-- generated message --

postconf.5.html has been updated:

*** /tmp/postconf.5.html.orig	2012-03-05 11:40:00.000000000 +0100
--- /tmp/postconf.5.html	2012-03-18 19:00:02.000000000 +0100
***************
*** 87,109 ****
  
- <DT><b><a name="access_map_defer_code">access_map_defer_code</a>
- (default: 450)</b></DT><DD>
- 
- <p>
- The numerical Postfix SMTP server response code for
- an <a href="access.5.html">access(5)</a> map "defer" action, including "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>"
- or "<a href="postconf.5.html#defer_if_reject">defer_if_reject</a>". Prior to Postfix 2.6, the response
- is hard-coded as "450".
- </p>
- 
- <p>
- Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
- </p>
- 
- <p>
- This feature is available in Postfix 2.6 and later.
- </p>
- 
- 
- </DD>
- 
  <DT><b><a name="access_map_reject_code">access_map_reject_code</a>
--- 87,88 ----
***************
*** 112,115 ****
  <p>
! The numerical Postfix SMTP server response code for
! an <a href="access.5.html">access(5)</a> map "reject" action.
  </p>
--- 91,94 ----
  <p>
! The numerical Postfix SMTP server response code when a client
! is rejected by an <a href="access.5.html">access(5)</a> map restriction.
  </p>
***************
*** 123,146 ****
  
- <DT><b><a name="address_verify_cache_cleanup_interval">address_verify_cache_cleanup_interval</a>
- (default: 12h)</b></DT><DD>
- 
- <p> The amount of time between <a href="verify.8.html">verify(8)</a> address verification
- database cleanup runs. This feature requires that the database
- supports the "delete" and "sequence" operators.  Specify a zero
- interval to disable database cleanup. </p>
- 
- <p> After each database cleanup run, the <a href="verify.8.html">verify(8)</a> daemon logs the
- number of entries that were retained and dropped. A cleanup run is
- logged as "partial" when the daemon terminates early after "<b>postfix
- reload</b>", "<b>postfix stop</b>", or no requests for $<a href="postconf.5.html#max_idle">max_idle</a>
- seconds. </p>
- 
- <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
- (weeks). </p>
- 
- <p> This feature is available in Postfix 2.7. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="address_verify_default_transport">address_verify_default_transport</a>
--- 102,103 ----
***************
*** 176,181 ****
  <DT><b><a name="address_verify_map">address_verify_map</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
  <p>
! Lookup table for persistent address verification status
  storage.  The table is maintained by the <a href="verify.8.html">verify(8)</a> service, and
--- 133,138 ----
  <DT><b><a name="address_verify_map">address_verify_map</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional lookup table for persistent address verification status
  storage.  The table is maintained by the <a href="verify.8.html">verify(8)</a> service, and
***************
*** 185,190 ****
  <p>
! The lookup table is persistent by default (Postfix 2.7 and later).
! Specify an empty table name to keep the information in volatile
! memory which is lost after "<b>postfix reload</b>" or "<b>postfix
! stop</b>". This is the default with Postfix version 2.6 and earlier.
  </p>
--- 142,145 ----
  <p>
! By default, the information is kept in volatile memory, and is lost
! after "<b>postfix reload</b>" or "<b>postfix stop</b>".
  </p>
***************
*** 194,204 ****
  database becomes corrupted, the world comes to an end. To recover
! delete (NOT: truncate) the file and do "<b>postfix reload</b>".
  </p>
  
! <p> Postfix daemon processes do not use root privileges when opening
! this file (Postfix 2.5 and later).  The file must therefore be
! stored under a Postfix-owned directory such as the <a href="postconf.5.html#data_directory">data_directory</a>.
! As a migration aid, an attempt to open the file under a non-Postfix
! directory is redirected to the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>, and a
! warning is logged. </p>
  
--- 149,158 ----
  database becomes corrupted, the world comes to an end. To recover
! delete the file and do "<b>postfix reload</b>".
  </p>
  
! <p> As of version 2.5, Postfix no longer uses root privileges when
! opening this file. The file should now be stored under the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
! under a non-Postfix directory is redirected to the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
  
***************
*** 276,278 ****
  <DT><b><a name="address_verify_poll_count">address_verify_poll_count</a>
! (default: normal: 3, overload: 1)</b></DT><DD>
  
--- 230,232 ----
  <DT><b><a name="address_verify_poll_count">address_verify_poll_count</a>
! (default: 3)</b></DT><DD>
  
***************
*** 283,289 ****
  
! <p> By default, the Postfix SMTP server polls the <a href="verify.8.html">verify(8)</a> service
! up to three times under non-overload conditions, and only once when
! under overload.  With Postfix version 2.5 and earlier, the SMTP
! server always polls the <a href="verify.8.html">verify(8)</a> service up to three times by
! default.  </p>
  
--- 237,241 ----
  
! <p>
! The default poll count is 3.
! </p>
  
***************
*** 291,293 ****
  Specify 1 to implement a crude form of greylisting, that is, always
! defer the first delivery request for a new address.
  </p>
--- 243,245 ----
  Specify 1 to implement a crude form of greylisting, that is, always
! defer the first delivery request for a never seen before address.
  </p>
***************
*** 295,297 ****
  <p>
! Examples:
  </p>
--- 247,249 ----
  <p>
! Example:
  </p>
***************
*** 299,303 ****
  <pre>
- # Postfix &le; 2.6 default
- <a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> = 3
- # Poor man's greylisting
  <a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> = 1
--- 251,252 ----
***************
*** 435,447 ****
  
- <DT><b><a name="address_verify_sender_dependent_default_transport_maps">address_verify_sender_dependent_default_transport_maps</a>
- (default: $<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>)</b></DT><DD>
- 
- <p> Overrides the <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> parameter
- setting for address verification probes.  </p>
- 
- <p> This feature is available in Postfix 2.7 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="address_verify_sender_dependent_relayhost_maps">address_verify_sender_dependent_relayhost_maps</a>
--- 384,385 ----
***************
*** 461,489 ****
  
- <DT><b><a name="address_verify_sender_ttl">address_verify_sender_ttl</a>
- (default: 0s)</b></DT><DD>
- 
- <p> The time between changes in the time-dependent portion of address
- verification probe sender addresses. The time-dependent portion is
- appended to the localpart of the address specified with the
- <a href="postconf.5.html#address_verify_sender">address_verify_sender</a> parameter. This feature is ignored when the
- probe sender addresses is the null sender, i.e. the <a href="postconf.5.html#address_verify_sender">address_verify_sender</a>
- value is empty or &lt;&gt;. </p>
- 
- <p> Historically, the probe sender address was fixed. This has
- caused such addresses to end up on spammer mailing lists, and has
- resulted in wasted network and processing resources.  </p>
- 
- <p> To enable time-dependent probe sender addresses, specify a
- non-zero time value (an integral value plus an optional one-letter
- suffix that specifies the time unit).  Specify a value of at least
- several hours, to avoid problems with senders that use greylisting.
- Avoid nice TTL values, to make the result less predictable.  Time
- units are: s (seconds), m (minutes), h (hours), d (days), w (weeks).
- </p>
- 
- <p> This feature is available in Postfix 2.9 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="address_verify_service_name">address_verify_service_name</a>
--- 399,400 ----
***************
*** 695,697 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 606,608 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 749,762 ****
  
- <DT><b><a name="always_add_missing_headers">always_add_missing_headers</a>
- (default: no)</b></DT><DD>
- 
- <p> Always add (Resent-) From:, To:, Date: or Message-ID: headers
- when not present.  Postfix 2.6 and later add these headers only
- when clients match the <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> parameter
- setting.  Earlier Postfix versions always add these headers; this
- may break DKIM signatures that cover non-existent headers. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="always_bcc">always_bcc</a>
--- 660,661 ----
***************
*** 776,779 ****
  To avoid mailer loops, automatic BCC recipients are not generated
! after Postfix forwards mail internally, or after Postfix generates
! mail itself. </p>
  
--- 675,678 ----
  To avoid mailer loops, automatic BCC recipients are not generated
! for mail that Postfix forwards internally, nor for mail that Postfix
! generates itself. </p>
  
***************
*** 859,861 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 758,760 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 896,898 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 795,797 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 906,908 ****
  How long the <a href="postkick.1.html">postkick(1)</a> command waits for a request to enter the
! Postfix daemon process input buffer before giving up.
  </p>
--- 805,807 ----
  How long the <a href="postkick.1.html">postkick(1)</a> command waits for a request to enter the
! server's input buffer before giving up.
  </p>
***************
*** 922,924 ****
  <DT><b><a name="authorized_flush_users">authorized_flush_users</a>
! (default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
  
--- 821,823 ----
  <DT><b><a name="authorized_flush_users">authorized_flush_users</a>
! (default: static:anyone)</b></DT><DD>
  
***************
*** 956,958 ****
  <DT><b><a name="authorized_mailq_users">authorized_mailq_users</a>
! (default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
  
--- 855,857 ----
  <DT><b><a name="authorized_mailq_users">authorized_mailq_users</a>
! (default: static:anyone)</b></DT><DD>
  
***************
*** 990,992 ****
  <DT><b><a name="authorized_submit_users">authorized_submit_users</a>
! (default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
  
--- 889,891 ----
  <DT><b><a name="authorized_submit_users">authorized_submit_users</a>
! (default: static:anyone)</b></DT><DD>
  
***************
*** 1021,1023 ****
  <pre>
! <a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> = !www, <a href="DATABASE_README.html#types">static</a>:all
  </pre>
--- 920,922 ----
  <pre>
! <a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> = !www, static:all
  </pre>
***************
*** 1034,1036 ****
  
! <p> What remote SMTP clients are allowed to specify the XVERP command.
  This command requests that mail be delivered one recipient at a
--- 933,935 ----
  
! <p> What SMTP clients are allowed to specify the XVERP command.
  This command requests that mail be delivered one recipient at a
***************
*** 1246,1252 ****
  <p> The maximal amount of original message text that is sent in a
! non-delivery notification. Specify a byte count.  A message is
! returned as either message/rfc822 (the complete original) or as
! text/rfc822-headers (the headers only).  With Postfix version 2.4
! and earlier, a message is always returned as message/rfc822 and is
! truncated when it exceeds the size limit.
  </p>
--- 1145,1151 ----
  <p> The maximal amount of original message text that is sent in a
! non-delivery notification. Specify a byte count. With Postfix 2.4
! and later, a message is returned as either message/rfc822 (the
! complete original) or as text/rfc822-headers (the headers only).
! With earlier Postfix versions, a message is always returned as
! message/rfc822 and is truncated when it exceeds the size limit.
  </p>
***************
*** 1293,1295 ****
  <p>
! Enable inter-operability with remote SMTP clients that implement an obsolete
  version of the AUTH command (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>). Examples of such clients
--- 1192,1194 ----
  <p>
! Enable inter-operability with SMTP clients that implement an obsolete
  version of the AUTH command (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>). Examples of such clients
***************
*** 1360,1362 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 1259,1261 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 1537,1540 ****
  
- <p> This feature is available in Postfix 2.2 and later. </p>
- 
  
--- 1436,1437 ----
***************
*** 1568,1593 ****
  
! <p> After the message is queued, send the entire message to the
! specified <i>transport:destination</i>. The <i>transport</i> name
! specifies the first field of a mail delivery agent definition in
! <a href="master.5.html">master.cf</a>; the syntax of the next-hop <i>destination</i> is described
! in the manual page of the corresponding delivery agent.  More
! information about external content filters is in the Postfix
! <a href="FILTER_README.html">FILTER_README</a> file.  </p>
! 
! <p> Notes: </p>
! 
! <ul>
! 
! <li> <p> This setting has lower precedence than a FILTER action
! that is specified in an <a href="access.5.html">access(5)</a>, <a href="header_checks.5.html">header_checks(5)</a> or <a href="header_checks.5.html">body_checks(5)</a>
! table. </p>
! 
! <li> <p> The meaning of an empty next-hop filter <i>destination</i>
! is version dependent.  Postfix 2.7 and later will use the recipient
! domain; earlier versions will use $<a href="postconf.5.html#myhostname">myhostname</a>.  Specify
! "<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> = $<a href="postconf.5.html#myhostname">myhostname</a>" for compatibility with Postfix
! 2.6 or earlier, or specify a <a href="postconf.5.html#content_filter">content_filter</a> value with an explicit
! next-hop <i>destination</i>.  </p>
  
! </ul>
  
--- 1465,1477 ----
  
! <p>
! The name of a mail delivery transport that filters mail after
! it is queued.
! </p>
  
! <p>
! This parameter uses the same syntax as the right-hand side of a
! Postfix <a href="transport.5.html">transport(5)</a> table. This setting has a lower precedence
! than a content filter that is specified with an <a href="access.5.html">access(5)</a> table or
! in a <a href="header_checks.5.html">header_checks(5)</a> or <a href="header_checks.5.html">body_checks(5)</a> table.
! </p>
  
***************
*** 1622,1656 ****
  
- <DT><b><a name="daemon_table_open_error_is_fatal">daemon_table_open_error_is_fatal</a>
- (default: no)</b></DT><DD>
- 
- <p> How a Postfix daemon process handles errors while opening lookup
- tables: gradual degradation or immediate termination. </p>
- 
- <dl>
- 
- <dt> <b> no </b> (default) </dt> <dd> <p> Gradual degradation: a
- daemon process logs a message of type "error" and continues execution
- with reduced functionality. Features that do not depend on the
- unavailable table will work normally, while features that depend
- on the table will result in a type "warning" message.  <br> When
- the <a href="postconf.5.html#notify_classes">notify_classes</a> parameter value contains the "data" class, the
- Postfix SMTP server and client will report transcripts of sessions
- with an error because a table is unavailable.  </p> </dd>
- 
- <dt> <b> yes </b> (historical behavior) </dt> <dd> <p> Immediate
- termination: a daemon process logs a type "fatal" message and
- terminates immediately.  This option reduces the number of possible
- code paths through Postfix, and may therefore be slightly more
- secure than the default.  </p> </dd>
- 
- </dl>
- 
- <p> For the sake of sanity, the number of type "error" messages is
- limited to 13 over the lifetime of a daemon process. </p>
- 
- <p> This feature is available in Postfix 2.9 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="daemon_timeout">daemon_timeout</a>
--- 1506,1507 ----
***************
*** 1711,1713 ****
  <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = 127.0.0.1
! <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = example.com
  </pre>
--- 1562,1564 ----
  <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = 127.0.0.1
! <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = some.domain
  </pre>
***************
*** 1960,1962 ****
  
! <p> Use <a href="postconf.5.html#transport_destination_concurrency_negative_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
  to specify a transport-specific override, where <i>transport</i>
--- 1811,1813 ----
  
! <p> Use <a href="postconf.5.html#transport_destination_concurrency_positive_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
  to specify a transport-specific override, where <i>transport</i>
***************
*** 2033,2036 ****
  <p> NOTE: the delay is enforced by the queue manager. The delay
! timer state does not survive "<b>postfix reload</b>" or "<b>postfix
! stop</b>".
  </p>
--- 1884,1886 ----
  <p> NOTE: the delay is enforced by the queue manager. The delay
! timer state does not survive "postfix reload" or "postfix stop".
  </p>
***************
*** 2042,2048 ****
  
- <p> NOTE: with a non-zero _destination_rate_delay, specify a
- <a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a> of 10
- or more to prevent Postfix from deferring all mail for the same
- destination after only one connection or handshake error. </p>
- 
  <p> This feature is available in Postfix 2.5 and later. </p>
--- 1892,1893 ----
***************
*** 2093,2109 ****
  
- <DT><b><a name="default_filter_nexthop">default_filter_nexthop</a>
- (default: empty)</b></DT><DD>
- 
- <p> When a <a href="postconf.5.html#content_filter">content_filter</a> or FILTER request specifies no explicit
- next-hop destination, use $<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> instead; when
- that value is empty, use the domain in the recipient address.
- Specify "<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> = $<a href="postconf.5.html#myhostname">myhostname</a>" for compatibility
- with Postfix version 2.6 and earlier, or specify an explicit next-hop
- destination with each <a href="postconf.5.html#content_filter">content_filter</a> value or FILTER action. </p>
- 
- <p> This feature is available in Postfix 2.7 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="default_minimum_delivery_slots">default_minimum_delivery_slots</a>
--- 1938,1939 ----
***************
*** 2156,2158 ****
  <p>
! The default Postfix SMTP server response template for a request that is
  rejected by an RBL-based restriction. This template can be overruled
--- 1986,1988 ----
  <p>
! The default SMTP server response template for a request that is
  rejected by an RBL-based restriction. This template can be overruled
***************
*** 2346,2356 ****
  $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
! or $<a href="postconf.5.html#relay_domains">relay_domains</a>.  This information can be overruled with the
! <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> parameter and with the
! <a href="transport.5.html">transport(5)</a> table. </p>
! 
! <p>
! In order of decreasing precedence, the nexthop destination is taken
! from $<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>, $<a href="postconf.5.html#default_transport">default_transport</a>,
  $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or from the recipient
! domain.
  </p>
--- 2176,2182 ----
  $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
! or $<a href="postconf.5.html#relay_domains">relay_domains</a>.  In order of decreasing precedence, the nexthop
! destination is taken from $<a href="postconf.5.html#default_transport">default_transport</a>,
  $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or from the recipient
! domain. This information can be overruled with the <a href="transport.5.html">transport(5)</a>
! table.
  </p>
***************
*** 2360,2363 ****
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> destination is optional; its syntax is documented
! in the manual page of the corresponding delivery agent.
  </p>
--- 2186,2189 ----
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> part is optional.  For more details see the
! <a href="transport.5.html">transport(5)</a> manual page.
  </p>
***************
*** 2462,2464 ****
  
! <li> c = time in connection setup, including DNS, EHLO and STARTTLS
  
--- 2288,2290 ----
  
! <li> c = time in connection setup, including DNS, EHLO and TLS
  
***************
*** 2651,2673 ****
  
- <DT><b><a name="dnsblog_reply_delay">dnsblog_reply_delay</a>
- (default: 0s)</b></DT><DD>
- 
- <p> A debugging aid to artifically delay DNS responses. </p>
- 
- <p> This feature is available in Postfix 2.8.  </p>
- 
- 
- </DD>
- 
- <DT><b><a name="dnsblog_service_name">dnsblog_service_name</a>
- (default: dnsblog)</b></DT><DD>
- 
- <p> The name of the <a href="dnsblog.8.html">dnsblog(8)</a> service entry in <a href="master.5.html">master.cf</a>. This
- service performs DNS white/blacklist lookups. </p>
- 
- <p> This feature is available in Postfix 2.8 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="dont_remove">dont_remove</a>
--- 2477,2478 ----
***************
*** 2704,2716 ****
  
- <DT><b><a name="empty_address_default_transport_maps_lookup_key">empty_address_default_transport_maps_lookup_key</a>
- (default: &lt;&gt;)</b></DT><DD>
- 
- <p> The <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> search string that
- will be used instead of the null sender address. </p>
- 
- <p> This feature is available in Postfix 2.7 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="empty_address_recipient">empty_address_recipient</a>
--- 2509,2510 ----
***************
*** 2752,2839 ****
  
- <DT><b><a name="enable_long_queue_ids">enable_long_queue_ids</a>
- (default: no)</b></DT><DD>
- 
- <p> Enable long, non-repeating, queue IDs (queue file names).  The
- benefit of non-repeating names is simpler logfile analysis and
- easier queue migration (there is no need to run "postsuper" to
- change queue file names that don't match their message file inode
- number).  </p>
- 
- <p> Note: see below for how to prepare long queue file names
- for migration to Postfix &le; 2.8. </p>
- 
- <p> Changing the parameter value to "yes" has the following effects:
- </p>
- 
- <ul>
- 
- <li> <p> Existing queue file names are not affected. </p>
- 
- <li> <p> New queue files are created with names such as 3Pt2mN2VXxznjll.
- These are encoded in a 52-character alphabet that contains digits
- (0-9), upper-case letters (B-Z) and lower-case letters (b-z). For
- safety reasons the vowels (AEIOUaeiou) are excluded from the alphabet.
- The name format is: 6 or more characters for the time in seconds,
- 4 characters for the time in microseconds, the 'z'; the remainder
- is the file inode number encoded in the first 51 characters of the
- 52-character alphabet.  </p>
- 
- <li> <p> New messages have a Message-ID header with
- <i>queueID</i>@<i><a href="postconf.5.html#myhostname">myhostname</a></i>.  </p>
- 
- <li> <p> The mailq (postqueue -p) output has a wider Queue ID column.
- The number of whitespace-separated fields is not changed. <p>
- 
- <li> <p> The <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> algorithm uses the first characters
- of the queue file creation time in microseconds, after conversion
- into hexadecimal representation. This produces the same queue hashing
- behavior as if the queue file name was created with "<a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>
- = no". </p>
- 
- </ul>
- 
- <p> Changing the parameter value to "no" has the following effects:
- </p>
- 
- <ul>
- 
- <li> <p> Existing long queue file names are renamed to the short
- form (while running "postfix reload" or "postsuper").  </p>
- 
- <li> <p> New queue files are created with names such as C3CD21F3E90
- from a hexadecimal alphabet that contains digits (0-9) and upper-case
- letters (A-F). The name format is: 5 characters for the time in
- microseconds; the remainder is the file inode number. </p>
- 
- <li> <p> New messages have a Message-ID header with
- <i>YYYYMMDDHHMMSS.queueid</i>@<i><a href="postconf.5.html#myhostname">myhostname</a></i>, where
- <i>YYYYMMDDHHMMSS</i> are the year, month, day, hour, minute and
- second.
- 
- <li> <p> The mailq (postqueue -p) output has the same format as
- with Postfix &le; 2.8. <p>
- 
- <li> <p> The <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> algorithm uses the first characters
- of the queue file name, with the hexadecimal representation of the
- file creation time in microseconds.  </p>
- 
- </ul>
- 
- <p> Before migration to Postfix &le; 2.8, the following commands
- are required to convert long queue file names into short names: </p>
- 
- <pre>
- # postfix stop
- # postconf <a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>=no
- # postsuper
- </pre>
- 
- <p> Repeat the postsuper command until it reports no more queue file
- name changes. </p>
- 
- <p> This feature is available in Postfix 2.9 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="enable_original_recipient">enable_original_recipient</a>
--- 2546,2547 ----
***************
*** 3254,3267 ****
  The number of subdirectory levels for queue directories listed with
! the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> parameter. Queue hashing is implemented by
! creating one or more levels of directories with one-character names.
! Originally, these directory names were equal to the first characters
! of the queue file name, with the hexadecimal representation of the
! file creation time in microseconds. </p>
! 
! <p> With long queue file names, queue hashing produces the same
! results as with short names. The file creation time in microseconds
! is converted into hexadecimal form before the result is used for
! queue hashing.  The base 16 encoding gives finer control over the
! number of subdirectories than is possible with the base 52 encoding
! of long queue file names.  </p>
  
--- 2962,2965 ----
  The number of subdirectory levels for queue directories listed with
! the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> parameter.
! </p>
  
***************
*** 3460,3462 ****
  <p>
! With the default 100 Postfix SMTP server process limit, "<a href="postconf.5.html#in_flow_delay">in_flow_delay</a>
  = 1s" limits the mail inflow to 100 messages per second above the
--- 3158,3160 ----
  <p>
! With the default 100 SMTP server process limit, "<a href="postconf.5.html#in_flow_delay">in_flow_delay</a>
  = 1s" limits the mail inflow to 100 messages per second above the
***************
*** 3497,3500 ****
  "inside" and "outside" interfaces, this can prevent each instance from
! being able to reach remote SMTP servers on the "other side" of the
! firewall. Setting
  <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> to 0.0.0.0 avoids the potential problem for
--- 3195,3197 ----
  "inside" and "outside" interfaces, this can prevent each instance from
! being able to reach servers on the "other side" of the firewall. Setting
  <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> to 0.0.0.0 avoids the potential problem for
***************
*** 3536,3538 ****
  <DT><b><a name="inet_protocols">inet_protocols</a>
! (default: all)</b></DT><DD>
  
--- 3233,3235 ----
  <DT><b><a name="inet_protocols">inet_protocols</a>
! (default: ipv4)</b></DT><DD>
  
***************
*** 3544,3552 ****
  
- <p> With Postfix 2.8 and earlier the default is "ipv4". For backwards
- compatibility with these releases, the Postfix 2.9 and later upgrade
- procedure appends an explicit "<a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4" setting to
- <a href="postconf.5.html">main.cf</a> when no explicit setting is present. This compatibility
- workaround will be phased out as IPv6 deployment becomes more common.
- </p>
- 
  <p> This feature is available in Postfix 2.2 and later. </p>
--- 3241,3242 ----
***************
*** 3564,3566 ****
  <p> When IPv4 support is enabled via the <a href="postconf.5.html#inet_protocols">inet_protocols</a> parameter,
! Postfix will look up DNS type A records, and will convert
  IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original
--- 3254,3256 ----
  <p> When IPv4 support is enabled via the <a href="postconf.5.html#inet_protocols">inet_protocols</a> parameter,
! Postfix will to DNS type A record lookups, and will convert
  IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original
***************
*** 3581,3584 ****
  <pre>
! <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4
! <a href="postconf.5.html#inet_protocols">inet_protocols</a> = all (DEFAULT)
  <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv6
--- 3271,3274 ----
  <pre>
! <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4 (DEFAULT)
! <a href="postconf.5.html#inet_protocols">inet_protocols</a> = all
  <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv6
***************
*** 3659,3663 ****
  The time after which a client closes an idle internal communication
! channel.  The purpose is to allow Postfix daemon processes to
! terminate voluntarily after they become idle. This is used, for
! example, by the Postfix address resolving and rewriting clients.
  </p>
--- 3349,3353 ----
  The time after which a client closes an idle internal communication
! channel.  The purpose is to allow servers to terminate voluntarily
! after they become idle. This is used, for example, by the address
! resolving and rewriting clients.
  </p>
***************
*** 3697,3702 ****
  The time after which a client closes an active internal communication
! channel.  The purpose is to allow Postfix daemon processes to
! terminate voluntarily
  after reaching their client limit.  This is used, for example, by
! the Postfix address resolving and rewriting clients.
  </p>
--- 3387,3391 ----
  The time after which a client closes an active internal communication
! channel.  The purpose is to allow servers to terminate voluntarily
  after reaching their client limit.  This is used, for example, by
! the address resolving and rewriting clients.
  </p>
***************
*** 3724,3749 ****
  
- <DT><b><a name="lmtp_address_preference">lmtp_address_preference</a>
- (default: ipv6)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
- 
- </DD>
- 
- <DT><b><a name="lmtp_assume_final">lmtp_assume_final</a>
- (default: no)</b></DT><DD>
- 
- <p> When a remote LMTP server announces no DSN support, assume that
- the
- server performs final delivery, and send "delivered" delivery status
- notifications instead of "relayed". The default setting is backwards
- compatible to avoid the infinetisimal possibility of breaking
- existing LMTP-based content filters. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_bind_address">lmtp_bind_address</a>
--- 3413,3414 ----
***************
*** 3770,3782 ****
  
- <DT><b><a name="lmtp_body_checks">lmtp_body_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_body_checks">smtp_body_checks</a> configuration
- parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.5 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_cache_connection">lmtp_cache_connection</a>
--- 3435,3436 ----
***************
*** 3790,3800 ****
  
- <p> This parameter is available in Postfix version 2.2 and earlier.
- With Postfix version 2.3 and later, see <a href="postconf.5.html#lmtp_connection_cache_on_demand">lmtp_connection_cache_on_demand</a>,
- <a href="postconf.5.html#lmtp_connection_cache_destinations">lmtp_connection_cache_destinations</a>, or <a href="postconf.5.html#lmtp_connection_reuse_time_limit">lmtp_connection_reuse_time_limit</a>.
- </p>
- 
  <p>
  The effectiveness of cached connections will be determined by the
! number of remote LMTP servers in use, and the concurrency limit specified
! for the Postfix LMTP client. Cached connections are closed under any of
  the following conditions:
--- 3444,3449 ----
  
  <p>
  The effectiveness of cached connections will be determined by the
! number of LMTP servers in use, and the concurrency limit specified
! for the LMTP client. Cached connections are closed under any of
  the following conditions:
***************
*** 3804,3806 ****
  
! <li> The Postfix LMTP client idle time limit is reached.  This limit is
  specified with the Postfix <a href="postconf.5.html#max_idle">max_idle</a> configuration parameter.
--- 3453,3455 ----
  
! <li> The LMTP client idle time limit is reached.  This limit is
  specified with the Postfix <a href="postconf.5.html#max_idle">max_idle</a> configuration parameter.
***************
*** 3814,3816 ****
  
! <li> Upon the onset of another delivery request, the remote LMTP server
  associated with the current session does not respond to the RSET
--- 3463,3465 ----
  
! <li> Upon the onset of another delivery request, the LMTP server
  associated with the current session does not respond to the RSET
***************
*** 3821,3823 ****
  <p>
! Most of these limitations have been with the Postfix
  a connection cache that is shared among multiple LMTP client
--- 3470,3472 ----
  <p>
! Most of these limitations will be removed after Postfix implements
  a connection cache that is shared among multiple LMTP client
***************
*** 3843,3845 ****
  
! <p> The Postfix LMTP client time limit for completing a TCP connection, or
  zero (use the operating system built-in time limit).  When no
--- 3492,3494 ----
  
! <p> The LMTP client time limit for completing a TCP connection, or
  zero (use the operating system built-in time limit).  When no
***************
*** 3912,3917 ****
  
! <p> The Postfix LMTP client time limit for sending the LMTP ".",
! and for receiving the remote LMTP server response.  When no response
! is received within the deadline, a warning is logged that the mail
! may be delivered multiple times.  </p>
  
--- 3561,3566 ----
  
! <p> The LMTP client time limit for sending the LMTP ".", and for
! receiving the server response.  When no response is received within
! the deadline, a warning is logged that the mail may be delivered
! multiple times.  </p>
  
***************
*** 3929,3933 ****
  <p>
! The Postfix LMTP client time limit for sending the LMTP DATA command,
! and
! for receiving the remote LMTP server response.
  </p>
--- 3578,3581 ----
  <p>
! The LMTP client time limit for sending the LMTP DATA command, and
! for receiving the server response.
  </p>
***************
*** 3946,3949 ****
  <p>
! The Postfix LMTP client time limit for sending the LMTP message
! content.
  When the connection stalls for more than $<a href="postconf.5.html#lmtp_data_xfer_timeout">lmtp_data_xfer_timeout</a>
--- 3594,3596 ----
  <p>
! The LMTP client time limit for sending the LMTP message content.
  When the connection stalls for more than $<a href="postconf.5.html#lmtp_data_xfer_timeout">lmtp_data_xfer_timeout</a>
***************
*** 4002,4005 ****
  case insensitive lists of LHLO keywords (pipelining, starttls,
! auth, etc.) that the Postfix LMTP client will ignore in the LHLO
! response
  from a remote LMTP server. See <a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> for
--- 3649,3651 ----
  case insensitive lists of LHLO keywords (pipelining, starttls,
! auth, etc.) that the LMTP client will ignore in the LHLO response
  from a remote LMTP server. See <a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> for
***************
*** 4017,4020 ****
  <p> A case insensitive list of LHLO keywords (pipelining, starttls,
! auth, etc.) that the Postfix LMTP client will ignore in the LHLO
! response
  from a remote LMTP server. </p>
--- 3663,3665 ----
  <p> A case insensitive list of LHLO keywords (pipelining, starttls,
! auth, etc.) that the LMTP client will ignore in the LHLO response
  from a remote LMTP server. </p>
***************
*** 4038,4050 ****
  
- <DT><b><a name="lmtp_dns_resolver_options">lmtp_dns_resolver_options</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_dns_resolver_options">smtp_dns_resolver_options</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_enforce_tls">lmtp_enforce_tls</a>
--- 3683,3684 ----
***************
*** 4071,4083 ****
  
- <DT><b><a name="lmtp_header_checks">lmtp_header_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_header_checks">smtp_header_checks</a> configuration
- parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.5 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_host_lookup">lmtp_host_lookup</a>
--- 3705,3706 ----
***************
*** 4114,4116 ****
  /etc/postfix/<a href="master.5.html">master.cf</a>:
!     mylmtp ... lmtp -o <a href="postconf.5.html#lmtp_lhlo_name">lmtp_lhlo_name</a>=foo.bar.com
  </pre>
--- 3737,3739 ----
  /etc/postfix/<a href="master.5.html">master.cf</a>:
!     mylmtp ... lmtp -o <a href="postconf.5.html#lmtp_lhloname">lmtp_lhlo_name</a>=foo.bar.com
  </pre>
***************
*** 4128,4131 ****
  
! <p> The Postfix LMTP client time limit for sending the LHLO command,
! and for receiving the initial remote LMTP server response. </p>
  
--- 3751,3754 ----
  
! <p> The LMTP client time limit for sending the LHLO command, and
! for receiving the initial server response. </p>
  
***************
*** 4152,4155 ****
  <p>
! The Postfix LMTP client time limit for sending the MAIL FROM command,
! and for receiving the remote LMTP server response.
  </p>
--- 3775,3778 ----
  <p>
! The LMTP client time limit for sending the MAIL FROM command, and
! for receiving the server response.
  </p>
***************
*** 4164,4176 ****
  
- <DT><b><a name="lmtp_mime_header_checks">lmtp_mime_header_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_mime_header_checks">smtp_mime_header_checks</a>
- configuration parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.5 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_mx_address_limit">lmtp_mx_address_limit</a>
--- 3787,3788 ----
***************
*** 4197,4220 ****
  
- <DT><b><a name="lmtp_nested_header_checks">lmtp_nested_header_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_nested_header_checks">smtp_nested_header_checks</a>
- configuration parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.5 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="lmtp_per_record_deadline">lmtp_per_record_deadline</a>
- (default: no)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.9 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_pix_workaround_delay_time">lmtp_pix_workaround_delay_time</a>
--- 3809,3810 ----
***************
*** 4267,4270 ****
  <p>
! The Postfix LMTP client time limit for sending the QUIT command,
! and for receiving the remote LMTP server response.
  </p>
--- 3857,3860 ----
  <p>
! The LMTP client time limit for sending the QUIT command, and for
! receiving the server response.
  </p>
***************
*** 4305,4308 ****
  <p>
! The Postfix LMTP client time limit for sending the RCPT TO command,
! and for receiving the remote LMTP server response.
  </p>
--- 3895,3898 ----
  <p>
! The LMTP client time limit for sending the RCPT TO command, and
! for receiving the server response.
  </p>
***************
*** 4317,4329 ****
  
- <DT><b><a name="lmtp_reply_filter">lmtp_reply_filter</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.7 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_rset_timeout">lmtp_rset_timeout</a>
--- 3907,3908 ----
***************
*** 4331,4335 ****
  
! <p> The Postfix LMTP client time limit for sending the RSET command,
! and for receiving the remote LMTP server response. The LMTP client
! sends RSET in
  order to finish a recipient address probe, or to verify that a
--- 3910,3913 ----
  
! <p> The LMTP client time limit for sending the RSET command, and
! for receiving the server response. The LMTP client sends RSET in
  order to finish a recipient address probe, or to verify that a
***************
*** 4403,4405 ****
  <p>
! Optional Postfix LMTP client lookup tables with one username:password entry
  per host or domain.  If a remote host or domain has no username:password
--- 3981,3983 ----
  <p>
! Optional LMTP client lookup tables with one username:password entry
  per host or domain.  If a remote host or domain has no username:password
***************
*** 4503,4515 ****
  
- <DT><b><a name="lmtp_send_dummy_mail_auth">lmtp_send_dummy_mail_auth</a>
- (default: no)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.9 and later.  </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_send_xforward_command">lmtp_send_xforward_command</a>
--- 4081,4082 ----
***************
*** 4518,4520 ****
  <p>
! Send an XFORWARD command to the remote LMTP server when the LMTP LHLO
  server response announces XFORWARD support.  This allows an <a href="lmtp.8.html">lmtp(8)</a>
--- 4085,4087 ----
  <p>
! Send an XFORWARD command to the LMTP server when the LMTP LHLO
  server response announces XFORWARD support.  This allows an <a href="lmtp.8.html">lmtp(8)</a>
***************
*** 4609,4621 ****
  
- <DT><b><a name="lmtp_tls_block_early_mail_reply">lmtp_tls_block_early_mail_reply</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_block_early_mail_reply">smtp_tls_block_early_mail_reply</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.7 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_tls_cert_file">lmtp_tls_cert_file</a>
--- 4176,4177 ----
***************
*** 4631,4643 ****
  
- <DT><b><a name="lmtp_tls_ciphers">lmtp_tls_ciphers</a>
- (default: export)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> configuration
- parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_tls_dcert_file">lmtp_tls_dcert_file</a>
--- 4187,4188 ----
***************
*** 4664,4673 ****
  
! <DT><b><a name="lmtp_tls_eccert_file">lmtp_tls_eccert_file</a>
! (default: empty)</b></DT><DD>
  
! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> configuration
! parameter.  See there for details. </p>
  
! <p> This feature is available in Postfix 2.6 and later, when Postfix is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
  
--- 4209,4217 ----
  
! <DT><b><a name="lmtp_tls_enforce_peername">lmtp_tls_enforce_peername</a>
! (default: yes)</b></DT><DD>
  
! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
! configuration parameter.  See there for details. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 4676,4707 ****
  
! <DT><b><a name="lmtp_tls_eckey_file">lmtp_tls_eckey_file</a>
  (default: empty)</b></DT><DD>
  
! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> configuration
! parameter.  See there for details. </p>
  
! <p> This feature is available in Postfix 2.6 and later, when Postfix is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="lmtp_tls_enforce_peername">lmtp_tls_enforce_peername</a>
! (default: yes)</b></DT><DD>
! 
! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
! configuration parameter.  See there for details. </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="lmtp_tls_exclude_ciphers">lmtp_tls_exclude_ciphers</a>
! (default: empty)</b></DT><DD>
! 
! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
! configuration parameter.  See there for details. </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
  
--- 4220,4228 ----
  
! <DT><b><a name="lmtp_tls_exclude_ciphers">lmtp_tls_exclude_ciphers</a>
  (default: empty)</b></DT><DD>
  
! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
! configuration parameter.  See there for details. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 4820,4832 ****
  
- <DT><b><a name="lmtp_tls_protocols">lmtp_tls_protocols</a>
- (default: empty)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> configuration
- parameter. See there for details. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_tls_scert_verifydepth">lmtp_tls_scert_verifydepth</a>
--- 4341,4342 ----
***************
*** 4912,4915 ****
  <p>
! The Postfix LMTP client time limit for sending the XFORWARD command,
! and for receiving the remote LMTP server response.
  </p>
--- 4422,4425 ----
  <p>
! The LMTP client time limit for sending the XFORWARD command, and
! for receiving the server response.
  </p>
***************
*** 4939,4943 ****
  By default, non-Postfix commands are executed directly; commands
! are given to given to the default shell (typically, /bin/sh) only
! when they contain shell meta characters or shell built-in commands.
! </p>
  
--- 4449,4452 ----
  By default, non-Postfix commands are executed directly; commands
! are given to given to /bin/sh only when they contain shell meta
! characters or shell built-in commands.  </p>
  
***************
*** 4957,4959 ****
  <a href="postconf.5.html#local_command_shell">local_command_shell</a> = /some/where/smrsh -c
- <a href="postconf.5.html#local_command_shell">local_command_shell</a> = /bin/bash -c
  </pre>
--- 4466,4467 ----
***************
*** 5038,5041 ****
  <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
! remote SMTP client TLS certificate fingerprint or public key fingerprint
! (Postfix 2.9 and later) is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
  The fingerprint digest algorithm is configurable via the
--- 4546,4548 ----
  <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
! client TLS certificate fingerprint is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
  The fingerprint digest algorithm is configurable via the
***************
*** 5047,5049 ****
  <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
! remote SMTP client TLS certificate is successfully verified, regardless of
  whether it is listed on the server, and regardless of the certifying
--- 4554,4556 ----
  <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
! client TLS certificate is successfully verified, regardless of
  whether it is listed on the server, and regardless of the certifying
***************
*** 5070,5072 ****
  <pre>
! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all
  </pre>
--- 4577,4579 ----
  <pre>
! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all
  </pre>
***************
*** 5178,5181 ****
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> destination is optional; its syntax is documented
! in the manual page of the corresponding delivery agent.
  </p>
--- 4685,4688 ----
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> part is optional.  For more details see the
! <a href="transport.5.html">transport(5)</a> manual page.
  </p>
***************
*** 5626,5629 ****
  client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>,
! <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a>, <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or
! <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction.
  </p>
--- 5133,5135 ----
  client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>,
! <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction.
  </p>
***************
*** 5715,5717 ****
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
--- 5221,5223 ----
  <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
***************
*** 5763,5797 ****
  
- <DT><b><a name="master_service_disable">master_service_disable</a>
- (default: empty)</b></DT><DD>
- 
- <p> Selectively disable <a href="master.8.html">master(8)</a> listener ports by service type
- or by service name and type.  Specify a list of service types
- ("inet", "unix", "fifo", or "pass") or "name.type" tuples, where
- "name" is the first field of a <a href="master.5.html">master.cf</a> entry and "type" is a
- service type. As with other Postfix matchlists, a search stops at
- the first match.  Specify "!pattern" to exclude a service from the
- list. By default, all <a href="master.8.html">master(8)</a> listener ports are enabled.  </p>
- 
- <p> Note: this feature does not support "/file/name" or "<a href="DATABASE_README.html">type:table</a>"
- patterns, nor does it support wildcards such as "*" or "all". This
- is intentional. </p>
- 
- <p> Examples: </p>
- 
- <pre>
- # Turn on all <a href="master.8.html">master(8)</a> listener ports (the default).
- <a href="postconf.5.html#master_service_disable">master_service_disable</a> =
- # Turn off only the main SMTP listener port.
- <a href="postconf.5.html#master_service_disable">master_service_disable</a> = smtp.inet
- # Turn off all TCP/IP listener ports.
- <a href="postconf.5.html#master_service_disable">master_service_disable</a> = inet
- # Turn off all TCP/IP listener ports except "foo".
- <a href="postconf.5.html#master_service_disable">master_service_disable</a> = !foo.inet, inet
- </pre>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="max_idle">max_idle</a>
--- 5269,5270 ----
***************
*** 5874,5882 ****
  
- <p> Note 1: this feature does not recognize text that requires MIME
- decoding. It inspects raw message content, just like <a href="postconf.5.html#header_checks">header_checks</a>
- and <a href="postconf.5.html#body_checks">body_checks</a>.  </p>
- 
- <p> Note 2: this feature is disabled with "<a href="postconf.5.html#receive_override_options">receive_override_options</a>
- = <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>".  </p>
- 
  <p> Example: </p>
--- 5347,5348 ----
***************
*** 5915,5923 ****
  
- <p> Note 1: this feature does not recognize text that requires MIME
- decoding. It inspects raw message content, just like <a href="postconf.5.html#header_checks">header_checks</a>
- and <a href="postconf.5.html#body_checks">body_checks</a>.  </p>
- 
- <p> Note 2: this feature is disabled with "<a href="postconf.5.html#receive_override_options">receive_override_options</a>
- = <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>".  </p>
- 
  <p> Example: </p>
--- 5381,5382 ----
***************
*** 5951,5953 ****
  <DT><b><a name="milter_connect_macros">milter_connect_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5410,5412 ----
  <DT><b><a name="milter_connect_macros">milter_connect_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 5997,5999 ****
  <DT><b><a name="milter_data_macros">milter_data_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5456,5458 ----
  <DT><b><a name="milter_data_macros">milter_data_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6025,6029 ****
  
- <dt>quarantine</dt> <dd>Like "accept", but freeze the message in
- the "<a href="QSHAPE_README.html#hold_queue">hold" queue</a>. Available with Postfix 2.6 and later. </dd>
- 
  </dl>
--- 5484,5485 ----
***************
*** 6036,6038 ****
  <DT><b><a name="milter_end_of_data_macros">milter_end_of_data_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5492,5494 ----
  <DT><b><a name="milter_end_of_data_macros">milter_end_of_data_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6048,6050 ****
  <DT><b><a name="milter_end_of_header_macros">milter_end_of_header_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5504,5506 ----
  <DT><b><a name="milter_end_of_header_macros">milter_end_of_header_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6059,6094 ****
  
- <DT><b><a name="milter_header_checks">milter_header_checks</a>
- (default: empty)</b></DT><DD>
- 
- <p> Optional lookup tables for content inspection of message headers
- that are produced by Milter applications.  See the <a href="header_checks.5.html">header_checks(5)</a>
- manual page available actions. Currently, PREPEND is not implemented.
- </p>
- 
- <p> The following example sends all mail that is marked as SPAM to
- a spam handling machine. Note that matches are case-insensitive
- by default. </p>
- 
- <pre>
- /etc/postfix/<a href="postconf.5.html">main.cf</a>:
-     <a href="postconf.5.html#milter_header_checks">milter_header_checks</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/<a href="postconf.5.html#milter_header_checks">milter_header_checks</a>
- </pre>
- 
- <pre>
- /etc/postfix/<a href="postconf.5.html#milter_header_checks">milter_header_checks</a>:
-     /^X-SPAM-FLAG:\s+YES/ FILTER mysmtp:sanitizer.example.com:25
- </pre>
- 
- <p> The <a href="postconf.5.html#milter_header_checks">milter_header_checks</a> mechanism could also be used for
- whitelisting. For example it could be used to skip heavy content
- inspection for DKIM-signed mail from known friendly domains. </p>
- 
- <p> This feature is available in Postfix 2.7, and as an optional
- patch for Postfix 2.6. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="milter_helo_macros">milter_helo_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5515,5518 ----
  
  <DT><b><a name="milter_helo_macros">milter_helo_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6129,6131 ****
  <DT><b><a name="milter_mail_macros">milter_mail_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5553,5555 ----
  <DT><b><a name="milter_mail_macros">milter_mail_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6141,6147 ****
  <DT><b><a name="milter_protocol">milter_protocol</a>
! (default: 6)</b></DT><DD>
  
  <p> The mail filter protocol version and optional protocol extensions
! for communication with a Milter application; prior to Postfix 2.6
! the default protocol is 2. Postfix
  sends this version number during the initial protocol handshake.
--- 5565,5570 ----
  <DT><b><a name="milter_protocol">milter_protocol</a>
! (default: 2)</b></DT><DD>
  
  <p> The mail filter protocol version and optional protocol extensions
! for communication with a Milter (mail filter) application. Postfix
  sends this version number during the initial protocol handshake.
***************
*** 6155,6158 ****
  <dt>2</dt> <dd>Use Sendmail 8 mail filter protocol version 2 (default
! with Sendmail version 8.11 .. 8.13 and Postfix version 2.3 ..
! 2.5).</dd>
  
--- 5578,5580 ----
  <dt>2</dt> <dd>Use Sendmail 8 mail filter protocol version 2 (default
! as of Sendmail version 8.11).</dd>
  
***************
*** 6163,6165 ****
  <dt>6</dt> <dd>Use Sendmail 8 mail filter protocol version 6 (default
! with Sendmail version 8.14 and Postfix version 2.6).</dd>
  
--- 5585,5587 ----
  <dt>6</dt> <dd>Use Sendmail 8 mail filter protocol version 6 (default
! as of Sendmail version 8.14).</dd>
  
***************
*** 6182,6184 ****
  <DT><b><a name="milter_rcpt_macros">milter_rcpt_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5604,5606 ----
  <DT><b><a name="milter_rcpt_macros">milter_rcpt_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6194,6196 ****
  <DT><b><a name="milter_unknown_command_macros">milter_unknown_command_macros</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 5616,5618 ----
  <DT><b><a name="milter_unknown_command_macros">milter_unknown_command_macros</a>
! (default: see postconf -n output)</b></DT><DD>
  
***************
*** 6275,6361 ****
  
- <DT><b><a name="multi_instance_directories">multi_instance_directories</a>
- (default: empty)</b></DT><DD>
- 
- <p> An optional list of non-default Postfix configuration directories;
- these directories belong to additional Postfix instances that share
- the Postfix executable files and documentation with the default
- Postfix instance, and that are started, stopped, etc., together
- with the default Postfix instance.  Specify a list of pathnames
- separated by comma or whitespace.  </p>
- 
- <p> When $<a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> is empty, the <a href="postfix.1.html">postfix(1)</a> command
- runs in single-instance mode and operates on a single Postfix
- instance only. Otherwise, the <a href="postfix.1.html">postfix(1)</a> command runs in multi-instance
- mode and invokes the multi-instance manager specified with the
- <a href="postconf.5.html#multi_instance_wrapper">multi_instance_wrapper</a> parameter. The multi-instance manager in
- turn executes <a href="postfix.1.html">postfix(1)</a> commands for the default instance and for
- all Postfix instances in $<a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>.  </p>
- 
- <p> Currently, this parameter setting is ignored except for the
- default <a href="postconf.5.html">main.cf</a> file. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="multi_instance_enable">multi_instance_enable</a>
- (default: no)</b></DT><DD>
- 
- <p> Allow this Postfix instance to be started, stopped, etc., by a
- multi-instance manager.  By default, new instances are created in
- a safe state that prevents them from being started inadvertently.
- This parameter is reserved for the multi-instance manager.  </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="multi_instance_group">multi_instance_group</a>
- (default: empty)</b></DT><DD>
- 
- <p> The optional instance group name of this Postfix instance. A
- group identifies closely-related Postfix instances that the
- multi-instance manager can start, stop, etc., as a unit.  This
- parameter is reserved for the multi-instance manager. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="multi_instance_name">multi_instance_name</a>
- (default: empty)</b></DT><DD>
- 
- <p> The optional instance name of this Postfix instance. This name
- becomes also the default value for the <a href="postconf.5.html#syslog_name">syslog_name</a> parameter. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
- <DT><b><a name="multi_instance_wrapper">multi_instance_wrapper</a>
- (default: empty)</b></DT><DD>
- 
- <p> The pathname of a multi-instance manager command that the
- <a href="postfix.1.html">postfix(1)</a> command invokes when the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>
- parameter value is non-empty. The pathname may be followed by
- initial command arguments separated by whitespace; shell
- metacharacters such as quotes are not supported in this context.
- </p>
- 
- <p> The <a href="postfix.1.html">postfix(1)</a> command invokes the manager command with the
- <a href="postfix.1.html">postfix(1)</a> non-option command arguments on the manager command line,
- and with all installation configuration parameters exported into
- the manager command process environment. The manager command in
- turn invokes the <a href="postfix.1.html">postfix(1)</a> command for individual Postfix instances
- as "postfix -c <i><a href="postconf.5.html#config_directory">config_directory</a></i> <i>command</i>".  </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a>
--- 5697,5698 ----
***************
*** 6449,6452 ****
  The internet domain name of this mail system.  The default is to
! use $<a href="postconf.5.html#myhostname">myhostname</a> minus the first component, or "localdomain" (Postfix
! 2.3 and later).  $<a href="postconf.5.html#mydomain">mydomain</a> is used as
  a default value for many other configuration parameters.
--- 5786,5788 ----
  The internet domain name of this mail system.  The default is to
! use $<a href="postconf.5.html#myhostname">myhostname</a> minus the first component.  $<a href="postconf.5.html#mydomain">mydomain</a> is used as
  a default value for many other configuration parameters.
***************
*** 6470,6475 ****
  The internet hostname of this mail system. The default is to use
! the fully-qualified domain name (FQDN) from gethostname(), or to
! use the non-FQDN result from gethostname() and append ".$<a href="postconf.5.html#mydomain">mydomain</a>".
! $<a href="postconf.5.html#myhostname">myhostname</a> is used as a default value for many other configuration
! parameters.  </p>
  
--- 5806,5810 ----
  The internet hostname of this mail system. The default is to use
! the fully-qualified domain name from gethostname(). $<a href="postconf.5.html#myhostname">myhostname</a> is
! used as a default value for many other configuration parameters.
! </p>
  
***************
*** 6480,6482 ****
  <pre>
! <a href="postconf.5.html#myhostname">myhostname</a> = host.example.com
  </pre>
--- 5815,5817 ----
  <pre>
! <a href="postconf.5.html#myhostname">myhostname</a> = host.domain.tld
  </pre>
***************
*** 6490,6492 ****
  <p>
! The list of "trusted" remote SMTP clients that have more privileges than
  "strangers".
--- 5825,5827 ----
  <p>
! The list of "trusted" SMTP clients that have more privileges than
  "strangers".
***************
*** 6559,6561 ****
  <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" when Postfix
! should "trust" remote SMTP clients in the same IP subnetworks as the local
  machine.  On Linux, this works correctly only with interfaces
--- 5894,5896 ----
  <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" when Postfix
! should "trust" SMTP clients in the same IP subnetworks as the local
  machine.  On Linux, this works correctly only with interfaces
***************
*** 6564,6566 ****
  <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = class" when Postfix should
! "trust" remote SMTP clients in the same IP class A/B/C networks as the
  local machine.  Don't do this with a dialup site - it would cause
--- 5899,5901 ----
  <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = class" when Postfix should
! "trust" SMTP clients in the same IP class A/B/C networks as the
  local machine.  Don't do this with a dialup site - it would cause
***************
*** 6645,6648 ****
  via the Postfix <a href="qmqpd.8.html">qmqpd(8)</a> server, and old mail that is re-injected
! into the queue with "postsuper -r".  Specify space or comma as
! separator. See the <a href="MILTER_README.html">MILTER_README</a> document for details.  </p>
  
--- 5980,5983 ----
  via the Postfix <a href="qmqpd.8.html">qmqpd(8)</a> server, and old mail that is re-injected
! into the queue with "postsuper -r".  See the <a href="MILTER_README.html">MILTER_README</a> document
! for details.  </p>
  
***************
*** 6688,6697 ****
  
- <dt><b>data</b></dt>
- 
- <dd>Send the postmaster a transcript of the SMTP session with an
- error because a critical data file was unavailable. The notification
- is sent to the address specified with the <a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a>
- configuration parameter (default: postmaster). <br> This feature
- is available in Postfix 2.9 and later.  </dd>
- 
  <dt><b>delay</b></dt>
--- 6023,6024 ----
***************
*** 6778,6781 ****
  only domains whose primary MX hosts match the listed networks.
! The parameter value syntax is the same as with the <a href="postconf.5.html#mynetworks">mynetworks</a>
! parameter; note, however, that the default value is empty.  </p>
  
--- 6105,6107 ----
  only domains whose primary MX hosts match the listed networks.
! </p>
  
***************
*** 6812,6834 ****
  
! <DT><b><a name="postmulti_control_commands">postmulti_control_commands</a>
! (default: reload flush)</b></DT><DD>
! 
! <p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager
! treats as "control" commands, that operate on running instances. For
! these commands, disabled instances are skipped. </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="postmulti_start_commands">postmulti_start_commands</a>
! (default: start)</b></DT><DD>
  
! <p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager treats
! as "start" commands. For these commands, disabled instances are "checked"
! rather than "started", and failure to "start" a member instance of an
! instance group will abort the start-up of later instances. </p>
  
! <p> This feature is available in Postfix 2.6 and later. </p>
  
--- 6138,6165 ----
  
! <DT><b><a name="prepend_delivered_header">prepend_delivered_header</a>
! (default: command, file, forward)</b></DT><DD>
  
+ <p> The message delivery contexts where the Postfix <a href="local.8.html">local(8)</a> delivery
+ agent prepends a Delivered-To:  message header with the address
+ that the mail was delivered to. This information is used for mail
+ delivery loop detection.  </p>
  
! <p>
! By default, the Postfix local delivery agent prepends a Delivered-To:
! header when forwarding mail and when delivering to file (mailbox)
! and command. Turning off the Delivered-To: header when forwarding
! mail is not recommended.
! </p>
  
! <p>
! Specify zero or more of <b>forward</b>, <b>file</b>, or <b>command</b>.
! </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a> = forward
! </pre>
  
***************
*** 6837,6846 ****
  
! <DT><b><a name="postmulti_stop_commands">postmulti_stop_commands</a>
! (default: see "postconf -d" output)</b></DT><DD>
! 
! <p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager treats
! as "stop" commands. For these commands, disabled instances are skipped,
! and enabled instances are processed in reverse order. </p>
  
! <p> This feature is available in Postfix 2.6 and later. </p>
  
--- 6168,6175 ----
  
! <DT><b><a name="process_id">process_id</a>
! (read-only)</b></DT><DD>
  
! <p>
! The process ID of a Postfix command or daemon process.
! </p>
  
***************
*** 6849,6945 ****
  
! <DT><b><a name="postscreen_access_list">postscreen_access_list</a>
! (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>)</b></DT><DD>
  
! <p> Permanent white/blacklist for remote SMTP client IP addresses.
! <a href="postscreen.8.html">postscreen(8)</a> searches this list immediately after a remote SMTP
! client connects.  Specify a comma- or whitespace-separated list of
! commands (in upper or lower case) or lookup tables. The search stops
! upon the first command that fires for the client IP address. </p>
  
- <dl>
  
! <dt> <b> <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a> </b> </dt> <dd> Whitelist the client and
! terminate the search if the client IP address matches $<a href="postconf.5.html#mynetworks">mynetworks</a>.
! Do not subject the client to any before/after 220 greeting tests.
! Pass the connection immediately to a Postfix SMTP server process.
! </dd>
  
! <dt> <b> <a href="DATABASE_README.html">type:table</a> </b> </dt> <dd> Query the specified lookup
! table. Each table lookup result is an access list, except that
! access lists inside a table cannot specify <a href="DATABASE_README.html">type:table</a> entries.  <br>
! To discourage the use of hash, btree, etc. tables, there is no
! support for substring matching like <a href="smtpd.8.html">smtpd(8)</a>. Use CIDR tables
! instead.  </dd>
! 
! <dt> <b> permit </b> </dt> <dd> Whitelist the client and terminate
! the search. Do not subject the client to any before/after 220
! greeting tests. Pass the connection immediately to a Postfix SMTP
! server process. </dd>
! 
! <dt> <b> reject </b> </dt> <dd> Blacklist the client and terminate
! the search. Subject the client to the action configured with the
! <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> configuration parameter. </dd>
! 
! <dt> <b> dunno </b> </dt> <dd> All <a href="postscreen.8.html">postscreen(8)</a> access lists
! implicitly have this command at the end. <br> When <b> dunno </b>
! is executed inside a lookup table, return from the lookup table and
! evaluate the next command.  <br> When <b> dunno </b> is executed
! outside a lookup table, terminate the search, and subject the client
! to the configured before/after 220 greeting tests. </dd>
  
! </dl>
  
- <p> Example: </p>
  
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,
! 		<a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr
!     <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> = enforce
! </pre>
  
! <pre>
! /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>:
!     # Rules are evaluated in the order as specified.
!     # Blacklist 192.168.* except 192.168.0.1.
!     192.168.0.1         dunno
!     192.168.0.0/16      reject
! </pre>
  
! <p> This feature is available in Postfix 2.8. </p>
  
  
! </DD>
  
! <DT><b><a name="postscreen_bare_newline_action">postscreen_bare_newline_action</a>
! (default: ignore)</b></DT><DD>
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client sends
! a bare newline character, that is, a newline not preceded by carriage
! return.  Specify one of the following: </p>
  
! <dl>
  
- <dt> <b>ignore</b> </dt>
  
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Do <i>not</i> repeat this test before some the result from some
! other test expires.
! This option is useful for testing and collecting statistics
! without blocking mail permanently. </dd>
  
! <dt> <b>enforce</b> </dt>
  
! <dd> Allow other tests to complete. Reject attempts to deliver mail
! with a 550 SMTP reply, and log the helo/sender/recipient information.
! Repeat this test the next time the client connects. </dd>
  
! <dt> <b>drop</b> </dt>
  
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects.  </dd>
  
! </dl>
  
! <p> This feature is available in Postfix 2.8. </p>
  
--- 6178,6265 ----
  
! <DT><b><a name="process_id_directory">process_id_directory</a>
! (default: pid)</b></DT><DD>
  
! <p>
! The location of Postfix PID files relative to $<a href="postconf.5.html#queue_directory">queue_directory</a>.
! This is a read-only parameter.
! </p>
  
  
! </DD>
  
! <DT><b><a name="process_name">process_name</a>
! (read-only)</b></DT><DD>
  
! <p>
! The process name of a Postfix command or daemon process.
! </p>
  
  
! </DD>
  
! <DT><b><a name="propagate_unmatched_extensions">propagate_unmatched_extensions</a>
! (default: canonical, virtual)</b></DT><DD>
  
! <p>
! What address lookup tables copy an address extension from the lookup
! key to the lookup result.
! </p>
  
+ <p>
+ For example, with a <a href="virtual.5.html">virtual(5)</a> mapping of "<i>joe@example.com =&gt;
+ joe.user@example.net</i>", the address "<i>joe+foo@example.com</i>"
+ would rewrite to "<i>joe.user+foo@example.net</i>".
+ </p>
  
! <p>
! Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>,
! <b>forward</b>, <b>include</b> or <b>generic</b>. These cause
! address extension
! propagation with <a href="canonical.5.html">canonical(5)</a>, <a href="virtual.5.html">virtual(5)</a>, and <a href="aliases.5.html">aliases(5)</a> maps,
! with <a href="local.8.html">local(8)</a> .forward and :include: file lookups, and with <a href="smtp.8.html">smtp(8)</a>
! generic maps, respectively.  </p>
  
! <p>
! Note: enabling this feature for types other than <b>canonical</b>
! and <b>virtual</b> is likely to cause problems when mail is forwarded
! to other sites, especially with mail that is sent to a mailing list
! exploder address.
! </p>
  
! <p>
! Examples:
! </p>
  
! <pre>
! <a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual, alias,
!         forward, include
! <a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual
! </pre>
  
  
! </DD>
  
! <DT><b><a name="proxy_interfaces">proxy_interfaces</a>
! (default: empty)</b></DT><DD>
  
! <p>
! The network interface addresses that this mail system receives mail
! on by way of a proxy or network address translation unit.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
! <p> You must specify your "outside" proxy/NAT addresses when your
! system is a backup MX host for other domains, otherwise mail delivery
! loops will happen when the primary MX host is down.  </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> = 1.2.3.4
! </pre>
  
***************
*** 6948,6959 ****
  
! <DT><b><a name="postscreen_bare_newline_enable">postscreen_bare_newline_enable</a>
! (default: no)</b></DT><DD>
  
! <p> Enable "bare newline" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
! server. These tests are expensive: a remote SMTP client must
! disconnect after
! it passes the test, before it can talk to a real Postfix SMTP server.
  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6268,6281 ----
  
! <DT><b><a name="proxy_read_maps">proxy_read_maps</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p>
! The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
! access for the read-only service.
! Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored.
  </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
***************
*** 6962,6978 ****
  
! <DT><b><a name="postscreen_bare_newline_ttl">postscreen_bare_newline_ttl</a>
! (default: 30d)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful "bare newline" SMTP protocol test. During this
! time, the client IP address is excluded from this test. The default
! is long because a remote SMTP client must disconnect after it passes
! the test,
! before it can talk to a real Postfix SMTP server. </p>
  
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6284,6296 ----
  
! <DT><b><a name="proxy_write_maps">proxy_write_maps</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p> The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
! access for the read-write service. Postfix-owned local database
! files should be stored under the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>.
! Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored.  </p>
  
! <p>
! This feature is available in Postfix 2.5 and later.
! </p>
  
***************
*** 6981,7012 ****
  
! <DT><b><a name="postscreen_blacklist_action">postscreen_blacklist_action</a>
! (default: ignore)</b></DT><DD>
  
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client is
! permanently blacklisted with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter.
! Specify one of the following: </p>
  
! <dl>
! 
! <dt> <b>ignore</b> (default) </dt>
! 
! <dd> Ignore  this result. Allow other tests to complete.  Repeat
! this test the next time the client connects.
! This option is useful for testing and collecting statistics
! without blocking mail. </dd>
  
! <dt> <b>enforce</b> </dt>
  
- <dd> Allow other tests to complete. Reject attempts to deliver mail
- with a 550 SMTP reply, and log the helo/sender/recipient information.
- Repeat this test the next time the client connects. </dd>
  
! <dt> <b>drop</b> </dt>
  
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. </dd>
  
! </dl>
  
! <p> This feature is available in Postfix 2.8. </p>
  
--- 6299,6332 ----
  
! <DT><b><a name="qmgr_clog_warn_time">qmgr_clog_warn_time</a>
! (default: 300s)</b></DT><DD>
  
! <p>
! The minimal delay between warnings that a specific destination is
! clogging up the Postfix <a href="QSHAPE_README.html#active_queue">active queue</a>. Specify 0 to disable.
! </p>
  
! <p>
! This feature is enabled with the <a href="postconf.5.html#helpful_warnings">helpful_warnings</a> parameter.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
! </DD>
  
! <DT><b><a name="qmgr_fudge_factor">qmgr_fudge_factor</a>
! (default: 100)</b></DT><DD>
  
! <p>
! Obsolete feature: the percentage of delivery resources that a busy
! mail system will use up for delivery of a large mailing  list
! message.
! </p>
  
! <p>
! This feature exists only in the <a href="qmgr.8.html">oqmgr(8)</a> old queue manager. The
! current queue manager solves the problem in a better way.
! </p>
  
***************
*** 7015,7035 ****
  
! <DT><b><a name="postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a>
! (default: 12h)</b></DT><DD>
! 
! <p> The amount of time between <a href="postscreen.8.html">postscreen(8)</a> cache cleanup runs.
! Cache cleanup increases the load on the cache database and should
! therefore not be run frequently. This feature requires that the
! cache database supports the "delete" and "sequence" operators.
! Specify a zero interval to disable cache cleanup. </p>
! 
! <p> After each cache cleanup run, the <a href="postscreen.8.html">postscreen(8)</a> daemon logs the
! number of entries that were retained and dropped. A cleanup run is
! logged as "partial" when the daemon terminates early after "<b>postfix
! reload</b>", "<b>postfix stop</b>", or no requests for $<a href="postconf.5.html#max_idle">max_idle</a>
! seconds. </p>
! 
! <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
! (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8. </p>
  
--- 6335,6342 ----
  
! <DT><b><a name="qmgr_message_active_limit">qmgr_message_active_limit</a>
! (default: 20000)</b></DT><DD>
  
! <p>
! The maximal number of messages in the <a href="QSHAPE_README.html#active_queue">active queue</a>.
! </p>
  
***************
*** 7038,7084 ****
  
! <DT><b><a name="postscreen_cache_map">postscreen_cache_map</a>
! (default: btree:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache)</b></DT><DD>
  
! <p> Persistent storage for the <a href="postscreen.8.html">postscreen(8)</a> server decisions. </p>
  
- <p> To share a <a href="postscreen.8.html">postscreen(8)</a> cache between multiple <a href="postscreen.8.html">postscreen(8)</a>
- instances, use "<a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="proxymap.8.html">proxy</a>:btree:/path/to/file".
- This requires Postfix version 2.9 or later; earlier <a href="proxymap.8.html">proxymap(8)</a>
- implementations don't support cache cleanup. For an alternative
- approach see the <a href="memcache_table.5.html">memcache_table(5)</a> manpage. </p>
  
! <p> This feature is available in Postfix 2.8. </p>
  
  
! </DD>
  
- <DT><b><a name="postscreen_cache_retention_time">postscreen_cache_retention_time</a>
- (default: 7d)</b></DT><DD>
  
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will cache an expired
! temporary whitelist entry before it is removed. This prevents clients
! from being logged as "NEW" just because their cache entry expired
! an hour ago. It also prevents the cache from filling up with clients
! that passed some deep protocol test once and never came back. </p>
  
! <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
! (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8. </p>
  
  
! </DD>
  
! <DT><b><a name="postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a>
! (default: $<a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>)</b></DT><DD>
  
! <p> How many simultaneous connections any remote SMTP client is
! allowed to have
! with the <a href="postscreen.8.html">postscreen(8)</a> daemon. By default, this limit is the same
! as with the Postfix SMTP server. Note that the triage process can
! take several seconds, with the time spent in <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
! delay, and with the time spent talking to the <a href="postscreen.8.html">postscreen(8)</a> built-in
! dummy SMTP protocol engine. </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6345,6404 ----
  
! <DT><b><a name="qmgr_message_recipient_limit">qmgr_message_recipient_limit</a>
! (default: 20000)</b></DT><DD>
  
! <p> The maximal number of recipients held in memory by the Postfix
! queue manager, and the maximal size of the size of the short-term,
! in-memory "dead" destination status cache.  </p>
  
  
! </DD>
  
+ <DT><b><a name="qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a>
+ (default: 10)</b></DT><DD>
  
! <p>
! The minimal number of in-memory recipients for any message. This
! takes priority over any other in-memory recipient limits (i.e.,
! the global <a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> and the per transport
! _recipient_limit) if necessary. The minimum value allowed for this
! parameter is 1.
! </p>
  
  
! </DD>
  
! <DT><b><a name="qmqpd_authorized_clients">qmqpd_authorized_clients</a>
! (default: empty)</b></DT><DD>
  
! <p>
! What clients are allowed to connect to the QMQP server port.
! </p>
  
+ <p>
+ By default, no client is allowed to use the service. This is
+ because the QMQP server will relay mail to any destination.
+ </p>
  
! <p>
! Specify a list of client patterns. A list pattern specifies a host
! name, a domain name, an internet address, or a network/mask pattern,
! where the mask specifies the number of bits in the network part.
! When a pattern specifies a file name, its contents are substituted
! for the file name; when a pattern is a "<a href="DATABASE_README.html">type:table</a>" table specification,
! table lookup is used instead.  </p>
  
! <p>
! Patterns are separated by whitespace and/or commas. In order to
! reverse the result, precede a pattern with an
! exclamation point (!). The form "!/file/name" is supported only
! in Postfix version 2.4 and later.
! </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#qmqpd_authorized_clients">qmqpd_authorized_clients</a> = !192.168.0.1, 192.168.0.0/24
! </pre>
  
***************
*** 7087,7098 ****
  
! <DT><b><a name="postscreen_command_count_limit">postscreen_command_count_limit</a>
! (default: 20)</b></DT><DD>
  
! <p> The limit on the total number of commands per SMTP session for
! <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP protocol engine.  This SMTP engine
! defers or rejects all attempts to deliver mail, therefore there is
! no need to enforce separate limits on the number of junk commands
! and error commands.  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6407,6416 ----
  
! <DT><b><a name="qmqpd_client_port_logging">qmqpd_client_port_logging</a>
! (default: no)</b></DT><DD>
  
! <p> Enable logging of the remote QMQP client port in addition to
! the hostname and IP address. The logging format is "host[address]:port".
! </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 7101,7109 ****
  
! <DT><b><a name="postscreen_command_filter">postscreen_command_filter</a>
! (default: $<a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a>)</b></DT><DD>
  
! <p> A mechanism to transform commands from remote SMTP clients.
! See <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 6419,6433 ----
  
! <DT><b><a name="qmqpd_error_delay">qmqpd_error_delay</a>
! (default: 1s)</b></DT><DD>
  
! <p>
! How long the QMQP server will pause before sending a negative reply
! to the client. The purpose is to slow down confused or malicious
! clients.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
***************
*** 7112,7120 ****
  
! <DT><b><a name="postscreen_command_time_limit">postscreen_command_time_limit</a>
! (default: ${stress?10}${stress:300}s)</b></DT><DD>
  
! <p> The time limit to read an entire command line with <a href="postscreen.8.html">postscreen(8)</a>'s
! built-in SMTP protocol engine. </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6436,6450 ----
  
! <DT><b><a name="qmqpd_timeout">qmqpd_timeout</a>
! (default: 300s)</b></DT><DD>
  
! <p>
! The time limit for sending or receiving information over the network.
! If a read or write operation blocks for more than $<a href="postconf.5.html#qmqpd_timeout">qmqpd_timeout</a>
! seconds the QMQP server gives up and disconnects.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
***************
*** 7123,7131 ****
  
! <DT><b><a name="postscreen_disable_vrfy_command">postscreen_disable_vrfy_command</a>
! (default: $<a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a>)</b></DT><DD>
! 
! <p> Disable the SMTP VRFY command in the <a href="postscreen.8.html">postscreen(8)</a> daemon.  See
! <a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a> for details.  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6453,6461 ----
  
! <DT><b><a name="queue_directory">queue_directory</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p>
! The location of the Postfix top-level queue directory. This is the
! root directory of Postfix daemon processes that run chrooted.
! </p>
  
***************
*** 7134,7145 ****
  
! <DT><b><a name="postscreen_discard_ehlo_keyword_address_maps">postscreen_discard_ehlo_keyword_address_maps</a>
! (default: $<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>)</b></DT><DD>
  
! <p> Lookup tables, indexed by the remote SMTP client address, with
! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
! etc.) that the <a href="postscreen.8.html">postscreen(8)</a> server will not send in the EHLO response
! to a remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
! The table is not searched by hostname for robustness reasons.  </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 6464,6477 ----
  
! <DT><b><a name="queue_file_attribute_count_limit">queue_file_attribute_count_limit</a>
! (default: 100)</b></DT><DD>
  
! <p>
! The maximal number of (name=value) attributes that may be stored
! in a Postfix queue file. The limit is enforced by the <a href="cleanup.8.html">cleanup(8)</a>
! server.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
***************
*** 7148,7193 ****
  
! <DT><b><a name="postscreen_discard_ehlo_keywords">postscreen_discard_ehlo_keywords</a>
! (default: $<a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>)</b></DT><DD>
! 
! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
! auth, etc.) that the <a href="postscreen.8.html">postscreen(8)</a> server will not send in the EHLO
! response to a remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>
! for details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
  
! </DD>
  
- <DT><b><a name="postscreen_dnsbl_action">postscreen_dnsbl_action</a>
- (default: ignore)</b></DT><DD>
  
! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client's combined
! DNSBL score is equal to or greater than a threshold (as defined
! with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> and <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>
! parameters).  Specify one of the following: </p>
  
! <dl>
  
! <dt> <b>ignore</b> (default) </dt>
  
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Repeat this test the next time the client connects.
! This option is useful for testing and collecting statistics
! without blocking mail. </dd>
  
! <dt> <b>enforce</b> </dt>
  
- <dd> Allow other tests to complete. Reject attempts to deliver mail
- with a 550 SMTP reply, and log the helo/sender/recipient information.
- Repeat this test the next time the client connects. </dd>
  
! <dt> <b>drop</b> </dt>
  
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. </dd>
  
! </dl>
  
! <p> This feature is available in Postfix 2.8. </p>
  
--- 6480,6535 ----
  
! <DT><b><a name="queue_minfree">queue_minfree</a>
! (default: 0)</b></DT><DD>
  
! <p>
! The minimal amount of free space in bytes in the queue file system
! that is needed to receive mail.  This is currently used by the SMTP
! server to decide if it will accept any mail at all.
! </p>
  
+ <p>
+ By default, the Postfix version 2.1 SMTP server rejects MAIL FROM commands
+ when the amount of free space is less than 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>.
+ To specify a higher minimum free space limit, specify a <a href="postconf.5.html#queue_minfree">queue_minfree</a>
+ value that is at least 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>.
+ </p>
  
! <p>
! With Postfix versions 2.0 and earlier, a <a href="postconf.5.html#queue_minfree">queue_minfree</a> value of
! zero means there is no minimum required amount of free space.
! </p>
  
  
! </DD>
  
! <DT><b><a name="queue_run_delay">queue_run_delay</a>
! (default: 300s)</b></DT><DD>
  
! <p>
! The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager;
! prior to Postfix 2.4 the default value was 1000s.
! </p>
  
! <p> This parameter should be set less than or equal to
! $<a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a>. See also $<a href="postconf.5.html#maximal_backoff_time">maximal_backoff_time</a>.  </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
  
! </DD>
  
! <DT><b><a name="queue_service_name">queue_service_name</a>
! (default: qmgr)</b></DT><DD>
  
! <p>
! The name of the <a href="qmgr.8.html">qmgr(8)</a> service. This service manages the Postfix
! queue and schedules delivery requests.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
***************
*** 7196,7224 ****
  
! <DT><b><a name="postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a>
  (default: empty)</b></DT><DD>
  
! <p> A mapping from actual DNSBL domain name which includes a secret
! password, to the DNSBL domain name that postscreen will reply with
! when it rejects mail.  When no mapping is found, the actual DNSBL
! domain will be used. </p>
  
! <p> For maximal stability it is best to use a file that is read
! into memory such as <a href="pcre_table.5.html">pcre</a>:, <a href="regexp_table.5.html">regexp</a>: or <a href="DATABASE_README.html#types">texthash</a>: (<a href="DATABASE_README.html#types">texthash</a>: is similar
! to hash:, except a) there is no need to run <a href="postmap.1.html">postmap(1)</a> before the
! file can be used, and b) <a href="DATABASE_README.html#types">texthash</a>: does not detect changes after
! the file is read). </p>
  
- <p> Example: </p>
  
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply
! </pre>
  
! <pre>
! /etc/postfix/dnsbl_reply:
!    secret.zen.spamhaus.org	zen.spamhaus.org
! </pre>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6538,6564 ----
  
! <DT><b><a name="rbl_reply_maps">rbl_reply_maps</a>
  (default: empty)</b></DT><DD>
  
! <p>
! Optional lookup tables with RBL response templates. The tables are
! indexed by the RBL domain name. By default, Postfix uses the default
! template as specified with the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> configuration
! parameter. See there for a discussion of the syntax of RBL reply
! templates.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
! </DD>
  
! <DT><b><a name="readme_directory">readme_directory</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p>
! The location of Postfix README files that describe how to build,
! configure or operate a specific Postfix subsystem or feature.
! </p>
  
***************
*** 7227,7286 ****
  
! <DT><b><a name="postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
  (default: empty)</b></DT><DD>
  
! <p>Optional list of DNS white/blacklist domains, filters and weight
! factors. When the list is non-empty, the <a href="dnsblog.8.html">dnsblog(8)</a> daemon will
! query these domains with the IP addresses of remote SMTP clients,
! and <a href="postscreen.8.html">postscreen(8)</a> will update an SMTP client's DNSBL score with
! each non-error reply. </p>
  
! <p> Caution: when postscreen rejects mail, it replies with the DNSBL
! domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to hide
! "password" information in DNSBL domain names. </p>
  
! <p> When a client's score is equal to or greater than the threshold
! specified with <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>, <a href="postscreen.8.html">postscreen(8)</a> can drop
! the connection with the remote SMTP client. </p>
  
! <p> Specify a list of domain=filter*weight entries, separated by
! comma or whitespace.  </p>
  
! <ul>
  
! <li> <p> When no "=filter" is specified, <a href="postscreen.8.html">postscreen(8)</a> will use any
! non-error DNSBL reply.  Otherwise, <a href="postscreen.8.html">postscreen(8)</a> uses only DNSBL
! replies that match the filter. The filter has the form d.d.d.d,
! where each d is a number, or a pattern inside [] that contains one
! or more ";"-separated numbers or number..number ranges.  </p>
! 
! <li> <p> When no "*weight" is specified, <a href="postscreen.8.html">postscreen(8)</a> increments
! the remote SMTP client's DNSBL score by 1.  Otherwise, the weight must be
! an integral number, and <a href="postscreen.8.html">postscreen(8)</a> adds the specified weight to
! the remote SMTP client's DNSBL score.  Specify a negative number for
! whitelisting.  </p>
  
! <li> <p> When one <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> entry produces multiple
! DNSBL responses, <a href="postscreen.8.html">postscreen(8)</a> applies the weight at most once.
! </p>
  
! </ul>
  
! <p> Examples: </p>
  
! <p> To use example.com as a high-confidence blocklist, and to
! block mail with example.net and example.org only when both agree:
! </p>
  
! <pre>
! <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2
! <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = example.com*2, example.net, example.org
! </pre>
  
! <p> To filter only DNSBL replies containing 127.0.0.4: </p>
  
  <pre>
! <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = example.com=127.0.0.4
  </pre>
  
! <p> This feature is available in Postfix 2.8. </p>
  
--- 6567,6628 ----
  
! <DT><b><a name="receive_override_options">receive_override_options</a>
  (default: empty)</b></DT><DD>
  
! <p> Enable or disable recipient validation, built-in content
! filtering, or address mapping. Typically, these are specified in
! <a href="master.5.html">master.cf</a> as command-line arguments for the <a href="smtpd.8.html">smtpd(8)</a>, <a href="qmqpd.8.html">qmqpd(8)</a> or
! <a href="pickup.8.html">pickup(8)</a> daemons. </p>
! 
! <p> Specify zero or more of the following options.  The options
! override <a href="postconf.5.html">main.cf</a> settings and are either implemented by <a href="smtpd.8.html">smtpd(8)</a>,
! <a href="qmqpd.8.html">qmqpd(8)</a>, or <a href="pickup.8.html">pickup(8)</a> themselves, or they are forwarded to the
! cleanup server.  </p>
! 
! <dl>
  
! <dt><b><a name="no_unknown_recipient_checks">no_unknown_recipient_checks</a></b></dt>
  
! <dd>Do not try to reject unknown recipients (SMTP server only).
! This is typically specified AFTER an external content filter.
! </dd>
  
! <dt><b><a name="no_address_mappings">no_address_mappings</a></b></dt>
  
! <dd>Disable canonical address mapping, virtual alias map expansion,
! address masquerading, and automatic BCC (blind carbon-copy)
! recipients. This is typically specified BEFORE an external content
! filter. </dd>
  
! <dt><b><a name="no_header_body_checks">no_header_body_checks</a></b></dt>
  
! <dd>Disable header/body_checks. This is typically specified AFTER
! an external content filter. </dd>
  
! <dt><b><a name="no_milters">no_milters</a></b></dt>
  
! <dd>Disable Milter (mail filter) applications. This is typically
! specified AFTER an external content filter. </dd>
  
! </dl>
  
! <p>
! Note: when the "BEFORE content filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a>
! setting is specified in the <a href="postconf.5.html">main.cf</a> file, specify the "AFTER content
! filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a> setting in <a href="master.5.html">master.cf</a> (and vice
! versa).
! </p>
  
! <p>
! Examples:
! </p>
  
  <pre>
! <a href="postconf.5.html#receive_override_options">receive_override_options</a> =
!     <a href="postconf.5.html#no_unknown_recipient_checks">no_unknown_recipient_checks</a>, <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>
! <a href="postconf.5.html#receive_override_options">receive_override_options</a> = <a href="postconf.5.html#no_address_mappings">no_address_mappings</a>
  </pre>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
***************
*** 7289,7341 ****
  
! <DT><b><a name="postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>
! (default: 1)</b></DT><DD>
! 
! <p> The inclusive lower bound for blocking a remote SMTP client, based on
! its combined DNSBL score as defined with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
! parameter. </p>
! 
! <p> This feature is available in Postfix 2.8.  </p>
! 
  
! </DD>
  
! <DT><b><a name="postscreen_dnsbl_ttl">postscreen_dnsbl_ttl</a>
! (default: 1h)</b></DT><DD>
  
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful DNS blocklist test. During this time, the client IP address
! is excluded from this test. The default is relatively short, because a
! good client can immediately talk to a real Postfix SMTP server.
  </p>
  
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
  
! </DD>
  
! <DT><b><a name="postscreen_enforce_tls">postscreen_enforce_tls</a>
! (default: $<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b></DT><DD>
  
! <p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and
! require that clients use TLS encryption.  See smtpd_postscreen_enforce_tls
! for details.  </p>
  
! <p> This feature is available in Postfix 2.8 and later.
! Preferably, use <a href="postconf.5.html#postscreen_tls_security_level">postscreen_tls_security_level</a> instead. </p>
  
  
! </DD>
  
! <DT><b><a name="postscreen_expansion_filter">postscreen_expansion_filter</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p> List of characters that are permitted in <a href="postconf.5.html#postscreen_reject_footer">postscreen_reject_footer</a>
! attribute expansions.  See <a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> for further
! details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 6631,6690 ----
  
! <DT><b><a name="recipient_bcc_maps">recipient_bcc_maps</a>
! (default: empty)</b></DT><DD>
  
! <p>
! Optional BCC (blind carbon-copy) address lookup tables, indexed by
! recipient address.  The BCC address (multiple results are not
! supported) is added when mail enters from outside of Postfix.
! </p>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
! <p>
! The table search order is as follows:
  </p>
  
! <ul>
  
! <li> Look up the "user+extension@domain.tld" address including the
! optional address extension.
  
+ <li> Look up the "user@domain.tld" address without the optional
+ address extension.
  
! <li> Look up the "user+extension" address local part when the
! recipient domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
  
! <li> Look up the "user" address local part when the recipient domain
! equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
  
! <li> Look up the "@domain.tld" part.
  
! </ul>
  
+ <p>
+ Specify the types and names of databases to use.  After change,
+ run "<b>postmap /etc/postfix/recipient_bcc</b>".
+ </p>
  
! <p>
! Note: if mail to the BCC address bounces it will be returned to
! the sender.
! </p>
  
! <p> Note: automatic BCC recipients are produced only for new mail.
! To avoid mailer loops, automatic BCC recipients are not generated
! for mail that Postfix forwards internally, nor for mail that Postfix
! generates itself. </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#recipient_bcc_maps">recipient_bcc_maps</a> = hash:/etc/postfix/recipient_bcc
! </pre>
  
***************
*** 7344,7354 ****
  
! <DT><b><a name="postscreen_forbidden_commands">postscreen_forbidden_commands</a>
! (default: $<a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a>)</b></DT><DD>
  
! <p> List of commands that the <a href="postscreen.8.html">postscreen(8)</a> server considers in
! violation of the SMTP protocol. See <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> for
! syntax, and <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> for possible actions.
  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6693,6706 ----
  
! <DT><b><a name="recipient_canonical_classes">recipient_canonical_classes</a>
! (default: envelope_recipient, header_recipient)</b></DT><DD>
! 
! <p> What addresses are subject to <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address
! mapping.  By default, <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address mapping is
! applied to envelope recipient addresses, and to header recipient
! addresses.  </p>
  
! <p> Specify one or more of: envelope_recipient, header_recipient
  </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
***************
*** 7357,7391 ****
  
! <DT><b><a name="postscreen_greet_action">postscreen_greet_action</a>
! (default: ignore)</b></DT><DD>
! 
! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client speaks
! before its turn within the time specified with the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
! parameter.  Specify one of the following: </p>
  
! <dl>
  
! <dt> <b>ignore</b> (default) </dt>
  
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Repeat this test the next time the client connects.
! This option is useful for testing and collecting statistics
! without blocking mail. </dd>
  
! <dt> <b>enforce</b> </dt>
  
- <dd> Allow other tests to complete. Reject attempts to deliver mail
- with a 550 SMTP reply, and log the helo/sender/recipient information.
- Repeat this test the next time the client connects. </dd>
  
! <dt> <b>drop</b> </dt>
  
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. </dd>
  
! </dl>
  
! <p> In either case, <a href="postscreen.8.html">postscreen(8)</a> will not whitelist the remote SMTP client
! IP address. </p>
  
! <p> This feature is available in Postfix 2.8. </p>
  
--- 6709,6752 ----
  
! <DT><b><a name="recipient_canonical_maps">recipient_canonical_maps</a>
! (default: empty)</b></DT><DD>
  
! <p>
! Optional address mapping lookup tables for envelope and header
! recipient addresses.
! The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
! </p>
  
! <p>
! Note: $<a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
! </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> = hash:/etc/postfix/recipient_canonical
! </pre>
  
  
! </DD>
  
! <DT><b><a name="recipient_delimiter">recipient_delimiter</a>
! (default: empty)</b></DT><DD>
  
! <p>
! The separator between user names and address extensions (user+foo).
! See <a href="canonical.5.html">canonical(5)</a>, <a href="local.8.html">local(8)</a>, <a href="relocated.5.html">relocated(5)</a> and <a href="virtual.5.html">virtual(5)</a> for the
! effects this has on aliases, canonical, virtual, relocated and
! on .forward file lookups.  Basically, the software tries user+foo
! and .forward+foo before trying user and .forward.
! </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> = +
! </pre>
  
***************
*** 7394,7406 ****
  
! <DT><b><a name="postscreen_greet_banner">postscreen_greet_banner</a>
! (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>)</b></DT><DD>
  
! <p> The <i>text</i> in the optional "220-<i>text</i>..." server
! response that
! <a href="postscreen.8.html">postscreen(8)</a> sends ahead of the real Postfix SMTP server's "220
! text..." response, in an attempt to confuse bad SMTP clients so
! that they speak before their turn (pre-greet).  Specify an empty
! value to disable this feature.  </p>
  
! <p> This feature is available in Postfix 2.8. </p>
  
--- 6755,6767 ----
  
! <DT><b><a name="reject_code">reject_code</a>
! (default: 554)</b></DT><DD>
  
! <p>
! The numerical Postfix SMTP server response code when a remote SMTP
! client request is rejected by the "reject" restriction.
! </p>
  
! <p>
! Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
! </p>
  
***************
*** 7409,7442 ****
  
! <DT><b><a name="postscreen_greet_ttl">postscreen_greet_ttl</a>
! (default: 1d)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful PREGREET test. During this time, the client IP address
! is excluded from this test. The default is relatively short, because
! a good client can immediately talk to a real Postfix SMTP server. </p>
! 
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
  
! </DD>
  
! <DT><b><a name="postscreen_greet_wait">postscreen_greet_wait</a>
! (default: ${stress?2}${stress:6}s)</b></DT><DD>
  
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will wait for an SMTP
! client to send a command before its turn, and for DNS blocklist
! lookup results to arrive (default: up to 2 seconds under stress,
! up to 6 seconds otherwise).  <p>
  
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  </p>
  
! <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
! (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8. </p>
  
--- 6770,6797 ----
  
! <DT><b><a name="relay_clientcerts">relay_clientcerts</a>
! (default: empty)</b></DT><DD>
  
! <p> List of tables with remote SMTP client-certificate fingerprints
! for which the Postfix SMTP server will allow access with the
! <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> feature.
! The fingerprint digest algorithm is configurable via the
! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
! Postfix version 2.5).  </p>
  
! <p> Postfix lookup tables are in the form of (key, value) pairs.
! Since we only need the key, the value can be chosen freely, e.g.
! the name of the user or host:
! D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a> = hash:/etc/postfix/relay_clientcerts
! </pre>
  
! <p>For more fine-grained control, use <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> to select
! an appropriate <a href="access.5.html">access(5)</a> policy for each client.
! See <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a>.</p>
  
! <p>This feature is available with Postfix version 2.2.</p>
  
***************
*** 7445,7453 ****
  
! <DT><b><a name="postscreen_helo_required">postscreen_helo_required</a>
! (default: $<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a>)</b></DT><DD>
  
! <p> Require that a remote SMTP client sends HELO or EHLO before
! commencing a MAIL transaction. </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6800,6810 ----
  
! <DT><b><a name="relay_destination_concurrency_limit">relay_destination_concurrency_limit</a>
! (default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
  
! <p> The maximal number of parallel deliveries to the same destination
! via the relay message delivery transport. This limit is enforced
! by the queue manager. The message delivery transport name is the
! first field in the entry in the <a href="master.5.html">master.cf</a> file.  </p>
  
! <p> This feature is available in Postfix 2.0 and later. </p>
  
***************
*** 7456,7502 ****
  
! <DT><b><a name="postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a>
! (default: drop)</b></DT><DD>
! 
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client sends
! non-SMTP commands as specified with the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a>
! parameter.  Specify one of the following: </p>
  
! <dl>
  
! <dt> <b>ignore</b> </dt>
  
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Do <i>not</i> repeat this test before some the result from some
! other test expires.
! This option is useful for testing and collecting statistics
! without blocking mail permanently. </dd>
! 
! <dt> <b>enforce</b> </dt>
! 
! <dd> Allow other tests to complete. Reject attempts to deliver mail
! with a 550 SMTP reply, and log the helo/sender/recipient information.
! Repeat this test the next time the client connects. </dd>
! 
! <dt> <b>drop</b> </dt>
! 
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. This action is the
! same as with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a>
! feature.  </dd>
  
- </dl>
  
! <p> This feature is available in Postfix 2.8. </p>
  
  
! </DD>
  
! <DT><b><a name="postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a>
! (default: no)</b></DT><DD>
  
! <p> Enable "non-SMTP command" tests in the <a href="postscreen.8.html">postscreen(8)</a> server. These
! tests are expensive: a client must disconnect after it passes the
! test, before it can talk to a real Postfix SMTP server. </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6813,6859 ----
  
! <DT><b><a name="relay_destination_recipient_limit">relay_destination_recipient_limit</a>
! (default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
  
! <p> The maximal number of recipients per message for the relay
! message delivery transport. This limit is enforced by the queue
! manager. The message delivery transport name is the first field in
! the entry in the <a href="master.5.html">master.cf</a> file.  </p>
  
! <p> Setting this parameter to a value of 1 changes the meaning of
! <a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> from concurrency per domain
! into concurrency per recipient.  </p>
  
! <p> This feature is available in Postfix 2.0 and later. </p>
  
  
! </DD>
  
+ <DT><b><a name="relay_domains">relay_domains</a>
+ (default: $<a href="postconf.5.html#mydestination">mydestination</a>)</b></DT><DD>
  
! <p> What destination domains (and subdomains thereof) this system
! will relay mail to. Subdomain matching is controlled with the
! <a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> parameter. For details about how
! the <a href="postconf.5.html#relay_domains">relay_domains</a> value is used, see the description of the
! <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> and <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> SMTP recipient
! restrictions.  </p>
  
! <p> Domains that match $<a href="postconf.5.html#relay_domains">relay_domains</a> are delivered with the
! $<a href="postconf.5.html#relay_transport">relay_transport</a> mail delivery transport. The SMTP server validates
! recipient addresses with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> and rejects non-existent
! recipients. See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the
! <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file.  </p>
  
! <p> Note: Postfix will not automatically forward mail for domains
! that list this system as their primary or backup MX host. See the
! <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> restriction in the <a href="postconf.5.html">postconf(5)</a> manual page.  </p>
  
! <p> Specify a list of host or domain names, "/file/name" patterns
! or "<a href="DATABASE_README.html">type:table</a>" lookup tables, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace. A
! "/file/name" pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>"
! lookup table is matched when a (parent) domain appears as lookup
! key. Specify "!pattern" to exclude a domain from the list. The form
! "!/file/name" is supported only in Postfix version 2.4 and later.
! </p>
  
***************
*** 7505,7520 ****
  
! <DT><b><a name="postscreen_non_smtp_command_ttl">postscreen_non_smtp_command_ttl</a>
! (default: 30d)</b></DT><DD>
! 
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful "non_smtp_command" SMTP protocol test. During this
! time, the client IP address is excluded from this test. The default
! is long because a client must disconnect after it passes the test,
! before it can talk to a real Postfix SMTP server. </p>
  
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6862,6875 ----
  
! <DT><b><a name="relay_domains_reject_code">relay_domains_reject_code</a>
! (default: 554)</b></DT><DD>
  
! <p>
! The numerical Postfix SMTP server response code when a client
! request is rejected by the <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient
! restriction.
! </p>
  
! <p>
! Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
! </p>
  
***************
*** 7523,7569 ****
  
! <DT><b><a name="postscreen_pipelining_action">postscreen_pipelining_action</a>
! (default: enforce)</b></DT><DD>
! 
! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client
! sends
! multiple commands instead of sending one command and waiting for
! the server to respond.  Specify one of the following: </p>
! 
! <dl>
  
! <dt> <b>ignore</b> </dt>
  
! <dd> Ignore the failure of this test. Allow other tests to complete.
! Do <i>not</i> repeat this test before some the result from some
! other test expires.
! This option is useful for testing and collecting statistics
! without blocking mail permanently. </dd>
  
! <dt> <b>enforce</b> </dt>
  
! <dd> Allow other tests to complete. Reject attempts to deliver mail
! with a 550 SMTP reply, and log the helo/sender/recipient information.
! Repeat this test the next time the client connects. </dd>
  
! <dt> <b>drop</b> </dt>
  
! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
! this test the next time the client connects. </dd>
  
- </dl>
  
! <p> This feature is available in Postfix 2.8. </p>
  
  
! </DD>
  
! <DT><b><a name="postscreen_pipelining_enable">postscreen_pipelining_enable</a>
! (default: no)</b></DT><DD>
  
! <p> Enable "pipelining" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
! server. These tests are expensive: a good client must disconnect
! after it passes the test, before it can talk to a real Postfix SMTP
! server. </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 6878,6944 ----
  
! <DT><b><a name="relay_recipient_maps">relay_recipient_maps</a>
! (default: empty)</b></DT><DD>
  
! <p> Optional lookup tables with all valid addresses in the domains
! that match $<a href="postconf.5.html#relay_domains">relay_domains</a>. Specify @domain as a wild-card for
! domains that have no valid recipient list, and become a source of
! backscatter mail: Postfix accepts spam for non-existent recipients
! and then floods innocent people with undeliverable mail.  Technically,
! tables
! listed with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> are used as lists: Postfix needs
! to know only if a lookup string is found or not, but it does not
! use the result from table lookup.  </p>
  
! <p>
! If this parameter is non-empty, then the Postfix SMTP server will reject
! mail to unknown relay users. This feature is off by default.
! </p>
  
! <p>
! See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
! file.
! </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> = hash:/etc/postfix/relay_recipients
! </pre>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
! </DD>
  
+ <DT><b><a name="relay_transport">relay_transport</a>
+ (default: relay)</b></DT><DD>
  
! <p>
! The default mail delivery transport and next-hop destination for
! remote delivery to domains listed with $<a href="postconf.5.html#relay_domains">relay_domains</a>. In order of
! decreasing precedence, the nexthop destination is taken from
! $<a href="postconf.5.html#relay_transport">relay_transport</a>, $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or
! from the recipient domain. This information can be overruled with
! the <a href="transport.5.html">transport(5)</a> table.
! </p>
  
! <p>
! Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i>
! is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> part is optional.  For more details see the
! <a href="transport.5.html">transport(5)</a> manual page.
! </p>
  
! <p>
! See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
! file.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
***************
*** 7572,7614 ****
  
! <DT><b><a name="postscreen_pipelining_ttl">postscreen_pipelining_ttl</a>
! (default: 30d)</b></DT><DD>
  
! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
! a successful "pipelining" SMTP protocol test. During this time, the
! client IP address is excluded from this test. The default is
! long because a good client must disconnect after it passes the test,
! before it can talk to a real Postfix SMTP server. </p>
  
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
  
! </DD>
  
! <DT><b><a name="postscreen_post_queue_limit">postscreen_post_queue_limit</a>
! (default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b></DT><DD>
  
- <p> The number of clients that can be waiting for service from a
- real Postfix SMTP server process. When this queue is full, all
- clients will
- receive a 421 reponse. </p>
  
! <p> This feature is available in Postfix 2.8. </p>
  
  
! </DD>
  
! <DT><b><a name="postscreen_pre_queue_limit">postscreen_pre_queue_limit</a>
! (default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b></DT><DD>
  
! <p> The number of non-whitelisted clients that can be waiting for
! a decision whether they will receive service from a real Postfix
! SMTP server
! process. When this queue is full, all non-whitelisted clients will
! receive a 421 reponse. </p>
  
! <p> This feature is available in Postfix 2.8. </p>
  
--- 6947,7012 ----
  
! <DT><b><a name="relayhost">relayhost</a>
! (default: empty)</b></DT><DD>
  
! <p>
! The next-hop destination of non-local mail; overrides non-local
! domains in recipient addresses. This information is overruled with
! <a href="postconf.5.html#relay_transport">relay_transport</a>, <a href="postconf.5.html#default_transport">default_transport</a>, <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
! and with the <a href="transport.5.html">transport(5)</a> table.
! </p>
  
! <p>
! On an intranet, specify the organizational domain name. If your
! internal DNS uses no MX records, specify the name of the intranet
! gateway host instead.
! </p>
  
! <p>
! In the case of SMTP, specify a domain name, hostname, hostname:port,
! [hostname]:port, [hostaddress] or [hostaddress]:port. The form
! [hostname] turns off MX lookups.
! </p>
  
+ <p>
+ If you're connected via UUCP, see the <a href="UUCP_README.html">UUCP_README</a> file for useful
+ information.
+ </p>
  
! <p>
! Examples:
! </p>
  
! <pre>
! <a href="postconf.5.html#relayhost">relayhost</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
! <a href="postconf.5.html#relayhost">relayhost</a> = [gateway.my.domain]
! <a href="postconf.5.html#relayhost">relayhost</a> = uucphost
! <a href="postconf.5.html#relayhost">relayhost</a> = [an.ip.add.ress]
! </pre>
  
  
! </DD>
  
+ <DT><b><a name="relocated_maps">relocated_maps</a>
+ (default: empty)</b></DT><DD>
  
! <p>
! Optional lookup tables with new contact information for users or
! domains that no longer exist.  The table format and lookups are
! documented in <a href="relocated.5.html">relocated(5)</a>.
! </p>
  
! <p>
! If you use this feature, run "<b>postmap /etc/postfix/relocated</b>" to
! build the necessary DBM or DB file after change, then "<b>postfix
! reload</b>" to make the changes visible.
! </p>
  
! <p>
! Examples:
! </p>
  
! <pre>
! <a href="postconf.5.html#relocated_maps">relocated_maps</a> = dbm:/etc/postfix/relocated
! <a href="postconf.5.html#relocated_maps">relocated_maps</a> = hash:/etc/postfix/relocated
! </pre>
  
***************
*** 7617,7639 ****
  
! <DT><b><a name="postscreen_reject_footer">postscreen_reject_footer</a>
! (default: $<a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a>)</b></DT><DD>
! 
! <p> Optional information that is appended after a 4XX or 5XX
! <a href="postscreen.8.html">postscreen(8)</a> server
! response. See <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> for further details.  </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="postscreen_tls_security_level">postscreen_tls_security_level</a>
! (default: $<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b></DT><DD>
  
! <p> The SMTP TLS security level for the <a href="postscreen.8.html">postscreen(8)</a> server; when
! a non-empty value is specified, this overrides the obsolete parameters
! <a href="postconf.5.html#postscreen_use_tls">postscreen_use_tls</a> and <a href="postconf.5.html#postscreen_enforce_tls">postscreen_enforce_tls</a>. See <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>
! for details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 7015,7045 ----
  
! <DT><b><a name="remote_header_rewrite_domain">remote_header_rewrite_domain</a>
! (default: empty)</b></DT><DD>
  
! <p> Don't rewrite message headers from remote clients at all when
! this parameter is empty; otherwise, rewrite message headers and
! append the specified domain name to incomplete addresses.  The
! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> parameter controls what clients Postfix
! considers local. </p>
  
+ <p> Examples:  </p>
  
! <p> The safe setting: append "domain.invalid" to incomplete header
! addresses from remote SMTP clients, so that those addresses cannot
! be confused with local addresses. </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> = domain.invalid
! </pre>
! </blockquote>
  
! <p> The default, purist, setting: don't rewrite headers from remote
! clients at all. </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> =
! </pre>
! </blockquote>
  
***************
*** 7642,7651 ****
  
! <DT><b><a name="postscreen_use_tls">postscreen_use_tls</a>
! (default: $<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b></DT><DD>
! 
! <p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
! but do not require that clients use TLS encryption. </p>
  
! <p> This feature is available in Postfix 2.8 and later.
! Preferably, use <a href="postconf.5.html#postscreen_tls_security_level">postscreen_tls_security_level</a> instead. </p>
  
--- 7048,7058 ----
  
! <DT><b><a name="require_home_directory">require_home_directory</a>
! (default: no)</b></DT><DD>
  
! <p>
! Whether or not a <a href="local.8.html">local(8)</a> recipient's home directory must exist
! before mail delivery is attempted. By default this test is disabled.
! It can be useful for environments that import home directories to
! the mail server (NOT RECOMMENDED).
! </p>
  
***************
*** 7654,7671 ****
  
! <DT><b><a name="postscreen_watchdog_timeout">postscreen_watchdog_timeout</a>
! (default: 10s)</b></DT><DD>
  
! <p> How much time a <a href="postscreen.8.html">postscreen(8)</a> process may take to respond to
! a remote SMTP client command or to perform a cache operation before it
! is terminated by a built-in watchdog timer.  This is a safety
! mechanism that prevents <a href="postscreen.8.html">postscreen(8)</a> from becoming non-responsive
! due to a bug in Postfix itself or in system software.  To avoid
! false alarms and unnecessary cache corruption this limit cannot be
! set under 10s.  </p>
  
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 7061,7079 ----
  
! <DT><b><a name="resolve_dequoted_address">resolve_dequoted_address</a>
! (default: yes)</b></DT><DD>
  
! <p> Resolve a recipient address safely instead of correctly, by
! looking inside quotes.  </p>
  
! <p> By default, the Postfix address resolver does not quote the
! address localpart as per <a href="http://tools.ietf.org/html/rfc822">RFC 822</a>, so that additional @ or % or !
! operators remain visible. This behavior is safe but it is also
! technically incorrect.  </p>
  
! <p> If you specify "<a href="postconf.5.html#resolve_dequoted_address">resolve_dequoted_address</a> = no", then
! the Postfix
! resolver will not know about additional @ etc. operators in the
! address localpart. This opens opportunities for obscure mail relay
! attacks with user@domain@domain addresses when Postfix provides
! backup MX service for Sendmail systems.  </p>
  
***************
*** 7674,7724 ****
  
! <DT><b><a name="postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a>
! (default: <a href="DATABASE_README.html#types">static</a>:all)</b></DT><DD>
  
! <p> A list of local <a href="postscreen.8.html">postscreen(8)</a> server IP addresses where a
! non-whitelisted remote SMTP client can obtain <a href="postscreen.8.html">postscreen(8)</a>'s temporary
! whitelist status. This status is required before the client can
! talk to a Postfix SMTP server process.  By default, a client can
! obtain <a href="postscreen.8.html">postscreen(8)</a>'s whitelist status on any local <a href="postscreen.8.html">postscreen(8)</a>
! server IP address. </p>
  
! <p> When <a href="postscreen.8.html">postscreen(8)</a> listens on both primary and backup MX
! addresses, the <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> parameter can be
! configured to give the temporary whitelist status only when a client
! connects to a primary MX address. Once a client is whitelisted it
! can talk to a Postfix SMTP server on any address. Thus, clients
! that connect only to backup MX addresses will never become whitelisted,
! and will never be allowed to talk to a Postfix SMTP server process.
! </p>
  
! <p> Example: </p>
  
- <pre>
- /etc/postfix/<a href="postconf.5.html">main.cf</a>:
-     # Don't whitelist connections to the backup IP address.
-     <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> = !168.100.189.8, <a href="DATABASE_README.html#types">static</a>:all
- </pre>
  
! <p> This feature is available in Postfix 2.9 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="prepend_delivered_header">prepend_delivered_header</a>
! (default: command, file, forward)</b></DT><DD>
  
- <p> The message delivery contexts where the Postfix <a href="local.8.html">local(8)</a> delivery
- agent prepends a Delivered-To:  message header with the address
- that the mail was delivered to. This information is used for mail
- delivery loop detection.  </p>
  
! <p>
! By default, the Postfix local delivery agent prepends a Delivered-To:
! header when forwarding mail and when delivering to file (mailbox)
! and command. Turning off the Delivered-To: header when forwarding
! mail is not recommended.
! </p>
  
  <p>
! Specify zero or more of <b>forward</b>, <b>file</b>, or <b>command</b>.
  </p>
--- 7082,7119 ----
  
! <DT><b><a name="resolve_null_domain">resolve_null_domain</a>
! (default: no)</b></DT><DD>
  
! <p> Resolve an address that ends in the "@" null domain as if the
! local hostname were specified, instead of rejecting the address as
! invalid.  </p>
  
! <p> This feature is available in Postfix 2.1 and later.
! Earlier versions always resolve the null domain as the local
! hostname.  </p>
  
! <p> The Postfix SMTP server uses this feature to reject mail from
! or to addresses that end in the "@" null domain, and from addresses
! that rewrite into a form that ends in the "@" null domain.  </p>
  
  
! </DD>
  
+ <DT><b><a name="resolve_numeric_domain">resolve_numeric_domain</a>
+ (default: no)</b></DT><DD>
  
! <p> Resolve "user@ipaddress" as "user@[ipaddress]", instead of
! rejecting the address as invalid.  </p>
  
! <p> This feature is available in Postfix 2.3 and later.
  
  
! </DD>
! 
! <DT><b><a name="rewrite_service_name">rewrite_service_name</a>
! (default: rewrite)</b></DT><DD>
  
  <p>
! The name of the address rewriting service. This service rewrites
! addresses to standard form and resolves them to a (delivery method,
! next-hop host, recipient) triple.
  </p>
***************
*** 7726,7734 ****
  <p>
! Example:
  </p>
  
- <pre>
- <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a> = forward
- </pre>
- 
  
--- 7121,7125 ----
  <p>
! This feature is available in Postfix 2.0 and later.
  </p>
  
  
***************
*** 7736,7742 ****
  
! <DT><b><a name="process_id">process_id</a>
! (read-only)</b></DT><DD>
  
  <p>
! The process ID of a Postfix command or daemon process.
  </p>
--- 7127,7133 ----
  
! <DT><b><a name="sample_directory">sample_directory</a>
! (default: /etc/postfix)</b></DT><DD>
  
  <p>
! The name of the directory with example Postfix configuration files.
  </p>
***************
*** 7746,7755 ****
  
! <DT><b><a name="process_id_directory">process_id_directory</a>
! (default: pid)</b></DT><DD>
  
! <p>
! The location of Postfix PID files relative to $<a href="postconf.5.html#queue_directory">queue_directory</a>.
! This is a read-only parameter.
  </p>
  
  
--- 7137,7153 ----
  
! <DT><b><a name="send_cyrus_sasl_authzid">send_cyrus_sasl_authzid</a>
! (default: no)</b></DT><DD>
  
! <p> When authenticating to a remote SMTP or LMTP server with the
! default setting "no", send no SASL authoriZation ID (authzid); send
! only the SASL authentiCation ID (authcid) plus the authcid's password.
  </p>
  
+ <p> The non-default setting "yes" enables the behavior of older
+ Postfix versions.  These always send a SASL authzid that is equal
+ to the SASL authcid, but this causes inter-operability problems
+ with some SMTP servers. </p>
+ 
+ <p> This feature is available in Postfix 2.4.4 and later. </p>
+ 
  
***************
*** 7757,7763 ****
  
! <DT><b><a name="process_name">process_name</a>
! (read-only)</b></DT><DD>
  
  <p>
! The process name of a Postfix command or daemon process.
  </p>
--- 7155,7162 ----
  
! <DT><b><a name="sender_based_routing">sender_based_routing</a>
! (default: no)</b></DT><DD>
  
  <p>
! This parameter should not be used. It was replaced by <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
! in Postfix version 2.3.
  </p>
***************
*** 7767,7774 ****
  
! <DT><b><a name="propagate_unmatched_extensions">propagate_unmatched_extensions</a>
! (default: canonical, virtual)</b></DT><DD>
  
  <p>
! What address lookup tables copy an address extension from the lookup
! key to the lookup result.
  </p>
--- 7166,7176 ----
  
! <DT><b><a name="sender_bcc_maps">sender_bcc_maps</a>
! (default: empty)</b></DT><DD>
! 
! <p> Optional BCC (blind carbon-copy) address lookup tables, indexed
! by sender address.  The BCC address (multiple results are not
! supported) is added when mail enters from outside of Postfix.  </p>
  
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
***************
*** 7776,7816 ****
  <p>
! For example, with a <a href="virtual.5.html">virtual(5)</a> mapping of "<i>joe@example.com =&gt;
! joe.user@example.net</i>", the address "<i>joe+foo@example.com</i>"
! would rewrite to "<i>joe.user+foo@example.net</i>".
  </p>
  
! <p>
! Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>,
! <b>forward</b>, <b>include</b> or <b>generic</b>. These cause
! address extension
! propagation with <a href="canonical.5.html">canonical(5)</a>, <a href="virtual.5.html">virtual(5)</a>, and <a href="aliases.5.html">aliases(5)</a> maps,
! with <a href="local.8.html">local(8)</a> .forward and :include: file lookups, and with <a href="smtp.8.html">smtp(8)</a>
! generic maps, respectively.  </p>
  
! <p>
! Note: enabling this feature for types other than <b>canonical</b>
! and <b>virtual</b> is likely to cause problems when mail is forwarded
! to other sites, especially with mail that is sent to a mailing list
! exploder address.
! </p>
  
! <p>
! Examples:
! </p>
  
! <pre>
! <a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual, alias,
!         forward, include
! <a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual
! </pre>
  
  
! </DD>
  
! <DT><b><a name="proxy_interfaces">proxy_interfaces</a>
! (default: empty)</b></DT><DD>
  
  <p>
! The network interface addresses that this mail system receives mail
! on by way of a proxy or network address translation unit.
  </p>
--- 7178,7204 ----
  <p>
! The table search order is as follows:
  </p>
  
! <ul>
  
! <li> Look up the "user+extension@domain.tld" address including the
! optional address extension.
  
! <li> Look up the "user@domain.tld" address without the optional
! address extension.
  
! <li> Look up the "user+extension" address local part when the
! sender domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
  
+ <li> Look up the "user" address local part when the sender domain
+ equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
  
! <li> Look up the "@domain.tld" part.
  
! </ul>
  
  <p>
! Specify the types and names of databases to use.  After change,
! run "<b>postmap /etc/postfix/sender_bcc</b>".
  </p>
***************
*** 7818,7825 ****
  <p>
! This feature is available in Postfix 2.0 and later.
  </p>
  
! <p> You must specify your "outside" proxy/NAT addresses when your
! system is a backup MX host for other domains, otherwise mail delivery
! loops will happen when the primary MX host is down.  </p>
  
--- 7206,7215 ----
  <p>
! Note: if mail to the BCC address bounces it will be returned to
! the sender.
  </p>
  
! <p> Note: automatic BCC recipients are produced only for new mail.
! To avoid mailer loops, automatic BCC recipients are not generated
! for mail that Postfix forwards internally, nor for mail that Postfix
! generates itself. </p>
  
***************
*** 7830,7832 ****
  <pre>
! <a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> = 1.2.3.4
  </pre>
--- 7220,7222 ----
  <pre>
! <a href="postconf.5.html#sender_bcc_maps">sender_bcc_maps</a> = hash:/etc/postfix/sender_bcc
  </pre>
***************
*** 7836,7875 ****
  
! <DT><b><a name="proxy_read_maps">proxy_read_maps</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p>
! The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
! access for the read-only service.
! Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored.
  </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
- </DD>
  
! <DT><b><a name="proxy_write_maps">proxy_write_maps</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p> The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
! access for the read-write service. Postfix-owned local database
! files should be stored under the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>.
! Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored.  </p>
  
  <p>
! This feature is available in Postfix 2.5 and later.
  </p>
  
  
! </DD>
  
! <DT><b><a name="proxymap_service_name">proxymap_service_name</a>
! (default: proxymap)</b></DT><DD>
  
! <p> The name of the proxymap read-only table lookup service.  This
! service is normally implemented by the <a href="proxymap.8.html">proxymap(8)</a> daemon. </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
  
--- 7226,7268 ----
  
! <DT><b><a name="sender_canonical_classes">sender_canonical_classes</a>
! (default: envelope_sender, header_sender)</b></DT><DD>
  
! <p> What addresses are subject to <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address
! mapping.  By default, <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address mapping is
! applied to envelope sender addresses, and to header sender addresses.
  </p>
  
! <p> Specify one or more of: envelope_sender, header_sender </p>
  
+ <p> This feature is available in Postfix 2.2 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="sender_canonical_maps">sender_canonical_maps</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional address mapping lookup tables for envelope and header
! sender addresses.
! The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
  </p>
  
+ <p>
+ Example: you want to rewrite the SENDER address "user@ugly.domain"
+ to "user@pretty.domain", while still being able to send mail to
+ the RECIPIENT address "user@ugly.domain".
+ </p>
  
! <p>
! Note: $<a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
! </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> = hash:/etc/postfix/sender_canonical
! </pre>
  
***************
*** 7878,7905 ****
  
! <DT><b><a name="proxywrite_service_name">proxywrite_service_name</a>
! (default: proxywrite)</b></DT><DD>
! 
! <p> The name of the proxywrite read-write table lookup service.
! This service is normally implemented by the <a href="proxymap.8.html">proxymap(8)</a> daemon.
! </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
  
! </DD>
  
! <DT><b><a name="qmgr_clog_warn_time">qmgr_clog_warn_time</a>
! (default: 300s)</b></DT><DD>
  
  <p>
! The minimal delay between warnings that a specific destination is
! clogging up the Postfix <a href="QSHAPE_README.html#active_queue">active queue</a>. Specify 0 to disable.
  </p>
  
! <p>
! This feature is enabled with the <a href="postconf.5.html#helpful_warnings">helpful_warnings</a> parameter.
! </p>
  
  <p>
! This feature is available in Postfix 2.0 and later.
  </p>
--- 7271,7297 ----
  
! <DT><b><a name="sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
! (default: empty)</b></DT><DD>
  
! <p> A sender-dependent override for the global <a href="postconf.5.html#relayhost">relayhost</a> parameter
! setting. The tables are searched by the envelope sender address and
! @domain. This information is overruled with <a href="postconf.5.html#relay_transport">relay_transport</a>,
! <a href="postconf.5.html#default_transport">default_transport</a> and with the <a href="transport.5.html">transport(5)</a> table. </p>
  
! <p> For safety reasons, this feature does not allow $number
! substitutions in regular expression maps. </p>
  
  <p>
! This feature is available in Postfix 2.3 and later.
  </p>
  
! 
! </DD>
! 
! <DT><b><a name="sendmail_path">sendmail_path</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
  <p>
! A Sendmail compatibility feature that specifies the location of
! the Postfix <a href="sendmail.1.html">sendmail(1)</a> command. This command can be used to
! submit mail into the Postfix queue.
  </p>
***************
*** 7909,7915 ****
  
! <DT><b><a name="qmgr_daemon_timeout">qmgr_daemon_timeout</a>
! (default: 1000s)</b></DT><DD>
  
! <p> How much time a Postfix queue manager process may take to handle
! a request before it is terminated by a built-in watchdog timer.
  </p>
--- 7301,7308 ----
  
! <DT><b><a name="service_throttle_time">service_throttle_time</a>
! (default: 60s)</b></DT><DD>
  
! <p>
! How long the Postfix <a href="master.8.html">master(8)</a> waits before forking a server that
! appears to be malfunctioning.
  </p>
***************
*** 7921,7924 ****
  
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
  
--- 7314,7315 ----
***************
*** 7926,7939 ****
  
! <DT><b><a name="qmgr_fudge_factor">qmgr_fudge_factor</a>
! (default: 100)</b></DT><DD>
! 
! <p>
! Obsolete feature: the percentage of delivery resources that a busy
! mail system will use up for delivery of a large mailing  list
! message.
! </p>
  
  <p>
! This feature exists only in the <a href="qmgr.8.html">oqmgr(8)</a> old queue manager. The
! current queue manager solves the problem in a better way.
  </p>
--- 7317,7326 ----
  
! <DT><b><a name="setgid_group">setgid_group</a>
! (default: postdrop)</b></DT><DD>
  
  <p>
! The group ownership of set-gid Postfix commands and of group-writable
! Postfix directories. When this parameter value is changed you need
! to re-run "<b>postfix set-permissions</b>" (with Postfix version 2.0 and
! earlier: "<b>/etc/postfix/post-install set-permissions</b>".
  </p>
***************
*** 7943,7967 ****
  
! <DT><b><a name="qmgr_ipc_timeout">qmgr_ipc_timeout</a>
! (default: 60s)</b></DT><DD>
! 
! <p> The time limit for the queue manager to send or receive information
! over an internal communication channel.  The purpose is to break
! out of deadlock situations. If the time limit is exceeded the
! software either retries or aborts the operation. </p>
  
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
  
- <p> This feature is available in Postfix 2.8 and later.  </p>
- 
- 
- </DD>
- 
- <DT><b><a name="qmgr_message_active_limit">qmgr_message_active_limit</a>
- (default: 20000)</b></DT><DD>
- 
  <p>
! The maximal number of messages in the <a href="QSHAPE_README.html#active_queue">active queue</a>.
  </p>
--- 7330,7342 ----
  
! <DT><b><a name="show_user_unknown_table_name">show_user_unknown_table_name</a>
! (default: yes)</b></DT><DD>
  
  <p>
! Display the name of the recipient table in the "User unknown"
! responses.  The extra detail makes trouble shooting easier but also
! reveals information that is nobody elses business.
  </p>
  
  <p>
! This feature is available in Postfix 2.0 and later.
  </p>
***************
*** 7971,7991 ****
  
! <DT><b><a name="qmgr_message_recipient_limit">qmgr_message_recipient_limit</a>
! (default: 20000)</b></DT><DD>
! 
! <p> The maximal number of recipients held in memory by the Postfix
! queue manager, and the maximal size of the size of the short-term,
! in-memory "dead" destination status cache.  </p>
! 
! 
! </DD>
  
! <DT><b><a name="qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a>
! (default: 10)</b></DT><DD>
  
  <p>
! The minimal number of in-memory recipients for any message. This
! takes priority over any other in-memory recipient limits (i.e.,
! the global <a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> and the per transport
! _recipient_limit) if necessary. The minimum value allowed for this
! parameter is 1.
  </p>
--- 7346,7357 ----
  
! <DT><b><a name="showq_service_name">showq_service_name</a>
! (default: showq)</b></DT><DD>
  
! <p>
! The name of the <a href="showq.8.html">showq(8)</a> service. This service produces mail queue
! status reports.
! </p>
  
  <p>
! This feature is available in Postfix 2.0 and later.
  </p>
***************
*** 7995,8002 ****
  
! <DT><b><a name="qmqpd_authorized_clients">qmqpd_authorized_clients</a>
! (default: empty)</b></DT><DD>
  
  <p>
! What remote QMQP clients are allowed to connect to the Postfix QMQP
! server port.
  </p>
--- 7361,7367 ----
  
! <DT><b><a name="smtp_always_send_ehlo">smtp_always_send_ehlo</a>
! (default: yes)</b></DT><DD>
  
  <p>
! Always send EHLO at the start of an SMTP session.
  </p>
***************
*** 8004,8022 ****
  <p>
! By default, no client is allowed to use the service. This is
! because the QMQP server will relay mail to any destination.
  </p>
  
! <p>
! Specify a list of client patterns. A list pattern specifies a host
! name, a domain name, an internet address, or a network/mask pattern,
! where the mask specifies the number of bits in the network part.
! When a pattern specifies a file name, its contents are substituted
! for the file name; when a pattern is a "<a href="DATABASE_README.html">type:table</a>" table specification,
! table lookup is used instead.  </p>
  
  <p>
! Patterns are separated by whitespace and/or commas. In order to
! reverse the result, precede a pattern with an
! exclamation point (!). The form "!/file/name" is supported only
! in Postfix version 2.4 and later.
  </p>
--- 7369,7384 ----
  <p>
! With "<a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> = no", Postfix sends EHLO only when
! the word "ESMTP" appears in the server greeting banner (example:
! 220 spike.porcupine.org ESMTP Postfix).
  </p>
  
! 
! </DD>
! 
! <DT><b><a name="smtp_bind_address">smtp_bind_address</a>
! (default: empty)</b></DT><DD>
  
  <p>
! An optional numerical network address that the Postfix SMTP client
! should bind to when making an IPv4 connection.
  </p>
***************
*** 8024,8043 ****
  <p>
! Example:
  </p>
  
  <pre>
! <a href="postconf.5.html#qmqpd_authorized_clients">qmqpd_authorized_clients</a> = !192.168.0.1, 192.168.0.0/24
  </pre>
  
  
! </DD>
! 
! <DT><b><a name="qmqpd_client_port_logging">qmqpd_client_port_logging</a>
! (default: no)</b></DT><DD>
! 
! <p> Enable logging of the remote QMQP client port in addition to
! the hostname and IP address. The logging format is "host[address]:port".
! </p>
! 
! <p> This feature is available in Postfix 2.5 and later. </p>
  
--- 7386,7407 ----
  <p>
! This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
! it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
! for example:
  </p>
  
+ <blockquote>
  <pre>
! /etc/postfix/<a href="master.5.html">master.cf</a>:
!     smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>=11.22.33.44
  </pre>
+ </blockquote>
  
+ <p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv4
+ address, and that address is a non-loopback address, it is
+ automatically used as the <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>.  This supports virtual
+ IP hosting, but can be a problem on multi-homed firewalls. See the
+ <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
  
! <p> Note 2: address information may be enclosed inside <tt>[]</tt>,
! but this form is not required here. </p>
  
***************
*** 8046,8088 ****
  
! <DT><b><a name="qmqpd_error_delay">qmqpd_error_delay</a>
! (default: 1s)</b></DT><DD>
! 
! <p>
! How long the Postfix QMQP server will pause before sending a negative
! reply to the remote QMQP client. The purpose is to slow down confused
! or malicious clients.
! </p>
  
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
  
! 
! </DD>
! 
! <DT><b><a name="qmqpd_timeout">qmqpd_timeout</a>
! (default: 300s)</b></DT><DD>
! 
! <p>
! The time limit for sending or receiving information over the network.
! If a read or write operation blocks for more than $<a href="postconf.5.html#qmqpd_timeout">qmqpd_timeout</a>
! seconds the Postfix QMQP server gives up and disconnects.
! </p>
  
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
  
  
! </DD>
! 
! <DT><b><a name="queue_directory">queue_directory</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p>
! The location of the Postfix top-level queue directory. This is the
! root directory of Postfix daemon processes that run chrooted.
! </p>
  
--- 7410,7442 ----
  
! <DT><b><a name="smtp_bind_address6">smtp_bind_address6</a>
! (default: empty)</b></DT><DD>
  
  <p>
! An optional numerical network address that the Postfix SMTP client
! should bind to when making an IPv6 connection.
  </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
  <p>
! This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
! it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
! for example:
  </p>
  
+ <blockquote>
+ <pre>
+ /etc/postfix/<a href="master.5.html">master.cf</a>:
+     smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>=1:2:3:4:5:6:7:8
+ </pre>
+ </blockquote>
  
! <p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv6
! address, and that address is a non-loopback address, it is
! automatically used as the <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>.  This supports virtual
! IP hosting, but can be a problem on multi-homed firewalls. See the
! <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
  
! <p> Note 2: address information may be enclosed inside <tt>[]</tt>,
! but this form is not recommended here. </p>
  
***************
*** 8091,8104 ****
  
! <DT><b><a name="queue_file_attribute_count_limit">queue_file_attribute_count_limit</a>
! (default: 100)</b></DT><DD>
  
! <p>
! The maximal number of (name=value) attributes that may be stored
! in a Postfix queue file. The limit is enforced by the <a href="cleanup.8.html">cleanup(8)</a>
! server.
  </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
--- 7445,7455 ----
  
! <DT><b><a name="smtp_body_checks">smtp_body_checks</a>
! (default: empty)</b></DT><DD>
  
! <p> Restricted <a href="header_checks.5.html">body_checks(5)</a> tables for the Postfix SMTP client.
! These tables are searched while mail is being delivered.  Actions
! that change the delivery time or destination are not available.
  </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 8107,8129 ****
  
! <DT><b><a name="queue_minfree">queue_minfree</a>
! (default: 0)</b></DT><DD>
! 
! <p>
! The minimal amount of free space in bytes in the queue file system
! that is needed to receive mail.  This is currently used by the
! Postfix SMTP server to decide if it will accept any mail at all.
! </p>
  
! <p>
! By default, the Postfix SMTP server rejects MAIL FROM commands when
! the amount of free space is less than 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>
! (Postfix version 2.1 and later).
! To specify a higher minimum free space limit, specify a <a href="postconf.5.html#queue_minfree">queue_minfree</a>
! value that is at least 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>.
! </p>
  
! <p>
! With Postfix versions 2.0 and earlier, a <a href="postconf.5.html#queue_minfree">queue_minfree</a> value of
! zero means there is no minimum required amount of free space.
! </p>
  
--- 7458,7471 ----
  
! <DT><b><a name="smtp_cname_overrides_servername">smtp_cname_overrides_servername</a>
! (default: version dependent)</b></DT><DD>
  
! <p> Allow DNS CNAME records to override the servername that the
! Postfix SMTP client uses for logging, SASL password lookup, TLS
! policy decisions, or TLS certificate verification. The value "no"
! hardens Postfix <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> hostname-based policies against
! false hostname information in DNS CNAME records, and makes SASL
! password file lookups more predictable. This is the default setting
! as of Postfix 2.3. </p>
  
! <p> This feature is available in Postfix 2.2.9 and later. </p>
  
***************
*** 8132,8143 ****
  
! <DT><b><a name="queue_run_delay">queue_run_delay</a>
! (default: 300s)</b></DT><DD>
  
  <p>
! The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager;
! prior to Postfix 2.4 the default value was 1000s.
  </p>
  
! <p> This parameter should be set less than or equal to
! $<a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a>. See also $<a href="postconf.5.html#maximal_backoff_time">maximal_backoff_time</a>.  </p>
  
--- 7474,7490 ----
  
! <DT><b><a name="smtp_connect_timeout">smtp_connect_timeout</a>
! (default: 30s)</b></DT><DD>
  
  <p>
! The SMTP client time limit for completing a TCP connection, or
! zero (use the operating system built-in time limit).
  </p>
  
! <p>
! When no connection can be made within the deadline, the Postfix
! SMTP client
! tries the next address on the mail exchanger list. Specify 0 to
! disable the time limit (i.e. use whatever timeout is implemented by
! the operating system).
! </p>
  
***************
*** 8151,8181 ****
  
! <DT><b><a name="queue_service_name">queue_service_name</a>
! (default: qmgr)</b></DT><DD>
  
! <p>
! The name of the <a href="qmgr.8.html">qmgr(8)</a> service. This service manages the Postfix
! queue and schedules delivery requests.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
! </DD>
  
! <DT><b><a name="rbl_reply_maps">rbl_reply_maps</a>
! (default: empty)</b></DT><DD>
  
! <p>
! Optional lookup tables with RBL response templates. The tables are
! indexed by the RBL domain name. By default, Postfix uses the default
! template as specified with the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> configuration
! parameter. See there for a discussion of the syntax of RBL reply
! templates.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
--- 7498,7535 ----
  
! <DT><b><a name="smtp_connection_cache_destinations">smtp_connection_cache_destinations</a>
! (default: empty)</b></DT><DD>
  
! <p> Permanently enable SMTP connection caching for the specified
! destinations.  With SMTP connection caching, a connection is not
! closed immediately after completion of a mail transaction.  Instead,
! the connection is kept open for up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
! seconds.  This allows connections to be reused for other deliveries,
! and can improve mail delivery performance. </p>
  
! <p> Specify a comma or white space separated list of destinations
! or pseudo-destinations: </p>
  
+ <ul>
  
! <li> if mail is sent without a <a href="postconf.5.html#relayhost">relay host</a>: a domain name (the
! right-hand side of an email address, without the [] around a numeric
! IP address),
  
! <li> if mail is sent via a <a href="postconf.5.html#relayhost">relay host</a>: a <a href="postconf.5.html#relayhost">relay host</a> name (without
! [] or non-default TCP port), as specified in <a href="postconf.5.html">main.cf</a> or in the
! transport map,
  
! <li> if mail is sent via a UNIX-domain socket: a pathname (without
! the unix: prefix),
  
! <li> a /file/name with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names as
! defined above,
! 
! <li> a "<a href="DATABASE_README.html">type:table</a>" with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names on
! the left-hand side.  The right-hand side result from "<a href="DATABASE_README.html">type:table</a>"
! lookups is ignored.
! 
! </ul>
! 
! <p> This feature is available in Postfix 2.2 and later. </p>
  
***************
*** 8184,8192 ****
  
! <DT><b><a name="readme_directory">readme_directory</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p>
! The location of Postfix README files that describe how to build,
! configure or operate a specific Postfix subsystem or feature.
! </p>
  
--- 7538,7551 ----
  
! <DT><b><a name="smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a>
! (default: yes)</b></DT><DD>
  
! <p> Temporarily enable SMTP connection caching while a destination
! has a high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>.  With SMTP connection
! caching, a connection is not closed immediately after completion
! of a mail transaction.  Instead, the connection is kept open for
! up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a> seconds.  This allows
! connections to be reused for other deliveries, and can improve mail
! delivery performance. </p>
! 
! <p> This feature is available in Postfix 2.2 and later. </p>
  
***************
*** 8195,8256 ****
  
! <DT><b><a name="receive_override_options">receive_override_options</a>
! (default: empty)</b></DT><DD>
  
! <p> Enable or disable recipient validation, built-in content
! filtering, or address mapping. Typically, these are specified in
! <a href="master.5.html">master.cf</a> as command-line arguments for the <a href="smtpd.8.html">smtpd(8)</a>, <a href="qmqpd.8.html">qmqpd(8)</a> or
! <a href="pickup.8.html">pickup(8)</a> daemons. </p>
  
! <p> Specify zero or more of the following options.  The options
! override <a href="postconf.5.html">main.cf</a> settings and are either implemented by <a href="smtpd.8.html">smtpd(8)</a>,
! <a href="qmqpd.8.html">qmqpd(8)</a>, or <a href="pickup.8.html">pickup(8)</a> themselves, or they are forwarded to the
! cleanup server.  </p>
  
- <dl>
  
! <dt><b><a name="no_unknown_recipient_checks">no_unknown_recipient_checks</a></b></dt>
  
! <dd>Do not try to reject unknown recipients (SMTP server only).
! This is typically specified AFTER an external content filter.
! </dd>
  
! <dt><b><a name="no_address_mappings">no_address_mappings</a></b></dt>
  
! <dd>Disable canonical address mapping, virtual alias map expansion,
! address masquerading, and automatic BCC (blind carbon-copy)
! recipients. This is typically specified BEFORE an external content
! filter. </dd>
  
- <dt><b><a name="no_header_body_checks">no_header_body_checks</a></b></dt>
  
! <dd>Disable header/body_checks. This is typically specified AFTER
! an external content filter. </dd>
  
! <dt><b><a name="no_milters">no_milters</a></b></dt>
  
! <dd>Disable Milter (mail filter) applications. This is typically
! specified AFTER an external content filter. </dd>
  
! </dl>
  
! <p>
! Note: when the "BEFORE content filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a>
! setting is specified in the <a href="postconf.5.html">main.cf</a> file, specify the "AFTER content
! filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a> setting in <a href="master.5.html">master.cf</a> (and vice
! versa).
! </p>
  
! <p>
! Examples:
! </p>
  
! <pre>
! <a href="postconf.5.html#receive_override_options">receive_override_options</a> =
!     <a href="postconf.5.html#no_unknown_recipient_checks">no_unknown_recipient_checks</a>, <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>
! <a href="postconf.5.html#receive_override_options">receive_override_options</a> = <a href="postconf.5.html#no_address_mappings">no_address_mappings</a>
! </pre>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
--- 7554,7629 ----
  
! <DT><b><a name="smtp_connection_cache_reuse_limit">smtp_connection_cache_reuse_limit</a>
! (default: 10)</b></DT><DD>
  
! <p> When SMTP connection caching is enabled, the number of times that
! an SMTP session may be reused before it is closed.
! </p>
  
! <p> This feature is available in Postfix 2.2. In Postfix 2.3 it is
! replaced by $<a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>.</p>
  
  
! </DD>
  
! <DT><b><a name="smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
! (default: 2s)</b></DT><DD>
  
! <p> When SMTP connection caching is enabled, the amount of time that
! an unused SMTP client socket is kept open before it is closed.  Do
! not specify larger values without permission from the remote sites.
! </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>
! (default: 300s)</b></DT><DD>
  
! <p> The amount of time during which Postfix will use an SMTP
! connection repeatedly.  The timer starts when the connection is
! initiated (i.e. it includes the connect, greeting and helo latency,
! in addition to the latencies of subsequent mail delivery transactions).
! </p>
  
! <p> This feature addresses a performance stability problem with
! remote SMTP servers. This problem is not specific to Postfix: it
! can happen when any MTA sends large amounts of SMTP email to a site
! that has multiple MX hosts. </p>
  
! <p> The problem starts when one of a set of MX hosts becomes slower
! than the rest.  Even though SMTP clients connect to fast and slow
! MX hosts with equal probability, the slow MX host ends up with more
! simultaneous inbound connections than the faster MX hosts, because
! the slow MX host needs more time to serve each client request. </p>
  
! <p> The slow MX host becomes a connection attractor.  If one MX
! host becomes N times slower than the rest, it dominates mail delivery
! latency unless there are more than N fast MX hosts to counter the
! effect. And if the number of MX hosts is smaller than N, the mail
! delivery latency becomes effectively that of the slowest MX host
! divided by the total number of MX hosts. </p>
  
! <p> The solution uses connection caching in a way that differs from
! Postfix version 2.2.  By limiting the amount of time during which a connection
! can be used repeatedly (instead of limiting the number of deliveries
! over that connection), Postfix not only restores fairness in the
! distribution of simultaneous connections across a set of MX hosts,
! it also favors deliveries over connections that perform well, which
! is exactly what we want.  </p>
  
! <p> The default reuse time limit, 300s, is comparable to the various
! smtp transaction timeouts which are fair estimates of maximum excess
! latency for a slow delivery.  Note that hosts may accept thousands
! of messages over a single connection within the default connection
! reuse time limit. This number is much larger than the default Postfix
! version 2.2 limit of 10 messages per cached connection. It may prove necessary
! to lower the limit to avoid interoperability issues with MTAs that
! exhibit bugs when many messages are delivered via a single connection.
! A lower reuse time limit risks losing the benefit of connection
! reuse when the average connection and mail delivery latency exceeds
! the reuse time limit.  </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 8259,8267 ****
  
! <DT><b><a name="recipient_bcc_maps">recipient_bcc_maps</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional BCC (blind carbon-copy) address lookup tables, indexed by
! recipient address.  The BCC address (multiple results are not
! supported) is added when mail enters from outside of Postfix.
  </p>
--- 7632,7639 ----
  
! <DT><b><a name="smtp_data_done_timeout">smtp_data_done_timeout</a>
! (default: 600s)</b></DT><DD>
  
  <p>
! The SMTP client time limit for sending the SMTP ".", and for receiving
! the server response.
  </p>
***************
*** 8269,8271 ****
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
--- 7641,7644 ----
  <p>
! When no response is received within the deadline, a warning is
! logged that the mail may be delivered multiple times.
  </p>
***************
*** 8273,8319 ****
  <p>
! The table search order is as follows:
  </p>
  
- <ul>
- 
- <li> Look up the "user+extension@domain.tld" address including the
- optional address extension.
- 
- <li> Look up the "user@domain.tld" address without the optional
- address extension.
- 
- <li> Look up the "user+extension" address local part when the
- recipient domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
- or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
- 
- <li> Look up the "user" address local part when the recipient domain
- equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
- 
- <li> Look up the "@domain.tld" part.
  
! </ul>
  
! <p>
! Specify the types and names of databases to use.  After change,
! run "<b>postmap /etc/postfix/recipient_bcc</b>".
! </p>
  
  <p>
! Note: if mail to the BCC address bounces it will be returned to
! the sender.
  </p>
  
- <p> Note: automatic BCC recipients are produced only for new mail.
- To avoid mailer loops, automatic BCC recipients are not generated
- after Postfix forwards mail internally, or after Postfix generates
- mail itself. </p>
- 
  <p>
! Example:
  </p>
  
- <pre>
- <a href="postconf.5.html#recipient_bcc_maps">recipient_bcc_maps</a> = hash:/etc/postfix/recipient_bcc
- </pre>
- 
  
--- 7646,7667 ----
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_data_init_timeout">smtp_data_init_timeout</a>
! (default: 120s)</b></DT><DD>
  
  <p>
! The SMTP client time limit for sending the SMTP DATA command, and for
! receiving the server response.
  </p>
  
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
  
  
***************
*** 8321,8334 ****
  
! <DT><b><a name="recipient_canonical_classes">recipient_canonical_classes</a>
! (default: envelope_recipient, header_recipient)</b></DT><DD>
! 
! <p> What addresses are subject to <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address
! mapping.  By default, <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address mapping is
! applied to envelope recipient addresses, and to header recipient
! addresses.  </p>
  
! <p> Specify one or more of: envelope_recipient, header_recipient
  </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
--- 7669,7683 ----
  
! <DT><b><a name="smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
! (default: 180s)</b></DT><DD>
  
! <p>
! The SMTP client time limit for sending the SMTP message content.
! When the connection makes no progress for more than $<a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
! seconds the Postfix SMTP client terminates the transfer.
  </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
***************
*** 8337,8345 ****
  
! <DT><b><a name="recipient_canonical_maps">recipient_canonical_maps</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional address mapping lookup tables for envelope and header
! recipient addresses.
! The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
  </p>
--- 7686,7692 ----
  
! <DT><b><a name="smtp_defer_if_no_mx_address_found">smtp_defer_if_no_mx_address_found</a>
! (default: no)</b></DT><DD>
  
  <p>
! Defer mail delivery when no MX record resolves to an IP address.
  </p>
***************
*** 8347,8349 ****
  <p>
! Note: $<a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
  </p>
--- 7694,7698 ----
  <p>
! The default (no) is to return the mail as undeliverable. With older
! Postfix versions the default was to keep trying to deliver the mail
! until someone fixed the MX record or until the mail was too old.
  </p>
***************
*** 8351,8358 ****
  <p>
! Example:
  </p>
  
! <pre>
! <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> = hash:/etc/postfix/recipient_canonical
! </pre>
  
--- 7700,7708 ----
  <p>
! Note: Postfix always ignores MX records with equal or worse preference
! than the local MTA itself.
  </p>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
***************
*** 8361,8380 ****
  
! <DT><b><a name="recipient_delimiter">recipient_delimiter</a>
! (default: empty)</b></DT><DD>
! 
! <p>
! The separator between user names and address extensions (user+foo).
! See <a href="canonical.5.html">canonical(5)</a>, <a href="local.8.html">local(8)</a>, <a href="relocated.5.html">relocated(5)</a> and <a href="virtual.5.html">virtual(5)</a> for the
! effects this has on aliases, canonical, virtual, relocated and
! on .forward file lookups.  Basically, the software tries user+foo
! and .forward+foo before trying user and .forward.
! </p>
! 
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> = +
! </pre>
  
--- 7711,7719 ----
  
! <DT><b><a name="smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a>
! (default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
  
! <p> The maximal number of parallel deliveries to the same destination
! via the smtp message delivery transport. This limit is enforced by
! the queue manager. The message delivery transport name is the first
! field in the entry in the <a href="master.5.html">master.cf</a> file.  </p>
  
***************
*** 8383,8395 ****
  
! <DT><b><a name="reject_code">reject_code</a>
! (default: 554)</b></DT><DD>
  
! <p>
! The numerical Postfix SMTP server response code when a remote SMTP
! client request is rejected by the "reject" restriction.
! </p>
  
! <p>
! Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
! </p>
  
--- 7722,7734 ----
  
! <DT><b><a name="smtp_destination_recipient_limit">smtp_destination_recipient_limit</a>
! (default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
  
! <p> The maximal number of recipients per message for the smtp
! message delivery transport. This limit is enforced by the queue
! manager. The message delivery transport name is the first field in
! the entry in the <a href="master.5.html">master.cf</a> file.  </p>
  
! <p> Setting this parameter to a value of 1 changes the meaning of
! <a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> from concurrency per domain
! into concurrency per recipient.  </p>
  
***************
*** 8398,8414 ****
  
! <DT><b><a name="reject_tempfail_action">reject_tempfail_action</a>
! (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>)</b></DT><DD>
  
! <p> The Postfix SMTP server's action when a reject-type restriction
! fails due to a temporary error condition. Specify "defer" to defer
! the remote SMTP client request immediately. With the default
! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
! for opportunities to reject mail, and defers the client request
! only if it would otherwise be accepted. </p>
! 
! <p> For finer control, see: <a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a>,
! <a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a>, <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a>,
! and <a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a>.  </p>
  
! <p> This feature is available in Postfix 2.6 and later. </p>
  
--- 7737,7749 ----
  
! <DT><b><a name="smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>
! (default: empty)</b></DT><DD>
  
! <p> Lookup tables, indexed by the remote SMTP server address, with
! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
! etc.) that the Postfix SMTP client will ignore in the EHLO response from a
! remote SMTP server. See <a href="postconf.5.html#smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a> for details. The
! table is not indexed by hostname for consistency with
! <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>. </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
***************
*** 8417,8444 ****
  
! <DT><b><a name="relay_clientcerts">relay_clientcerts</a>
  (default: empty)</b></DT><DD>
  
! <p> List of tables with remote SMTP client-certificate fingerprints or
! public key fingerprints (Postfix 2.9 and later) for which the Postfix
! SMTP server will allow access with the <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
! feature.  The fingerprint digest algorithm is configurable via the
! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
! Postfix version 2.5).  </p>
  
! <p> Postfix lookup tables are in the form of (key, value) pairs.
! Since we only need the key, the value can be chosen freely, e.g.
! the name of the user or host:
! D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a> = hash:/etc/postfix/relay_clientcerts
! </pre>
  
! <p>For more fine-grained control, use <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> to select
! an appropriate <a href="access.5.html">access(5)</a> policy for each client.
! See <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a>.</p>
  
! <p>This feature is available with Postfix version 2.2.</p>
  
--- 7752,7773 ----
  
! <DT><b><a name="smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a>
  (default: empty)</b></DT><DD>
  
! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
! auth, etc.) that the Postfix SMTP client will ignore in the EHLO
! response from a remote SMTP server. </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
! <p> Notes: </p>
  
! <ul>
  
! <li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
! this action from being logged. </p>
  
! <li> <p> Use the <a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a> feature to
! discard EHLO keywords selectively. </p>
! 
! </ul>
  
***************
*** 8447,8457 ****
  
! <DT><b><a name="relay_destination_concurrency_limit">relay_destination_concurrency_limit</a>
! (default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
  
! <p> The maximal number of parallel deliveries to the same destination
! via the relay message delivery transport. This limit is enforced
! by the queue manager. The message delivery transport name is the
! first field in the entry in the <a href="master.5.html">master.cf</a> file.  </p>
  
! <p> This feature is available in Postfix 2.0 and later. </p>
  
--- 7776,7800 ----
  
! <DT><b><a name="smtp_enforce_tls">smtp_enforce_tls</a>
! (default: no)</b></DT><DD>
  
! <p> Enforcement mode: require that remote SMTP servers use TLS
! encryption, and never send mail in the clear.  This also requires
! that the remote SMTP server hostname matches the information in
! the remote server certificate, and that the remote SMTP server
! certificate was issued by a CA that is trusted by the Postfix SMTP
! client. If the certificate doesn't verify or the hostname doesn't
! match, delivery is deferred and mail stays in the queue.  </p>
  
! <p> The server hostname is matched against all names provided as
! dNSNames in the SubjectAlternativeName.  If no dNSNames are specified,
! the CommonName is checked.  The behavior may be changed with the
! <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> option.  </p>
! 
! <p> This option is useful only if you are definitely sure that you
! will only connect to servers that support <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> _and_ that
! provide valid server certificates.  Typical use is for clients that
! send all their email to a dedicated mailhub.  </p>
! 
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
  
***************
*** 8460,8506 ****
  
! <DT><b><a name="relay_destination_recipient_limit">relay_destination_recipient_limit</a>
! (default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
  
! <p> The maximal number of recipients per message for the relay
! message delivery transport. This limit is enforced by the queue
! manager. The message delivery transport name is the first field in
! the entry in the <a href="master.5.html">master.cf</a> file.  </p>
  
! <p> Setting this parameter to a value of 1 changes the meaning of
! <a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> from concurrency per domain
! into concurrency per recipient.  </p>
  
! <p> This feature is available in Postfix 2.0 and later. </p>
  
  
- </DD>
  
! <DT><b><a name="relay_domains">relay_domains</a>
! (default: $<a href="postconf.5.html#mydestination">mydestination</a>)</b></DT><DD>
  
! <p> What destination domains (and subdomains thereof) this system
! will relay mail to. Subdomain matching is controlled with the
! <a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> parameter. For details about how
! the <a href="postconf.5.html#relay_domains">relay_domains</a> value is used, see the description of the
! <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> and <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> SMTP recipient
! restrictions.  </p>
  
! <p> Domains that match $<a href="postconf.5.html#relay_domains">relay_domains</a> are delivered with the
! $<a href="postconf.5.html#relay_transport">relay_transport</a> mail delivery transport. The SMTP server validates
! recipient addresses with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> and rejects non-existent
! recipients. See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the
! <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file.  </p>
  
! <p> Note: Postfix will not automatically forward mail for domains
! that list this system as their primary or backup MX host. See the
! <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> restriction in the <a href="postconf.5.html">postconf(5)</a> manual page.  </p>
  
! <p> Specify a list of host or domain names, "/file/name" patterns
! or "<a href="DATABASE_README.html">type:table</a>" lookup tables, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace. A
! "/file/name" pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>"
! lookup table is matched when a (parent) domain appears as lookup
! key. Specify "!pattern" to exclude a domain from the list. The form
! "!/file/name" is supported only in Postfix version 2.4 and later.
! </p>
  
--- 7803,7845 ----
  
! <DT><b><a name="smtp_fallback_relay">smtp_fallback_relay</a>
! (default: $<a href="postconf.5.html#fallback_relay">fallback_relay</a>)</b></DT><DD>
  
! <p>
! Optional list of relay hosts for SMTP destinations that can't be
! found or that are unreachable. With Postfix 2.2 and earlier this
! parameter is called <a href="postconf.5.html#fallback_relay">fallback_relay</a>.  </p>
  
! <p>
! By default, mail is returned to the sender when a destination is
! not found, and delivery is deferred when a destination is unreachable.
! </p>
  
! <p> The fallback relays must be SMTP destinations. Specify a domain,
! host, host:port, [host]:port, [address] or [address]:port; the form
! [host] turns off MX lookups.  If you specify multiple SMTP
! destinations, Postfix will try them in the specified order.  </p>
  
+ <p> To prevent mailer loops between MX hosts and fall-back hosts,
+ Postfix version 2.2 and later will not use the fallback relays for
+ destinations that it is MX host for (assuming DNS lookup is turned on).
+ </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_generic_maps">smtp_generic_maps</a>
! (default: empty)</b></DT><DD>
  
! <p> Optional lookup tables that perform address rewriting in the
! SMTP client, typically to transform a locally valid address into
! a globally valid address when sending mail across the Internet.
! This is needed when the local machine does not have its own Internet
! domain name, but uses something like <i>localdomain.local</i>
! instead.  </p>
  
! <p> The table format and lookups are documented in <a href="generic.5.html">generic(5)</a>;
! examples are shown in the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> and
! <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> documents. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 8509,8522 ****
  
! <DT><b><a name="relay_domains_reject_code">relay_domains_reject_code</a>
! (default: 554)</b></DT><DD>
  
! <p>
! The numerical Postfix SMTP server response code when a client
! request is rejected by the <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient
! restriction.
  </p>
  
! <p>
! Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
! </p>
  
--- 7848,7858 ----
  
! <DT><b><a name="smtp_header_checks">smtp_header_checks</a>
! (default: empty)</b></DT><DD>
  
! <p> Restricted <a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP client.
! These tables are searched while mail is being delivered.  Actions
! that change the delivery time or destination are not available.
  </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 8525,8542 ****
  
! <DT><b><a name="relay_recipient_maps">relay_recipient_maps</a>
! (default: empty)</b></DT><DD>
! 
! <p> Optional lookup tables with all valid addresses in the domains
! that match $<a href="postconf.5.html#relay_domains">relay_domains</a>. Specify @domain as a wild-card for
! domains that have no valid recipient list, and become a source of
! backscatter mail: Postfix accepts spam for non-existent recipients
! and then floods innocent people with undeliverable mail.  Technically,
! tables
! listed with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> are used as lists: Postfix needs
! to know only if a lookup string is found or not, but it does not
! use the result from table lookup.  </p>
  
  <p>
! If this parameter is non-empty, then the Postfix SMTP server will reject
! mail to unknown relay users. This feature is off by default.
  </p>
--- 7861,7867 ----
  
! <DT><b><a name="smtp_helo_name">smtp_helo_name</a>
! (default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
  
  <p>
! The hostname to send in the SMTP EHLO or HELO command.
  </p>
***************
*** 8544,8547 ****
  <p>
! See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
! file.
  </p>
--- 7869,7872 ----
  <p>
! The default value is the machine hostname.  Specify a hostname or
! [ip.add.re.ss].
  </p>
***************
*** 8549,8556 ****
  <p>
! Example:
  </p>
  
  <pre>
! <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> = hash:/etc/postfix/relay_recipients
  </pre>
  
--- 7874,7886 ----
  <p>
! This information can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP
! clients, or it can be specified in the <a href="master.5.html">master.cf</a> file for a specific
! client, for example:
  </p>
  
+ <blockquote>
  <pre>
! /etc/postfix/<a href="master.5.html">master.cf</a>:
!     mysmtp ... smtp -o <a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a>=foo.bar.com
  </pre>
+ </blockquote>
  
***************
*** 8563,8586 ****
  
! <DT><b><a name="relay_transport">relay_transport</a>
! (default: relay)</b></DT><DD>
! 
! <p>
! The default mail delivery transport and next-hop destination for
! remote delivery to domains listed with $<a href="postconf.5.html#relay_domains">relay_domains</a>. In order of
! decreasing precedence, the nexthop destination is taken from
! $<a href="postconf.5.html#relay_transport">relay_transport</a>, $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or
! from the recipient domain. This information can be overruled with
! the <a href="transport.5.html">transport(5)</a> table.
! </p>
! 
! <p>
! Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i>
! is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> destination is optional; its syntax is documented
! in the manual page of the corresponding delivery agent.
! </p>
  
  <p>
! See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
! file.
  </p>
--- 7893,7900 ----
  
! <DT><b><a name="smtp_helo_timeout">smtp_helo_timeout</a>
! (default: 300s)</b></DT><DD>
  
  <p>
! The SMTP client time limit for sending the HELO or EHLO command,
! and for receiving the initial server response.
  </p>
***************
*** 8588,8590 ****
  <p>
! This feature is available in Postfix 2.0 and later.
  </p>
--- 7902,7905 ----
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
***************
*** 8594,8604 ****
  
! <DT><b><a name="relayhost">relayhost</a>
! (default: empty)</b></DT><DD>
  
  <p>
! The next-hop destination of non-local mail; overrides non-local
! domains in recipient addresses. This information is overruled with
! <a href="postconf.5.html#relay_transport">relay_transport</a>, <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>,
! <a href="postconf.5.html#default_transport">default_transport</a>, <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
! and with the <a href="transport.5.html">transport(5)</a> table.
  </p>
--- 7909,7916 ----
  
! <DT><b><a name="smtp_host_lookup">smtp_host_lookup</a>
! (default: dns)</b></DT><DD>
  
  <p>
! What mechanisms when the Postfix SMTP client uses to look up a host's IP
! address.  This parameter is ignored when DNS lookups are disabled.
  </p>
***************
*** 8606,8650 ****
  <p>
! On an intranet, specify the organizational domain name. If your
! internal DNS uses no MX records, specify the name of the intranet
! gateway host instead.
  </p>
  
! <p>
! In the case of SMTP, specify a domain name, hostname, hostname:port,
! [hostname]:port, [hostaddress] or [hostaddress]:port. The form
! [hostname] turns off MX lookups.
! </p>
  
! <p>
! If you're connected via UUCP, see the <a href="UUCP_README.html">UUCP_README</a> file for useful
! information.
! </p>
  
! <p>
! Examples:
! </p>
  
! <pre>
! <a href="postconf.5.html#relayhost">relayhost</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
! <a href="postconf.5.html#relayhost">relayhost</a> = [gateway.example.com]
! <a href="postconf.5.html#relayhost">relayhost</a> = uucphost
! <a href="postconf.5.html#relayhost">relayhost</a> = [an.ip.add.ress]
! </pre>
  
  
! </DD>
  
! <DT><b><a name="relocated_maps">relocated_maps</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional lookup tables with new contact information for users or
! domains that no longer exist.  The table format and lookups are
! documented in <a href="relocated.5.html">relocated(5)</a>.
  </p>
  
  <p>
! If you use this feature, run "<b>postmap /etc/postfix/relocated</b>" to
! build the necessary DBM or DB file after change, then "<b>postfix
! reload</b>" to make the changes visible.
  </p>
--- 7918,7954 ----
  <p>
! Specify one of the following:
  </p>
  
! <dl>
  
! <dt><b>dns</b></dt>
  
! <dd>Hosts can be found in the DNS (preferred).  </dd>
  
! <dt><b>native</b></dt>
! 
! <dd>Use the native naming service only (nsswitch.conf, or equivalent
! mechanism).  </dd>
  
+ <dt><b>dns, native</b></dt>
  
! <dd>Use the native service for hosts not found in the DNS.  </dd>
  
! </dl>
  
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
+ 
+ </DD>
+ 
+ <DT><b><a name="smtp_line_length_limit">smtp_line_length_limit</a>
+ (default: 990)</b></DT><DD>
+ 
  <p>
! The maximal length of message header and body lines that Postfix
! will send via SMTP.  Longer lines are broken by inserting
! "&lt;CR&gt;&lt;LF&gt;&lt;SPACE&gt;". This minimizes the damage to
! MIME formatted mail.
  </p>
***************
*** 8652,8661 ****
  <p>
! Examples:
  </p>
  
- <pre>
- <a href="postconf.5.html#relocated_maps">relocated_maps</a> = dbm:/etc/postfix/relocated
- <a href="postconf.5.html#relocated_maps">relocated_maps</a> = hash:/etc/postfix/relocated
- </pre>
- 
  
--- 7956,7961 ----
  <p>
! By default, the line length is limited to 990 characters, because
! some server implementations cannot receive mail with long lines.
  </p>
  
  
***************
*** 8663,8693 ****
  
! <DT><b><a name="remote_header_rewrite_domain">remote_header_rewrite_domain</a>
! (default: empty)</b></DT><DD>
  
! <p> Don't rewrite message headers from remote clients at all when
! this parameter is empty; otherwise, rewrite message headers and
! append the specified domain name to incomplete addresses.  The
! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> parameter controls what clients Postfix
! considers local. </p>
  
! <p> Examples:  </p>
  
- <p> The safe setting: append "domain.invalid" to incomplete header
- addresses from remote SMTP clients, so that those addresses cannot
- be confused with local addresses. </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> = domain.invalid
! </pre>
! </blockquote>
  
! <p> The default, purist, setting: don't rewrite headers from remote
! clients at all. </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> =
! </pre>
! </blockquote>
  
--- 7963,7989 ----
  
! <DT><b><a name="smtp_mail_timeout">smtp_mail_timeout</a>
! (default: 300s)</b></DT><DD>
  
! <p>
! The SMTP client time limit for sending the MAIL FROM command, and
! for receiving the server response.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_mime_header_checks">smtp_mime_header_checks</a>
! (default: empty)</b></DT><DD>
  
! <p> Restricted mime_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
! client. These tables are searched while mail is being delivered.
! Actions that change the delivery time or destination are not
! available.  </p>
! 
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 8696,8759 ****
  
! <DT><b><a name="require_home_directory">require_home_directory</a>
! (default: no)</b></DT><DD>
  
  <p>
! Require that a <a href="local.8.html">local(8)</a> recipient's home directory exists
! before mail delivery is attempted. By default this test is disabled.
! It can be useful for environments that import home directories to
! the mail server (IMPORTING HOME DIRECTORIES IS NOT RECOMMENDED).
  </p>
  
  
- </DD>
  
! <DT><b><a name="reset_owner_alias">reset_owner_alias</a>
! (default: no)</b></DT><DD>
  
! <p> Reset the <a href="local.8.html">local(8)</a> delivery agent's idea of the owner-alias
! attribute, when delivering mail to a child alias that does not have
! its own owner alias. </p>
  
! <p> This feature is available in Postfix 2.8 and later. With older
! Postfix releases, the behavior is as if this parameter is set to
! "yes". </p>
  
! <p> As documented in <a href="aliases.5.html">aliases(5)</a>, when an alias <i>name</i> has a
! companion alias named owner-<i>name</i>, delivery errors will be
! reported to the owner alias instead of the sender. This configuration
! is recommended for mailing lists. <p>
! 
! <p> A less known property of the owner alias is that it also forces
! the <a href="local.8.html">local(8)</a> delivery agent to write local and remote addresses
! from alias expansion to a new queue file, instead of attempting to
! deliver mail to local addresses as soon as they come out of alias
! expansion.  </p>
! 
! <p> Writing local addresses from alias expansion to a new queue
! file allows for robust handling of temporary delivery errors: errors
! with one local member have no effect on deliveries to other members
! of the list.  On the other hand, delivery to local addresses as
! soon as they come out of alias expansion is fragile: a temporary
! error with one local address from alias expansion will cause the
! entire alias to be expanded repeatedly until the error goes away,
! or until the message expires in the queue.  In that case, a problem
! with one list member results in multiple message deliveries to other
! list members. </p>
! 
! <p> The default behavior of Postfix 2.8 and later is to keep the
! owner-alias attribute of the parent alias, when delivering mail to
! a child alias that does not have its own owner alias. Then, local
! addresses from that child alias will be written to a new queue file,
! and a temporary error with one local address will not affect delivery
! to other mailing list members. </p>
! 
! <p> Unfortunately, older Postfix releases reset the owner-alias
! attribute when delivering mail to a child alias that does not have
! its own owner alias.  The <a href="local.8.html">local(8)</a> delivery agent then attempts to
! deliver local addresses as soon as they come out of child alias
! expansion.  If delivery to any address from child alias expansion
! fails with a temporary error condition, the entire mailing list may
! be expanded repeatedly until the mail expires in the queue, resulting
! in multiple deliveries of the same message to mailing list members.
! </p>
  
--- 7992,8019 ----
  
! <DT><b><a name="smtp_mx_address_limit">smtp_mx_address_limit</a>
! (default: 5)</b></DT><DD>
  
  <p>
! The maximal number of MX (mail exchanger) IP addresses that can
! result from mail exchanger lookups, or zero (no limit). Prior to
! Postfix version 2.3, this limit was disabled by default.
  </p>
  
+ <p>
+ This feature is available in Postfix 2.1 and later.
+ </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_mx_session_limit">smtp_mx_session_limit</a>
! (default: 2)</b></DT><DD>
  
! <p> The maximal number of SMTP sessions per delivery request before
! giving up or delivering to a fall-back <a href="postconf.5.html#relayhost">relay host</a>, or zero (no
! limit). This restriction ignores sessions that fail to complete the
! SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to
! complete the EHLO and TLS handshake (Postfix version 2.3 and later).  </p>
  
! <p> This feature is available in Postfix 2.1 and later.  </p>
  
***************
*** 8762,8780 ****
  
! <DT><b><a name="resolve_dequoted_address">resolve_dequoted_address</a>
! (default: yes)</b></DT><DD>
! 
! <p> Resolve a recipient address safely instead of correctly, by
! looking inside quotes.  </p>
  
! <p> By default, the Postfix address resolver does not quote the
! address localpart as per <a href="http://tools.ietf.org/html/rfc822">RFC 822</a>, so that additional @ or % or !
! operators remain visible. This behavior is safe but it is also
! technically incorrect.  </p>
  
! <p> If you specify "<a href="postconf.5.html#resolve_dequoted_address">resolve_dequoted_address</a> = no", then
! the Postfix
! resolver will not know about additional @ etc. operators in the
! address localpart. This opens opportunities for obscure mail relay
! attacks with user@domain@domain addresses when Postfix provides
! backup MX service for Sendmail systems.  </p>
  
--- 8022,8032 ----
  
! <DT><b><a name="smtp_nested_header_checks">smtp_nested_header_checks</a>
! (default: empty)</b></DT><DD>
  
! <p> Restricted nested_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
! client. These tables are searched while mail is being delivered.
! Actions that change the delivery time or destination are not
! available.  </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 8783,8798 ****
  
! <DT><b><a name="resolve_null_domain">resolve_null_domain</a>
  (default: no)</b></DT><DD>
  
! <p> Resolve an address that ends in the "@" null domain as if the
! local hostname were specified, instead of rejecting the address as
! invalid.  </p>
  
- <p> This feature is available in Postfix 2.1 and later.
- Earlier versions always resolve the null domain as the local
- hostname.  </p>
  
! <p> The Postfix SMTP server uses this feature to reject mail from
! or to addresses that end in the "@" null domain, and from addresses
! that rewrite into a form that ends in the "@" null domain.  </p>
  
--- 8035,8058 ----
  
! <DT><b><a name="smtp_never_send_ehlo">smtp_never_send_ehlo</a>
  (default: no)</b></DT><DD>
  
! <p> Never send EHLO at the start of an SMTP session. See also the
! <a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> parameter.  </p>
  
  
! </DD>
! 
! <DT><b><a name="smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a>
! (default: 10s)</b></DT><DD>
! 
! <p>
! How long the Postfix SMTP client pauses before sending
! ".&lt;CR&gt;&lt;LF&gt;" in order to work around the PIX firewall
! "&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;" bug.
! </p>
! 
! <p>
! Choosing a too short time makes this workaround ineffective when
! sending large messages over slow network connections.
! </p>
  
***************
*** 8801,8809 ****
  
! <DT><b><a name="resolve_numeric_domain">resolve_numeric_domain</a>
! (default: no)</b></DT><DD>
  
! <p> Resolve "user@ipaddress" as "user@[ipaddress]", instead of
! rejecting the address as invalid.  </p>
  
! <p> This feature is available in Postfix 2.3 and later.
  
--- 8061,8071 ----
  
! <DT><b><a name="smtp_pix_workaround_maps">smtp_pix_workaround_maps</a>
! (default: empty)</b></DT><DD>
  
! <p> Lookup tables, indexed by the remote SMTP server address, with
! per-destination workarounds for CISCO PIX firewall bugs.  The table
! is not indexed by hostname for consistency with
! <a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>. </p>
  
! <p> This feature is available in Postfix 2.4 and later. </p>
  
***************
*** 8812,8820 ****
  
! <DT><b><a name="rewrite_service_name">rewrite_service_name</a>
! (default: rewrite)</b></DT><DD>
  
  <p>
! The name of the address rewriting service. This service rewrites
! addresses to standard form and resolves them to a (delivery method,
! next-hop host, recipient) triple.
  </p>
--- 8074,8087 ----
  
! <DT><b><a name="smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a>
! (default: 500s)</b></DT><DD>
! 
! <p> How long a message must be queued before the Postfix SMTP client
! turns on the PIX firewall "&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;"
! bug workaround for delivery through firewalls with "smtp fixup"
! mode turned on.  </p>
  
  <p>
! By default, the workaround is turned off for mail that is queued
! for less than 500 seconds. In other words, the workaround is normally
! turned off for the first delivery attempt.
  </p>
***************
*** 8822,8824 ****
  <p>
! This feature is available in Postfix 2.0 and later.
  </p>
--- 8089,8093 ----
  <p>
! Specify 0 to enable the PIX firewall
! "&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;" bug workaround upon the
! first delivery attempt.
  </p>
***************
*** 8828,8855 ****
  
! <DT><b><a name="sample_directory">sample_directory</a>
! (default: /etc/postfix)</b></DT><DD>
! 
! <p>
! The name of the directory with example Postfix configuration files.
! Starting with Postfix 2.1, these files have been replaced with the
! <a href="postconf.5.html">postconf(5)</a> manual page.
! </p>
  
  
! </DD>
  
! <DT><b><a name="send_cyrus_sasl_authzid">send_cyrus_sasl_authzid</a>
! (default: no)</b></DT><DD>
  
! <p> When authenticating to a remote SMTP or LMTP server with the
! default setting "no", send no SASL authoriZation ID (authzid); send
! only the SASL authentiCation ID (authcid) plus the authcid's password.
! </p>
  
! <p> The non-default setting "yes" enables the behavior of older
! Postfix versions.  These always send a SASL authzid that is equal
! to the SASL authcid, but this causes inter-operability problems
! with some SMTP servers. </p>
  
! <p> This feature is available in Postfix 2.4.4 and later. </p>
  
--- 8097,8122 ----
  
! <DT><b><a name="smtp_pix_workarounds">smtp_pix_workarounds</a>
! (default: disable_esmtp, delay_dotcrlf)</b></DT><DD>
  
+ <p> A list that specifies zero or more workarounds for CISCO PIX
+ firewall bugs. These workarounds are implemented by the Postfix
+ SMTP client. Workaround names are separated by comma or space, and
+ are case insensitive.  This parameter setting can be overruled with
+ per-destination <a href="postconf.5.html#smtp_pix_workaround_maps">smtp_pix_workaround_maps</a> settings. </p>
  
! <dl>
  
! <dt><b>delay_dotcrlf</b><dd> Insert a delay before sending
! ".&lt;CR&gt;&lt;LF&gt;" after the end of the message content.  The
! delay is subject to the <a href="postconf.5.html#smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a> and
! <a href="postconf.5.html#smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a> parameter settings. </dd>
  
! <dt><b>disable_esmtp</b><dd> Disable all extended SMTP commands:
! send HELO instead of EHLO. </dd>
  
! </dl>
  
! <p> This feature is available in Postfix 2.4 and later. The default
! settings are backwards compatible with earlier Postfix versions.
! </p>
  
***************
*** 8858,8865 ****
  
! <DT><b><a name="sender_based_routing">sender_based_routing</a>
! (default: no)</b></DT><DD>
  
  <p>
! This parameter should not be used. It was replaced by <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
! in Postfix version 2.3.
  </p>
--- 8125,8137 ----
  
! <DT><b><a name="smtp_quit_timeout">smtp_quit_timeout</a>
! (default: 300s)</b></DT><DD>
  
  <p>
! The SMTP client time limit for sending the QUIT command, and for
! receiving the server response.
! </p>
! 
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
***************
*** 8869,8879 ****
  
! <DT><b><a name="sender_bcc_maps">sender_bcc_maps</a>
! (default: empty)</b></DT><DD>
! 
! <p> Optional BCC (blind carbon-copy) address lookup tables, indexed
! by sender address.  The BCC address (multiple results are not
! supported) is added when mail enters from outside of Postfix.  </p>
  
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
--- 8141,8149 ----
  
! <DT><b><a name="smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>
! (default: yes)</b></DT><DD>
  
  <p>
! Quote addresses in SMTP MAIL FROM and RCPT TO commands as required
! by <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. This includes putting quotes around an address localpart
! that ends in ".".
  </p>
***************
*** 8881,8926 ****
  <p>
! The table search order is as follows:
  </p>
  
! <ul>
  
! <li> Look up the "user+extension@domain.tld" address including the
! optional address extension.
! 
! <li> Look up the "user@domain.tld" address without the optional
! address extension.
  
! <li> Look up the "user+extension" address local part when the
! sender domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
  
- <li> Look up the "user" address local part when the sender domain
- equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
  
! <li> Look up the "@domain.tld" part.
  
! </ul>
  
  <p>
! Specify the types and names of databases to use.  After change,
! run "<b>postmap /etc/postfix/sender_bcc</b>".
  </p>
  
- <p>
- Note: if mail to the BCC address bounces it will be returned to
- the sender.
- </p>
  
! <p> Note: automatic BCC recipients are produced only for new mail.
! To avoid mailer loops, automatic BCC recipients are not generated
! after Postfix forwards mail internally, or after Postfix generates
! mail itself. </p>
  
  <p>
! Example:
  </p>
  
! <pre>
! <a href="postconf.5.html#sender_bcc_maps">sender_bcc_maps</a> = hash:/etc/postfix/sender_bcc
! </pre>
  
--- 8151,8198 ----
  <p>
! The default is to comply with <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. If you have to send mail to
! a broken SMTP server, configure a special SMTP client in <a href="master.5.html">master.cf</a>:
  </p>
  
! <blockquote>
! <pre>
! /etc/postfix/<a href="master.5.html">master.cf</a>:
!     broken-smtp . . . smtp -o <a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>=no
! </pre>
! </blockquote>
  
! <p>
! and route mail for the destination in question to the "broken-smtp"
! message delivery with a <a href="transport.5.html">transport(5)</a> table.
! </p>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_randomize_addresses">smtp_randomize_addresses</a>
! (default: yes)</b></DT><DD>
  
  <p>
! Randomize the order of equal-preference MX host addresses.  This
! is a performance feature of the Postfix SMTP client.
  </p>
  
  
! </DD>
! 
! <DT><b><a name="smtp_rcpt_timeout">smtp_rcpt_timeout</a>
! (default: 300s)</b></DT><DD>
  
  <p>
! The SMTP client time limit for sending the SMTP RCPT TO command, and
! for receiving the server response.
  </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
***************
*** 8929,8941 ****
  
! <DT><b><a name="sender_canonical_classes">sender_canonical_classes</a>
! (default: envelope_sender, header_sender)</b></DT><DD>
! 
! <p> What addresses are subject to <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address
! mapping.  By default, <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address mapping is
! applied to envelope sender addresses, and to header sender addresses.
! </p>
  
! <p> Specify one or more of: envelope_sender, header_sender </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
--- 8201,8211 ----
  
! <DT><b><a name="smtp_rset_timeout">smtp_rset_timeout</a>
! (default: 20s)</b></DT><DD>
  
! <p> The SMTP client time limit for sending the RSET command, and
! for receiving the server response. The SMTP client sends RSET in
! order to finish a recipient address probe, or to verify that a
! cached session is still usable.  </p>
  
! <p> This feature is available in Postfix 2.1 and later.  </p>
  
***************
*** 8944,8972 ****
  
! <DT><b><a name="sender_canonical_maps">sender_canonical_maps</a>
  (default: empty)</b></DT><DD>
  
! <p>
! Optional address mapping lookup tables for envelope and header
! sender addresses.
! The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
! </p>
  
! <p>
! Example: you want to rewrite the SENDER address "user@ugly.domain"
! to "user@pretty.domain", while still being able to send mail to
! the RECIPIENT address "user@ugly.domain".
  </p>
  
! <p>
! Note: $<a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
! </p>
  
! <p>
! Example:
  </p>
  
  <pre>
! <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> = hash:/etc/postfix/sender_canonical
  </pre>
  
  
--- 8214,8253 ----
  
! <DT><b><a name="smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
  (default: empty)</b></DT><DD>
  
! <p> An optional table to prevent repeated SASL authentication
! failures with the same remote SMTP server hostname, username and
! password. Each table (key, value) pair contains a server name, a
! username and password, and the full server response. This information
! is stored when a remote SMTP server rejects an authentication attempt
! with a 535 reply code.  As long as the <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a>
! information does no change, and as long as the <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
! information does not expire (see <a href="postconf.5.html#smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>) the
! Postfix SMTP client avoids SASL authentication attempts with the
! same server, username and password, and instead bounces or defers
! mail as controlled with the <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> configuration
! parameter.  </p>
  
! <p> Use a per-destination delivery concurrency of 1 (for example,
! "<a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> = 1",
! "<a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> = 1", etc.), otherwise multiple
! delivery agents may experience a login failure at the same time.
  </p>
  
! <p> The table must be accessed via the proxywrite service, i.e. the
! map name must start with "<a href="proxymap.8.html">proxy</a>:". The table should be stored under
! the directory specified with the <a href="postconf.5.html#data_directory">data_directory</a> parameter. </p>
  
! <p> This feature uses cryptographic hashing to protect plain-text
! passwords, and requires that Postfix is compiled with TLS support.
  </p>
  
+ <p> Example: </p>
+ 
  <pre>
! <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> = <a href="proxymap.8.html">proxy</a>:btree:/var/lib/postfix/sasl_auth_cache
  </pre>
  
+ <p> This feature is available in Postfix 2.5 and later. </p>
+ 
  
***************
*** 8974,8994 ****
  
! <DT><b><a name="sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>
! (default: empty)</b></DT><DD>
! 
! <p> A sender-dependent override for the global <a href="postconf.5.html#default_transport">default_transport</a>
! parameter setting. The tables are searched by the envelope sender
! address and @domain. A lookup result of DUNNO terminates the search
! without overriding the global <a href="postconf.5.html#default_transport">default_transport</a> parameter setting.
! This information is overruled with the <a href="transport.5.html">transport(5)</a> table. </p>
! 
! <p> Note: this overrides <a href="postconf.5.html#default_transport">default_transport</a>, not <a href="postconf.5.html#transport_maps">transport_maps</a>, and
! therefore the expected syntax is that of <a href="postconf.5.html#default_transport">default_transport</a>, not the
! syntax of <a href="postconf.5.html#transport_maps">transport_maps</a>.  Specifically, this does not support the
! <a href="postconf.5.html#transport_maps">transport_maps</a> syntax for null transport, null nexthop, or null
! email addresses. </p>
  
! <p> For safety reasons, this feature does not allow $number
! substitutions in regular expression maps. </p>
  
! <p> This feature is available in Postfix 2.7 and later.  </p>
  
--- 8255,8263 ----
  
! <DT><b><a name="smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>
! (default: 90d)</b></DT><DD>
  
! <p> The maximal age of an <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> entry before it
! is removed. </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 8997,9016 ****
  
! <DT><b><a name="sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
! (default: empty)</b></DT><DD>
! 
! <p> A sender-dependent override for the global <a href="postconf.5.html#relayhost">relayhost</a> parameter
! setting. The tables are searched by the envelope sender address and
! @domain. A lookup result of DUNNO terminates the search without
! overriding the global <a href="postconf.5.html#relayhost">relayhost</a> parameter setting (Postfix 2.6 and
! later). This information is overruled with <a href="postconf.5.html#relay_transport">relay_transport</a>,
! <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>, <a href="postconf.5.html#default_transport">default_transport</a> and with
! the <a href="transport.5.html">transport(5)</a> table. </p>
  
! <p> For safety reasons, this feature does not allow $number
! substitutions in regular expression maps. </p>
  
  <p>
! This feature is available in Postfix 2.3 and later.
  </p>
  
  
--- 8266,8283 ----
  
! <DT><b><a name="smtp_sasl_auth_enable">smtp_sasl_auth_enable</a>
! (default: no)</b></DT><DD>
  
! <p>
! Enable SASL authentication in the Postfix SMTP client.  By default,
! the Postfix SMTP client uses no authentication.
! </p>
  
  <p>
! Example:
  </p>
  
+ <pre>
+ <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes
+ </pre>
+ 
  
***************
*** 9018,9044 ****
  
! <DT><b><a name="sendmail_fix_line_endings">sendmail_fix_line_endings</a>
! (default: always)</b></DT><DD>
! 
! <p> Controls how the Postfix sendmail command converts email message
! line endings from &lt;CR&gt;&lt;LF&gt; into UNIX format (&lt;LF&gt;).
! </p>
  
! <dl>
  
! <dt> <b>always</b> </dt> <dd> Always convert message lines ending
! in &lt;CR&gt;&lt;LF&gt;. This setting is the default with Postfix
! 2.9 and later. </dd>
! 
! <dt> <b>strict</b> </dt> <dd> Convert message lines ending in
! &lt;CR&gt;&lt;LF&gt; only if the first input line ends in
! &lt;CR&gt;&lt;LF&gt;. This setting is backwards-compatible with
! Postfix 2.8 and earlier. </dd>
  
! <dt> <b>never</b> </dt> <dd> Never convert message lines ending in
! &lt;CR&gt;&lt;LF&gt;. This setting exists for completeness only.
! </dd>
  
! </dl>
  
! <p> This feature is available in Postfix 2.9 and later. </p>
  
--- 8285,8307 ----
  
! <DT><b><a name="smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a>
! (default: yes)</b></DT><DD>
  
! <p> When a remote SMTP server rejects a SASL authentication request
! with a 535 reply code, defer mail delivery instead of returning
! mail as undeliverable. The latter behavior was hard-coded prior to
! Postfix version 2.5. </p>
  
! <p> Note: the setting "yes" overrides the global <a href="postconf.5.html#soft_bounce">soft_bounce</a>
! parameter, but the setting "no" does not. </p>
  
! <p> Example: </p>
  
! <pre>
! # Default as of Postfix 2.5
! <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = yes
! # The old hard-coded default
! <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = no
! </pre>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 9047,9057 ****
  
! <DT><b><a name="sendmail_path">sendmail_path</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
  <p>
! A Sendmail compatibility feature that specifies the location of
! the Postfix <a href="sendmail.1.html">sendmail(1)</a> command. This command can be used to
! submit mail into the Postfix queue.
  </p>
  
  
--- 8310,8340 ----
  
! <DT><b><a name="smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a>
! (default: empty)</b></DT><DD>
  
  <p>
! If non-empty, a Postfix SMTP client filter for the remote SMTP
! server's list of offered SASL mechanisms.  Different client and
! server implementations may support different mechanism lists. By
! default, the Postfix SMTP client will use the intersection of the
! two. <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> further restricts what server
! mechanisms the client will take into consideration.  </p>
! 
! <p> Specify mechanism names, "/file/name" patterns or "<a href="DATABASE_README.html">type:table</a>"
! lookup tables. The right-hand side result from "<a href="DATABASE_README.html">type:table</a>" lookups
! is ignored. Specify "!pattern" to exclude a mechanism name from the
! list. The form "!/file/name" is supported only in Postfix version
! 2.4 and later. </p>
! 
! <p> This feature is available in Postfix 2.2 and later. </p>
! 
! <p>
! Examples:
  </p>
  
+ <pre>
+ <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = plain, login
+ <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = /etc/postfix/smtp_mechs
+ <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = !gssapi, !login, static:rest
+ </pre>
+ 
  
***************
*** 9059,9066 ****
  
! <DT><b><a name="service_throttle_time">service_throttle_time</a>
! (default: 60s)</b></DT><DD>
  
  <p>
! How long the Postfix <a href="master.8.html">master(8)</a> waits before forking a server that
! appears to be malfunctioning.
  </p>
--- 8342,8352 ----
  
! <DT><b><a name="smtp_sasl_password_maps">smtp_sasl_password_maps</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional SMTP client lookup tables with one username:password entry
! per remote hostname or domain, or sender address when sender-dependent
! authentication is enabled.  If no username:password entry is found,
! then the Postfix SMTP client will not
! attempt to authenticate to the remote host.
  </p>
***************
*** 9068,9071 ****
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
--- 8354,8357 ----
  <p>
! The Postfix SMTP client opens the lookup table before going to
! chroot jail, so you can leave the password file in /etc/postfix.
  </p>
***************
*** 9075,9085 ****
  
! <DT><b><a name="setgid_group">setgid_group</a>
! (default: postdrop)</b></DT><DD>
  
! <p>
! The group ownership of set-gid Postfix commands and of group-writable
! Postfix directories. When this parameter value is changed you need
! to re-run "<b>postfix set-permissions</b>" (with Postfix version 2.0 and
! earlier: "<b>/etc/postfix/post-install set-permissions</b>".
! </p>
  
--- 8361,8372 ----
  
! <DT><b><a name="smtp_sasl_path">smtp_sasl_path</a>
! (default: empty)</b></DT><DD>
  
! <p> Implementation-specific information that the Postfix SMTP client
! passes through to
! the SASL plug-in implementation that is selected with
! <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>.  Typically this specifies the name of a
! configuration file or rendezvous point. </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 9088,9147 ****
  
! <DT><b><a name="show_user_unknown_table_name">show_user_unknown_table_name</a>
! (default: yes)</b></DT><DD>
  
! <p>
! Display the name of the recipient table in the "User unknown"
! responses.  The extra detail makes trouble shooting easier but also
! reveals information that is nobody elses business.
! </p>
  
  <p>
! This feature is available in Postfix 2.0 and later.
  </p>
  
  
! </DD>
! 
! <DT><b><a name="showq_service_name">showq_service_name</a>
! (default: showq)</b></DT><DD>
  
! <p>
! The name of the <a href="showq.8.html">showq(8)</a> service. This service produces mail queue
! status reports.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_address_preference">smtp_address_preference</a>
! (default: any)</b></DT><DD>
  
! <p> The address type ("ipv6", "ipv4" or "any") that the Postfix
! SMTP client will try first, when a destination has IPv6 and IPv4
! addresses with equal MX preference. This feature has no effect
! unless the <a href="postconf.5.html#inet_protocols">inet_protocols</a> setting enables both IPv4 and IPv6.
! With Postfix 2.8 the default is "ipv6".  </p>
  
! <p> This feature is available in Postfix 2.8 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_always_send_ehlo">smtp_always_send_ehlo</a>
! (default: yes)</b></DT><DD>
  
  <p>
! Always send EHLO at the start of an SMTP session.
  </p>
  
! <p>
! With "<a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> = no", the Postfix SMTP client sends
! EHLO only when
! the word "ESMTP" appears in the server greeting banner (example:
! 220 spike.porcupine.org ESMTP Postfix).
! </p>
  
--- 8375,8424 ----
  
! <DT><b><a name="smtp_sasl_security_options">smtp_sasl_security_options</a>
! (default: noplaintext, noanonymous)</b></DT><DD>
  
! <p> Postfix SMTP client SASL security options; as of Postfix 2.3
! the list of available
! features depends on the SASL client implementation that is selected
! with <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>.  </p>
! 
! <p> The following security features are defined for the <b>cyrus</b>
! client SASL implementation: </p>
  
  <p>
! Specify zero or more of the following:
  </p>
  
+ <dl>
  
! <dt><b>noplaintext</b></dt>
  
! <dd>Disallow methods that use plaintext passwords. </dd>
  
! <dt><b>noactive</b></dt>
  
+ <dd>Disallow methods subject to active (non-dictionary) attack.
+ </dd>
  
! <dt><b>nodictionary</b></dt>
  
! <dd>Disallow methods subject to passive (dictionary) attack. </dd>
  
! <dt><b>noanonymous</b></dt>
  
! <dd>Disallow methods that allow anonymous authentication. </dd>
  
+ <dt><b>mutual_auth</b></dt>
  
! <dd>Only allow methods that provide mutual authentication (not
! available with SASL version 1). </dd>
  
! </dl>
  
  <p>
! Example:
  </p>
  
! <pre>
! <a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a> = noplaintext
! </pre>
  
***************
*** 9150,9180 ****
  
! <DT><b><a name="smtp_bind_address">smtp_bind_address</a>
! (default: empty)</b></DT><DD>
! 
! <p>
! An optional numerical network address that the Postfix SMTP client
! should bind to when making an IPv4 connection.
! </p>
! 
! <p>
! This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
! it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
! for example:
! </p>
! 
! <blockquote>
! <pre>
! /etc/postfix/<a href="master.5.html">master.cf</a>:
!     smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>=11.22.33.44
! </pre>
! </blockquote>
  
! <p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv4
! address, and that address is a non-loopback address, it is
! automatically used as the <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>.  This supports virtual
! IP hosting, but can be a problem on multi-homed firewalls. See the
! <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
  
! <p> Note 2: address information may be enclosed inside <tt>[]</tt>,
! but this form is not required here. </p>
  
--- 8427,8435 ----
  
! <DT><b><a name="smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>
! (default: $<a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a>)</b></DT><DD>
  
! <p> The SASL authentication security options that the Postfix SMTP
! client uses for TLS encrypted SMTP sessions. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 9183,9215 ****
  
! <DT><b><a name="smtp_bind_address6">smtp_bind_address6</a>
! (default: empty)</b></DT><DD>
  
! <p>
! An optional numerical network address that the Postfix SMTP client
! should bind to when making an IPv6 connection.
! </p>
  
- <p> This feature is available in Postfix 2.2 and later. </p>
  
! <p>
! This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
! it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
! for example:
! </p>
  
! <blockquote>
! <pre>
! /etc/postfix/<a href="master.5.html">master.cf</a>:
!     smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>=1:2:3:4:5:6:7:8
! </pre>
! </blockquote>
  
! <p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv6
! address, and that address is a non-loopback address, it is
! automatically used as the <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>.  This supports virtual
! IP hosting, but can be a problem on multi-homed firewalls. See the
! <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
  
! <p> Note 2: address information may be enclosed inside <tt>[]</tt>,
! but this form is not recommended here. </p>
  
--- 8438,8458 ----
  
! <DT><b><a name="smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a>
! (default: $<a href="postconf.5.html#smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>)</b></DT><DD>
  
! <p> The SASL authentication security options that the Postfix SMTP
! client uses for TLS encrypted SMTP sessions with a verified server
! certificate. This feature is under construction as of Postfix version
! 2.3. </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_sasl_type">smtp_sasl_type</a>
! (default: cyrus)</b></DT><DD>
  
! <p> The SASL plug-in type that the Postfix SMTP client should use
! for authentication.  The available types are listed with the
! "<b>postconf -A</b>" command. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 9218,9228 ****
  
! <DT><b><a name="smtp_body_checks">smtp_body_checks</a>
! (default: empty)</b></DT><DD>
  
! <p> Restricted <a href="header_checks.5.html">body_checks(5)</a> tables for the Postfix SMTP client.
! These tables are searched while mail is being delivered.  Actions
! that change the delivery time or destination are not available.
  </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
--- 8461,8481 ----
  
! <DT><b><a name="smtp_send_xforward_command">smtp_send_xforward_command</a>
! (default: no)</b></DT><DD>
  
! <p>
! Send the non-standard XFORWARD command when the Postfix SMTP server
! EHLO response announces XFORWARD support.
  </p>
  
! <p>
! This allows an "smtp" delivery agent, used for injecting mail into
! a content filter, to forward the name, address, protocol and HELO
! name of the original client to the content filter and downstream
! queuing SMTP server. This can produce more useful logging than
! localhost[127.0.0.1] etc.
! </p>
! 
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
***************
*** 9231,9244 ****
  
! <DT><b><a name="smtp_cname_overrides_servername">smtp_cname_overrides_servername</a>
! (default: version dependent)</b></DT><DD>
  
! <p> Allow DNS CNAME records to override the servername that the
! Postfix SMTP client uses for logging, SASL password lookup, TLS
! policy decisions, or TLS certificate verification. The value "no"
! hardens Postfix <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> hostname-based policies against
! false hostname information in DNS CNAME records, and makes SASL
! password file lookups more predictable. This is the default setting
! as of Postfix 2.3. </p>
  
! <p> This feature is available in Postfix 2.2.9 and later. </p>
  
--- 8484,8497 ----
  
! <DT><b><a name="smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a>
! (default: no)</b></DT><DD>
  
! <p>
! Enable sender-dependent authentication in the Postfix SMTP client; this is
! available only with SASL authentication, and disables SMTP connection
! caching to ensure that mail from different senders will use the
! appropriate credentials.  </p>
  
! <p>
! This feature is available in Postfix 2.3 and later.
! </p>
  
***************
*** 9247,9254 ****
  
! <DT><b><a name="smtp_connect_timeout">smtp_connect_timeout</a>
! (default: 30s)</b></DT><DD>
  
  <p>
! The Postfix SMTP client time limit for completing a TCP connection, or
! zero (use the operating system built-in time limit).
  </p>
--- 8500,8507 ----
  
! <DT><b><a name="smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a>
! (default: yes)</b></DT><DD>
  
  <p>
! Skip SMTP servers that greet with a 4XX status code (go away, try
! again later).
  </p>
***************
*** 9256,9268 ****
  <p>
! When no connection can be made within the deadline, the Postfix
! SMTP client
! tries the next address on the mail exchanger list. Specify 0 to
! disable the time limit (i.e. use whatever timeout is implemented by
! the operating system).
  </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
--- 8509,8518 ----
  <p>
! By default, Postfix moves on the next mail exchanger. Specify
! "<a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> = no" if Postfix should defer delivery
! immediately.
  </p>
  
! <p> This feature is available in Postfix 2.0 and earlier.
! Later Postfix versions always skip SMTP servers that greet with a
! 4XX status code. </p>
  
***************
*** 9271,9308 ****
  
! <DT><b><a name="smtp_connection_cache_destinations">smtp_connection_cache_destinations</a>
! (default: empty)</b></DT><DD>
  
! <p> Permanently enable SMTP connection caching for the specified
! destinations.  With SMTP connection caching, a connection is not
! closed immediately after completion of a mail transaction.  Instead,
! the connection is kept open for up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
! seconds.  This allows connections to be reused for other deliveries,
! and can improve mail delivery performance. </p>
  
! <p> Specify a comma or white space separated list of destinations
! or pseudo-destinations: </p>
  
- <ul>
  
! <li> if mail is sent without a <a href="postconf.5.html#relayhost">relay host</a>: a domain name (the
! right-hand side of an email address, without the [] around a numeric
! IP address),
  
! <li> if mail is sent via a <a href="postconf.5.html#relayhost">relay host</a>: a <a href="postconf.5.html#relayhost">relay host</a> name (without
! [] or non-default TCP port), as specified in <a href="postconf.5.html">main.cf</a> or in the
! transport map,
  
! <li> if mail is sent via a UNIX-domain socket: a pathname (without
! the unix: prefix),
  
- <li> a /file/name with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names as
- defined above,
  
! <li> a "<a href="DATABASE_README.html">type:table</a>" with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names on
! the left-hand side.  The right-hand side result from "<a href="DATABASE_README.html">type:table</a>"
! lookups is ignored.
  
! </ul>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
--- 8521,8555 ----
  
! <DT><b><a name="smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a>
! (default: yes)</b></DT><DD>
  
! <p>
! Skip SMTP servers that greet with a 5XX status code (go away, do
! not try again later).
! </p>
  
! <p> By default, the Postfix SMTP client moves on the next mail
! exchanger. Specify "<a href="postconf.5.html#smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a> = no" if Postfix should
! bounce the mail immediately. The default setting is incorrect, but
! it is what a lot of people expect to happen.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_skip_quit_response">smtp_skip_quit_response</a>
! (default: yes)</b></DT><DD>
  
! <p>
! Do not wait for the response to the SMTP QUIT command.
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_starttls_timeout">smtp_starttls_timeout</a>
! (default: 300s)</b></DT><DD>
  
! <p> Time limit for Postfix SMTP client write and read operations
! during TLS startup and shutdown handshake procedures. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 9311,9350 ****
  
! <DT><b><a name="smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a>
! (default: yes)</b></DT><DD>
  
! <p> Temporarily enable SMTP connection caching while a destination
! has a high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>.  With SMTP connection
! caching, a connection is not closed immediately after completion
! of a mail transaction.  Instead, the connection is kept open for
! up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a> seconds.  This allows
! connections to be reused for other deliveries, and can improve mail
! delivery performance. </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
  
! </DD>
  
- <DT><b><a name="smtp_connection_cache_reuse_limit">smtp_connection_cache_reuse_limit</a>
- (default: 10)</b></DT><DD>
  
! <p> When SMTP connection caching is enabled, the number of times that
! an SMTP session may be reused before it is closed.
! </p>
  
! <p> This feature is available in Postfix 2.2. In Postfix 2.3 it is
! replaced by $<a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>.</p>
  
  
! </DD>
  
! <DT><b><a name="smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
! (default: 2s)</b></DT><DD>
  
! <p> When SMTP connection caching is enabled, the amount of time that
! an unused SMTP client socket is kept open before it is closed.  Do
! not specify larger values without permission from the remote sites.
! </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
--- 8558,8597 ----
  
! <DT><b><a name="smtp_tls_CAfile">smtp_tls_CAfile</a>
! (default: empty)</b></DT><DD>
  
! <p> The file with the certificate of the certification authority
! (CA) that issued the Postfix SMTP client certificate.  This is
! needed only when the CA certificate is not already present in the
! client certificate file.  </p>
  
! <p> Example: </p>
  
+ <pre>
+ <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> = /etc/postfix/CAcert.pem
+ </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_tls_CApath">smtp_tls_CApath</a>
! (default: empty)</b></DT><DD>
  
+ <p> Directory with PEM format certificate authority certificates
+ that the Postfix SMTP client uses to verify a remote SMTP server
+ certificate.  Don't forget to create the necessary "hash" links
+ with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
+ </p>
  
! <p> To use this option in chroot mode, this directory (or a copy)
! must be inside the chroot jail. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> = /etc/postfix/certs
! </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 9353,9423 ****
  
! <DT><b><a name="smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>
! (default: 300s)</b></DT><DD>
  
! <p> The amount of time during which Postfix will use an SMTP
! connection repeatedly.  The timer starts when the connection is
! initiated (i.e. it includes the connect, greeting and helo latency,
! in addition to the latencies of subsequent mail delivery transactions).
! </p>
  
! <p> This feature addresses a performance stability problem with
! remote SMTP servers. This problem is not specific to Postfix: it
! can happen when any MTA sends large amounts of SMTP email to a site
! that has multiple MX hosts. </p>
  
! <p> The problem starts when one of a set of MX hosts becomes slower
! than the rest.  Even though SMTP clients connect to fast and slow
! MX hosts with equal probability, the slow MX host ends up with more
! simultaneous inbound connections than the faster MX hosts, because
! the slow MX host needs more time to serve each client request. </p>
! 
! <p> The slow MX host becomes a connection attractor.  If one MX
! host becomes N times slower than the rest, it dominates mail delivery
! latency unless there are more than N fast MX hosts to counter the
! effect. And if the number of MX hosts is smaller than N, the mail
! delivery latency becomes effectively that of the slowest MX host
! divided by the total number of MX hosts. </p>
! 
! <p> The solution uses connection caching in a way that differs from
! Postfix version 2.2.  By limiting the amount of time during which a connection
! can be used repeatedly (instead of limiting the number of deliveries
! over that connection), Postfix not only restores fairness in the
! distribution of simultaneous connections across a set of MX hosts,
! it also favors deliveries over connections that perform well, which
! is exactly what we want.  </p>
  
! <p> The default reuse time limit, 300s, is comparable to the various
! smtp transaction timeouts which are fair estimates of maximum excess
! latency for a slow delivery.  Note that hosts may accept thousands
! of messages over a single connection within the default connection
! reuse time limit. This number is much larger than the default Postfix
! version 2.2 limit of 10 messages per cached connection. It may prove necessary
! to lower the limit to avoid interoperability issues with MTAs that
! exhibit bugs when many messages are delivered via a single connection.
! A lower reuse time limit risks losing the benefit of connection
! reuse when the average connection and mail delivery latency exceeds
! the reuse time limit.  </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_data_done_timeout">smtp_data_done_timeout</a>
! (default: 600s)</b></DT><DD>
  
! <p>
! The Postfix SMTP client time limit for sending the SMTP ".", and
! for receiving the remote SMTP server response.
! </p>
  
! <p>
! When no response is received within the deadline, a warning is
! logged that the mail may be delivered multiple times.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
--- 8600,8651 ----
  
! <DT><b><a name="smtp_tls_cert_file">smtp_tls_cert_file</a>
! (default: empty)</b></DT><DD>
  
! <p> File with the Postfix SMTP client RSA certificate in PEM format.
! This file may also contain the Postfix SMTP client private RSA key,
! and these may be the same as the Postfix SMTP server RSA certificate and key
! file. </p>
  
! <p> Do not configure client certificates unless you <b>must</b> present
! client TLS certificates to one or more servers. Client certificates are
! not usually needed, and can cause problems in configurations that work
! well without them. The recommended setting is to let the defaults stand: </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> =
! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> =
! <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> =
! <a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a> =
! </pre>
! </blockquote>
  
! <p> The best way to use the default settings is to comment out the above
! parameters in <a href="postconf.5.html">main.cf</a> if present. </p>
  
! <p> In order to verify certificates, the CA certificate (in case
! of a certificate chain, all CA certificates) must be available.
! You should add these certificates to the client certificate, the
! client certificate first, then the issuing CA(s). </p>
  
+ <p> Example: the certificate for "client.dom.ain" was issued by
+ "intermediate CA" which itself has a certificate of "root CA".
+ Create the client.pem file with "cat client_cert.pem intermediate_CA.pem
+ root_CA.pem &gt; client.pem". </p>
  
! <p> If you also want to verify remote SMTP server certificates issued by
! these CAs, you can also add the CA certificates to the <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>,
! in which case it is not necessary to have them in the <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>
! or <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>. </p>
  
! <p> A certificate supplied here must be usable as an SSL client certificate
! and hence pass the "openssl verify -purpose sslclient ..." test. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> = /etc/postfix/client.pem
! </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 9426,9456 ****
  
! <DT><b><a name="smtp_data_init_timeout">smtp_data_init_timeout</a>
! (default: 120s)</b></DT><DD>
! 
! <p>
! The Postfix SMTP client time limit for sending the SMTP DATA command,
! and for receiving the remote SMTP server response.
! </p>
! 
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
! 
! 
! </DD>
  
! <DT><b><a name="smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
! (default: 180s)</b></DT><DD>
  
! <p>
! The Postfix SMTP client time limit for sending the SMTP message content.
! When the connection makes no progress for more than $<a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
! seconds the Postfix SMTP client terminates the transfer.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
--- 8654,8671 ----
  
! <DT><b><a name="smtp_tls_cipherlist">smtp_tls_cipherlist</a>
! (default: empty)</b></DT><DD>
  
! <p> Obsolete Postfix &lt; 2.3 control for the Postfix SMTP client TLS
! cipher list. As this feature applies to all TLS security levels, it is easy
! to create inter-operability problems by choosing a non-default cipher
! list. Do not use a non-default TLS cipher list on hosts that deliver email
! to the public Internet: you will be unable to send email to servers that
! only support the ciphers you exclude. Using a restricted cipher list
! may be more appropriate for an internal MTA, where one can exert some
! control over the TLS software and settings of the peer servers. </p>
  
! <p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
  
! <p> This feature is available in Postfix version 2.2. It is not used with
! Postfix 2.3 and later; use <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> instead. </p>
  
***************
*** 9459,9482 ****
  
! <DT><b><a name="smtp_defer_if_no_mx_address_found">smtp_defer_if_no_mx_address_found</a>
! (default: no)</b></DT><DD>
  
! <p>
! Defer mail delivery when no MX record resolves to an IP address.
! </p>
  
! <p>
! The default (no) is to return the mail as undeliverable. With older
! Postfix versions the default was to keep trying to deliver the mail
! until someone fixed the MX record or until the mail was too old.
  </p>
  
! <p>
! Note: the Postfix SMTP client always ignores MX records with equal
! or worse preference
! than the local MTA itself.
! </p>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
--- 8674,8691 ----
  
! <DT><b><a name="smtp_tls_dcert_file">smtp_tls_dcert_file</a>
! (default: empty)</b></DT><DD>
  
! <p> File with the Postfix SMTP client DSA certificate in PEM format.
! This file may also contain the Postfix SMTP client private DSA key. </p>
  
! <p> See the discussion under <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for more details.
  </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> = /etc/postfix/client-dsa.pem
! </pre>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 9485,9523 ****
  
! <DT><b><a name="smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a>
! (default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
! 
! <p> The maximal number of parallel deliveries to the same destination
! via the smtp message delivery transport. This limit is enforced by
! the queue manager. The message delivery transport name is the first
! field in the entry in the <a href="master.5.html">master.cf</a> file.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_destination_recipient_limit">smtp_destination_recipient_limit</a>
! (default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
  
- <p> The maximal number of recipients per message for the smtp
- message delivery transport. This limit is enforced by the queue
- manager. The message delivery transport name is the first field in
- the entry in the <a href="master.5.html">master.cf</a> file.  </p>
  
! <p> Setting this parameter to a value of 1 changes the meaning of
! <a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> from concurrency per domain
! into concurrency per recipient.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>
! (default: empty)</b></DT><DD>
  
! <p> Lookup tables, indexed by the remote SMTP server address, with
! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
! etc.) that the Postfix SMTP client will ignore in the EHLO response from a
! remote SMTP server. See <a href="postconf.5.html#smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a> for details. The
! table is not indexed by hostname for consistency with
! <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>. </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
--- 8694,8730 ----
  
! <DT><b><a name="smtp_tls_dkey_file">smtp_tls_dkey_file</a>
! (default: $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>)</b></DT><DD>
  
+ <p> File with the Postfix SMTP client DSA private key in PEM format.
+ This file may be combined with the Postfix SMTP client DSA certificate
+ file specified with $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>. </p>
  
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted, but file permissions should grant read/write
! access only to the system superuser account ("root"). </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
+ <DT><b><a name="smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
+ (default: yes)</b></DT><DD>
  
! <p> With mandatory TLS encryption, require that the remote SMTP
! server hostname matches the information in the remote SMTP server
! certificate.  As of <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> the requirements for hostname checking
! for MTA clients are not specified. </p>
  
! <p> This option can be set to "no" to disable strict peer name
! checking. This setting has no effect on sessions that are controlled
! via the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table.  </p>
  
! <p> Disabling the hostname verification can make sense in closed
! environment where special CAs are created.  If not used carefully,
! this option opens the danger of a "man-in-the-middle" attack (the
! CommonName of this attacker will be logged). </p>
  
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
  
***************
*** 9526,9547 ****
  
! <DT><b><a name="smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a>
  (default: empty)</b></DT><DD>
  
! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
! auth, etc.) that the Postfix SMTP client will ignore in the EHLO
! response from a remote SMTP server. </p>
! 
! <p> This feature is available in Postfix 2.2 and later. </p>
! 
! <p> Notes: </p>
  
! <ul>
  
! <li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
! this action from being logged. </p>
  
! <li> <p> Use the <a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a> feature to
! discard EHLO keywords selectively. </p>
  
! </ul>
  
--- 8733,8764 ----
  
! <DT><b><a name="smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
  (default: empty)</b></DT><DD>
  
! <p> List of ciphers or cipher types to exclude from the Postfix
! SMTP client cipher
! list at all TLS security levels. This is not an OpenSSL cipherlist, it is
! a simple list separated by whitespace and/or commas. The elements are a
! single cipher, or one or more "+" separated cipher properties, in which
! case only ciphers matching <b>all</b> the properties are excluded. </p>
  
! <p> Examples (some of these will cause problems): </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = aNULL
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = MD5, DES
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = DES+MD5
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = kEDH+aRSA
! </pre>
! </blockquote>
  
! <p> The first setting, disables anonymous ciphers. The next setting
! disables ciphers that use the MD5 digest algorithm or the (single) DES
! encryption algorithm. The next setting disables ciphers that use MD5 and
! DES together.  The next setting disables the two ciphers "AES256-SHA"
! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
! key exchange with RSA authentication. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 9550,9576 ****
  
! <DT><b><a name="smtp_dns_resolver_options">smtp_dns_resolver_options</a>
  (default: empty)</b></DT><DD>
  
! <p> DNS Resolver options for the Postfix SMTP client.  Specify zero
! or more of the following options, separated by comma or whitespace.
! Option names are case-sensitive. Some options refer to domain names
! that are specified in the file /etc/resolv.conf or equivalent. </p>
  
! <dl>
  
! <dt><b>res_defnames</b></dt>
  
! <dd> Append the current domain name to single-component names (those
! that do not contain a "." character). This can produce incorrect
! results, and is the hard-coded behavior prior to Postfix 2.8. </dd>
  
! <dt><b>res_dnsrch</b></dt>
  
! <dd> Search for host names in the current domain and in parent
! domains. This can produce incorrect results and is therefore not
! recommended. </dd>
  
! </dl>
  
! <p> This feature is available in Postfix 2.8 and later.  </p>
  
--- 8767,8825 ----
  
! <DT><b><a name="smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a>
  (default: empty)</b></DT><DD>
  
! <p> List of acceptable remote SMTP server certificate fingerprints
! for the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> =
! fingerprint). At this security level, certificate authorities are
! not used, and certificate expiration times are ignored. Instead,
! server certificates are verified directly via their "fingerprint". The
! fingerprint is a message digest of the server certificate. The digest
! algorithm is selected via the <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b>
! parameter. </p>
  
! <p> When an <b><a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a></b> table entry specifies the
! "fingerprint" security level, any "match" attributes in that entry specify
! the list of valid fingerprints for the corresponding destination. Multiple
! fingerprints can be combined with a "|" delimiter in a single match
! attribute, or multiple match attributes can be employed. </p>
  
! <p> Example: Certificate fingerprint verification with internal mailhub.
! Two matching fingerprints are listed. The <a href="postconf.5.html#relayhost">relayhost</a> may be multiple
! physical hosts behind a load-balancer, each with its own private/public
! key and self-signed certificate. Alternatively, a single <a href="postconf.5.html#relayhost">relayhost</a> may
! be in the process of switching from one set of private/public keys to
! another, and both keys are trusted just prior to the transition. </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
! <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
! <a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
!     3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
!     EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
! </pre>
! </blockquote>
  
! <p> Example: Certificate fingerprint verification with selected destinations.
! As in the example above, we show two matching fingerprints: </p>
  
! <blockquote>
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = hash:/etc/postfix/tls_policy
!     <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
! </pre>
! </blockquote>
  
! <blockquote>
! <pre>
! /etc/postfix/tls_policy:
!     example.com	fingerprint
!         match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
!         match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
! </pre>
! </blockquote>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 9579,9661 ****
  
! <DT><b><a name="smtp_enforce_tls">smtp_enforce_tls</a>
! (default: no)</b></DT><DD>
! 
! <p> Enforcement mode: require that remote SMTP servers use TLS
! encryption, and never send mail in the clear.  This also requires
! that the remote SMTP server hostname matches the information in
! the remote server certificate, and that the remote SMTP server
! certificate was issued by a CA that is trusted by the Postfix SMTP
! client. If the certificate doesn't verify or the hostname doesn't
! match, delivery is deferred and mail stays in the queue.  </p>
! 
! <p> The server hostname is matched against all names provided as
! dNSNames in the SubjectAlternativeName.  If no dNSNames are specified,
! the CommonName is checked.  The behavior may be changed with the
! <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> option.  </p>
! 
! <p> This option is useful only if you are definitely sure that you
! will only connect to servers that support <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> _and_ that
! provide valid server certificates.  Typical use is for clients that
! send all their email to a dedicated mailhub.  </p>
! 
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
! 
! 
! </DD>
  
! <DT><b><a name="smtp_fallback_relay">smtp_fallback_relay</a>
! (default: $<a href="postconf.5.html#fallback_relay">fallback_relay</a>)</b></DT><DD>
  
! <p>
! Optional list of relay hosts for SMTP destinations that can't be
! found or that are unreachable. With Postfix 2.2 and earlier this
! parameter is called <a href="postconf.5.html#fallback_relay">fallback_relay</a>.  </p>
  
! <p>
! By default, mail is returned to the sender when a destination is
! not found, and delivery is deferred when a destination is unreachable.
  </p>
  
! <p> The fallback relays must be SMTP destinations. Specify a domain,
! host, host:port, [host]:port, [address] or [address]:port; the form
! [host] turns off MX lookups.  If you specify multiple SMTP
! destinations, Postfix will try them in the specified order.  </p>
  
! <p> To prevent mailer loops between MX hosts and fall-back hosts,
! Postfix version 2.2 and later will not use the fallback relays for
! destinations that it is MX host for (assuming DNS lookup is turned on).
  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_generic_maps">smtp_generic_maps</a>
! (default: empty)</b></DT><DD>
  
- <p> Optional lookup tables that perform address rewriting in the
- Postfix SMTP client, typically to transform a locally valid address into
- a globally valid address when sending mail across the Internet.
- This is needed when the local machine does not have its own Internet
- domain name, but uses something like <i>localdomain.local</i>
- instead.  </p>
  
! <p> The table format and lookups are documented in <a href="generic.5.html">generic(5)</a>;
! examples are shown in the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> and
! <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> documents. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_header_checks">smtp_header_checks</a>
! (default: empty)</b></DT><DD>
  
! <p> Restricted <a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP client.
! These tables are searched while mail is being delivered.  Actions
! that change the delivery time or destination are not available.
! </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
--- 8828,8898 ----
  
! <DT><b><a name="smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a>
! (default: md5)</b></DT><DD>
  
! <p> The message digest algorithm used to construct remote SMTP server
! certificate fingerprints. At the "fingerprint" TLS security level
! (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> = fingerprint), the server certificate is
! verified by directly matching its <i>fingerprint</i>. The fingerprint
! is the message digest of the server certificate using the selected
! algorithm. With a digest algorithm resistant to "second pre-image"
! attacks, it is not feasible to create a new public key and a matching
! certificate that has the same fingerprint. </p>
  
! <p> The default algorithm is <b>md5</b>; this is consistent with
! the backwards compatible setting of the digest used to verify client
! certificates in the SMTP server. </p>
  
! <p> The best practice algorithm is now <b>sha1</b>. Recent advances in hash
! function cryptanalysis have led to md5 being deprecated in favor of sha1.
! However, as long as there are no known "second pre-image" attacks
! against md5, its use in this context can still be considered safe.
  </p>
  
! <p> While additional digest algorithms are often available with OpenSSL's
! libcrypto, only those used by libssl in SSL cipher suites are available to
! Postfix. For now this means just md5 or sha1. </p>
  
! <p> To find the fingerprint of a specific certificate file, with a
! specific digest algorithm, run:
  </p>
  
+ <blockquote>
+ <pre>
+ $ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
+ </pre>
+ </blockquote>
+ 
+ <p> The text to the right of "=" sign is the desired fingerprint.
+ For example: </p>
  
! <blockquote>
! <pre>
! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem
! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
! </pre>
! </blockquote>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_tls_key_file">smtp_tls_key_file</a>
! (default: $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>)</b></DT><DD>
  
+ <p> File with the Postfix SMTP client RSA private key in PEM format.
+ This file may be combined with the Postfix SMTP client RSA certificate
+ file specified with $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>. </p>
  
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted, but file permissions should grant read/write
! access only to the system superuser account ("root"). </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> = $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>
! </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 9664,9709 ****
  
! <DT><b><a name="smtp_helo_name">smtp_helo_name</a>
! (default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
  
! <p>
! The hostname to send in the SMTP EHLO or HELO command.
! </p>
  
! <p>
! The default value is the machine hostname.  Specify a hostname or
! [ip.add.re.ss].
! </p>
  
! <p>
! This information can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP
! clients, or it can be specified in the <a href="master.5.html">master.cf</a> file for a specific
! client, for example:
! </p>
  
! <blockquote>
! <pre>
! /etc/postfix/<a href="master.5.html">master.cf</a>:
!     mysmtp ... smtp -o <a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a>=foo.bar.com
! </pre>
! </blockquote>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_helo_timeout">smtp_helo_timeout</a>
! (default: 300s)</b></DT><DD>
  
! <p>
! The Postfix SMTP client time limit for sending the HELO or EHLO command,
! and for receiving the initial remote SMTP server response.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
--- 8901,8929 ----
  
! <DT><b><a name="smtp_tls_loglevel">smtp_tls_loglevel</a>
! (default: 0)</b></DT><DD>
  
! <p> Enable additional Postfix SMTP client logging of TLS activity.
! Each logging level also includes the information that is logged at
! a lower logging level.  </p>
  
! <dl compact>
  
! <dt> </dt> <dd> 0 Disable logging of TLS activity. </dd>
  
! <dt> </dt> <dd> 1 Log TLS handshake and certificate information. </dd>
  
! <dt> </dt> <dd> 2 Log levels during TLS negotiation. </dd>
  
+ <dt> </dt> <dd> 3 Log hexadecimal and ASCII dump of TLS negotiation
+ process.  </dd>
  
! <dt> </dt> <dd> 4 Log hexadecimal and ASCII dump of complete
! transmission after STARTTLS. </dd>
  
! </dl>
  
! <p> Use "<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> = 3" only in case of problems. Use of
! loglevel 4 is strongly discouraged. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 9712,9740 ****
  
! <DT><b><a name="smtp_host_lookup">smtp_host_lookup</a>
! (default: dns)</b></DT><DD>
  
! <p>
! What mechanisms the Postfix SMTP client uses to look up a host's IP
! address.  This parameter is ignored when DNS lookups are disabled
! (see: <a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a>).
! </p>
  
! <p>
! Specify one of the following:
! </p>
  
  <dl>
  
! <dt><b>dns</b></dt>
! 
! <dd>Hosts can be found in the DNS (preferred).  </dd>
! 
! <dt><b>native</b></dt>
  
! <dd>Use the native naming service only (nsswitch.conf, or equivalent
! mechanism).  </dd>
  
! <dt><b>dns, native</b></dt>
  
! <dd>Use the native service for hosts not found in the DNS.  </dd>
  
--- 8932,9001 ----
  
! <DT><b><a name="smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>
! (default: medium)</b></DT><DD>
  
! <p> The minimum TLS cipher grade that the Postfix SMTP client will
! use with
! mandatory TLS encryption.  The default value "medium" is suitable
! for most destinations with which you may want to enforce TLS, and
! is beyond the reach of today's crypt-analytic methods. See
! <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure ciphers
! on a per-destination basis. </p>
  
! <p> The following cipher grades are supported: </p>
  
  <dl>
+ <dt><b>export</b></dt>
+ <dd> Enable the mainstream "EXPORT" grade or better OpenSSL
+ ciphers.  This is always used for opportunistic encryption. It is
+ not recommended for mandatory encryption unless you must enforce TLS
+ with "crippled" peers. The underlying cipherlist is specified via the
+ <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter, which you are strongly
+ encouraged to not change. The default value of <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a>
+ includes anonymous ciphers, but these are automatically filtered out if
+ the client is configured to verify server certificates. If you must
+ exclude anonymous ciphers also at the "encrypt" security level, set
+ "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
! <dt><b>low</b></dt>
! <dd> Enable the mainstream "LOW" grade or better OpenSSL ciphers.  This
! setting is only appropriate for internal mail servers.  The underlying
! cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration
! parameter, which you are strongly encouraged to not change. The default
! value of <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> includes anonymous ciphers, but these are
! automatically filtered out if the client is configured to verify server
! certificates. If you must exclude anonymous ciphers also at the "encrypt"
! security level, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
! <dt><b>medium</b></dt>
! <dd> Enable the mainstream "MEDIUM" grade or better OpenSSL ciphers.
! The underlying cipherlist is specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
! configuration parameter, which you are strongly encouraged to not change.
! The default value of <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> includes anonymous ciphers,
! but these are automatically filtered out if the client is configured to
! verify server certificates. If you must exclude anonymous ciphers also
! at the "encrypt" security level, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>
! = aNULL". </dd>
  
! <dt><b>high</b></dt>
! <dd> Enable only the mainstream "HIGH" grade OpenSSL ciphers.  This
! setting is appropriate when all mandatory TLS destinations support
! some of "HIGH" grade ciphers, this is not uncommon. The underlying
! cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> configuration
! parameter, which you are strongly encouraged to not change. The default
! value of <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> includes anonymous ciphers, but these are
! automatically filtered out if the client is configured to verify server
! certificates. If you must exclude anonymous ciphers also at the "encrypt"
! security level, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
! <dt><b>null</b></dt>
! <dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
! without encryption.  This setting is only appropriate in the rare case
! that all servers are prepared to use NULL ciphers (not normally enabled
! in TLS servers). A plausible use-case is an LMTP server listening on a
! UNIX-domain socket that is configured to support "NULL" ciphers. The
! underlying cipherlist is specified via the <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a>
! configuration parameter, which you are strongly encouraged to not
! change. The default value of <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> excludes anonymous
! ciphers (OpenSSL 0.9.8 has NULL ciphers that offer data integrity without
! encryption or authentication). </dd>
  
***************
*** 9742,9746 ****
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
--- 9003,9005 ----
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 9749,9767 ****
  
! <DT><b><a name="smtp_line_length_limit">smtp_line_length_limit</a>
! (default: 998)</b></DT><DD>
  
! <p>
! The maximal length of message header and body lines that Postfix
! will send via SMTP. This limit does not include the &lt;CR&gt;&lt;LF&gt;
! at the end of each line.  Longer lines are broken by inserting
! "&lt;CR&gt;&lt;LF&gt;&lt;SPACE&gt;", to minimize the damage to MIME
! formatted mail.
! </p>
  
! <p>
! The Postfix limit of 998 characters not including &lt;CR&gt;&lt;LF&gt;
! is consistent with the SMTP limit of 1000 characters including
! &lt;CR&gt;&lt;LF&gt;.  The Postfix limit was 990 with Postfix 2.8
! and earlier.
! </p>
  
--- 9008,9018 ----
  
! <DT><b><a name="smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>
! (default: empty)</b></DT><DD>
  
! <p> Additional list of ciphers or cipher types to exclude from the
! SMTP client cipher list at mandatory TLS security levels. This list
! works in addition to the exclusions listed with <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
! (see there for syntax details).  </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 9770,9796 ****
  
! <DT><b><a name="smtp_mail_timeout">smtp_mail_timeout</a>
! (default: 300s)</b></DT><DD>
  
! <p>
! The Postfix SMTP client time limit for sending the MAIL FROM command,
! and for receiving the remote SMTP server response.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_mime_header_checks">smtp_mime_header_checks</a>
! (default: empty)</b></DT><DD>
  
! <p> Restricted mime_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
! client. These tables are searched while mail is being delivered.
! Actions that change the delivery time or destination are not
! available.  </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
--- 9021,9056 ----
  
! <DT><b><a name="smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>
! (default: SSLv3, TLSv1)</b></DT><DD>
  
! <p> List of SSL/TLS protocols that the Postfix SMTP client will use with
! mandatory TLS encryption.  In <a href="postconf.5.html">main.cf</a> the values are separated by
! whitespace, commas or colons. In the policy table "protocols" attribute
! (see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid separator is colon. An
! empty value means allow all protocols. The valid protocol names, (see
! <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and "TLSv1". </p>
  
! <p> With Postfix &ge; 2.5 the parameter syntax is expanded to support
! protocol exclusions. One can now explicitly exclude SSLv2 by setting
! "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2". To exclude both SSLv2 and
! SSLv3 set "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3". Listing
! the protocols to include, rather than protocols to exclude, is still
! supported; use the form you find more intuitive. </p>
  
+ <p> Since SSL version 2 has known protocol weaknesses and is now
+ deprecated, the default setting excludes "SSLv2".  This means that by
+ default, SSL version 2 will not be used at the "encrypt" security level
+ and higher. </p>
  
! <p> See the documentation of the <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> parameter and
! <a href="TLS_README.html">TLS_README</a> for more information about security levels. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = TLSv1
! # Alternative form with Postfix &ge; 2.5:
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
! </pre>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 9799,9828 ****
  
! <DT><b><a name="smtp_mx_address_limit">smtp_mx_address_limit</a>
! (default: 5)</b></DT><DD>
! 
! <p>
! The maximal number of MX (mail exchanger) IP addresses that can
! result from Postfix SMTP client mail exchanger lookups, or zero (no
! limit). Prior to
! Postfix version 2.3, this limit was disabled by default.
! </p>
! 
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
! 
  
! </DD>
  
! <DT><b><a name="smtp_mx_session_limit">smtp_mx_session_limit</a>
! (default: 2)</b></DT><DD>
  
! <p> The maximal number of SMTP sessions per delivery request before
! the Postfix SMTP client
! gives up or delivers to a fall-back <a href="postconf.5.html#relayhost">relay host</a>, or zero (no
! limit). This restriction ignores sessions that fail to complete the
! SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to
! complete the EHLO and TLS handshake (Postfix version 2.3 and later).  </p>
  
! <p> This feature is available in Postfix 2.1 and later.  </p>
  
--- 9059,9073 ----
  
! <DT><b><a name="smtp_tls_note_starttls_offer">smtp_tls_note_starttls_offer</a>
! (default: no)</b></DT><DD>
  
! <p> Log the hostname of a remote SMTP server that offers STARTTLS,
! when TLS is not already enabled for that server. </p>
  
! <p> The logfile record looks like:  </p>
  
! <pre>
! postfix/smtp[pid]:  Host offered STARTTLS: [name.of.host]
! </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 9831,9890 ****
  
! <DT><b><a name="smtp_nested_header_checks">smtp_nested_header_checks</a>
  (default: empty)</b></DT><DD>
  
! <p> Restricted nested_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
! client. These tables are searched while mail is being delivered.
! Actions that change the delivery time or destination are not
! available.  </p>
! 
! <p> This feature is available in Postfix 2.5 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_never_send_ehlo">smtp_never_send_ehlo</a>
! (default: no)</b></DT><DD>
  
! <p> Never send EHLO at the start of an SMTP session. See also the
! <a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> parameter.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_per_record_deadline">smtp_per_record_deadline</a>
! (default: no)</b></DT><DD>
  
! <p> Change the behavior of the smtp_*_timeout time limits, from a
! time limit per read or write system call, to a time limit to send
! or receive a complete record (an SMTP command line, SMTP response
! line, SMTP message content line, or TLS protocol message).  This
! limits the impact from hostile peers that trickle data one byte at
! a time.  </p>
! 
! <p> Note: when per-record deadlines are enabled, a short timeout
! may cause problems with TLS over very slow network connections.
! The reasons are that a TLS protocol message can be up to 16 kbytes
! long (with TLSv1), and that an entire TLS protocol message must be
! sent or received within the per-record deadline.  </p>
  
! <p> This feature is available in Postfix 2.9 and later. With older
! Postfix releases, the behavior is as if this parameter is set to
! "no". </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a>
! (default: 10s)</b></DT><DD>
  
! <p>
! How long the Postfix SMTP client pauses before sending
! ".&lt;CR&gt;&lt;LF&gt;" in order to work around the PIX firewall
! "&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;" bug.
! </p>
  
! <p>
! Choosing a too short time makes this workaround ineffective when
! sending large messages over slow network connections.
! </p>
  
--- 9076,9151 ----
  
! <DT><b><a name="smtp_tls_per_site">smtp_tls_per_site</a>
  (default: empty)</b></DT><DD>
  
! <p> Optional lookup tables with the Postfix SMTP client TLS usage
! policy by next-hop destination and by remote SMTP server hostname.
! When both lookups succeed, the more specific per-site policy (NONE,
! MUST, etc) overrides the less specific one (MAY), and the more secure
! per-site policy (MUST, etc) overrides the less secure one (NONE).
! With Postfix 2.3 and later <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> is strongly discouraged:
! use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
  
! <p> Use of the bare hostname as the per-site table lookup key is
! discouraged. Always use the full destination nexthop (enclosed in
! [] with a possible ":port" suffix). A recipient domain or MX-enabled
! transport next-hop with no port suffix may look like a bare hostname,
! but is still a suitable <i>destination</i>. </p>
  
+ <p> Specify a next-hop destination or server hostname on the left-hand
+ side; no wildcards are allowed. The next-hop destination is either
+ the recipient domain, or the destination specified with a <a href="transport.5.html">transport(5)</a>
+ table, the <a href="postconf.5.html#relayhost">relayhost</a> parameter, or the <a href="postconf.5.html#relay_transport">relay_transport</a> parameter.
+ On the right hand side specify one of the following keywords:  </p>
  
! <dl>
  
! <dt> NONE </dt> <dd> Don't use TLS at all. This overrides a less
! specific <b>MAY</b> lookup result from the alternate host or next-hop
! lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>,
! and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings. </dd>
  
! <dt> MAY </dt> <dd> Try to use TLS if the server announces support,
! otherwise use the unencrypted connection. This has less precedence
! than a more specific result (including <b>NONE</b>) from the alternate
! host or next-hop lookup key, and has less precedence than the more
! specific global "<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> = yes" or "<a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
! = yes".  </dd>
  
! <dt> MUST_NOPEERMATCH </dt> <dd> Require TLS encryption, but do not
! require that the remote SMTP server hostname matches the information
! in the remote SMTP server certificate, or that the server certificate
! was issued by a trusted CA. This overrides a less secure <b>NONE</b>
! or a less specific <b>MAY</b> lookup result from the alternate host
! or next-hop lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>,
! <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings.  </dd>
  
+ <dt> MUST </dt> <dd> Require TLS encryption, require that the remote
+ SMTP server hostname matches the information in the remote SMTP
+ server certificate, and require that the remote SMTP server certificate
+ was issued by a trusted CA. This overrides a less secure <b>NONE</b>
+ and <b>MUST_NOPEERMATCH</b> or a less specific <b>MAY</b> lookup
+ result from the alternate host or next-hop lookup key, and overrides
+ the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
+ settings.  </dd>
  
! </dl>
  
! <p> The above keywords correspond to the "none", "may", "encrypt" and
! "verify" security levels for the new <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> parameter
! introduced in Postfix 2.3. Starting with Postfix 2.3, and independently
! of how the policy is specified, the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters only apply when TLS encryption
! is mandatory. Connections for which encryption is optional enable
! all "export" grade and better ciphers. </p>
  
! <p> As long as no secure DNS lookup mechanism is available, false
! hostnames in MX or CNAME responses can change the server hostname
! that Postfix uses for TLS policy lookup and server certificate
! verification. Even with a perfect match between the server hostname and
! the server certificate, there is no guarantee that Postfix is connected
! to the right server.  See <a href="TLS_README.html">TLS_README</a> (Closing a DNS loophole with obsolete
! per-site TLS policies) for a possible work-around. </p>
  
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
  
***************
*** 9893,9938 ****
  
! <DT><b><a name="smtp_pix_workaround_maps">smtp_pix_workaround_maps</a>
  (default: empty)</b></DT><DD>
  
! <p> Lookup tables, indexed by the remote SMTP server address, with
! per-destination workarounds for CISCO PIX firewall bugs.  The table
! is not indexed by hostname for consistency with
! <a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>. </p>
! 
! <p> This feature is available in Postfix 2.4 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a>
! (default: 500s)</b></DT><DD>
! 
! <p> How long a message must be queued before the Postfix SMTP client
! turns on the PIX firewall "&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;"
! bug workaround for delivery through firewalls with "smtp fixup"
! mode turned on.  </p>
! 
! <p>
! By default, the workaround is turned off for mail that is queued
! for less than 500 seconds. In other words, the workaround is normally
! turned off for the first delivery attempt.
! </p>
! 
! <p>
! Specify 0 to enable the PIX firewall
! "&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;" bug workaround upon the
! first delivery attempt.
  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_pix_workarounds">smtp_pix_workarounds</a>
! (default: disable_esmtp, delay_dotcrlf)</b></DT><DD>
  
! <p> A list that specifies zero or more workarounds for CISCO PIX
! firewall bugs. These workarounds are implemented by the Postfix
! SMTP client. Workaround names are separated by comma or space, and
! are case insensitive.  This parameter setting can be overruled with
! per-destination <a href="postconf.5.html#smtp_pix_workaround_maps">smtp_pix_workaround_maps</a> settings. </p>
  
--- 9154,9188 ----
  
! <DT><b><a name="smtp_tls_policy_maps">smtp_tls_policy_maps</a>
  (default: empty)</b></DT><DD>
  
! <p> Optional lookup tables with the Postfix SMTP client TLS security
! policy by next-hop destination; when a non-empty value is specified,
! this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter.  See
! <a href="TLS_README.html">TLS_README</a> for a more detailed discussion of TLS security levels.
  </p>
  
+ <p> The TLS policy table is indexed by the full next-hop destination,
+ which is either the recipient domain, or the verbatim next-hop
+ specified in the transport table, $<a href="postconf.5.html#local_transport">local_transport</a>, $<a href="postconf.5.html#virtual_transport">virtual_transport</a>,
+ $<a href="postconf.5.html#relay_transport">relay_transport</a> or $<a href="postconf.5.html#default_transport">default_transport</a>. This includes any enclosing
+ square brackets and any non-default destination server port suffix. The
+ LMTP socket type prefix (inet: or unix:) is not included in the lookup
+ key. </p>
  
! <p> Only the next-hop domain, or $<a href="postconf.5.html#myhostname">myhostname</a> with LMTP over UNIX-domain
! sockets, is used as the nexthop name for certificate verification. The
! port and any enclosing square brackets are used in the table lookup key,
! but are not used for server name verification. </p>
  
! <p> When the lookup key is a domain name without enclosing square brackets
! or any <i>:port</i> suffix (typically the recipient domain), and the full
! domain is not found in the table, just as with the <a href="transport.5.html">transport(5)</a> table,
! the parent domain starting with a leading "." is matched recursively. This
! allows one to specify a security policy for a recipient domain and all
! its sub-domains. </p>
  
! <p> The lookup result is a security level, followed by an optional list
! of whitespace and/or comma separated name=value attributes that override
! related <a href="postconf.5.html">main.cf</a> settings. The TLS security levels in order of increasing
! security are: </p>
  
***************
*** 9940,12458 ****
  
! <dt><b>delay_dotcrlf</b><dd> Insert a delay before sending
! ".&lt;CR&gt;&lt;LF&gt;" after the end of the message content.  The
! delay is subject to the <a href="postconf.5.html#smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a> and
! <a href="postconf.5.html#smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a> parameter settings. </dd>
! 
! <dt><b>disable_esmtp</b><dd> Disable all extended SMTP commands:
! send HELO instead of EHLO. </dd>
  
! </dl>
  
! <p> This feature is available in Postfix 2.4 and later. The default
! settings are backwards compatible with earlier Postfix versions.
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_quit_timeout">smtp_quit_timeout</a>
! (default: 300s)</b></DT><DD>
  
! <p>
! The Postfix SMTP client time limit for sending the QUIT command,
! and for receiving the remote SMTP server response.
! </p>
  
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
  
! 
! </DD>
! 
! <DT><b><a name="smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>
! (default: yes)</b></DT><DD>
! 
! <p>
! Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO commands
! as required
! by <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. This includes putting quotes around an address localpart
! that ends in ".".
! </p>
! 
! <p>
! The default is to comply with <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. If you have to send mail to
! a broken SMTP server, configure a special SMTP client in <a href="master.5.html">master.cf</a>:
! </p>
! 
! <blockquote>
! <pre>
! /etc/postfix/<a href="master.5.html">master.cf</a>:
!     broken-smtp . . . smtp -o <a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>=no
! </pre>
! </blockquote>
! 
! <p>
! and route mail for the destination in question to the "broken-smtp"
! message delivery with a <a href="transport.5.html">transport(5)</a> table.
! </p>
! 
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_randomize_addresses">smtp_randomize_addresses</a>
! (default: yes)</b></DT><DD>
! 
! <p>
! Randomize the order of equal-preference MX host addresses.  This
! is a performance feature of the Postfix SMTP client.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_rcpt_timeout">smtp_rcpt_timeout</a>
! (default: 300s)</b></DT><DD>
! 
! <p>
! The Postfix SMTP client time limit for sending the SMTP RCPT TO
! command, and for receiving the remote SMTP server response.
! </p>
! 
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_reply_filter">smtp_reply_filter</a>
! (default: empty)</b></DT><DD>
! 
! <p> A mechanism to transform replies from remote SMTP servers one
! line at a time.  This is a last-resort tool to work around server
! replies that break inter-operability with the Postfix SMTP client.
! Other uses involve fault injection to test Postfix's handling of
! invalid responses. </p>
! 
! <p> Notes: </p>
! 
! <ul>
! 
! <li> <p> In the case of a multi-line reply, the Postfix SMTP client
! uses the final reply line's numerical SMTP reply code and enhanced
! status code.  </p>
! 
! <li> <p> The numerical SMTP reply code (XYZ) takes precedence over
! the enhanced status code (X.Y.Z).  When the enhanced status code
! initial digit differs from the SMTP reply code initial digit, or
! when no enhanced status code is present, the Postfix SMTP client
! uses a generic enhanced status code (X.0.0) instead. </p>
! 
! </ul>
! 
! <p> Specify the name of a "<a href="DATABASE_README.html">type:table</a>" lookup table. The search
! string is a single SMTP reply line as received from the remote SMTP
! server, except that the trailing &lt;CR&gt;&lt;LF&gt; are removed.
! When the lookup succeeds, the result replaces the single SMTP reply
! line. </p>
! 
! <p> Examples: </p>
! 
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/reply_filter
! </pre>
! 
! <pre>
! /etc/postfix/reply_filter:
!     # Transform garbage into "250-filler..." so that it looks like
!     # one line from a multi-line reply. It does not matter what we
!     # substitute here as long it has the right syntax.  The Postfix
!     # SMTP client will use the final line's numerical SMTP reply
!     # code and enhanced status code.
!     !/^([2-5][0-9][0-9]($|[- ]))/ 250-filler for garbage
! </pre>
! 
! <p> This feature is available in Postfix 2.7. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_rset_timeout">smtp_rset_timeout</a>
! (default: 20s)</b></DT><DD>
! 
! <p> The Postfix SMTP client time limit for sending the RSET command,
! and for receiving the remote SMTP server response. The SMTP client
! sends RSET in
! order to finish a recipient address probe, or to verify that a
! cached session is still usable.  </p>
! 
! <p> This feature is available in Postfix 2.1 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
! (default: empty)</b></DT><DD>
! 
! <p> An optional table to prevent repeated SASL authentication
! failures with the same remote SMTP server hostname, username and
! password. Each table (key, value) pair contains a server name, a
! username and password, and the full server response. This information
! is stored when a remote SMTP server rejects an authentication attempt
! with a 535 reply code.  As long as the <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a>
! information does no change, and as long as the <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
! information does not expire (see <a href="postconf.5.html#smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>) the
! Postfix SMTP client avoids SASL authentication attempts with the
! same server, username and password, and instead bounces or defers
! mail as controlled with the <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> configuration
! parameter.  </p>
! 
! <p> Use a per-destination delivery concurrency of 1 (for example,
! "<a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> = 1",
! "<a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> = 1", etc.), otherwise multiple
! delivery agents may experience a login failure at the same time.
! </p>
! 
! <p> The table must be accessed via the proxywrite service, i.e. the
! map name must start with "<a href="proxymap.8.html">proxy</a>:". The table should be stored under
! the directory specified with the <a href="postconf.5.html#data_directory">data_directory</a> parameter. </p>
! 
! <p> This feature uses cryptographic hashing to protect plain-text
! passwords, and requires that Postfix is compiled with TLS support.
! </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> = <a href="proxymap.8.html">proxy</a>:btree:/var/lib/postfix/sasl_auth_cache
! </pre>
! 
! <p> This feature is available in Postfix 2.5 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>
! (default: 90d)</b></DT><DD>
! 
! <p> The maximal age of an <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> entry before it
! is removed. </p>
! 
! <p> This feature is available in Postfix 2.5 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_auth_enable">smtp_sasl_auth_enable</a>
! (default: no)</b></DT><DD>
! 
! <p>
! Enable SASL authentication in the Postfix SMTP client.  By default,
! the Postfix SMTP client uses no authentication.
! </p>
! 
! <p>
! Example:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes
! </pre>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a>
! (default: yes)</b></DT><DD>
! 
! <p> When a remote SMTP server rejects a SASL authentication request
! with a 535 reply code, defer mail delivery instead of returning
! mail as undeliverable. The latter behavior was hard-coded prior to
! Postfix version 2.5. </p>
! 
! <p> Note: the setting "yes" overrides the global <a href="postconf.5.html#soft_bounce">soft_bounce</a>
! parameter, but the setting "no" does not. </p>
! 
! <p> Example: </p>
! 
! <pre>
! # Default as of Postfix 2.5
! <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = yes
! # The old hard-coded default
! <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = no
! </pre>
! 
! <p> This feature is available in Postfix 2.5 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a>
! (default: empty)</b></DT><DD>
! 
! <p>
! If non-empty, a Postfix SMTP client filter for the remote SMTP
! server's list of offered SASL mechanisms.  Different client and
! server implementations may support different mechanism lists; by
! default, the Postfix SMTP client will use the intersection of the
! two. <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> specifies an optional third mechanism
! list to intersect with. </p>
! 
! <p> Specify mechanism names, "/file/name" patterns or "<a href="DATABASE_README.html">type:table</a>"
! lookup tables. The right-hand side result from "<a href="DATABASE_README.html">type:table</a>" lookups
! is ignored. Specify "!pattern" to exclude a mechanism name from the
! list. The form "!/file/name" is supported only in Postfix version
! 2.4 and later. </p>
! 
! <p> This feature is available in Postfix 2.2 and later. </p>
! 
! <p>
! Examples:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = plain, login
! <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = /etc/postfix/smtp_mechs
! <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = !gssapi, !login, <a href="DATABASE_README.html#types">static</a>:rest
! </pre>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_password_maps">smtp_sasl_password_maps</a>
! (default: empty)</b></DT><DD>
! 
! <p>
! Optional Postfix SMTP client lookup tables with one username:password
! entry
! per remote hostname or domain, or sender address when sender-dependent
! authentication is enabled.  If no username:password entry is found,
! then the Postfix SMTP client will not
! attempt to authenticate to the remote host.
! </p>
! 
! <p>
! The Postfix SMTP client opens the lookup table before going to
! chroot jail, so you can leave the password file in /etc/postfix.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_path">smtp_sasl_path</a>
! (default: empty)</b></DT><DD>
! 
! <p> Implementation-specific information that the Postfix SMTP client
! passes through to
! the SASL plug-in implementation that is selected with
! <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>.  Typically this specifies the name of a
! configuration file or rendezvous point. </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_security_options">smtp_sasl_security_options</a>
! (default: noplaintext, noanonymous)</b></DT><DD>
! 
! <p> Postfix SMTP client SASL security options; as of Postfix 2.3
! the list of available
! features depends on the SASL client implementation that is selected
! with <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>.  </p>
! 
! <p> The following security features are defined for the <b>cyrus</b>
! client SASL implementation: </p>
! 
! <p>
! Specify zero or more of the following:
! </p>
! 
! <dl>
! 
! <dt><b>noplaintext</b></dt>
! 
! <dd>Disallow methods that use plaintext passwords. </dd>
! 
! <dt><b>noactive</b></dt>
! 
! <dd>Disallow methods subject to active (non-dictionary) attack.
! </dd>
! 
! <dt><b>nodictionary</b></dt>
! 
! <dd>Disallow methods subject to passive (dictionary) attack. </dd>
! 
! <dt><b>noanonymous</b></dt>
! 
! <dd>Disallow methods that allow anonymous authentication. </dd>
! 
! <dt><b>mutual_auth</b></dt>
! 
! <dd>Only allow methods that provide mutual authentication (not
! available with SASL version 1). </dd>
! 
! </dl>
! 
! <p>
! Example:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a> = noplaintext
! </pre>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>
! (default: $<a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a>)</b></DT><DD>
! 
! <p> The SASL authentication security options that the Postfix SMTP
! client uses for TLS encrypted SMTP sessions. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a>
! (default: $<a href="postconf.5.html#smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>)</b></DT><DD>
! 
! <p> The SASL authentication security options that the Postfix SMTP
! client uses for TLS encrypted SMTP sessions with a verified server
! certificate. </p>
! 
! <p> When mail is sent to the public MX host for the recipient's
! domain, server certificates are by default optional, and delivery
! proceeds even if certificate verification fails. For delivery via
! a submission service that requires SASL authentication, it may be
! appropriate to send plaintext passwords only when the connection
! to the server is strongly encrypted <b>and</b> the server identity
! is verified. </p>
! 
! <p> The <a href="postconf.5.html#smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a> parameter makes it
! possible to only enable plaintext mechanisms when a secure connection
! to the server is available. Submission servers subject to this
! policy must either have verifiable certificates or offer suitable
! non-plaintext SASL mechanisms. </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sasl_type">smtp_sasl_type</a>
! (default: cyrus)</b></DT><DD>
! 
! <p> The SASL plug-in type that the Postfix SMTP client should use
! for authentication.  The available types are listed with the
! "<b>postconf -A</b>" command. </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a>
! (default: no)</b></DT><DD>
! 
! <p> Whether or not to append the "AUTH=&lt;&gt;" option to the MAIL
! FROM command in SASL-authenticated SMTP sessions. The default is
! not to send this, to avoid problems with broken remote SMTP servers.
! Before Postfix 2.9 the behavior is as if "<a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a>
! = yes".
! 
! <p> This feature is available in Postfix 2.9 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_send_xforward_command">smtp_send_xforward_command</a>
! (default: no)</b></DT><DD>
! 
! <p>
! Send the non-standard XFORWARD command when the Postfix SMTP server
! EHLO response announces XFORWARD support.
! </p>
! 
! <p>
! This allows a Postfix SMTP delivery agent, used for injecting mail
! into
! a content filter, to forward the name, address, protocol and HELO
! name of the original client to the content filter and downstream
! queuing SMTP server. This can produce more useful logging than
! localhost[127.0.0.1] etc.
! </p>
! 
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a>
! (default: no)</b></DT><DD>
! 
! <p>
! Enable sender-dependent authentication in the Postfix SMTP client; this is
! available only with SASL authentication, and disables SMTP connection
! caching to ensure that mail from different senders will use the
! appropriate credentials.  </p>
! 
! <p>
! This feature is available in Postfix 2.3 and later.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a>
! (default: yes)</b></DT><DD>
! 
! <p>
! Skip SMTP servers that greet with a 4XX status code (go away, try
! again later).
! </p>
! 
! <p>
! By default, the Postfix SMTP client moves on the next mail exchanger.
! Specify
! "<a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> = no" if Postfix should defer delivery
! immediately.
! </p>
! 
! <p> This feature is available in Postfix 2.0 and earlier.
! Later Postfix versions always skip remote SMTP servers that greet
! with a
! 4XX status code. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a>
! (default: yes)</b></DT><DD>
! 
! <p>
! Skip remote SMTP servers that greet with a 5XX status code (go away,
! do
! not try again later).
! </p>
! 
! <p> By default, the Postfix SMTP client moves on the next mail
! exchanger. Specify "<a href="postconf.5.html#smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a> = no" if Postfix should
! bounce the mail immediately. The default setting is incorrect, but
! it is what a lot of people expect to happen.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_skip_quit_response">smtp_skip_quit_response</a>
! (default: yes)</b></DT><DD>
! 
! <p>
! Do not wait for the response to the SMTP QUIT command.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_starttls_timeout">smtp_starttls_timeout</a>
! (default: 300s)</b></DT><DD>
! 
! <p> Time limit for Postfix SMTP client write and read operations
! during TLS startup and shutdown handshake procedures. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_CAfile">smtp_tls_CAfile</a>
! (default: empty)</b></DT><DD>
! 
! <p> A file containing CA certificates of root CAs trusted to sign
! either remote SMTP server certificates or intermediate CA certificates.
! These are loaded into memory before the <a href="smtp.8.html">smtp(8)</a> client enters the
! chroot jail. If the number of trusted roots is large, consider using
! <a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> instead, but note that the latter directory must be
! present in the chroot jail if the <a href="smtp.8.html">smtp(8)</a> client is chrooted. This
! file may also be used to augment the client certificate trust chain,
! but it is best to include all the required certificates directly in
! $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>. </p>
! 
! <p> Specify "<a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> = /path/to/system_CA_file" to use
! ONLY the system-supplied default certificate authority certificates.
! </p>
! 
! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
! appending the system-supplied default CAs and trusting third-party
! certificates. </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> = /etc/postfix/CAcert.pem
! </pre>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_CApath">smtp_tls_CApath</a>
! (default: empty)</b></DT><DD>
! 
! <p> Directory with PEM format certificate authority certificates
! that the Postfix SMTP client uses to verify a remote SMTP server
! certificate.  Don't forget to create the necessary "hash" links
! with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
! </p>
! 
! <p> To use this option in chroot mode, this directory (or a copy)
! must be inside the chroot jail. </p>
! 
! <p> Specify "<a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> = /path/to/system_CA_directory" to
! use ONLY the system-supplied default certificate authority certificates.
! </p>
! 
! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
! appending the system-supplied default CAs and trusting third-party
! certificates. </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> = /etc/postfix/certs
! </pre>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_block_early_mail_reply">smtp_tls_block_early_mail_reply</a>
! (default: no)</b></DT><DD>
! 
! <p> Try to detect a mail hijacking attack based on a TLS protocol
! vulnerability (CVE-2009-3555), where an attacker prepends malicious
! HELO, MAIL, RCPT, DATA commands to a Postfix SMTP client TLS session.
! The attack would succeed with non-Postfix SMTP servers that reply
! to the malicious HELO, MAIL, RCPT, DATA commands after negotiating
! the Postfix SMTP client TLS session.  </p>
! 
! <p> This feature is available in Postfix 2.7. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_cert_file">smtp_tls_cert_file</a>
! (default: empty)</b></DT><DD>
! 
! <p> File with the Postfix SMTP client RSA certificate in PEM format.
! This file may also contain the Postfix SMTP client private RSA key,
! and these may be the same as the Postfix SMTP server RSA certificate and key
! file. </p>
! 
! <p> Do not configure client certificates unless you <b>must</b> present
! client TLS certificates to one or more servers. Client certificates are
! not usually needed, and can cause problems in configurations that work
! well without them. The recommended setting is to let the defaults stand: </p>
! 
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> =
! <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> =
! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> =
! <a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a> =
! <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> =
! <a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> =
! </pre>
! </blockquote>
! 
! <p> The best way to use the default settings is to comment out the above
! parameters in <a href="postconf.5.html">main.cf</a> if present. </p>
! 
! <p> To enable remote SMTP servers to verify the Postfix SMTP client
! certificate, the issuing CA certificates must be made available to the
! server. You should include the required certificates in the client
! certificate file, the client certificate first, then the issuing
! CA(s) (bottom-up order). </p>
! 
! <p> Example: the certificate for "client.example.com" was issued by
! "intermediate CA" which itself has a certificate issued by "root CA".
! Create the client.pem file with "cat client_cert.pem intermediate_CA.pem
! root_CA.pem &gt; client.pem". </p>
! 
! <p> If you also want to verify remote SMTP server certificates issued by
! these CAs, you can add the CA certificates to the <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>, in
! which case it is not necessary to have them in the <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>,
! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> or <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>. </p>
! 
! <p> A certificate supplied here must be usable as an SSL client certificate
! and hence pass the "openssl verify -purpose sslclient ..." test. </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> = /etc/postfix/client.pem
! </pre>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_cipherlist">smtp_tls_cipherlist</a>
! (default: empty)</b></DT><DD>
! 
! <p> Obsolete Postfix &lt; 2.3 control for the Postfix SMTP client TLS
! cipher list. As this feature applies to all TLS security levels, it is easy
! to create inter-operability problems by choosing a non-default cipher
! list. Do not use a non-default TLS cipher list on hosts that deliver email
! to the public Internet: you will be unable to send email to servers that
! only support the ciphers you exclude. Using a restricted cipher list
! may be more appropriate for an internal MTA, where one can exert some
! control over the TLS software and settings of the peer servers. </p>
! 
! <p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
! 
! <p> This feature is available in Postfix version 2.2. It is not used with
! Postfix 2.3 and later; use <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> instead. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_ciphers">smtp_tls_ciphers</a>
! (default: export)</b></DT><DD>
! 
! <p> The minimum TLS cipher grade that the Postfix SMTP client
! will use with opportunistic TLS encryption. Cipher types listed in
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> are excluded from the base definition of
! the selected cipher grade. The default value "export" ensures maximum
! inter-operability. Because encryption is optional, stronger controls
! are not appropriate, and this setting SHOULD NOT be changed unless the
! change is essential. </p>
! 
! <p> When TLS is mandatory the cipher grade is chosen via the
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
! details. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure
! ciphers on a per-destination basis. </p>
! 
! <p> Example: </p>
! <pre>
! <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = export
! </pre>
! 
! <p> This feature is available in Postfix 2.6 and later. With earlier Postfix
! releases only the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter is implemented,
! and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_dcert_file">smtp_tls_dcert_file</a>
! (default: empty)</b></DT><DD>
! 
! <p> File with the Postfix SMTP client DSA certificate in PEM format.
! This file may also contain the Postfix SMTP client private DSA key. </p>
! 
! <p> See the discussion under <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for more details.
! </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> = /etc/postfix/client-dsa.pem
! </pre>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_dkey_file">smtp_tls_dkey_file</a>
! (default: $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>)</b></DT><DD>
! 
! <p> File with the Postfix SMTP client DSA private key in PEM format.
! This file may be combined with the Postfix SMTP client DSA certificate
! file specified with $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>. </p>
! 
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_eccert_file">smtp_tls_eccert_file</a>
! (default: empty)</b></DT><DD>
! 
! <p> File with the Postfix SMTP client ECDSA certificate in PEM format.
! This file may also contain the Postfix SMTP client ECDSA private key. </p>
! 
! <p> See the discussion under <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for more details.
! </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> = /etc/postfix/ecdsa-ccert.pem
! </pre>
! 
! <p> This feature is available in Postfix 2.6 and later, when Postfix is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_eckey_file">smtp_tls_eckey_file</a>
! (default: $<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>)</b></DT><DD>
! 
! <p> File with the Postfix SMTP client ECDSA private key in PEM format.
! This file may be combined with the Postfix SMTP client ECDSA
! certificate file specified with $<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>. </p>
! 
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
! 
! <p> This feature is available in Postfix 2.6 and later, when Postfix is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
! (default: yes)</b></DT><DD>
! 
! <p> With mandatory TLS encryption, require that the remote SMTP
! server hostname matches the information in the remote SMTP server
! certificate.  As of <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> the requirements for hostname checking
! for MTA clients are not specified. </p>
! 
! <p> This option can be set to "no" to disable strict peer name
! checking. This setting has no effect on sessions that are controlled
! via the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table.  </p>
! 
! <p> Disabling the hostname verification can make sense in closed
! environment where special CAs are created.  If not used carefully,
! this option opens the danger of a "man-in-the-middle" attack (the
! CommonName of this attacker will be logged). </p>
! 
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
! (default: empty)</b></DT><DD>
! 
! <p> List of ciphers or cipher types to exclude from the Postfix
! SMTP client cipher
! list at all TLS security levels. This is not an OpenSSL cipherlist, it is
! a simple list separated by whitespace and/or commas. The elements are a
! single cipher, or one or more "+" separated cipher properties, in which
! case only ciphers matching <b>all</b> the properties are excluded. </p>
! 
! <p> Examples (some of these will cause problems): </p>
! 
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = aNULL
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = MD5, DES
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = DES+MD5
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = kEDH+aRSA
! </pre>
! </blockquote>
! 
! <p> The first setting, disables anonymous ciphers. The next setting
! disables ciphers that use the MD5 digest algorithm or the (single) DES
! encryption algorithm. The next setting disables ciphers that use MD5 and
! DES together.  The next setting disables the two ciphers "AES256-SHA"
! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
! key exchange with RSA authentication. </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a>
! (default: empty)</b></DT><DD>
! 
! <p> List of acceptable remote SMTP server certificate fingerprints for
! the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> =
! fingerprint). At this security level, certificate authorities are not
! used, and certificate expiration times are ignored. Instead, server
! certificates are verified directly via their certificate fingerprint
! or public key fingerprint (Postfix 2.9 and later). The fingerprint
! is a message digest of the server certificate (or public key). The
! digest algorithm is selected via the <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b>
! parameter. </p>
! 
! <p> When an <b><a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a></b> table entry specifies the
! "fingerprint" security level, any "match" attributes in that entry specify
! the list of valid fingerprints for the corresponding destination. Multiple
! fingerprints can be combined with a "|" delimiter in a single match
! attribute, or multiple match attributes can be employed. </p>
! 
! <p> Example: Certificate fingerprint verification with internal mailhub.
! Two matching fingerprints are listed. The <a href="postconf.5.html#relayhost">relayhost</a> may be multiple
! physical hosts behind a load-balancer, each with its own private/public
! key and self-signed certificate. Alternatively, a single <a href="postconf.5.html#relayhost">relayhost</a> may
! be in the process of switching from one set of private/public keys to
! another, and both keys are trusted just prior to the transition. </p>
! 
! <blockquote>
! <pre>
! <a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
! <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
! <a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
!     3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
!     EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
! </pre>
! </blockquote>
! 
! <p> Example: Certificate fingerprint verification with selected destinations.
! As in the example above, we show two matching fingerprints: </p>
! 
! <blockquote>
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = hash:/etc/postfix/tls_policy
!     <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
! </pre>
! </blockquote>
! 
! <blockquote>
! <pre>
! /etc/postfix/tls_policy:
!     example.com	fingerprint
!         match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
!         match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
! </pre>
! </blockquote>
! 
! <p> This feature is available in Postfix 2.5 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a>
! (default: md5)</b></DT><DD>
! 
! <p> The message digest algorithm used to construct remote SMTP server
! certificate fingerprints. At the "fingerprint" TLS security level
! (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> = fingerprint), the server certificate is
! verified by directly matching its certificate fingerprint or its public
! key fingerprint (Postfix 2.9 and later). The fingerprint is the
! message digest of the server certificate (or its public key)
! using the selected
! algorithm. With a digest algorithm resistant to "second pre-image"
! attacks, it is not feasible to create a new public key and a matching
! certificate (or public/private key-pair) that has the same fingerprint. </p>
! 
! <p> The default algorithm is <b>md5</b>; this is consistent with
! the backwards compatible setting of the digest used to verify client
! certificates in the SMTP server. </p>
! 
! <p> The best practice algorithm is now <b>sha1</b>. Recent advances in hash
! function cryptanalysis have led to md5 being deprecated in favor of sha1.
! However, as long as there are no known "second pre-image" attacks
! against md5, its use in this context can still be considered safe.
! </p>
! 
! <p> While additional digest algorithms are often available with OpenSSL's
! libcrypto, only those used by libssl in SSL cipher suites are available to
! Postfix. For now this means just md5 or sha1. </p>
! 
! <p> To find the fingerprint of a specific certificate file, with a
! specific digest algorithm, run:
! </p>
! 
! <blockquote>
! <pre>
! $ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
! </pre>
! </blockquote>
! 
! <p> The text to the right of "=" sign is the desired fingerprint.
! For example: </p>
! 
! <blockquote>
! <pre>
! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem
! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
! </pre>
! </blockquote>
! 
! <p> Public key fingerprints are more difficult to extract, however,
! the SHA-1 public key fingerprint is often present as the value of the
! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix
! SMTP server and client log the peer certificate fingerprint and public
! key fingerprint when TLS loglevel is 1 or higher. </p>
! 
! <p> This feature is available in Postfix 2.5 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_key_file">smtp_tls_key_file</a>
! (default: $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>)</b></DT><DD>
! 
! <p> File with the Postfix SMTP client RSA private key in PEM format.
! This file may be combined with the Postfix SMTP client RSA certificate
! file specified with $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>. </p>
! 
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> = $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>
! </pre>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_loglevel">smtp_tls_loglevel</a>
! (default: 0)</b></DT><DD>
! 
! <p> Enable additional Postfix SMTP client logging of TLS activity.
! Each logging level also includes the information that is logged at
! a lower logging level.  </p>
! 
! <dl compact>
! 
! <dt> </dt> <dd> 0 Log only a summary message on TLS handshake completion
! &mdash; no logging of remote SMTP server certificate trust-chain
! verification errors if server certificate verification is not required.
! With Postfix 2.8 and earlier, disable logging of TLS activity.  </dd>
! 
! <dt> </dt> <dd> 1 Also log remote SMTP server trust-chain verification
! errors and peer certificate summary information. With Postfix 2.8
! and earlier, log TLS handshake and certificate information.  </dd>
! 
! <dt> </dt> <dd> 2 Also log levels during TLS negotiation.  </dd>
! 
! <dt> </dt> <dd> 3 Also log hexadecimal and ASCII dump of TLS negotiation
! process.  </dd>
! 
! <dt> </dt> <dd> 4 Also log hexadecimal and ASCII dump of complete
! transmission after STARTTLS. </dd>
! 
! </dl>
! 
! <p> Do not use "<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> = 2" or higher except in case of
! problems. Use of loglevel 4 is strongly discouraged. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>
! (default: medium)</b></DT><DD>
! 
! <p> The minimum TLS cipher grade that the Postfix SMTP client will
! use with
! mandatory TLS encryption.  The default value "medium" is suitable
! for most destinations with which you may want to enforce TLS, and
! is beyond the reach of today's cryptanalytic methods. See
! <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure ciphers
! on a per-destination basis. </p>
! 
! <p> The following cipher grades are supported: </p>
! 
! <dl>
! <dt><b>export</b></dt>
! <dd> Enable "EXPORT" grade or better OpenSSL
! ciphers.  This is the default for opportunistic encryption. It is
! not recommended for mandatory encryption unless you must enforce TLS
! with "crippled" peers. The underlying cipherlist is specified via the
! <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. </dd>
! 
! <dt><b>low</b></dt>
! <dd> Enable "LOW" grade or better OpenSSL ciphers.  This
! setting is only appropriate for internal mail servers.  The underlying
! cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration
! parameter, which you are strongly encouraged to not change. </dd>
! 
! <dt><b>medium</b></dt>
! <dd> Enable "MEDIUM" grade or better OpenSSL ciphers.
! The underlying cipherlist is specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
! configuration parameter, which you are strongly encouraged to not change.
! </dd>
! 
! <dt><b>high</b></dt>
! <dd> Enable only "HIGH" grade OpenSSL ciphers.  This setting may
! be appropriate when all mandatory TLS destinations (e.g. when all
! mail is routed to a suitably capable <a href="postconf.5.html#relayhost">relayhost</a>) support at least one
! "HIGH" grade cipher. The underlying cipherlist is specified via the
! <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. </dd>
! 
! <dt><b>null</b></dt>
! <dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
! without encryption.  This setting is only appropriate in the rare case
! that all servers are prepared to use NULL ciphers (not normally enabled
! in TLS servers). A plausible use-case is an LMTP server listening on a
! UNIX-domain socket that is configured to support "NULL" ciphers. The
! underlying cipherlist is specified via the <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a>
! configuration parameter, which you are strongly encouraged to not
! change. </dd>
! 
! </dl>
! 
! <p> The underlying cipherlists for grades other than "null" include
! anonymous ciphers, but these are automatically filtered out if the
! Postfix SMTP client is configured to verify server certificates.
! You are very unlikely to need to take any steps to exclude anonymous
! ciphers, they are excluded automatically as necessary.  If you must
! exclude anonymous ciphers at the "may" or "encrypt" security levels,
! when the Postfix SMTP client does not need or use peer certificates, set
! "<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers only when
! TLS is enforced, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>
! (default: empty)</b></DT><DD>
! 
! <p> Additional list of ciphers or cipher types to exclude from the
! Postfix SMTP client cipher list at mandatory TLS security levels. This list
! works in addition to the exclusions listed with <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
! (see there for syntax details).  </p>
! 
! <p> Starting with Postfix 2.6, the mandatory cipher exclusions can be
! specified on a per-destination basis via the TLS policy "exclude"
! attribute. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for notes and examples. </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>
! (default: SSLv3, TLSv1)</b></DT><DD>
! 
! <p> List of SSL/TLS protocols that the Postfix SMTP client will use with
! mandatory TLS encryption.  In <a href="postconf.5.html">main.cf</a> the values are separated by
! whitespace, commas or colons. In the policy table "protocols" attribute
! (see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid separator is colon. An
! empty value means allow all protocols. The valid protocol names, (see
! <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and "TLSv1". </p>
! 
! <p> With Postfix &ge; 2.5 the parameter syntax is expanded to support
! protocol exclusions. One can now explicitly exclude SSLv2 by setting
! "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2". To exclude both SSLv2 and
! SSLv3 set "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3". Listing
! the protocols to include, rather than protocols to exclude, is still
! supported; use the form you find more intuitive. </p>
! 
! <p> Since SSL version 2 has known protocol weaknesses and is now
! deprecated, the default setting excludes "SSLv2".  This means that by
! default, SSL version 2 will not be used at the "encrypt" security level
! and higher. </p>
! 
! <p> See the documentation of the <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> parameter and
! <a href="TLS_README.html">TLS_README</a> for more information about security levels. </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = TLSv1
! # Alternative form with Postfix &ge; 2.5:
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
! </pre>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_note_starttls_offer">smtp_tls_note_starttls_offer</a>
! (default: no)</b></DT><DD>
! 
! <p> Log the hostname of a remote SMTP server that offers STARTTLS,
! when TLS is not already enabled for that server. </p>
! 
! <p> The logfile record looks like:  </p>
! 
! <pre>
! postfix/smtp[pid]:  Host offered STARTTLS: [name.of.host]
! </pre>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_per_site">smtp_tls_per_site</a>
! (default: empty)</b></DT><DD>
! 
! <p> Optional lookup tables with the Postfix SMTP client TLS usage
! policy by next-hop destination and by remote SMTP server hostname.
! When both lookups succeed, the more specific per-site policy (NONE,
! MUST, etc) overrides the less specific one (MAY), and the more secure
! per-site policy (MUST, etc) overrides the less secure one (NONE).
! With Postfix 2.3 and later <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> is strongly discouraged:
! use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
! 
! <p> Use of the bare hostname as the per-site table lookup key is
! discouraged. Always use the full destination nexthop (enclosed in
! [] with a possible ":port" suffix). A recipient domain or MX-enabled
! transport next-hop with no port suffix may look like a bare hostname,
! but is still a suitable <i>destination</i>. </p>
! 
! <p> Specify a next-hop destination or server hostname on the left-hand
! side; no wildcards are allowed. The next-hop destination is either
! the recipient domain, or the destination specified with a <a href="transport.5.html">transport(5)</a>
! table, the <a href="postconf.5.html#relayhost">relayhost</a> parameter, or the <a href="postconf.5.html#relay_transport">relay_transport</a> parameter.
! On the right hand side specify one of the following keywords:  </p>
! 
! <dl>
! 
! <dt> NONE </dt> <dd> Don't use TLS at all. This overrides a less
! specific <b>MAY</b> lookup result from the alternate host or next-hop
! lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>,
! and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings. </dd>
! 
! <dt> MAY </dt> <dd> Try to use TLS if the server announces support,
! otherwise use the unencrypted connection. This has less precedence
! than a more specific result (including <b>NONE</b>) from the alternate
! host or next-hop lookup key, and has less precedence than the more
! specific global "<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> = yes" or "<a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
! = yes".  </dd>
! 
! <dt> MUST_NOPEERMATCH </dt> <dd> Require TLS encryption, but do not
! require that the remote SMTP server hostname matches the information
! in the remote SMTP server certificate, or that the server certificate
! was issued by a trusted CA. This overrides a less secure <b>NONE</b>
! or a less specific <b>MAY</b> lookup result from the alternate host
! or next-hop lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>,
! <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings.  </dd>
! 
! <dt> MUST </dt> <dd> Require TLS encryption, require that the remote
! SMTP server hostname matches the information in the remote SMTP
! server certificate, and require that the remote SMTP server certificate
! was issued by a trusted CA. This overrides a less secure <b>NONE</b>
! and <b>MUST_NOPEERMATCH</b> or a less specific <b>MAY</b> lookup
! result from the alternate host or next-hop lookup key, and overrides
! the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
! settings.  </dd>
! 
! </dl>
! 
! <p> The above keywords correspond to the "none", "may", "encrypt" and
! "verify" security levels for the new <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> parameter
! introduced in Postfix 2.3. Starting with Postfix 2.3, and independently
! of how the policy is specified, the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters apply when TLS encryption
! is mandatory. Connections for which encryption is optional typically
! enable all "export" grade and better ciphers (see <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>
! and <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>). </p>
! 
! <p> As long as no secure DNS lookup mechanism is available, false
! hostnames in MX or CNAME responses can change the server hostname
! that Postfix uses for TLS policy lookup and server certificate
! verification. Even with a perfect match between the server hostname and
! the server certificate, there is no guarantee that Postfix is connected
! to the right server.  See <a href="TLS_README.html">TLS_README</a> (Closing a DNS loophole with obsolete
! per-site TLS policies) for a possible work-around. </p>
! 
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_policy_maps">smtp_tls_policy_maps</a>
! (default: empty)</b></DT><DD>
! 
! <p> Optional lookup tables with the Postfix SMTP client TLS security
! policy by next-hop destination; when a non-empty value is specified,
! this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter.  See
! <a href="TLS_README.html">TLS_README</a> for a more detailed discussion of TLS security levels.
! </p>
! 
! <p> The TLS policy table is indexed by the full next-hop destination,
! which is either the recipient domain, or the verbatim next-hop
! specified in the transport table, $<a href="postconf.5.html#local_transport">local_transport</a>, $<a href="postconf.5.html#virtual_transport">virtual_transport</a>,
! $<a href="postconf.5.html#relay_transport">relay_transport</a> or $<a href="postconf.5.html#default_transport">default_transport</a>. This includes any enclosing
! square brackets and any non-default destination server port suffix. The
! LMTP socket type prefix (inet: or unix:) is not included in the lookup
! key. </p>
! 
! <p> Only the next-hop domain, or $<a href="postconf.5.html#myhostname">myhostname</a> with LMTP over UNIX-domain
! sockets, is used as the nexthop name for certificate verification. The
! port and any enclosing square brackets are used in the table lookup key,
! but are not used for server name verification. </p>
! 
! <p> When the lookup key is a domain name without enclosing square brackets
! or any <i>:port</i> suffix (typically the recipient domain), and the full
! domain is not found in the table, just as with the <a href="transport.5.html">transport(5)</a> table,
! the parent domain starting with a leading "." is matched recursively. This
! allows one to specify a security policy for a recipient domain and all
! its sub-domains. </p>
! 
! <p> The lookup result is a security level, followed by an optional list
! of whitespace and/or comma separated name=value attributes that override
! related <a href="postconf.5.html">main.cf</a> settings. The TLS security levels in order of increasing
! security are: </p>
! 
! <dl>
! 
! <dt><b>none</b></dt>
! <dd>No TLS. No additional attributes are supported at this level. </dd>
! 
! <dt><b>may</b></dt>
! <dd>Opportunistic TLS. Since sending in the clear is acceptable,
! demanding stronger than default TLS security merely reduces
! inter-operability. The optional "ciphers", "exclude" and "protocols"
! attributes (available for opportunistic TLS with Postfix &ge; 2.6)
! override the "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>", "<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>" and
! "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>" configuration parameters. When opportunistic TLS
! handshakes fail, Postfix retries the connection with TLS disabled.
! This allows mail delivery to sites with non-interoperable TLS
! implementations.</dd>
! 
! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. At this level
! and higher, the optional "protocols" attribute overrides the <a href="postconf.5.html">main.cf</a>
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameter, the optional "ciphers" attribute
! overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter, and the
! optional "exclude" attribute (Postfix &ge; 2.6) overrides the <a href="postconf.5.html">main.cf</a>
! <a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> parameter. In the policy table,
! multiple protocols or excluded ciphers must be separated by colons,
! as attribute values may not contain whitespace or commas. </dd>
! 
! <dt><b>fingerprint</b></dt> <dd>Certificate fingerprint
! verification. Available with Postfix 2.5 and later. At this security
! level, there are no trusted certificate authorities. The certificate
! trust chain, expiration date, ... are not checked. Instead,
! the optional <b>match</b> attribute, or else the <a href="postconf.5.html">main.cf</a>
! <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter, lists the certificate
! fingerprints or the public key fingerprint (Postfix 2.9 and later)
! of the valid server certificate. The digest
! algorithm used to calculate the fingerprint is selected by the
! <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. Multiple fingerprints can
! be combined with a "|" delimiter in a single match attribute, or multiple
! match attributes can be employed. The ":" character is not used as a
! delimiter as it occurs between each pair of fingerprint (hexadecimal)
! digits. </dd>
! 
! <dt><b>verify</b></dt> <dd>Mandatory TLS verification.  At this security
! level, DNS MX lookups are trusted to be secure enough, and the name
! verified in the server certificate is usually obtained indirectly via
! unauthenticated DNS MX lookups.  The optional "match" attribute overrides
! the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> parameter. In the policy table,
! multiple match patterns and strategies must be separated by colons.
! In practice explicit control over matching is more common with the
! "secure" policy, described below. </dd>
! 
! <dt><b>secure</b></dt> <dd>Secure-channel TLS. At this security level, DNS
! MX lookups, though potentially used to determine the candidate next-hop
! gateway IP addresses, are <b>not</b> trusted to be secure enough for TLS
! peername verification. Instead, the default name verified in the server
! certificate is obtained directly from the next-hop, or is explicitly
! specified via the optional <b>match</b> attribute which overrides the
! <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> parameter. In the policy table,
! multiple match patterns and strategies must be separated by colons.
! The match attribute is most useful when multiple domains are supported by
! common server, the policy entries for additional domains specify matching
! rules for the primary domain certificate. While transport table overrides
! routing the secondary domains to the primary nexthop also allow secure
! verification, they risk delivery to the wrong destination when domains
! change hands or are re-assigned to new gateways. With the "match"
! attribute approach, routing is not perturbed, and mail is deferred if
! verification of a new MX host fails. </dd>
! 
! </dl>
! 
! <p>
! Example:
! </p>
! 
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = hash:/etc/postfix/tls_policy
!     # Postfix 2.5 and later
!     <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
! </pre>
! 
! <pre>
! /etc/postfix/tls_policy:
!     example.edu                 none
!     example.mil                 may
!     example.gov                 encrypt protocols=TLSv1
!     example.com                 verify ciphers=high
!     example.net                 secure
!     .example.net                secure match=.example.net:example.net
!     [mail.example.org]:587      secure match=nexthop
!     # Postfix 2.5 and later
!     [thumb.example.org]          fingerprint
!     	match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
! 	match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
! </pre>
! 
! <p> <b>Note:</b> The <b>hostname</b> strategy if listed in a non-default
! setting of <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> or in the <b>match</b> attribute
! in the policy table can render the <b>secure</b> level vulnerable to
! DNS forgery. Do not use the <b>hostname</b> strategy for secure-channel
! configurations in environments where DNS security is not assured. </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_protocols">smtp_tls_protocols</a>
! (default: !SSLv2)</b></DT><DD>
! 
! <p> List of TLS protocols that the Postfix SMTP client will exclude or
! include with opportunistic TLS encryption. Starting with Postfix 2.6,
! the Postfix SMTP client will by default not use the obsolete SSLv2
! protocol. </p>
! 
! <p> In <a href="postconf.5.html">main.cf</a> the values are separated by whitespace, commas or
! colons. In the policy table (see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid
! separator is colon. An empty value means allow all protocols. The valid
! protocol names, (see <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3"
! and "TLSv1". </p>
! 
! <p> To include a protocol list its name, to exclude it, prefix the name
! with a "!" character. To exclude SSLv2 even for opportunistic TLS set
! "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
! "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3". Explicitly listing the protocols to
! include, is supported, but not recommended. OpenSSL provides no mechanisms
! for excluding protocols not known at compile-time. If Postfix is linked
! against an OpenSSL library that supports additional protocol versions,
! they cannot be excluded using either syntax. </p>
! 
! <p> Example: </p>
! <pre>
! # TLSv1 only!
! <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3
! </pre>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>
! (default: 9)</b></DT><DD>
! 
! <p> The verification depth for remote SMTP server certificates. A depth
! of 1 is sufficient if the issuing CA is listed in a local CA file. </p>
! 
! <p> The default verification depth is 9 (the OpenSSL default) for
! compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
! the default value was 5, but the limit was not actually enforced. If
! you have set this to a lower non-default value, certificates with longer
! trust chains may now fail to verify. Certificate chains with 1 or 2
! CAs are common, deeper chains are more rare and any number between 5
! and 9 should suffice in practice. You can choose a lower number if,
! for example, you trust certificates directly signed by an issuing CA
! but not any CAs it delegates to. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a>
! (default: nexthop, dot-nexthop)</b></DT><DD>
! 
! <p> How the Postfix SMTP client verifies the server certificate
! peername for the
! "secure" TLS security level. In a "secure" TLS policy table
! ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
! overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
! 
! <p> This parameter specifies one or more patterns or strategies separated
! by commas, whitespace or colons.  In the policy table the only valid
! separator is the colon character. </p>
! 
! <p> For a description of the pattern and strategy syntax see the
! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> parameter. The "hostname" strategy should
! be avoided in this context, as in the absence of a secure global DNS, using
! the results of MX lookups in certificate verification is not immune to active
! (man-in-the-middle) attacks on DNS. </p>
! 
! <p>
! Sample <a href="postconf.5.html">main.cf</a> setting:
! </p>
! 
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop
! </pre>
! </blockquote>
! 
! <p>
! Sample policy table override:
! </p>
! 
! <blockquote>
! <pre>
! example.net     secure match=example.com:.example.com
! .example.net    secure match=example.com:.example.com
! </pre>
! </blockquote>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_security_level">smtp_tls_security_level</a>
! (default: empty)</b></DT><DD>
! 
! <p> The default SMTP TLS security level for the Postfix SMTP client;
! when a non-empty value is specified, this overrides the obsolete
! parameters <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>, and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>.
! </p>
! 
! <p> Specify one of the following security levels: </p>
! 
! <dl>
! 
! <dt><b>none</b></dt> <dd> TLS will not be used unless enabled for specific
! destinations via <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>. </dd>
! 
! <dt><b>may</b></dt>
! <dd> Opportunistic TLS. Use TLS if this is supported by the remote
! SMTP server, otherwise use plaintext. Since
! sending in the clear is acceptable, demanding stronger than default TLS
! security merely reduces inter-operability.
! The "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>" and "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>" (Postfix &ge; 2.6)
! configuration parameters provide control over the protocols and
! cipher grade used with opportunistic TLS.  With earlier releases the
! opportunistic TLS cipher grade is always "export" and no protocols
! are disabled.
! When TLS handshakes fail, the connection is retried with TLS disabled.
! This allows mail delivery to sites with non-interoperable TLS
! implementations. </dd>
! 
! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. Since a minimum
! level of security is intended, it is reasonable to be specific about
! sufficiently secure protocol versions and ciphers. At this security level
! and higher, the <a href="postconf.5.html">main.cf</a> parameters <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> specify the TLS protocols and minimum
! cipher grade which the administrator considers secure enough for
! mandatory encrypted sessions. This security level is not an appropriate
! default for systems delivering mail to the Internet. </dd>
! 
! <dt><b>fingerprint</b></dt> <dd>Certificate fingerprint
! verification. Available with Postfix 2.5 and later. At this security
! level, there are no trusted certificate authorities. The certificate
! trust chain, expiration date, ... are not checked. Instead, the
! <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter lists the certificate
! fingerprint or public key fingerprint (Postfix 2.9 and later) of
! the valid server certificate. The digest
! algorithm used to calculate the fingerprint is selected by the
! <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. </dd>
! 
! <dt><b>verify</b></dt> <dd>Mandatory TLS verification. At this security
! level, DNS MX lookups are trusted to be secure enough, and the name
! verified in the server certificate is usually obtained indirectly
! via unauthenticated DNS MX lookups. The <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
! parameter controls how the server name is verified. In practice explicit
! control over matching is more common at the "secure" level, described
! below. This security level is not an appropriate default for systems
! delivering mail to the Internet. </dd>
! 
! <dt><b>secure</b></dt> <dd>Secure-channel TLS.  At this security level,
! DNS MX lookups, though potentially used to determine the candidate
! next-hop gateway IP addresses, are <b>not</b> trusted to be secure enough
! for TLS peername verification. Instead, the default name verified in
! the server certificate is obtained from the next-hop domain as specified
! in the <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> configuration parameter. The default
! matching rule is that a server certificate matches when its name is equal
! to or is a sub-domain of the nexthop domain. This security level is not
! an appropriate default for systems delivering mail to the Internet. </dd>
! 
! </dl>
! 
! <p>
! Examples:
! </p>
! 
! <pre>
! # No TLS. Formerly: <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>=no and <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>=no.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = none
! </pre>
! 
! <pre>
! # Opportunistic TLS.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = may
! # Postfix &ge; 2.6:
! # Do not tweak opportunistic ciphers or protocol unless it is essential
! # to do so (if a security vulnerability is found in the SSL library that
! # can be mitigated by disabling a particular protocol or raising the
! # cipher grade from "export" to "low" or "medium").
! <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = export
! <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2
! </pre>
! 
! <pre>
! # Mandatory (high-grade) TLS encryption.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = encrypt
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
! </pre>
! 
! <pre>
! # Mandatory TLS verification of hostname or nexthop domain.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = verify
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> = hostname, nexthop, dot-nexthop
! </pre>
! 
! <pre>
! # Secure channel TLS with exact nexthop name match.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = secure
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = TLSv1
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
! <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop
! </pre>
! 
! <pre>
! # Certificate fingerprint verification (Postfix &ge; 2.5).
! # The CA-less "fingerprint" security level only scales to a limited
! # number of destinations. As a global default rather than a per-site
! # setting, this is practical when mail for all recipients is sent
! # to a central mail hub.
! <a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
! <a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
!     3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
!     EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
! </pre>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
! (default: empty)</b></DT><DD>
! 
! <p> Name of the file containing the optional Postfix SMTP client
! TLS session cache. Specify a database type that supports enumeration,
! such as <b>btree</b> or <b>sdbm</b>; there is no need to support
! concurrent access.  The file is created if it does not exist. The <a href="smtp.8.html">smtp(8)</a>
! daemon does not use this parameter directly, rather the cache is
! implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
! per-smtp-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not effective.
! Note, that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon:
! $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
! (and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to
! be stored separately. It is not at this time possible to store multiple
! caches in a single database. </p>
! 
! <p> Note: <b>dbm</b> databases are not suitable. TLS
! session objects are too large. </p>
! 
! <p> As of version 2.5, Postfix no longer uses root privileges when
! opening this file. The file should now be stored under the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
! under a non-Postfix directory is redirected to the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a> = btree:/var/lib/postfix/smtp_scache
! </pre>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a>
! (default: 3600s)</b></DT><DD>
! 
! <p> The expiration time of Postfix SMTP client TLS session cache
! information.  A cache cleanup is performed periodically
! every $<a href="postconf.5.html#smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a> seconds. As with
! $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>, this parameter is implemented in the
! <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtp-instance <a href="master.5.html">master.cf</a> overrides
! are not possible. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
! (default: hostname)</b></DT><DD>
! 
! <p> How the Postfix SMTP client verifies the server certificate
! peername for the
! "verify" TLS security level. In a "verify" TLS policy table
! ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
! overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
! 
! <p> This parameter specifies one or more patterns or strategies separated
! by commas, whitespace or colons.  In the policy table the only valid
! separator is the colon character. </p>
! 
! <p> Patterns specify domain names, or domain name suffixes: </p>
! 
! <dl>
! 
! <dt><i>example.com</i></dt> <dd> Match the <i>example.com</i> domain,
! i.e. one of the names the server certificate must be <i>example.com</i>,
! upper and lower case distinctions are ignored. </dd>
! 
! <dt><i>.example.com</i></dt>
! <dd> Match subdomains of the <i>example.com</i> domain, i.e. match
! a name in the server certificate that consists of a non-zero number of
! labels followed by a <i>.example.com</i> suffix. Case distinctions are
! ignored.</dd>
! 
! </dl>
! 
! <p> Strategies specify a transformation from the next-hop domain
! to the expected name in the server certificate: </p>
! 
! <dl>
! 
! <dt>nexthop</dt>
! <dd> Match against the next-hop domain, which is either the recipient
! domain, or the transport next-hop configured for the domain stripped of
! any optional socket type prefix, enclosing square brackets and trailing
! port. When MX lookups are not suppressed, this is the original nexthop
! domain prior to the MX lookup, not the result of the MX lookup. For
! LMTP delivery via UNIX-domain sockets, the verified next-hop name is
! $<a href="postconf.5.html#myhostname">myhostname</a>.  This strategy is suitable for use with the "secure"
! policy. Case is ignored.</dd>
! 
! <dt>dot-nexthop</dt>
! <dd> As above, but match server certificate names that are subdomains
! of the next-hop domain. Case is ignored.</dd>
! 
! <dt>hostname</dt> <dd> Match against the hostname of the server, often
! obtained via an unauthenticated DNS MX lookup. For LMTP delivery via
! UNIX-domain sockets, the verified name is $<a href="postconf.5.html#myhostname">myhostname</a>. This matches
! the verification strategy of the "MUST" keyword in the obsolete
! <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table, and is suitable for use with the "verify"
! security level. When the next-hop name is enclosed in square brackets
! to suppress MX lookups, the "hostname" strategy is the same as the
! "nexthop" strategy. Case is ignored.</dd>
! 
! </dl>
! 
! <p>
! Sample <a href="postconf.5.html">main.cf</a> setting:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> = hostname, nexthop, dot-nexthop
! </pre>
! 
! <p>
! Sample policy table override:
! </p>
! 
! <pre>
! example.com     verify  match=hostname:nexthop
! .example.com    verify  match=example.com:.example.com:hostname
! </pre>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_use_tls">smtp_use_tls</a>
! (default: no)</b></DT><DD>
! 
! <p> Opportunistic mode: use TLS when a remote SMTP server announces
! STARTTLS support, otherwise send the mail in the clear. Beware:
! some SMTP servers offer STARTTLS even if it is not configured.  With
! Postfix &lt; 2.3, if the TLS handshake fails, and no other server is
! available, delivery is deferred and mail stays in the queue. If this
! is a concern for you, use the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> feature instead.  </p>
! 
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtp_xforward_timeout">smtp_xforward_timeout</a>
! (default: 300s)</b></DT><DD>
! 
! <p>
! The Postfix SMTP client time limit for sending the XFORWARD command,
! and for receiving the remote SMTP server response.
! </p>
! 
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
! 
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a>
! (default: $<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b></DT><DD>
! 
! <p> What remote SMTP clients are allowed to specify the XVERP command.
! This command requests that mail be delivered one recipient at a
! time with a per recipient return address.  </p>
! 
! <p> By default, no clients are allowed to specify XVERP.  </p>
! 
! <p> This parameter was renamed with Postfix version 2.1. The default value
! is backwards compatible with Postfix version 2.0.  </p>
! 
! <p> Specify a list of network/netmask patterns, separated by commas
! and/or whitespace. The mask specifies the number of bits in the
! network part of a host address. You can also specify hostnames or
! .domain names (the initial dot causes the domain to match any name
! below it),  "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns.  A "/file/name"
! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
! is matched when a table entry matches a lookup string (the lookup
! result is ignored).  Continue long lines by starting the next line
! with whitespace. Specify "!pattern" to exclude an address or network
! block from the list. The form "!/file/name" is supported only in
! Postfix version 2.4 and later.  </p>
! 
! <p> Note: IP version 6 address information must be specified inside
! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> value, and in
! files specified with "/file/name".  IP version 6 addresses contain
! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
! pattern.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a>
! (default: empty)</b></DT><DD>
! 
! <p>
! What remote SMTP clients are allowed to use the XCLIENT feature.  This
! command overrides remote SMTP client information that is used for access
! control. Typical use is for SMTP-based content filters, fetchmail-like
! programs, or SMTP server access rule testing. See the <a href="XCLIENT_README.html">XCLIENT_README</a>
! document for details.
! </p>
! 
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
! 
! <p>
! By default, no clients are allowed to specify XCLIENT.
! </p>
! 
! <p>
! Specify a list of network/netmask patterns, separated by commas
! and/or whitespace. The mask specifies the number of bits in the
! network part of a host address. You can also specify hostnames or
! .domain names (the initial dot causes the domain to match any name
! below it),  "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns.  A "/file/name"
! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
! is matched when a table entry matches a lookup string (the lookup
! result is ignored).  Continue long lines by starting the next line
! with whitespace. Specify "!pattern" to exclude an address or network
! block from the list. The form "!/file/name" is supported only in
! Postfix version 2.4 and later.  </p>
! 
! <p> Note: IP version 6 address information must be specified inside
! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a> value, and in
! files specified with "/file/name".  IP version 6 addresses contain
! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
! pattern.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a>
! (default: empty)</b></DT><DD>
! 
! <p>
! What remote SMTP clients are allowed to use the XFORWARD feature.  This
! command forwards information that is used to improve logging after
! SMTP-based content filters. See the <a href="XFORWARD_README.html">XFORWARD_README</a> document for
! details.
! </p>
! 
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
! 
! <p>
! By default, no clients are allowed to specify XFORWARD.
! </p>
! 
! <p>
! Specify a list of network/netmask patterns, separated by commas
! and/or whitespace. The mask specifies the number of bits in the
! network part of a host address. You can also specify hostnames or
! .domain names (the initial dot causes the domain to match any name
! below it),  "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns.  A "/file/name"
! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
! is matched when a table entry matches a lookup string (the lookup
! result is ignored).  Continue long lines by starting the next line
! with whitespace. Specify "!pattern" to exclude an address or network
! block from the list. The form "!/file/name" is supported only in
! Postfix version 2.4 and later.  </p>
! 
! <p> Note: IP version 6 address information must be specified inside
! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a> value, and in
! files specified with "/file/name".  IP version 6 addresses contain
! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
! pattern.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_banner">smtpd_banner</a>
! (default: $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a>)</b></DT><DD>
! 
! <p>
! The text that follows the 220 status code in the SMTP greeting
! banner. Some people like to see the mail version advertised. By
! default, Postfix shows no version.
! </p>
! 
! <p>
! You MUST specify $<a href="postconf.5.html#myhostname">myhostname</a> at the start of the text. This is
! required by the SMTP protocol.
! </p>
! 
! <p>
! Example:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtpd_banner">smtpd_banner</a> = $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a> ($<a href="postconf.5.html#mail_version">mail_version</a>)
! </pre>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>
! (default: 50)</b></DT><DD>
! 
! <p>
! How many simultaneous connections any client is allowed to
! make to this service.  By default, the limit is set to half
! the default process limit value.
! </p>
! 
! <p>
! To disable this feature, specify a limit of 0.
! </p>
! 
! <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
! </p>
! 
! <p>
! This feature is available in Postfix 2.2 and later.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a>
! (default: 0)</b></DT><DD>
! 
! <p>
! The maximal number of connection attempts any client is allowed to
! make to this service per time unit.  The time unit is specified
! with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
! </p>
! 
! <p>
! By default, a client can make as many connections per time unit as
! Postfix can accept.
! </p>
! 
! <p>
! To disable this feature, specify a limit of 0.
! </p>
! 
! <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
! </p>
! 
! <p>
! This feature is available in Postfix 2.2 and later.
! </p>
! 
! <p>
! Example:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a> = 1000
! </pre>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a>
! (default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD>
! 
! <p>
! Clients that are excluded from smtpd_client_*_count/rate_limit
! restrictions. See the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter
! description for the parameter value syntax.
! </p>
! 
! <p>
! By default, clients in trusted networks are excluded. Specify a
! list of network blocks, hostnames or .domain names (the initial
! dot causes the domain to match any name below it).
! </p>
! 
! <p> Note: IP version 6 address information must be specified inside
! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a> value, and
! in files specified with "/file/name".  IP version 6 addresses
! contain the ":" character, and would otherwise be confused with a
! "<a href="DATABASE_README.html">type:table</a>" pattern.  </p>
! 
! <p>
! This feature is available in Postfix 2.2 and later.
! </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a>
! (default: 0)</b></DT><DD>
! 
! <p>
! The maximal number of message delivery requests that any client is
! allowed to make to this service per time unit, regardless of whether
! or not Postfix actually accepts those messages.  The time unit is
! specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
! </p>
! 
! <p>
! By default, a client can send as many message delivery requests
! per time unit as Postfix can accept.
! </p>
! 
! <p>
! To disable this feature, specify a limit of 0.
! </p>
! 
! <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
! </p>
! 
! <p>
! This feature is available in Postfix 2.2 and later.
! </p>
! 
! <p>
! Example:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a> = 1000
! </pre>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a>
! (default: 0)</b></DT><DD>
! 
! <p>
! The maximal number of new (i.e., uncached) TLS sessions that a
! remote SMTP client is allowed to negotiate with this service per
! time unit.  The time unit is specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a>
! configuration parameter.
! </p>
! 
! <p>
! By default, a remote SMTP client can negotiate as many new TLS
! sessions per time unit as Postfix can accept.
! </p>
! 
! <p>
! To disable this feature, specify a limit of 0. Otherwise, specify
! a limit that is at least the per-client concurrent session limit,
! or else legitimate client sessions may be rejected.
! </p>
! 
! <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
! </p>
! 
! <p>
! This feature is available in Postfix 2.3 and later.
! </p>
! 
! <p>
! Example:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a> = 100
! </pre>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_client_port_logging">smtpd_client_port_logging</a>
! (default: no)</b></DT><DD>
! 
! <p> Enable logging of the remote SMTP client port in addition to
! the hostname and IP address. The logging format is "host[address]:port".
! </p>
! 
! <p> This feature is available in Postfix 2.5 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a>
! (default: 0)</b></DT><DD>
! 
! <p>
! The maximal number of recipient addresses that any client is allowed
! to send to this service per time unit, regardless of whether or not
! Postfix actually accepts those recipients.  The time unit is specified
! with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
! </p>
! 
! <p>
! By default, a client can send as many recipient addresses per time
! unit as Postfix can accept.
! </p>
! 
! <p>
! To disable this feature, specify a limit of 0.
! </p>
! 
! <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
! </p>
! 
! <p>
! This feature is available in Postfix 2.2 and later.
! </p>
! 
! <p>
! Example:
! </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a> = 1000
! </pre>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_client_restrictions">smtpd_client_restrictions</a>
! (default: empty)</b></DT><DD>
! 
! <p>
! Optional Postfix SMTP server access restrictions in the context of
! a remote SMTP client connection request.
! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
! restriction lists" for a discussion of evaluation context and time.
! </p>
! 
! <p>
! The default is to allow all connection requests.
! </p>
! 
! <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
! </p>
! 
! <p>
! The following restrictions are specific to client hostname or
! client network address information.
! </p>
! 
! <dl>
! 
! <dt><b><a name="check_ccert_access">check_ccert_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
! 
! <dd> Use the remote SMTP client certificate fingerprint or the public key
! fingerprint (Postfix 2.9 and later) as lookup key for the specified
! <a href="access.5.html">access(5)</a> database; with Postfix version 2.2, also require that the
! remote SMTP client certificate is verified successfully.
! The fingerprint digest algorithm is configurable via the
! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
! Postfix version 2.5).  This feature is available with Postfix version
! 2.2 and later. </dd>
! 
! <dt><b><a name="check_client_access">check_client_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
! 
! <dd>Search the specified access database for the client hostname,
! parent domains, client IP address, or networks obtained by stripping
! least significant octets. See the <a href="access.5.html">access(5)</a> manual page for details. </dd>
! 
! <dt><b><a name="check_client_mx_access">check_client_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
! 
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for the
! client hostname, and execute the corresponding action.  Note: a result
! of "OK" is not allowed for safety reasons. Instead, use DUNNO in order
! to exclude specific hosts from blacklists.  This feature is available
! in Postfix 2.7 and later.  </dd>
! 
! <dt><b><a name="check_client_ns_access">check_client_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
! 
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers for
! the client hostname, and execute the corresponding action.  Note: a
! result of "OK" is not allowed for safety reasons. Instead, use DUNNO
! in order to exclude specific hosts from blacklists.  This feature is
! available in Postfix 2.7 and later.  </dd>
! 
! <dt><b><a name="check_reverse_client_hostname_access">check_reverse_client_hostname_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
! 
! <dd>Search the specified access database for the unverified reverse
! client hostname, parent domains, client IP address, or networks
! obtained by stripping least significant octets. See the <a href="access.5.html">access(5)</a>
! manual page for details.  Note: a result of "OK" is not allowed for
! safety reasons.  Instead, use DUNNO in order to exclude specific
! hosts from blacklists.  This feature is available in Postfix 2.6
! and later.</dd>
! 
! <dt><b><a name="check_reverse_client_hostname_mx_access">check_reverse_client_hostname_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
! 
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for the
! unverified reverse client hostname, and execute the corresponding
! action.  Note: a result of "OK" is not allowed for safety reasons.
! Instead, use DUNNO in order to exclude specific hosts from blacklists.
! This feature is available in Postfix 2.7 and later.  </dd>
! 
! <dt><b><a name="check_reverse_client_hostname_ns_access">check_reverse_client_hostname_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
! 
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers for
! the unverified reverse client hostname, and execute the corresponding
! action.  Note: a result of "OK" is not allowed for safety reasons.
! Instead, use DUNNO in order to exclude specific hosts from blacklists.
! This feature is available in Postfix 2.7 and later.  </dd>
! 
! <dt><b><a name="permit_inet_interfaces">permit_inet_interfaces</a></b></dt>
! 
! <dd>Permit the request when the client IP address matches
! $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>. </dd>
! 
! <dt><b><a name="permit_mynetworks">permit_mynetworks</a></b></dt>
! 
! <dd>Permit the request when the client IP address matches any
! network or network address listed in  $<a href="postconf.5.html#mynetworks">mynetworks</a>. </dd>
! 
! <dt><b><a name="permit_sasl_authenticated">permit_sasl_authenticated</a></b></dt>
! 
! <dd> Permit the request when the client is successfully
! authenticated via the <a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH) protocol. </dd>
! 
! <dt><b><a name="permit_tls_all_clientcerts">permit_tls_all_clientcerts</a></b></dt>
! 
! <dd> Permit the request when the remote SMTP client certificate is
! verified successfully.  This option must be used only if a special
! CA issues the certificates and only this CA is listed as trusted
! CA. Otherwise, clients with a third-party certificate would also
! be allowed to relay.  Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" when the
! trusted CA is specified with <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> or <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>,
! to prevent Postfix from appending the system-supplied default CAs.
! This feature is available with Postfix version 2.2.</dd>
! 
! <dt><b><a name="permit_tls_clientcerts">permit_tls_clientcerts</a></b></dt>
! 
! <dd>Permit the request when the remote SMTP client certificate
! fingerprint or public key fingerprint (Postfix 2.9 and later) is
! listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
! The fingerprint digest algorithm is configurable via the
! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
! Postfix version 2.5).  This feature is available with Postfix version
! 2.2. </dd>
! 
! <dt><b><a name="reject_rbl_client">reject_rbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Reject the request when the reversed client network address is
! listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
! (Postfix version 2.1 and later only).  Each "<i>d</i>" is a number,
! or a pattern inside "[]" that contains one or more ";"-separated
! numbers or number..number ranges (Postfix version 2.8 and later).
! If no "<i>=d.d.d.d</i>" is specified, reject the request when the
! reversed client network address is listed with any A record under
! <i>rbl_domain</i>. <br>
! The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
! rejected requests (default:  554), the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a>  parameter
! specifies the default server reply, and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a>  parameter
! specifies tables with server replies indexed by <i>rbl_domain</i>.
! This feature is available in Postfix 2.0 and later.  </dd>
! 
! <dt><b><a name="permit_dnswl_client">permit_dnswl_client <i>dnswl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Accept the request when the reversed client network address is
! listed with the A record "<i>d.d.d.d</i>" under <i>dnswl_domain</i>.
! Each "<i>d</i>" is a number, or a pattern inside "[]" that contains
! one or more ";"-separated numbers or number..number ranges.
! If no "<i>=d.d.d.d</i>" is specified, accept the request when the
! reversed client network address is listed with any A record under
! <i>dnswl_domain</i>. <br> For safety, <a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a> is silently
! ignored when it would override <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>.  The
! result is DEFER_IF_REJECT when whitelist lookup fails.  This feature
! is available in Postfix 2.8 and later.  </dd>
! 
! <dt><b><a name="reject_rhsbl_client">reject_rhsbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Reject the request when the client hostname is listed with the
! A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
! 2.1 and later only).  Each "<i>d</i>" is a number, or a pattern
! inside "[]" that contains one or more ";"-separated numbers or
! number..number ranges (Postfix version 2.8 and later).  If no
! "<i>=d.d.d.d</i>" is specified, reject the request when the client
! hostname is listed with
! any A record under <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>
! description above for additional RBL related configuration parameters.
! This feature is available in Postfix 2.0 and later; with Postfix
! version 2.8 and later, <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a> will usually
! produce better results.  </dd>
! 
! <dt><b><a name="permit_rhswl_client">permit_rhswl_client <i>rhswl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Accept the request when the client hostname is listed with the
! A record "<i>d.d.d.d</i>" under <i>rhswl_domain</i>.  Each "<i>d</i>"
! is a number, or a pattern inside "[]" that contains one or more
! ";"-separated numbers or number..number ranges. If no
! "<i>=d.d.d.d</i>" is specified, accept the request when the client
! hostname is listed with any A record under <i>rhswl_domain</i>.
! <br> Caution: client name whitelisting is fragile, since the client
! name lookup can fail due to temporary outages.  Client name
! whitelisting should be used only to reduce false positives in e.g.
! DNS-based blocklists, and not for making access rule exceptions.
! <br> For safety, <a href="postconf.5.html#permit_rhswl_client">permit_rhswl_client</a> is silently ignored when it
! would override <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>.  The result is DEFER_IF_REJECT
! when whitelist lookup fails.  This feature is available in Postfix
! 2.8 and later.  </dd>
! 
! <dt><b><a name="reject_rhsbl_reverse_client">reject_rhsbl_reverse_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Reject the request when the unverified reverse client hostname
! is listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>.
! Each "<i>d</i>" is a number, or a pattern inside "[]" that contains
! one or more ";"-separated numbers or number..number ranges.
! If no "<i>=d.d.d.d</i>" is specified, reject the request when the
! unverified reverse client hostname is listed with any A record under
! <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description above for
! additional RBL related configuration parameters.  This feature is
! available in Postfix 2.8 and later.  </dd>
! 
! <dt><b><a name="reject_unknown_client_hostname">reject_unknown_client_hostname</a></b> (with Postfix &lt; 2.3: reject_unknown_client)</dt>
! 
! <dd>Reject the request when 1) the client IP address-&gt;name mapping
! fails, 2) the name-&gt;address mapping fails, or 3) the name-&gt;address
! mapping does not match the client IP address.  <br> This is a
! stronger restriction than the <a href="postconf.5.html#reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a>
! feature, which triggers only under condition 1) above. <br> The
! <a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response code
! for rejected requests (default: 450). The reply is always 450 in
! case the address-&gt;name or name-&gt;address lookup failed due to
! a temporary problem. </dd>
! 
! <dt><b><a name="reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a></b></dt>
! 
! <dd>Reject the request when the client IP address has no address-&gt;name
! mapping. <br> This is a weaker restriction than the
! <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> feature, which requires not only
! that the address-&gt;name and name-&gt;address mappings exist, but
! also that the two mappings reproduce the client IP address.  <br>
! The <a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response
! code for rejected requests (default: 450).  The reply is always 450
! in case the address-&gt;name lookup failed due to a temporary
! problem. <br> This feature is available in Postfix 2.3 and
! later.  </dd>
! 
! </dl>
! 
! <p>
! In addition, you can use any of the following <a name="generic">
! generic</a> restrictions.  These restrictions are applicable in
! any SMTP command context.
! </p>
! 
! <dl>
! 
! <dt><b><a name="check_policy_service">check_policy_service <i>servername</i></a></b></dt>
! 
! <dd>Query the specified policy server. See the <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a>
! document for details. This feature is available in Postfix 2.1
! and later. </dd>
! 
! <dt><b><a name="defer">defer</a></b></dt>
! 
! <dd>Defer the request. The client is told to try again later. This
! restriction is useful at the end of a restriction list, to make
! the default policy explicit. <br> The <a href="postconf.5.html#defer_code">defer_code</a> parameter specifies
! the SMTP server reply code (default: 450).</dd>
! 
! <dt><b><a name="defer_if_permit">defer_if_permit</a></b></dt>
! 
! <dd>Defer the request if some later restriction would result in an
! explicit or implicit PERMIT action.  This is useful when a blacklisting
! feature fails due to a temporary problem.  This feature is available
! in Postfix version 2.1 and later.  </dd>
! 
! <dt><b><a name="defer_if_reject">defer_if_reject</a></b></dt>
! 
! <dd>Defer the request if some later restriction would result in a
! REJECT action.  This is useful when a whitelisting feature fails
! due to a temporary problem.  This feature is available in Postfix
! version 2.1 and later.  </dd>
! 
! <dt><b><a name="permit">permit</a></b></dt>
! 
! <dd>Permit the request. This restriction is useful at the end of
! a restriction list, to make the default policy explicit.</dd>
! 
! <dt><b><a name="reject_multi_recipient_bounce">reject_multi_recipient_bounce</a></b></dt>
! 
! <dd>Reject the request when the envelope sender is the null address,
! and the message has multiple envelope recipients. This usage has
! rare but legitimate applications: under certain conditions,
! multi-recipient mail that was posted with the DSN option NOTIFY=NEVER
! may be forwarded with the null sender address.
! <br> Note: this restriction can only work reliably
! when used in <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> or
! <a href="postconf.5.html#smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>, because the total number of
! recipients is not known at an earlier stage of the SMTP conversation.
! Use at the RCPT stage will only reject the second etc.  recipient.
! <br>
! The <a href="postconf.5.html#multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a> parameter specifies the
! response code for rejected requests (default:  550).  This feature
! is available in Postfix 2.1 and later. </dd>
  
! <dt><b><a name="reject_plaintext_session">reject_plaintext_session</a></b></dt>
  
! <dd>Reject the request when the connection is not encrypted. This
! restriction should not be used before the client has had a chance
! to negotiate encryption with the AUTH or STARTTLS commands.
! <br>
! The <a href="postconf.5.html#plaintext_reject_code">plaintext_reject_code</a> parameter specifies the response
! code for rejected requests (default:  450).  This feature is available
! in Postfix 2.3 and later. </dd>
  
- <dt><b><a name="reject_unauth_pipelining">reject_unauth_pipelining</a></b></dt>
  
! <dd>Reject the request when the client sends SMTP commands ahead
! of time where it is not allowed, or when the client sends SMTP
! commands ahead of time without knowing that Postfix actually supports
! ESMTP command pipelining. This stops mail from bulk mail software
! that improperly uses ESMTP command pipelining in order to speed up
! deliveries.
! <br> With Postfix 2.6 and later, the SMTP server sets a per-session
! flag whenever it detects illegal pipelining, including pipelined
! EHLO or HELO commands. The <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> feature simply
! tests whether the flag was set at any point in time during the
! session.
! <br> With older Postfix versions, <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> checks
! the current status of the input read queue, and its usage is not
! recommended in contexts other than <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a>.  </dd>
  
! <dt><b><a name="reject">reject</a></b></dt>
  
! <dd>Reject the request. This restriction is useful at the end of
! a restriction list, to make the default policy explicit.  The
! <a href="postconf.5.html#reject_code">reject_code</a> configuration parameter specifies the response code for
! rejected requests (default: 554).</dd>
  
! <dt><b><a name="sleep">sleep <i>seconds</i></a></b></dt>
  
! <dd>Pause for the specified number of seconds and proceed with
! the next restriction in the list, if any. This may stop zombie
! mail when used as:
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
!         sleep 1, <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
!     <a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = no
! </pre>
! This feature is available in Postfix 2.3. </dd>
  
- <dt><b><a name="warn_if_reject">warn_if_reject</a></b></dt>
  
! <dd> A safety net for testing. When "<a href="postconf.5.html#warn_if_reject">warn_if_reject</a>" is placed
! before a reject-type restriction, access table query, or
! <a href="postconf.5.html#check_policy_service">check_policy_service</a> query, this logs a "reject_warning" message
! instead of rejecting a request (when a reject-type restriction fails
! due to a temporary error, this logs a "reject_warning" message for
! any implicit "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" actions that would normally prevent
! mail from being accepted by some later access restriction). This
! feature has no effect on <a href="postconf.5.html#defer_if_reject">defer_if_reject</a> restrictions.  </dd>
  
! </dl>
  
! <p>
! Other restrictions that are valid in this context:
! </p>
  
! <ul>
  
! <li> SMTP command specific restrictions that are described under
! the <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>, <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> parameters. When helo, sender or
! recipient restrictions are listed under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>,
! they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> is evaluated at the time of the RCPT TO
! command.
  
! </ul>
  
  <p>
! Example:
  </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a>
  </pre>
  
--- 9190,9352 ----
  
! <dt><b>none</b></dt>
! <dd>No TLS. No additional attributes are supported at this level. </dd>
  
! <dt><b>may</b></dt>
! <dd>Opportunistic TLS. No additional attributes are supported at this
! level. Since sending in the clear is acceptable, demanding stronger
! than default TLS security parameters merely reduces inter-operability.
! Postfix 2.3 and later ignore the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters at this security level; all
! protocols are allowed and "export" grade or better ciphers are used.
! When TLS handshakes fail, the connection is retried with TLS disabled.
! This allows mail delivery to sites with non-interoperable TLS
! implementations.</dd>
  
! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. At this level
! and higher the optional "ciphers" attribute overrides the <a href="postconf.5.html">main.cf</a>
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter and the optional "protocols"
! keyword overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameter.
! In the policy table, multiple protocols must be separated by colons,
! as attribute values may not contain whitespace or commas. </dd>
  
+ <dt><b>fingerprint</b></dt> <dd>Certificate fingerprint
+ verification. Available with Postfix 2.5 and later. At this security
+ level, there are no trusted certificate authorities. The certificate
+ trust chain, expiration date, ... are not checked. Instead,
+ the optional <b>match</b> attribute, or else the <a href="postconf.5.html">main.cf</a>
+ <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter, lists the
+ valid "fingerprints" of the server certificate. The digest
+ algorithm used to calculate the fingerprint is selected by the
+ <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. Multiple fingerprints can
+ be combined with a "|" delimiter in a single match attribute, or multiple
+ match attributes can be employed. The ":" character is not used as a
+ delimiter as it occurs between each pair of fingerprint (hexadecimal)
+ digits. </dd>
  
! <dt><b>verify</b></dt> <dd>Mandatory TLS verification.  At this security
! level, DNS MX lookups are trusted to be secure enough, and the name
! verified in the server certificate is usually obtained indirectly via
! unauthenticated DNS MX lookups.  The optional "match" attribute overrides
! the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> parameter. In the policy table,
! multiple match patterns and strategies must be separated by colons.
! In practice explicit control over matching is more common with the
! "secure" policy, described below. </dd>
  
! <dt><b>secure</b></dt> <dd>Secure-channel TLS. At this security level, DNS
! MX lookups, though potentially used to determine the candidate next-hop
! gateway IP addresses, are <b>not</b> trusted to be secure enough for TLS
! peername verification. Instead, the default name verified in the server
! certificate is obtained directly from the next-hop, or is explicitly
! specified via the optional <b>match</b> attribute which overrides the
! <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> parameter. In the policy table,
! multiple match patterns and strategies must be separated by colons.
! The match attribute is most useful when multiple domains are supported by
! common server, the policy entries for additional domains specify matching
! rules for the primary domain certificate. While transport table overrides
! routing the secondary domains to the primary nexthop also allow secure
! verification, they risk delivery to the wrong destination when domains
! change hands or are re-assigned to new gateways. With the "match"
! attribute approach, routing is not perturbed, and mail is deferred if
! verification of a new MX host fails. </dd>
  
! </dl>
  
  <p>
! Example:
  </p>
  
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = hash:/etc/postfix/tls_policy
!     # Postfix 2.5 and later
!     <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
! </pre>
  
  <pre>
! /etc/postfix/tls_policy:
!     example.edu                 none
!     example.mil                 may
!     example.gov                 encrypt protocols=TLSv1
!     example.com                 verify ciphers=high
!     example.net                 secure
!     .example.net                secure match=.example.net:example.net
!     [mail.example.org]:587      secure match=nexthop
!     # Postfix 2.5 and later
!     [thumb.example.org]          fingerprint
!     	match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
! 	match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
! </pre>
  
! <p> <b>Note:</b> The <b>hostname</b> strategy if listed in a non-default
! setting of <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> or in the <b>match</b> attribute
! in the policy table can render the <b>secure</b> level vulnerable to
! DNS forgery. Do not use the <b>hostname</b> strategy for secure-channel
! configurations in environments where DNS security is not assured. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>
! (default: 9)</b></DT><DD>
  
! <p> The verification depth for remote SMTP server certificates. A depth
! of 1 is sufficient if the issuing CA is listed in a local CA file. </p>
  
! <p> The default verification depth is 9 (the OpenSSL default) for
! compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
! the default value was 5, but the limit was not actually enforced. If
! you have set this to a lower non-default value, certificates with longer
! trust chains may now fail to verify. Certificate chains with 1 or 2
! CAs are common, deeper chains are more rare and any number between 5
! and 9 should suffice in practice. You can choose a lower number if,
! for example, you trust certificates directly signed by an issuing CA
! but not any CAs it delegates to. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a>
! (default: nexthop, dot-nexthop)</b></DT><DD>
  
! <p> The server certificate peername verification method for the
! "secure" TLS security level. In a "secure" TLS policy table
! ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
! overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
  
! <p> This parameter specifies one or more patterns or strategies separated
! by commas, whitespace or colons.  In the policy table the only valid
! separator is the colon character. </p>
  
! <p> For a description of the pattern and strategy syntax see the
! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> parameter. The "hostname" strategy should
! be avoided in this context, as in the absence of a secure global DNS, using
! the results of MX lookups in certificate verification is not immune to active
! (man-in-the-middle) attacks on DNS. </p>
  
! <p>
! Sample <a href="postconf.5.html">main.cf</a> setting:
! </p>
! 
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop
! </pre>
! </blockquote>
  
  <p>
! Sample policy table override:
  </p>
  
+ <blockquote>
  <pre>
! example.net     secure match=example.com:.example.com
! .example.net    secure match=example.com:.example.com
  </pre>
+ </blockquote>
+ 
+ <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 12461,12502 ****
  
! <DT><b><a name="smtpd_command_filter">smtpd_command_filter</a>
  (default: empty)</b></DT><DD>
  
! <p> A mechanism to transform commands from remote SMTP clients.
! This is a last-resort tool to work around client commands that break
! inter-operability with the Postfix SMTP server.  Other uses involve
! fault injection to test Postfix's handling of invalid commands.
  </p>
  
! <p> Specify the name of a "<a href="DATABASE_README.html">type:table</a>" lookup table. The search
! string is the SMTP command as received from the remote SMTP client,
! except that initial whitespace and the trailing &lt;CR&gt;&lt;LF&gt;
! are removed.  The result value is executed by the Postfix SMTP
! server.  </p>
  
! <p> There is no need to use <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> for the following
! cases: </p>
  
! <ul>
  
! <li> <p> Use "<a href="postconf.5.html#resolve_numeric_domain">resolve_numeric_domain</a> = yes" to accept
! "<i>user@ipaddress</i>". </p>
  
! <li> <p> Postfix already accepts the correct form
! "<i>user@[ipaddress]</i>". Use <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> or <a href="postconf.5.html#canonical_maps">canonical_maps</a>
! to translate these into domain names if necessary.  </p>
! 
! <li> <p> Use "<a href="postconf.5.html#strict_rfc821_envelopes">strict_rfc821_envelopes</a> = no" to accept "RCPT TO:&lt;<i>User
! Name &lt;user@example.com&gt;&gt;</i>". Postfix will ignore the "<i>User
! Name</i>" part and deliver to the <i>&lt;user@example.com&gt;</i> address.
! </p>
  
! </ul>
  
! <p> Examples of problems that can be solved with the <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a>
! feature: </p>
  
  <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/command_filter
  </pre>
--- 9355,9428 ----
  
! <DT><b><a name="smtp_tls_security_level">smtp_tls_security_level</a>
  (default: empty)</b></DT><DD>
  
! <p> The default SMTP TLS security level for the Postfix SMTP client;
! when a non-empty value is specified, this overrides the obsolete
! parameters <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>, and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>.
  </p>
  
! <p> Specify one of the following security levels: </p>
! 
! <dl>
  
! <dt><b>none</b></dt> <dd> TLS will not be used unless enabled for specific
! destinations via <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>. </dd>
  
! <dt><b>may</b></dt>
! <dd> Opportunistic TLS. TLS will be used if supported by the server. Since
! sending in the clear is acceptable, demanding stronger than default TLS
! security parameters merely reduces inter-operability. Postfix 2.3 and
! later ignore the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters at this security level; all
! protocols are allowed and "export" grade or better ciphers are used.
! When TLS handshakes fail, the connection is retried with TLS disabled.
! This allows mail delivery to sites with non-interoperable TLS
! implementations. </dd>
  
! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. Since a minimum
! level of security is intended, it reasonable to be specific about
! sufficiently secure protocol versions and ciphers. At this security level
! and higher, the <a href="postconf.5.html">main.cf</a> parameters <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> and
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> specify the TLS protocols and minimum
! cipher grade which the administrator considers secure enough for
! mandatory encrypted sessions. This security level is not an appropriate
! default for systems delivering mail to the Internet. </dd>
  
! <dt><b>fingerprint</b></dt> <dd>Certificate fingerprint
! verification. Available with Postfix 2.5 and later. At this security
! level, there are no trusted certificate authorities. The certificate
! trust chain, expiration date, ... are not checked. Instead,
! the <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter lists
! the valid "fingerprints" of the server certificate. The digest
! algorithm used to calculate the fingerprint is selected by the
! <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. </dd>
  
! <dt><b>verify</b></dt> <dd>Mandatory TLS verification. At this security
! level, DNS MX lookups are trusted to be secure enough, and the name
! verified in the server certificate is usually obtained indirectly
! via unauthenticated DNS MX lookups. The <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
! parameter controls how the server name is verified. In practice explicit
! control over matching is more common at the "secure" level, described
! below. This security level is not an appropriate default for systems
! delivering mail to the Internet. </dd>
! 
! <dt><b>secure</b></dt> <dd>Secure-channel TLS.  At this security level,
! DNS MX lookups, though potentially used to determine the candidate
! next-hop gateway IP addresses, are <b>not</b> trusted to be secure enough
! for TLS peername verification. Instead, the default name verified in
! the server certificate is obtained from the next-hop domain as specified
! in the <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> configuration parameter. The default
! matching rule is that a server certificate matches when its name is equal
! to or is a sub-domain of the nexthop domain. This security level is not
! an appropriate default for systems delivering mail to the Internet. </dd>
! 
! </dl>
  
! <p>
! Examples:
! </p>
  
  <pre>
! # No TLS. Formerly: <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>=no and <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>=no.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = none
  </pre>
***************
*** 12504,12508 ****
  <pre>
! /etc/postfix/command_filter:
!     # Work around clients that send malformed HELO commands.
!     /^HELO\s*$/ HELO domain.invalid
  </pre>
--- 9430,9433 ----
  <pre>
! # Opportunistic TLS.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = may
  </pre>
***************
*** 12510,12513 ****
  <pre>
!     # Work around clients that send empty lines.
!     /^\s*$/     NOOP
  </pre>
--- 9435,9439 ----
  <pre>
! # Mandatory (high-grade) TLS encryption.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = encrypt
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
  </pre>
***************
*** 12515,12519 ****
  <pre>
!     # Work around clients that send RCPT TO:&lt;'user@domain'&gt;.
!     # WARNING: do not lose the parameters that follow the address.
!     /^RCPT\s+TO:\s*&lt;'([^[:space:]]+)'&gt;(.*)/     RCPT TO:&lt;$1&gt;$2
  </pre>
--- 9441,9446 ----
  <pre>
! # Mandatory TLS verification of hostname or nexthop domain.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = verify
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> = hostname, nexthop, dot-nexthop
  </pre>
***************
*** 12521,12525 ****
  <pre>
!     # Append XVERP to MAIL FROM commands to request VERP-style delivery.
!     # See <a href="VERP_README.html">VERP_README</a> for more information on how to use Postfix VERP.
!     /^(MAIL FROM:&lt;listname@example\.com&gt;.*)/   $1 XVERP
  </pre>
--- 9448,9454 ----
  <pre>
! # Secure channel TLS with exact nexthop name match.
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = secure
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = TLSv1
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
! <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop
  </pre>
***************
*** 12527,12535 ****
  <pre>
!     # Bounce-never mail sink. Use <a href="postconf.5.html#notify_classes">notify_classes</a>=bounce,resource,software
!     # to send bounced mail to the postmaster (with message body removed).
!     /^(RCPT\s+TO:.*?)\bNOTIFY=\S+\b(.*)/ $1 NOTIFY=NEVER $2
!     /^(RCPT\s+TO:.*)/                    $1 NOTIFY=NEVER
  </pre>
  
! <p> This feature is available in Postfix 2.7. </p>
  
--- 9456,9472 ----
  <pre>
! # Certificate fingerprint verification (Postfix &ge; 2.5).
! # The CA-less "fingerprint" security level only scales to a limited
! # number of destinations. As a global default rather than a per-site
! # setting, this is practical when mail for all recipients is sent
! # to a central mail hub.
! <a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
! <a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
!     3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
!     EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
  </pre>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 12538,12609 ****
  
! <DT><b><a name="smtpd_data_restrictions">smtpd_data_restrictions</a>
  (default: empty)</b></DT><DD>
  
! <p>
! Optional access restrictions that the Postfix SMTP server applies
! in the context of the SMTP DATA command.
! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
! restriction lists" for a discussion of evaluation context and time.
! </p>
! 
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
! 
! <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
! </p>
! 
! <p>
! The following restrictions are valid in this context:
! </p>
! 
! <ul>
! 
! <li><a href="#generic">Generic</a> restrictions that can be used
! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
! 
! <li>SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
  
! <li>However, no recipient information is available in the case of
! multi-recipient mail. Acting on only one recipient would be misleading,
! because any decision will affect all recipients equally. Acting on
! all recipients would require a possibly very large amount of memory,
! and would also be misleading for the reasons mentioned before.
  
! </ul>
  
! <p>
! Examples:
! </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
! <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipient_bounce</a>
  </pre>
  
! 
! </DD>
! 
! <DT><b><a name="smtpd_delay_open_until_valid_rcpt">smtpd_delay_open_until_valid_rcpt</a>
! (default: yes)</b></DT><DD>
! 
! <p> Postpone the start of an SMTP mail transaction until a valid
! RCPT TO command is received. Specify "no" to create a mail transaction
! as soon as the Postfix SMTP server receives a valid MAIL FROM
! command. </p>
! 
! <p> With sites that reject lots of mail, the default setting reduces
! the use of
! disk, CPU and memory resources. The downside is that rejected
! recipients are logged with NOQUEUE instead of a mail transaction
! ID. This complicates the logfile analysis of multi-recipient mail.
! </p>
! 
! <p> This feature is available in Postfix 2.3 and later. </p>
  
--- 9475,9508 ----
  
! <DT><b><a name="smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
  (default: empty)</b></DT><DD>
  
! <p> Name of the file containing the optional Postfix SMTP client
! TLS session cache. Specify a database type that supports enumeration,
! such as <b>btree</b> or <b>sdbm</b>; there is no need to support
! concurrent access.  The file is created if it does not exist. The <a href="smtp.8.html">smtp(8)</a>
! daemon does not use this parameter directly, rather the cache is
! implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
! per-smtp-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not effective.
! Note, that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon:
! $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
! (and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to
! be stored separately. It is not at this time possible to store multiple
! caches in a single database. </p>
  
! <p> Note: <b>dbm</b> databases are not suitable. TLS
! session objects are too large. </p>
  
! <p> As of version 2.5, Postfix no longer uses root privileges when
! opening this file. The file should now be stored under the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
! under a non-Postfix directory is redirected to the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
  
! <p> Example: </p>
  
  <pre>
! <a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a> = btree:/var/lib/postfix/smtp_scache
  </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 12612,12635 ****
  
! <DT><b><a name="smtpd_delay_reject">smtpd_delay_reject</a>
! (default: yes)</b></DT><DD>
! 
! <p>
! Wait until the RCPT TO command before evaluating
! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
! $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, or wait until the ETRN command before
! evaluating $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
! </p>
  
! <p>
! This feature is turned on by default because some clients apparently
! mis-behave when the Postfix SMTP server rejects commands before
! RCPT TO.
! </p>
  
! <p>
! The default setting has one major benefit: it allows Postfix to log
! recipient address information when rejecting a client name/address
! or sender address, so that it is possible to find out whose mail
! is being rejected.
! </p>
  
--- 9511,9523 ----
  
! <DT><b><a name="smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a>
! (default: 3600s)</b></DT><DD>
  
! <p> The expiration time of Postfix SMTP client TLS session cache
! information.  A cache cleanup is performed periodically
! every $<a href="postconf.5.html#smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a> seconds. As with
! $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>, this parameter is implemented in the
! <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtp-instance <a href="master.5.html">master.cf</a> overrides
! are not possible. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 12638,12691 ****
  
! <DT><b><a name="smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>
! (default: empty)</b></DT><DD>
  
! <p> Lookup tables, indexed by the remote SMTP client address, with
! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
! etc.) that the Postfix SMTP server will not send in the EHLO response
! to a
! remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
! The table is not searched by hostname for robustness reasons.  </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>
! (default: empty)</b></DT><DD>
  
! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
! auth, etc.) that the Postfix SMTP server will not send in the EHLO
! response
! to a remote SMTP client. </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
! <p> Notes: </p>
  
! <ul>
  
! <li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
! this action from being logged. </p>
  
! <li> <p> Use the <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a> feature
! to discard EHLO keywords selectively.  </p>
  
! </ul>
  
  
! </DD>
  
! <DT><b><a name="smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>
! (default: empty)</b></DT><DD>
  
! <p> Optional access restrictions that the Postfix SMTP server
! applies in the context of the SMTP END-OF-DATA command.
! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
! restriction lists" for a discussion of evaluation context and time.
  </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
! <p> See <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> for details and limitations. </p>
  
--- 9526,9603 ----
  
! <DT><b><a name="smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
! (default: hostname)</b></DT><DD>
  
! <p> The server certificate peername verification method for the
! "verify" TLS security level. In a "verify" TLS policy table
! ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
! overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
  
! <p> This parameter specifies one or more patterns or strategies separated
! by commas, whitespace or colons.  In the policy table the only valid
! separator is the colon character. </p>
  
+ <p> Patterns specify domain names, or domain name suffixes: </p>
  
! <dl>
  
! <dt><i>example.com</i></dt> <dd> Match the <i>example.com</i> domain,
! i.e. one of the names the server certificate must be <i>example.com</i>,
! upper and lower case distinctions are ignored. </dd>
  
! <dt><i>.example.com</i></dt>
! <dd> Match subdomains of the <i>example.com</i> domain, i.e. match
! a name in the server certificate that consists of a non-zero number of
! labels followed by a <i>.example.com</i> suffix. Case distinctions are
! ignored.</dd>
  
! </dl>
  
! <p> Strategies specify a transformation from the next-hop domain
! to the expected name in the server certificate: </p>
  
! <dl>
  
! <dt>nexthop</dt>
! <dd> Match against the next-hop domain, which is either the recipient
! domain, or the transport next-hop configured for the domain stripped of
! any optional socket type prefix, enclosing square brackets and trailing
! port. When MX lookups are not suppressed, this is the original nexthop
! domain prior to the MX lookup, not the result of the MX lookup. For
! LMTP delivery via UNIX-domain sockets, the verified next-hop name is
! $<a href="postconf.5.html#myhostname">myhostname</a>.  This strategy is suitable for use with the "secure"
! policy. Case is ignored.</dd>
  
! <dt>dot-nexthop</dt>
! <dd> As above, but match server certificate names that are subdomains
! of the next-hop domain. Case is ignored.</dd>
  
! <dt>hostname</dt> <dd> Match against the hostname of the server, often
! obtained via an unauthenticated DNS MX lookup. For LMTP delivery via
! UNIX-domain sockets, the verified name is $<a href="postconf.5.html#myhostname">myhostname</a>. This matches
! the verification strategy of the "MUST" keyword in the obsolete
! <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table, and is suitable for use with the "verify"
! security level. When the next-hop name is enclosed in square brackets
! to suppress MX lookups, the "hostname" strategy is the same as the
! "nexthop" strategy. Case is ignored.</dd>
  
+ </dl>
  
! <p>
! Sample <a href="postconf.5.html">main.cf</a> setting:
! </p>
  
! <pre>
! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> = hostname, nexthop, dot-nexthop
! </pre>
  
! <p>
! Sample policy table override:
  </p>
  
! <pre>
! example.com     verify  match=hostname:nexthop
! .example.com    verify  match=example.com:.example.com:hostname
! </pre>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 12694,12727 ****
  
! <DT><b><a name="smtpd_enforce_tls">smtpd_enforce_tls</a>
  (default: no)</b></DT><DD>
  
! <p> Mandatory TLS: announce STARTTLS support to remote SMTP clients,
! and require that clients use TLS encryption.  According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a>
! this MUST NOT be applied in case of a publicly-referenced SMTP
! server.  This option is therefore off by default. </p>
! 
! <p> Note 1: "<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> = yes" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes". </p>
! 
! <p> Note 2: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
! STARTTLS due to insufficient privileges to access the server private
! key. This is intended behavior. </p>
  
  <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_error_sleep_time">smtpd_error_sleep_time</a>
! (default: 1s)</b></DT><DD>
! 
! <p>With Postfix version 2.1 and later: the SMTP server response delay after
! a client has made more than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors, and
! fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without delivering mail.
! </p>
! 
! <p>With Postfix version 2.0 and earlier: the SMTP server delay before
! sending a reject (4xx or 5xx) response, when the client has made
! fewer than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors without delivering
! mail. </p>
  
--- 9606,9619 ----
  
! <DT><b><a name="smtp_use_tls">smtp_use_tls</a>
  (default: no)</b></DT><DD>
  
! <p> Opportunistic mode: use TLS when a remote SMTP server announces
! STARTTLS support, otherwise send the mail in the clear. Beware:
! some SMTP servers offer STARTTLS even if it is not configured.  With
! Postfix &lt; 2.3, if the TLS handshake fails, and no other server is
! available, delivery is deferred and mail stays in the queue. If this
! is a concern for you, use the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> feature instead.  </p>
  
  <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
  
***************
*** 12730,12745 ****
  
! <DT><b><a name="smtpd_etrn_restrictions">smtpd_etrn_restrictions</a>
! (default: empty)</b></DT><DD>
! 
! <p>
! Optional SMTP server access restrictions in the context of a client
! ETRN request.
! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
! restriction lists" for a discussion of evaluation context and time.
! </p>
  
  <p>
! The Postfix ETRN implementation accepts only destinations that are
! eligible for the Postfix "fast flush" service. See the <a href="ETRN_README.html">ETRN_README</a>
! file for details.
  </p>
--- 9622,9629 ----
  
! <DT><b><a name="smtp_xforward_timeout">smtp_xforward_timeout</a>
! (default: 300s)</b></DT><DD>
  
  <p>
! The SMTP client time limit for sending the XFORWARD command, and
! for receiving the server response.
  </p>
***************
*** 12747,12752 ****
  <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
  </p>
--- 9631,9634 ----
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
***************
*** 12754,12790 ****
  <p>
! The following restrictions are specific to the domain name information
! received with the ETRN command.
  </p>
  
- <dl>
- 
- <dt><b><a name="check_etrn_access">check_etrn_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
- 
- <dd>Search the specified access database for the ETRN domain name
- or its parent domains. See the <a href="access.5.html">access(5)</a> manual page for details.
- </dd>
- 
- </dl>
  
! <p>
! Other restrictions that are valid in this context:
! </p>
  
! <ul>
  
! <li><a href="#generic">Generic</a> restrictions that can be used
! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
  
! <li>SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
  
! </ul>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_etrn_restrictions">smtpd_etrn_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, reject
! </pre>
  
--- 9636,9672 ----
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a>
! (default: $<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b></DT><DD>
  
! <p> What SMTP clients are allowed to specify the XVERP command.
! This command requests that mail be delivered one recipient at a
! time with a per recipient return address.  </p>
  
! <p> By default, no clients are allowed to specify XVERP.  </p>
  
! <p> This parameter was renamed with Postfix version 2.1. The default value
! is backwards compatible with Postfix version 2.0.  </p>
  
! <p> Specify a list of network/netmask patterns, separated by commas
! and/or whitespace. The mask specifies the number of bits in the
! network part of a host address. You can also specify hostnames or
! .domain names (the initial dot causes the domain to match any name
! below it),  "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns.  A "/file/name"
! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
! is matched when a table entry matches a lookup string (the lookup
! result is ignored).  Continue long lines by starting the next line
! with whitespace. Specify "!pattern" to exclude an address or network
! block from the list. The form "!/file/name" is supported only in
! Postfix version 2.4 and later.  </p>
  
! <p> Note: IP version 6 address information must be specified inside
! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> value, and in
! files specified with "/file/name".  IP version 6 addresses contain
! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
! pattern.  </p>
  
***************
*** 12793,12801 ****
  
! <DT><b><a name="smtpd_expansion_filter">smtpd_expansion_filter</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
  <p>
! What characters are allowed in $name expansions of RBL reply
! templates. Characters not in the allowed set are replaced by "_".
! Use C like escapes to specify special characters such as whitespace.
  </p>
--- 9675,9685 ----
  
! <DT><b><a name="smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a>
! (default: empty)</b></DT><DD>
  
  <p>
! What SMTP clients are allowed to use the XCLIENT feature.  This
! command overrides SMTP client information that is used for access
! control. Typical use is for SMTP-based content filters, fetchmail-like
! programs, or SMTP server access rule testing. See the <a href="XCLIENT_README.html">XCLIENT_README</a>
! document for details.
  </p>
***************
*** 12803,12805 ****
  <p>
! This parameter is not subjected to $parameter expansion.
  </p>
--- 9687,9689 ----
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
***************
*** 12807,12811 ****
  <p>
! This feature is available in Postfix 2.0 and later.
  </p>
  
  
--- 9691,9714 ----
  <p>
! By default, no clients are allowed to specify XCLIENT.
  </p>
  
+ <p>
+ Specify a list of network/netmask patterns, separated by commas
+ and/or whitespace. The mask specifies the number of bits in the
+ network part of a host address. You can also specify hostnames or
+ .domain names (the initial dot causes the domain to match any name
+ below it),  "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns.  A "/file/name"
+ pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
+ is matched when a table entry matches a lookup string (the lookup
+ result is ignored).  Continue long lines by starting the next line
+ with whitespace. Specify "!pattern" to exclude an address or network
+ block from the list. The form "!/file/name" is supported only in
+ Postfix version 2.4 and later.  </p>
+ 
+ <p> Note: IP version 6 address information must be specified inside
+ <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a> value, and in
+ files specified with "/file/name".  IP version 6 addresses contain
+ the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
+ pattern.  </p>
+ 
  
***************
*** 12813,12823 ****
  
! <DT><b><a name="smtpd_forbidden_commands">smtpd_forbidden_commands</a>
! (default: CONNECT, GET, POST)</b></DT><DD>
  
  <p>
! List of commands that cause the Postfix SMTP server to immediately
! terminate the session with a 221 code. This can be used to disconnect
! clients that obviously attempt to abuse the system. In addition to the
! commands listed in this parameter, commands that follow the "Label:"
! format of message headers will also cause a disconnect.
  </p>
--- 9716,9725 ----
  
! <DT><b><a name="smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a>
! (default: empty)</b></DT><DD>
  
  <p>
! What SMTP clients are allowed to use the XFORWARD feature.  This
! command forwards information that is used to improve logging after
! SMTP-based content filters. See the <a href="XFORWARD_README.html">XFORWARD_README</a> document for
! details.
  </p>
***************
*** 12825,12843 ****
  <p>
! This feature is available in Postfix 2.2 and later.
  </p>
  
! 
! </DD>
! 
! <DT><b><a name="smtpd_hard_error_limit">smtpd_hard_error_limit</a>
! (default: normal: 20, overload: 1)</b></DT><DD>
  
  <p>
! The maximal number of errors a remote SMTP client is allowed to
! make without delivering mail. The Postfix SMTP server disconnects
! when the limit is exceeded. Normally the default limit is 20, but
! it changes under overload to just 1. With Postfix 2.5 and earlier,
! the SMTP server always allows up to 20 errors by default.
  
! </p>
  
--- 9727,9753 ----
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
! <p>
! By default, no clients are allowed to specify XFORWARD.
! </p>
  
  <p>
! Specify a list of network/netmask patterns, separated by commas
! and/or whitespace. The mask specifies the number of bits in the
! network part of a host address. You can also specify hostnames or
! .domain names (the initial dot causes the domain to match any name
! below it),  "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns.  A "/file/name"
! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
! is matched when a table entry matches a lookup string (the lookup
! result is ignored).  Continue long lines by starting the next line
! with whitespace. Specify "!pattern" to exclude an address or network
! block from the list. The form "!/file/name" is supported only in
! Postfix version 2.4 and later.  </p>
  
! <p> Note: IP version 6 address information must be specified inside
! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a> value, and in
! files specified with "/file/name".  IP version 6 addresses contain
! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
! pattern.  </p>
  
***************
*** 12846,12854 ****
  
! <DT><b><a name="smtpd_helo_required">smtpd_helo_required</a>
! (default: no)</b></DT><DD>
  
  <p>
! Require that a remote SMTP client introduces itself with the HELO
! or EHLO command before sending the MAIL command or other commands
! that require EHLO negotiation.
  </p>
--- 9756,9769 ----
  
! <DT><b><a name="smtpd_banner">smtpd_banner</a>
! (default: $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a>)</b></DT><DD>
! 
! <p>
! The text that follows the 220 status code in the SMTP greeting
! banner. Some people like to see the mail version advertised. By
! default, Postfix shows no version.
! </p>
  
  <p>
! You MUST specify $<a href="postconf.5.html#myhostname">myhostname</a> at the start of the text. This is
! required by the SMTP protocol.
  </p>
***************
*** 12860,12862 ****
  <pre>
! <a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes
  </pre>
--- 9775,9777 ----
  <pre>
! <a href="postconf.5.html#smtpd_banner">smtpd_banner</a> = $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a> ($<a href="postconf.5.html#mail_version">mail_version</a>)
  </pre>
***************
*** 12866,12875 ****
  
! <DT><b><a name="smtpd_helo_restrictions">smtpd_helo_restrictions</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional restrictions that the Postfix SMTP server applies in the
! context of the SMTP HELO command.
! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
! restriction lists" for a discussion of evaluation context and time.
  </p>
--- 9781,9789 ----
  
! <DT><b><a name="smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>
! (default: 50)</b></DT><DD>
  
  <p>
! How many simultaneous connections any client is allowed to
! make to this service.  By default, the limit is set to half
! the default process limit value.
  </p>
***************
*** 12877,12884 ****
  <p>
! The default is to permit everything.
! </p>
! 
! <p> Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
! restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
! simply skip <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> by not sending HELO or EHLO).
  </p>
--- 9791,9793 ----
  <p>
! To disable this feature, specify a limit of 0.
  </p>
***************
*** 12886,12891 ****
  <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
  </p>
--- 9795,9798 ----
  <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
  </p>
***************
*** 12893,13086 ****
  <p>
! The following restrictions are specific to the hostname information
! received with the HELO or EHLO command.
  </p>
  
- <dl>
- 
- <dt><b><a name="check_helo_access">check_helo_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
- 
- <dd>Search the specified <a href="access.5.html">access(5)</a> database for the HELO or EHLO
- hostname or parent domains, and execute the corresponding action.
- Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
- restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
- simply skip <a href="postconf.5.html#check_helo_access">check_helo_access</a> by not sending HELO or EHLO).  </dd>
- 
- <dt><b><a name="check_helo_mx_access">check_helo_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
- 
- <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
- the HELO or EHLO hostname, and execute the corresponding action.
- Note 1: a result of "OK" is not allowed for safety reasons. Instead,
- use DUNNO in order to exclude specific hosts from blacklists.  Note
- 2: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
- restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
- simply skip <a href="postconf.5.html#check_helo_mx_access">check_helo_mx_access</a> by not sending HELO or EHLO).  This
- feature is available in Postfix 2.1 and later.
- </dd>
- 
- <dt><b><a name="check_helo_ns_access">check_helo_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
- 
- <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
- for the HELO or EHLO hostname, and execute the corresponding action.
- Note 1: a result of "OK" is not allowed for safety reasons. Instead,
- use DUNNO in order to exclude specific hosts from blacklists.  Note
- 2: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
- restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
- simply skip <a href="postconf.5.html#check_helo_ns_access">check_helo_ns_access</a> by not sending HELO or EHLO). This
- feature is available in Postfix 2.1 and later.
- </dd>
- 
- <dt><b><a name="reject_invalid_helo_hostname">reject_invalid_helo_hostname</a></b> (with Postfix &lt; 2.3: reject_invalid_hostname)</dt>
- 
- <dd>Reject the request when the HELO or EHLO hostname syntax is
- invalid. Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce
- this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can simply
- skip <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a> by not sending HELO or EHLO).
- <br> The <a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> specifies the response code
- for rejected requests (default: 501).</dd>
- 
- <dt><b><a name="reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a></b> (with Postfix &lt; 2.3: reject_non_fqdn_hostname)</dt>
- 
- <dd>Reject the request when the HELO or EHLO hostname is not in
- fully-qualified domain form, as required by the RFC. Note: specify
- "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this restriction
- (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can simply skip
- <a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a> by not sending HELO or EHLO).  <br>
- The <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
- rejected requests (default: 504).</dd>
- 
- <dt><b><a name="reject_rhsbl_helo">reject_rhsbl_helo <i>rbl_domain=d.d.d.d</i></a></b></dt>
- 
- <dd>Reject the request when the HELO or EHLO hostname hostname is
- listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
- (Postfix version 2.1 and later only).  Each "<i>d</i>" is a number,
- or a pattern inside "[]" that contains one or more ";"-separated
- numbers or number..number ranges (Postfix version 2.8 and later).
- If no "<i>=d.d.d.d</i>" is
- specified, reject the request when the HELO or EHLO hostname is
- listed with any A record under <i>rbl_domain</i>. See the
- <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description for additional RBL related configuration
- parameters.  Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully
- enforce this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a
- client can simply skip <a href="postconf.5.html#reject_rhsbl_helo">reject_rhsbl_helo</a> by not sending HELO or
- EHLO). This feature is available in Postfix 2.0
- and later.  </dd>
- 
- <dt><b><a name="reject_unknown_helo_hostname">reject_unknown_helo_hostname</a></b> (with Postfix &lt; 2.3: reject_unknown_hostname)</dt>
  
! <dd>Reject the request when the HELO or EHLO hostname has no DNS A
! or MX record. <br> The <a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> parameter
! specifies the numerical response code for rejected requests (default:
! 450). <br> The <a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a> parameter
! specifies the action after a temporary DNS error (default:
! <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully
! enforce this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a
! client can simply skip <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a> by not sending
! HELO or EHLO). </dd>
  
! </dl>
  
  <p>
! Other restrictions that are valid in this context:
  </p>
  
- <ul>
- 
- <li> <a href="#generic">Generic</a> restrictions that can be used
- in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
- 
- <li> Client hostname or network address specific restrictions
- described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
- 
- <li> SMTP command specific restrictions described under
- <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.  When
- sender or recipient restrictions are listed under <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
- they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
- $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> is evaluated at the time of the RCPT TO
- command.
- 
- </ul>
- 
  <p>
! Examples:
  </p>
  
- <pre>
- <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a>
- <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>
- </pre>
- 
- 
- </DD>
- 
- <DT><b><a name="smtpd_history_flush_threshold">smtpd_history_flush_threshold</a>
- (default: 100)</b></DT><DD>
- 
  <p>
! The maximal number of lines in the Postfix SMTP server command history
! before it is flushed upon receipt of EHLO, RSET, or end of DATA.
  </p>
  
- 
- </DD>
- 
- <DT><b><a name="smtpd_junk_command_limit">smtpd_junk_command_limit</a>
- (default: normal: 100, overload: 1)</b></DT><DD>
- 
  <p>
! The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote
! SMTP client can send before the Postfix SMTP server starts to
! increment the error counter with each junk command.  The junk
! command count is reset after mail is delivered.  See also the
! <a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> and <a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> configuration
! parameters.  Normally the default limit is 100, but it changes under
! overload to just 1. With Postfix 2.5 and earlier, the SMTP server
! always allows up to 100 junk commands by default.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a>
! (default: empty)</b></DT><DD>
! 
! <p> Enable logging of the named "permit" actions in SMTP server
! access lists.  This does not affect conditional actions such as
! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>". </p>
! 
! <p> Specify a list of "permit" action names, "/file/name" or
! "<a href="DATABASE_README.html">type:table</a>" patterns, separated by commas and/or whitespace. The
! list is matched left to right, and the search stops on the first
! match. A "/file/name" pattern is replaced by its contents; a
! "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a name matches a lookup
! key (the lookup result is ignored).  Continue long lines by starting
! the next line with whitespace. Specify "!pattern" to exclude a name
! from the list. </p>
  
! <p> Examples: </p>
  
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     # Log all "permit" actions.
!     <a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> = <a href="DATABASE_README.html#types">static</a>:all
! </pre>
  
  <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     # Log "<a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a>" only.
!     <a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> = <a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a>
  </pre>
  
- <p> This feature is available in Postfix 2.10 and later.  </p>
- 
- 
- </DD>
- 
- <DT><b><a name="smtpd_milters">smtpd_milters</a>
- (default: empty)</b></DT><DD>
- 
- <p> A list of Milter (mail filter) applications for new mail that
- arrives via the Postfix <a href="smtpd.8.html">smtpd(8)</a> server. Specify space or comma as
- separator. See the <a href="MILTER_README.html">MILTER_README</a> document for details.  </p>
- 
- <p> This feature is available in Postfix 2.3 and later. </p>
- 
  
--- 9800,9842 ----
  <p>
! This feature is available in Postfix 2.2 and later.
  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a>
! (default: 0)</b></DT><DD>
  
  <p>
! The maximal number of connection attempts any client is allowed to
! make to this service per time unit.  The time unit is specified
! with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
  </p>
  
  <p>
! By default, a client can make as many connections per time unit as
! Postfix can accept.
  </p>
  
  <p>
! To disable this feature, specify a limit of 0.
  </p>
  
  <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
! </p>
  
! <p>
! This feature is available in Postfix 2.2 and later.
! </p>
  
! <p>
! Example:
! </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a> = 1000
  </pre>
  
  
***************
*** 13088,13145 ****
  
! <DT><b><a name="smtpd_noop_commands">smtpd_noop_commands</a>
! (default: empty)</b></DT><DD>
  
  <p>
! List of commands that the Postfix SMTP server replies to with "250
! Ok", without doing any syntax checks and without changing state.
! This list overrides any commands built into the Postfix SMTP server.
  </p>
  
- 
- </DD>
- 
- <DT><b><a name="smtpd_null_access_lookup_key">smtpd_null_access_lookup_key</a>
- (default: &lt;&gt;)</b></DT><DD>
- 
  <p>
! The lookup key to be used in SMTP <a href="access.5.html">access(5)</a> tables instead of the
! null sender address.
  </p>
  
  
! </DD>
! 
! <DT><b><a name="smtpd_peername_lookup">smtpd_peername_lookup</a>
! (default: yes)</b></DT><DD>
! 
! <p> Attempt to look up the remote SMTP client hostname, and verify that
! the name matches the client IP address. A client name is set to
! "unknown" when it cannot be looked up or verified, or when name
! lookup is disabled.  Turning off name lookup reduces delays due to
! DNS lookup and increases the maximal inbound delivery rate. </p>
! 
! <p> This feature is available in Postfix 2.3 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_per_record_deadline">smtpd_per_record_deadline</a>
! (default: normal: no, overload: yes)</b></DT><DD>
! 
! <p> Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> time limit, from a
! time limit per read or write system call, to a time limit to send
! or receive a complete record (an SMTP command line, SMTP response
! line, SMTP message content line, or TLS protocol message).  This
! limits the impact from hostile peers that trickle data one byte at
! a time.  </p>
! 
! <p> Note: when per-record deadlines are enabled, a short timeout
! may cause problems with TLS over very slow network connections.
! The reasons are that a TLS protocol message can be up to 16 kbytes
! long (with TLSv1), and that an entire TLS protocol message must be
! sent or received within the per-record deadline.  </p>
! 
! <p> This feature is available in Postfix 2.9 and later. With older
! Postfix releases, the behavior is as if this parameter is set to
! "no". </p>
  
--- 9844,9869 ----
  
! <DT><b><a name="smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a>
! (default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD>
  
  <p>
! Clients that are excluded from connection count, connection rate,
! or SMTP request rate restrictions. See the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter
! description for the parameter value syntax.
  </p>
  
  <p>
! By default, clients in trusted networks are excluded. Specify a
! list of network blocks, hostnames or .domain names (the initial
! dot causes the domain to match any name below it).
  </p>
  
+ <p> Note: IP version 6 address information must be specified inside
+ <tt>[]</tt> in the <a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a> value, and
+ in files specified with "/file/name".  IP version 6 addresses
+ contain the ":" character, and would otherwise be confused with a
+ "<a href="DATABASE_README.html">type:table</a>" pattern.  </p>
  
! <p>
! This feature is available in Postfix 2.2 and later.
! </p>
  
***************
*** 13148,13155 ****
  
! <DT><b><a name="smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a>
! (default: 300s)</b></DT><DD>
  
  <p>
! The time after which an idle SMTPD policy service connection is
! closed.
  </p>
--- 9872,9881 ----
  
! <DT><b><a name="smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a>
! (default: 0)</b></DT><DD>
  
  <p>
! The maximal number of message delivery requests that any client is
! allowed to make to this service per time unit, regardless of whether
! or not Postfix actually accepts those messages.  The time unit is
! specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
  </p>
***************
*** 13157,13170 ****
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
  
! </DD>
! 
! <DT><b><a name="smtpd_policy_service_max_ttl">smtpd_policy_service_max_ttl</a>
! (default: 1000s)</b></DT><DD>
  
  <p>
! The time after which an active SMTPD policy service connection is
! closed.
  </p>
--- 9883,9899 ----
  <p>
! By default, a client can send as many message delivery requests
! per time unit as Postfix can accept.
  </p>
  
+ <p>
+ To disable this feature, specify a limit of 0.
+ </p>
  
! <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
! </p>
  
  <p>
! This feature is available in Postfix 2.2 and later.
  </p>
***************
*** 13172,13176 ****
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
  
--- 9901,9909 ----
  <p>
! Example:
  </p>
  
+ <pre>
+ <a href="postconf.5.html#smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a> = 1000
+ </pre>
+ 
  
***************
*** 13178,13185 ****
  
! <DT><b><a name="smtpd_policy_service_timeout">smtpd_policy_service_timeout</a>
! (default: 100s)</b></DT><DD>
  
  <p>
! The time limit for connecting to, writing to or receiving from a
! delegated SMTPD policy server.
  </p>
--- 9911,9920 ----
  
! <DT><b><a name="smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a>
! (default: 0)</b></DT><DD>
  
  <p>
! The maximal number of new (i.e., uncached) TLS sessions that a
! remote SMTP client is allowed to negotiate with this service per
! time unit.  The time unit is specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a>
! configuration parameter.
  </p>
***************
*** 13187,13200 ****
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
  
! </DD>
! 
! <DT><b><a name="smtpd_proxy_ehlo">smtpd_proxy_ehlo</a>
! (default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
  
  <p>
! How the Postfix SMTP server announces itself to the proxy filter.
! By default, the Postfix hostname is used.
  </p>
--- 9922,9940 ----
  <p>
! By default, a remote SMTP client can negotiate as many new TLS
! sessions per time unit as Postfix can accept.
  </p>
  
+ <p>
+ To disable this feature, specify a limit of 0. Otherwise, specify
+ a limit that is at least the per-client concurrent session limit,
+ or else legitimate client sessions may be rejected.
+ </p>
  
! <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
! </p>
  
  <p>
! This feature is available in Postfix 2.3 and later.
  </p>
***************
*** 13202,13206 ****
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
  
--- 9942,9950 ----
  <p>
! Example:
  </p>
  
+ <pre>
+ <a href="postconf.5.html#smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a> = 100
+ </pre>
+ 
  
***************
*** 13208,13228 ****
  
! <DT><b><a name="smtpd_proxy_filter">smtpd_proxy_filter</a>
! (default: empty)</b></DT><DD>
  
! <p> The hostname and TCP port of the mail filtering proxy server.
! The proxy receives all mail from the Postfix SMTP server, and is
! supposed to give the result to another Postfix SMTP server process.
  </p>
  
! <p> Specify "host:port" or "inet:host:port" for a TCP endpoint, or
! "unix:pathname" for a UNIX-domain endpoint. The host can be specified
! as an IP address or as a symbolic name; no MX lookups are done.
! When no "host" or "host:"  are specified, the local machine is
! assumed.  Pathname interpretation is relative to the Postfix queue
! directory.  </p>
! 
! <p> This feature is available in Postfix 2.1 and later.  </p>
! 
! <p> The "inet:" and "unix:" prefixes are available in Postfix 2.3
! and later.  </p>
  
--- 9952,9961 ----
  
! <DT><b><a name="smtpd_client_port_logging">smtpd_client_port_logging</a>
! (default: no)</b></DT><DD>
  
! <p> Enable logging of the remote SMTP client port in addition to
! the hostname and IP address. The logging format is "host[address]:port".
  </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 13231,13273 ****
  
! <DT><b><a name="smtpd_proxy_options">smtpd_proxy_options</a>
! (default: empty)</b></DT><DD>
  
  <p>
! List of options that control how the Postfix SMTP server
! communicates with a before-queue content filter. Specify zero or
! more of the following, separated by comma or whitespace.  </p>
! 
! <dl>
! 
! <dt><b>speed_adjust</b></dt>
! 
! <dd> <p> Do not connect to a before-queue content filter until an entire
! message has been received. This reduces the number of simultaneous
! before-queue content filter processes. </p>
! 
! <p> NOTE 1: A filter must not <i>selectively</i> reject recipients
! of a multi-recipient message.  Rejecting all recipients is OK, as
! is accepting all recipients. </p>
! 
! <p> NOTE 2: This feature increases the minimum amount of free queue
! space by $<a href="postconf.5.html#message_size_limit">message_size_limit</a>. The extra space is needed to save the
! message to a temporary file. </p> </dd>
! 
! </dl>
  
  <p>
! This feature is available in Postfix 2.7 and later.
  </p>
  
- 
- </DD>
- 
- <DT><b><a name="smtpd_proxy_timeout">smtpd_proxy_timeout</a>
- (default: 100s)</b></DT><DD>
- 
  <p>
! The time limit for connecting to a proxy filter and for sending or
! receiving information.  When a connection fails the client gets a
! generic error message while more detailed information is logged to
! the maillog file.
  </p>
--- 9964,9982 ----
  
! <DT><b><a name="smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a>
! (default: 0)</b></DT><DD>
  
  <p>
! The maximal number of recipient addresses that any client is allowed
! to send to this service per time unit, regardless of whether or not
! Postfix actually accepts those recipients.  The time unit is specified
! with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
! </p>
  
  <p>
! By default, a client can make as many recipient addresses per time
! unit as Postfix can accept.
  </p>
  
  <p>
! To disable this feature, specify a limit of 0.
  </p>
***************
*** 13275,13278 ****
  <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
  </p>
--- 9984,9987 ----
  <p>
! WARNING: The purpose of this feature is to limit abuse. It must
! not be used to regulate legitimate mail traffic.
  </p>
***************
*** 13280,13305 ****
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
- 
- </DD>
- 
- <DT><b><a name="smtpd_recipient_limit">smtpd_recipient_limit</a>
- (default: 1000)</b></DT><DD>
- 
  <p>
! The maximal number of recipients that the Postfix SMTP server
! accepts per message delivery request.
  </p>
  
! 
! </DD>
! 
! <DT><b><a name="smtpd_recipient_overshoot_limit">smtpd_recipient_overshoot_limit</a>
! (default: 1000)</b></DT><DD>
! 
! <p> The number of recipients that a remote SMTP client can send in
! excess of the limit specified with $<a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a>, before
! the Postfix SMTP server increments the per-session error count
! for each excess recipient.  </p>
  
--- 9989,10000 ----
  <p>
! This feature is available in Postfix 2.2 and later.
  </p>
  
  <p>
! Example:
  </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a> = 1000
! </pre>
  
***************
*** 13308,13349 ****
  
! <DT><b><a name="smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>
! (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>)</b></DT><DD>
! 
! <p>
! The access restrictions that the Postfix SMTP server applies in
! the context of the RCPT TO command.
! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
! restriction lists" for a discussion of evaluation context and time.
! </p>
  
  <p>
! By default, the Postfix SMTP server accepts:
  </p>
  
- <ul>
- 
- <li> Mail from clients whose IP address matches $<a href="postconf.5.html#mynetworks">mynetworks</a>, or:
- 
- <li> Mail to remote destinations that match $<a href="postconf.5.html#relay_domains">relay_domains</a>, except
- for addresses that contain sender-specified routing
- (user@elsewhere@domain), or:
- 
- <li> Mail to local destinations that match $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
- or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or
- $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
- 
- </ul>
- 
  <p>
! IMPORTANT: If you change this parameter setting, you must specify
! at least one of the following restrictions. Otherwise Postfix will
! refuse to receive mail:
  </p>
  
- <blockquote>
- <pre>
- reject, defer, <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
- </pre>
- </blockquote>
- 
  <p>
--- 10003,10016 ----
  
! <DT><b><a name="smtpd_client_restrictions">smtpd_client_restrictions</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional SMTP server access restrictions in the context of a client
! SMTP connection request.
  </p>
  
  <p>
! The default is to allow all connection requests.
  </p>
  
  <p>
***************
*** 13356,13359 ****
  <p>
! The following restrictions are specific to the recipient address
! that is received with the RCPT TO command.
  </p>
--- 10023,10026 ----
  <p>
! The following restrictions are specific to client hostname or
! client network address information.
  </p>
***************
*** 13362,13503 ****
  
! <dt><b><a name="check_recipient_access">check_recipient_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the resolved RCPT
! TO address, domain, parent domains, or localpart@, and execute the
! corresponding action.  </dd>
  
! <dt><b><a name="check_recipient_mx_access">check_recipient_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
! the RCPT TO domain, and execute the corresponding action.  Note:
! a result of "OK" is not allowed for safety reasons. Instead, use
! DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later. </dd>
  
! <dt><b><a name="check_recipient_ns_access">check_recipient_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
! for the RCPT TO domain, and execute the corresponding action.
! Note: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later.  </dd>
  
! <dt><b><a name="permit_auth_destination">permit_auth_destination</a></b></dt>
  
! <dd>Permit the request when one of the following is true:
  
! <ul>
  
! <li> Postfix is mail forwarder: the resolved RCPT TO domain matches
! $<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and the address contains no
! sender-specified routing (user@elsewhere@domain),
  
! <li> Postfix is the final destination: the resolved RCPT TO domain
! matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
! $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and the address
! contains no sender-specified routing (user@elsewhere@domain).
  
! </ul></dd>
  
! <dt><b><a name="permit_mx_backup">permit_mx_backup</a></b></dt>
  
! <dd>Permit the request when the local mail system is backup MX for
! the RCPT TO domain, or when the domain is an authorized destination
! (see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> for definition).
  
! <ul>
  
! <li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> does not accept addresses that have
! sender-specified routing information (example: user@elsewhere@domain).
  
! <li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> can be vulnerable to mis-use when
! access is not restricted with <a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a>.
  
! <li> Safety: as of Postfix version 2.3, <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> no longer
! accepts the address when the local mail system is primary MX for
! the recipient domain.  Exception: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> accepts the address
! when it specifies an authorized destination (see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
! for definition).
  
! <li> Limitation: mail may be rejected in case of a temporary DNS
! lookup problem with Postfix prior to version 2.0.
  
! </ul></dd>
  
! <dt><b><a name="reject_non_fqdn_recipient">reject_non_fqdn_recipient</a></b></dt>
  
! <dd>Reject the request when the RCPT TO address is not in
! fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
! rejected requests (default: 504). </dd>
  
! <dt><b><a name="reject_rhsbl_recipient">reject_rhsbl_recipient <i>rbl_domain=d.d.d.d</i></a></b></dt>
  
! <dd>Reject the request when the RCPT TO domain is listed with the
! A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
! 2.1 and later only).  Each "<i>d</i>" is a number, or a pattern
! inside "[]" that contains one or more ";"-separated numbers or
! number..number ranges (Postfix version 2.8 and later). If no
! "<i>=d.d.d.d</i>" is specified, reject
! the request when the RCPT TO domain is listed with
! any A record under <i>rbl_domain</i>. <br> The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a>
! parameter specifies the response code for rejected requests (default:
! 554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter specifies the default server
! reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter specifies tables with server
! replies indexed by <i>rbl_domain</i>.  This feature is available
! in Postfix version 2.0 and later.</dd>
  
! <dt><b><a name="reject_unauth_destination">reject_unauth_destination</a></b></dt>
  
! <dd>Reject the request unless one of the following is true:
  
! <ul>
  
! <li> Postfix is mail forwarder: the resolved RCPT TO domain matches
! $<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and contains no sender-specified
! routing (user@elsewhere@domain),
  
! <li> Postfix is the final destination: the resolved RCPT TO domain
! matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
! $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and contains
! no sender-specified routing (user@elsewhere@domain).
  
! </ul> The <a href="postconf.5.html#relay_domains_reject_code">relay_domains_reject_code</a> parameter specifies the response
! code for rejected requests (default: 554). </dd>
  
! <dt><b><a name="reject_unknown_recipient_domain">reject_unknown_recipient_domain</a></b></dt>
  
! <dd>Reject the request when Postfix is not final destination for
! the recipient domain, and the RCPT TO domain has 1) no DNS A or MX
! record or 2) a malformed MX record such as a record with
! a zero-length MX hostname (Postfix version 2.3 and later). <br> The
! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the numerical
! response code for rejected requests (default: 450).  The response
! is always 450 in case of a temporary DNS error. <br> The
! <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> parameter specifies the action
! after a temporary DNS error (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>).  </dd>
  
! <dt><b><a name="reject_unlisted_recipient">reject_unlisted_recipient</a></b> (with Postfix version 2.0: check_recipient_maps)</dt>
  
! <dd> Reject the request when the RCPT TO address is not listed in
! the list of valid recipients for its domain class. See the
! <a href="postconf.5.html#smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a> parameter description for details.
! This feature is available in Postfix 2.1 and later.</dd>
  
! <dt><b><a name="reject_unverified_recipient">reject_unverified_recipient</a></b></dt>
  
! <dd>Reject the request when mail to the RCPT TO address is known
! to bounce, or when the recipient address destination is not reachable.
! Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
! see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details.  <br> The
! <a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> parameter specifies the numerical
! response code when an address is known to bounce (default: 450,
! change into 550 when you are confident that it is safe to do so).
! <br>The <a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> parameter specifies the
! numerical response code when an address probe failed due to a
! temporary problem (default: 450). <br> The
! <a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a> parameter specifies the action
! after addres probe failure due to a temporary problem (default:
! <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>).  <br>  This feature is available in Postfix 2.1
! and later.  </dd>
  
--- 10029,10245 ----
  
! <dt><b><a name="check_ccert_access">check_ccert_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd> Use the client certificate fingerprint as lookup key for the
! specified <a href="access.5.html">access(5)</a> database; with Postfix version 2.2, also require that
! the SMTP client certificate is verified successfully.
! The fingerprint digest algorithm is configurable via the
! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
! Postfix version 2.5).  This feature is available with Postfix version
! 2.2 and later. </dd>
  
! <dt><b><a name="check_client_access">check_client_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified access database for the client hostname,
! parent domains, client IP address, or networks obtained by stripping
! least significant octets. See the <a href="access.5.html">access(5)</a> manual page for details. </dd>
  
! <dt><b><a name="check_reverse_client_hostname_access">check_reverse_client_hostname_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified access database for the unverified reverse
! client hostname, parent domains, client IP address, or networks
! obtained by stripping least significant octets. See the <a href="access.5.html">access(5)</a>
! manual page for details.  Note: a result of "OK" is not allowed for
! safety reasons.  Instead, use DUNNO in order to exclude specific
! hosts from blacklists.  This feature is available in Postfix 2.6
! and later.</dd>
  
! <dt><b><a name="permit_inet_interfaces">permit_inet_interfaces</a></b></dt>
  
! <dd>Permit the request when the client IP address matches
! $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>. </dd>
  
! <dt><b><a name="permit_mynetworks">permit_mynetworks</a></b></dt>
  
! <dd>Permit the request when the client IP address matches any
! network or network address listed in  $<a href="postconf.5.html#mynetworks">mynetworks</a>. </dd>
  
! <dt><b><a name="permit_sasl_authenticated">permit_sasl_authenticated</a></b></dt>
! 
! <dd> Permit the request when the client is successfully
! authenticated via the <a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH) protocol. </dd>
! 
! <dt><b><a name="permit_tls_all_clientcerts">permit_tls_all_clientcerts</a></b></dt>
! 
! <dd> Permit the request when the remote SMTP client certificate is
! verified successfully.  This option must be used only if a special
! CA issues the certificates and only this CA is listed as trusted
! CA, otherwise all clients with a recognized certificate would be
! allowed to relay. This feature is available with Postfix version 2.2.</dd>
! 
! <dt><b><a name="permit_tls_clientcerts">permit_tls_clientcerts</a></b></dt>
! 
! <dd>Permit the request when the remote SMTP client certificate
! fingerprint is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
! The fingerprint digest algorithm is configurable via the
! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
! Postfix version 2.5).  This feature is available with Postfix version
! 2.2. </dd>
! 
! <dt><b><a name="reject_rbl_client">reject_rbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Reject the request when the reversed client network address is
! listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
! (Postfix version 2.1 and later only).  If no "<i>=d.d.d.d</i>" is
! specified, reject the request when the reversed client network
! address is listed with any A record under <i>rbl_domain</i>. <br>
! The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
! rejected requests (default:  554), the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a>  parameter
! specifies the default server reply, and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a>  parameter
! specifies tables with server replies indexed by <i>rbl_domain</i>.
! This feature is available in Postfix 2.0 and later.  </dd>
! 
! <dt><b><a name="reject_rhsbl_client">reject_rhsbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Reject the request when the client hostname is listed with the
! A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
! 2.1 and later only).  If no "<i>=d.d.d.d</i>" is specified, reject
! the request when the client hostname is listed with
! any A record under <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>
! description above for additional RBL related configuration parameters.
! This feature is available in Postfix 2.0 and later.  </dd>
! 
! <dt><b><a name="reject_unknown_client_hostname">reject_unknown_client_hostname</a></b> (with Postfix &lt; 2.3: reject_unknown_client)</dt>
! 
! <dd>Reject the request when 1) the client IP address-&gt;name mapping
! fails, 2) the name-&gt;address mapping fails, or 3) the name-&gt;address
! mapping does not match the client IP address.  <br> This is a
! stronger restriction than the <a href="postconf.5.html#reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a>
! feature, which triggers only under condition 1) above. <br> The
! <a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response code
! for rejected requests (default: 450). The reply is always 450 in
! case the address-&gt;name or name-&gt;address lookup failed due to
! a temporary problem. </dd>
  
! <dt><b><a name="reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a></b></dt>
  
! <dd>Reject the request when the client IP address has no address-&gt;name
! mapping. <br> This is a weaker restriction than the
! <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> feature, which requires not only
! that the address-&gt;name and name-&gt;address mappings exist, but
! also that the two mappings reproduce the client IP address.  <br>
! The <a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response
! code for rejected requests (default: 450).  The reply is always 450
! in case the address-&gt;name lookup failed due to a temporary
! problem. <br> This feature is available in Postfix 2.3 and
! later.  </dd>
  
! </dl>
  
! <p>
! In addition, you can use any of the following <a name="generic">
! generic</a> restrictions.  These restrictions are applicable in
! any SMTP command context.
! </p>
  
! <dl>
  
! <dt><b><a name="check_policy_service">check_policy_service <i>servername</i></a></b></dt>
  
! <dd>Query the specified policy server. See the <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a>
! document for details. This feature is available in Postfix 2.1
! and later. </dd>
  
! <dt><b><a name="defer">defer</a></b></dt>
  
! <dd>Defer the request. The client is told to try again later. This
! restriction is useful at the end of a restriction list, to make
! the default policy explicit. <br> The <a href="postconf.5.html#defer_code">defer_code</a> parameter specifies
! the SMTP server reply code (default: 450).</dd>
  
! <dt><b><a name="defer_if_permit">defer_if_permit</a></b></dt>
  
! <dd>Defer the request if some later restriction would result in an
! explicit or implicit PERMIT action.  This is useful when a blacklisting
! feature fails due to a temporary problem.  This feature is available
! in Postfix version 2.1 and later.  </dd>
  
! <dt><b><a name="defer_if_reject">defer_if_reject</a></b></dt>
  
! <dd>Defer the request if some later restriction would result in a
! REJECT action.  This is useful when a whitelisting feature fails
! due to a temporary problem.  This feature is available in Postfix
! version 2.1 and later.  </dd>
  
! <dt><b><a name="permit">permit</a></b></dt>
  
! <dd>Permit the request. This restriction is useful at the end of
! a restriction list, to make the default policy explicit.</dd>
  
! <dt><b><a name="reject_multi_recipient_bounce">reject_multi_recipient_bounce</a></b></dt>
  
! <dd>Reject the request when the envelope sender is the null address,
! and the message has multiple envelope recipients. This usage has
! rare but legitimate applications: under certain conditions,
! multi-recipient mail that was posted with the DSN option NOTIFY=NEVER
! may be forwarded with the null sender address.
! <br> Note: this restriction can only work reliably
! when used in <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> or
! <a href="postconf.5.html#smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>, because the total number of
! recipients is not known at an earlier stage of the SMTP conversation.
! Use at the RCPT stage will only reject the second etc.  recipient.
! <br>
! The <a href="postconf.5.html#multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a> parameter specifies the
! response code for rejected requests (default:  550).  This feature
! is available in Postfix 2.1 and later. </dd>
  
! <dt><b><a name="reject_plaintext_session">reject_plaintext_session</a></b></dt>
  
! <dd>Reject the request when the connection is not encrypted. This
! restriction should not be used before the client has had a chance
! to negotiate encryption with the AUTH or STARTTLS commands.
! <br>
! The <a href="postconf.5.html#plaintext_reject_code">plaintext_reject_code</a> parameter specifies the response
! code for rejected requests (default:  450).  This feature is available
! in Postfix 2.3 and later. </dd>
  
! <dt><b><a name="reject_unauth_pipelining">reject_unauth_pipelining</a></b></dt>
  
! <dd>Reject the request when the client sends SMTP commands ahead
! of time where it is not allowed, or when the client sends SMTP
! commands ahead of time without knowing that Postfix actually supports
! ESMTP command pipelining. This stops mail from bulk mail software
! that improperly uses ESMTP command pipelining in order to speed up
! deliveries. <br> Note: <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> is not useful
! outside <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> when 1) the client uses ESMTP (EHLO
! instead of HELO) and 2) with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes" (the
! default).  The use of <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> in the other
! restriction contexts is therefore not recommended.  </dd>
  
! <dt><b><a name="reject">reject</a></b></dt>
  
! <dd>Reject the request. This restriction is useful at the end of
! a restriction list, to make the default policy explicit.  The
! <a href="postconf.5.html#reject_code">reject_code</a> configuration parameter specifies the response code to
! rejected requests (default: 554).</dd>
  
! <dt><b><a name="sleep">sleep <i>seconds</i></a></b></dt>
  
! <dd>Pause for the specified number of seconds and proceed with
! the next restriction in the list, if any. This may stop zombie
! mail when used as:
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
!         sleep 1, <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
!     <a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = no
! </pre>
! This feature is available in Postfix 2.3. </dd>
! 
! <dt><b><a name="warn_if_reject">warn_if_reject</a></b></dt>
! 
! <dd>Change the meaning of the next restriction, so that it logs
! a warning instead of rejecting a request (look for logfile records
! that contain "reject_warning"). This is useful for testing new
! restrictions in a "live" environment without risking unnecessary
! loss of mail. </dd>
  
***************
*** 13511,13518 ****
  
! <li><a href="#generic">Generic</a> restrictions that can be used
! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
! 
! <li>SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>.
  
--- 10253,10261 ----
  
! <li> SMTP command specific restrictions that are described under
! the <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>, <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> parameters. When helo, sender or
! recipient restrictions are listed under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>,
! they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> is evaluated at the time of the RCPT TO
! command.
  
***************
*** 13525,13527 ****
  <pre>
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
  </pre>
--- 10268,10270 ----
  <pre>
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a>
  </pre>
***************
*** 13531,13608 ****
  
! <DT><b><a name="smtpd_reject_footer">smtpd_reject_footer</a>
  (default: empty)</b></DT><DD>
  
! <p> Optional information that is appended after each Postfix SMTP
! server
! 4XX or 5XX response. </p>
  
! <p> Example: </p>
  
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> = For assistance, call 800-555-0101.
!      Please provide the following information in your problem report:
!      time ($localtime), client ($client_address) and server
!      ($server_name).
! </pre>
  
! <p> Server response: </p>
  
! <pre>
!     550-5.5.1 &lt;user@example&gt; Recipient address rejected: User unknown
!     550 5.5.1 For assistance, call 800-555-0101. Please provide the
!     following information in your problem report: time (Jan 4 15:42:00),
!     client (192.168.1.248) and server (mail1.example.com).
! </pre>
  
! <p> Note: the above text is meant to make it easier to find the
! Postfix logfile records for a failed SMTP session. The text itself
! is not logged to the Postfix SMTP server's maillog file. </p>
  
! <p> Be sure to keep the text as short as possible. Long text may
! be truncated before it is logged to the remote SMTP client's maillog
! file, or before it is returned to the sender in a delivery status
! notification.  </p>
  
! <p> This feature supports a limited number of $name attributes in
! the footer text. These are replaced by their current value for the
! SMTP session: </p>
  
! <dl>
  
! <dt> <b>client_address</b> </dt> <dd> The Client IP address that
! is logged in the maillog file. </dd>
  
- <dt> <b>client_port</b> </dt> <dd> The client TCP port that is
- logged in the maillog file. </dd>
  
! <dt> <b>localtime</b> </dt> <dd> The server local time (Mmm dd
! hh:mm:ss) that is logged in the maillog file. </dd>
  
! <dt> <b>server_name</b> </dt> <dd> The server's <a href="postconf.5.html#myhostname">myhostname</a> value.
! This attribute is made available for sites with multiple MTAs
! (perhaps behind a load-balancer), where the server name can help
! the server support team to quickly find the right log files.  </dd>
  
! </dl>
  
! <p> Notes: </p>
  
! <ul>
  
- <li> <p> NOT SUPPORTED are other attributes such as sender, recipient,
- or <a href="postconf.5.html">main.cf</a> parameters.  </p>
  
! <li> <p> For safety reasons, text that does not match
! $<a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> is censored. </p>
  
! </ul>
  
! <p> This feature supports the two-character sequence \n as a request
! for a line break in the footer text. Postfix automatically inserts
! after each line break the three-digit SMTP reply code (and optional
! enhanced status code) from the original Postfix reject message.
  </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 10274,10362 ----
  
! <DT><b><a name="smtpd_data_restrictions">smtpd_data_restrictions</a>
  (default: empty)</b></DT><DD>
  
! <p>
! Optional access restrictions that the Postfix SMTP server applies
! in the context of the SMTP DATA command.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
! <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
! </p>
  
! <p>
! The following restrictions are valid in this context:
! </p>
  
! <ul>
  
! <li><a href="#generic">Generic</a> restrictions that can be used
! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
  
! <li>SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
  
! </ul>
  
! <p>
! Examples:
! </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
! <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipient_bounce</a>
! </pre>
  
  
! </DD>
  
! <DT><b><a name="smtpd_delay_open_until_valid_rcpt">smtpd_delay_open_until_valid_rcpt</a>
! (default: yes)</b></DT><DD>
  
! <p> Postpone the start of an SMTP mail transaction until a valid
! RCPT TO command is received. Specify "no" to create a mail transaction
! as soon as the SMTP server receives a valid MAIL FROM command. </p>
  
! <p> With sites that reject lots of mail, the default setting reduces
! the use of
! disk, CPU and memory resources. The downside is that rejected
! recipients are logged with NOQUEUE instead of a mail transaction
! ID. This complicates the logfile analysis of multi-recipient mail.
! </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_delay_reject">smtpd_delay_reject</a>
! (default: yes)</b></DT><DD>
  
! <p>
! Wait until the RCPT TO command before evaluating
! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
! $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, or wait until the ETRN command before
! evaluating $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
! </p>
! 
! <p>
! This feature is turned on by default because some clients apparently
! mis-behave when the Postfix SMTP server rejects commands before
! RCPT TO.
  </p>
  
! <p>
! The default setting has one major benefit: it allows Postfix to log
! recipient address information when rejecting a client name/address
! or sender address, so that it is possible to find out whose mail
! is being rejected.
! </p>
  
***************
*** 13611,13641 ****
  
! <DT><b><a name="smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a>
! (default: yes)</b></DT><DD>
  
! <p>
! Request that the Postfix SMTP server rejects mail for unknown
! recipient addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a>
! access restriction is specified. This prevents the Postfix queue
! from filling up with undeliverable MAILER-DAEMON messages.
! </p>
  
! <p> An address is always considered "known" when it matches a
! <a href="virtual.5.html">virtual(5)</a> alias or a <a href="canonical.5.html">canonical(5)</a> mapping.
  
! <ul>
  
! <li> The recipient domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, but the recipient is not listed in
! $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> is not null.
  
! <li> The recipient domain matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> but the
! recipient is not listed in $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>.
  
! <li> The recipient domain matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> but the
! recipient is not listed in $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
! is not null.
  
! <li> The recipient domain matches $<a href="postconf.5.html#relay_domains">relay_domains</a> but the recipient
! is not listed in $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>, and $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>
! is not null.
  
--- 10365,10398 ----
  
! <DT><b><a name="smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>
! (default: empty)</b></DT><DD>
  
! <p> Lookup tables, indexed by the remote SMTP client address, with
! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
! etc.) that the SMTP server will not send in the EHLO response to a
! remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
! The table is not searched by hostname for robustness reasons.  </p>
! 
! <p> This feature is available in Postfix 2.2 and later. </p>
! 
! 
! </DD>
  
! <DT><b><a name="smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>
! (default: empty)</b></DT><DD>
! 
! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
! auth, etc.) that the SMTP server will not send in the EHLO response
! to a remote SMTP client. </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
! <p> Notes: </p>
  
! <ul>
  
! <li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
! this action from being logged. </p>
  
! <li> <p> Use the <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a> feature
! to discard EHLO keywords selectively.  </p>
  
***************
*** 13643,13648 ****
  
- <p>
- This feature is available in Postfix 2.1 and later.
- </p>
- 
  
--- 10400,10401 ----
***************
*** 13650,13684 ****
  
! <DT><b><a name="smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a>
! (default: no)</b></DT><DD>
  
! <p> Request that the Postfix SMTP server rejects mail from unknown
! sender addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a>
! access restriction is specified. This can slow down an explosion
! of forged mail from worms or viruses.  </p>
  
! <p> An address is always considered "known" when it matches a
! <a href="virtual.5.html">virtual(5)</a> alias or a <a href="canonical.5.html">canonical(5)</a> mapping.
  
! <ul>
  
- <li> The sender domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or
- $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, but the sender is not listed in
- $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> is not null.
  
! <li> The sender domain matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> but the sender
! is not listed in $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>.
  
! <li> The sender domain matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> but the
! sender is not listed in $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
! is not null.
  
! <li> The sender domain matches $<a href="postconf.5.html#relay_domains">relay_domains</a> but the sender is
! not listed in $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>, and $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> is
! not null.
  
! </ul>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
--- 10403,10434 ----
  
! <DT><b><a name="smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>
! (default: empty)</b></DT><DD>
  
! <p> Optional access restrictions that the Postfix SMTP server
! applies in the context of the SMTP END-OF-DATA command. </p>
  
! <p> This feature is available in Postfix 2.2 and later. </p>
  
! <p> See <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> for syntax details. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_enforce_tls">smtpd_enforce_tls</a>
! (default: no)</b></DT><DD>
  
! <p> Mandatory TLS: announce STARTTLS support to SMTP clients,
! and require that clients use TLS encryption.  According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a>
! this MUST NOT be applied in case of a publicly-referenced SMTP
! server.  This option is off by default and should be used only on
! dedicated servers. </p>
  
! <p> Note 1: "<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> = yes" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes". </p>
  
! <p> Note 2: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
! STARTTLS due to insufficient privileges to access the server private
! key. This is intended behavior. </p>
! 
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
  
***************
*** 13687,13701 ****
  
! <DT><b><a name="smtpd_restriction_classes">smtpd_restriction_classes</a>
! (default: empty)</b></DT><DD>
  
! <p>
! User-defined aliases for groups of access restrictions. The aliases
! can be specified in <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> etc., and on the
! right-hand side of a Postfix <a href="access.5.html">access(5)</a> table.
  </p>
  
! <p>
! One major application is for implementing per-recipient UCE control.
! See the <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a> document for other examples.
! </p>
  
--- 10437,10450 ----
  
! <DT><b><a name="smtpd_error_sleep_time">smtpd_error_sleep_time</a>
! (default: 1s)</b></DT><DD>
  
! <p>With Postfix version 2.1 and later: the SMTP server response delay after
! a client has made more than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors, and
! fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without delivering mail.
  </p>
  
! <p>With Postfix version 2.0 and earlier: the SMTP server delay before
! sending a reject (4xx or 5xx) response, when the client has made
! fewer than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors without delivering
! mail. </p>
  
***************
*** 13704,13714 ****
  
! <DT><b><a name="smtpd_sasl_application_name">smtpd_sasl_application_name</a>
! (default: smtpd)</b></DT><DD>
  
  <p>
! The application name that the Postfix SMTP server uses for SASL
! server initialization. This
! controls the name of the SASL configuration file. The default value
! is <b>smtpd</b>, corresponding to a SASL configuration file named
! <b>smtpd.conf</b>.
  </p>
--- 10453,10460 ----
  
! <DT><b><a name="smtpd_etrn_restrictions">smtpd_etrn_restrictions</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional SMTP server access restrictions in the context of a client
! ETRN request.
  </p>
***************
*** 13716,13730 ****
  <p>
! This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3
! it was renamed to <a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a>.
  </p>
  
- 
- </DD>
- 
- <DT><b><a name="smtpd_sasl_auth_enable">smtpd_sasl_auth_enable</a>
- (default: no)</b></DT><DD>
- 
  <p>
! Enable SASL authentication in the Postfix SMTP server. By default,
! the Postfix SMTP server does not use authentication.
  </p>
--- 10462,10473 ----
  <p>
! The Postfix ETRN implementation accepts only destinations that are
! eligible for the Postfix "fast flush" service. See the <a href="ETRN_README.html">ETRN_README</a>
! file for details.
  </p>
  
  <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
  </p>
***************
*** 13732,13768 ****
  <p>
! If a remote SMTP client is authenticated, the <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>
! access restriction can be used to permit relay access, like this:
  </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
!     <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, ...
! </pre>
! </blockquote>
  
! <p> To reject all SMTP connections from unauthenticated clients,
! specify "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes" (which is the default) and use:
! </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, reject
! </pre>
! </blockquote>
  
  <p>
! See the <a href="SASL_README.html">SASL_README</a> file for SASL configuration and operation details.
  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_sasl_authenticated_header">smtpd_sasl_authenticated_header</a>
! (default: no)</b></DT><DD>
  
! <p> Report the SASL authenticated user name in the <a href="smtpd.8.html">smtpd(8)</a> Received
! message header.  </p>
  
! <p> This feature is available in Postfix 2.3 and later.  </p>
  
--- 10475,10511 ----
  <p>
! The following restrictions are specific to the domain name information
! received with the ETRN command.
  </p>
  
! <dl>
  
! <dt><b><a name="check_etrn_access">check_etrn_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified access database for the ETRN domain name
! or its parent domains. See the <a href="access.5.html">access(5)</a> manual page for details.
! </dd>
! 
! </dl>
  
  <p>
! Other restrictions that are valid in this context:
  </p>
  
+ <ul>
  
! <li><a href="#generic">Generic</a> restrictions that can be used
! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
  
! <li>SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
  
! </ul>
  
! <p>
! Example:
! </p>
! 
! <pre>
! <a href="postconf.5.html#smtpd_etrn_restrictions">smtpd_etrn_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, reject
! </pre>
  
***************
*** 13771,13778 ****
  
! <DT><b><a name="smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a>
! (default: empty)</b></DT><DD>
  
  <p>
! What remote SMTP clients the Postfix SMTP server will not offer
! AUTH support to.
  </p>
--- 10514,10522 ----
  
! <DT><b><a name="smtpd_expansion_filter">smtpd_expansion_filter</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
  <p>
! What characters are allowed in $name expansions of RBL reply
! templates. Characters not in the allowed set are replaced by "_".
! Use C like escapes to specify special characters such as whitespace.
  </p>
***************
*** 13780,13785 ****
  <p>
! Some clients (Netscape 4 at least) have a bug that causes them to
! require a login and password whenever AUTH is offered, whether it's
! necessary or not. To work around this, specify, for example,
! $<a href="postconf.5.html#mynetworks">mynetworks</a> to prevent Postfix from offering AUTH to local clients.
  </p>
--- 10524,10526 ----
  <p>
! This parameter is not subjected to $parameter expansion.
  </p>
***************
*** 13787,13815 ****
  <p>
! Specify a list of network/netmask patterns, separated by commas
! and/or whitespace. The mask specifies the number of bits in the
! network part of a host address. You can also "/file/name" or
! "<a href="DATABASE_README.html">type:table</a>" patterns.  A "/file/name" pattern is replaced by its
! contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a table entry
! matches a lookup string (the lookup result is ignored).  Continue
! long lines by starting the next line with whitespace. Specify
! "!pattern" to exclude an address or network block from the list.
! The form "!/file/name" is supported only in Postfix version 2.4 and
! later.  </p>
  
! <p> Note: IP version 6 address information must be specified inside
! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> value, and in
! files specified with "/file/name".  IP version 6 addresses contain
! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
! pattern.  </p>
  
  <p>
! Example:
  </p>
  
- <pre>
- <a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
- </pre>
- 
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
--- 10528,10548 ----
  <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
! 
! </DD>
! 
! <DT><b><a name="smtpd_forbidden_commands">smtpd_forbidden_commands</a>
! (default: CONNECT, GET, POST)</b></DT><DD>
  
  <p>
! List of commands that causes the Postfix SMTP server to immediately
! terminate the session with a 221 code. This can be used to disconnect
! clients that obviously attempt to abuse the system. In addition to the
! commands listed in this parameter, commands that follow the "Label:"
! format of message headers will also cause a disconnect.
  </p>
  
  <p>
! This feature is available in Postfix 2.2 and later.
  </p>
***************
*** 13819,13830 ****
  
! <DT><b><a name="smtpd_sasl_local_domain">smtpd_sasl_local_domain</a>
! (default: empty)</b></DT><DD>
  
  <p>
! The name of the Postfix SMTP server's local SASL authentication
! realm.
  </p>
  
  <p>
! By default, the local authentication realm name is the null string.
  </p>
--- 10552,10571 ----
  
! <DT><b><a name="smtpd_hard_error_limit">smtpd_hard_error_limit</a>
! (default: 20)</b></DT><DD>
  
  <p>
! The maximal number of errors a remote SMTP client is allowed to
! make without delivering mail. The Postfix SMTP server disconnects
! when the limit is exceeded.
  </p>
  
+ 
+ </DD>
+ 
+ <DT><b><a name="smtpd_helo_required">smtpd_helo_required</a>
+ (default: no)</b></DT><DD>
+ 
  <p>
! Require that a remote SMTP client introduces itself at the beginning
! of an SMTP session with the HELO or EHLO command.
  </p>
***************
*** 13832,13834 ****
  <p>
! Examples:
  </p>
--- 10573,10575 ----
  <p>
! Example:
  </p>
***************
*** 13836,13839 ****
  <pre>
! <a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
! <a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#myhostname">myhostname</a>
  </pre>
--- 10577,10579 ----
  <pre>
! <a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes
  </pre>
***************
*** 13843,13874 ****
  
! <DT><b><a name="smtpd_sasl_path">smtpd_sasl_path</a>
! (default: smtpd)</b></DT><DD>
! 
! <p> Implementation-specific information that the Postfix SMTP server
! passes through to
! the SASL plug-in implementation that is selected with
! <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>.  Typically this specifies the name of a
! configuration file or rendezvous point. </p>
! 
! <p> This feature is available in Postfix 2.3 and later. In earlier
! releases it was called <b><a href="postconf.5.html#smtpd_sasl_application_name">smtpd_sasl_application_name</a></b>. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_sasl_security_options">smtpd_sasl_security_options</a>
! (default: noanonymous)</b></DT><DD>
  
! <p> Postfix SMTP server SASL security options; as of Postfix 2.3
! the list of available
! features depends on the SASL server implementation that is selected
! with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>.  </p>
  
! <p> The following security features are defined for the <b>cyrus</b>
! server SASL implementation: </p>
  
  <p>
! Restrict what authentication mechanisms the Postfix SMTP server
! will offer to the client.  The list of available authentication
! mechanisms is system dependent.
  </p>
--- 10583,10601 ----
  
! <DT><b><a name="smtpd_helo_restrictions">smtpd_helo_restrictions</a>
! (default: empty)</b></DT><DD>
  
! <p>
! Optional restrictions that the Postfix SMTP server applies in the
! context of the SMTP HELO command.
! </p>
  
! <p>
! The default is to permit everything.
! </p>
  
  <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
  </p>
***************
*** 13876,13878 ****
  <p>
! Specify zero or more of the following:
  </p>
--- 10603,10606 ----
  <p>
! The following restrictions are specific to the hostname information
! received with the HELO or EHLO command.
  </p>
***************
*** 13881,13907 ****
  
! <dt><b>noplaintext</b></dt>
  
! <dd>Disallow methods that use plaintext passwords. </dd>
  
! <dt><b>noactive</b></dt>
  
! <dd>Disallow methods subject to active (non-dictionary) attack. </dd>
  
! <dt><b>nodictionary</b></dt>
  
! <dd>Disallow methods subject to passive (dictionary) attack. </dd>
  
! <dt><b>noanonymous</b></dt>
  
! <dd>Disallow methods that allow anonymous authentication. </dd>
  
! <dt><b>forward_secrecy</b></dt>
  
! <dd>Only allow methods that support forward secrecy (Dovecot only).
  </dd>
  
! <dt><b>mutual_auth</b></dt>
  
! <dd>Only allow methods that provide mutual authentication (not available
! with Cyrus SASL version 1). </dd>
  
--- 10609,10661 ----
  
! <dt><b><a name="check_helo_access">check_helo_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the HELO or EHLO
! hostname or parent domains, and execute the corresponding action.
! </dd>
  
! <dt><b><a name="check_helo_mx_access">check_helo_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
! the HELO or EHLO hostname, and execute the corresponding action.
! Note: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later.  </dd>
  
! <dt><b><a name="check_helo_ns_access">check_helo_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
! for the HELO or EHLO hostname, and execute the corresponding action.
! Note: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later.  </dd>
  
! <dt><b><a name="reject_invalid_helo_hostname">reject_invalid_helo_hostname</a></b> (with Postfix &lt; 2.3: reject_invalid_hostname)</dt>
  
! <dd>Reject the request when the HELO or EHLO hostname syntax is
! invalid. <br> The <a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> specifies the response
! code to rejected requests (default: 501).</dd>
  
! <dt><b><a name="reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a></b> (with Postfix &lt; 2.3: reject_non_fqdn_hostname)</dt>
  
! <dd>Reject the request when the HELO or EHLO hostname is not in
! fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code to
! rejected requests (default: 504).</dd>
! 
! <dt><b><a name="reject_rhsbl_helo">reject_rhsbl_helo <i>rbl_domain=d.d.d.d</i></a></b></dt>
! 
! <dd>Reject the request when the HELO or EHLO hostname hostname is
! listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
! (Postfix version 2.1 and later only).  If no "<i>=d.d.d.d</i>" is
! specified, reject the request when the HELO or EHLO hostname is
! listed with any A record under <i>rbl_domain</i>. See the
! <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description for additional RBL related configuration
! parameters.  This feature is available in Postfix 2.0 and later.
  </dd>
  
! <dt><b><a name="reject_unknown_helo_hostname">reject_unknown_helo_hostname</a></b> (with Postfix &lt; 2.3: reject_unknown_hostname)</dt>
  
! <dd>Reject the request when the HELO or EHLO hostname has no DNS A
! or MX record. <br> The <a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> specifies the
! response code to rejected requests (default: 450). </dd>
  
***************
*** 13910,13926 ****
  <p>
! By default, the Postfix SMTP server accepts plaintext passwords but
! not anonymous logins.
  </p>
  
! <p>
! Warning: it appears that clients try authentication methods in the
! order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5)
! which means that if you disable plaintext passwords, clients will
! log in anonymously, even when they should be able to use CRAM-MD5.
! So, if you disable plaintext logins, disable anonymous logins too.
! Postfix treats anonymous login as no authentication.
! </p>
  
  <p>
! Example:
  </p>
--- 10664,10687 ----
  <p>
! Other restrictions that are valid in this context:
  </p>
  
! <ul>
! 
! <li> <a href="#generic">Generic</a> restrictions that can be used
! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
! 
! <li> Client hostname or network address specific restrictions
! described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
! 
! <li> SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.  When
! sender or recipient restrictions are listed under <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
! they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
! $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> is evaluated at the time of the RCPT TO
! command.
! 
! </ul>
  
  <p>
! Examples:
  </p>
***************
*** 13928,13930 ****
  <pre>
! <a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a> = noanonymous, noplaintext
  </pre>
--- 10689,10692 ----
  <pre>
! <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a>
! <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>
  </pre>
***************
*** 13934,13942 ****
  
! <DT><b><a name="smtpd_sasl_tls_security_options">smtpd_sasl_tls_security_options</a>
! (default: $<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a>)</b></DT><DD>
  
! <p> The SASL authentication security options that the Postfix SMTP
! server uses for TLS encrypted SMTP sessions. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 10696,10719 ----
  
! <DT><b><a name="smtpd_history_flush_threshold">smtpd_history_flush_threshold</a>
! (default: 100)</b></DT><DD>
  
! <p>
! The maximal number of lines in the Postfix SMTP server command history
! before it is flushed upon receipt of EHLO, RSET, or end of DATA.
! </p>
  
! 
! </DD>
! 
! <DT><b><a name="smtpd_junk_command_limit">smtpd_junk_command_limit</a>
! (default: 100)</b></DT><DD>
! 
! <p>
! The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote
! SMTP client can send before the Postfix SMTP server starts to
! increment the error counter with each junk command.  The junk
! command count is reset after mail is delivered.  See also the
! <a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> and <a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> configuration
! parameters.
! </p>
  
***************
*** 13945,13952 ****
  
! <DT><b><a name="smtpd_sasl_type">smtpd_sasl_type</a>
! (default: cyrus)</b></DT><DD>
  
! <p> The SASL plug-in type that the Postfix SMTP server should use
! for authentication. The available types are listed with the
! "<b>postconf -a</b>" command. </p>
  
--- 10722,10729 ----
  
! <DT><b><a name="smtpd_milters">smtpd_milters</a>
! (default: empty)</b></DT><DD>
  
! <p> A list of Milter (mail filter) applications for new mail that
! arrives via the Postfix <a href="smtpd.8.html">smtpd(8)</a> server.  See the <a href="MILTER_README.html">MILTER_README</a>
! document for details.  </p>
  
***************
*** 13957,13959 ****
  
! <DT><b><a name="smtpd_sender_login_maps">smtpd_sender_login_maps</a>
  (default: empty)</b></DT><DD>
--- 10734,10736 ----
  
! <DT><b><a name="smtpd_noop_commands">smtpd_noop_commands</a>
  (default: empty)</b></DT><DD>
***************
*** 13961,13993 ****
  <p>
! Optional lookup table with the SASL login names that own sender
! (MAIL FROM) addresses.
  </p>
  
  <p>
! Specify zero or more "<a href="DATABASE_README.html">type:table</a>" lookup tables. With lookups from
! indexed files such as DB or DBM, or from networked tables such as
! NIS, LDAP or SQL, the following search operations are done with a
! sender address of <i>user@domain</i>:  </p>
  
- <dl>
  
! <dt> 1) <i>user@domain</i> </dt>
  
! <dd>This table lookup is always done and has the highest precedence. </dd>
  
! <dt> 2) <i>user</i> </dt>
  
! <dd>This table lookup is done only when the <i>domain</i> part of the
! sender address matches $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. </dd>
  
- <dt> 3) <i>@domain</i> </dt>
  
! <dd>This table lookup is done last and has the lowest precedence. </dd>
  
! </dl>
  
  <p>
! In all cases the result of table lookup must be either "not found"
! or a list of SASL login names separated by comma and/or whitespace.
  </p>
--- 10738,10782 ----
  <p>
! List of commands that the Postfix SMTP server replies to with "250
! Ok", without doing any syntax checks and without changing state.
! This list overrides any commands built into the Postfix SMTP server.
  </p>
  
+ 
+ </DD>
+ 
+ <DT><b><a name="smtpd_null_access_lookup_key">smtpd_null_access_lookup_key</a>
+ (default: &lt;&gt;)</b></DT><DD>
+ 
  <p>
! The lookup key to be used in SMTP <a href="access.5.html">access(5)</a> tables instead of the
! null sender address.
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_peername_lookup">smtpd_peername_lookup</a>
! (default: yes)</b></DT><DD>
  
! <p> Attempt to look up the remote SMTP client hostname, and verify that
! the name matches the client IP address. A client name is set to
! "unknown" when it cannot be looked up or verified, or when name
! lookup is disabled.  Turning off name lookup reduces delays due to
! DNS lookup and increases the maximal inbound delivery rate. </p>
  
! <p> This feature is available in Postfix 2.3 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a>
! (default: 300s)</b></DT><DD>
  
  <p>
! The time after which an idle SMTPD policy service connection is
! closed.
! </p>
! 
! <p>
! This feature is available in Postfix 2.1 and later.
  </p>
***************
*** 13997,14006 ****
  
! <DT><b><a name="smtpd_sender_restrictions">smtpd_sender_restrictions</a>
! (default: empty)</b></DT><DD>
  
  <p>
! Optional restrictions that the Postfix SMTP server applies in the
! context of the MAIL FROM command.
! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
! restriction lists" for a discussion of evaluation context and time.
  </p>
--- 10786,10793 ----
  
! <DT><b><a name="smtpd_policy_service_max_ttl">smtpd_policy_service_max_ttl</a>
! (default: 1000s)</b></DT><DD>
  
  <p>
! The time after which an active SMTPD policy service connection is
! closed.
  </p>
***************
*** 14008,14017 ****
  <p>
! The default is to permit everything.
  </p>
  
  <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
  </p>
--- 10795,10808 ----
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
+ 
+ </DD>
+ 
+ <DT><b><a name="smtpd_policy_service_timeout">smtpd_policy_service_timeout</a>
+ (default: 100s)</b></DT><DD>
+ 
  <p>
! The time limit for connecting to, writing to or receiving from a
! delegated SMTPD policy server.
  </p>
***************
*** 14019,14130 ****
  <p>
! The following restrictions are specific to the sender address
! received with the MAIL FROM command.
  </p>
  
- <dl>
  
! <dt><b><a name="check_sender_access">check_sender_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MAIL FROM
! address, domain, parent domains, or localpart@, and execute the
! corresponding action. </dd>
  
! <dt><b><a name="check_sender_mx_access">check_sender_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
! the MAIL FROM address, and execute the corresponding action.  Note:
! a result of "OK" is not allowed for safety reasons. Instead, use
! DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later. </dd>
  
- <dt><b><a name="check_sender_ns_access">check_sender_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
! for the MAIL FROM address, and execute the corresponding action.
! Note: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later.  </dd>
  
! <dt><b><a name="reject_authenticated_sender_login_mismatch">reject_authenticated_sender_login_mismatch</a></b></dt>
  
! <dd>Enforces the <a href="postconf.5.html#reject_sender_login_mismatch">reject_sender_login_mismatch</a> restriction for
! authenticated clients only. This feature is available in
! Postfix version 2.1 and later. </dd>
  
! <dt><b><a name="reject_non_fqdn_sender">reject_non_fqdn_sender</a></b></dt>
  
! <dd>Reject the request when the MAIL FROM address is not in
! fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
! rejected requests (default: 504). </dd>
  
! <dt><b><a name="reject_rhsbl_sender">reject_rhsbl_sender <i>rbl_domain=d.d.d.d</i></a></b></dt>
  
! <dd>Reject the request when the MAIL FROM domain is listed with
! the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix
! version 2.1 and later only).  Each "<i>d</i>" is a number, or a
! pattern inside "[]" that contains one or more ";"-separated numbers
! or number..number ranges (Postfix version 2.8 and later). If no
! "<i>=d.d.d.d</i>" is specified,
! reject the request when the MAIL FROM domain is
! listed with any A record under <i>rbl_domain</i>. <br> The
! <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
! rejected requests (default:  554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter
! specifies the default server reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter
! specifies tables with server replies indexed by <i>rbl_domain</i>.
! This feature is available in Postfix 2.0 and later.</dd>
  
- <dt><b><a name="reject_sender_login_mismatch">reject_sender_login_mismatch</a></b></dt>
  
! <dd>Reject the request when $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a> specifies an
! owner for the MAIL FROM address, but the client is not (SASL) logged
! in as that MAIL FROM address owner; or when the client is (SASL)
! logged in, but the client login name doesn't own the MAIL FROM
! address according to $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>.</dd>
  
! <dt><b><a name="reject_unauthenticated_sender_login_mismatch">reject_unauthenticated_sender_login_mismatch</a></b></dt>
  
! <dd>Enforces the <a href="postconf.5.html#reject_sender_login_mismatch">reject_sender_login_mismatch</a> restriction for
! unauthenticated clients only. This feature is available in
! Postfix version 2.1 and later. </dd>
  
- <dt><b><a name="reject_unknown_sender_domain">reject_unknown_sender_domain</a></b></dt>
  
! <dd>Reject the request when Postfix is not final destination for
! the sender address, and the MAIL FROM domain has 1) no DNS A or MX
! record, or 2) a malformed MX record such as a record with
! a zero-length MX hostname (Postfix version 2.3 and later). <br> The
! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the numerical
! response code for rejected requests (default: 450).  The response
! is always 450 in case of a temporary DNS error. <br> The
! <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> parameter specifies the action
! after a temporary DNS error (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). </dd>
  
! <dt><b><a name="reject_unlisted_sender">reject_unlisted_sender</a></b></dt>
  
! <dd>Reject the request when the MAIL FROM address is not listed in
! the list of valid recipients for its domain class. See the
! <a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> parameter description for details.
! This feature is available in Postfix 2.1 and later.</dd>
  
- <dt><b><a name="reject_unverified_sender">reject_unverified_sender</a></b></dt>
  
! <dd>Reject the request when mail to the MAIL FROM address is known to
! bounce, or when the sender address destination is not reachable.
! Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
! see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
! <a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> parameter specifies the numerical
! response code when an address is known to bounce (default: 450,
! change into 550 when you are confident that it is safe to do so).
! <br>The <a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> specifies the numerical response
! code when an address address probe failed due to a temporary problem
! (default: 450).  <br> The <a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a> parameter
! specifies the action after address probe failure due to a temporary
! problem (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>).  <br> This feature is available
! in Postfix 2.1 and later.  </dd>
  
! </dl>
  
  <p>
! Other restrictions that are valid in this context:
  </p>
--- 10810,10909 ----
  <p>
! This feature is available in Postfix 2.1 and later.
  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_proxy_ehlo">smtpd_proxy_ehlo</a>
! (default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
  
! <p>
! How the Postfix SMTP server announces itself to the proxy filter.
! By default, the Postfix hostname is used.
! </p>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_proxy_filter">smtpd_proxy_filter</a>
! (default: empty)</b></DT><DD>
  
! <p> The hostname and TCP port of the mail filtering proxy server.
! The proxy receives all mail from the Postfix SMTP server, and is
! supposed to give the result to another Postfix SMTP server process.
! </p>
  
! <p> Specify "host:port" or "inet:host:port" for a TCP endpoint, or
! "unix:pathname" for a UNIX-domain endpoint. The host can be specified
! as an IP address or as a symbolic name; no MX lookups are done.
! When no "host" or "host:"  are specified, the local machine is
! assumed.  Pathname interpretation is relative to the Postfix queue
! directory.  </p>
  
! <p> This feature is available in Postfix 2.1 and later.  </p>
! 
! <p> The "inet:" and "unix:" prefixes are available in Postfix 2.3
! and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_proxy_timeout">smtpd_proxy_timeout</a>
! (default: 100s)</b></DT><DD>
! 
! <p>
! The time limit for connecting to a proxy filter and for sending or
! receiving information.  When a connection fails the client gets a
! generic error message while more detailed information is logged to
! the maillog file.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_recipient_limit">smtpd_recipient_limit</a>
! (default: 1000)</b></DT><DD>
  
! <p>
! The maximal number of recipients that the Postfix SMTP server
! accepts per message delivery request.
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_recipient_overshoot_limit">smtpd_recipient_overshoot_limit</a>
! (default: 1000)</b></DT><DD>
  
! <p> The number of recipients that a remote SMTP client can send in
! excess of the limit specified with $<a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a>, before
! the Postfix SMTP server increments the per-session error count
! for each excess recipient.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>
! (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>)</b></DT><DD>
  
  <p>
! The access restrictions that the Postfix SMTP server applies in
! the context of the RCPT TO command.
! </p>
! 
! <p>
! By default, the Postfix SMTP server accepts:
  </p>
***************
*** 14133,14145 ****
  
! <li> <a href="#generic">Generic</a> restrictions that can be used
! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
  
! <li> SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
  
! <li> SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. When recipient restrictions are listed
! under <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, they have effect only with
! "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> is
! evaluated at the time of the RCPT TO command.
  
--- 10912,10922 ----
  
! <li> Mail from clients whose IP address matches $<a href="postconf.5.html#mynetworks">mynetworks</a>, or:
  
! <li> Mail to remote destinations that match $<a href="postconf.5.html#relay_domains">relay_domains</a>, except
! for addresses that contain sender-specified routing
! (user@elsewhere@domain), or:
  
! <li> Mail to local destinations that match $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or
! $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
  
***************
*** 14148,14354 ****
  <p>
! Examples:
  </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>,
!     <a href="postconf.5.html#check_sender_access">check_sender_access</a> hash:/etc/postfix/access
  </pre>
  
! 
! </DD>
! 
! <DT><b><a name="smtpd_service_name">smtpd_service_name</a>
! (default: smtpd)</b></DT><DD>
! 
! <p> The internal service that <a href="postscreen.8.html">postscreen(8)</a> hands off allowed
! connections to. In a future version there may be different
! classes of SMTP service. </p>
! 
! <p> This feature is available in Postfix 2.8. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_soft_error_limit">smtpd_soft_error_limit</a>
! (default: 10)</b></DT><DD>
  
  <p>
! The number of errors a remote SMTP client is allowed to make without
! delivering mail before the Postfix SMTP server slows down all its
! responses.
  </p>
  
! <ul>
  
! <li><p>With Postfix version 2.1 and later, the Postfix SMTP server
! delays all responses by $<a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> seconds. </p>
  
! <li><p>With Postfix versions 2.0 and earlier, the Postfix SMTP
! server delays all responses by (number of errors) seconds. </p>
  
! </ul>
  
  
! </DD>
  
! <DT><b><a name="smtpd_starttls_timeout">smtpd_starttls_timeout</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p> The time limit for Postfix SMTP server write and read operations
! during TLS startup and shutdown handshake procedures. The current
! default value is stress-dependent. Before Postfix version 2.8, it
! was fixed at 300s. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_timeout">smtpd_timeout</a>
! (default: normal: 300s, overload: 10s)</b></DT><DD>
  
! <p>
! The time limit for sending a Postfix SMTP server response and for
! receiving a remote SMTP client request. Normally the default limit
! is 300s, but it changes under overload to just 10s. With Postfix
! 2.5 and earlier, the SMTP server always uses a time limit of 300s
! by default.
! </p>
  
! <p>
! Note: if you set SMTP time limits to very large values you may have
! to update the global <a href="postconf.5.html#ipc_timeout">ipc_timeout</a> parameter.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_CAfile">smtpd_tls_CAfile</a>
! (default: empty)</b></DT><DD>
  
! <p> A file containing (PEM format) CA certificates of root CAs trusted
! to sign either remote SMTP client certificates or intermediate CA
! certificates.  These are loaded into memory before the <a href="smtpd.8.html">smtpd(8)</a> server
! enters the chroot jail. If the number of trusted roots is large, consider
! using <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> instead, but note that the latter directory must
! be present in the chroot jail if the <a href="smtpd.8.html">smtpd(8)</a> server is chrooted. This
! file may also be used to augment the server certificate trust chain,
! but it is best to include all the required certificates directly in the
! server certificate file. </p>
! 
! <p> Specify "<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> = /path/to/system_CA_file" to use ONLY
! the system-supplied default certificate authority certificates.
! </p>
! 
! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
! appending the system-supplied default CAs and trusting third-party
! certificates. </p>
! 
! <p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are not
! requested, and <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> should remain empty. If you do make use
! of client certificates, the distinguished names (DNs) of the certificate
! authorities listed in <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> are sent to the remote SMTP client
! in the client certificate request message. MUAs with multiple client
! certificates may use the list of preferred certificate authorities
! to select the correct client certificate.  You may want to put your
! "preferred" CA or CAs in this file, and install other trusted CAs in
! $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> = /etc/postfix/CAcert.pem
! </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_CApath">smtpd_tls_CApath</a>
! (default: empty)</b></DT><DD>
  
! <p> A directory containing (PEM format) CA certificates of root CAs
! trusted to sign either remote SMTP client certificates or intermediate CA
! certificates. Do not forget to create the necessary "hash" links with,
! for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
! <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> in chroot mode, this directory (or a copy) must be
! inside the chroot jail. </p>
! 
! <p> Specify "<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> = /path/to/system_CA_directory" to
! use ONLY the system-supplied default certificate authority certificates.
! </p>
! 
! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
! appending the system-supplied default CAs and trusting third-party
! certificates. </p>
! 
! <p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are
! not requested, and <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> should remain empty. In contrast
! to <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, DNs of certificate authorities installed
! in $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> are not included in the client certificate
! request message. MUAs with multiple client certificates may use the
! list of preferred certificate authorities to select the correct
! client certificate.  You may want to put your "preferred" CA or
! CAs in $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, and install the remaining trusted CAs in
! $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> = /etc/postfix/certs
! </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>
! (default: yes)</b></DT><DD>
  
! <p> Force the Postfix SMTP server to issue a TLS session id, even
! when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
! is empty). This behavior is compatible with Postfix &lt; 2.3. </p>
  
! <p> With Postfix 2.3 and later the Postfix SMTP server can disable
! session id generation when TLS session caching is turned off. This
! keeps remote SMTP clients from caching sessions that almost certainly cannot
! be re-used.  </p>
  
! <p> By default, the Postfix SMTP server always generates TLS session
! ids. This works around a known defect in mail client applications
! such as MS Outlook, and may also prevent interoperability issues
! with other MTAs. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> = no
! </pre>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>
! (default: no)</b></DT><DD>
  
! <p> Ask a remote SMTP client for a client certificate. This
! information is needed for certificate based mail relaying with,
! for example, the <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> feature. </p>
  
! <p> Some clients such as Netscape will either complain if no
! certificate is available (for the list of CAs in $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)
! or will offer multiple client certificates to choose from. This
! may be annoying, so this option is "off" by default. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 10925,11107 ----
  <p>
! IMPORTANT: If you change this parameter setting, you must specify
! at least one of the following restrictions. Otherwise Postfix will
! refuse to receive mail:
  </p>
  
+ <blockquote>
  <pre>
! reject, defer, <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
  </pre>
+ </blockquote>
  
! <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
! </p>
  
  <p>
! The following restrictions are specific to the recipient address
! that is received with the RCPT TO command.
  </p>
  
! <dl>
  
! <dt><b><a name="check_recipient_access">check_recipient_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the resolved RCPT
! TO address, domain, parent domains, or localpart@, and execute the
! corresponding action.  </dd>
  
! <dt><b><a name="check_recipient_mx_access">check_recipient_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
! 
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
! the RCPT TO domain, and execute the corresponding action.  Note:
! a result of "OK" is not allowed for safety reasons. Instead, use
! DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later. </dd>
  
+ <dt><b><a name="check_recipient_ns_access">check_recipient_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
! for the RCPT TO domain, and execute the corresponding action.
! Note: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later.  </dd>
  
! <dt><b><a name="permit_auth_destination">permit_auth_destination</a></b></dt>
  
! <dd>Permit the request when one of the following is true:
  
! <ul>
  
+ <li> Postfix is mail forwarder: the resolved RCPT TO domain matches
+ $<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and the address contains no
+ sender-specified routing (user@elsewhere@domain),
  
! <li> Postfix is the final destination: the resolved RCPT TO domain
! matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
! $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and the address
! contains no sender-specified routing (user@elsewhere@domain).
  
! </ul></dd>
  
! <dt><b><a name="permit_mx_backup">permit_mx_backup</a></b></dt>
  
! <dd>Permit the request when the local mail system is backup MX for
! the RCPT TO domain, or when the domain is an authorized destination
! (see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> for definition).
  
! <ul>
  
+ <li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> does not accept addresses that have
+ sender-specified routing information (example: user@elsewhere@domain).
  
! <li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> can be vulnerable to mis-use when
! access is not restricted with <a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a>.
  
! <li> Safety: as of Postfix version 2.3, <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> no longer
! accepts the address when the local mail system is primary MX for
! the recipient domain.  Exception: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> accepts the address
! when it specifies an authorized destination (see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
! for definition).
  
! <li> Limitation: mail may be rejected in case of a temporary DNS
! lookup problem with Postfix prior to version 2.0.
  
! </ul></dd>
  
! <dt><b><a name="reject_non_fqdn_recipient">reject_non_fqdn_recipient</a></b></dt>
  
! <dd>Reject the request when the RCPT TO address is not in
! fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code to
! rejected requests (default: 504). </dd>
  
+ <dt><b><a name="reject_rhsbl_recipient">reject_rhsbl_recipient <i>rbl_domain=d.d.d.d</i></a></b></dt>
  
! <dd>Reject the request when the RCPT TO domain is listed with the
! A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
! 2.1 and later only).  If no "<i>=d.d.d.d</i>" is specified, reject
! the request when the RCPT TO domain is listed with
! any A record under <i>rbl_domain</i>. <br> The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a>
! parameter specifies the response code for rejected requests (default:
! 554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter specifies the default server
! reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter specifies tables with server
! replies indexed by <i>rbl_domain</i>.  This feature is available
! in Postfix version 2.0 and later.</dd>
  
! <dt><b><a name="reject_unauth_destination">reject_unauth_destination</a></b></dt>
  
! <dd>Reject the request unless one of the following is true:
  
! <ul>
  
! <li> Postfix is mail forwarder: the resolved RCPT TO domain matches
! $<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and contains no sender-specified
! routing (user@elsewhere@domain),
  
! <li> Postfix is the final destination: the resolved RCPT TO domain
! matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
! $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and contains
! no sender-specified routing (user@elsewhere@domain).
  
+ </ul> The <a href="postconf.5.html#relay_domains_reject_code">relay_domains_reject_code</a> parameter specifies the response
+ code for rejected requests (default: 554). </dd>
  
! <dt><b><a name="reject_unknown_recipient_domain">reject_unknown_recipient_domain</a></b></dt>
  
! <dd>Reject the request when Postfix is not final destination for
! the recipient domain, and the RCPT TO domain has no DNS A or MX
! record, or when it has a malformed MX record such as a record with
! a zero-length MX hostname (Postfix version 2.3 and later). <br> The
! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the response code
! for rejected requests (default: 450).  The response is always 450
! in case of a temporary DNS error.</dd>
  
! <dt><b><a name="reject_unlisted_recipient">reject_unlisted_recipient</a></b> (with Postfix version 2.0: check_recipient_maps)</dt>
  
! <dd> Reject the request when the RCPT TO address is not listed in
! the list of valid recipients for its domain class. See the
! <a href="postconf.5.html#smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a> parameter description for details.
! This feature is available in Postfix 2.1 and later.</dd>
  
! <dt><b><a name="reject_unverified_recipient">reject_unverified_recipient</a></b></dt>
  
! <dd>Reject the request when mail to the RCPT TO address is known
! to bounce, or when the recipient address destination is not reachable.
! Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
! see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details.  <br> The
! <a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> parameter specifies the response
! when an address is known to bounce (default: 450, change into 550
! when you are confident that it is safe to do so).  The
! <a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> parameter specifies the response
! when an address probe failed due to a temporary problem (default:
! 450).  This feature is available in Postfix 2.1 and later.  </dd>
  
! </dl>
  
! <p>
! Other restrictions that are valid in this context:
! </p>
  
+ <ul>
  
! <li><a href="#generic">Generic</a> restrictions that can be used
! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
  
! <li>SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>.
  
! </ul>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
! </pre>
  
***************
*** 14357,14388 ****
  
! <DT><b><a name="smtpd_tls_auth_only">smtpd_tls_auth_only</a>
! (default: no)</b></DT><DD>
  
! <p> When TLS encryption is optional in the Postfix SMTP server, do
! not announce or accept SASL authentication over unencrypted
! connections. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a>
! (default: 9)</b></DT><DD>
  
! <p> The verification depth for remote SMTP client certificates. A
! depth of 1 is sufficient if the issuing CA is listed in a local CA
! file. </p>
  
! <p> The default verification depth is 9 (the OpenSSL default) for
! compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
! the default value was 5, but the limit was not actually enforced. If
! you have set this to a lower non-default value, certificates with longer
! trust chains may now fail to verify. Certificate chains with 1 or 2
! CAs are common, deeper chains are more rare and any number between 5
! and 9 should suffice in practice. You can choose a lower number if,
! for example, you trust certificates directly signed by an issuing CA
! but not any CAs it delegates to. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 11110,11143 ----
  
! <DT><b><a name="smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a>
! (default: yes)</b></DT><DD>
  
! <p>
! Request that the Postfix SMTP server rejects mail for unknown
! recipient addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a>
! access restriction is specified. This prevents the Postfix queue
! from filling up with undeliverable MAILER-DAEMON messages.
! </p>
  
! <ul>
  
+ <li> The recipient domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
+ or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, but the recipient is not listed in
+ $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> is not null.
  
! <li> The recipient domain matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> but the
! recipient is not listed in $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>.
  
! <li> The recipient domain matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> but the
! recipient is not listed in $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
! is not null.
  
! <li> The recipient domain matches $<a href="postconf.5.html#relay_domains">relay_domains</a> but the recipient
! is not listed in $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>, and $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>
! is not null.
  
! </ul>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
***************
*** 14391,14446 ****
  
! <DT><b><a name="smtpd_tls_cert_file">smtpd_tls_cert_file</a>
! (default: empty)</b></DT><DD>
! 
! <p> File with the Postfix SMTP server RSA certificate in PEM format.
! This file may also contain the Postfix SMTP server private RSA key. </p>
! 
! <p> Public Internet MX hosts without certificates signed by a "reputable"
! CA must generate, and be prepared to present to most clients, a
! self-signed or private-CA signed certificate. The client will not be
! able to authenticate the server, but unless it is running Postfix 2.3 or
! similar software, it will still insist on a server certificate. </p>
! 
! <p> For servers that are <b>not</b> public Internet MX hosts, Postfix
! 2.3 supports configurations with no certificates. This entails the
! use of just the anonymous TLS ciphers, which are not supported by
! typical SMTP clients. Since such clients will not, as a rule, fall
! back to plain text after a TLS handshake failure, the server will
! be unable to receive email from TLS enabled clients. To avoid
! accidental configurations with no certificates, Postfix 2.3 enables
! certificate-less operation only when the administrator explicitly
! sets "<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = none". This ensures that new Postfix
! configurations will not accidentally run with no certificates. </p>
  
! <p> Both RSA and DSA certificates are supported.  When both types
! are present, the cipher used determines which certificate will be
! presented to the client.  For Netscape and OpenSSL clients without
! special cipher choices the RSA certificate is preferred. </p>
  
! <p> To enable a remote SMTP client to verify the Postfix SMTP server
! certificate, the issuing CA certificates must be made available to the
! client. You should include the required certificates in the server
! certificate file, the server certificate first, then the issuing
! CA(s) (bottom-up order). </p>
  
! <p> Example: the certificate for "server.example.com" was issued by
! "intermediate CA" which itself has a certificate of "root CA".
! Create the server.pem file with "cat server_cert.pem intermediate_CA.pem
! root_CA.pem &gt; server.pem". </p>
  
! <p> If you also want to verify client certificates issued by these
! CAs, you can add the CA certificates to the <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, in which
! case it is not necessary to have them in the <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> or
! <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. </p>
  
! <p> A certificate supplied here must be usable as an SSL server certificate
! and hence pass the "openssl verify -purpose sslserver ..." test. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = /etc/postfix/server.pem
! </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 11146,11177 ----
  
! <DT><b><a name="smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a>
! (default: no)</b></DT><DD>
  
! <p> Request that the Postfix SMTP server rejects mail from unknown
! sender addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a>
! access restriction is specified. This can slow down an explosion
! of forged mail from worms or viruses.  </p>
  
! <ul>
  
! <li> The sender domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or
! $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, but the sender is not listed in
! $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> is not null.
  
! <li> The sender domain matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> but the sender
! is not listed in $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>.
  
! <li> The sender domain matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> but the
! sender is not listed in $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
! is not null.
  
! <li> The sender domain matches $<a href="postconf.5.html#relay_domains">relay_domains</a> but the sender is
! not listed in $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>, and $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> is
! not null.
  
! </ul>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
***************
*** 14449,14467 ****
  
! <DT><b><a name="smtpd_tls_cipherlist">smtpd_tls_cipherlist</a>
  (default: empty)</b></DT><DD>
  
! <p> Obsolete Postfix &lt; 2.3 control for the Postfix SMTP server TLS
! cipher list. It is easy to create inter-operability problems by choosing
! a non-default cipher list. Do not use a non-default TLS cipherlist for
! MX hosts on the public Internet. Clients that begin the TLS handshake,
! but are unable to agree on a common cipher, may not be able to send any
! email to the SMTP server. Using a restricted cipher list may be more
! appropriate for a dedicated MSA or an internal mailhub, where one can
! exert some control over the TLS software and settings of the connecting
! clients. </p>
! 
! <p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
  
! <p>This feature is available with Postfix version 2.2. It is not used with
! Postfix 2.3 and later; use <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> instead. </p>
  
--- 11180,11194 ----
  
! <DT><b><a name="smtpd_restriction_classes">smtpd_restriction_classes</a>
  (default: empty)</b></DT><DD>
  
! <p>
! User-defined aliases for groups of access restrictions. The aliases
! can be specified in <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> etc., and on the
! right-hand side of a Postfix <a href="access.5.html">access(5)</a> table.
! </p>
  
! <p>
! One major application is for implementing per-recipient UCE control.
! See the <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a> document for other examples.
! </p>
  
***************
*** 14470,14494 ****
  
! <DT><b><a name="smtpd_tls_ciphers">smtpd_tls_ciphers</a>
! (default: export)</b></DT><DD>
! 
! <p> The minimum TLS cipher grade that the Postfix SMTP server
! will use with opportunistic TLS encryption. Cipher types listed in
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are excluded from the base definition of
! the selected cipher grade. The default value "export" ensures maximum
! inter-operability. Because encryption is optional, stronger controls
! are not appropriate, and this setting SHOULD NOT be changed unless the
! change is essential. </p>
! 
! <p> When TLS is mandatory the cipher grade is chosen via the
! <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
! details. </p>
  
! <p> Example: </p>
! <pre>
! <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> = export
! </pre>
  
! <p> This feature is available in Postfix 2.6 and later. With earlier Postfix
! releases only the <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> parameter is implemented,
! and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
  
--- 11197,11213 ----
  
! <DT><b><a name="smtpd_sasl_application_name">smtpd_sasl_application_name</a>
! (default: smtpd)</b></DT><DD>
  
! <p>
! The application name that the Postfix SMTP server uses for SASL
! server initialization. This
! controls the name of the SASL configuration file. The default value
! is <b>smtpd</b>, corresponding to a SASL configuration file named
! <b>smtpd.conf</b>.
! </p>
  
! <p>
! This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3
! it was renamed to <a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a>.
! </p>
  
***************
*** 14497,14514 ****
  
! <DT><b><a name="smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>
! (default: empty)</b></DT><DD>
  
! <p> File with the Postfix SMTP server DSA certificate in PEM format.
! This file may also contain the Postfix SMTP server private DSA key. </p>
  
! <p> See the discussion under <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for more details.
  </p>
  
! <p> Example: </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> = /etc/postfix/server-dsa.pem
  </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 11216,11250 ----
  
! <DT><b><a name="smtpd_sasl_auth_enable">smtpd_sasl_auth_enable</a>
! (default: no)</b></DT><DD>
  
! <p>
! Enable SASL authentication in the Postfix SMTP server. By default,
! the Postfix SMTP server does not use authentication.
! </p>
  
! <p>
! If a remote SMTP client is authenticated, the <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>
! access restriction can be used to permit relay access, like this:
  </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
!     <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, ...
! </pre>
! </blockquote>
! 
! <p> To reject all SMTP connections from unauthenticated clients,
! specify "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes" (which is the default) and use:
! </p>
  
+ <blockquote>
  <pre>
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, reject
  </pre>
+ </blockquote>
  
! <p>
! See the <a href="SASL_README.html">SASL_README</a> file for SASL configuration and operation details.
! </p>
  
***************
*** 14517,14546 ****
  
! <DT><b><a name="smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
  (default: empty)</b></DT><DD>
  
! <p> File with DH parameters that the Postfix SMTP server should
! use with EDH ciphers. </p>
  
! <p> Instead of using the exact same parameter sets as distributed
! with other TLS packages, it is more secure to generate your own
! set of parameters with something like the following command:  </p>
  
! <blockquote>
! <pre>
! openssl gendh -out /etc/postfix/dh_1024.pem -2 1024
! </pre>
! </blockquote>
  
! <p> Your actual source for entropy may differ. Some systems have
! /dev/random; on other system you may consider using the "Entropy
! Gathering Daemon EGD", available at <a href="http://egd.sourceforge.net/">http://egd.sourceforge.net/</a>
  </p>
  
- <p> Example: </p>
- 
  <pre>
! <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> = /etc/postfix/dh_1024.pem
  </pre>
  
! <p>This feature is available with Postfix version 2.2.</p>
  
--- 11253,11309 ----
  
! <DT><b><a name="smtpd_sasl_authenticated_header">smtpd_sasl_authenticated_header</a>
! (default: no)</b></DT><DD>
! 
! <p> Report the SASL authenticated user name in the <a href="smtpd.8.html">smtpd(8)</a> Received
! message header.  </p>
! 
! <p> This feature is available in Postfix 2.3 and later.  </p>
! 
! 
! </DD>
! 
! <DT><b><a name="smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a>
  (default: empty)</b></DT><DD>
  
! <p>
! What remote SMTP clients the Postfix SMTP server will not offer
! AUTH support to.
! </p>
  
! <p>
! Some clients (Netscape 4 at least) have a bug that causes them to
! require a login and password whenever AUTH is offered, whether it's
! necessary or not. To work around this, specify, for example,
! $<a href="postconf.5.html#mynetworks">mynetworks</a> to prevent Postfix from offering AUTH to local clients.
! </p>
  
! <p>
! Specify a list of network/netmask patterns, separated by commas
! and/or whitespace. The mask specifies the number of bits in the
! network part of a host address. You can also "/file/name" or
! "<a href="DATABASE_README.html">type:table</a>" patterns.  A "/file/name" pattern is replaced by its
! contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a table entry
! matches a lookup string (the lookup result is ignored).  Continue
! long lines by starting the next line with whitespace. Specify
! "!pattern" to exclude an address or network block from the list.
! The form "!/file/name" is supported only in Postfix version 2.4 and
! later.  </p>
! 
! <p> Note: IP version 6 address information must be specified inside
! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> value, and in
! files specified with "/file/name".  IP version 6 addresses contain
! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
! pattern.  </p>
  
! <p>
! Example:
  </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
  </pre>
  
! <p>
! This feature is available in Postfix 2.1 and later.
! </p>
  
***************
*** 14549,14567 ****
  
! <DT><b><a name="smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>
  (default: empty)</b></DT><DD>
  
! <p> File with DH parameters that the Postfix SMTP server should
! use with EDH ciphers. </p>
  
! <p> See also the discussion under the <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
! configuration parameter.  </p>
  
! <p> Example: </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> = /etc/postfix/dh_512.pem
  </pre>
  
- <p>This feature is available with Postfix version 2.2.</p>
- 
  
--- 11312,11334 ----
  
! <DT><b><a name="smtpd_sasl_local_domain">smtpd_sasl_local_domain</a>
  (default: empty)</b></DT><DD>
  
! <p>
! The name of the Postfix SMTP server's local SASL authentication
! realm.
! </p>
  
! <p>
! By default, the local authentication realm name is the null string.
! </p>
  
! <p>
! Examples:
! </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
! <a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#myhostname">myhostname</a>
  </pre>
  
  
***************
*** 14569,14583 ****
  
! <DT><b><a name="smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b></DT><DD>
! 
! <p> File with the Postfix SMTP server DSA private key in PEM format.
! This file may be combined with the Postfix SMTP server DSA certificate
! file specified with $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. </p>
  
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 11336,11348 ----
  
! <DT><b><a name="smtpd_sasl_path">smtpd_sasl_path</a>
! (default: smtpd)</b></DT><DD>
  
! <p> Implementation-specific information that the Postfix SMTP server
! passes through to
! the SASL plug-in implementation that is selected with
! <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>.  Typically this specifies the name of a
! configuration file or rendezvous point. </p>
  
! <p> This feature is available in Postfix 2.3 and later. In earlier
! releases it was called <b>smtpd_sasl_application_name</b>. </p>
  
***************
*** 14586,14650 ****
  
! <DT><b><a name="smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>
! (default: empty)</b></DT><DD>
! 
! <p> File with the Postfix SMTP server ECDSA certificate in PEM format.
! This file may also contain the Postfix SMTP server private ECDSA key. </p>
! 
! <p> See the discussion under <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for more details. </p>
! 
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> = /etc/postfix/ecdsa-scert.pem
! </pre>
  
! <p> This feature is available in Postfix 2.6 and later, when Postfix is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_eckey_file">smtpd_tls_eckey_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b></DT><DD>
  
! <p> File with the Postfix SMTP server ECDSA private key in PEM format.
! This file may be combined with the Postfix SMTP server ECDSA certificate
! file specified with $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>. </p>
  
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
  
! <p> This feature is available in Postfix 2.6 and later, when Postfix is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p> The Postfix SMTP server security grade for ephemeral elliptic-curve
! Diffie-Hellman (EECDH) key exchange. </p>
  
! <p> The available choices are: </p>
  
! <dl>
  
! <dt><b>none</b></dt> <dd> Don't use EECDH. Ciphers based on EECDH key
! exchange will be disabled. This is the default in Postfix versions
! 2.6 and 2.7. </dd>
! 
! <dt><b>strong</b></dt> <dd> Use EECDH with approximately 128
! bits of security at a reasonable computational cost. This is the
! current best-practice trade-off between security and computational
! efficiency. This is the default in Postfix version 2.8 and later.
  </dd>
  
! <dt><b>ultra</b></dt> <dd> Use EECDH with approximately 192 bits of
! security at computational cost that is approximately twice as high
! as 128 bit strength ECC. Barring significant progress in attacks on
! elliptic curve crypto-systems, the "strong" curve is sufficient for most
! users. </dd>
  
--- 11351,11400 ----
  
! <DT><b><a name="smtpd_sasl_security_options">smtpd_sasl_security_options</a>
! (default: noanonymous)</b></DT><DD>
  
! <p> Postfix SMTP server SASL security options; as of Postfix 2.3
! the list of available
! features depends on the SASL server implementation that is selected
! with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>.  </p>
  
! <p> The following security features are defined for the <b>cyrus</b>
! server SASL implementation: </p>
  
+ <p>
+ Restrict what authentication mechanisms the Postfix SMTP server
+ will offer to the client.  The list of available authentication
+ mechanisms is system dependent.
+ </p>
  
! <p>
! Specify zero or more of the following:
! </p>
  
! <dl>
  
! <dt><b>noplaintext</b></dt>
  
! <dd>Disallow methods that use plaintext passwords. </dd>
  
! <dt><b>noactive</b></dt>
  
+ <dd>Disallow methods subject to active (non-dictionary) attack. </dd>
  
! <dt><b>nodictionary</b></dt>
  
! <dd>Disallow methods subject to passive (dictionary) attack. </dd>
  
! <dt><b>noanonymous</b></dt>
  
! <dd>Disallow methods that allow anonymous authentication. </dd>
  
! <dt><b>forward_secrecy</b></dt>
  
! <dd>Only allow methods that support forward secrecy (Dovecot only).
  </dd>
  
! <dt><b>mutual_auth</b></dt>
! 
! <dd>Only allow methods that provide mutual authentication (not available
! with Cyrus SASL version 1). </dd>
  
***************
*** 14652,14690 ****
  
! <p> This feature is available in Postfix 2.6 and later, when it is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
! (default: empty)</b></DT><DD>
  
- <p> List of ciphers or cipher types to exclude from the SMTP server
- cipher list at all TLS security levels. Excluding valid ciphers
- can create interoperability problems. DO NOT exclude ciphers unless it
- is essential to do so. This is not an OpenSSL cipherlist; it is a simple
- list separated by whitespace and/or commas. The elements are a single
- cipher, or one or more "+" separated cipher properties, in which case
- only ciphers matching <b>all</b> the properties are excluded. </p>
  
! <p> Examples (some of these will cause problems): </p>
  
! <blockquote>
! <pre>
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = MD5, DES
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = DES+MD5
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = kEDH+aRSA
! </pre>
! </blockquote>
  
! <p> The first setting disables anonymous ciphers. The next setting
! disables ciphers that use the MD5 digest algorithm or the (single) DES
! encryption algorithm. The next setting disables ciphers that use MD5 and
! DES together.  The next setting disables the two ciphers "AES256-SHA"
! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
! key exchange with RSA authentication. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
--- 11402,11435 ----
  
! <p>
! By default, the Postfix SMTP server accepts plaintext passwords but
! not anonymous logins.
! </p>
  
+ <p>
+ Warning: it appears that clients try authentication methods in the
+ order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5)
+ which means that if you disable plaintext passwords, clients will
+ log in anonymously, even when they should be able to use CRAM-MD5.
+ So, if you disable plaintext logins, disable anonymous logins too.
+ Postfix treats anonymous login as no authentication.
+ </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a> = noanonymous, noplaintext
! </pre>
  
  
! </DD>
  
! <DT><b><a name="smtpd_sasl_tls_security_options">smtpd_sasl_tls_security_options</a>
! (default: $<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a>)</b></DT><DD>
  
! <p> The SASL authentication security options that the Postfix SMTP
! server uses for TLS encrypted SMTP sessions. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 14693,14775 ****
  
! <DT><b><a name="smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>
! (default: md5)</b></DT><DD>
  
! <p> The message digest algorithm to construct remote SMTP
! client-certificate
! fingerprints or public key fingerprints (Postfix 2.9 and later)
! for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and <b><a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a></b>. The
! default algorithm is <b>md5</b>, for backwards compatibility with Postfix
! releases prior to 2.5.  </p>
  
! <p> Advances in hash
! function cryptanalysis have led to md5 being deprecated in favor of sha1.
! However, as long as there are no known "second pre-image" attacks
! against md5, its use in this context can still be considered safe.
! </p>
  
- <p> While additional digest algorithms are often available with OpenSSL's
- libcrypto, only those used by libssl in SSL cipher suites are available to
- Postfix. </p>
  
! <p> To find the fingerprint of a specific certificate file, with a
! specific digest algorithm, run: </p>
  
! <blockquote>
! <pre>
! $ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
! </pre>
! </blockquote>
  
! <p> The text to the right of "=" sign is the desired fingerprint.
! For example: </p>
  
! <blockquote>
! <pre>
! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem
! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
! </pre>
! </blockquote>
  
! <p> Public key fingerprints are more difficult to extract, however,
! the SHA-1 public key fingerprint is often present as the value of the
! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix
! SMTP server and client log the peer certificate fingerprint and public
! key fingerprint when TLS loglevel is 1 or higher. </p>
  
! <p> Example: client-certificate access table, with sha1 fingerprints: </p>
  
! <blockquote>
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> = sha1
!     <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
!         <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> hash:/etc/postfix/access,
!         reject
! </pre>
! <pre>
! /etc/postfix/access:
!     # Action folded to next line...
!     AF:88:7C:AD:51:95:6F:36:96:F6:01:FB:2E:48:CD:AB:49:25:A2:3B
!         OK
!     85:16:78:FD:73:6E:CE:70:E0:31:5F:0D:3C:C8:6D:C4:2C:24:59:E1
!         <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
! </pre>
! </blockquote>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_key_file">smtpd_tls_key_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b></DT><DD>
  
! <p> File with the Postfix SMTP server RSA private key in PEM format.
! This file may be combined with the Postfix SMTP server RSA certificate
! file specified with $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>. </p>
  
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted. File permissions should grant read-only
! access to the system superuser account ("root"), and no access
! to anyone else. </p>
  
--- 11438,11487 ----
  
! <DT><b><a name="smtpd_sasl_type">smtpd_sasl_type</a>
! (default: cyrus)</b></DT><DD>
  
! <p> The SASL plug-in type that the Postfix SMTP server should use
! for authentication. The available types are listed with the
! "<b>postconf -a</b>" command. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_sender_login_maps">smtpd_sender_login_maps</a>
! (default: empty)</b></DT><DD>
  
! <p>
! Optional lookup table with the SASL login names that own sender
! (MAIL FROM) addresses.
! </p>
  
! <p>
! Specify zero or more "<a href="DATABASE_README.html">type:table</a>" lookup tables. With lookups from
! indexed files such as DB or DBM, or from networked tables such as
! NIS, LDAP or SQL, the following search operations are done with a
! sender address of <i>user@domain</i>:  </p>
  
! <dl>
  
! <dt> 1) <i>user@domain</i> </dt>
  
! <dd>This table lookup is always done and has the highest precedence. </dd>
  
! <dt> 2) <i>user</i> </dt>
  
+ <dd>This table lookup is done only when the <i>domain</i> part of the
+ sender address matches $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
+ or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. </dd>
  
! <dt> 3) <i>@domain</i> </dt>
  
! <dd>This table lookup is done last and has the lowest precedence. </dd>
  
! </dl>
  
! <p>
! In all cases the result of table lookup must be either "not found"
! or a list of SASL login names separated by comma and/or whitespace.
! </p>
  
***************
*** 14778,14936 ****
  
! <DT><b><a name="smtpd_tls_loglevel">smtpd_tls_loglevel</a>
! (default: 0)</b></DT><DD>
  
! <p> Enable additional Postfix SMTP server logging of TLS activity.
! Each logging level also includes the information that is logged at
! a lower logging level.  </p>
  
! <dl compact>
  
! <dt> </dt> <dd> 0 Log only a summary message on TLS handshake completion
! &mdash; no logging of remote SMTP client certificate trust-chain verification
! errors
! if client certificate verification is not required. With Postfix 2.8
! and earlier, disable logging of TLS activity. </dd>
! 
! <dt> </dt> <dd> 1 Also log trust-chain verification errors and peer
! certificate name and issuer. With Postfix 2.8 and earlier, log TLS
! handshake and certificate information. </dd>
  
! <dt> </dt> <dd> 2 Also log levels during TLS negotiation. </dd>
  
! <dt> </dt> <dd> 3 Also log hexadecimal and ASCII dump of TLS negotiation
! process. </dd>
  
! <dt> </dt> <dd> 4 Also log hexadecimal and ASCII dump of complete
! transmission after STARTTLS. </dd>
  
! </dl>
  
! <p> Do not use "<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> = 2" or higher except in case
! of problems. Use of loglevel 4 is strongly discouraged. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>
! (default: medium)</b></DT><DD>
  
! <p> The minimum TLS cipher grade that the Postfix SMTP server will
! use with mandatory TLS encryption. The default grade ("medium") is
! sufficiently strong that any benefit from globally restricting TLS
! sessions to a more stringent grade is likely negligible, especially
! given the fact that many implementations still do not offer any stronger
! ("high" grade) ciphers, while those that do, will always use "high"
! grade ciphers. So insisting on "high" grade ciphers is generally
! counter-productive. Allowing "export" or "low" ciphers is typically
! not a good idea, as systems limited to just these are limited to
! obsolete browsers. No known SMTP clients fail to support at least
! one "medium" or "high" grade cipher. </p>
  
! <p> The following cipher grades are supported: </p>
  
! <dl>
! <dt><b>export</b></dt>
! <dd> Enable "EXPORT" grade or stronger OpenSSL ciphers.
! This is the most appropriate setting for public MX hosts, and is always
! used with opportunistic TLS encryption. The underlying cipherlist
! is specified via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter,
! which you are strongly encouraged to not change. </dd>
  
! <dt><b>low</b></dt>
! <dd> Enable "LOW" grade or stronger OpenSSL ciphers. The
! underlying cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a>
! configuration parameter, which you are strongly encouraged to
! not change. </dd>
  
! <dt><b>medium</b></dt>
! <dd> Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit
! or longer symmetric bulk-encryption keys. This is the default minimum
! strength for mandatory TLS encryption. The underlying cipherlist is
! specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> configuration parameter, which
! you are strongly encouraged to not change. </dd>
  
! <dt><b>high</b></dt>
! <dd> Enable only "HIGH" grade OpenSSL ciphers. The
! underlying cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a>
! configuration parameter, which you are strongly encouraged to
! not change. </dd>
  
! <dt><b>null</b></dt>
! <dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
! without encryption.  This setting is only appropriate in the rare
! case that all clients are prepared to use NULL ciphers (not normally
! enabled in TLS clients). The underlying cipherlist is specified via the
! <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. </dd>
  
! </dl>
  
! <p> Cipher types listed in
! <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> or <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are
! excluded from the base definition of the selected cipher grade. See
! <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> for cipher controls that apply to opportunistic
! TLS. </p>
  
! <p> The underlying cipherlists for grades other than "null" include
! anonymous ciphers, but these are automatically filtered out if the
! server is configured to ask for remote SMTP client certificates.  You are very
! unlikely to need to take any steps to exclude anonymous ciphers, they
! are excluded automatically as required.  If you must exclude anonymous
! ciphers even when Postfix does not need or use peer certificates, set
! "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers only
! when TLS is enforced, set "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>
! (default: empty)</b></DT><DD>
  
! <p> Additional list of ciphers or cipher types to exclude from the
! Postfix SMTP server cipher list at mandatory TLS security levels.
! This list
! works in addition to the exclusions listed with <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
! (see there for syntax details).  </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>
! (default: SSLv3, TLSv1)</b></DT><DD>
  
! <p> The SSL/TLS protocols accepted by the Postfix SMTP server with
! mandatory TLS encryption. If the list is empty, the server supports all
! available SSL/TLS protocol versions.  A non-empty value is a list
! of protocol
! names separated by whitespace, commas or colons. The supported protocol
! names are "SSLv2", "SSLv3" and "TLSv1", and are not case sensitive. </p>
  
! <p> With Postfix &ge; 2.5 the parameter syntax is expanded to support
! protocol exclusions. One can now explicitly exclude SSLv2 by setting
! "<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2". To exclude both SSLv2 and
! SSLv3 set "<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2, !SSLv3". Listing
! the protocols to include, rather than protocols to exclude, is still
! supported, use the form you find more intuitive. </p>
  
! <p> Since SSL version 2 has known protocol weaknesses and is now
! deprecated, the default setting excludes "SSLv2".  This means that
! by default, SSL version 2 will not be used at the "encrypt" security
! level. </p>
  
! <p> Example: </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = TLSv1
! # Alternative form with Postfix &ge; 2.5:
! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
  </pre>
  
- <p> This feature is available in Postfix 2.3 and later. </p>
- 
  
--- 11490,11641 ----
  
! <DT><b><a name="smtpd_sender_restrictions">smtpd_sender_restrictions</a>
! (default: empty)</b></DT><DD>
  
! <p>
! Optional restrictions that the Postfix SMTP server applies in the
! context of the MAIL FROM command.
! </p>
  
! <p>
! The default is to permit everything.
! </p>
  
! <p>
! Specify a list of restrictions, separated by commas and/or whitespace.
! Continue long lines by starting the next line with whitespace.
! Restrictions are applied in the order as specified; the first
! restriction that matches wins.
! </p>
  
! <p>
! The following restrictions are specific to the sender address
! received with the MAIL FROM command.
! </p>
  
! <dl>
  
! <dt><b><a name="check_sender_access">check_sender_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MAIL FROM
! address, domain, parent domains, or localpart@, and execute the
! corresponding action. </dd>
  
! <dt><b><a name="check_sender_mx_access">check_sender_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
! the MAIL FROM address, and execute the corresponding action.  Note:
! a result of "OK" is not allowed for safety reasons. Instead, use
! DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later. </dd>
  
+ <dt><b><a name="check_sender_ns_access">check_sender_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
  
! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
! for the MAIL FROM address, and execute the corresponding action.
! Note: a result of "OK" is not allowed for safety reasons. Instead,
! use DUNNO in order to exclude specific hosts from blacklists.  This
! feature is available in Postfix 2.1 and later.  </dd>
  
! <dt><b><a name="reject_authenticated_sender_login_mismatch">reject_authenticated_sender_login_mismatch</a></b></dt>
  
! <dd>Enforces the <a href="postconf.5.html#reject_sender_login_mismatch">reject_sender_login_mismatch</a> restriction for
! authenticated clients only. This feature is available in
! Postfix version 2.1 and later. </dd>
  
! <dt><b><a name="reject_non_fqdn_sender">reject_non_fqdn_sender</a></b></dt>
  
! <dd>Reject the request when the MAIL FROM address is not in
! fully-qualified domain form, as required by the RFC. <br> The
! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code to
! rejected requests (default: 504). </dd>
  
! <dt><b><a name="reject_rhsbl_sender">reject_rhsbl_sender <i>rbl_domain=d.d.d.d</i></a></b></dt>
  
! <dd>Reject the request when the MAIL FROM domain is listed with
! the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix
! version 2.1 and later only).  If no "<i>=d.d.d.d</i>" is specified,
! reject the request when the MAIL FROM domain is
! listed with any A record under <i>rbl_domain</i>. <br> The
! <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
! rejected requests (default:  554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter
! specifies the default server reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter
! specifies tables with server replies indexed by <i>rbl_domain</i>.
! This feature is available in Postfix 2.0 and later.</dd>
  
! <dt><b><a name="reject_sender_login_mismatch">reject_sender_login_mismatch</a></b></dt>
  
! <dd>Reject the request when $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a> specifies an
! owner for the MAIL FROM address, but the client is not (SASL) logged
! in as that MAIL FROM address owner; or when the client is (SASL)
! logged in, but the client login name doesn't own the MAIL FROM
! address according to $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>.</dd>
  
! <dt><b><a name="reject_unauthenticated_sender_login_mismatch">reject_unauthenticated_sender_login_mismatch</a></b></dt>
  
! <dd>Enforces the <a href="postconf.5.html#reject_sender_login_mismatch">reject_sender_login_mismatch</a> restriction for
! unauthenticated clients only. This feature is available in
! Postfix version 2.1 and later. </dd>
  
! <dt><b><a name="reject_unknown_sender_domain">reject_unknown_sender_domain</a></b></dt>
  
! <dd>Reject the request when Postfix is not final destination for
! the sender address, and the MAIL FROM address has no DNS A or MX
! record, or when it has a malformed MX record such as a record with
! a zero-length MX hostname (Postfix version 2.3 and later). <br> The
! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the response code
! for rejected requests (default: 450).  The response is always 450
! in case of a temporary DNS error.  </dd>
  
+ <dt><b><a name="reject_unlisted_sender">reject_unlisted_sender</a></b></dt>
  
! <dd>Reject the request when the MAIL FROM address is not listed in
! the list of valid recipients for its domain class. See the
! <a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> parameter description for details.
! This feature is available in Postfix 2.1 and later.</dd>
  
! <dt><b><a name="reject_unverified_sender">reject_unverified_sender</a></b></dt>
  
! <dd>Reject the request when mail to the MAIL FROM address is known to
! bounce, or when the sender address destination is not reachable.
! Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
! see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
! <a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> parameter specifies the response when
! an address is known to bounce (default: 450, change into 550 when
! you are confident that it is safe to do so). The
! <a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> specifies the response when an address
! address probe failed due to a temporary problem (default: 450).
! This feature is available in Postfix 2.1 and later.  </dd>
  
! </dl>
  
+ <p>
+ Other restrictions that are valid in this context:
+ </p>
  
! <ul>
  
! <li> <a href="#generic">Generic</a> restrictions that can be used
! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
  
! <li> SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
  
! <li> SMTP command specific restrictions described under
! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. When recipient restrictions are listed
! under <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, they have effect only with
! "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> is
! evaluated at the time of the RCPT TO command.
  
! </ul>
  
! <p>
! Examples:
! </p>
  
  <pre>
! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>,
!     <a href="postconf.5.html#check_sender_access">check_sender_access</a> hash:/etc/postfix/access
  </pre>
  
  
***************
*** 14938,14983 ****
  
! <DT><b><a name="smtpd_tls_protocols">smtpd_tls_protocols</a>
! (default: empty)</b></DT><DD>
! 
! <p> List of TLS protocols that the Postfix SMTP server will exclude
! or include with opportunistic TLS encryption. This parameter SHOULD be
! left at its default empty value, allowing all protocols to be used with
! opportunistic TLS. </p>
! 
! <p> In <a href="postconf.5.html">main.cf</a> the values are separated by whitespace, commas or
! colons. An empty value means allow all protocols. The valid protocol
! names, (see <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and
! "TLSv1". In <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> table entries, "protocols" attribute
! values are separated by a colon. </p>
! 
! <p> To include a protocol list its name, to exclude it, prefix the name
! with a "!" character. To exclude SSLv2 even for opportunistic TLS set
! "<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
! "<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2, !SSLv3". Explicitly listing the protocols to
! include, is supported, but not recommended. OpenSSL provides no mechanisms
! for excluding protocols not known at compile-time. If Postfix is linked
! against an OpenSSL library that supports additional protocol versions,
! they cannot be excluded using either syntax. </p>
! 
! <p> Example: </p>
! <pre>
! <a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2
! </pre>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_received_header">smtpd_tls_received_header</a>
! (default: no)</b></DT><DD>
  
! <p> Request that the Postfix SMTP server produces Received:  message
! headers that include information about the protocol and cipher used,
! as well as the remote SMTP client CommonName and client certificate issuer
! CommonName.  This is disabled by default, as the information may
! be modified in transit through other mail servers.  Only information
! that was recorded by the final destination can be trusted. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 11643,11662 ----
  
! <DT><b><a name="smtpd_soft_error_limit">smtpd_soft_error_limit</a>
! (default: 10)</b></DT><DD>
  
+ <p>
+ The number of errors a remote SMTP client is allowed to make without
+ delivering mail before the Postfix SMTP server slows down all its
+ responses.
+ </p>
  
! <ul>
  
! <li><p>With Postfix version 2.1 and later, the Postfix SMTP server
! delays all responses by $<a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> seconds. </p>
  
! <li><p>With Postfix versions 2.0 and earlier, the Postfix SMTP
! server delays all responses by (number of errors) seconds. </p>
  
! </ul>
  
***************
*** 14986,14996 ****
  
! <DT><b><a name="smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>
! (default: no)</b></DT><DD>
! 
! <p> With mandatory TLS encryption, require a trusted remote SMTP client
! certificate in order to allow TLS connections to proceed.  This
! option implies "<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> = yes". </p>
  
! <p> When TLS encryption is optional, this setting is ignored with
! a warning written to the mail log. </p>
  
--- 11665,11671 ----
  
! <DT><b><a name="smtpd_starttls_timeout">smtpd_starttls_timeout</a>
! (default: 300s)</b></DT><DD>
  
! <p> The time limit for Postfix SMTP server write and read operations
! during TLS startup and shutdown handshake procedures. </p>
  
***************
*** 15001,15043 ****
  
! <DT><b><a name="smtpd_tls_security_level">smtpd_tls_security_level</a>
! (default: empty)</b></DT><DD>
! 
! <p> The SMTP TLS security level for the Postfix SMTP server; when
! a non-empty value is specified, this overrides the obsolete parameters
! <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. This parameter is ignored with
! "<a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> = yes".  </p>
  
! <p> Specify one of the following security levels: </p>
  
! <dl>
  
! <dt><b>none</b></dt> <dd> TLS will not be used. </dd>
  
- <dt><b>may</b></dt> <dd> Opportunistic TLS: announce STARTTLS support
- to remote SMTP clients, but do not require that clients use TLS encryption.
- </dd>
  
! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption: announce
! STARTTLS support to remote SMTP clients, and require that clients use TLS
! encryption. According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> this MUST NOT be applied in case
! of a publicly-referenced SMTP server. Instead, this option should
! be used only on dedicated servers. </dd>
  
! </dl>
  
! <p> Note 1: the "fingerprint", "verify" and "secure" levels are not
! supported here.
! The Postfix SMTP server logs a warning and uses "encrypt" instead.
! To verify remote SMTP client certificates, see <a href="TLS_README.html">TLS_README</a> for a discussion
! of the <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>, <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>, and <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
! features.  </p>
  
! <p> Note 2: The parameter setting "<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> =
! encrypt" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes".</p>
  
! <p> Note 3: when invoked via "sendmail -bs", Postfix will never
! offer STARTTLS due to insufficient privileges to access the server
! private key. This is intended behavior.</p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
--- 11676,11715 ----
  
! <DT><b><a name="smtpd_timeout">smtpd_timeout</a>
! (default: 300s)</b></DT><DD>
  
! <p>
! The time limit for sending a Postfix SMTP server response and for
! receiving a remote SMTP client request.
! </p>
  
! <p>
! Note: if you set SMTP time limits to very large values you may have
! to update the global <a href="postconf.5.html#ipc_timeout">ipc_timeout</a> parameter.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_CAfile">smtpd_tls_CAfile</a>
! (default: empty)</b></DT><DD>
  
! <p> The file with the certificate of the certification authority
! (CA) that issued the Postfix SMTP server certificate.  This is
! needed only when the CA certificate is not already present in the
! server certificate file.  This file may also contain the CA
! certificates of other trusted CAs.  You must use this file for the
! list of trusted CAs if you want to use chroot-mode. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> = /etc/postfix/CAcert.pem
! </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 15046,15072 ****
  
! <DT><b><a name="smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
  (default: empty)</b></DT><DD>
  
! <p> Name of the file containing the optional Postfix SMTP server
! TLS session cache. Specify a database type that supports enumeration,
! such as <b>btree</b> or <b>sdbm</b>; there is no need to support
! concurrent access.  The file is created if it does not exist. The <a href="smtpd.8.html">smtpd(8)</a>
! daemon does not use this parameter directly, rather the cache is
! implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
! per-smtpd-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not
! effective. Note, that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a>
! daemon: $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
! (and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to be
! stored separately. It is not at this time possible to store multiple
! caches in a single database. </p>
! 
! <p> Note: <b>dbm</b> databases are not suitable. TLS
! session objects are too large. </p>
! 
! <p> As of version 2.5, Postfix no longer uses root privileges when
! opening this file. The file should now be stored under the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
! under a non-Postfix directory is redirected to the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
! 
  <p> Example: </p>
--- 11718,11734 ----
  
! <DT><b><a name="smtpd_tls_CApath">smtpd_tls_CApath</a>
  (default: empty)</b></DT><DD>
  
! <p> Directory with PEM format certificate authority certificates
! that the Postfix SMTP server offers to remote SMTP clients for the
! purpose of client certificate verification.  Do not forget to create
! the necessary "hash" links with, for example, "$OPENSSL_HOME/bin/c_rehash
! /etc/postfix/certs".  </p>
! 
! <p> To use this option in chroot mode, this directory (or a copy)
! must be inside the chroot jail. Please note that in this case the
! CA certificates are not offered to the client, so that e.g.  Netscape
! clients might not offer certificates issued by them.  Use of this
! feature is therefore not recommended. </p>
! 
  <p> Example: </p>
***************
*** 15074,15076 ****
  <pre>
! <a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a> = btree:/var/lib/postfix/smtpd_scache
  </pre>
--- 11736,11738 ----
  <pre>
! <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> = /etc/postfix/certs
  </pre>
***************
*** 15082,15110 ****
  
! <DT><b><a name="smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>
! (default: 3600s)</b></DT><DD>
! 
! <p> The expiration time of Postfix SMTP server TLS session cache
! information. A cache cleanup is performed periodically
! every $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> seconds. As with
! $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, this parameter is implemented in the
! <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtpd-instance <a href="master.5.html">master.cf</a> overrides
! are not possible. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>
! (default: no)</b></DT><DD>
  
! <p> Run the Postfix SMTP server in the non-standard "wrapper" mode,
! instead of using the STARTTLS command. </p>
  
! <p> If you want to support this service, enable a special port in
! <a href="master.5.html">master.cf</a>, and specify "-o <a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>=yes" on the SMTP
! server's command line. Port 465 (smtps) was once chosen for this
! purpose. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 11744,11769 ----
  
! <DT><b><a name="smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>
! (default: yes)</b></DT><DD>
  
+ <p> Force the Postfix SMTP server to issue a TLS session id, even
+ when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
+ is empty). This behavior is compatible with Postfix &lt; 2.3. </p>
  
! <p> With Postfix 2.3 and later the Postfix SMTP server can disable
! session id generation when TLS session caching is turned off. This
! keeps clients from caching sessions that almost certainly cannot
! be re-used.  </p>
  
! <p> By default, the Postfix SMTP server always generates TLS session
! ids. This works around a known defect in mail client applications
! such as MS Outlook, and may also prevent interoperability issues
! with other MTAs. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> = no
! </pre>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 15113,15126 ****
  
! <DT><b><a name="smtpd_use_tls">smtpd_use_tls</a>
  (default: no)</b></DT><DD>
  
! <p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
! but do not require that clients use TLS encryption. </p>
  
! <p> Note: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
! STARTTLS due to insufficient privileges to access the server private
! key. This is intended behavior. </p>
  
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
  
--- 11772,11786 ----
  
! <DT><b><a name="smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>
  (default: no)</b></DT><DD>
  
! <p> Ask a remote SMTP client for a client certificate. This
! information is needed for certificate based mail relaying with,
! for example, the <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> feature. </p>
  
! <p> Some clients such as Netscape will either complain if no
! certificate is available (for the list of CAs in $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)
! or will offer multiple client certificates to choose from. This
! may be annoying, so this option is "off" by default. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 15129,15148 ****
  
! <DT><b><a name="soft_bounce">soft_bounce</a>
  (default: no)</b></DT><DD>
  
! <p>
! Safety net to keep mail queued that would otherwise be returned to
! the sender.  This parameter disables locally-generated bounces,
! and prevents the Postfix SMTP server from rejecting mail permanently,
! by changing 5xx reply codes into 4xx.  However, <a href="postconf.5.html#soft_bounce">soft_bounce</a> is no
! cure for address rewriting mistakes or mail routing mistakes.
! </p>
! 
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#soft_bounce">soft_bounce</a> = yes
! </pre>
  
--- 11789,11798 ----
  
! <DT><b><a name="smtpd_tls_auth_only">smtpd_tls_auth_only</a>
  (default: no)</b></DT><DD>
  
! <p> When TLS encryption is optional in the Postfix SMTP server, do
! not announce or accept SASL authentication over unencrypted
! connections. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 15151,15164 ****
  
! <DT><b><a name="stale_lock_time">stale_lock_time</a>
! (default: 500s)</b></DT><DD>
  
! <p>
! The time after which a stale exclusive mailbox lockfile is removed.
! This is used for delivery to file or mailbox.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
--- 11801,11820 ----
  
! <DT><b><a name="smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a>
! (default: 9)</b></DT><DD>
  
! <p> The verification depth for remote SMTP client certificates. A
! depth of 1 is sufficient if the issuing CA is listed in a local CA
! file. </p>
  
! <p> The default verification depth is 9 (the OpenSSL default) for
! compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
! the default value was 5, but the limit was not actually enforced. If
! you have set this to a lower non-default value, certificates with longer
! trust chains may now fail to verify. Certificate chains with 1 or 2
! CAs are common, deeper chains are more rare and any number between 5
! and 9 should suffice in practice. You can choose a lower number if,
! for example, you trust certificates directly signed by an issuing CA
! but not any CAs it delegates to. </p>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 15167,15194 ****
  
! <DT><b><a name="stress">stress</a>
  (default: empty)</b></DT><DD>
  
! <p> This feature is documented in the <a href="STRESS_README.html">STRESS_README</a> document. </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="strict_7bit_headers">strict_7bit_headers</a>
! (default: no)</b></DT><DD>
  
! <p>
! Reject mail with 8-bit text in message headers. This blocks mail
! from poorly written applications.
! </p>
  
! <p>
! This feature should not be enabled on a general purpose mail server,
! because it is likely to reject legitimate email.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
--- 11823,11877 ----
  
! <DT><b><a name="smtpd_tls_cert_file">smtpd_tls_cert_file</a>
  (default: empty)</b></DT><DD>
  
! <p> File with the Postfix SMTP server RSA certificate in PEM format.
! This file may also contain the Postfix SMTP server private RSA key. </p>
  
! <p> Public Internet MX hosts without certificates signed by a "reputable"
! CA must generate, and be prepared to present to most clients, a
! self-signed or private-CA signed certificate. The client will not be
! able to authenticate the server, but unless it is running Postfix 2.3 or
! similar software, it will still insist on a server certificate. </p>
  
+ <p> For servers that are <b>not</b> public Internet MX hosts, Postfix
+ 2.3 supports configurations with no certificates. This entails the
+ use of just the anonymous TLS ciphers, which are not supported by
+ typical SMTP clients. Since such clients will not, as a rule, fall
+ back to plain text after a TLS handshake failure, the server will
+ be unable to receive email from TLS enabled clients. To avoid
+ accidental configurations with no certificates, Postfix 2.3 enables
+ certificate-less operation only when the administrator explicitly
+ sets "<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = none". This ensures that new Postfix
+ configurations will not accidentally run with no certificates. </p>
  
! <p> Both RSA and DSA certificates are supported.  When both types
! are present, the cipher used determines which certificate will be
! presented to the client.  For Netscape and OpenSSL clients without
! special cipher choices the RSA certificate is preferred. </p>
  
! <p> In order to verify a certificate, the CA certificate (in case
! of a certificate chain, all CA certificates) must be available.
! You should add these certificates to the server certificate, the
! server certificate first, then the issuing CA(s).  </p>
  
! <p> Example: the certificate for "server.dom.ain" was issued by
! "intermediate CA" which itself has a certificate of "root CA".
! Create the server.pem file with "cat server_cert.pem intermediate_CA.pem
! root_CA.pem &gt; server.pem". </p>
  
! <p> If you also want to verify client certificates issued by these
! CAs, you can add the CA certificates to the <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, in which
! case it is not necessary to have them in the <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> or
! <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. </p>
  
! <p> A certificate supplied here must be usable as an SSL server certificate
! and hence pass the "openssl verify -purpose sslserver ..." test. </p>
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = /etc/postfix/server.pem
! </pre>
! 
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 15197,15213 ****
  
! <DT><b><a name="strict_8bitmime">strict_8bitmime</a>
! (default: no)</b></DT><DD>
  
! <p>
! Enable both <a href="postconf.5.html#strict_7bit_headers">strict_7bit_headers</a> and <a href="postconf.5.html#strict_8bitmime_body">strict_8bitmime_body</a>.
! </p>
  
! <p>
! This feature should not be enabled on a general purpose mail server,
! because it is likely to reject legitimate email.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
--- 11880,11898 ----
  
! <DT><b><a name="smtpd_tls_cipherlist">smtpd_tls_cipherlist</a>
! (default: empty)</b></DT><DD>
  
! <p> Obsolete Postfix &lt; 2.3 control for the Postfix SMTP server TLS
! cipher list. It is easy to create inter-operability problems by choosing
! a non-default cipher list. Do not use a non-default TLS cipherlist for
! MX hosts on the public Internet. Clients that begin the TLS handshake,
! but are unable to agree on a common cipher, may not be able to send any
! email to the SMTP server. Using a restricted cipher list may be more
! appropriate for a dedicated MSA or an internal mailhub, where one can
! exert some control over the TLS software and settings of the connecting
! clients. </p>
  
! <p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
  
! <p>This feature is available with Postfix version 2.2. It is not used with
! Postfix 2.3 and later; use <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> instead. </p>
  
***************
*** 15216,15301 ****
  
! <DT><b><a name="strict_8bitmime_body">strict_8bitmime_body</a>
! (default: no)</b></DT><DD>
! 
! <p>
! Reject 8-bit message body text without 8-bit MIME content encoding
! information.  This blocks mail from poorly written applications.
! </p>
  
! <p>
! Unfortunately, this also rejects majordomo approval requests when
! the included request contains valid 8-bit MIME mail, and it rejects
! bounces from mailers that do not MIME encapsulate 8-bit content
! (for example, bounces from qmail or from old versions of Postfix).
! </p>
  
! <p>
! This feature should not be enabled on a general purpose mail server,
! because it is likely to reject legitimate email.
  </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
! </DD>
  
- <DT><b><a name="strict_mailbox_ownership">strict_mailbox_ownership</a>
- (default: yes)</b></DT><DD>
  
! <p> Defer delivery when a mailbox file is not owned by its recipient.
! The default setting is not backwards compatible.  </p>
  
! <p> This feature is available in Postfix 2.5.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="strict_mime_encoding_domain">strict_mime_encoding_domain</a>
! (default: no)</b></DT><DD>
  
! <p>
! Reject mail with invalid Content-Transfer-Encoding: information
! for the message/* or multipart/* MIME content types.  This blocks
! mail from poorly written software.
  </p>
  
! <p>
! This feature should not be enabled on a general purpose mail server,
! because it will reject mail after a single violation.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
- </DD>
  
! <DT><b><a name="strict_rfc821_envelopes">strict_rfc821_envelopes</a>
! (default: no)</b></DT><DD>
  
! <p>
! Require that addresses received in SMTP MAIL FROM and RCPT TO
! commands are enclosed with &lt;&gt;, and that those addresses do
! not contain <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> style comments or phrases.  This stops mail
! from poorly written software.
! </p>
  
! <p>
! By default, the Postfix SMTP server accepts <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> syntax in MAIL
! FROM and RCPT TO addresses.
! </p>
  
  
! </DD>
  
! <DT><b><a name="sun_mailtool_compatibility">sun_mailtool_compatibility</a>
! (default: no)</b></DT><DD>
  
! <p>
! Obsolete SUN mailtool compatibility feature. Instead, use
! "<a href="postconf.5.html#mailbox_delivery_lock">mailbox_delivery_lock</a> = dotlock".
! </p>
  
--- 11901,11970 ----
  
! <DT><b><a name="smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>
! (default: empty)</b></DT><DD>
  
! <p> File with the Postfix SMTP server DSA certificate in PEM format.
! This file may also contain the Postfix SMTP server private DSA key. </p>
  
! <p> See the discussion under <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for more details.
  </p>
  
! <p> Example: </p>
  
+ <pre>
+ <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> = /etc/postfix/server-dsa.pem
+ </pre>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
! (default: empty)</b></DT><DD>
  
+ <p> File with DH parameters that the Postfix SMTP server should
+ use with EDH ciphers. </p>
  
! <p> Instead of using the exact same parameter sets as distributed
! with other TLS packages, it is more secure to generate your own
! set of parameters with something like the following command:  </p>
  
! <blockquote>
! <pre>
! openssl gendh -out /etc/postfix/dh_1024.pem -2 1024
! </pre>
! </blockquote>
  
! <p> Your actual source for entropy may differ. Some systems have
! /dev/random; on other system you may consider using the "Entropy
! Gathering Daemon EGD", available at <a href="http://egd.sourceforge.net/">http://egd.sourceforge.net/</a>
  </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> = /etc/postfix/dh_1024.pem
! </pre>
  
+ <p>This feature is available with Postfix version 2.2.</p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>
! (default: empty)</b></DT><DD>
  
! <p> File with DH parameters that the Postfix SMTP server should
! use with EDH ciphers. </p>
  
+ <p> See also the discussion under the <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
+ configuration parameter.  </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> = /etc/postfix/dh_512.pem
! </pre>
  
! <p>This feature is available with Postfix version 2.2.</p>
  
***************
*** 15304,15358 ****
  
! <DT><b><a name="swap_bangpath">swap_bangpath</a>
! (default: yes)</b></DT><DD>
! 
! <p>
! Enable the rewriting of "site!user" into "user@site".  This is
! necessary if your machine is connected to UUCP networks.  It is
! enabled by default.
! </p>
  
! <p> Note: with Postfix version 2.2, message header address rewriting
! happens only when one of the following conditions is true: </p>
  
! <ul>
  
! <li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
  
- <li> The message is received from a network client that matches
- $<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
  
! <li> The message is received from the network, and the
! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
  
! </ul>
  
! <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
  
! <p>
! Example:
! </p>
  
  <pre>
! <a href="postconf.5.html#swap_bangpath">swap_bangpath</a> = no
  </pre>
  
  
! </DD>
! 
! <DT><b><a name="syslog_facility">syslog_facility</a>
! (default: mail)</b></DT><DD>
! 
! <p>
! The syslog facility of Postfix logging. Specify a facility as
! defined in syslog.conf(5). The default facility is "mail".
! </p>
! 
! <p>
! Warning: a non-default <a href="postconf.5.html#syslog_facility">syslog_facility</a> setting takes effect only
! after a Postfix process has completed initialization.  Errors during
! process initialization will be logged with the default facility.
! Examples are errors while parsing the command line arguments, and
! errors while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
! </p>
  
--- 11973,12021 ----
  
! <DT><b><a name="smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b></DT><DD>
  
! <p> File with the Postfix SMTP server DSA private key in PEM format.
! This file may be combined with the Postfix SMTP server DSA certificate
! file specified with $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. </p>
  
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted, but file permissions should grant read/write
! access only to the system superuser account ("root"). </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
! (default: empty)</b></DT><DD>
  
! <p> List of ciphers or cipher types to exclude from the SMTP server
! cipher list at all TLS security levels. Excluding valid ciphers
! can create interoperability problems. DO NOT exclude ciphers unless it
! is essential to do so. This is not an OpenSSL cipherlist; it is a simple
! list separated by whitespace and/or commas. The elements are a single
! cipher, or one or more "+" separated cipher properties, in which case
! only ciphers matching <b>all</b> the properties are excluded. </p>
  
! <p> Examples (some of these will cause problems): </p>
  
+ <blockquote>
  <pre>
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = MD5, DES
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = DES+MD5
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = kEDH+aRSA
  </pre>
+ </blockquote>
  
+ <p> The first setting disables anonymous ciphers. The next setting
+ disables ciphers that use the MD5 digest algorithm or the (single) DES
+ encryption algorithm. The next setting disables ciphers that use MD5 and
+ DES together.  The next setting disables the two ciphers "AES256-SHA"
+ and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
+ key exchange with RSA authentication. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 15361,15391 ****
  
! <DT><b><a name="syslog_name">syslog_name</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p>
! The mail system name that is prepended to the process name in syslog
! records, so that "smtpd" becomes, for example, "postfix/smtpd".
  </p>
  
! <p>
! Warning: a non-default <a href="postconf.5.html#syslog_name">syslog_name</a> setting takes effect only after
! a Postfix process has completed initialization. Errors during
! process initialization will be logged with the default name. Examples
! are errors while parsing the command line arguments, and errors
! while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
  </p>
  
  
! </DD>
! 
! <DT><b><a name="tcp_windowsize">tcp_windowsize</a>
! (default: 0)</b></DT><DD>
! 
! <p> An optional workaround for routers that break TCP window scaling.
! Specify a value &gt; 0 and &lt; 65536 to enable this feature.  With
! Postfix TCP servers (<a href="smtpd.8.html">smtpd(8)</a>, <a href="qmqpd.8.html">qmqpd(8)</a>), this feature is implemented
! by the Postfix <a href="master.8.html">master(8)</a> daemon.  </p>
! 
! <p> To change this parameter without stopping Postfix, you need to
! first terminate all Postfix TCP servers: </p>
  
--- 12024,12046 ----
  
! <DT><b><a name="smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>
! (default: md5)</b></DT><DD>
  
! <p> The message digest algorithm used to construct client-certificate
! fingerprints for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and
! <b><a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a></b>. The default algorithm is <b>md5</b>,
! for backwards compatibility with Postfix releases prior to 2.5.
  </p>
  
! <p> The best practice algorithm is now <b>sha1</b>. Recent advances in hash
! function cryptanalysis have led to md5 being deprecated in favor of sha1.
! However, as long as there are no known "second pre-image" attacks
! against md5, its use in this context can still be considered safe.
  </p>
  
+ <p> While additional digest algorithms are often available with OpenSSL's
+ libcrypto, only those used by libssl in SSL cipher suites are available to
+ Postfix. For now this means just md5 or sha1. </p>
  
! <p> To find the fingerprint of a specific certificate file, with a
! specific digest algorithm, run: </p>
  
***************
*** 15393,15396 ****
  <pre>
! # postconf -e <a href="postconf.5.html#master_service_disable">master_service_disable</a>=inet
! # postfix reload
  </pre>
--- 12048,12050 ----
  <pre>
! $ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
  </pre>
***************
*** 15398,15402 ****
  
! <p> This immediately terminates all processes that accept network
! connections.  Next, you enable Postfix TCP servers with the updated
! <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> setting: </p>
  
--- 12052,12055 ----
  
! <p> The text to the right of "=" sign is the desired fingerprint.
! For example: </p>
  
***************
*** 15404,15407 ****
  <pre>
! # postconf -e <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a>=65535 <a href="postconf.5.html#master_service_disable">master_service_disable</a>=
! # postfix reload
  </pre>
--- 12057,12060 ----
  <pre>
! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem
! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
  </pre>
***************
*** 15409,15432 ****
  
! <p> If you skip these steps with a running Postfix system, then the
! <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> change will work only for Postfix TCP clients (<a href="smtp.8.html">smtp(8)</a>,
! <a href="lmtp.8.html">lmtp(8)</a>).  </p>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
  
! <DT><b><a name="tls_append_default_CA">tls_append_default_CA</a>
! (default: no)</b></DT><DD>
  
! <p> Append the system-supplied default certificate authority
! certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
! The default is "no"; this prevents Postfix from trusting third-party
! certificates and giving them relay permission with
! <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>.  </p>
! 
! <p> This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
! 2.7.2 and later versions. Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = yes" for
! backwards compatibility, to avoid breaking certificate verification
! with sites that don't use <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>. </p>
  
--- 12062,12084 ----
  
! <p> Example: client-certificate access table, with sha1 fingerprints: </p>
  
! <blockquote>
! <pre>
! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
!     <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> = sha1
!     <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
!         <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> hash:/etc/postfix/access,
!         reject
! </pre>
! <pre>
! /etc/postfix/access:
!     # Action folded to next line...
!     AF:88:7C:AD:51:95:6F:36:96:F6:01:FB:2E:48:CD:AB:49:25:A2:3B
!         OK
!     85:16:78:FD:73:6E:CE:70:E0:31:5F:0D:3C:C8:6D:C4:2C:24:59:E1
!         <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
! </pre>
! </blockquote>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 15435,15446 ****
  
! <DT><b><a name="tls_daemon_random_bytes">tls_daemon_random_bytes</a>
! (default: 32)</b></DT><DD>
  
! <p> The number of pseudo-random bytes that an <a href="smtp.8.html">smtp(8)</a> or <a href="smtpd.8.html">smtpd(8)</a>
! process requests from the <a href="tlsmgr.8.html">tlsmgr(8)</a> server in order to seed its
! internal pseudo random number generator (PRNG).  The default of 32
! bytes (equivalent to 256 bits) is sufficient to generate a 128bit
! (or 168bit) session key. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 12087,12098 ----
  
! <DT><b><a name="smtpd_tls_key_file">smtpd_tls_key_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b></DT><DD>
  
! <p> File with the Postfix SMTP server RSA private key in PEM format.
! This file may be combined with the Postfix SMTP server RSA certificate
! file specified with $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>. </p>
  
! <p> The private key must be accessible without a pass-phrase, i.e. it
! must not be encrypted, but file permissions should grant read/write
! access only to the system superuser account ("root"). </p>
  
***************
*** 15449,15557 ****
  
! <DT><b><a name="tls_disable_workarounds">tls_disable_workarounds</a>
! (default: see "postconf -d" output)</b></DT><DD>
! 
! <p> List or bit-mask of OpenSSL bug work-arounds to disable. </p>
! 
! <p> The OpenSSL toolkit includes a set of work-arounds for buggy SSL/TLS
! implementations. Applications, such as Postfix, that want to maximize
! interoperability ask the OpenSSL library to enable the full set of
! recommended work-arounds. </p>
! 
! <p> From time to time, it is discovered that a work-around creates a
! security issue, and should no longer be used. If upgrading OpenSSL
! to a fixed version is not an option or an upgrade is not available
! in a timely manner, or in closed environments where no buggy clients
! or servers exist, it may be appropriate to disable some or all of the
! OpenSSL interoperability work-arounds. This parameter specifies which
! bug work-arounds to disable. </p>
! 
! <p> If the value of the parameter is a hexadecimal long integer starting
! with "0x", the bug work-arounds corresponding to the bits specified in
! its value are removed from the <b>SSL_OP_ALL</b> work-around bit-mask
! (see openssl/ssl.h and SSL_CTX_set_options(3)). You can specify more
! bits than are present in SSL_OP_ALL, excess bits are ignored. Specifying
! 0xFFFFFFFF disables all bug-workarounds on a 32-bit system. This should
! also be sufficient on 64-bit systems, until OpenSSL abandons support
! for 32-bit systems and starts using the high 32 bits of a 64-bit
! bug-workaround mask. </p>
! 
! <p> Otherwise, the parameter is a white-space or comma separated list
! of specific named bug work-arounds chosen from the list below. It
! is possible that your OpenSSL version includes new bug work-arounds
! added after your Postfix source code was last updated, in that case
! you can only disable one of these via the hexadecimal syntax above. </p>
! 
! <dl>
  
! <dt><b>MICROSOFT_SESS_ID_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
  
! <dt><b>NETSCAPE_CHALLENGE_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
  
! <dt><b>LEGACY_SERVER_CONNECT</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
  
! <dt><b>NETSCAPE_REUSE_CIPHER_CHANGE_BUG</b></dt> <dd> also aliased
! as <b>CVE-2010-4180</b>. Postfix 2.8 disables this work-around by
! default with OpenSSL versions that may predate the fix. Fixed in
! OpenSSL 0.9.8q and OpenSSL 1.0.0c.</dd>
  
! <dt><b>SSLREF2_REUSE_CERT_TYPE_BUG</b></dt> <dd>See
! SSL_CTX_set_options(3)</dd>
  
! <dt><b>MICROSOFT_BIG_SSLV3_BUFFER</b></dt> <dd>See
! SSL_CTX_set_options(3)</dd>
  
! <dt><b>MSIE_SSLV2_RSA_PADDING</b></dt> <dd> also aliased as
! <b>CVE-2005-2969</b>. Postfix 2.8 disables this work-around by
! default with OpenSSL versions that may predate the fix. Fixed in
! OpenSSL 0.9.7h and OpenSSL 0.9.8a.</dd>
  
! <dt><b>SSLEAY_080_CLIENT_DH_BUG</b></dt> <dd>See
! SSL_CTX_set_options(3)</dd>
  
! <dt><b>TLS_D5_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
  
! <dt><b>TLS_BLOCK_PADDING_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
  
- <dt><b>TLS_ROLLBACK_BUG</b></dt> <dd>See SSL_CTX_set_options(3).
- This is disabled in OpenSSL 0.9.7 and later. Nobody should still
- be using 0.9.6! </dd>
  
! <dt><b>DONT_INSERT_EMPTY_FRAGMENTS</b></dt> <dd>See
! SSL_CTX_set_options(3)</dd>
  
! <dt><b>CRYPTOPRO_TLSEXT_BUG</b></dt> <dd>New with GOST support in
! OpenSSL 1.0.0.</dd>
  
! </dl>
  
! <p> This feature is available in Postfix 2.8 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="tls_eecdh_strong_curve">tls_eecdh_strong_curve</a>
! (default: prime256v1)</b></DT><DD>
  
! <p> The elliptic curve used by the Postfix SMTP server for sensibly
! strong
! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
! server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong". The phrase "sensibly
! strong" means approximately 128-bit security based on best known
! attacks. The selected curve must be implemented by OpenSSL (as
! reported by ecparam(1) with the "-list_curves" option) and be one
! of the curves listed in Section 5.1.1 of <a href="http://tools.ietf.org/html/rfc4492">RFC 4492</a>. You should not
! generally change this setting. </p>
  
! <p> This default curve is specified in NSA "Suite B" Cryptography
! (see <a href="http://www.nsa.gov/ia/industry/crypto_suite_b.cfm">http://www.nsa.gov/ia/industry/crypto_suite_b.cfm</a>) for
! information classified as SECRET. </p>
  
! <p> Note: elliptic curve names are poorly standardized; different
! standards groups are assigning different names to the same underlying
! curves.  The curve with the X9.62 name "prime256v1" is also known
! under the SECG name "secp256r1", but OpenSSL does not recognize the
! latter name. </p>
  
! <p> This feature is available in Postfix 2.6 and later, when it is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
  
--- 12101,12210 ----
  
! <DT><b><a name="smtpd_tls_loglevel">smtpd_tls_loglevel</a>
! (default: 0)</b></DT><DD>
  
! <p> Enable additional Postfix SMTP server logging of TLS activity.
! Each logging level also includes the information that is logged at
! a lower logging level.  </p>
  
! <dl compact>
  
! <dt> </dt> <dd> 0 Disable logging of TLS activity. </dd>
  
! <dt> </dt> <dd> 1 Log TLS handshake and certificate information. </dd>
  
! <dt> </dt> <dd> 2 Log levels during TLS negotiation. </dd>
  
! <dt> </dt> <dd> 3 Log hexadecimal and ASCII dump of TLS negotiation
! process.  </dd>
  
! <dt> </dt> <dd> 4 Also log hexadecimal and ASCII dump of complete
! transmission after STARTTLS. </dd>
  
! </dl>
  
! <p> Use "<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> = 3" only in case of problems. Use of
! loglevel 4 is strongly discouraged. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>
! (default: medium)</b></DT><DD>
  
! <p> The minimum TLS cipher grade that the Postfix SMTP server will
! use with mandatory
! TLS encryption. Cipher types listed in <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>
! or <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are excluded from the base definition
! of the selected cipher grade. With opportunistic TLS encryption,
! the "export" grade is used unconditionally with exclusions specified
! only via <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>. </p>
  
! <p> The following cipher grades are supported: </p>
  
+ <dl>
+ <dt><b>export</b></dt>
+ <dd> Enable the mainstream "EXPORT" grade or better OpenSSL ciphers.
+ This is the most appropriate setting for public MX hosts, and is always
+ used with opportunistic TLS encryption. The underlying cipherlist
+ is specified via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter,
+ which you are strongly encouraged to not change. The default value
+ of <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> includes anonymous ciphers, but these are
+ automatically filtered out if the server is configured to ask for
+ client certificates. If you must always exclude anonymous ciphers,
+ set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers
+ only when TLS is enforced, set "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> =
+ aNULL". </dd>
  
! <dt><b>low</b></dt>
! <dd> Enable the mainstream "LOW" grade or better OpenSSL ciphers. The
! underlying cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a>
! configuration parameter, which you are strongly encouraged to
! not change. The default value of <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> includes
! anonymous ciphers, but these are automatically filtered out if the
! server is configured to ask for client certificates. If you must
! always exclude anonymous ciphers, set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> =
! aNULL". To exclude anonymous ciphers only when TLS is enforced, set
! "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
! <dt><b>medium</b></dt>
! <dd> Enable the mainstream "MEDIUM" grade or better OpenSSL ciphers. These
! are essentially the 128-bit or stronger ciphers. This is the default
! minimum strength for mandatory TLS encryption. MSAs that enforce
! TLS and have clients that do not support any "MEDIUM" or "HIGH"
! grade ciphers, may need to configure a weaker ("low" or "export")
! minimum cipher grade. The underlying cipherlist is specified via the
! <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. The default value of <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
! includes anonymous ciphers, but these are automatically filtered out if
! the server is configured to ask for client certificates. If you must
! always exclude anonymous ciphers, set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> =
! aNULL". To exclude anonymous ciphers only when TLS is enforced, set
! "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
! <dt><b>high</b></dt>
! <dd> Enable only the mainstream "HIGH" grade OpenSSL ciphers. The
! underlying cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a>
! configuration parameter, which you are strongly encouraged to
! not change. The default value of <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> includes
! anonymous ciphers, but these are automatically filtered out if the
! server is configured to ask for client certificates. If you must
! always exclude anonymous ciphers, set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> =
! aNULL". To exclude anonymous ciphers only when TLS is enforced, set
! "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
  
! <dt><b>null</b></dt>
! <dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
! without encryption.  This setting is only appropriate in the rare
! case that all clients are prepared to use NULL ciphers (not normally
! enabled in TLS clients). The underlying cipherlist is specified via the
! <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> configuration parameter, which you are strongly
! encouraged to not change. The default value of <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a>
! excludes anonymous ciphers (OpenSSL 0.9.8 has NULL ciphers that offer
! data integrity without encryption or authentication). </dd>
  
! </dl>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 15560,15581 ****
  
! <DT><b><a name="tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a>
! (default: secp384r1)</b></DT><DD>
! 
! <p> The elliptic curve used by the Postfix SMTP server for maximally
! strong
! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
! server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = ultra". The phrase "maximally
! strong" means approximately 192-bit security based on best known attacks.
! This additional strength comes at a significant computational cost, most
! users should instead set "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong".  The selected
! curve must be implemented by OpenSSL (as reported by ecparam(1) with the
! "-list_curves" option) and be one of the curves listed in Section 5.1.1
! of <a href="http://tools.ietf.org/html/rfc4492">RFC 4492</a>. You should not generally change this setting. </p>
  
! <p> This default "ultra" curve is specified in NSA "Suite B" Cryptography
! (see <a href="http://www.nsa.gov/ia/industry/crypto_suite_b.cfm">http://www.nsa.gov/ia/industry/crypto_suite_b.cfm</a>) for information
! classified as TOP SECRET. </p>
  
! <p> This feature is available in Postfix 2.6 and later, when it is
! compiled and linked with OpenSSL 1.0.0 or later. </p>
  
--- 12213,12223 ----
  
! <DT><b><a name="smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>
! (default: empty)</b></DT><DD>
  
! <p> Additional list of ciphers or cipher types to exclude from the
! SMTP server cipher list at mandatory TLS security levels. This list
! works in addition to the exclusions listed with <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
! (see there for syntax details).  </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 15584,15615 ****
  
! <DT><b><a name="tls_export_cipherlist">tls_export_cipherlist</a>
! (default: ALL:+RC4:@STRENGTH)</b></DT><DD>
! 
! <p> The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This
! defines the meaning of the "export" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
! the cipherlist for the opportunistic ("may") TLS client security
! level and is the default cipherlist for the SMTP server. You are
! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
! later the cipherlist may start with an "aNULL:" prefix, which restores
! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
! list when they are enabled. This prefix is not needed with previous
! OpenSSL releases. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="tls_high_cipherlist">tls_high_cipherlist</a>
! (default: ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH)</b></DT><DD>
  
! <p> The OpenSSL cipherlist for "HIGH" grade ciphers. This defines
! the meaning of the "high" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
! later the cipherlist may start with an "aNULL:" prefix, which restores
! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
! list when they are enabled. This prefix is not needed with previous
! OpenSSL releases. </p>
  
--- 12226,12256 ----
  
! <DT><b><a name="smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>
! (default: SSLv3, TLSv1)</b></DT><DD>
  
! <p> The SSL/TLS protocols accepted by the Postfix SMTP server with
! mandatory TLS encryption. If the list is empty, the server supports all
! available SSL/TLS protocol versions.  A non-empty value is a list
! of protocol
! names separated by whitespace, commas or colons. The supported protocol
! names are "SSLv2", "SSLv3" and "TLSv1", and are not case sensitive. </p>
  
+ <p> With Postfix &ge; 2.5 the parameter syntax is expanded to support
+ protocol exclusions. One can now explicitly exclude SSLv2 by setting
+ "<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2". To exclude both SSLv2 and
+ SSLv3 set "<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2, !SSLv3". Listing
+ the protocols to include, rather than protocols to exclude, is still
+ supported, use the form you find more intuitive. </p>
  
! <p> Since SSL version 2 has known protocol weaknesses and is now
! deprecated, the default setting excludes "SSLv2".  This means that
! by default, SSL version 2 will not be used at the "encrypt" security
! level. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = TLSv1
! # Alternative form with Postfix &ge; 2.5:
! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
! </pre>
  
***************
*** 15620,15634 ****
  
! <DT><b><a name="tls_low_cipherlist">tls_low_cipherlist</a>
! (default: ALL:!EXPORT:+RC4:@STRENGTH)</b></DT><DD>
  
! <p> The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines
! the meaning of the "low" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
! strongly encouraged to not change this setting.  With OpenSSL 1.0.0 and
! later the cipherlist may start with an "aNULL:" prefix, which restores
! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
! list when they are enabled. This prefix is not needed with previous
! OpenSSL releases. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
--- 12261,12273 ----
  
! <DT><b><a name="smtpd_tls_received_header">smtpd_tls_received_header</a>
! (default: no)</b></DT><DD>
  
! <p> Request that the Postfix SMTP server produces Received:  message
! headers that include information about the protocol and cipher used,
! as well as the client CommonName and client certificate issuer
! CommonName.  This is disabled by default, as the information may
! be modified in transit through other mail servers.  Only information
! that was recorded by the final destination can be trusted. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 15637,15707 ****
  
! <DT><b><a name="tls_medium_cipherlist">tls_medium_cipherlist</a>
! (default: ALL:!EXPORT:!LOW:+RC4:@STRENGTH)</b></DT><DD>
  
! <p> The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This
! defines the meaning of the "medium" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
! the default cipherlist for mandatory TLS encryption in the TLS
! client (with anonymous ciphers disabled when verifying server
! certificates). You are strongly encouraged to not change this
! setting.  With OpenSSL 1.0.0 and later the cipherlist may start with an
! "aNULL:" prefix, which restores the 0.9.8-compatible ordering of the
! aNULL ciphers to the top of the list when they are enabled. This prefix
! is not needed with previous OpenSSL releases. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
- </DD>
  
! <DT><b><a name="tls_null_cipherlist">tls_null_cipherlist</a>
! (default: eNULL:!aNULL)</b></DT><DD>
  
! <p> The OpenSSL cipherlist for "NULL" grade ciphers that provide
! authentication without encryption. This defines the meaning of the "null"
! setting in smtpd_mandatory_tls_ciphers, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>.  You are strongly encouraged to not
! change this setting. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="tls_preempt_cipherlist">tls_preempt_cipherlist</a>
! (default: no)</b></DT><DD>
  
! <p> With SSLv3 and later, use the Postfix SMTP server's cipher
! preference order instead of the remote client's cipher preference
! order. </p>
! 
! <p> By default, the OpenSSL server selects the client's most preferred
! cipher that the server supports. With SSLv3 and later, the server may
! choose its own most preferred cipher that is supported (offered) by
! the client. Setting "<a href="postconf.5.html#tls_preempt_cipherlist">tls_preempt_cipherlist</a> = yes" enables server cipher
! preferences. </p>
! 
! <p> While server cipher selection may in some cases lead to a more secure
! or performant cipher choice, there is some risk of interoperability
! issues. In the past, some SSL clients have listed lower priority ciphers
! that they did not implement correctly. If the server chooses a cipher
! that the client prefers less, it may select a cipher whose client
! implementation is flawed. </p>
  
! <p> This feature is available in Postfix 2.8 and later, in combination
! with OpenSSL 0.9.7 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="tls_random_bytes">tls_random_bytes</a>
! (default: 32)</b></DT><DD>
  
! <p> The number of bytes that <a href="tlsmgr.8.html">tlsmgr(8)</a> reads from $<a href="postconf.5.html#tls_random_source">tls_random_source</a>
! when (re)seeding the in-memory pseudo random number generator (PRNG)
! pool. The default of 32 bytes (256 bits) is good enough for 128bit
! symmetric keys.  If using EGD or a device file, a maximum of 255
! bytes is read. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
--- 12276,12333 ----
  
! <DT><b><a name="smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>
! (default: no)</b></DT><DD>
  
! <p> With mandatory TLS encryption, require a trusted remote SMTP client
! certificate in order to allow TLS connections to proceed.  This
! option implies "<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> = yes". </p>
  
! <p> When TLS encryption is optional, this setting is ignored with
! a warning written to the mail log. </p>
  
+ <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="smtpd_tls_security_level">smtpd_tls_security_level</a>
! (default: empty)</b></DT><DD>
  
! <p> The SMTP TLS security level for the Postfix SMTP server; when
! a non-empty value is specified, this overrides the obsolete parameters
! <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. This parameter is ignored with
! "<a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> = yes".  </p>
  
+ <p> Specify one of the following security levels: </p>
  
! <dl>
  
! <dt><b>none</b></dt> <dd> TLS will not be used. </dd>
  
! <dt><b>may</b></dt> <dd> Opportunistic TLS: announce STARTTLS support
! to SMTP clients, but do not require that clients use TLS encryption.
! </dd>
  
! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption: announce
! STARTTLS support to SMTP clients, and require that clients use TLS
! encryption. According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> this MUST NOT be applied in case
! of a publicly-referenced SMTP server. Instead, this option should
! be used only on dedicated servers. </dd>
  
+ </dl>
  
! <p> Note 1: the "fingerprint", "verify" and "secure" levels are not
! supported here.
! The Postfix SMTP server logs a warning and uses "encrypt" instead.
! To verify SMTP client certificates, see <a href="TLS_README.html">TLS_README</a> for a discussion
! of the <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>, <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>, and <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
! features.  </p>
  
! <p> Note 2: The parameter setting "<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> =
! encrypt" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes".</p>
  
! <p> Note 3: when invoked via "sendmail -bs", Postfix will never
! offer STARTTLS due to insufficient privileges to access the server
! private key. This is intended behavior.</p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 15710,15736 ****
  
! <DT><b><a name="tls_random_exchange_name">tls_random_exchange_name</a>
! (default: see "postconf -d" output)</b></DT><DD>
! 
! <p> Name of the pseudo random number generator (PRNG) state file
! that is maintained by <a href="tlsmgr.8.html">tlsmgr(8)</a>. The file is created when it does
! not exist, and its length is fixed at 1024 bytes.  </p>
! 
! <p> As of version 2.5, Postfix no longer uses root privileges when
! opening this file, and the default file location was changed from
! ${<a href="postconf.5.html#config_directory">config_directory</a>}/prng_exch to ${<a href="postconf.5.html#data_directory">data_directory</a>}/prng_exch.  As
! a migration aid, an attempt to open the file under a non-Postfix
! directory is redirected to the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>, and a
! warning is logged. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
  
! </DD>
  
! <DT><b><a name="tls_random_prng_update_period">tls_random_prng_update_period</a>
! (default: 3600s)</b></DT><DD>
  
! <p> The time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to save the state of
! the pseudo random number generator (PRNG) to the file specified
! with $<a href="postconf.5.html#tls_random_exchange_name">tls_random_exchange_name</a>.  </p>
  
--- 12336,12367 ----
  
! <DT><b><a name="smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
! (default: empty)</b></DT><DD>
  
! <p> Name of the file containing the optional Postfix SMTP server
! TLS session cache. Specify a database type that supports enumeration,
! such as <b>btree</b> or <b>sdbm</b>; there is no need to support
! concurrent access.  The file is created if it does not exist. The <a href="smtpd.8.html">smtpd(8)</a>
! daemon does not use this parameter directly, rather the cache is
! implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
! per-smtpd-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not
! effective. Note, that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a>
! daemon: $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
! (and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to be
! stored separately. It is not at this time possible to store multiple
! caches in a single database. </p>
  
+ <p> Note: <b>dbm</b> databases are not suitable. TLS
+ session objects are too large. </p>
  
! <p> As of version 2.5, Postfix no longer uses root privileges when
! opening this file. The file should now be stored under the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
! under a non-Postfix directory is redirected to the Postfix-owned
! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
  
! <p> Example: </p>
  
! <pre>
! <a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a> = btree:/var/lib/postfix/smtpd_scache
! </pre>
  
***************
*** 15741,15749 ****
  
! <DT><b><a name="tls_random_reseed_period">tls_random_reseed_period</a>
  (default: 3600s)</b></DT><DD>
  
! <p> The maximal time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to re-seed the
! in-memory pseudo random number generator (PRNG) pool from external
! sources.  The actual time between re-seeding attempts is calculated
! using the PRNG, and is between 0 and the time specified.  </p>
  
--- 12372,12382 ----
  
! <DT><b><a name="smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>
  (default: 3600s)</b></DT><DD>
  
! <p> The expiration time of Postfix SMTP server TLS session cache
! information. A cache cleanup is performed periodically
! every $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> seconds. As with
! $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, this parameter is implemented in the
! <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtpd-instance <a href="master.5.html">master.cf</a> overrides
! are not possible. </p>
  
***************
*** 15754,15767 ****
  
! <DT><b><a name="tls_random_source">tls_random_source</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p> The external entropy source for the in-memory <a href="tlsmgr.8.html">tlsmgr(8)</a> pseudo
! random number generator (PRNG) pool. Be sure to specify a non-blocking
! source.  If this source is not a regular file, the entropy source
! type must be prepended:  egd:/path/to/egd_socket for a source with
! EGD compatible socket interface, or dev:/path/to/device for a
! device file.  </p>
  
! <p> Note: on OpenBSD systems specify /dev/arandom when /dev/urandom
! gives timeout errors.  </p>
  
--- 12387,12398 ----
  
! <DT><b><a name="smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>
! (default: no)</b></DT><DD>
  
! <p> Run the Postfix SMTP server in the non-standard "wrapper" mode,
! instead of using the STARTTLS command. </p>
  
! <p> If you want to support this service, enable a special port in
! <a href="master.5.html">master.cf</a>, and specify "-o <a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>=yes" on the SMTP
! server's command line. Port 465 (smtps) was once chosen for this
! purpose. </p>
  
***************
*** 15772,15781 ****
  
! <DT><b><a name="tlsproxy_enforce_tls">tlsproxy_enforce_tls</a>
! (default: $<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b></DT><DD>
  
! <p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and
! require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> for
! further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12403,12416 ----
  
! <DT><b><a name="smtpd_use_tls">smtpd_use_tls</a>
! (default: no)</b></DT><DD>
! 
! <p> Opportunistic TLS: announce STARTTLS support to SMTP clients,
! but do not require that clients use TLS encryption. </p>
  
! <p> Note: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
! STARTTLS due to insufficient privileges to access the server private
! key. This is intended behavior. </p>
  
! <p> This feature is available in Postfix 2.2 and later. With
! Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
  
***************
*** 15784,15792 ****
  
! <DT><b><a name="tlsproxy_service_name">tlsproxy_service_name</a>
! (default: tlsproxy)</b></DT><DD>
  
! <p> The name of the <a href="tlsproxy.8.html">tlsproxy(8)</a> service entry in <a href="master.5.html">master.cf</a>. This
! service performs plaintext &lt;=&gt; TLS ciphertext conversion. <p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12419,12438 ----
  
! <DT><b><a name="soft_bounce">soft_bounce</a>
! (default: no)</b></DT><DD>
! 
! <p>
! Safety net to keep mail queued that would otherwise be returned to
! the sender.  This parameter disables locally-generated bounces,
! and prevents the Postfix SMTP server from rejecting mail permanently,
! by changing 5xx reply codes into 4xx.  However, <a href="postconf.5.html#soft_bounce">soft_bounce</a> is no
! cure for address rewriting mistakes or mail routing mistakes.
! </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#soft_bounce">soft_bounce</a> = yes
! </pre>
  
***************
*** 15795,15804 ****
  
! <DT><b><a name="tlsproxy_tls_CAfile">tlsproxy_tls_CAfile</a>
! (default: $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)</b></DT><DD>
  
! <p> A file containing (PEM format) CA certificates of root CAs
! trusted to sign either remote SMTP client certificates or intermediate
! CA certificates.  See <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12441,12454 ----
  
! <DT><b><a name="stale_lock_time">stale_lock_time</a>
! (default: 500s)</b></DT><DD>
  
! <p>
! The time after which a stale exclusive mailbox lockfile is removed.
! This is used for delivery to file or mailbox.
! </p>
  
! <p>
! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
! The default time unit is s (seconds).
! </p>
  
***************
*** 15807,15816 ****
  
! <DT><b><a name="tlsproxy_tls_CApath">tlsproxy_tls_CApath</a>
! (default: $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>)</b></DT><DD>
  
! <p> A directory containing (PEM format) CA certificates of root CAs
! trusted to sign either remote SMTP client certificates or intermediate
! CA certificates. See <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12457,12464 ----
  
! <DT><b><a name="stress">stress</a>
! (default: empty)</b></DT><DD>
  
! <p> This feature is documented in the <a href="STRESS_README.html">STRESS_README</a> document. </p>
  
! <p> This feature is available in Postfix 2.5 and later. </p>
  
***************
*** 15819,15863 ****
  
! <DT><b><a name="tlsproxy_tls_always_issue_session_ids">tlsproxy_tls_always_issue_session_ids</a>
! (default: $<a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>)</b></DT><DD>
! 
! <p> Force the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server to issue a TLS session id,
! even when TLS session caching is turned off. See
! <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
  
! </DD>
  
- <DT><b><a name="tlsproxy_tls_ask_ccert">tlsproxy_tls_ask_ccert</a>
- (default: $<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>)</b></DT><DD>
  
! <p> Ask a remote SMTP client for a client certificate. See
! <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="tlsproxy_tls_ccert_verifydepth">tlsproxy_tls_ccert_verifydepth</a>
! (default: $<a href="postconf.5.html#smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a>)</b></DT><DD>
  
- <p> The verification depth for remote SMTP client certificates. A
- depth of 1 is sufficient if the issuing CA is listed in a local CA
- file. See <a href="postconf.5.html#smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="tlsproxy_tls_cert_file">tlsproxy_tls_cert_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b></DT><DD>
  
! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server RSA certificate in PEM
! format.  This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
! private RSA key.  See <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for further details.  </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12467,12530 ----
  
! <DT><b><a name="strict_7bit_headers">strict_7bit_headers</a>
! (default: no)</b></DT><DD>
  
! <p>
! Reject mail with 8-bit text in message headers. This blocks mail
! from poorly written applications.
! </p>
  
+ <p>
+ This feature should not be enabled on a general purpose mail server,
+ because it is likely to reject legitimate email.
+ </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
! </DD>
  
! <DT><b><a name="strict_8bitmime">strict_8bitmime</a>
! (default: no)</b></DT><DD>
  
+ <p>
+ Enable both <a href="postconf.5.html#strict_7bit_headers">strict_7bit_headers</a> and <a href="postconf.5.html#strict_8bitmime_body">strict_8bitmime_body</a>.
+ </p>
  
! <p>
! This feature should not be enabled on a general purpose mail server,
! because it is likely to reject legitimate email.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
  
! </DD>
  
+ <DT><b><a name="strict_8bitmime_body">strict_8bitmime_body</a>
+ (default: no)</b></DT><DD>
  
! <p>
! Reject 8-bit message body text without 8-bit MIME content encoding
! information.  This blocks mail from poorly written applications.
! </p>
  
! <p>
! Unfortunately, this also rejects majordomo approval requests when
! the included request contains valid 8-bit MIME mail, and it rejects
! bounces from mailers that do not MIME encapsulate 8-bit content
! (for example, bounces from qmail or from old versions of Postfix).
! </p>
  
! <p>
! This feature should not be enabled on a general purpose mail server,
! because it is likely to reject legitimate email.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
***************
*** 15866,15875 ****
  
! <DT><b><a name="tlsproxy_tls_ciphers">tlsproxy_tls_ciphers</a>
! (default: $<a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>)</b></DT><DD>
  
! <p> The minimum TLS cipher grade that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
! will use with opportunistic TLS encryption. See <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>
! for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12533,12541 ----
  
! <DT><b><a name="strict_mailbox_ownership">strict_mailbox_ownership</a>
! (default: yes)</b></DT><DD>
  
! <p> Defer delivery when a mailbox file is not owned by its recipient.
! The default setting is not backwards compatible.  </p>
  
! <p> This feature is available in Postfix 2.5.3 and later. </p>
  
***************
*** 15878,15900 ****
  
! <DT><b><a name="tlsproxy_tls_dcert_file">tlsproxy_tls_dcert_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b></DT><DD>
  
! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server DSA certificate in PEM
! format.  This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
! private DSA key.  See <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> for further details.
  </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="tlsproxy_tls_dh1024_param_file">tlsproxy_tls_dh1024_param_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>)</b></DT><DD>
! 
! <p> File with DH parameters that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
! should use with EDH ciphers. See <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> for
! further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12544,12562 ----
  
! <DT><b><a name="strict_mime_encoding_domain">strict_mime_encoding_domain</a>
! (default: no)</b></DT><DD>
  
! <p>
! Reject mail with invalid Content-Transfer-Encoding: information
! for the message/* or multipart/* MIME content types.  This blocks
! mail from poorly written software.
  </p>
  
! <p>
! This feature should not be enabled on a general purpose mail server,
! because it will reject mail after a single violation.
! </p>
  
! <p>
! This feature is available in Postfix 2.0 and later.
! </p>
  
***************
*** 15903,15912 ****
  
! <DT><b><a name="tlsproxy_tls_dh512_param_file">tlsproxy_tls_dh512_param_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>)</b></DT><DD>
  
! <p> File with DH parameters that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
! should use with EDH ciphers. See <a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> for
! further details.  </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12565,12580 ----
  
! <DT><b><a name="strict_rfc821_envelopes">strict_rfc821_envelopes</a>
! (default: no)</b></DT><DD>
  
! <p>
! Require that addresses received in SMTP MAIL FROM and RCPT TO
! commands are enclosed with &lt;&gt;, and that those addresses do
! not contain <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> style comments or phrases.  This stops mail
! from poorly written software.
! </p>
  
! <p>
! By default, the Postfix SMTP server accepts <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> syntax in MAIL
! FROM and RCPT TO addresses.
! </p>
  
***************
*** 15915,15925 ****
  
! <DT><b><a name="tlsproxy_tls_dkey_file">tlsproxy_tls_dkey_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>)</b></DT><DD>
! 
! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server DSA private key in PEM
! format.  This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
! server DSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>.
! See <a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12583,12591 ----
  
! <DT><b><a name="sun_mailtool_compatibility">sun_mailtool_compatibility</a>
! (default: no)</b></DT><DD>
  
! <p>
! Obsolete SUN mailtool compatibility feature. Instead, use
! "<a href="postconf.5.html#mailbox_delivery_lock">mailbox_delivery_lock</a> = dotlock".
! </p>
  
***************
*** 15928,15963 ****
  
! <DT><b><a name="tlsproxy_tls_eccert_file">tlsproxy_tls_eccert_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b></DT><DD>
! 
! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server ECDSA certificate in
! PEM format.  This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
! server private ECDSA key.  See <a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> for further
! details. </p>
! 
! <p> This feature is available in Postfix 2.8 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="tlsproxy_tls_eckey_file">tlsproxy_tls_eckey_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a>)</b></DT><DD>
  
! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server ECDSA private key in
! PEM format.  This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
! server ECDSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>.
! See <a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
  
! </DD>
  
! <DT><b><a name="tlsproxy_tls_eecdh_grade">tlsproxy_tls_eecdh_grade</a>
! (default: $<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>)</b></DT><DD>
  
! <p> The Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server security grade for ephemeral
! elliptic-curve Diffie-Hellman (EECDH) key exchange. See
! <a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12594,12629 ----
  
! <DT><b><a name="swap_bangpath">swap_bangpath</a>
! (default: yes)</b></DT><DD>
  
+ <p>
+ Enable the rewriting of "site!user" into "user@site".  This is
+ necessary if your machine is connected to UUCP networks.  It is
+ enabled by default.
+ </p>
  
! <p> Note: with Postfix version 2.2, message header address rewriting
! happens only when one of the following conditions is true: </p>
  
! <ul>
  
! <li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
  
! <li> The message is received from a network client that matches
! $<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
  
+ <li> The message is received from the network, and the
+ <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
  
! </ul>
  
! <p> To get the behavior before Postfix version 2.2, specify
! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
  
! <p>
! Example:
! </p>
  
! <pre>
! <a href="postconf.5.html#swap_bangpath">swap_bangpath</a> = no
! </pre>
  
***************
*** 15966,15975 ****
  
! <DT><b><a name="tlsproxy_tls_exclude_ciphers">tlsproxy_tls_exclude_ciphers</a>
! (default: $<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>)</b></DT><DD>
  
! <p> List of ciphers or cipher types to exclude from the <a href="tlsproxy.8.html">tlsproxy(8)</a>
! server cipher list at all TLS security levels. See
! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12632,12648 ----
  
! <DT><b><a name="syslog_facility">syslog_facility</a>
! (default: mail)</b></DT><DD>
  
! <p>
! The syslog facility of Postfix logging. Specify a facility as
! defined in syslog.conf(5). The default facility is "mail".
! </p>
  
! <p>
! Warning: a non-default <a href="postconf.5.html#syslog_facility">syslog_facility</a> setting takes effect only
! after a Postfix process has completed initialization.  Errors during
! process initialization will be logged with the default facility.
! Examples are errors while parsing the command line arguments, and
! errors while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
! </p>
  
***************
*** 15978,15988 ****
  
! <DT><b><a name="tlsproxy_tls_fingerprint_digest">tlsproxy_tls_fingerprint_digest</a>
! (default: $<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>)</b></DT><DD>
  
! <p> The message digest algorithm to construct remote SMTP
! client-certificate
! fingerprints. See <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> for further details.
  </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12651,12667 ----
  
! <DT><b><a name="syslog_name">syslog_name</a>
! (default: postfix)</b></DT><DD>
  
! <p>
! The mail system name that is prepended to the process name in syslog
! records, so that "smtpd" becomes, for example, "postfix/smtpd".
  </p>
  
! <p>
! Warning: a non-default <a href="postconf.5.html#syslog_name">syslog_name</a> setting takes effect only after
! a Postfix process has completed initialization. Errors during
! process initialization will be logged with the default name. Examples
! are errors while parsing the command line arguments, and errors
! while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
! </p>
  
***************
*** 15991,16001 ****
  
! <DT><b><a name="tlsproxy_tls_key_file">tlsproxy_tls_key_file</a>
! (default: $<a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a>)</b></DT><DD>
  
! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server RSA private key in PEM
! format.  This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
! server RSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>.
! See <a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12670,12681 ----
  
! <DT><b><a name="tls_daemon_random_bytes">tls_daemon_random_bytes</a>
! (default: 32)</b></DT><DD>
  
! <p> The number of pseudo-random bytes that an <a href="smtp.8.html">smtp(8)</a> or <a href="smtpd.8.html">smtpd(8)</a>
! process requests from the <a href="tlsmgr.8.html">tlsmgr(8)</a> server in order to seed its
! internal pseudo random number generator (PRNG).  The default of 32
! bytes (equivalent to 256 bits) is sufficient to generate a 128bit
! (or 168bit) session key. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 16004,16014 ****
  
! <DT><b><a name="tlsproxy_tls_loglevel">tlsproxy_tls_loglevel</a>
! (default: $<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a>)</b></DT><DD>
  
! <p> Enable additional Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server logging of TLS
! activity.  Each logging level also includes the information that
! is logged at a lower logging level. See <a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> for
! further details.  </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12684,12696 ----
  
! <DT><b><a name="tls_export_cipherlist">tls_export_cipherlist</a>
! (default: ALL:+RC4:@STRENGTH)</b></DT><DD>
  
! <p> The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This
! defines the meaning of the "export" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
! the cipherlist for the opportunistic ("may") TLS client security
! level and is the default cipherlist for the SMTP server. You are
! strongly encouraged to not change this setting. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 16017,16026 ****
  
! <DT><b><a name="tlsproxy_tls_mandatory_ciphers">tlsproxy_tls_mandatory_ciphers</a>
! (default: $<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>)</b></DT><DD>
  
! <p> The minimum TLS cipher grade that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
! will use with mandatory TLS encryption. See <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>
! for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12699,12709 ----
  
! <DT><b><a name="tls_high_cipherlist">tls_high_cipherlist</a>
! (default: ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH)</b></DT><DD>
  
! <p> The OpenSSL cipherlist for "HIGH" grade ciphers. This defines
! the meaning of the "high" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
! strongly encouraged to not change this setting. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 16029,16038 ****
  
! <DT><b><a name="tlsproxy_tls_mandatory_exclude_ciphers">tlsproxy_tls_mandatory_exclude_ciphers</a>
! (default: $<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>)</b></DT><DD>
  
! <p> Additional list of ciphers or cipher types to exclude from the
! <a href="tlsproxy.8.html">tlsproxy(8)</a> server cipher list at mandatory TLS security levels.
! See <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12712,12722 ----
  
! <DT><b><a name="tls_low_cipherlist">tls_low_cipherlist</a>
! (default: ALL:!EXPORT:+RC4:@STRENGTH)</b></DT><DD>
  
! <p> The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines
! the meaning of the "low" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
! strongly encouraged to not change this setting. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 16041,16051 ****
  
! <DT><b><a name="tlsproxy_tls_mandatory_protocols">tlsproxy_tls_mandatory_protocols</a>
! (default: $<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>)</b></DT><DD>
  
! <p> The SSL/TLS protocols accepted by the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
! with mandatory TLS encryption. If the list is empty, the server
! supports all available SSL/TLS protocol versions.  See
! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12725,12738 ----
  
! <DT><b><a name="tls_medium_cipherlist">tls_medium_cipherlist</a>
! (default: ALL:!EXPORT:!LOW:+RC4:@STRENGTH)</b></DT><DD>
  
! <p> The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This
! defines the meaning of the "medium" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
! the default cipherlist for mandatory TLS encryption in the TLS
! client (with anonymous ciphers disabled when verifying server
! certificates). You are strongly encouraged to not change this
! setting. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 16054,16063 ****
  
! <DT><b><a name="tlsproxy_tls_protocols">tlsproxy_tls_protocols</a>
! (default: $<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a>)</b></DT><DD>
  
! <p> List of TLS protocols that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server will
! exclude or include with opportunistic TLS encryption. See
! <a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12741,12752 ----
  
! <DT><b><a name="tls_null_cipherlist">tls_null_cipherlist</a>
! (default: eNULL:!aNULL)</b></DT><DD>
  
! <p> The OpenSSL cipherlist for "NULL" grade ciphers that provide
! authentication without encryption. This defines the meaning of the "null"
! setting in smtpd_mandatory_tls_ciphers, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
! <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>.  You are strongly encouraged to not
! change this setting. </p>
  
! <p> This feature is available in Postfix 2.3 and later. </p>
  
***************
*** 16066,16075 ****
  
! <DT><b><a name="tlsproxy_tls_req_ccert">tlsproxy_tls_req_ccert</a>
! (default: $<a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>)</b></DT><DD>
  
! <p> With mandatory TLS encryption, require a trusted remote SMTP
! client certificate in order to allow TLS connections to proceed.
! See <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12755,12766 ----
  
! <DT><b><a name="tls_random_bytes">tls_random_bytes</a>
! (default: 32)</b></DT><DD>
  
! <p> The number of bytes that <a href="tlsmgr.8.html">tlsmgr(8)</a> reads from $<a href="postconf.5.html#tls_random_source">tls_random_source</a>
! when (re)seeding the in-memory pseudo random number generator (PRNG)
! pool. The default of 32 bytes (256 bits) is good enough for 128bit
! symmetric keys.  If using EGD or a device file, a maximum of 255
! bytes is read. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 16078,16088 ****
  
! <DT><b><a name="tlsproxy_tls_security_level">tlsproxy_tls_security_level</a>
! (default: $<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b></DT><DD>
  
! <p> The SMTP TLS security level for the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server;
! when a non-empty value is specified, this overrides the obsolete
! parameters <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. See
! <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12769,12785 ----
  
! <DT><b><a name="tls_random_exchange_name">tls_random_exchange_name</a>
! (default: see "postconf -d" output)</b></DT><DD>
! 
! <p> Name of the pseudo random number generator (PRNG) state file
! that is maintained by <a href="tlsmgr.8.html">tlsmgr(8)</a>. The file is created when it does
! not exist, and its length is fixed at 1024 bytes.  </p>
  
! <p> As of version 2.5, Postfix no longer uses root privileges when
! opening this file, and the default file location was changed from
! ${<a href="postconf.5.html#config_directory">config_directory</a>}/prng_exch to ${<a href="postconf.5.html#data_directory">data_directory</a>}/prng_exch.  As
! a migration aid, an attempt to open the file under a non-Postfix
! directory is redirected to the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>, and a
! warning is logged. </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 16091,16101 ****
  
! <DT><b><a name="tlsproxy_tls_session_cache_timeout">tlsproxy_tls_session_cache_timeout</a>
! (default: $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>)</b></DT><DD>
  
! <p> The expiration time of Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server TLS session
! cache information. A cache cleanup is performed periodically every
! $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> seconds. See
! <a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12788,12797 ----
  
! <DT><b><a name="tls_random_prng_update_period">tls_random_prng_update_period</a>
! (default: 3600s)</b></DT><DD>
  
! <p> The time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to save the state of
! the pseudo random number generator (PRNG) to the file specified
! with $<a href="postconf.5.html#tls_random_exchange_name">tls_random_exchange_name</a>.  </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 16104,16113 ****
  
! <DT><b><a name="tlsproxy_use_tls">tlsproxy_use_tls</a>
! (default: $<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b></DT><DD>
  
! <p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
! but do not require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>
! for further details. </p>
  
! <p> This feature is available in Postfix 2.8 and later. </p>
  
--- 12800,12810 ----
  
! <DT><b><a name="tls_random_reseed_period">tls_random_reseed_period</a>
! (default: 3600s)</b></DT><DD>
  
! <p> The maximal time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to re-seed the
! in-memory pseudo random number generator (PRNG) pool from external
! sources.  The actual time between re-seeding attempts is calculated
! using the PRNG, and is between 0 and the time specified.  </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 16116,16132 ****
  
! <DT><b><a name="tlsproxy_watchdog_timeout">tlsproxy_watchdog_timeout</a>
! (default: 10s)</b></DT><DD>
  
! <p> How much time a <a href="tlsproxy.8.html">tlsproxy(8)</a> process may take to process local
! or remote I/O before it is terminated by a built-in watchdog timer.
! This is a safety mechanism that prevents <a href="tlsproxy.8.html">tlsproxy(8)</a> from becoming
! non-responsive due to a bug in Postfix itself or in system software.
! To avoid false alarms and unnecessary cache corruption this limit
! cannot be set under 10s.  </p>
  
! <p> Specify a non-zero time value (an integral value plus an optional
! one-letter suffix that specifies the time unit).  Time units: s
! (seconds), m (minutes), h (hours), d (days), w (weeks).  </p>
  
! <p> This feature is available in Postfix 2.8.  </p>
  
--- 12813,12828 ----
  
! <DT><b><a name="tls_random_source">tls_random_source</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
! <p> The external entropy source for the in-memory <a href="tlsmgr.8.html">tlsmgr(8)</a> pseudo
! random number generator (PRNG) pool. Be sure to specify a non-blocking
! source.  If this source is not a regular file, the entropy source
! type must be prepended:  egd:/path/to/egd_socket for a source with
! EGD compatible socket interface, or dev:/path/to/device for a
! device file.  </p>
  
! <p> Note: on OpenBSD systems specify /dev/arandom when /dev/urandom
! gives timeout errors.  </p>
  
! <p> This feature is available in Postfix 2.2 and later.  </p>
  
***************
*** 16159,16166 ****
  
- <p> Note: <a href="postconf.5.html#transport_delivery_slot_cost"><i>transport</i>_delivery_slot_cost</a> parameters will not
- show up in "postconf" command output before Postfix version 2.9.
- This limitation applies to many parameters whose name is a combination
- of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
- "_delivery_slot_cost"). </p>
- 
  
--- 12855,12856 ----
***************
*** 16175,16182 ****
  
- <p> Note: <a href="postconf.5.html#transport_delivery_slot_discount"><i>transport</i>_delivery_slot_discount</a> parameters will
- not show up in "postconf" command output before Postfix version
- 2.9.  This limitation applies to many parameters whose name is a
- combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
- this case: "_delivery_slot_discount"). </p>
- 
  
--- 12865,12866 ----
***************
*** 16191,16198 ****
  
- <p> Note: <a href="postconf.5.html#transport_delivery_slot_loan"><i>transport</i>_delivery_slot_loan</a> parameters will not
- show up in "postconf" command output before Postfix version 2.9.
- This limitation applies to many parameters whose name is a combination
- of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
- "_delivery_slot_loan"). </p>
- 
  
--- 12875,12876 ----
***************
*** 16208,16216 ****
  
- <p> Note: some <a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a>
- parameters will not show up in "postconf" command output before
- Postfix version 2.9.  This limitation applies to many parameters
- whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
- built-in suffix (in this case:
- "_destination_concurrency_failed_cohort_limit"). </p>
- 
  <p> This feature is available in Postfix 2.5 and later. </p>
--- 12886,12887 ----
***************
*** 16228,16236 ****
  
- <p> Note: some <a href="postconf.5.html#transport_destination_concurrency_limit"><i>transport</i>_destination_concurrency_limit</a>
- parameters will not show up in "postconf" command output before
- Postfix version 2.9.  This limitation applies to many parameters
- whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
- built-in suffix (in this case: "_destination_concurrency_limit").
- </p>
- 
  
--- 12899,12900 ----
***************
*** 16246,16254 ****
  
- <p> Note: some <a href="postconf.5.html#transport_destination_concurrency_negative_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
- parameters will not show up in "postconf" command output before
- Postfix version 2.9.  This limitation applies to many parameters
- whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
- built-in suffix (in this case:
- "_destination_concurrency_negative_feedback"). </p>
- 
  <p> This feature is available in Postfix 2.5 and later. </p>
--- 12910,12911 ----
***************
*** 16266,16274 ****
  
- <p> Note: some <a href="postconf.5.html#transport_destination_concurrency_positive_feedback"><i>transport</i>_destination_concurrency_positive_feedback</a>
- parameters will not show up in "postconf" command output before
- Postfix version 2.9.  This limitation applies to many parameters
- whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
- built-in suffix (in this case:
- "_destination_concurrency_positive_feedback"). </p>
- 
  <p> This feature is available in Postfix 2.5 and later. </p>
--- 12923,12924 ----
***************
*** 16285,16292 ****
  
- <p> Note: some <a href="postconf.5.html#transport_destination_rate_delay"><i>transport</i>_destination_rate_delay</a> parameters
- will not show up in "postconf" command output before Postfix version
- 2.9.  This limitation applies to many parameters whose name is a
- combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
- this case: "_destination_rate_delay"). </p>
- 
  <p> This feature is available in Postfix 2.5 and later. </p>
--- 12935,12936 ----
***************
*** 16304,16311 ****
  
- <p> Note: some <a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> parameters
- will not show up in "postconf" command output before Postfix version
- 2.9.  This limitation applies to many parameters whose name is a
- combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
- this case: "_destination_recipient_limit"). </p>
- 
  
--- 12948,12949 ----
***************
*** 16320,16327 ****
  
- <p> Note: <a href="postconf.5.html#transport_extra_recipient_limit"><i>transport</i>_extra_recipient_limit</a> parameters will
- not show up in "postconf" command output before Postfix version
- 2.9.  This limitation applies to many parameters whose name is a
- combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
- this case: "_extra_recipient_limit").  </p>
- 
  
--- 12958,12959 ----
***************
*** 16336,16344 ****
  
- <p> Note: some <a href="postconf.5.html#transport_initial_destination_concurrency"><i>transport</i>_initial_destination_concurrency</a>
- parameters will not show up in "postconf" command output before
- Postfix version 2.9.  This limitation applies to many parameters
- whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
- built-in suffix (in this case: "_initial_destination_concurrency").
- </p>
- 
  <p> This feature is available in Postfix 2.5 and later. </p>
--- 12968,12969 ----
***************
*** 16384,16391 ****
  
- <p> Note: <a href="postconf.5.html#transport_minimum_delivery_slots"><i>transport</i>_minimum_delivery_slots</a> parameters will
- not show up in "postconf" command output before Postfix version
- 2.9.  This limitation applies to many parameters whose name is a
- combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
- this case: "_minimum_delivery_slots"). </p>
- 
  
--- 13009,13010 ----
***************
*** 16400,16407 ****
  
- <p> Note: some <a href="postconf.5.html#transport_recipient_limit"><i>transport</i>_recipient_limit</a> parameters will not
- show up in "postconf" command output before Postfix version 2.9.
- This limitation applies to many parameters whose name is a combination
- of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
- "_recipient_limit"). </p>
- 
  
--- 13019,13020 ----
***************
*** 16416,16423 ****
  
- <p> Note: <a href="postconf.5.html#transport_recipient_refill_delay"><i>transport</i>_recipient_refill_delay</a> parameters will
- not show up in "postconf" command output before Postfix version
- 2.9.  This limitation applies to many parameters whose name is a
- combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
- this case: "_recipient_refill_delay").  </p>
- 
  <p> This feature is available in Postfix 2.4 and later. </p>
--- 13029,13030 ----
***************
*** 16434,16441 ****
  
- <p> Note: <a href="postconf.5.html#transport_recipient_refill_limit"><i>transport</i>_recipient_refill_limit</a> parameters will
- not show up in "postconf" command output before Postfix version
- 2.9.  This limitation applies to many parameters whose name is a
- combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
- this case: "_recipient_refill_limit").  </p>
- 
  <p> This feature is available in Postfix 2.4 and later. </p>
--- 13041,13042 ----
***************
*** 16468,16475 ****
  
- <p> Note: <a href="postconf.5.html#transport_time_limit"><i>transport</i>_time_limit</a> parameters will not show up
- in "postconf" command output before Postfix version 2.9.  This
- limitation applies to many parameters whose name is a combination
- of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
- "_time_limit"). </p>
- 
  
--- 13069,13070 ----
***************
*** 16496,16498 ****
  <DT><b><a name="undisclosed_recipients_header">undisclosed_recipients_header</a>
! (default: see "postconf -d" output)</b></DT><DD>
  
--- 13091,13093 ----
  <DT><b><a name="undisclosed_recipients_header">undisclosed_recipients_header</a>
! (default: To: undisclosed-recipients:;)</b></DT><DD>
  
***************
*** 16500,16512 ****
  Message header that the Postfix <a href="cleanup.8.html">cleanup(8)</a> server inserts when a
! message contains no To: or Cc: message header. With Postfix 2.8
! and later, the default value is empty. With Postfix 2.4-2.7,
! specify an empty value to disable this feature.  </p>
! 
! <p> Example: </p>
! 
! <pre>
! # Default value before Postfix 2.8.
! # Note: the ":" and ";" are both required.
! <a href="postconf.5.html#undisclosed_recipients_header">undisclosed_recipients_header</a> = To: undisclosed-recipients:;
! </pre>
  
--- 13095,13098 ----
  Message header that the Postfix <a href="cleanup.8.html">cleanup(8)</a> server inserts when a
! message contains no To: or Cc: message header. With Postfix 2.4
! and later, specify an empty value to disable this feature.  </p>
  
***************
*** 16532,16549 ****
  
- <DT><b><a name="unknown_address_tempfail_action">unknown_address_tempfail_action</a>
- (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
- 
- <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
- or <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a> fail due to a temporary error
- condition. Specify "defer" to defer the remote SMTP client request
- immediately. With the default "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix
- SMTP server continues to look for opportunities to reject mail, and
- defers the client request only if it would otherwise be accepted.
- </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="unknown_client_reject_code">unknown_client_reject_code</a>
--- 13118,13119 ----
***************
*** 16565,16581 ****
  
- <DT><b><a name="unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a>
- (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
- 
- <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>
- fails due to an temporary error condition. Specify "defer" to defer
- the remote SMTP client request immediately. With the default
- "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
- for opportunities to reject mail, and defers the client request
- only if it would otherwise be accepted. </p>
- 
- <p> This feature is available in Postfix 2.6 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="unknown_hostname_reject_code">unknown_hostname_reject_code</a>
--- 13135,13136 ----
***************
*** 16648,16650 ****
  <p>
! The Postfix SMTP server reply code when a recipient address matches
  $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> specifies a list
--- 13203,13205 ----
  <p>
! The SMTP server reply code when a recipient address matches
  $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> specifies a list
***************
*** 16664,16666 ****
  <p>
! The Postfix SMTP server reply code when a recipient address matches
  $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> specifies a list
--- 13219,13221 ----
  <p>
! The SMTP server reply code when a recipient address matches
  $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> specifies a list
***************
*** 16727,16753 ****
  
! <p> The Postfix SMTP server's reply when rejecting mail with
! <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>. Do not include the numeric SMTP reply
! code or the enhanced status code. By default, the response includes
! actual address verification details.
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#unverified_recipient_reject_reason">unverified_recipient_reject_reason</a> = Recipient address lookup failed
! </pre>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a>
! (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
! 
! <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>
! fails due to a temporary error condition. Specify "defer" to defer
! the remote SMTP client request immediately. With the default
! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
! for opportunities to reject mail, and defers the client request
! only if it would otherwise be accepted. </p>
  
--- 13282,13286 ----
  
! <p> When rejecting mail with <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>, reply
! with this text as the reason, instead of actual address verification
! details.
  
***************
*** 16809,16835 ****
  
! <p> The Postfix SMTP server's reply when rejecting mail with
! <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>. Do not include the numeric SMTP reply
! code or the enhanced status code. By default, the response includes
! actual address verification details.
! 
! <p> Example: </p>
! 
! <pre>
! <a href="postconf.5.html#unverified_sender_reject_reason">unverified_sender_reject_reason</a> = Sender address lookup failed
! </pre>
! 
! <p> This feature is available in Postfix 2.6 and later. </p>
! 
! 
! </DD>
! 
! <DT><b><a name="unverified_sender_tempfail_action">unverified_sender_tempfail_action</a>
! (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
! 
! <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>
! fails due to a temporary error condition. Specify "defer" to defer
! the remote SMTP client request immediately. With the default
! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
! for opportunities to reject mail, and defers the client request
! only if it would otherwise be accepted. </p>
  
--- 13342,13346 ----
  
! <p> When rejecting mail with <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>, reply with
! this text as the reason, instead of actual address verification
! details.
  
***************
*** 17079,17082 ****
  <p>
! The maximal size in bytes of an individual <a href="virtual.8.html">virtual(8)</a> mailbox or
! maildir file, or zero (no limit).  </p>
  
--- 13590,13594 ----
  <p>
! The maximal size in bytes of an individual mailbox or maildir file,
! or zero (no limit).
! </p>
  
***************
*** 17196,17199 ****
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> destination is optional; its syntax is documented
! in the manual page of the corresponding delivery agent.
  </p>
--- 13708,13711 ----
  is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
! The <i>:nexthop</i> part is optional.  For more details see the
! <a href="transport.5.html">transport(5)</a> manual page.
  </p>

