. Typical use is for SMTP-based content filters, fetchmail-like
***************
*** 11756,11758 ****
  <p>
! What remote SMTP clients are allowed to use the XFORWARD feature.  This
  command forwards information that is used to improve logging after
--- 11683,11685 ----
  <p>
! What SMTP clients are allowed to use the XFORWARD feature.  This
  command forwards information that is used to improve logging after
***************
*** 12043,12046 ****
  <p>
! Optional Postfix SMTP server access restrictions in the context of
! a remote SMTP client connection request.
  See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
--- 11970,11973 ----
  <p>
! Optional SMTP server access restrictions in the context of a client
! SMTP connection request.
  See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
***************
*** 12069,12074 ****
  
! <dd> Use the remote SMTP client certificate fingerprint or the public key
! fingerprint (Postfix 2.9 and later) as lookup key for the specified
! <a href="access.5.html">access(5)</a> database; with Postfix version 2.2, also require that the
! remote SMTP client certificate is verified successfully.
  The fingerprint digest algorithm is configurable via the
--- 11996,12000 ----
  
! <dd> Use the client certificate fingerprint as lookup key for the
! specified <a href="access.5.html">access(5)</a> database; with Postfix version 2.2, also require that
! the SMTP client certificate is verified successfully.
  The fingerprint digest algorithm is configurable via the
***************
*** 12155,12158 ****
  <dd>Permit the request when the remote SMTP client certificate
! fingerprint or public key fingerprint (Postfix 2.9 and later) is
! listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
  The fingerprint digest algorithm is configurable via the
--- 12081,12083 ----
  <dd>Permit the request when the remote SMTP client certificate
! fingerprint is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
  The fingerprint digest algorithm is configurable via the
***************
*** 12539,12542 ****
  RCPT TO command is received. Specify "no" to create a mail transaction
! as soon as the Postfix SMTP server receives a valid MAIL FROM
! command. </p>
  
--- 12464,12466 ----
  RCPT TO command is received. Specify "no" to create a mail transaction
! as soon as the SMTP server receives a valid MAIL FROM command. </p>
  
***************
*** 12585,12588 ****
  case insensitive lists of EHLO keywords (pipelining, starttls, auth,
! etc.) that the Postfix SMTP server will not send in the EHLO response
! to a
  remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
--- 12509,12511 ----
  case insensitive lists of EHLO keywords (pipelining, starttls, auth,
! etc.) that the SMTP server will not send in the EHLO response to a
  remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
***************
*** 12599,12602 ****
  <p> A case insensitive list of EHLO keywords (pipelining, starttls,
! auth, etc.) that the Postfix SMTP server will not send in the EHLO
! response
  to a remote SMTP client. </p>
--- 12522,12524 ----
  <p> A case insensitive list of EHLO keywords (pipelining, starttls,
! auth, etc.) that the SMTP server will not send in the EHLO response
  to a remote SMTP client. </p>
***************
*** 12639,12641 ****
  
! <p> Mandatory TLS: announce STARTTLS support to remote SMTP clients,
  and require that clients use TLS encryption.  According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a>
--- 12561,12563 ----
  
! <p> Mandatory TLS: announce STARTTLS support to SMTP clients,
  and require that clients use TLS encryption.  According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a>
***************
*** 13441,13444 ****
  
! <p> Optional information that is appended after each Postfix SMTP
! server
  4XX or 5XX response. </p>
--- 13363,13365 ----
  
! <p> Optional information that is appended after each SMTP server
  4XX or 5XX response. </p>
***************
*** 14220,14222 ****
  session id generation when TLS session caching is turned off. This
! keeps remote SMTP clients from caching sessions that almost certainly cannot
  be re-used.  </p>
--- 14141,14143 ----
  session id generation when TLS session caching is turned off. This
! keeps clients from caching sessions that almost certainly cannot
  be re-used.  </p>
***************
*** 14595,14602 ****
  
! <p> The message digest algorithm to construct remote SMTP
! client-certificate
! fingerprints or public key fingerprints (Postfix 2.9 and later)
! for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and <b><a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a></b>. The
! default algorithm is <b>md5</b>, for backwards compatibility with Postfix
! releases prior to 2.5.  </p>
  
--- 14516,14522 ----
  
! <p> The message digest algorithm used to construct client-certificate
! fingerprints for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and
! <b><a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a></b>. The default algorithm is <b>md5</b>,
! for backwards compatibility with Postfix releases prior to 2.5.
! </p>
  
***************
*** 14631,14638 ****
  
- <p> Public key fingerprints are more difficult to extract, however,
- the SHA-1 public key fingerprint is often present as the value of the
- "Subject Key Identifier" extension in X.509v3 certificates. The Postfix
- SMTP server and client log the peer certificate fingerprint and public
- key fingerprint when TLS loglevel is 1 or higher. </p>
- 
  <p> Example: client-certificate access table, with sha1 fingerprints: </p>
--- 14551,14552 ----
***************
*** 14686,14701 ****
  
! <dt> </dt> <dd> 0 Log only a summary message on TLS handshake completion
! &mdash; no logging of remote SMTP client certificate trust-chain verification
! errors
! if client certificate verification is not required. With Postfix 2.8
! and earlier, disable logging of TLS activity. </dd>
! 
! <dt> </dt> <dd> 1 Also log trust-chain verification errors and peer
! certificate name and issuer. With Postfix 2.8 and earlier, log TLS
! handshake and certificate information. </dd>
  
! <dt> </dt> <dd> 2 Also log levels during TLS negotiation. </dd>
  
! <dt> </dt> <dd> 3 Also log hexadecimal and ASCII dump of TLS negotiation
! process. </dd>
  
--- 14600,14609 ----
  
! <dt> </dt> <dd> 0 Disable logging of TLS activity. </dd>
  
! <dt> </dt> <dd> 1 Log TLS handshake and certificate information. </dd>
  
! <dt> </dt> <dd> 2 Log levels during TLS negotiation. </dd>
! 
! <dt> </dt> <dd> 3 Log hexadecimal and ASCII dump of TLS negotiation
! process.  </dd>
  
***************
*** 14706,14709 ****
  
! <p> Do not use "<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> = 2" or higher except in case
! of problems. Use of loglevel 4 is strongly discouraged. </p>
  
--- 14614,14617 ----
  
! <p> Use "<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> = 3" only in case of problems. Use of
! loglevel 4 is strongly discouraged. </p>
  
***************
*** 14776,14778 ****
  anonymous ciphers, but these are automatically filtered out if the
! server is configured to ask for remote SMTP client certificates.  You are very
  unlikely to need to take any steps to exclude anonymous ciphers, they
--- 14684,14686 ----
  anonymous ciphers, but these are automatically filtered out if the
! server is configured to ask for client certificates.  You are very
  unlikely to need to take any steps to exclude anonymous ciphers, they
***************
*** 14792,14795 ****
  <p> Additional list of ciphers or cipher types to exclude from the
! Postfix SMTP server cipher list at mandatory TLS security levels.
! This list
  works in addition to the exclusions listed with <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
--- 14700,14702 ----
  <p> Additional list of ciphers or cipher types to exclude from the
! SMTP server cipher list at mandatory TLS security levels. This list
  works in addition to the exclusions listed with <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
***************
*** 14875,14877 ****
  headers that include information about the protocol and cipher used,
! as well as the remote SMTP client CommonName and client certificate issuer
  CommonName.  This is disabled by default, as the information may
--- 14782,14784 ----
  headers that include information about the protocol and cipher used,
! as well as the client CommonName and client certificate issuer
  CommonName.  This is disabled by default, as the information may
***************
*** 14915,14917 ****
  <dt><b>may</b></dt> <dd> Opportunistic TLS: announce STARTTLS support
! to remote SMTP clients, but do not require that clients use TLS encryption.
  </dd>
--- 14822,14824 ----
  <dt><b>may</b></dt> <dd> Opportunistic TLS: announce STARTTLS support
! to SMTP clients, but do not require that clients use TLS encryption.
  </dd>
***************
*** 14919,14921 ****
  <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption: announce
! STARTTLS support to remote SMTP clients, and require that clients use TLS
  encryption. According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> this MUST NOT be applied in case
--- 14826,14828 ----
  <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption: announce
! STARTTLS support to SMTP clients, and require that clients use TLS
  encryption. According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> this MUST NOT be applied in case
***************
*** 14929,14931 ****
  The Postfix SMTP server logs a warning and uses "encrypt" instead.
! To verify remote SMTP client certificates, see <a href="TLS_README.html">TLS_README</a> for a discussion
  of the <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>, <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>, and <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
--- 14836,14838 ----
  The Postfix SMTP server logs a warning and uses "encrypt" instead.
! To verify SMTP client certificates, see <a href="TLS_README.html">TLS_README</a> for a discussion
  of the <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>, <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>, and <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
***************
*** 15015,15017 ****
  
! <p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
  but do not require that clients use TLS encryption. </p>
--- 14922,14924 ----
  
! <p> Opportunistic TLS: announce STARTTLS support to SMTP clients,
  but do not require that clients use TLS encryption. </p>
***************
*** 15433,15436 ****
  
! <p> The elliptic curve used by the Postfix SMTP server for sensibly
! strong
  ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
--- 15340,15342 ----
  
! <p> The elliptic curve used by the SMTP server for sensibly strong
  ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
***************
*** 15462,15465 ****
  
! <p> The elliptic curve used by the Postfix SMTP server for maximally
! strong
  ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
--- 15368,15370 ----
  
! <p> The elliptic curve used by the SMTP server for maximally strong
  ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
***************
*** 15572,15576 ****
  
! <p> With SSLv3 and later, use the Postfix SMTP server's cipher
! preference order instead of the remote client's cipher preference
! order. </p>
  
--- 15477,15480 ----
  
! <p> With SSLv3 and later, use the server's cipher preference order
! instead of the client's cipher preference order. </p>
  
***************
*** 15674,15676 ****
  
! <p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and
  require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> for
--- 15578,15580 ----
  
! <p> Mandatory TLS: announce STARTTLS support to SMTP clients, and
  require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> for
***************
*** 15880,15883 ****
  
! <p> The message digest algorithm to construct remote SMTP
! client-certificate
  fingerprints. See <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> for further details.
--- 15784,15786 ----
  
! <p> The message digest algorithm used to construct client-certificate
  fingerprints. See <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> for further details.
***************
*** 16006,16008 ****
  
! <p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
  but do not require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>
--- 15909,15911 ----
  
! <p> Opportunistic TLS: announce STARTTLS support to SMTP clients,
  but do not require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>
***************
*** 16547,16549 ****
  <p>
! The Postfix SMTP server reply code when a recipient address matches
  $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> specifies a list
--- 16450,16452 ----
  <p>
! The SMTP server reply code when a recipient address matches
  $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> specifies a list
***************
*** 16563,16565 ****
  <p>
! The Postfix SMTP server reply code when a recipient address matches
  $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> specifies a list
--- 16466,16468 ----
  <p>
! The SMTP server reply code when a recipient address matches
  $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> specifies a list

