[postconf-devel] [postconf.5.html] UPDATE
Patrick Ben Koetter
p at state-of-mind.de
Sun Mar 18 19:32:33 CET 2012
* Werner Detter <werner at detter.biz>:
> Hi,
>
> wollt ihr mein Skript hier nicht mal deaktivieren nachdem das Projekt ja
> quasi tot ist? :)
ACK
>
> Grüsse,
> Werner
>
>
>
>
> Am 18.03.12 19:00, schrieb postconf-devel at de.postfix.org:
> > -- generated message --
> >
> > postconf.5.html has been updated:
> >
> > *** /tmp/postconf.5.html.orig 2012-03-05 11:40:00.000000000 +0100
> > --- /tmp/postconf.5.html 2012-03-18 19:00:02.000000000 +0100
> > ***************
> > *** 87,109 ****
> >
> > - <DT><b><a name="access_map_defer_code">access_map_defer_code</a>
> > - (default: 450)</b></DT><DD>
> > -
> > - <p>
> > - The numerical Postfix SMTP server response code for
> > - an <a href="access.5.html">access(5)</a> map "defer" action, including "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>"
> > - or "<a href="postconf.5.html#defer_if_reject">defer_if_reject</a>". Prior to Postfix 2.6, the response
> > - is hard-coded as "450".
> > - </p>
> > -
> > - <p>
> > - Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
> > - </p>
> > -
> > - <p>
> > - This feature is available in Postfix 2.6 and later.
> > - </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="access_map_reject_code">access_map_reject_code</a>
> > --- 87,88 ----
> > ***************
> > *** 112,115 ****
> > <p>
> > ! The numerical Postfix SMTP server response code for
> > ! an <a href="access.5.html">access(5)</a> map "reject" action.
> > </p>
> > --- 91,94 ----
> > <p>
> > ! The numerical Postfix SMTP server response code when a client
> > ! is rejected by an <a href="access.5.html">access(5)</a> map restriction.
> > </p>
> > ***************
> > *** 123,146 ****
> >
> > - <DT><b><a name="address_verify_cache_cleanup_interval">address_verify_cache_cleanup_interval</a>
> > - (default: 12h)</b></DT><DD>
> > -
> > - <p> The amount of time between <a href="verify.8.html">verify(8)</a> address verification
> > - database cleanup runs. This feature requires that the database
> > - supports the "delete" and "sequence" operators. Specify a zero
> > - interval to disable database cleanup. </p>
> > -
> > - <p> After each database cleanup run, the <a href="verify.8.html">verify(8)</a> daemon logs the
> > - number of entries that were retained and dropped. A cleanup run is
> > - logged as "partial" when the daemon terminates early after "<b>postfix
> > - reload</b>", "<b>postfix stop</b>", or no requests for $<a href="postconf.5.html#max_idle">max_idle</a>
> > - seconds. </p>
> > -
> > - <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
> > - (weeks). </p>
> > -
> > - <p> This feature is available in Postfix 2.7. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="address_verify_default_transport">address_verify_default_transport</a>
> > --- 102,103 ----
> > ***************
> > *** 176,181 ****
> > <DT><b><a name="address_verify_map">address_verify_map</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > <p>
> > ! Lookup table for persistent address verification status
> > storage. The table is maintained by the <a href="verify.8.html">verify(8)</a> service, and
> > --- 133,138 ----
> > <DT><b><a name="address_verify_map">address_verify_map</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional lookup table for persistent address verification status
> > storage. The table is maintained by the <a href="verify.8.html">verify(8)</a> service, and
> > ***************
> > *** 185,190 ****
> > <p>
> > ! The lookup table is persistent by default (Postfix 2.7 and later).
> > ! Specify an empty table name to keep the information in volatile
> > ! memory which is lost after "<b>postfix reload</b>" or "<b>postfix
> > ! stop</b>". This is the default with Postfix version 2.6 and earlier.
> > </p>
> > --- 142,145 ----
> > <p>
> > ! By default, the information is kept in volatile memory, and is lost
> > ! after "<b>postfix reload</b>" or "<b>postfix stop</b>".
> > </p>
> > ***************
> > *** 194,204 ****
> > database becomes corrupted, the world comes to an end. To recover
> > ! delete (NOT: truncate) the file and do "<b>postfix reload</b>".
> > </p>
> >
> > ! <p> Postfix daemon processes do not use root privileges when opening
> > ! this file (Postfix 2.5 and later). The file must therefore be
> > ! stored under a Postfix-owned directory such as the <a href="postconf.5.html#data_directory">data_directory</a>.
> > ! As a migration aid, an attempt to open the file under a non-Postfix
> > ! directory is redirected to the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>, and a
> > ! warning is logged. </p>
> >
> > --- 149,158 ----
> > database becomes corrupted, the world comes to an end. To recover
> > ! delete the file and do "<b>postfix reload</b>".
> > </p>
> >
> > ! <p> As of version 2.5, Postfix no longer uses root privileges when
> > ! opening this file. The file should now be stored under the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
> > ! under a non-Postfix directory is redirected to the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
> >
> > ***************
> > *** 276,278 ****
> > <DT><b><a name="address_verify_poll_count">address_verify_poll_count</a>
> > ! (default: normal: 3, overload: 1)</b></DT><DD>
> >
> > --- 230,232 ----
> > <DT><b><a name="address_verify_poll_count">address_verify_poll_count</a>
> > ! (default: 3)</b></DT><DD>
> >
> > ***************
> > *** 283,289 ****
> >
> > ! <p> By default, the Postfix SMTP server polls the <a href="verify.8.html">verify(8)</a> service
> > ! up to three times under non-overload conditions, and only once when
> > ! under overload. With Postfix version 2.5 and earlier, the SMTP
> > ! server always polls the <a href="verify.8.html">verify(8)</a> service up to three times by
> > ! default. </p>
> >
> > --- 237,241 ----
> >
> > ! <p>
> > ! The default poll count is 3.
> > ! </p>
> >
> > ***************
> > *** 291,293 ****
> > Specify 1 to implement a crude form of greylisting, that is, always
> > ! defer the first delivery request for a new address.
> > </p>
> > --- 243,245 ----
> > Specify 1 to implement a crude form of greylisting, that is, always
> > ! defer the first delivery request for a never seen before address.
> > </p>
> > ***************
> > *** 295,297 ****
> > <p>
> > ! Examples:
> > </p>
> > --- 247,249 ----
> > <p>
> > ! Example:
> > </p>
> > ***************
> > *** 299,303 ****
> > <pre>
> > - # Postfix ≤ 2.6 default
> > - <a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> = 3
> > - # Poor man's greylisting
> > <a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> = 1
> > --- 251,252 ----
> > ***************
> > *** 435,447 ****
> >
> > - <DT><b><a name="address_verify_sender_dependent_default_transport_maps">address_verify_sender_dependent_default_transport_maps</a>
> > - (default: $<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>)</b></DT><DD>
> > -
> > - <p> Overrides the <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> parameter
> > - setting for address verification probes. </p>
> > -
> > - <p> This feature is available in Postfix 2.7 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="address_verify_sender_dependent_relayhost_maps">address_verify_sender_dependent_relayhost_maps</a>
> > --- 384,385 ----
> > ***************
> > *** 461,489 ****
> >
> > - <DT><b><a name="address_verify_sender_ttl">address_verify_sender_ttl</a>
> > - (default: 0s)</b></DT><DD>
> > -
> > - <p> The time between changes in the time-dependent portion of address
> > - verification probe sender addresses. The time-dependent portion is
> > - appended to the localpart of the address specified with the
> > - <a href="postconf.5.html#address_verify_sender">address_verify_sender</a> parameter. This feature is ignored when the
> > - probe sender addresses is the null sender, i.e. the <a href="postconf.5.html#address_verify_sender">address_verify_sender</a>
> > - value is empty or <>. </p>
> > -
> > - <p> Historically, the probe sender address was fixed. This has
> > - caused such addresses to end up on spammer mailing lists, and has
> > - resulted in wasted network and processing resources. </p>
> > -
> > - <p> To enable time-dependent probe sender addresses, specify a
> > - non-zero time value (an integral value plus an optional one-letter
> > - suffix that specifies the time unit). Specify a value of at least
> > - several hours, to avoid problems with senders that use greylisting.
> > - Avoid nice TTL values, to make the result less predictable. Time
> > - units are: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > - </p>
> > -
> > - <p> This feature is available in Postfix 2.9 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="address_verify_service_name">address_verify_service_name</a>
> > --- 399,400 ----
> > ***************
> > *** 695,697 ****
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
> >
> > --- 606,608 ----
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
> >
> > ***************
> > *** 749,762 ****
> >
> > - <DT><b><a name="always_add_missing_headers">always_add_missing_headers</a>
> > - (default: no)</b></DT><DD>
> > -
> > - <p> Always add (Resent-) From:, To:, Date: or Message-ID: headers
> > - when not present. Postfix 2.6 and later add these headers only
> > - when clients match the <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> parameter
> > - setting. Earlier Postfix versions always add these headers; this
> > - may break DKIM signatures that cover non-existent headers. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="always_bcc">always_bcc</a>
> > --- 660,661 ----
> > ***************
> > *** 776,779 ****
> > To avoid mailer loops, automatic BCC recipients are not generated
> > ! after Postfix forwards mail internally, or after Postfix generates
> > ! mail itself. </p>
> >
> > --- 675,678 ----
> > To avoid mailer loops, automatic BCC recipients are not generated
> > ! for mail that Postfix forwards internally, nor for mail that Postfix
> > ! generates itself. </p>
> >
> > ***************
> > *** 859,861 ****
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
> >
> > --- 758,760 ----
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
> >
> > ***************
> > *** 896,898 ****
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
> >
> > --- 795,797 ----
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
> >
> > ***************
> > *** 906,908 ****
> > How long the <a href="postkick.1.html">postkick(1)</a> command waits for a request to enter the
> > ! Postfix daemon process input buffer before giving up.
> > </p>
> > --- 805,807 ----
> > How long the <a href="postkick.1.html">postkick(1)</a> command waits for a request to enter the
> > ! server's input buffer before giving up.
> > </p>
> > ***************
> > *** 922,924 ****
> > <DT><b><a name="authorized_flush_users">authorized_flush_users</a>
> > ! (default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
> >
> > --- 821,823 ----
> > <DT><b><a name="authorized_flush_users">authorized_flush_users</a>
> > ! (default: static:anyone)</b></DT><DD>
> >
> > ***************
> > *** 956,958 ****
> > <DT><b><a name="authorized_mailq_users">authorized_mailq_users</a>
> > ! (default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
> >
> > --- 855,857 ----
> > <DT><b><a name="authorized_mailq_users">authorized_mailq_users</a>
> > ! (default: static:anyone)</b></DT><DD>
> >
> > ***************
> > *** 990,992 ****
> > <DT><b><a name="authorized_submit_users">authorized_submit_users</a>
> > ! (default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
> >
> > --- 889,891 ----
> > <DT><b><a name="authorized_submit_users">authorized_submit_users</a>
> > ! (default: static:anyone)</b></DT><DD>
> >
> > ***************
> > *** 1021,1023 ****
> > <pre>
> > ! <a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> = !www, <a href="DATABASE_README.html#types">static</a>:all
> > </pre>
> > --- 920,922 ----
> > <pre>
> > ! <a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> = !www, static:all
> > </pre>
> > ***************
> > *** 1034,1036 ****
> >
> > ! <p> What remote SMTP clients are allowed to specify the XVERP command.
> > This command requests that mail be delivered one recipient at a
> > --- 933,935 ----
> >
> > ! <p> What SMTP clients are allowed to specify the XVERP command.
> > This command requests that mail be delivered one recipient at a
> > ***************
> > *** 1246,1252 ****
> > <p> The maximal amount of original message text that is sent in a
> > ! non-delivery notification. Specify a byte count. A message is
> > ! returned as either message/rfc822 (the complete original) or as
> > ! text/rfc822-headers (the headers only). With Postfix version 2.4
> > ! and earlier, a message is always returned as message/rfc822 and is
> > ! truncated when it exceeds the size limit.
> > </p>
> > --- 1145,1151 ----
> > <p> The maximal amount of original message text that is sent in a
> > ! non-delivery notification. Specify a byte count. With Postfix 2.4
> > ! and later, a message is returned as either message/rfc822 (the
> > ! complete original) or as text/rfc822-headers (the headers only).
> > ! With earlier Postfix versions, a message is always returned as
> > ! message/rfc822 and is truncated when it exceeds the size limit.
> > </p>
> > ***************
> > *** 1293,1295 ****
> > <p>
> > ! Enable inter-operability with remote SMTP clients that implement an obsolete
> > version of the AUTH command (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>). Examples of such clients
> > --- 1192,1194 ----
> > <p>
> > ! Enable inter-operability with SMTP clients that implement an obsolete
> > version of the AUTH command (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>). Examples of such clients
> > ***************
> > *** 1360,1362 ****
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
> >
> > --- 1259,1261 ----
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
> >
> > ***************
> > *** 1537,1540 ****
> >
> > - <p> This feature is available in Postfix 2.2 and later. </p>
> > -
> >
> > --- 1436,1437 ----
> > ***************
> > *** 1568,1593 ****
> >
> > ! <p> After the message is queued, send the entire message to the
> > ! specified <i>transport:destination</i>. The <i>transport</i> name
> > ! specifies the first field of a mail delivery agent definition in
> > ! <a href="master.5.html">master.cf</a>; the syntax of the next-hop <i>destination</i> is described
> > ! in the manual page of the corresponding delivery agent. More
> > ! information about external content filters is in the Postfix
> > ! <a href="FILTER_README.html">FILTER_README</a> file. </p>
> > !
> > ! <p> Notes: </p>
> > !
> > ! <ul>
> > !
> > ! <li> <p> This setting has lower precedence than a FILTER action
> > ! that is specified in an <a href="access.5.html">access(5)</a>, <a href="header_checks.5.html">header_checks(5)</a> or <a href="header_checks.5.html">body_checks(5)</a>
> > ! table. </p>
> > !
> > ! <li> <p> The meaning of an empty next-hop filter <i>destination</i>
> > ! is version dependent. Postfix 2.7 and later will use the recipient
> > ! domain; earlier versions will use $<a href="postconf.5.html#myhostname">myhostname</a>. Specify
> > ! "<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> = $<a href="postconf.5.html#myhostname">myhostname</a>" for compatibility with Postfix
> > ! 2.6 or earlier, or specify a <a href="postconf.5.html#content_filter">content_filter</a> value with an explicit
> > ! next-hop <i>destination</i>. </p>
> >
> > ! </ul>
> >
> > --- 1465,1477 ----
> >
> > ! <p>
> > ! The name of a mail delivery transport that filters mail after
> > ! it is queued.
> > ! </p>
> >
> > ! <p>
> > ! This parameter uses the same syntax as the right-hand side of a
> > ! Postfix <a href="transport.5.html">transport(5)</a> table. This setting has a lower precedence
> > ! than a content filter that is specified with an <a href="access.5.html">access(5)</a> table or
> > ! in a <a href="header_checks.5.html">header_checks(5)</a> or <a href="header_checks.5.html">body_checks(5)</a> table.
> > ! </p>
> >
> > ***************
> > *** 1622,1656 ****
> >
> > - <DT><b><a name="daemon_table_open_error_is_fatal">daemon_table_open_error_is_fatal</a>
> > - (default: no)</b></DT><DD>
> > -
> > - <p> How a Postfix daemon process handles errors while opening lookup
> > - tables: gradual degradation or immediate termination. </p>
> > -
> > - <dl>
> > -
> > - <dt> <b> no </b> (default) </dt> <dd> <p> Gradual degradation: a
> > - daemon process logs a message of type "error" and continues execution
> > - with reduced functionality. Features that do not depend on the
> > - unavailable table will work normally, while features that depend
> > - on the table will result in a type "warning" message. <br> When
> > - the <a href="postconf.5.html#notify_classes">notify_classes</a> parameter value contains the "data" class, the
> > - Postfix SMTP server and client will report transcripts of sessions
> > - with an error because a table is unavailable. </p> </dd>
> > -
> > - <dt> <b> yes </b> (historical behavior) </dt> <dd> <p> Immediate
> > - termination: a daemon process logs a type "fatal" message and
> > - terminates immediately. This option reduces the number of possible
> > - code paths through Postfix, and may therefore be slightly more
> > - secure than the default. </p> </dd>
> > -
> > - </dl>
> > -
> > - <p> For the sake of sanity, the number of type "error" messages is
> > - limited to 13 over the lifetime of a daemon process. </p>
> > -
> > - <p> This feature is available in Postfix 2.9 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="daemon_timeout">daemon_timeout</a>
> > --- 1506,1507 ----
> > ***************
> > *** 1711,1713 ****
> > <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = 127.0.0.1
> > ! <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = example.com
> > </pre>
> > --- 1562,1564 ----
> > <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = 127.0.0.1
> > ! <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = some.domain
> > </pre>
> > ***************
> > *** 1960,1962 ****
> >
> > ! <p> Use <a href="postconf.5.html#transport_destination_concurrency_negative_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
> > to specify a transport-specific override, where <i>transport</i>
> > --- 1811,1813 ----
> >
> > ! <p> Use <a href="postconf.5.html#transport_destination_concurrency_positive_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
> > to specify a transport-specific override, where <i>transport</i>
> > ***************
> > *** 2033,2036 ****
> > <p> NOTE: the delay is enforced by the queue manager. The delay
> > ! timer state does not survive "<b>postfix reload</b>" or "<b>postfix
> > ! stop</b>".
> > </p>
> > --- 1884,1886 ----
> > <p> NOTE: the delay is enforced by the queue manager. The delay
> > ! timer state does not survive "postfix reload" or "postfix stop".
> > </p>
> > ***************
> > *** 2042,2048 ****
> >
> > - <p> NOTE: with a non-zero _destination_rate_delay, specify a
> > - <a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a> of 10
> > - or more to prevent Postfix from deferring all mail for the same
> > - destination after only one connection or handshake error. </p>
> > -
> > <p> This feature is available in Postfix 2.5 and later. </p>
> > --- 1892,1893 ----
> > ***************
> > *** 2093,2109 ****
> >
> > - <DT><b><a name="default_filter_nexthop">default_filter_nexthop</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> When a <a href="postconf.5.html#content_filter">content_filter</a> or FILTER request specifies no explicit
> > - next-hop destination, use $<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> instead; when
> > - that value is empty, use the domain in the recipient address.
> > - Specify "<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> = $<a href="postconf.5.html#myhostname">myhostname</a>" for compatibility
> > - with Postfix version 2.6 and earlier, or specify an explicit next-hop
> > - destination with each <a href="postconf.5.html#content_filter">content_filter</a> value or FILTER action. </p>
> > -
> > - <p> This feature is available in Postfix 2.7 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="default_minimum_delivery_slots">default_minimum_delivery_slots</a>
> > --- 1938,1939 ----
> > ***************
> > *** 2156,2158 ****
> > <p>
> > ! The default Postfix SMTP server response template for a request that is
> > rejected by an RBL-based restriction. This template can be overruled
> > --- 1986,1988 ----
> > <p>
> > ! The default SMTP server response template for a request that is
> > rejected by an RBL-based restriction. This template can be overruled
> > ***************
> > *** 2346,2356 ****
> > $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
> > ! or $<a href="postconf.5.html#relay_domains">relay_domains</a>. This information can be overruled with the
> > ! <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> parameter and with the
> > ! <a href="transport.5.html">transport(5)</a> table. </p>
> > !
> > ! <p>
> > ! In order of decreasing precedence, the nexthop destination is taken
> > ! from $<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>, $<a href="postconf.5.html#default_transport">default_transport</a>,
> > $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or from the recipient
> > ! domain.
> > </p>
> > --- 2176,2182 ----
> > $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
> > ! or $<a href="postconf.5.html#relay_domains">relay_domains</a>. In order of decreasing precedence, the nexthop
> > ! destination is taken from $<a href="postconf.5.html#default_transport">default_transport</a>,
> > $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or from the recipient
> > ! domain. This information can be overruled with the <a href="transport.5.html">transport(5)</a>
> > ! table.
> > </p>
> > ***************
> > *** 2360,2363 ****
> > is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
> > ! The <i>:nexthop</i> destination is optional; its syntax is documented
> > ! in the manual page of the corresponding delivery agent.
> > </p>
> > --- 2186,2189 ----
> > is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
> > ! The <i>:nexthop</i> part is optional. For more details see the
> > ! <a href="transport.5.html">transport(5)</a> manual page.
> > </p>
> > ***************
> > *** 2462,2464 ****
> >
> > ! <li> c = time in connection setup, including DNS, EHLO and STARTTLS
> >
> > --- 2288,2290 ----
> >
> > ! <li> c = time in connection setup, including DNS, EHLO and TLS
> >
> > ***************
> > *** 2651,2673 ****
> >
> > - <DT><b><a name="dnsblog_reply_delay">dnsblog_reply_delay</a>
> > - (default: 0s)</b></DT><DD>
> > -
> > - <p> A debugging aid to artifically delay DNS responses. </p>
> > -
> > - <p> This feature is available in Postfix 2.8. </p>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="dnsblog_service_name">dnsblog_service_name</a>
> > - (default: dnsblog)</b></DT><DD>
> > -
> > - <p> The name of the <a href="dnsblog.8.html">dnsblog(8)</a> service entry in <a href="master.5.html">master.cf</a>. This
> > - service performs DNS white/blacklist lookups. </p>
> > -
> > - <p> This feature is available in Postfix 2.8 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="dont_remove">dont_remove</a>
> > --- 2477,2478 ----
> > ***************
> > *** 2704,2716 ****
> >
> > - <DT><b><a name="empty_address_default_transport_maps_lookup_key">empty_address_default_transport_maps_lookup_key</a>
> > - (default: <>)</b></DT><DD>
> > -
> > - <p> The <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> search string that
> > - will be used instead of the null sender address. </p>
> > -
> > - <p> This feature is available in Postfix 2.7 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="empty_address_recipient">empty_address_recipient</a>
> > --- 2509,2510 ----
> > ***************
> > *** 2752,2839 ****
> >
> > - <DT><b><a name="enable_long_queue_ids">enable_long_queue_ids</a>
> > - (default: no)</b></DT><DD>
> > -
> > - <p> Enable long, non-repeating, queue IDs (queue file names). The
> > - benefit of non-repeating names is simpler logfile analysis and
> > - easier queue migration (there is no need to run "postsuper" to
> > - change queue file names that don't match their message file inode
> > - number). </p>
> > -
> > - <p> Note: see below for how to prepare long queue file names
> > - for migration to Postfix ≤ 2.8. </p>
> > -
> > - <p> Changing the parameter value to "yes" has the following effects:
> > - </p>
> > -
> > - <ul>
> > -
> > - <li> <p> Existing queue file names are not affected. </p>
> > -
> > - <li> <p> New queue files are created with names such as 3Pt2mN2VXxznjll.
> > - These are encoded in a 52-character alphabet that contains digits
> > - (0-9), upper-case letters (B-Z) and lower-case letters (b-z). For
> > - safety reasons the vowels (AEIOUaeiou) are excluded from the alphabet.
> > - The name format is: 6 or more characters for the time in seconds,
> > - 4 characters for the time in microseconds, the 'z'; the remainder
> > - is the file inode number encoded in the first 51 characters of the
> > - 52-character alphabet. </p>
> > -
> > - <li> <p> New messages have a Message-ID header with
> > - <i>queueID</i>@<i><a href="postconf.5.html#myhostname">myhostname</a></i>. </p>
> > -
> > - <li> <p> The mailq (postqueue -p) output has a wider Queue ID column.
> > - The number of whitespace-separated fields is not changed. <p>
> > -
> > - <li> <p> The <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> algorithm uses the first characters
> > - of the queue file creation time in microseconds, after conversion
> > - into hexadecimal representation. This produces the same queue hashing
> > - behavior as if the queue file name was created with "<a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>
> > - = no". </p>
> > -
> > - </ul>
> > -
> > - <p> Changing the parameter value to "no" has the following effects:
> > - </p>
> > -
> > - <ul>
> > -
> > - <li> <p> Existing long queue file names are renamed to the short
> > - form (while running "postfix reload" or "postsuper"). </p>
> > -
> > - <li> <p> New queue files are created with names such as C3CD21F3E90
> > - from a hexadecimal alphabet that contains digits (0-9) and upper-case
> > - letters (A-F). The name format is: 5 characters for the time in
> > - microseconds; the remainder is the file inode number. </p>
> > -
> > - <li> <p> New messages have a Message-ID header with
> > - <i>YYYYMMDDHHMMSS.queueid</i>@<i><a href="postconf.5.html#myhostname">myhostname</a></i>, where
> > - <i>YYYYMMDDHHMMSS</i> are the year, month, day, hour, minute and
> > - second.
> > -
> > - <li> <p> The mailq (postqueue -p) output has the same format as
> > - with Postfix ≤ 2.8. <p>
> > -
> > - <li> <p> The <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> algorithm uses the first characters
> > - of the queue file name, with the hexadecimal representation of the
> > - file creation time in microseconds. </p>
> > -
> > - </ul>
> > -
> > - <p> Before migration to Postfix ≤ 2.8, the following commands
> > - are required to convert long queue file names into short names: </p>
> > -
> > - <pre>
> > - # postfix stop
> > - # postconf <a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>=no
> > - # postsuper
> > - </pre>
> > -
> > - <p> Repeat the postsuper command until it reports no more queue file
> > - name changes. </p>
> > -
> > - <p> This feature is available in Postfix 2.9 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="enable_original_recipient">enable_original_recipient</a>
> > --- 2546,2547 ----
> > ***************
> > *** 3254,3267 ****
> > The number of subdirectory levels for queue directories listed with
> > ! the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> parameter. Queue hashing is implemented by
> > ! creating one or more levels of directories with one-character names.
> > ! Originally, these directory names were equal to the first characters
> > ! of the queue file name, with the hexadecimal representation of the
> > ! file creation time in microseconds. </p>
> > !
> > ! <p> With long queue file names, queue hashing produces the same
> > ! results as with short names. The file creation time in microseconds
> > ! is converted into hexadecimal form before the result is used for
> > ! queue hashing. The base 16 encoding gives finer control over the
> > ! number of subdirectories than is possible with the base 52 encoding
> > ! of long queue file names. </p>
> >
> > --- 2962,2965 ----
> > The number of subdirectory levels for queue directories listed with
> > ! the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> parameter.
> > ! </p>
> >
> > ***************
> > *** 3460,3462 ****
> > <p>
> > ! With the default 100 Postfix SMTP server process limit, "<a href="postconf.5.html#in_flow_delay">in_flow_delay</a>
> > = 1s" limits the mail inflow to 100 messages per second above the
> > --- 3158,3160 ----
> > <p>
> > ! With the default 100 SMTP server process limit, "<a href="postconf.5.html#in_flow_delay">in_flow_delay</a>
> > = 1s" limits the mail inflow to 100 messages per second above the
> > ***************
> > *** 3497,3500 ****
> > "inside" and "outside" interfaces, this can prevent each instance from
> > ! being able to reach remote SMTP servers on the "other side" of the
> > ! firewall. Setting
> > <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> to 0.0.0.0 avoids the potential problem for
> > --- 3195,3197 ----
> > "inside" and "outside" interfaces, this can prevent each instance from
> > ! being able to reach servers on the "other side" of the firewall. Setting
> > <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> to 0.0.0.0 avoids the potential problem for
> > ***************
> > *** 3536,3538 ****
> > <DT><b><a name="inet_protocols">inet_protocols</a>
> > ! (default: all)</b></DT><DD>
> >
> > --- 3233,3235 ----
> > <DT><b><a name="inet_protocols">inet_protocols</a>
> > ! (default: ipv4)</b></DT><DD>
> >
> > ***************
> > *** 3544,3552 ****
> >
> > - <p> With Postfix 2.8 and earlier the default is "ipv4". For backwards
> > - compatibility with these releases, the Postfix 2.9 and later upgrade
> > - procedure appends an explicit "<a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4" setting to
> > - <a href="postconf.5.html">main.cf</a> when no explicit setting is present. This compatibility
> > - workaround will be phased out as IPv6 deployment becomes more common.
> > - </p>
> > -
> > <p> This feature is available in Postfix 2.2 and later. </p>
> > --- 3241,3242 ----
> > ***************
> > *** 3564,3566 ****
> > <p> When IPv4 support is enabled via the <a href="postconf.5.html#inet_protocols">inet_protocols</a> parameter,
> > ! Postfix will look up DNS type A records, and will convert
> > IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original
> > --- 3254,3256 ----
> > <p> When IPv4 support is enabled via the <a href="postconf.5.html#inet_protocols">inet_protocols</a> parameter,
> > ! Postfix will to DNS type A record lookups, and will convert
> > IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original
> > ***************
> > *** 3581,3584 ****
> > <pre>
> > ! <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4
> > ! <a href="postconf.5.html#inet_protocols">inet_protocols</a> = all (DEFAULT)
> > <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv6
> > --- 3271,3274 ----
> > <pre>
> > ! <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4 (DEFAULT)
> > ! <a href="postconf.5.html#inet_protocols">inet_protocols</a> = all
> > <a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv6
> > ***************
> > *** 3659,3663 ****
> > The time after which a client closes an idle internal communication
> > ! channel. The purpose is to allow Postfix daemon processes to
> > ! terminate voluntarily after they become idle. This is used, for
> > ! example, by the Postfix address resolving and rewriting clients.
> > </p>
> > --- 3349,3353 ----
> > The time after which a client closes an idle internal communication
> > ! channel. The purpose is to allow servers to terminate voluntarily
> > ! after they become idle. This is used, for example, by the address
> > ! resolving and rewriting clients.
> > </p>
> > ***************
> > *** 3697,3702 ****
> > The time after which a client closes an active internal communication
> > ! channel. The purpose is to allow Postfix daemon processes to
> > ! terminate voluntarily
> > after reaching their client limit. This is used, for example, by
> > ! the Postfix address resolving and rewriting clients.
> > </p>
> > --- 3387,3391 ----
> > The time after which a client closes an active internal communication
> > ! channel. The purpose is to allow servers to terminate voluntarily
> > after reaching their client limit. This is used, for example, by
> > ! the address resolving and rewriting clients.
> > </p>
> > ***************
> > *** 3724,3749 ****
> >
> > - <DT><b><a name="lmtp_address_preference">lmtp_address_preference</a>
> > - (default: ipv6)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a>
> > - configuration parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.8 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="lmtp_assume_final">lmtp_assume_final</a>
> > - (default: no)</b></DT><DD>
> > -
> > - <p> When a remote LMTP server announces no DSN support, assume that
> > - the
> > - server performs final delivery, and send "delivered" delivery status
> > - notifications instead of "relayed". The default setting is backwards
> > - compatible to avoid the infinetisimal possibility of breaking
> > - existing LMTP-based content filters. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_bind_address">lmtp_bind_address</a>
> > --- 3413,3414 ----
> > ***************
> > *** 3770,3782 ****
> >
> > - <DT><b><a name="lmtp_body_checks">lmtp_body_checks</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_body_checks">smtp_body_checks</a> configuration
> > - parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.5 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_cache_connection">lmtp_cache_connection</a>
> > --- 3435,3436 ----
> > ***************
> > *** 3790,3800 ****
> >
> > - <p> This parameter is available in Postfix version 2.2 and earlier.
> > - With Postfix version 2.3 and later, see <a href="postconf.5.html#lmtp_connection_cache_on_demand">lmtp_connection_cache_on_demand</a>,
> > - <a href="postconf.5.html#lmtp_connection_cache_destinations">lmtp_connection_cache_destinations</a>, or <a href="postconf.5.html#lmtp_connection_reuse_time_limit">lmtp_connection_reuse_time_limit</a>.
> > - </p>
> > -
> > <p>
> > The effectiveness of cached connections will be determined by the
> > ! number of remote LMTP servers in use, and the concurrency limit specified
> > ! for the Postfix LMTP client. Cached connections are closed under any of
> > the following conditions:
> > --- 3444,3449 ----
> >
> > <p>
> > The effectiveness of cached connections will be determined by the
> > ! number of LMTP servers in use, and the concurrency limit specified
> > ! for the LMTP client. Cached connections are closed under any of
> > the following conditions:
> > ***************
> > *** 3804,3806 ****
> >
> > ! <li> The Postfix LMTP client idle time limit is reached. This limit is
> > specified with the Postfix <a href="postconf.5.html#max_idle">max_idle</a> configuration parameter.
> > --- 3453,3455 ----
> >
> > ! <li> The LMTP client idle time limit is reached. This limit is
> > specified with the Postfix <a href="postconf.5.html#max_idle">max_idle</a> configuration parameter.
> > ***************
> > *** 3814,3816 ****
> >
> > ! <li> Upon the onset of another delivery request, the remote LMTP server
> > associated with the current session does not respond to the RSET
> > --- 3463,3465 ----
> >
> > ! <li> Upon the onset of another delivery request, the LMTP server
> > associated with the current session does not respond to the RSET
> > ***************
> > *** 3821,3823 ****
> > <p>
> > ! Most of these limitations have been with the Postfix
> > a connection cache that is shared among multiple LMTP client
> > --- 3470,3472 ----
> > <p>
> > ! Most of these limitations will be removed after Postfix implements
> > a connection cache that is shared among multiple LMTP client
> > ***************
> > *** 3843,3845 ****
> >
> > ! <p> The Postfix LMTP client time limit for completing a TCP connection, or
> > zero (use the operating system built-in time limit). When no
> > --- 3492,3494 ----
> >
> > ! <p> The LMTP client time limit for completing a TCP connection, or
> > zero (use the operating system built-in time limit). When no
> > ***************
> > *** 3912,3917 ****
> >
> > ! <p> The Postfix LMTP client time limit for sending the LMTP ".",
> > ! and for receiving the remote LMTP server response. When no response
> > ! is received within the deadline, a warning is logged that the mail
> > ! may be delivered multiple times. </p>
> >
> > --- 3561,3566 ----
> >
> > ! <p> The LMTP client time limit for sending the LMTP ".", and for
> > ! receiving the server response. When no response is received within
> > ! the deadline, a warning is logged that the mail may be delivered
> > ! multiple times. </p>
> >
> > ***************
> > *** 3929,3933 ****
> > <p>
> > ! The Postfix LMTP client time limit for sending the LMTP DATA command,
> > ! and
> > ! for receiving the remote LMTP server response.
> > </p>
> > --- 3578,3581 ----
> > <p>
> > ! The LMTP client time limit for sending the LMTP DATA command, and
> > ! for receiving the server response.
> > </p>
> > ***************
> > *** 3946,3949 ****
> > <p>
> > ! The Postfix LMTP client time limit for sending the LMTP message
> > ! content.
> > When the connection stalls for more than $<a href="postconf.5.html#lmtp_data_xfer_timeout">lmtp_data_xfer_timeout</a>
> > --- 3594,3596 ----
> > <p>
> > ! The LMTP client time limit for sending the LMTP message content.
> > When the connection stalls for more than $<a href="postconf.5.html#lmtp_data_xfer_timeout">lmtp_data_xfer_timeout</a>
> > ***************
> > *** 4002,4005 ****
> > case insensitive lists of LHLO keywords (pipelining, starttls,
> > ! auth, etc.) that the Postfix LMTP client will ignore in the LHLO
> > ! response
> > from a remote LMTP server. See <a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> for
> > --- 3649,3651 ----
> > case insensitive lists of LHLO keywords (pipelining, starttls,
> > ! auth, etc.) that the LMTP client will ignore in the LHLO response
> > from a remote LMTP server. See <a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> for
> > ***************
> > *** 4017,4020 ****
> > <p> A case insensitive list of LHLO keywords (pipelining, starttls,
> > ! auth, etc.) that the Postfix LMTP client will ignore in the LHLO
> > ! response
> > from a remote LMTP server. </p>
> > --- 3663,3665 ----
> > <p> A case insensitive list of LHLO keywords (pipelining, starttls,
> > ! auth, etc.) that the LMTP client will ignore in the LHLO response
> > from a remote LMTP server. </p>
> > ***************
> > *** 4038,4050 ****
> >
> > - <DT><b><a name="lmtp_dns_resolver_options">lmtp_dns_resolver_options</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_dns_resolver_options">smtp_dns_resolver_options</a>
> > - configuration parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.8 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_enforce_tls">lmtp_enforce_tls</a>
> > --- 3683,3684 ----
> > ***************
> > *** 4071,4083 ****
> >
> > - <DT><b><a name="lmtp_header_checks">lmtp_header_checks</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_header_checks">smtp_header_checks</a> configuration
> > - parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.5 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_host_lookup">lmtp_host_lookup</a>
> > --- 3705,3706 ----
> > ***************
> > *** 4114,4116 ****
> > /etc/postfix/<a href="master.5.html">master.cf</a>:
> > ! mylmtp ... lmtp -o <a href="postconf.5.html#lmtp_lhlo_name">lmtp_lhlo_name</a>=foo.bar.com
> > </pre>
> > --- 3737,3739 ----
> > /etc/postfix/<a href="master.5.html">master.cf</a>:
> > ! mylmtp ... lmtp -o <a href="postconf.5.html#lmtp_lhloname">lmtp_lhlo_name</a>=foo.bar.com
> > </pre>
> > ***************
> > *** 4128,4131 ****
> >
> > ! <p> The Postfix LMTP client time limit for sending the LHLO command,
> > ! and for receiving the initial remote LMTP server response. </p>
> >
> > --- 3751,3754 ----
> >
> > ! <p> The LMTP client time limit for sending the LHLO command, and
> > ! for receiving the initial server response. </p>
> >
> > ***************
> > *** 4152,4155 ****
> > <p>
> > ! The Postfix LMTP client time limit for sending the MAIL FROM command,
> > ! and for receiving the remote LMTP server response.
> > </p>
> > --- 3775,3778 ----
> > <p>
> > ! The LMTP client time limit for sending the MAIL FROM command, and
> > ! for receiving the server response.
> > </p>
> > ***************
> > *** 4164,4176 ****
> >
> > - <DT><b><a name="lmtp_mime_header_checks">lmtp_mime_header_checks</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_mime_header_checks">smtp_mime_header_checks</a>
> > - configuration parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.5 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_mx_address_limit">lmtp_mx_address_limit</a>
> > --- 3787,3788 ----
> > ***************
> > *** 4197,4220 ****
> >
> > - <DT><b><a name="lmtp_nested_header_checks">lmtp_nested_header_checks</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_nested_header_checks">smtp_nested_header_checks</a>
> > - configuration parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.5 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="lmtp_per_record_deadline">lmtp_per_record_deadline</a>
> > - (default: no)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a>
> > - configuration parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.9 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_pix_workaround_delay_time">lmtp_pix_workaround_delay_time</a>
> > --- 3809,3810 ----
> > ***************
> > *** 4267,4270 ****
> > <p>
> > ! The Postfix LMTP client time limit for sending the QUIT command,
> > ! and for receiving the remote LMTP server response.
> > </p>
> > --- 3857,3860 ----
> > <p>
> > ! The LMTP client time limit for sending the QUIT command, and for
> > ! receiving the server response.
> > </p>
> > ***************
> > *** 4305,4308 ****
> > <p>
> > ! The Postfix LMTP client time limit for sending the RCPT TO command,
> > ! and for receiving the remote LMTP server response.
> > </p>
> > --- 3895,3898 ----
> > <p>
> > ! The LMTP client time limit for sending the RCPT TO command, and
> > ! for receiving the server response.
> > </p>
> > ***************
> > *** 4317,4329 ****
> >
> > - <DT><b><a name="lmtp_reply_filter">lmtp_reply_filter</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a>
> > - configuration parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.7 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_rset_timeout">lmtp_rset_timeout</a>
> > --- 3907,3908 ----
> > ***************
> > *** 4331,4335 ****
> >
> > ! <p> The Postfix LMTP client time limit for sending the RSET command,
> > ! and for receiving the remote LMTP server response. The LMTP client
> > ! sends RSET in
> > order to finish a recipient address probe, or to verify that a
> > --- 3910,3913 ----
> >
> > ! <p> The LMTP client time limit for sending the RSET command, and
> > ! for receiving the server response. The LMTP client sends RSET in
> > order to finish a recipient address probe, or to verify that a
> > ***************
> > *** 4403,4405 ****
> > <p>
> > ! Optional Postfix LMTP client lookup tables with one username:password entry
> > per host or domain. If a remote host or domain has no username:password
> > --- 3981,3983 ----
> > <p>
> > ! Optional LMTP client lookup tables with one username:password entry
> > per host or domain. If a remote host or domain has no username:password
> > ***************
> > *** 4503,4515 ****
> >
> > - <DT><b><a name="lmtp_send_dummy_mail_auth">lmtp_send_dummy_mail_auth</a>
> > - (default: no)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a>
> > - configuration parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.9 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_send_xforward_command">lmtp_send_xforward_command</a>
> > --- 4081,4082 ----
> > ***************
> > *** 4518,4520 ****
> > <p>
> > ! Send an XFORWARD command to the remote LMTP server when the LMTP LHLO
> > server response announces XFORWARD support. This allows an <a href="lmtp.8.html">lmtp(8)</a>
> > --- 4085,4087 ----
> > <p>
> > ! Send an XFORWARD command to the LMTP server when the LMTP LHLO
> > server response announces XFORWARD support. This allows an <a href="lmtp.8.html">lmtp(8)</a>
> > ***************
> > *** 4609,4621 ****
> >
> > - <DT><b><a name="lmtp_tls_block_early_mail_reply">lmtp_tls_block_early_mail_reply</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_block_early_mail_reply">smtp_tls_block_early_mail_reply</a>
> > - configuration parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.7 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_tls_cert_file">lmtp_tls_cert_file</a>
> > --- 4176,4177 ----
> > ***************
> > *** 4631,4643 ****
> >
> > - <DT><b><a name="lmtp_tls_ciphers">lmtp_tls_ciphers</a>
> > - (default: export)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> configuration
> > - parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_tls_dcert_file">lmtp_tls_dcert_file</a>
> > --- 4187,4188 ----
> > ***************
> > *** 4664,4673 ****
> >
> > ! <DT><b><a name="lmtp_tls_eccert_file">lmtp_tls_eccert_file</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> configuration
> > ! parameter. See there for details. </p>
> >
> > ! <p> This feature is available in Postfix 2.6 and later, when Postfix is
> > ! compiled and linked with OpenSSL 1.0.0 or later. </p>
> >
> > --- 4209,4217 ----
> >
> > ! <DT><b><a name="lmtp_tls_enforce_peername">lmtp_tls_enforce_peername</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
> > ! configuration parameter. See there for details. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 4676,4707 ****
> >
> > ! <DT><b><a name="lmtp_tls_eckey_file">lmtp_tls_eckey_file</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> configuration
> > ! parameter. See there for details. </p>
> >
> > ! <p> This feature is available in Postfix 2.6 and later, when Postfix is
> > ! compiled and linked with OpenSSL 1.0.0 or later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="lmtp_tls_enforce_peername">lmtp_tls_enforce_peername</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
> > ! configuration parameter. See there for details. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="lmtp_tls_exclude_ciphers">lmtp_tls_exclude_ciphers</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
> > ! configuration parameter. See there for details. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > --- 4220,4228 ----
> >
> > ! <DT><b><a name="lmtp_tls_exclude_ciphers">lmtp_tls_exclude_ciphers</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
> > ! configuration parameter. See there for details. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 4820,4832 ****
> >
> > - <DT><b><a name="lmtp_tls_protocols">lmtp_tls_protocols</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> configuration
> > - parameter. See there for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="lmtp_tls_scert_verifydepth">lmtp_tls_scert_verifydepth</a>
> > --- 4341,4342 ----
> > ***************
> > *** 4912,4915 ****
> > <p>
> > ! The Postfix LMTP client time limit for sending the XFORWARD command,
> > ! and for receiving the remote LMTP server response.
> > </p>
> > --- 4422,4425 ----
> > <p>
> > ! The LMTP client time limit for sending the XFORWARD command, and
> > ! for receiving the server response.
> > </p>
> > ***************
> > *** 4939,4943 ****
> > By default, non-Postfix commands are executed directly; commands
> > ! are given to given to the default shell (typically, /bin/sh) only
> > ! when they contain shell meta characters or shell built-in commands.
> > ! </p>
> >
> > --- 4449,4452 ----
> > By default, non-Postfix commands are executed directly; commands
> > ! are given to given to /bin/sh only when they contain shell meta
> > ! characters or shell built-in commands. </p>
> >
> > ***************
> > *** 4957,4959 ****
> > <a href="postconf.5.html#local_command_shell">local_command_shell</a> = /some/where/smrsh -c
> > - <a href="postconf.5.html#local_command_shell">local_command_shell</a> = /bin/bash -c
> > </pre>
> > --- 4466,4467 ----
> > ***************
> > *** 5038,5041 ****
> > <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
> > ! remote SMTP client TLS certificate fingerprint or public key fingerprint
> > ! (Postfix 2.9 and later) is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
> > The fingerprint digest algorithm is configurable via the
> > --- 4546,4548 ----
> > <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
> > ! client TLS certificate fingerprint is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
> > The fingerprint digest algorithm is configurable via the
> > ***************
> > *** 5047,5049 ****
> > <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
> > ! remote SMTP client TLS certificate is successfully verified, regardless of
> > whether it is listed on the server, and regardless of the certifying
> > --- 4554,4556 ----
> > <dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
> > ! client TLS certificate is successfully verified, regardless of
> > whether it is listed on the server, and regardless of the certifying
> > ***************
> > *** 5070,5072 ****
> > <pre>
> > ! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all
> > </pre>
> > --- 4577,4579 ----
> > <pre>
> > ! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all
> > </pre>
> > ***************
> > *** 5178,5181 ****
> > is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
> > ! The <i>:nexthop</i> destination is optional; its syntax is documented
> > ! in the manual page of the corresponding delivery agent.
> > </p>
> > --- 4685,4688 ----
> > is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
> > ! The <i>:nexthop</i> part is optional. For more details see the
> > ! <a href="transport.5.html">transport(5)</a> manual page.
> > </p>
> > ***************
> > *** 5626,5629 ****
> > client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>,
> > ! <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a>, <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or
> > ! <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction.
> > </p>
> > --- 5133,5135 ----
> > client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>,
> > ! <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction.
> > </p>
> > ***************
> > *** 5715,5717 ****
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
> >
> > --- 5221,5223 ----
> > <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
> >
> > ***************
> > *** 5763,5797 ****
> >
> > - <DT><b><a name="master_service_disable">master_service_disable</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> Selectively disable <a href="master.8.html">master(8)</a> listener ports by service type
> > - or by service name and type. Specify a list of service types
> > - ("inet", "unix", "fifo", or "pass") or "name.type" tuples, where
> > - "name" is the first field of a <a href="master.5.html">master.cf</a> entry and "type" is a
> > - service type. As with other Postfix matchlists, a search stops at
> > - the first match. Specify "!pattern" to exclude a service from the
> > - list. By default, all <a href="master.8.html">master(8)</a> listener ports are enabled. </p>
> > -
> > - <p> Note: this feature does not support "/file/name" or "<a href="DATABASE_README.html">type:table</a>"
> > - patterns, nor does it support wildcards such as "*" or "all". This
> > - is intentional. </p>
> > -
> > - <p> Examples: </p>
> > -
> > - <pre>
> > - # Turn on all <a href="master.8.html">master(8)</a> listener ports (the default).
> > - <a href="postconf.5.html#master_service_disable">master_service_disable</a> =
> > - # Turn off only the main SMTP listener port.
> > - <a href="postconf.5.html#master_service_disable">master_service_disable</a> = smtp.inet
> > - # Turn off all TCP/IP listener ports.
> > - <a href="postconf.5.html#master_service_disable">master_service_disable</a> = inet
> > - # Turn off all TCP/IP listener ports except "foo".
> > - <a href="postconf.5.html#master_service_disable">master_service_disable</a> = !foo.inet, inet
> > - </pre>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="max_idle">max_idle</a>
> > --- 5269,5270 ----
> > ***************
> > *** 5874,5882 ****
> >
> > - <p> Note 1: this feature does not recognize text that requires MIME
> > - decoding. It inspects raw message content, just like <a href="postconf.5.html#header_checks">header_checks</a>
> > - and <a href="postconf.5.html#body_checks">body_checks</a>. </p>
> > -
> > - <p> Note 2: this feature is disabled with "<a href="postconf.5.html#receive_override_options">receive_override_options</a>
> > - = <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>". </p>
> > -
> > <p> Example: </p>
> > --- 5347,5348 ----
> > ***************
> > *** 5915,5923 ****
> >
> > - <p> Note 1: this feature does not recognize text that requires MIME
> > - decoding. It inspects raw message content, just like <a href="postconf.5.html#header_checks">header_checks</a>
> > - and <a href="postconf.5.html#body_checks">body_checks</a>. </p>
> > -
> > - <p> Note 2: this feature is disabled with "<a href="postconf.5.html#receive_override_options">receive_override_options</a>
> > - = <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>". </p>
> > -
> > <p> Example: </p>
> > --- 5381,5382 ----
> > ***************
> > *** 5951,5953 ****
> > <DT><b><a name="milter_connect_macros">milter_connect_macros</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > --- 5410,5412 ----
> > <DT><b><a name="milter_connect_macros">milter_connect_macros</a>
> > ! (default: see postconf -n output)</b></DT><DD>
> >
> > ***************
> > *** 5997,5999 ****
> > <DT><b><a name="milter_data_macros">milter_data_macros</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > --- 5456,5458 ----
> > <DT><b><a name="milter_data_macros">milter_data_macros</a>
> > ! (default: see postconf -n output)</b></DT><DD>
> >
> > ***************
> > *** 6025,6029 ****
> >
> > - <dt>quarantine</dt> <dd>Like "accept", but freeze the message in
> > - the "<a href="QSHAPE_README.html#hold_queue">hold" queue</a>. Available with Postfix 2.6 and later. </dd>
> > -
> > </dl>
> > --- 5484,5485 ----
> > ***************
> > *** 6036,6038 ****
> > <DT><b><a name="milter_end_of_data_macros">milter_end_of_data_macros</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > --- 5492,5494 ----
> > <DT><b><a name="milter_end_of_data_macros">milter_end_of_data_macros</a>
> > ! (default: see postconf -n output)</b></DT><DD>
> >
> > ***************
> > *** 6048,6050 ****
> > <DT><b><a name="milter_end_of_header_macros">milter_end_of_header_macros</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > --- 5504,5506 ----
> > <DT><b><a name="milter_end_of_header_macros">milter_end_of_header_macros</a>
> > ! (default: see postconf -n output)</b></DT><DD>
> >
> > ***************
> > *** 6059,6094 ****
> >
> > - <DT><b><a name="milter_header_checks">milter_header_checks</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> Optional lookup tables for content inspection of message headers
> > - that are produced by Milter applications. See the <a href="header_checks.5.html">header_checks(5)</a>
> > - manual page available actions. Currently, PREPEND is not implemented.
> > - </p>
> > -
> > - <p> The following example sends all mail that is marked as SPAM to
> > - a spam handling machine. Note that matches are case-insensitive
> > - by default. </p>
> > -
> > - <pre>
> > - /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > - <a href="postconf.5.html#milter_header_checks">milter_header_checks</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/<a href="postconf.5.html#milter_header_checks">milter_header_checks</a>
> > - </pre>
> > -
> > - <pre>
> > - /etc/postfix/<a href="postconf.5.html#milter_header_checks">milter_header_checks</a>:
> > - /^X-SPAM-FLAG:\s+YES/ FILTER mysmtp:sanitizer.example.com:25
> > - </pre>
> > -
> > - <p> The <a href="postconf.5.html#milter_header_checks">milter_header_checks</a> mechanism could also be used for
> > - whitelisting. For example it could be used to skip heavy content
> > - inspection for DKIM-signed mail from known friendly domains. </p>
> > -
> > - <p> This feature is available in Postfix 2.7, and as an optional
> > - patch for Postfix 2.6. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="milter_helo_macros">milter_helo_macros</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > --- 5515,5518 ----
> >
> > <DT><b><a name="milter_helo_macros">milter_helo_macros</a>
> > ! (default: see postconf -n output)</b></DT><DD>
> >
> > ***************
> > *** 6129,6131 ****
> > <DT><b><a name="milter_mail_macros">milter_mail_macros</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > --- 5553,5555 ----
> > <DT><b><a name="milter_mail_macros">milter_mail_macros</a>
> > ! (default: see postconf -n output)</b></DT><DD>
> >
> > ***************
> > *** 6141,6147 ****
> > <DT><b><a name="milter_protocol">milter_protocol</a>
> > ! (default: 6)</b></DT><DD>
> >
> > <p> The mail filter protocol version and optional protocol extensions
> > ! for communication with a Milter application; prior to Postfix 2.6
> > ! the default protocol is 2. Postfix
> > sends this version number during the initial protocol handshake.
> > --- 5565,5570 ----
> > <DT><b><a name="milter_protocol">milter_protocol</a>
> > ! (default: 2)</b></DT><DD>
> >
> > <p> The mail filter protocol version and optional protocol extensions
> > ! for communication with a Milter (mail filter) application. Postfix
> > sends this version number during the initial protocol handshake.
> > ***************
> > *** 6155,6158 ****
> > <dt>2</dt> <dd>Use Sendmail 8 mail filter protocol version 2 (default
> > ! with Sendmail version 8.11 .. 8.13 and Postfix version 2.3 ..
> > ! 2.5).</dd>
> >
> > --- 5578,5580 ----
> > <dt>2</dt> <dd>Use Sendmail 8 mail filter protocol version 2 (default
> > ! as of Sendmail version 8.11).</dd>
> >
> > ***************
> > *** 6163,6165 ****
> > <dt>6</dt> <dd>Use Sendmail 8 mail filter protocol version 6 (default
> > ! with Sendmail version 8.14 and Postfix version 2.6).</dd>
> >
> > --- 5585,5587 ----
> > <dt>6</dt> <dd>Use Sendmail 8 mail filter protocol version 6 (default
> > ! as of Sendmail version 8.14).</dd>
> >
> > ***************
> > *** 6182,6184 ****
> > <DT><b><a name="milter_rcpt_macros">milter_rcpt_macros</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > --- 5604,5606 ----
> > <DT><b><a name="milter_rcpt_macros">milter_rcpt_macros</a>
> > ! (default: see postconf -n output)</b></DT><DD>
> >
> > ***************
> > *** 6194,6196 ****
> > <DT><b><a name="milter_unknown_command_macros">milter_unknown_command_macros</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > --- 5616,5618 ----
> > <DT><b><a name="milter_unknown_command_macros">milter_unknown_command_macros</a>
> > ! (default: see postconf -n output)</b></DT><DD>
> >
> > ***************
> > *** 6275,6361 ****
> >
> > - <DT><b><a name="multi_instance_directories">multi_instance_directories</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> An optional list of non-default Postfix configuration directories;
> > - these directories belong to additional Postfix instances that share
> > - the Postfix executable files and documentation with the default
> > - Postfix instance, and that are started, stopped, etc., together
> > - with the default Postfix instance. Specify a list of pathnames
> > - separated by comma or whitespace. </p>
> > -
> > - <p> When $<a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> is empty, the <a href="postfix.1.html">postfix(1)</a> command
> > - runs in single-instance mode and operates on a single Postfix
> > - instance only. Otherwise, the <a href="postfix.1.html">postfix(1)</a> command runs in multi-instance
> > - mode and invokes the multi-instance manager specified with the
> > - <a href="postconf.5.html#multi_instance_wrapper">multi_instance_wrapper</a> parameter. The multi-instance manager in
> > - turn executes <a href="postfix.1.html">postfix(1)</a> commands for the default instance and for
> > - all Postfix instances in $<a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>. </p>
> > -
> > - <p> Currently, this parameter setting is ignored except for the
> > - default <a href="postconf.5.html">main.cf</a> file. </p>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="multi_instance_enable">multi_instance_enable</a>
> > - (default: no)</b></DT><DD>
> > -
> > - <p> Allow this Postfix instance to be started, stopped, etc., by a
> > - multi-instance manager. By default, new instances are created in
> > - a safe state that prevents them from being started inadvertently.
> > - This parameter is reserved for the multi-instance manager. </p>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="multi_instance_group">multi_instance_group</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The optional instance group name of this Postfix instance. A
> > - group identifies closely-related Postfix instances that the
> > - multi-instance manager can start, stop, etc., as a unit. This
> > - parameter is reserved for the multi-instance manager. </p>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="multi_instance_name">multi_instance_name</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The optional instance name of this Postfix instance. This name
> > - becomes also the default value for the <a href="postconf.5.html#syslog_name">syslog_name</a> parameter. </p>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="multi_instance_wrapper">multi_instance_wrapper</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> The pathname of a multi-instance manager command that the
> > - <a href="postfix.1.html">postfix(1)</a> command invokes when the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>
> > - parameter value is non-empty. The pathname may be followed by
> > - initial command arguments separated by whitespace; shell
> > - metacharacters such as quotes are not supported in this context.
> > - </p>
> > -
> > - <p> The <a href="postfix.1.html">postfix(1)</a> command invokes the manager command with the
> > - <a href="postfix.1.html">postfix(1)</a> non-option command arguments on the manager command line,
> > - and with all installation configuration parameters exported into
> > - the manager command process environment. The manager command in
> > - turn invokes the <a href="postfix.1.html">postfix(1)</a> command for individual Postfix instances
> > - as "postfix -c <i><a href="postconf.5.html#config_directory">config_directory</a></i> <i>command</i>". </p>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a>
> > --- 5697,5698 ----
> > ***************
> > *** 6449,6452 ****
> > The internet domain name of this mail system. The default is to
> > ! use $<a href="postconf.5.html#myhostname">myhostname</a> minus the first component, or "localdomain" (Postfix
> > ! 2.3 and later). $<a href="postconf.5.html#mydomain">mydomain</a> is used as
> > a default value for many other configuration parameters.
> > --- 5786,5788 ----
> > The internet domain name of this mail system. The default is to
> > ! use $<a href="postconf.5.html#myhostname">myhostname</a> minus the first component. $<a href="postconf.5.html#mydomain">mydomain</a> is used as
> > a default value for many other configuration parameters.
> > ***************
> > *** 6470,6475 ****
> > The internet hostname of this mail system. The default is to use
> > ! the fully-qualified domain name (FQDN) from gethostname(), or to
> > ! use the non-FQDN result from gethostname() and append ".$<a href="postconf.5.html#mydomain">mydomain</a>".
> > ! $<a href="postconf.5.html#myhostname">myhostname</a> is used as a default value for many other configuration
> > ! parameters. </p>
> >
> > --- 5806,5810 ----
> > The internet hostname of this mail system. The default is to use
> > ! the fully-qualified domain name from gethostname(). $<a href="postconf.5.html#myhostname">myhostname</a> is
> > ! used as a default value for many other configuration parameters.
> > ! </p>
> >
> > ***************
> > *** 6480,6482 ****
> > <pre>
> > ! <a href="postconf.5.html#myhostname">myhostname</a> = host.example.com
> > </pre>
> > --- 5815,5817 ----
> > <pre>
> > ! <a href="postconf.5.html#myhostname">myhostname</a> = host.domain.tld
> > </pre>
> > ***************
> > *** 6490,6492 ****
> > <p>
> > ! The list of "trusted" remote SMTP clients that have more privileges than
> > "strangers".
> > --- 5825,5827 ----
> > <p>
> > ! The list of "trusted" SMTP clients that have more privileges than
> > "strangers".
> > ***************
> > *** 6559,6561 ****
> > <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" when Postfix
> > ! should "trust" remote SMTP clients in the same IP subnetworks as the local
> > machine. On Linux, this works correctly only with interfaces
> > --- 5894,5896 ----
> > <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" when Postfix
> > ! should "trust" SMTP clients in the same IP subnetworks as the local
> > machine. On Linux, this works correctly only with interfaces
> > ***************
> > *** 6564,6566 ****
> > <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = class" when Postfix should
> > ! "trust" remote SMTP clients in the same IP class A/B/C networks as the
> > local machine. Don't do this with a dialup site - it would cause
> > --- 5899,5901 ----
> > <li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = class" when Postfix should
> > ! "trust" SMTP clients in the same IP class A/B/C networks as the
> > local machine. Don't do this with a dialup site - it would cause
> > ***************
> > *** 6645,6648 ****
> > via the Postfix <a href="qmqpd.8.html">qmqpd(8)</a> server, and old mail that is re-injected
> > ! into the queue with "postsuper -r". Specify space or comma as
> > ! separator. See the <a href="MILTER_README.html">MILTER_README</a> document for details. </p>
> >
> > --- 5980,5983 ----
> > via the Postfix <a href="qmqpd.8.html">qmqpd(8)</a> server, and old mail that is re-injected
> > ! into the queue with "postsuper -r". See the <a href="MILTER_README.html">MILTER_README</a> document
> > ! for details. </p>
> >
> > ***************
> > *** 6688,6697 ****
> >
> > - <dt><b>data</b></dt>
> > -
> > - <dd>Send the postmaster a transcript of the SMTP session with an
> > - error because a critical data file was unavailable. The notification
> > - is sent to the address specified with the <a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a>
> > - configuration parameter (default: postmaster). <br> This feature
> > - is available in Postfix 2.9 and later. </dd>
> > -
> > <dt><b>delay</b></dt>
> > --- 6023,6024 ----
> > ***************
> > *** 6778,6781 ****
> > only domains whose primary MX hosts match the listed networks.
> > ! The parameter value syntax is the same as with the <a href="postconf.5.html#mynetworks">mynetworks</a>
> > ! parameter; note, however, that the default value is empty. </p>
> >
> > --- 6105,6107 ----
> > only domains whose primary MX hosts match the listed networks.
> > ! </p>
> >
> > ***************
> > *** 6812,6834 ****
> >
> > ! <DT><b><a name="postmulti_control_commands">postmulti_control_commands</a>
> > ! (default: reload flush)</b></DT><DD>
> > !
> > ! <p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager
> > ! treats as "control" commands, that operate on running instances. For
> > ! these commands, disabled instances are skipped. </p>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postmulti_start_commands">postmulti_start_commands</a>
> > ! (default: start)</b></DT><DD>
> >
> > ! <p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager treats
> > ! as "start" commands. For these commands, disabled instances are "checked"
> > ! rather than "started", and failure to "start" a member instance of an
> > ! instance group will abort the start-up of later instances. </p>
> >
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> >
> > --- 6138,6165 ----
> >
> > ! <DT><b><a name="prepend_delivered_header">prepend_delivered_header</a>
> > ! (default: command, file, forward)</b></DT><DD>
> >
> > + <p> The message delivery contexts where the Postfix <a href="local.8.html">local(8)</a> delivery
> > + agent prepends a Delivered-To: message header with the address
> > + that the mail was delivered to. This information is used for mail
> > + delivery loop detection. </p>
> >
> > ! <p>
> > ! By default, the Postfix local delivery agent prepends a Delivered-To:
> > ! header when forwarding mail and when delivering to file (mailbox)
> > ! and command. Turning off the Delivered-To: header when forwarding
> > ! mail is not recommended.
> > ! </p>
> >
> > ! <p>
> > ! Specify zero or more of <b>forward</b>, <b>file</b>, or <b>command</b>.
> > ! </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a> = forward
> > ! </pre>
> >
> > ***************
> > *** 6837,6846 ****
> >
> > ! <DT><b><a name="postmulti_stop_commands">postmulti_stop_commands</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> > !
> > ! <p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager treats
> > ! as "stop" commands. For these commands, disabled instances are skipped,
> > ! and enabled instances are processed in reverse order. </p>
> >
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> >
> > --- 6168,6175 ----
> >
> > ! <DT><b><a name="process_id">process_id</a>
> > ! (read-only)</b></DT><DD>
> >
> > ! <p>
> > ! The process ID of a Postfix command or daemon process.
> > ! </p>
> >
> > ***************
> > *** 6849,6945 ****
> >
> > ! <DT><b><a name="postscreen_access_list">postscreen_access_list</a>
> > ! (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>)</b></DT><DD>
> >
> > ! <p> Permanent white/blacklist for remote SMTP client IP addresses.
> > ! <a href="postscreen.8.html">postscreen(8)</a> searches this list immediately after a remote SMTP
> > ! client connects. Specify a comma- or whitespace-separated list of
> > ! commands (in upper or lower case) or lookup tables. The search stops
> > ! upon the first command that fires for the client IP address. </p>
> >
> > - <dl>
> >
> > ! <dt> <b> <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a> </b> </dt> <dd> Whitelist the client and
> > ! terminate the search if the client IP address matches $<a href="postconf.5.html#mynetworks">mynetworks</a>.
> > ! Do not subject the client to any before/after 220 greeting tests.
> > ! Pass the connection immediately to a Postfix SMTP server process.
> > ! </dd>
> >
> > ! <dt> <b> <a href="DATABASE_README.html">type:table</a> </b> </dt> <dd> Query the specified lookup
> > ! table. Each table lookup result is an access list, except that
> > ! access lists inside a table cannot specify <a href="DATABASE_README.html">type:table</a> entries. <br>
> > ! To discourage the use of hash, btree, etc. tables, there is no
> > ! support for substring matching like <a href="smtpd.8.html">smtpd(8)</a>. Use CIDR tables
> > ! instead. </dd>
> > !
> > ! <dt> <b> permit </b> </dt> <dd> Whitelist the client and terminate
> > ! the search. Do not subject the client to any before/after 220
> > ! greeting tests. Pass the connection immediately to a Postfix SMTP
> > ! server process. </dd>
> > !
> > ! <dt> <b> reject </b> </dt> <dd> Blacklist the client and terminate
> > ! the search. Subject the client to the action configured with the
> > ! <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> configuration parameter. </dd>
> > !
> > ! <dt> <b> dunno </b> </dt> <dd> All <a href="postscreen.8.html">postscreen(8)</a> access lists
> > ! implicitly have this command at the end. <br> When <b> dunno </b>
> > ! is executed inside a lookup table, return from the lookup table and
> > ! evaluate the next command. <br> When <b> dunno </b> is executed
> > ! outside a lookup table, terminate the search, and subject the client
> > ! to the configured before/after 220 greeting tests. </dd>
> >
> > ! </dl>
> >
> > - <p> Example: </p>
> >
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,
> > ! <a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr
> > ! <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> = enforce
> > ! </pre>
> >
> > ! <pre>
> > ! /etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>:
> > ! # Rules are evaluated in the order as specified.
> > ! # Blacklist 192.168.* except 192.168.0.1.
> > ! 192.168.0.1 dunno
> > ! 192.168.0.0/16 reject
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_bare_newline_action">postscreen_bare_newline_action</a>
> > ! (default: ignore)</b></DT><DD>
> >
> > ! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client sends
> > ! a bare newline character, that is, a newline not preceded by carriage
> > ! return. Specify one of the following: </p>
> >
> > ! <dl>
> >
> > - <dt> <b>ignore</b> </dt>
> >
> > ! <dd> Ignore the failure of this test. Allow other tests to complete.
> > ! Do <i>not</i> repeat this test before some the result from some
> > ! other test expires.
> > ! This option is useful for testing and collecting statistics
> > ! without blocking mail permanently. </dd>
> >
> > ! <dt> <b>enforce</b> </dt>
> >
> > ! <dd> Allow other tests to complete. Reject attempts to deliver mail
> > ! with a 550 SMTP reply, and log the helo/sender/recipient information.
> > ! Repeat this test the next time the client connects. </dd>
> >
> > ! <dt> <b>drop</b> </dt>
> >
> > ! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
> > ! this test the next time the client connects. </dd>
> >
> > ! </dl>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6178,6265 ----
> >
> > ! <DT><b><a name="process_id_directory">process_id_directory</a>
> > ! (default: pid)</b></DT><DD>
> >
> > ! <p>
> > ! The location of Postfix PID files relative to $<a href="postconf.5.html#queue_directory">queue_directory</a>.
> > ! This is a read-only parameter.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="process_name">process_name</a>
> > ! (read-only)</b></DT><DD>
> >
> > ! <p>
> > ! The process name of a Postfix command or daemon process.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="propagate_unmatched_extensions">propagate_unmatched_extensions</a>
> > ! (default: canonical, virtual)</b></DT><DD>
> >
> > ! <p>
> > ! What address lookup tables copy an address extension from the lookup
> > ! key to the lookup result.
> > ! </p>
> >
> > + <p>
> > + For example, with a <a href="virtual.5.html">virtual(5)</a> mapping of "<i>joe at example.com =>
> > + joe.user at example.net</i>", the address "<i>joe+foo at example.com</i>"
> > + would rewrite to "<i>joe.user+foo at example.net</i>".
> > + </p>
> >
> > ! <p>
> > ! Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>,
> > ! <b>forward</b>, <b>include</b> or <b>generic</b>. These cause
> > ! address extension
> > ! propagation with <a href="canonical.5.html">canonical(5)</a>, <a href="virtual.5.html">virtual(5)</a>, and <a href="aliases.5.html">aliases(5)</a> maps,
> > ! with <a href="local.8.html">local(8)</a> .forward and :include: file lookups, and with <a href="smtp.8.html">smtp(8)</a>
> > ! generic maps, respectively. </p>
> >
> > ! <p>
> > ! Note: enabling this feature for types other than <b>canonical</b>
> > ! and <b>virtual</b> is likely to cause problems when mail is forwarded
> > ! to other sites, especially with mail that is sent to a mailing list
> > ! exploder address.
> > ! </p>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual, alias,
> > ! forward, include
> > ! <a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual
> > ! </pre>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="proxy_interfaces">proxy_interfaces</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! The network interface addresses that this mail system receives mail
> > ! on by way of a proxy or network address translation unit.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > ! <p> You must specify your "outside" proxy/NAT addresses when your
> > ! system is a backup MX host for other domains, otherwise mail delivery
> > ! loops will happen when the primary MX host is down. </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> = 1.2.3.4
> > ! </pre>
> >
> > ***************
> > *** 6948,6959 ****
> >
> > ! <DT><b><a name="postscreen_bare_newline_enable">postscreen_bare_newline_enable</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Enable "bare newline" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
> > ! server. These tests are expensive: a remote SMTP client must
> > ! disconnect after
> > ! it passes the test, before it can talk to a real Postfix SMTP server.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6268,6281 ----
> >
> > ! <DT><b><a name="proxy_read_maps">proxy_read_maps</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p>
> > ! The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
> > ! access for the read-only service.
> > ! Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored.
> > </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > ***************
> > *** 6962,6978 ****
> >
> > ! <DT><b><a name="postscreen_bare_newline_ttl">postscreen_bare_newline_ttl</a>
> > ! (default: 30d)</b></DT><DD>
> > !
> > ! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
> > ! a successful "bare newline" SMTP protocol test. During this
> > ! time, the client IP address is excluded from this test. The default
> > ! is long because a remote SMTP client must disconnect after it passes
> > ! the test,
> > ! before it can talk to a real Postfix SMTP server. </p>
> >
> > ! <p> Specify a non-zero time value (an integral value plus an optional
> > ! one-letter suffix that specifies the time unit). Time units: s
> > ! (seconds), m (minutes), h (hours), d (days), w (weeks). </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6284,6296 ----
> >
> > ! <DT><b><a name="proxy_write_maps">proxy_write_maps</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p> The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
> > ! access for the read-write service. Postfix-owned local database
> > ! files should be stored under the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>.
> > ! Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored. </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.5 and later.
> > ! </p>
> >
> > ***************
> > *** 6981,7012 ****
> >
> > ! <DT><b><a name="postscreen_blacklist_action">postscreen_blacklist_action</a>
> > ! (default: ignore)</b></DT><DD>
> >
> > ! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client is
> > ! permanently blacklisted with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter.
> > ! Specify one of the following: </p>
> >
> > ! <dl>
> > !
> > ! <dt> <b>ignore</b> (default) </dt>
> > !
> > ! <dd> Ignore this result. Allow other tests to complete. Repeat
> > ! this test the next time the client connects.
> > ! This option is useful for testing and collecting statistics
> > ! without blocking mail. </dd>
> >
> > ! <dt> <b>enforce</b> </dt>
> >
> > - <dd> Allow other tests to complete. Reject attempts to deliver mail
> > - with a 550 SMTP reply, and log the helo/sender/recipient information.
> > - Repeat this test the next time the client connects. </dd>
> >
> > ! <dt> <b>drop</b> </dt>
> >
> > ! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
> > ! this test the next time the client connects. </dd>
> >
> > ! </dl>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6299,6332 ----
> >
> > ! <DT><b><a name="qmgr_clog_warn_time">qmgr_clog_warn_time</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p>
> > ! The minimal delay between warnings that a specific destination is
> > ! clogging up the Postfix <a href="QSHAPE_README.html#active_queue">active queue</a>. Specify 0 to disable.
> > ! </p>
> >
> > ! <p>
> > ! This feature is enabled with the <a href="postconf.5.html#helpful_warnings">helpful_warnings</a> parameter.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="qmgr_fudge_factor">qmgr_fudge_factor</a>
> > ! (default: 100)</b></DT><DD>
> >
> > ! <p>
> > ! Obsolete feature: the percentage of delivery resources that a busy
> > ! mail system will use up for delivery of a large mailing list
> > ! message.
> > ! </p>
> >
> > ! <p>
> > ! This feature exists only in the <a href="qmgr.8.html">oqmgr(8)</a> old queue manager. The
> > ! current queue manager solves the problem in a better way.
> > ! </p>
> >
> > ***************
> > *** 7015,7035 ****
> >
> > ! <DT><b><a name="postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a>
> > ! (default: 12h)</b></DT><DD>
> > !
> > ! <p> The amount of time between <a href="postscreen.8.html">postscreen(8)</a> cache cleanup runs.
> > ! Cache cleanup increases the load on the cache database and should
> > ! therefore not be run frequently. This feature requires that the
> > ! cache database supports the "delete" and "sequence" operators.
> > ! Specify a zero interval to disable cache cleanup. </p>
> > !
> > ! <p> After each cache cleanup run, the <a href="postscreen.8.html">postscreen(8)</a> daemon logs the
> > ! number of entries that were retained and dropped. A cleanup run is
> > ! logged as "partial" when the daemon terminates early after "<b>postfix
> > ! reload</b>", "<b>postfix stop</b>", or no requests for $<a href="postconf.5.html#max_idle">max_idle</a>
> > ! seconds. </p>
> > !
> > ! <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
> > ! (weeks). </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6335,6342 ----
> >
> > ! <DT><b><a name="qmgr_message_active_limit">qmgr_message_active_limit</a>
> > ! (default: 20000)</b></DT><DD>
> >
> > ! <p>
> > ! The maximal number of messages in the <a href="QSHAPE_README.html#active_queue">active queue</a>.
> > ! </p>
> >
> > ***************
> > *** 7038,7084 ****
> >
> > ! <DT><b><a name="postscreen_cache_map">postscreen_cache_map</a>
> > ! (default: btree:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache)</b></DT><DD>
> >
> > ! <p> Persistent storage for the <a href="postscreen.8.html">postscreen(8)</a> server decisions. </p>
> >
> > - <p> To share a <a href="postscreen.8.html">postscreen(8)</a> cache between multiple <a href="postscreen.8.html">postscreen(8)</a>
> > - instances, use "<a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="proxymap.8.html">proxy</a>:btree:/path/to/file".
> > - This requires Postfix version 2.9 or later; earlier <a href="proxymap.8.html">proxymap(8)</a>
> > - implementations don't support cache cleanup. For an alternative
> > - approach see the <a href="memcache_table.5.html">memcache_table(5)</a> manpage. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> >
> > ! </DD>
> >
> > - <DT><b><a name="postscreen_cache_retention_time">postscreen_cache_retention_time</a>
> > - (default: 7d)</b></DT><DD>
> >
> > ! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will cache an expired
> > ! temporary whitelist entry before it is removed. This prevents clients
> > ! from being logged as "NEW" just because their cache entry expired
> > ! an hour ago. It also prevents the cache from filling up with clients
> > ! that passed some deep protocol test once and never came back. </p>
> >
> > ! <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
> > ! (weeks). </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a>
> > ! (default: $<a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>)</b></DT><DD>
> >
> > ! <p> How many simultaneous connections any remote SMTP client is
> > ! allowed to have
> > ! with the <a href="postscreen.8.html">postscreen(8)</a> daemon. By default, this limit is the same
> > ! as with the Postfix SMTP server. Note that the triage process can
> > ! take several seconds, with the time spent in <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
> > ! delay, and with the time spent talking to the <a href="postscreen.8.html">postscreen(8)</a> built-in
> > ! dummy SMTP protocol engine. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6345,6404 ----
> >
> > ! <DT><b><a name="qmgr_message_recipient_limit">qmgr_message_recipient_limit</a>
> > ! (default: 20000)</b></DT><DD>
> >
> > ! <p> The maximal number of recipients held in memory by the Postfix
> > ! queue manager, and the maximal size of the size of the short-term,
> > ! in-memory "dead" destination status cache. </p>
> >
> >
> > ! </DD>
> >
> > + <DT><b><a name="qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a>
> > + (default: 10)</b></DT><DD>
> >
> > ! <p>
> > ! The minimal number of in-memory recipients for any message. This
> > ! takes priority over any other in-memory recipient limits (i.e.,
> > ! the global <a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> and the per transport
> > ! _recipient_limit) if necessary. The minimum value allowed for this
> > ! parameter is 1.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="qmqpd_authorized_clients">qmqpd_authorized_clients</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! What clients are allowed to connect to the QMQP server port.
> > ! </p>
> >
> > + <p>
> > + By default, no client is allowed to use the service. This is
> > + because the QMQP server will relay mail to any destination.
> > + </p>
> >
> > ! <p>
> > ! Specify a list of client patterns. A list pattern specifies a host
> > ! name, a domain name, an internet address, or a network/mask pattern,
> > ! where the mask specifies the number of bits in the network part.
> > ! When a pattern specifies a file name, its contents are substituted
> > ! for the file name; when a pattern is a "<a href="DATABASE_README.html">type:table</a>" table specification,
> > ! table lookup is used instead. </p>
> >
> > ! <p>
> > ! Patterns are separated by whitespace and/or commas. In order to
> > ! reverse the result, precede a pattern with an
> > ! exclamation point (!). The form "!/file/name" is supported only
> > ! in Postfix version 2.4 and later.
> > ! </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#qmqpd_authorized_clients">qmqpd_authorized_clients</a> = !192.168.0.1, 192.168.0.0/24
> > ! </pre>
> >
> > ***************
> > *** 7087,7098 ****
> >
> > ! <DT><b><a name="postscreen_command_count_limit">postscreen_command_count_limit</a>
> > ! (default: 20)</b></DT><DD>
> >
> > ! <p> The limit on the total number of commands per SMTP session for
> > ! <a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP protocol engine. This SMTP engine
> > ! defers or rejects all attempts to deliver mail, therefore there is
> > ! no need to enforce separate limits on the number of junk commands
> > ! and error commands. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6407,6416 ----
> >
> > ! <DT><b><a name="qmqpd_client_port_logging">qmqpd_client_port_logging</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Enable logging of the remote QMQP client port in addition to
> > ! the hostname and IP address. The logging format is "host[address]:port".
> > ! </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 7101,7109 ****
> >
> > ! <DT><b><a name="postscreen_command_filter">postscreen_command_filter</a>
> > ! (default: $<a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a>)</b></DT><DD>
> >
> > ! <p> A mechanism to transform commands from remote SMTP clients.
> > ! See <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 6419,6433 ----
> >
> > ! <DT><b><a name="qmqpd_error_delay">qmqpd_error_delay</a>
> > ! (default: 1s)</b></DT><DD>
> >
> > ! <p>
> > ! How long the QMQP server will pause before sending a negative reply
> > ! to the client. The purpose is to slow down confused or malicious
> > ! clients.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > ***************
> > *** 7112,7120 ****
> >
> > ! <DT><b><a name="postscreen_command_time_limit">postscreen_command_time_limit</a>
> > ! (default: ${stress?10}${stress:300}s)</b></DT><DD>
> >
> > ! <p> The time limit to read an entire command line with <a href="postscreen.8.html">postscreen(8)</a>'s
> > ! built-in SMTP protocol engine. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6436,6450 ----
> >
> > ! <DT><b><a name="qmqpd_timeout">qmqpd_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p>
> > ! The time limit for sending or receiving information over the network.
> > ! If a read or write operation blocks for more than $<a href="postconf.5.html#qmqpd_timeout">qmqpd_timeout</a>
> > ! seconds the QMQP server gives up and disconnects.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > ***************
> > *** 7123,7131 ****
> >
> > ! <DT><b><a name="postscreen_disable_vrfy_command">postscreen_disable_vrfy_command</a>
> > ! (default: $<a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a>)</b></DT><DD>
> > !
> > ! <p> Disable the SMTP VRFY command in the <a href="postscreen.8.html">postscreen(8)</a> daemon. See
> > ! <a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a> for details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6453,6461 ----
> >
> > ! <DT><b><a name="queue_directory">queue_directory</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p>
> > ! The location of the Postfix top-level queue directory. This is the
> > ! root directory of Postfix daemon processes that run chrooted.
> > ! </p>
> >
> > ***************
> > *** 7134,7145 ****
> >
> > ! <DT><b><a name="postscreen_discard_ehlo_keyword_address_maps">postscreen_discard_ehlo_keyword_address_maps</a>
> > ! (default: $<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>)</b></DT><DD>
> >
> > ! <p> Lookup tables, indexed by the remote SMTP client address, with
> > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
> > ! etc.) that the <a href="postscreen.8.html">postscreen(8)</a> server will not send in the EHLO response
> > ! to a remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
> > ! The table is not searched by hostname for robustness reasons. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 6464,6477 ----
> >
> > ! <DT><b><a name="queue_file_attribute_count_limit">queue_file_attribute_count_limit</a>
> > ! (default: 100)</b></DT><DD>
> >
> > ! <p>
> > ! The maximal number of (name=value) attributes that may be stored
> > ! in a Postfix queue file. The limit is enforced by the <a href="cleanup.8.html">cleanup(8)</a>
> > ! server.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > ***************
> > *** 7148,7193 ****
> >
> > ! <DT><b><a name="postscreen_discard_ehlo_keywords">postscreen_discard_ehlo_keywords</a>
> > ! (default: $<a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>)</b></DT><DD>
> > !
> > ! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
> > ! auth, etc.) that the <a href="postscreen.8.html">postscreen(8)</a> server will not send in the EHLO
> > ! response to a remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>
> > ! for details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> >
> > ! </DD>
> >
> > - <DT><b><a name="postscreen_dnsbl_action">postscreen_dnsbl_action</a>
> > - (default: ignore)</b></DT><DD>
> >
> > ! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client's combined
> > ! DNSBL score is equal to or greater than a threshold (as defined
> > ! with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> and <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>
> > ! parameters). Specify one of the following: </p>
> >
> > ! <dl>
> >
> > ! <dt> <b>ignore</b> (default) </dt>
> >
> > ! <dd> Ignore the failure of this test. Allow other tests to complete.
> > ! Repeat this test the next time the client connects.
> > ! This option is useful for testing and collecting statistics
> > ! without blocking mail. </dd>
> >
> > ! <dt> <b>enforce</b> </dt>
> >
> > - <dd> Allow other tests to complete. Reject attempts to deliver mail
> > - with a 550 SMTP reply, and log the helo/sender/recipient information.
> > - Repeat this test the next time the client connects. </dd>
> >
> > ! <dt> <b>drop</b> </dt>
> >
> > ! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
> > ! this test the next time the client connects. </dd>
> >
> > ! </dl>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6480,6535 ----
> >
> > ! <DT><b><a name="queue_minfree">queue_minfree</a>
> > ! (default: 0)</b></DT><DD>
> >
> > ! <p>
> > ! The minimal amount of free space in bytes in the queue file system
> > ! that is needed to receive mail. This is currently used by the SMTP
> > ! server to decide if it will accept any mail at all.
> > ! </p>
> >
> > + <p>
> > + By default, the Postfix version 2.1 SMTP server rejects MAIL FROM commands
> > + when the amount of free space is less than 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>.
> > + To specify a higher minimum free space limit, specify a <a href="postconf.5.html#queue_minfree">queue_minfree</a>
> > + value that is at least 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>.
> > + </p>
> >
> > ! <p>
> > ! With Postfix versions 2.0 and earlier, a <a href="postconf.5.html#queue_minfree">queue_minfree</a> value of
> > ! zero means there is no minimum required amount of free space.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="queue_run_delay">queue_run_delay</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p>
> > ! The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager;
> > ! prior to Postfix 2.4 the default value was 1000s.
> > ! </p>
> >
> > ! <p> This parameter should be set less than or equal to
> > ! $<a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a>. See also $<a href="postconf.5.html#maximal_backoff_time">maximal_backoff_time</a>. </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="queue_service_name">queue_service_name</a>
> > ! (default: qmgr)</b></DT><DD>
> >
> > ! <p>
> > ! The name of the <a href="qmgr.8.html">qmgr(8)</a> service. This service manages the Postfix
> > ! queue and schedules delivery requests.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > ***************
> > *** 7196,7224 ****
> >
> > ! <DT><b><a name="postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> A mapping from actual DNSBL domain name which includes a secret
> > ! password, to the DNSBL domain name that postscreen will reply with
> > ! when it rejects mail. When no mapping is found, the actual DNSBL
> > ! domain will be used. </p>
> >
> > ! <p> For maximal stability it is best to use a file that is read
> > ! into memory such as <a href="pcre_table.5.html">pcre</a>:, <a href="regexp_table.5.html">regexp</a>: or <a href="DATABASE_README.html#types">texthash</a>: (<a href="DATABASE_README.html#types">texthash</a>: is similar
> > ! to hash:, except a) there is no need to run <a href="postmap.1.html">postmap(1)</a> before the
> > ! file can be used, and b) <a href="DATABASE_README.html#types">texthash</a>: does not detect changes after
> > ! the file is read). </p>
> >
> > - <p> Example: </p>
> >
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply
> > ! </pre>
> >
> > ! <pre>
> > ! /etc/postfix/dnsbl_reply:
> > ! secret.zen.spamhaus.org zen.spamhaus.org
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6538,6564 ----
> >
> > ! <DT><b><a name="rbl_reply_maps">rbl_reply_maps</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional lookup tables with RBL response templates. The tables are
> > ! indexed by the RBL domain name. By default, Postfix uses the default
> > ! template as specified with the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> configuration
> > ! parameter. See there for a discussion of the syntax of RBL reply
> > ! templates.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="readme_directory">readme_directory</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p>
> > ! The location of Postfix README files that describe how to build,
> > ! configure or operate a specific Postfix subsystem or feature.
> > ! </p>
> >
> > ***************
> > *** 7227,7286 ****
> >
> > ! <DT><b><a name="postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p>Optional list of DNS white/blacklist domains, filters and weight
> > ! factors. When the list is non-empty, the <a href="dnsblog.8.html">dnsblog(8)</a> daemon will
> > ! query these domains with the IP addresses of remote SMTP clients,
> > ! and <a href="postscreen.8.html">postscreen(8)</a> will update an SMTP client's DNSBL score with
> > ! each non-error reply. </p>
> >
> > ! <p> Caution: when postscreen rejects mail, it replies with the DNSBL
> > ! domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to hide
> > ! "password" information in DNSBL domain names. </p>
> >
> > ! <p> When a client's score is equal to or greater than the threshold
> > ! specified with <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>, <a href="postscreen.8.html">postscreen(8)</a> can drop
> > ! the connection with the remote SMTP client. </p>
> >
> > ! <p> Specify a list of domain=filter*weight entries, separated by
> > ! comma or whitespace. </p>
> >
> > ! <ul>
> >
> > ! <li> <p> When no "=filter" is specified, <a href="postscreen.8.html">postscreen(8)</a> will use any
> > ! non-error DNSBL reply. Otherwise, <a href="postscreen.8.html">postscreen(8)</a> uses only DNSBL
> > ! replies that match the filter. The filter has the form d.d.d.d,
> > ! where each d is a number, or a pattern inside [] that contains one
> > ! or more ";"-separated numbers or number..number ranges. </p>
> > !
> > ! <li> <p> When no "*weight" is specified, <a href="postscreen.8.html">postscreen(8)</a> increments
> > ! the remote SMTP client's DNSBL score by 1. Otherwise, the weight must be
> > ! an integral number, and <a href="postscreen.8.html">postscreen(8)</a> adds the specified weight to
> > ! the remote SMTP client's DNSBL score. Specify a negative number for
> > ! whitelisting. </p>
> >
> > ! <li> <p> When one <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> entry produces multiple
> > ! DNSBL responses, <a href="postscreen.8.html">postscreen(8)</a> applies the weight at most once.
> > ! </p>
> >
> > ! </ul>
> >
> > ! <p> Examples: </p>
> >
> > ! <p> To use example.com as a high-confidence blocklist, and to
> > ! block mail with example.net and example.org only when both agree:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2
> > ! <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = example.com*2, example.net, example.org
> > ! </pre>
> >
> > ! <p> To filter only DNSBL replies containing 127.0.0.4: </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = example.com=127.0.0.4
> > </pre>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6567,6628 ----
> >
> > ! <DT><b><a name="receive_override_options">receive_override_options</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Enable or disable recipient validation, built-in content
> > ! filtering, or address mapping. Typically, these are specified in
> > ! <a href="master.5.html">master.cf</a> as command-line arguments for the <a href="smtpd.8.html">smtpd(8)</a>, <a href="qmqpd.8.html">qmqpd(8)</a> or
> > ! <a href="pickup.8.html">pickup(8)</a> daemons. </p>
> > !
> > ! <p> Specify zero or more of the following options. The options
> > ! override <a href="postconf.5.html">main.cf</a> settings and are either implemented by <a href="smtpd.8.html">smtpd(8)</a>,
> > ! <a href="qmqpd.8.html">qmqpd(8)</a>, or <a href="pickup.8.html">pickup(8)</a> themselves, or they are forwarded to the
> > ! cleanup server. </p>
> > !
> > ! <dl>
> >
> > ! <dt><b><a name="no_unknown_recipient_checks">no_unknown_recipient_checks</a></b></dt>
> >
> > ! <dd>Do not try to reject unknown recipients (SMTP server only).
> > ! This is typically specified AFTER an external content filter.
> > ! </dd>
> >
> > ! <dt><b><a name="no_address_mappings">no_address_mappings</a></b></dt>
> >
> > ! <dd>Disable canonical address mapping, virtual alias map expansion,
> > ! address masquerading, and automatic BCC (blind carbon-copy)
> > ! recipients. This is typically specified BEFORE an external content
> > ! filter. </dd>
> >
> > ! <dt><b><a name="no_header_body_checks">no_header_body_checks</a></b></dt>
> >
> > ! <dd>Disable header/body_checks. This is typically specified AFTER
> > ! an external content filter. </dd>
> >
> > ! <dt><b><a name="no_milters">no_milters</a></b></dt>
> >
> > ! <dd>Disable Milter (mail filter) applications. This is typically
> > ! specified AFTER an external content filter. </dd>
> >
> > ! </dl>
> >
> > ! <p>
> > ! Note: when the "BEFORE content filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a>
> > ! setting is specified in the <a href="postconf.5.html">main.cf</a> file, specify the "AFTER content
> > ! filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a> setting in <a href="master.5.html">master.cf</a> (and vice
> > ! versa).
> > ! </p>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#receive_override_options">receive_override_options</a> =
> > ! <a href="postconf.5.html#no_unknown_recipient_checks">no_unknown_recipient_checks</a>, <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>
> > ! <a href="postconf.5.html#receive_override_options">receive_override_options</a> = <a href="postconf.5.html#no_address_mappings">no_address_mappings</a>
> > </pre>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > ***************
> > *** 7289,7341 ****
> >
> > ! <DT><b><a name="postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>
> > ! (default: 1)</b></DT><DD>
> > !
> > ! <p> The inclusive lower bound for blocking a remote SMTP client, based on
> > ! its combined DNSBL score as defined with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
> > ! parameter. </p>
> > !
> > ! <p> This feature is available in Postfix 2.8. </p>
> > !
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_dnsbl_ttl">postscreen_dnsbl_ttl</a>
> > ! (default: 1h)</b></DT><DD>
> >
> > ! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
> > ! a successful DNS blocklist test. During this time, the client IP address
> > ! is excluded from this test. The default is relatively short, because a
> > ! good client can immediately talk to a real Postfix SMTP server.
> > </p>
> >
> > ! <p> Specify a non-zero time value (an integral value plus an optional
> > ! one-letter suffix that specifies the time unit). Time units: s
> > ! (seconds), m (minutes), h (hours), d (days), w (weeks). </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_enforce_tls">postscreen_enforce_tls</a>
> > ! (default: $<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b></DT><DD>
> >
> > ! <p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and
> > ! require that clients use TLS encryption. See smtpd_postscreen_enforce_tls
> > ! for details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later.
> > ! Preferably, use <a href="postconf.5.html#postscreen_tls_security_level">postscreen_tls_security_level</a> instead. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_expansion_filter">postscreen_expansion_filter</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p> List of characters that are permitted in <a href="postconf.5.html#postscreen_reject_footer">postscreen_reject_footer</a>
> > ! attribute expansions. See <a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> for further
> > ! details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 6631,6690 ----
> >
> > ! <DT><b><a name="recipient_bcc_maps">recipient_bcc_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional BCC (blind carbon-copy) address lookup tables, indexed by
> > ! recipient address. The BCC address (multiple results are not
> > ! supported) is added when mail enters from outside of Postfix.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > ! <p>
> > ! The table search order is as follows:
> > </p>
> >
> > ! <ul>
> >
> > ! <li> Look up the "user+extension at domain.tld" address including the
> > ! optional address extension.
> >
> > + <li> Look up the "user at domain.tld" address without the optional
> > + address extension.
> >
> > ! <li> Look up the "user+extension" address local part when the
> > ! recipient domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > ! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
> >
> > ! <li> Look up the "user" address local part when the recipient domain
> > ! equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
> >
> > ! <li> Look up the "@domain.tld" part.
> >
> > ! </ul>
> >
> > + <p>
> > + Specify the types and names of databases to use. After change,
> > + run "<b>postmap /etc/postfix/recipient_bcc</b>".
> > + </p>
> >
> > ! <p>
> > ! Note: if mail to the BCC address bounces it will be returned to
> > ! the sender.
> > ! </p>
> >
> > ! <p> Note: automatic BCC recipients are produced only for new mail.
> > ! To avoid mailer loops, automatic BCC recipients are not generated
> > ! for mail that Postfix forwards internally, nor for mail that Postfix
> > ! generates itself. </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#recipient_bcc_maps">recipient_bcc_maps</a> = hash:/etc/postfix/recipient_bcc
> > ! </pre>
> >
> > ***************
> > *** 7344,7354 ****
> >
> > ! <DT><b><a name="postscreen_forbidden_commands">postscreen_forbidden_commands</a>
> > ! (default: $<a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a>)</b></DT><DD>
> >
> > ! <p> List of commands that the <a href="postscreen.8.html">postscreen(8)</a> server considers in
> > ! violation of the SMTP protocol. See <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> for
> > ! syntax, and <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> for possible actions.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6693,6706 ----
> >
> > ! <DT><b><a name="recipient_canonical_classes">recipient_canonical_classes</a>
> > ! (default: envelope_recipient, header_recipient)</b></DT><DD>
> > !
> > ! <p> What addresses are subject to <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address
> > ! mapping. By default, <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address mapping is
> > ! applied to envelope recipient addresses, and to header recipient
> > ! addresses. </p>
> >
> > ! <p> Specify one or more of: envelope_recipient, header_recipient
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 7357,7391 ****
> >
> > ! <DT><b><a name="postscreen_greet_action">postscreen_greet_action</a>
> > ! (default: ignore)</b></DT><DD>
> > !
> > ! <p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client speaks
> > ! before its turn within the time specified with the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
> > ! parameter. Specify one of the following: </p>
> >
> > ! <dl>
> >
> > ! <dt> <b>ignore</b> (default) </dt>
> >
> > ! <dd> Ignore the failure of this test. Allow other tests to complete.
> > ! Repeat this test the next time the client connects.
> > ! This option is useful for testing and collecting statistics
> > ! without blocking mail. </dd>
> >
> > ! <dt> <b>enforce</b> </dt>
> >
> > - <dd> Allow other tests to complete. Reject attempts to deliver mail
> > - with a 550 SMTP reply, and log the helo/sender/recipient information.
> > - Repeat this test the next time the client connects. </dd>
> >
> > ! <dt> <b>drop</b> </dt>
> >
> > ! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
> > ! this test the next time the client connects. </dd>
> >
> > ! </dl>
> >
> > ! <p> In either case, <a href="postscreen.8.html">postscreen(8)</a> will not whitelist the remote SMTP client
> > ! IP address. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6709,6752 ----
> >
> > ! <DT><b><a name="recipient_canonical_maps">recipient_canonical_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional address mapping lookup tables for envelope and header
> > ! recipient addresses.
> > ! The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
> > ! </p>
> >
> > ! <p>
> > ! Note: $<a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
> > ! </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> = hash:/etc/postfix/recipient_canonical
> > ! </pre>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="recipient_delimiter">recipient_delimiter</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! The separator between user names and address extensions (user+foo).
> > ! See <a href="canonical.5.html">canonical(5)</a>, <a href="local.8.html">local(8)</a>, <a href="relocated.5.html">relocated(5)</a> and <a href="virtual.5.html">virtual(5)</a> for the
> > ! effects this has on aliases, canonical, virtual, relocated and
> > ! on .forward file lookups. Basically, the software tries user+foo
> > ! and .forward+foo before trying user and .forward.
> > ! </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> = +
> > ! </pre>
> >
> > ***************
> > *** 7394,7406 ****
> >
> > ! <DT><b><a name="postscreen_greet_banner">postscreen_greet_banner</a>
> > ! (default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>)</b></DT><DD>
> >
> > ! <p> The <i>text</i> in the optional "220-<i>text</i>..." server
> > ! response that
> > ! <a href="postscreen.8.html">postscreen(8)</a> sends ahead of the real Postfix SMTP server's "220
> > ! text..." response, in an attempt to confuse bad SMTP clients so
> > ! that they speak before their turn (pre-greet). Specify an empty
> > ! value to disable this feature. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6755,6767 ----
> >
> > ! <DT><b><a name="reject_code">reject_code</a>
> > ! (default: 554)</b></DT><DD>
> >
> > ! <p>
> > ! The numerical Postfix SMTP server response code when a remote SMTP
> > ! client request is rejected by the "reject" restriction.
> > ! </p>
> >
> > ! <p>
> > ! Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
> > ! </p>
> >
> > ***************
> > *** 7409,7442 ****
> >
> > ! <DT><b><a name="postscreen_greet_ttl">postscreen_greet_ttl</a>
> > ! (default: 1d)</b></DT><DD>
> > !
> > ! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
> > ! a successful PREGREET test. During this time, the client IP address
> > ! is excluded from this test. The default is relatively short, because
> > ! a good client can immediately talk to a real Postfix SMTP server. </p>
> > !
> > ! <p> Specify a non-zero time value (an integral value plus an optional
> > ! one-letter suffix that specifies the time unit). Time units: s
> > ! (seconds), m (minutes), h (hours), d (days), w (weeks). </p>
> > !
> > ! <p> This feature is available in Postfix 2.8. </p>
> > !
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_greet_wait">postscreen_greet_wait</a>
> > ! (default: ${stress?2}${stress:6}s)</b></DT><DD>
> >
> > ! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will wait for an SMTP
> > ! client to send a command before its turn, and for DNS blocklist
> > ! lookup results to arrive (default: up to 2 seconds under stress,
> > ! up to 6 seconds otherwise). <p>
> >
> > ! <p> Specify a non-zero time value (an integral value plus an optional
> > ! one-letter suffix that specifies the time unit). </p>
> >
> > ! <p> Time units: s (seconds), m (minutes), h (hours), d (days), w
> > ! (weeks). </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6770,6797 ----
> >
> > ! <DT><b><a name="relay_clientcerts">relay_clientcerts</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> List of tables with remote SMTP client-certificate fingerprints
> > ! for which the Postfix SMTP server will allow access with the
> > ! <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> feature.
> > ! The fingerprint digest algorithm is configurable via the
> > ! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
> > ! Postfix version 2.5). </p>
> >
> > ! <p> Postfix lookup tables are in the form of (key, value) pairs.
> > ! Since we only need the key, the value can be chosen freely, e.g.
> > ! the name of the user or host:
> > ! D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a> = hash:/etc/postfix/relay_clientcerts
> > ! </pre>
> >
> > ! <p>For more fine-grained control, use <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> to select
> > ! an appropriate <a href="access.5.html">access(5)</a> policy for each client.
> > ! See <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a>.</p>
> >
> > ! <p>This feature is available with Postfix version 2.2.</p>
> >
> > ***************
> > *** 7445,7453 ****
> >
> > ! <DT><b><a name="postscreen_helo_required">postscreen_helo_required</a>
> > ! (default: $<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a>)</b></DT><DD>
> >
> > ! <p> Require that a remote SMTP client sends HELO or EHLO before
> > ! commencing a MAIL transaction. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6800,6810 ----
> >
> > ! <DT><b><a name="relay_destination_concurrency_limit">relay_destination_concurrency_limit</a>
> > ! (default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
> >
> > ! <p> The maximal number of parallel deliveries to the same destination
> > ! via the relay message delivery transport. This limit is enforced
> > ! by the queue manager. The message delivery transport name is the
> > ! first field in the entry in the <a href="master.5.html">master.cf</a> file. </p>
> >
> > ! <p> This feature is available in Postfix 2.0 and later. </p>
> >
> > ***************
> > *** 7456,7502 ****
> >
> > ! <DT><b><a name="postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a>
> > ! (default: drop)</b></DT><DD>
> > !
> > ! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client sends
> > ! non-SMTP commands as specified with the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a>
> > ! parameter. Specify one of the following: </p>
> >
> > ! <dl>
> >
> > ! <dt> <b>ignore</b> </dt>
> >
> > ! <dd> Ignore the failure of this test. Allow other tests to complete.
> > ! Do <i>not</i> repeat this test before some the result from some
> > ! other test expires.
> > ! This option is useful for testing and collecting statistics
> > ! without blocking mail permanently. </dd>
> > !
> > ! <dt> <b>enforce</b> </dt>
> > !
> > ! <dd> Allow other tests to complete. Reject attempts to deliver mail
> > ! with a 550 SMTP reply, and log the helo/sender/recipient information.
> > ! Repeat this test the next time the client connects. </dd>
> > !
> > ! <dt> <b>drop</b> </dt>
> > !
> > ! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
> > ! this test the next time the client connects. This action is the
> > ! same as with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a>
> > ! feature. </dd>
> >
> > - </dl>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Enable "non-SMTP command" tests in the <a href="postscreen.8.html">postscreen(8)</a> server. These
> > ! tests are expensive: a client must disconnect after it passes the
> > ! test, before it can talk to a real Postfix SMTP server. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6813,6859 ----
> >
> > ! <DT><b><a name="relay_destination_recipient_limit">relay_destination_recipient_limit</a>
> > ! (default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
> >
> > ! <p> The maximal number of recipients per message for the relay
> > ! message delivery transport. This limit is enforced by the queue
> > ! manager. The message delivery transport name is the first field in
> > ! the entry in the <a href="master.5.html">master.cf</a> file. </p>
> >
> > ! <p> Setting this parameter to a value of 1 changes the meaning of
> > ! <a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> from concurrency per domain
> > ! into concurrency per recipient. </p>
> >
> > ! <p> This feature is available in Postfix 2.0 and later. </p>
> >
> >
> > ! </DD>
> >
> > + <DT><b><a name="relay_domains">relay_domains</a>
> > + (default: $<a href="postconf.5.html#mydestination">mydestination</a>)</b></DT><DD>
> >
> > ! <p> What destination domains (and subdomains thereof) this system
> > ! will relay mail to. Subdomain matching is controlled with the
> > ! <a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> parameter. For details about how
> > ! the <a href="postconf.5.html#relay_domains">relay_domains</a> value is used, see the description of the
> > ! <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> and <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> SMTP recipient
> > ! restrictions. </p>
> >
> > ! <p> Domains that match $<a href="postconf.5.html#relay_domains">relay_domains</a> are delivered with the
> > ! $<a href="postconf.5.html#relay_transport">relay_transport</a> mail delivery transport. The SMTP server validates
> > ! recipient addresses with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> and rejects non-existent
> > ! recipients. See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the
> > ! <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file. </p>
> >
> > ! <p> Note: Postfix will not automatically forward mail for domains
> > ! that list this system as their primary or backup MX host. See the
> > ! <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> restriction in the <a href="postconf.5.html">postconf(5)</a> manual page. </p>
> >
> > ! <p> Specify a list of host or domain names, "/file/name" patterns
> > ! or "<a href="DATABASE_README.html">type:table</a>" lookup tables, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace. A
> > ! "/file/name" pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>"
> > ! lookup table is matched when a (parent) domain appears as lookup
> > ! key. Specify "!pattern" to exclude a domain from the list. The form
> > ! "!/file/name" is supported only in Postfix version 2.4 and later.
> > ! </p>
> >
> > ***************
> > *** 7505,7520 ****
> >
> > ! <DT><b><a name="postscreen_non_smtp_command_ttl">postscreen_non_smtp_command_ttl</a>
> > ! (default: 30d)</b></DT><DD>
> > !
> > ! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
> > ! a successful "non_smtp_command" SMTP protocol test. During this
> > ! time, the client IP address is excluded from this test. The default
> > ! is long because a client must disconnect after it passes the test,
> > ! before it can talk to a real Postfix SMTP server. </p>
> >
> > ! <p> Specify a non-zero time value (an integral value plus an optional
> > ! one-letter suffix that specifies the time unit). Time units: s
> > ! (seconds), m (minutes), h (hours), d (days), w (weeks). </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6862,6875 ----
> >
> > ! <DT><b><a name="relay_domains_reject_code">relay_domains_reject_code</a>
> > ! (default: 554)</b></DT><DD>
> >
> > ! <p>
> > ! The numerical Postfix SMTP server response code when a client
> > ! request is rejected by the <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient
> > ! restriction.
> > ! </p>
> >
> > ! <p>
> > ! Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
> > ! </p>
> >
> > ***************
> > *** 7523,7569 ****
> >
> > ! <DT><b><a name="postscreen_pipelining_action">postscreen_pipelining_action</a>
> > ! (default: enforce)</b></DT><DD>
> > !
> > ! <p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client
> > ! sends
> > ! multiple commands instead of sending one command and waiting for
> > ! the server to respond. Specify one of the following: </p>
> > !
> > ! <dl>
> >
> > ! <dt> <b>ignore</b> </dt>
> >
> > ! <dd> Ignore the failure of this test. Allow other tests to complete.
> > ! Do <i>not</i> repeat this test before some the result from some
> > ! other test expires.
> > ! This option is useful for testing and collecting statistics
> > ! without blocking mail permanently. </dd>
> >
> > ! <dt> <b>enforce</b> </dt>
> >
> > ! <dd> Allow other tests to complete. Reject attempts to deliver mail
> > ! with a 550 SMTP reply, and log the helo/sender/recipient information.
> > ! Repeat this test the next time the client connects. </dd>
> >
> > ! <dt> <b>drop</b> </dt>
> >
> > ! <dd> Drop the connection immediately with a 521 SMTP reply. Repeat
> > ! this test the next time the client connects. </dd>
> >
> > - </dl>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_pipelining_enable">postscreen_pipelining_enable</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Enable "pipelining" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
> > ! server. These tests are expensive: a good client must disconnect
> > ! after it passes the test, before it can talk to a real Postfix SMTP
> > ! server. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6878,6944 ----
> >
> > ! <DT><b><a name="relay_recipient_maps">relay_recipient_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Optional lookup tables with all valid addresses in the domains
> > ! that match $<a href="postconf.5.html#relay_domains">relay_domains</a>. Specify @domain as a wild-card for
> > ! domains that have no valid recipient list, and become a source of
> > ! backscatter mail: Postfix accepts spam for non-existent recipients
> > ! and then floods innocent people with undeliverable mail. Technically,
> > ! tables
> > ! listed with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> are used as lists: Postfix needs
> > ! to know only if a lookup string is found or not, but it does not
> > ! use the result from table lookup. </p>
> >
> > ! <p>
> > ! If this parameter is non-empty, then the Postfix SMTP server will reject
> > ! mail to unknown relay users. This feature is off by default.
> > ! </p>
> >
> > ! <p>
> > ! See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
> > ! file.
> > ! </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> = hash:/etc/postfix/relay_recipients
> > ! </pre>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > + <DT><b><a name="relay_transport">relay_transport</a>
> > + (default: relay)</b></DT><DD>
> >
> > ! <p>
> > ! The default mail delivery transport and next-hop destination for
> > ! remote delivery to domains listed with $<a href="postconf.5.html#relay_domains">relay_domains</a>. In order of
> > ! decreasing precedence, the nexthop destination is taken from
> > ! $<a href="postconf.5.html#relay_transport">relay_transport</a>, $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or
> > ! from the recipient domain. This information can be overruled with
> > ! the <a href="transport.5.html">transport(5)</a> table.
> > ! </p>
> >
> > ! <p>
> > ! Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i>
> > ! is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
> > ! The <i>:nexthop</i> part is optional. For more details see the
> > ! <a href="transport.5.html">transport(5)</a> manual page.
> > ! </p>
> >
> > ! <p>
> > ! See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
> > ! file.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > ***************
> > *** 7572,7614 ****
> >
> > ! <DT><b><a name="postscreen_pipelining_ttl">postscreen_pipelining_ttl</a>
> > ! (default: 30d)</b></DT><DD>
> >
> > ! <p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will use the result from
> > ! a successful "pipelining" SMTP protocol test. During this time, the
> > ! client IP address is excluded from this test. The default is
> > ! long because a good client must disconnect after it passes the test,
> > ! before it can talk to a real Postfix SMTP server. </p>
> >
> > ! <p> Specify a non-zero time value (an integral value plus an optional
> > ! one-letter suffix that specifies the time unit). Time units: s
> > ! (seconds), m (minutes), h (hours), d (days), w (weeks). </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_post_queue_limit">postscreen_post_queue_limit</a>
> > ! (default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b></DT><DD>
> >
> > - <p> The number of clients that can be waiting for service from a
> > - real Postfix SMTP server process. When this queue is full, all
> > - clients will
> > - receive a 421 reponse. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_pre_queue_limit">postscreen_pre_queue_limit</a>
> > ! (default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b></DT><DD>
> >
> > ! <p> The number of non-whitelisted clients that can be waiting for
> > ! a decision whether they will receive service from a real Postfix
> > ! SMTP server
> > ! process. When this queue is full, all non-whitelisted clients will
> > ! receive a 421 reponse. </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 6947,7012 ----
> >
> > ! <DT><b><a name="relayhost">relayhost</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! The next-hop destination of non-local mail; overrides non-local
> > ! domains in recipient addresses. This information is overruled with
> > ! <a href="postconf.5.html#relay_transport">relay_transport</a>, <a href="postconf.5.html#default_transport">default_transport</a>, <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
> > ! and with the <a href="transport.5.html">transport(5)</a> table.
> > ! </p>
> >
> > ! <p>
> > ! On an intranet, specify the organizational domain name. If your
> > ! internal DNS uses no MX records, specify the name of the intranet
> > ! gateway host instead.
> > ! </p>
> >
> > ! <p>
> > ! In the case of SMTP, specify a domain name, hostname, hostname:port,
> > ! [hostname]:port, [hostaddress] or [hostaddress]:port. The form
> > ! [hostname] turns off MX lookups.
> > ! </p>
> >
> > + <p>
> > + If you're connected via UUCP, see the <a href="UUCP_README.html">UUCP_README</a> file for useful
> > + information.
> > + </p>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = [gateway.my.domain]
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = uucphost
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = [an.ip.add.ress]
> > ! </pre>
> >
> >
> > ! </DD>
> >
> > + <DT><b><a name="relocated_maps">relocated_maps</a>
> > + (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional lookup tables with new contact information for users or
> > ! domains that no longer exist. The table format and lookups are
> > ! documented in <a href="relocated.5.html">relocated(5)</a>.
> > ! </p>
> >
> > ! <p>
> > ! If you use this feature, run "<b>postmap /etc/postfix/relocated</b>" to
> > ! build the necessary DBM or DB file after change, then "<b>postfix
> > ! reload</b>" to make the changes visible.
> > ! </p>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#relocated_maps">relocated_maps</a> = dbm:/etc/postfix/relocated
> > ! <a href="postconf.5.html#relocated_maps">relocated_maps</a> = hash:/etc/postfix/relocated
> > ! </pre>
> >
> > ***************
> > *** 7617,7639 ****
> >
> > ! <DT><b><a name="postscreen_reject_footer">postscreen_reject_footer</a>
> > ! (default: $<a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a>)</b></DT><DD>
> > !
> > ! <p> Optional information that is appended after a 4XX or 5XX
> > ! <a href="postscreen.8.html">postscreen(8)</a> server
> > ! response. See <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="postscreen_tls_security_level">postscreen_tls_security_level</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b></DT><DD>
> >
> > ! <p> The SMTP TLS security level for the <a href="postscreen.8.html">postscreen(8)</a> server; when
> > ! a non-empty value is specified, this overrides the obsolete parameters
> > ! <a href="postconf.5.html#postscreen_use_tls">postscreen_use_tls</a> and <a href="postconf.5.html#postscreen_enforce_tls">postscreen_enforce_tls</a>. See <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>
> > ! for details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 7015,7045 ----
> >
> > ! <DT><b><a name="remote_header_rewrite_domain">remote_header_rewrite_domain</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Don't rewrite message headers from remote clients at all when
> > ! this parameter is empty; otherwise, rewrite message headers and
> > ! append the specified domain name to incomplete addresses. The
> > ! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> parameter controls what clients Postfix
> > ! considers local. </p>
> >
> > + <p> Examples: </p>
> >
> > ! <p> The safe setting: append "domain.invalid" to incomplete header
> > ! addresses from remote SMTP clients, so that those addresses cannot
> > ! be confused with local addresses. </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> = domain.invalid
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> The default, purist, setting: don't rewrite headers from remote
> > ! clients at all. </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> =
> > ! </pre>
> > ! </blockquote>
> >
> > ***************
> > *** 7642,7651 ****
> >
> > ! <DT><b><a name="postscreen_use_tls">postscreen_use_tls</a>
> > ! (default: $<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b></DT><DD>
> > !
> > ! <p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
> > ! but do not require that clients use TLS encryption. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later.
> > ! Preferably, use <a href="postconf.5.html#postscreen_tls_security_level">postscreen_tls_security_level</a> instead. </p>
> >
> > --- 7048,7058 ----
> >
> > ! <DT><b><a name="require_home_directory">require_home_directory</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Whether or not a <a href="local.8.html">local(8)</a> recipient's home directory must exist
> > ! before mail delivery is attempted. By default this test is disabled.
> > ! It can be useful for environments that import home directories to
> > ! the mail server (NOT RECOMMENDED).
> > ! </p>
> >
> > ***************
> > *** 7654,7671 ****
> >
> > ! <DT><b><a name="postscreen_watchdog_timeout">postscreen_watchdog_timeout</a>
> > ! (default: 10s)</b></DT><DD>
> >
> > ! <p> How much time a <a href="postscreen.8.html">postscreen(8)</a> process may take to respond to
> > ! a remote SMTP client command or to perform a cache operation before it
> > ! is terminated by a built-in watchdog timer. This is a safety
> > ! mechanism that prevents <a href="postscreen.8.html">postscreen(8)</a> from becoming non-responsive
> > ! due to a bug in Postfix itself or in system software. To avoid
> > ! false alarms and unnecessary cache corruption this limit cannot be
> > ! set under 10s. </p>
> >
> > ! <p> Specify a non-zero time value (an integral value plus an optional
> > ! one-letter suffix that specifies the time unit). Time units: s
> > ! (seconds), m (minutes), h (hours), d (days), w (weeks). </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 7061,7079 ----
> >
> > ! <DT><b><a name="resolve_dequoted_address">resolve_dequoted_address</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p> Resolve a recipient address safely instead of correctly, by
> > ! looking inside quotes. </p>
> >
> > ! <p> By default, the Postfix address resolver does not quote the
> > ! address localpart as per <a href="http://tools.ietf.org/html/rfc822">RFC 822</a>, so that additional @ or % or !
> > ! operators remain visible. This behavior is safe but it is also
> > ! technically incorrect. </p>
> >
> > ! <p> If you specify "<a href="postconf.5.html#resolve_dequoted_address">resolve_dequoted_address</a> = no", then
> > ! the Postfix
> > ! resolver will not know about additional @ etc. operators in the
> > ! address localpart. This opens opportunities for obscure mail relay
> > ! attacks with user at domain@domain addresses when Postfix provides
> > ! backup MX service for Sendmail systems. </p>
> >
> > ***************
> > *** 7674,7724 ****
> >
> > ! <DT><b><a name="postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a>
> > ! (default: <a href="DATABASE_README.html#types">static</a>:all)</b></DT><DD>
> >
> > ! <p> A list of local <a href="postscreen.8.html">postscreen(8)</a> server IP addresses where a
> > ! non-whitelisted remote SMTP client can obtain <a href="postscreen.8.html">postscreen(8)</a>'s temporary
> > ! whitelist status. This status is required before the client can
> > ! talk to a Postfix SMTP server process. By default, a client can
> > ! obtain <a href="postscreen.8.html">postscreen(8)</a>'s whitelist status on any local <a href="postscreen.8.html">postscreen(8)</a>
> > ! server IP address. </p>
> >
> > ! <p> When <a href="postscreen.8.html">postscreen(8)</a> listens on both primary and backup MX
> > ! addresses, the <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> parameter can be
> > ! configured to give the temporary whitelist status only when a client
> > ! connects to a primary MX address. Once a client is whitelisted it
> > ! can talk to a Postfix SMTP server on any address. Thus, clients
> > ! that connect only to backup MX addresses will never become whitelisted,
> > ! and will never be allowed to talk to a Postfix SMTP server process.
> > ! </p>
> >
> > ! <p> Example: </p>
> >
> > - <pre>
> > - /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > - # Don't whitelist connections to the backup IP address.
> > - <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> = !168.100.189.8, <a href="DATABASE_README.html#types">static</a>:all
> > - </pre>
> >
> > ! <p> This feature is available in Postfix 2.9 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="prepend_delivered_header">prepend_delivered_header</a>
> > ! (default: command, file, forward)</b></DT><DD>
> >
> > - <p> The message delivery contexts where the Postfix <a href="local.8.html">local(8)</a> delivery
> > - agent prepends a Delivered-To: message header with the address
> > - that the mail was delivered to. This information is used for mail
> > - delivery loop detection. </p>
> >
> > ! <p>
> > ! By default, the Postfix local delivery agent prepends a Delivered-To:
> > ! header when forwarding mail and when delivering to file (mailbox)
> > ! and command. Turning off the Delivered-To: header when forwarding
> > ! mail is not recommended.
> > ! </p>
> >
> > <p>
> > ! Specify zero or more of <b>forward</b>, <b>file</b>, or <b>command</b>.
> > </p>
> > --- 7082,7119 ----
> >
> > ! <DT><b><a name="resolve_null_domain">resolve_null_domain</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Resolve an address that ends in the "@" null domain as if the
> > ! local hostname were specified, instead of rejecting the address as
> > ! invalid. </p>
> >
> > ! <p> This feature is available in Postfix 2.1 and later.
> > ! Earlier versions always resolve the null domain as the local
> > ! hostname. </p>
> >
> > ! <p> The Postfix SMTP server uses this feature to reject mail from
> > ! or to addresses that end in the "@" null domain, and from addresses
> > ! that rewrite into a form that ends in the "@" null domain. </p>
> >
> >
> > ! </DD>
> >
> > + <DT><b><a name="resolve_numeric_domain">resolve_numeric_domain</a>
> > + (default: no)</b></DT><DD>
> >
> > ! <p> Resolve "user at ipaddress" as "user@[ipaddress]", instead of
> > ! rejecting the address as invalid. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later.
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="rewrite_service_name">rewrite_service_name</a>
> > ! (default: rewrite)</b></DT><DD>
> >
> > <p>
> > ! The name of the address rewriting service. This service rewrites
> > ! addresses to standard form and resolves them to a (delivery method,
> > ! next-hop host, recipient) triple.
> > </p>
> > ***************
> > *** 7726,7734 ****
> > <p>
> > ! Example:
> > </p>
> >
> > - <pre>
> > - <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a> = forward
> > - </pre>
> > -
> >
> > --- 7121,7125 ----
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > </p>
> >
> >
> > ***************
> > *** 7736,7742 ****
> >
> > ! <DT><b><a name="process_id">process_id</a>
> > ! (read-only)</b></DT><DD>
> >
> > <p>
> > ! The process ID of a Postfix command or daemon process.
> > </p>
> > --- 7127,7133 ----
> >
> > ! <DT><b><a name="sample_directory">sample_directory</a>
> > ! (default: /etc/postfix)</b></DT><DD>
> >
> > <p>
> > ! The name of the directory with example Postfix configuration files.
> > </p>
> > ***************
> > *** 7746,7755 ****
> >
> > ! <DT><b><a name="process_id_directory">process_id_directory</a>
> > ! (default: pid)</b></DT><DD>
> >
> > ! <p>
> > ! The location of Postfix PID files relative to $<a href="postconf.5.html#queue_directory">queue_directory</a>.
> > ! This is a read-only parameter.
> > </p>
> >
> >
> > --- 7137,7153 ----
> >
> > ! <DT><b><a name="send_cyrus_sasl_authzid">send_cyrus_sasl_authzid</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> When authenticating to a remote SMTP or LMTP server with the
> > ! default setting "no", send no SASL authoriZation ID (authzid); send
> > ! only the SASL authentiCation ID (authcid) plus the authcid's password.
> > </p>
> >
> > + <p> The non-default setting "yes" enables the behavior of older
> > + Postfix versions. These always send a SASL authzid that is equal
> > + to the SASL authcid, but this causes inter-operability problems
> > + with some SMTP servers. </p>
> > +
> > + <p> This feature is available in Postfix 2.4.4 and later. </p>
> > +
> >
> > ***************
> > *** 7757,7763 ****
> >
> > ! <DT><b><a name="process_name">process_name</a>
> > ! (read-only)</b></DT><DD>
> >
> > <p>
> > ! The process name of a Postfix command or daemon process.
> > </p>
> > --- 7155,7162 ----
> >
> > ! <DT><b><a name="sender_based_routing">sender_based_routing</a>
> > ! (default: no)</b></DT><DD>
> >
> > <p>
> > ! This parameter should not be used. It was replaced by <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
> > ! in Postfix version 2.3.
> > </p>
> > ***************
> > *** 7767,7774 ****
> >
> > ! <DT><b><a name="propagate_unmatched_extensions">propagate_unmatched_extensions</a>
> > ! (default: canonical, virtual)</b></DT><DD>
> >
> > <p>
> > ! What address lookup tables copy an address extension from the lookup
> > ! key to the lookup result.
> > </p>
> > --- 7166,7176 ----
> >
> > ! <DT><b><a name="sender_bcc_maps">sender_bcc_maps</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Optional BCC (blind carbon-copy) address lookup tables, indexed
> > ! by sender address. The BCC address (multiple results are not
> > ! supported) is added when mail enters from outside of Postfix. </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> > ***************
> > *** 7776,7816 ****
> > <p>
> > ! For example, with a <a href="virtual.5.html">virtual(5)</a> mapping of "<i>joe at example.com =>
> > ! joe.user at example.net</i>", the address "<i>joe+foo at example.com</i>"
> > ! would rewrite to "<i>joe.user+foo at example.net</i>".
> > </p>
> >
> > ! <p>
> > ! Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>,
> > ! <b>forward</b>, <b>include</b> or <b>generic</b>. These cause
> > ! address extension
> > ! propagation with <a href="canonical.5.html">canonical(5)</a>, <a href="virtual.5.html">virtual(5)</a>, and <a href="aliases.5.html">aliases(5)</a> maps,
> > ! with <a href="local.8.html">local(8)</a> .forward and :include: file lookups, and with <a href="smtp.8.html">smtp(8)</a>
> > ! generic maps, respectively. </p>
> >
> > ! <p>
> > ! Note: enabling this feature for types other than <b>canonical</b>
> > ! and <b>virtual</b> is likely to cause problems when mail is forwarded
> > ! to other sites, especially with mail that is sent to a mailing list
> > ! exploder address.
> > ! </p>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual, alias,
> > ! forward, include
> > ! <a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual
> > ! </pre>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="proxy_interfaces">proxy_interfaces</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! The network interface addresses that this mail system receives mail
> > ! on by way of a proxy or network address translation unit.
> > </p>
> > --- 7178,7204 ----
> > <p>
> > ! The table search order is as follows:
> > </p>
> >
> > ! <ul>
> >
> > ! <li> Look up the "user+extension at domain.tld" address including the
> > ! optional address extension.
> >
> > ! <li> Look up the "user at domain.tld" address without the optional
> > ! address extension.
> >
> > ! <li> Look up the "user+extension" address local part when the
> > ! sender domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > ! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
> >
> > + <li> Look up the "user" address local part when the sender domain
> > + equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
> >
> > ! <li> Look up the "@domain.tld" part.
> >
> > ! </ul>
> >
> > <p>
> > ! Specify the types and names of databases to use. After change,
> > ! run "<b>postmap /etc/postfix/sender_bcc</b>".
> > </p>
> > ***************
> > *** 7818,7825 ****
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > </p>
> >
> > ! <p> You must specify your "outside" proxy/NAT addresses when your
> > ! system is a backup MX host for other domains, otherwise mail delivery
> > ! loops will happen when the primary MX host is down. </p>
> >
> > --- 7206,7215 ----
> > <p>
> > ! Note: if mail to the BCC address bounces it will be returned to
> > ! the sender.
> > </p>
> >
> > ! <p> Note: automatic BCC recipients are produced only for new mail.
> > ! To avoid mailer loops, automatic BCC recipients are not generated
> > ! for mail that Postfix forwards internally, nor for mail that Postfix
> > ! generates itself. </p>
> >
> > ***************
> > *** 7830,7832 ****
> > <pre>
> > ! <a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> = 1.2.3.4
> > </pre>
> > --- 7220,7222 ----
> > <pre>
> > ! <a href="postconf.5.html#sender_bcc_maps">sender_bcc_maps</a> = hash:/etc/postfix/sender_bcc
> > </pre>
> > ***************
> > *** 7836,7875 ****
> >
> > ! <DT><b><a name="proxy_read_maps">proxy_read_maps</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p>
> > ! The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
> > ! access for the read-only service.
> > ! Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored.
> > </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > - </DD>
> >
> > ! <DT><b><a name="proxy_write_maps">proxy_write_maps</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p> The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
> > ! access for the read-write service. Postfix-owned local database
> > ! files should be stored under the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>.
> > ! Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored. </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.5 and later.
> > </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="proxymap_service_name">proxymap_service_name</a>
> > ! (default: proxymap)</b></DT><DD>
> >
> > ! <p> The name of the proxymap read-only table lookup service. This
> > ! service is normally implemented by the <a href="proxymap.8.html">proxymap(8)</a> daemon. </p>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> >
> > --- 7226,7268 ----
> >
> > ! <DT><b><a name="sender_canonical_classes">sender_canonical_classes</a>
> > ! (default: envelope_sender, header_sender)</b></DT><DD>
> >
> > ! <p> What addresses are subject to <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address
> > ! mapping. By default, <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address mapping is
> > ! applied to envelope sender addresses, and to header sender addresses.
> > </p>
> >
> > ! <p> Specify one or more of: envelope_sender, header_sender </p>
> >
> > + <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="sender_canonical_maps">sender_canonical_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional address mapping lookup tables for envelope and header
> > ! sender addresses.
> > ! The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
> > </p>
> >
> > + <p>
> > + Example: you want to rewrite the SENDER address "user at ugly.domain"
> > + to "user at pretty.domain", while still being able to send mail to
> > + the RECIPIENT address "user at ugly.domain".
> > + </p>
> >
> > ! <p>
> > ! Note: $<a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
> > ! </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> = hash:/etc/postfix/sender_canonical
> > ! </pre>
> >
> > ***************
> > *** 7878,7905 ****
> >
> > ! <DT><b><a name="proxywrite_service_name">proxywrite_service_name</a>
> > ! (default: proxywrite)</b></DT><DD>
> > !
> > ! <p> The name of the proxywrite read-write table lookup service.
> > ! This service is normally implemented by the <a href="proxymap.8.html">proxymap(8)</a> daemon.
> > ! </p>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> > !
> >
> > ! </DD>
> >
> > ! <DT><b><a name="qmgr_clog_warn_time">qmgr_clog_warn_time</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > <p>
> > ! The minimal delay between warnings that a specific destination is
> > ! clogging up the Postfix <a href="QSHAPE_README.html#active_queue">active queue</a>. Specify 0 to disable.
> > </p>
> >
> > ! <p>
> > ! This feature is enabled with the <a href="postconf.5.html#helpful_warnings">helpful_warnings</a> parameter.
> > ! </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > </p>
> > --- 7271,7297 ----
> >
> > ! <DT><b><a name="sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> A sender-dependent override for the global <a href="postconf.5.html#relayhost">relayhost</a> parameter
> > ! setting. The tables are searched by the envelope sender address and
> > ! @domain. This information is overruled with <a href="postconf.5.html#relay_transport">relay_transport</a>,
> > ! <a href="postconf.5.html#default_transport">default_transport</a> and with the <a href="transport.5.html">transport(5)</a> table. </p>
> >
> > ! <p> For safety reasons, this feature does not allow $number
> > ! substitutions in regular expression maps. </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.3 and later.
> > </p>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="sendmail_path">sendmail_path</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > <p>
> > ! A Sendmail compatibility feature that specifies the location of
> > ! the Postfix <a href="sendmail.1.html">sendmail(1)</a> command. This command can be used to
> > ! submit mail into the Postfix queue.
> > </p>
> > ***************
> > *** 7909,7915 ****
> >
> > ! <DT><b><a name="qmgr_daemon_timeout">qmgr_daemon_timeout</a>
> > ! (default: 1000s)</b></DT><DD>
> >
> > ! <p> How much time a Postfix queue manager process may take to handle
> > ! a request before it is terminated by a built-in watchdog timer.
> > </p>
> > --- 7301,7308 ----
> >
> > ! <DT><b><a name="service_throttle_time">service_throttle_time</a>
> > ! (default: 60s)</b></DT><DD>
> >
> > ! <p>
> > ! How long the Postfix <a href="master.8.html">master(8)</a> waits before forking a server that
> > ! appears to be malfunctioning.
> > </p>
> > ***************
> > *** 7921,7924 ****
> >
> > - <p> This feature is available in Postfix 2.8 and later. </p>
> > -
> >
> > --- 7314,7315 ----
> > ***************
> > *** 7926,7939 ****
> >
> > ! <DT><b><a name="qmgr_fudge_factor">qmgr_fudge_factor</a>
> > ! (default: 100)</b></DT><DD>
> > !
> > ! <p>
> > ! Obsolete feature: the percentage of delivery resources that a busy
> > ! mail system will use up for delivery of a large mailing list
> > ! message.
> > ! </p>
> >
> > <p>
> > ! This feature exists only in the <a href="qmgr.8.html">oqmgr(8)</a> old queue manager. The
> > ! current queue manager solves the problem in a better way.
> > </p>
> > --- 7317,7326 ----
> >
> > ! <DT><b><a name="setgid_group">setgid_group</a>
> > ! (default: postdrop)</b></DT><DD>
> >
> > <p>
> > ! The group ownership of set-gid Postfix commands and of group-writable
> > ! Postfix directories. When this parameter value is changed you need
> > ! to re-run "<b>postfix set-permissions</b>" (with Postfix version 2.0 and
> > ! earlier: "<b>/etc/postfix/post-install set-permissions</b>".
> > </p>
> > ***************
> > *** 7943,7967 ****
> >
> > ! <DT><b><a name="qmgr_ipc_timeout">qmgr_ipc_timeout</a>
> > ! (default: 60s)</b></DT><DD>
> > !
> > ! <p> The time limit for the queue manager to send or receive information
> > ! over an internal communication channel. The purpose is to break
> > ! out of deadlock situations. If the time limit is exceeded the
> > ! software either retries or aborts the operation. </p>
> >
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> >
> > - <p> This feature is available in Postfix 2.8 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="qmgr_message_active_limit">qmgr_message_active_limit</a>
> > - (default: 20000)</b></DT><DD>
> > -
> > <p>
> > ! The maximal number of messages in the <a href="QSHAPE_README.html#active_queue">active queue</a>.
> > </p>
> > --- 7330,7342 ----
> >
> > ! <DT><b><a name="show_user_unknown_table_name">show_user_unknown_table_name</a>
> > ! (default: yes)</b></DT><DD>
> >
> > <p>
> > ! Display the name of the recipient table in the "User unknown"
> > ! responses. The extra detail makes trouble shooting easier but also
> > ! reveals information that is nobody elses business.
> > </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > </p>
> > ***************
> > *** 7971,7991 ****
> >
> > ! <DT><b><a name="qmgr_message_recipient_limit">qmgr_message_recipient_limit</a>
> > ! (default: 20000)</b></DT><DD>
> > !
> > ! <p> The maximal number of recipients held in memory by the Postfix
> > ! queue manager, and the maximal size of the size of the short-term,
> > ! in-memory "dead" destination status cache. </p>
> > !
> > !
> > ! </DD>
> >
> > ! <DT><b><a name="qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a>
> > ! (default: 10)</b></DT><DD>
> >
> > <p>
> > ! The minimal number of in-memory recipients for any message. This
> > ! takes priority over any other in-memory recipient limits (i.e.,
> > ! the global <a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> and the per transport
> > ! _recipient_limit) if necessary. The minimum value allowed for this
> > ! parameter is 1.
> > </p>
> > --- 7346,7357 ----
> >
> > ! <DT><b><a name="showq_service_name">showq_service_name</a>
> > ! (default: showq)</b></DT><DD>
> >
> > ! <p>
> > ! The name of the <a href="showq.8.html">showq(8)</a> service. This service produces mail queue
> > ! status reports.
> > ! </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > </p>
> > ***************
> > *** 7995,8002 ****
> >
> > ! <DT><b><a name="qmqpd_authorized_clients">qmqpd_authorized_clients</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! What remote QMQP clients are allowed to connect to the Postfix QMQP
> > ! server port.
> > </p>
> > --- 7361,7367 ----
> >
> > ! <DT><b><a name="smtp_always_send_ehlo">smtp_always_send_ehlo</a>
> > ! (default: yes)</b></DT><DD>
> >
> > <p>
> > ! Always send EHLO at the start of an SMTP session.
> > </p>
> > ***************
> > *** 8004,8022 ****
> > <p>
> > ! By default, no client is allowed to use the service. This is
> > ! because the QMQP server will relay mail to any destination.
> > </p>
> >
> > ! <p>
> > ! Specify a list of client patterns. A list pattern specifies a host
> > ! name, a domain name, an internet address, or a network/mask pattern,
> > ! where the mask specifies the number of bits in the network part.
> > ! When a pattern specifies a file name, its contents are substituted
> > ! for the file name; when a pattern is a "<a href="DATABASE_README.html">type:table</a>" table specification,
> > ! table lookup is used instead. </p>
> >
> > <p>
> > ! Patterns are separated by whitespace and/or commas. In order to
> > ! reverse the result, precede a pattern with an
> > ! exclamation point (!). The form "!/file/name" is supported only
> > ! in Postfix version 2.4 and later.
> > </p>
> > --- 7369,7384 ----
> > <p>
> > ! With "<a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> = no", Postfix sends EHLO only when
> > ! the word "ESMTP" appears in the server greeting banner (example:
> > ! 220 spike.porcupine.org ESMTP Postfix).
> > </p>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_bind_address">smtp_bind_address</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! An optional numerical network address that the Postfix SMTP client
> > ! should bind to when making an IPv4 connection.
> > </p>
> > ***************
> > *** 8024,8043 ****
> > <p>
> > ! Example:
> > </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#qmqpd_authorized_clients">qmqpd_authorized_clients</a> = !192.168.0.1, 192.168.0.0/24
> > </pre>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="qmqpd_client_port_logging">qmqpd_client_port_logging</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> Enable logging of the remote QMQP client port in addition to
> > ! the hostname and IP address. The logging format is "host[address]:port".
> > ! </p>
> > !
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > --- 7386,7407 ----
> > <p>
> > ! This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
> > ! it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
> > ! for example:
> > </p>
> >
> > + <blockquote>
> > <pre>
> > ! /etc/postfix/<a href="master.5.html">master.cf</a>:
> > ! smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>=11.22.33.44
> > </pre>
> > + </blockquote>
> >
> > + <p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv4
> > + address, and that address is a non-loopback address, it is
> > + automatically used as the <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>. This supports virtual
> > + IP hosting, but can be a problem on multi-homed firewalls. See the
> > + <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
> >
> > ! <p> Note 2: address information may be enclosed inside <tt>[]</tt>,
> > ! but this form is not required here. </p>
> >
> > ***************
> > *** 8046,8088 ****
> >
> > ! <DT><b><a name="qmqpd_error_delay">qmqpd_error_delay</a>
> > ! (default: 1s)</b></DT><DD>
> > !
> > ! <p>
> > ! How long the Postfix QMQP server will pause before sending a negative
> > ! reply to the remote QMQP client. The purpose is to slow down confused
> > ! or malicious clients.
> > ! </p>
> >
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="qmqpd_timeout">qmqpd_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> > !
> > ! <p>
> > ! The time limit for sending or receiving information over the network.
> > ! If a read or write operation blocks for more than $<a href="postconf.5.html#qmqpd_timeout">qmqpd_timeout</a>
> > ! seconds the Postfix QMQP server gives up and disconnects.
> > ! </p>
> >
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="queue_directory">queue_directory</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p>
> > ! The location of the Postfix top-level queue directory. This is the
> > ! root directory of Postfix daemon processes that run chrooted.
> > ! </p>
> >
> > --- 7410,7442 ----
> >
> > ! <DT><b><a name="smtp_bind_address6">smtp_bind_address6</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! An optional numerical network address that the Postfix SMTP client
> > ! should bind to when making an IPv6 connection.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > <p>
> > ! This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
> > ! it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
> > ! for example:
> > </p>
> >
> > + <blockquote>
> > + <pre>
> > + /etc/postfix/<a href="master.5.html">master.cf</a>:
> > + smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>=1:2:3:4:5:6:7:8
> > + </pre>
> > + </blockquote>
> >
> > ! <p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv6
> > ! address, and that address is a non-loopback address, it is
> > ! automatically used as the <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>. This supports virtual
> > ! IP hosting, but can be a problem on multi-homed firewalls. See the
> > ! <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
> >
> > ! <p> Note 2: address information may be enclosed inside <tt>[]</tt>,
> > ! but this form is not recommended here. </p>
> >
> > ***************
> > *** 8091,8104 ****
> >
> > ! <DT><b><a name="queue_file_attribute_count_limit">queue_file_attribute_count_limit</a>
> > ! (default: 100)</b></DT><DD>
> >
> > ! <p>
> > ! The maximal number of (name=value) attributes that may be stored
> > ! in a Postfix queue file. The limit is enforced by the <a href="cleanup.8.html">cleanup(8)</a>
> > ! server.
> > </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > --- 7445,7455 ----
> >
> > ! <DT><b><a name="smtp_body_checks">smtp_body_checks</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Restricted <a href="header_checks.5.html">body_checks(5)</a> tables for the Postfix SMTP client.
> > ! These tables are searched while mail is being delivered. Actions
> > ! that change the delivery time or destination are not available.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 8107,8129 ****
> >
> > ! <DT><b><a name="queue_minfree">queue_minfree</a>
> > ! (default: 0)</b></DT><DD>
> > !
> > ! <p>
> > ! The minimal amount of free space in bytes in the queue file system
> > ! that is needed to receive mail. This is currently used by the
> > ! Postfix SMTP server to decide if it will accept any mail at all.
> > ! </p>
> >
> > ! <p>
> > ! By default, the Postfix SMTP server rejects MAIL FROM commands when
> > ! the amount of free space is less than 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>
> > ! (Postfix version 2.1 and later).
> > ! To specify a higher minimum free space limit, specify a <a href="postconf.5.html#queue_minfree">queue_minfree</a>
> > ! value that is at least 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>.
> > ! </p>
> >
> > ! <p>
> > ! With Postfix versions 2.0 and earlier, a <a href="postconf.5.html#queue_minfree">queue_minfree</a> value of
> > ! zero means there is no minimum required amount of free space.
> > ! </p>
> >
> > --- 7458,7471 ----
> >
> > ! <DT><b><a name="smtp_cname_overrides_servername">smtp_cname_overrides_servername</a>
> > ! (default: version dependent)</b></DT><DD>
> >
> > ! <p> Allow DNS CNAME records to override the servername that the
> > ! Postfix SMTP client uses for logging, SASL password lookup, TLS
> > ! policy decisions, or TLS certificate verification. The value "no"
> > ! hardens Postfix <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> hostname-based policies against
> > ! false hostname information in DNS CNAME records, and makes SASL
> > ! password file lookups more predictable. This is the default setting
> > ! as of Postfix 2.3. </p>
> >
> > ! <p> This feature is available in Postfix 2.2.9 and later. </p>
> >
> > ***************
> > *** 8132,8143 ****
> >
> > ! <DT><b><a name="queue_run_delay">queue_run_delay</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > <p>
> > ! The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager;
> > ! prior to Postfix 2.4 the default value was 1000s.
> > </p>
> >
> > ! <p> This parameter should be set less than or equal to
> > ! $<a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a>. See also $<a href="postconf.5.html#maximal_backoff_time">maximal_backoff_time</a>. </p>
> >
> > --- 7474,7490 ----
> >
> > ! <DT><b><a name="smtp_connect_timeout">smtp_connect_timeout</a>
> > ! (default: 30s)</b></DT><DD>
> >
> > <p>
> > ! The SMTP client time limit for completing a TCP connection, or
> > ! zero (use the operating system built-in time limit).
> > </p>
> >
> > ! <p>
> > ! When no connection can be made within the deadline, the Postfix
> > ! SMTP client
> > ! tries the next address on the mail exchanger list. Specify 0 to
> > ! disable the time limit (i.e. use whatever timeout is implemented by
> > ! the operating system).
> > ! </p>
> >
> > ***************
> > *** 8151,8181 ****
> >
> > ! <DT><b><a name="queue_service_name">queue_service_name</a>
> > ! (default: qmgr)</b></DT><DD>
> >
> > ! <p>
> > ! The name of the <a href="qmgr.8.html">qmgr(8)</a> service. This service manages the Postfix
> > ! queue and schedules delivery requests.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="rbl_reply_maps">rbl_reply_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional lookup tables with RBL response templates. The tables are
> > ! indexed by the RBL domain name. By default, Postfix uses the default
> > ! template as specified with the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> configuration
> > ! parameter. See there for a discussion of the syntax of RBL reply
> > ! templates.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > --- 7498,7535 ----
> >
> > ! <DT><b><a name="smtp_connection_cache_destinations">smtp_connection_cache_destinations</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Permanently enable SMTP connection caching for the specified
> > ! destinations. With SMTP connection caching, a connection is not
> > ! closed immediately after completion of a mail transaction. Instead,
> > ! the connection is kept open for up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
> > ! seconds. This allows connections to be reused for other deliveries,
> > ! and can improve mail delivery performance. </p>
> >
> > ! <p> Specify a comma or white space separated list of destinations
> > ! or pseudo-destinations: </p>
> >
> > + <ul>
> >
> > ! <li> if mail is sent without a <a href="postconf.5.html#relayhost">relay host</a>: a domain name (the
> > ! right-hand side of an email address, without the [] around a numeric
> > ! IP address),
> >
> > ! <li> if mail is sent via a <a href="postconf.5.html#relayhost">relay host</a>: a <a href="postconf.5.html#relayhost">relay host</a> name (without
> > ! [] or non-default TCP port), as specified in <a href="postconf.5.html">main.cf</a> or in the
> > ! transport map,
> >
> > ! <li> if mail is sent via a UNIX-domain socket: a pathname (without
> > ! the unix: prefix),
> >
> > ! <li> a /file/name with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names as
> > ! defined above,
> > !
> > ! <li> a "<a href="DATABASE_README.html">type:table</a>" with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names on
> > ! the left-hand side. The right-hand side result from "<a href="DATABASE_README.html">type:table</a>"
> > ! lookups is ignored.
> > !
> > ! </ul>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 8184,8192 ****
> >
> > ! <DT><b><a name="readme_directory">readme_directory</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p>
> > ! The location of Postfix README files that describe how to build,
> > ! configure or operate a specific Postfix subsystem or feature.
> > ! </p>
> >
> > --- 7538,7551 ----
> >
> > ! <DT><b><a name="smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p> Temporarily enable SMTP connection caching while a destination
> > ! has a high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>. With SMTP connection
> > ! caching, a connection is not closed immediately after completion
> > ! of a mail transaction. Instead, the connection is kept open for
> > ! up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a> seconds. This allows
> > ! connections to be reused for other deliveries, and can improve mail
> > ! delivery performance. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 8195,8256 ****
> >
> > ! <DT><b><a name="receive_override_options">receive_override_options</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Enable or disable recipient validation, built-in content
> > ! filtering, or address mapping. Typically, these are specified in
> > ! <a href="master.5.html">master.cf</a> as command-line arguments for the <a href="smtpd.8.html">smtpd(8)</a>, <a href="qmqpd.8.html">qmqpd(8)</a> or
> > ! <a href="pickup.8.html">pickup(8)</a> daemons. </p>
> >
> > ! <p> Specify zero or more of the following options. The options
> > ! override <a href="postconf.5.html">main.cf</a> settings and are either implemented by <a href="smtpd.8.html">smtpd(8)</a>,
> > ! <a href="qmqpd.8.html">qmqpd(8)</a>, or <a href="pickup.8.html">pickup(8)</a> themselves, or they are forwarded to the
> > ! cleanup server. </p>
> >
> > - <dl>
> >
> > ! <dt><b><a name="no_unknown_recipient_checks">no_unknown_recipient_checks</a></b></dt>
> >
> > ! <dd>Do not try to reject unknown recipients (SMTP server only).
> > ! This is typically specified AFTER an external content filter.
> > ! </dd>
> >
> > ! <dt><b><a name="no_address_mappings">no_address_mappings</a></b></dt>
> >
> > ! <dd>Disable canonical address mapping, virtual alias map expansion,
> > ! address masquerading, and automatic BCC (blind carbon-copy)
> > ! recipients. This is typically specified BEFORE an external content
> > ! filter. </dd>
> >
> > - <dt><b><a name="no_header_body_checks">no_header_body_checks</a></b></dt>
> >
> > ! <dd>Disable header/body_checks. This is typically specified AFTER
> > ! an external content filter. </dd>
> >
> > ! <dt><b><a name="no_milters">no_milters</a></b></dt>
> >
> > ! <dd>Disable Milter (mail filter) applications. This is typically
> > ! specified AFTER an external content filter. </dd>
> >
> > ! </dl>
> >
> > ! <p>
> > ! Note: when the "BEFORE content filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a>
> > ! setting is specified in the <a href="postconf.5.html">main.cf</a> file, specify the "AFTER content
> > ! filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a> setting in <a href="master.5.html">master.cf</a> (and vice
> > ! versa).
> > ! </p>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#receive_override_options">receive_override_options</a> =
> > ! <a href="postconf.5.html#no_unknown_recipient_checks">no_unknown_recipient_checks</a>, <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>
> > ! <a href="postconf.5.html#receive_override_options">receive_override_options</a> = <a href="postconf.5.html#no_address_mappings">no_address_mappings</a>
> > ! </pre>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > --- 7554,7629 ----
> >
> > ! <DT><b><a name="smtp_connection_cache_reuse_limit">smtp_connection_cache_reuse_limit</a>
> > ! (default: 10)</b></DT><DD>
> >
> > ! <p> When SMTP connection caching is enabled, the number of times that
> > ! an SMTP session may be reused before it is closed.
> > ! </p>
> >
> > ! <p> This feature is available in Postfix 2.2. In Postfix 2.3 it is
> > ! replaced by $<a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>.</p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
> > ! (default: 2s)</b></DT><DD>
> >
> > ! <p> When SMTP connection caching is enabled, the amount of time that
> > ! an unused SMTP client socket is kept open before it is closed. Do
> > ! not specify larger values without permission from the remote sites.
> > ! </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p> The amount of time during which Postfix will use an SMTP
> > ! connection repeatedly. The timer starts when the connection is
> > ! initiated (i.e. it includes the connect, greeting and helo latency,
> > ! in addition to the latencies of subsequent mail delivery transactions).
> > ! </p>
> >
> > ! <p> This feature addresses a performance stability problem with
> > ! remote SMTP servers. This problem is not specific to Postfix: it
> > ! can happen when any MTA sends large amounts of SMTP email to a site
> > ! that has multiple MX hosts. </p>
> >
> > ! <p> The problem starts when one of a set of MX hosts becomes slower
> > ! than the rest. Even though SMTP clients connect to fast and slow
> > ! MX hosts with equal probability, the slow MX host ends up with more
> > ! simultaneous inbound connections than the faster MX hosts, because
> > ! the slow MX host needs more time to serve each client request. </p>
> >
> > ! <p> The slow MX host becomes a connection attractor. If one MX
> > ! host becomes N times slower than the rest, it dominates mail delivery
> > ! latency unless there are more than N fast MX hosts to counter the
> > ! effect. And if the number of MX hosts is smaller than N, the mail
> > ! delivery latency becomes effectively that of the slowest MX host
> > ! divided by the total number of MX hosts. </p>
> >
> > ! <p> The solution uses connection caching in a way that differs from
> > ! Postfix version 2.2. By limiting the amount of time during which a connection
> > ! can be used repeatedly (instead of limiting the number of deliveries
> > ! over that connection), Postfix not only restores fairness in the
> > ! distribution of simultaneous connections across a set of MX hosts,
> > ! it also favors deliveries over connections that perform well, which
> > ! is exactly what we want. </p>
> >
> > ! <p> The default reuse time limit, 300s, is comparable to the various
> > ! smtp transaction timeouts which are fair estimates of maximum excess
> > ! latency for a slow delivery. Note that hosts may accept thousands
> > ! of messages over a single connection within the default connection
> > ! reuse time limit. This number is much larger than the default Postfix
> > ! version 2.2 limit of 10 messages per cached connection. It may prove necessary
> > ! to lower the limit to avoid interoperability issues with MTAs that
> > ! exhibit bugs when many messages are delivered via a single connection.
> > ! A lower reuse time limit risks losing the benefit of connection
> > ! reuse when the average connection and mail delivery latency exceeds
> > ! the reuse time limit. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 8259,8267 ****
> >
> > ! <DT><b><a name="recipient_bcc_maps">recipient_bcc_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional BCC (blind carbon-copy) address lookup tables, indexed by
> > ! recipient address. The BCC address (multiple results are not
> > ! supported) is added when mail enters from outside of Postfix.
> > </p>
> > --- 7632,7639 ----
> >
> > ! <DT><b><a name="smtp_data_done_timeout">smtp_data_done_timeout</a>
> > ! (default: 600s)</b></DT><DD>
> >
> > <p>
> > ! The SMTP client time limit for sending the SMTP ".", and for receiving
> > ! the server response.
> > </p>
> > ***************
> > *** 8269,8271 ****
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> > --- 7641,7644 ----
> > <p>
> > ! When no response is received within the deadline, a warning is
> > ! logged that the mail may be delivered multiple times.
> > </p>
> > ***************
> > *** 8273,8319 ****
> > <p>
> > ! The table search order is as follows:
> > </p>
> >
> > - <ul>
> > -
> > - <li> Look up the "user+extension at domain.tld" address including the
> > - optional address extension.
> > -
> > - <li> Look up the "user at domain.tld" address without the optional
> > - address extension.
> > -
> > - <li> Look up the "user+extension" address local part when the
> > - recipient domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > - or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
> > -
> > - <li> Look up the "user" address local part when the recipient domain
> > - equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
> > -
> > - <li> Look up the "@domain.tld" part.
> >
> > ! </ul>
> >
> > ! <p>
> > ! Specify the types and names of databases to use. After change,
> > ! run "<b>postmap /etc/postfix/recipient_bcc</b>".
> > ! </p>
> >
> > <p>
> > ! Note: if mail to the BCC address bounces it will be returned to
> > ! the sender.
> > </p>
> >
> > - <p> Note: automatic BCC recipients are produced only for new mail.
> > - To avoid mailer loops, automatic BCC recipients are not generated
> > - after Postfix forwards mail internally, or after Postfix generates
> > - mail itself. </p>
> > -
> > <p>
> > ! Example:
> > </p>
> >
> > - <pre>
> > - <a href="postconf.5.html#recipient_bcc_maps">recipient_bcc_maps</a> = hash:/etc/postfix/recipient_bcc
> > - </pre>
> > -
> >
> > --- 7646,7667 ----
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_data_init_timeout">smtp_data_init_timeout</a>
> > ! (default: 120s)</b></DT><DD>
> >
> > <p>
> > ! The SMTP client time limit for sending the SMTP DATA command, and for
> > ! receiving the server response.
> > </p>
> >
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> >
> >
> > ***************
> > *** 8321,8334 ****
> >
> > ! <DT><b><a name="recipient_canonical_classes">recipient_canonical_classes</a>
> > ! (default: envelope_recipient, header_recipient)</b></DT><DD>
> > !
> > ! <p> What addresses are subject to <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address
> > ! mapping. By default, <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address mapping is
> > ! applied to envelope recipient addresses, and to header recipient
> > ! addresses. </p>
> >
> > ! <p> Specify one or more of: envelope_recipient, header_recipient
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 7669,7683 ----
> >
> > ! <DT><b><a name="smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
> > ! (default: 180s)</b></DT><DD>
> >
> > ! <p>
> > ! The SMTP client time limit for sending the SMTP message content.
> > ! When the connection makes no progress for more than $<a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
> > ! seconds the Postfix SMTP client terminates the transfer.
> > </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > ***************
> > *** 8337,8345 ****
> >
> > ! <DT><b><a name="recipient_canonical_maps">recipient_canonical_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional address mapping lookup tables for envelope and header
> > ! recipient addresses.
> > ! The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
> > </p>
> > --- 7686,7692 ----
> >
> > ! <DT><b><a name="smtp_defer_if_no_mx_address_found">smtp_defer_if_no_mx_address_found</a>
> > ! (default: no)</b></DT><DD>
> >
> > <p>
> > ! Defer mail delivery when no MX record resolves to an IP address.
> > </p>
> > ***************
> > *** 8347,8349 ****
> > <p>
> > ! Note: $<a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
> > </p>
> > --- 7694,7698 ----
> > <p>
> > ! The default (no) is to return the mail as undeliverable. With older
> > ! Postfix versions the default was to keep trying to deliver the mail
> > ! until someone fixed the MX record or until the mail was too old.
> > </p>
> > ***************
> > *** 8351,8358 ****
> > <p>
> > ! Example:
> > </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> = hash:/etc/postfix/recipient_canonical
> > ! </pre>
> >
> > --- 7700,7708 ----
> > <p>
> > ! Note: Postfix always ignores MX records with equal or worse preference
> > ! than the local MTA itself.
> > </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > ***************
> > *** 8361,8380 ****
> >
> > ! <DT><b><a name="recipient_delimiter">recipient_delimiter</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p>
> > ! The separator between user names and address extensions (user+foo).
> > ! See <a href="canonical.5.html">canonical(5)</a>, <a href="local.8.html">local(8)</a>, <a href="relocated.5.html">relocated(5)</a> and <a href="virtual.5.html">virtual(5)</a> for the
> > ! effects this has on aliases, canonical, virtual, relocated and
> > ! on .forward file lookups. Basically, the software tries user+foo
> > ! and .forward+foo before trying user and .forward.
> > ! </p>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> = +
> > ! </pre>
> >
> > --- 7711,7719 ----
> >
> > ! <DT><b><a name="smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a>
> > ! (default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
> >
> > ! <p> The maximal number of parallel deliveries to the same destination
> > ! via the smtp message delivery transport. This limit is enforced by
> > ! the queue manager. The message delivery transport name is the first
> > ! field in the entry in the <a href="master.5.html">master.cf</a> file. </p>
> >
> > ***************
> > *** 8383,8395 ****
> >
> > ! <DT><b><a name="reject_code">reject_code</a>
> > ! (default: 554)</b></DT><DD>
> >
> > ! <p>
> > ! The numerical Postfix SMTP server response code when a remote SMTP
> > ! client request is rejected by the "reject" restriction.
> > ! </p>
> >
> > ! <p>
> > ! Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
> > ! </p>
> >
> > --- 7722,7734 ----
> >
> > ! <DT><b><a name="smtp_destination_recipient_limit">smtp_destination_recipient_limit</a>
> > ! (default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
> >
> > ! <p> The maximal number of recipients per message for the smtp
> > ! message delivery transport. This limit is enforced by the queue
> > ! manager. The message delivery transport name is the first field in
> > ! the entry in the <a href="master.5.html">master.cf</a> file. </p>
> >
> > ! <p> Setting this parameter to a value of 1 changes the meaning of
> > ! <a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> from concurrency per domain
> > ! into concurrency per recipient. </p>
> >
> > ***************
> > *** 8398,8414 ****
> >
> > ! <DT><b><a name="reject_tempfail_action">reject_tempfail_action</a>
> > ! (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>)</b></DT><DD>
> >
> > ! <p> The Postfix SMTP server's action when a reject-type restriction
> > ! fails due to a temporary error condition. Specify "defer" to defer
> > ! the remote SMTP client request immediately. With the default
> > ! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
> > ! for opportunities to reject mail, and defers the client request
> > ! only if it would otherwise be accepted. </p>
> > !
> > ! <p> For finer control, see: <a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a>,
> > ! <a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a>, <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a>,
> > ! and <a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a>. </p>
> >
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> >
> > --- 7737,7749 ----
> >
> > ! <DT><b><a name="smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Lookup tables, indexed by the remote SMTP server address, with
> > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
> > ! etc.) that the Postfix SMTP client will ignore in the EHLO response from a
> > ! remote SMTP server. See <a href="postconf.5.html#smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a> for details. The
> > ! table is not indexed by hostname for consistency with
> > ! <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 8417,8444 ****
> >
> > ! <DT><b><a name="relay_clientcerts">relay_clientcerts</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> List of tables with remote SMTP client-certificate fingerprints or
> > ! public key fingerprints (Postfix 2.9 and later) for which the Postfix
> > ! SMTP server will allow access with the <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
> > ! feature. The fingerprint digest algorithm is configurable via the
> > ! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
> > ! Postfix version 2.5). </p>
> >
> > ! <p> Postfix lookup tables are in the form of (key, value) pairs.
> > ! Since we only need the key, the value can be chosen freely, e.g.
> > ! the name of the user or host:
> > ! D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a> = hash:/etc/postfix/relay_clientcerts
> > ! </pre>
> >
> > ! <p>For more fine-grained control, use <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> to select
> > ! an appropriate <a href="access.5.html">access(5)</a> policy for each client.
> > ! See <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a>.</p>
> >
> > ! <p>This feature is available with Postfix version 2.2.</p>
> >
> > --- 7752,7773 ----
> >
> > ! <DT><b><a name="smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
> > ! auth, etc.) that the Postfix SMTP client will ignore in the EHLO
> > ! response from a remote SMTP server. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ! <p> Notes: </p>
> >
> > ! <ul>
> >
> > ! <li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
> > ! this action from being logged. </p>
> >
> > ! <li> <p> Use the <a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a> feature to
> > ! discard EHLO keywords selectively. </p>
> > !
> > ! </ul>
> >
> > ***************
> > *** 8447,8457 ****
> >
> > ! <DT><b><a name="relay_destination_concurrency_limit">relay_destination_concurrency_limit</a>
> > ! (default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
> >
> > ! <p> The maximal number of parallel deliveries to the same destination
> > ! via the relay message delivery transport. This limit is enforced
> > ! by the queue manager. The message delivery transport name is the
> > ! first field in the entry in the <a href="master.5.html">master.cf</a> file. </p>
> >
> > ! <p> This feature is available in Postfix 2.0 and later. </p>
> >
> > --- 7776,7800 ----
> >
> > ! <DT><b><a name="smtp_enforce_tls">smtp_enforce_tls</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Enforcement mode: require that remote SMTP servers use TLS
> > ! encryption, and never send mail in the clear. This also requires
> > ! that the remote SMTP server hostname matches the information in
> > ! the remote server certificate, and that the remote SMTP server
> > ! certificate was issued by a CA that is trusted by the Postfix SMTP
> > ! client. If the certificate doesn't verify or the hostname doesn't
> > ! match, delivery is deferred and mail stays in the queue. </p>
> >
> > ! <p> The server hostname is matched against all names provided as
> > ! dNSNames in the SubjectAlternativeName. If no dNSNames are specified,
> > ! the CommonName is checked. The behavior may be changed with the
> > ! <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> option. </p>
> > !
> > ! <p> This option is useful only if you are definitely sure that you
> > ! will only connect to servers that support <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> _and_ that
> > ! provide valid server certificates. Typical use is for clients that
> > ! send all their email to a dedicated mailhub. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
> >
> > ***************
> > *** 8460,8506 ****
> >
> > ! <DT><b><a name="relay_destination_recipient_limit">relay_destination_recipient_limit</a>
> > ! (default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
> >
> > ! <p> The maximal number of recipients per message for the relay
> > ! message delivery transport. This limit is enforced by the queue
> > ! manager. The message delivery transport name is the first field in
> > ! the entry in the <a href="master.5.html">master.cf</a> file. </p>
> >
> > ! <p> Setting this parameter to a value of 1 changes the meaning of
> > ! <a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> from concurrency per domain
> > ! into concurrency per recipient. </p>
> >
> > ! <p> This feature is available in Postfix 2.0 and later. </p>
> >
> >
> > - </DD>
> >
> > ! <DT><b><a name="relay_domains">relay_domains</a>
> > ! (default: $<a href="postconf.5.html#mydestination">mydestination</a>)</b></DT><DD>
> >
> > ! <p> What destination domains (and subdomains thereof) this system
> > ! will relay mail to. Subdomain matching is controlled with the
> > ! <a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> parameter. For details about how
> > ! the <a href="postconf.5.html#relay_domains">relay_domains</a> value is used, see the description of the
> > ! <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> and <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> SMTP recipient
> > ! restrictions. </p>
> >
> > ! <p> Domains that match $<a href="postconf.5.html#relay_domains">relay_domains</a> are delivered with the
> > ! $<a href="postconf.5.html#relay_transport">relay_transport</a> mail delivery transport. The SMTP server validates
> > ! recipient addresses with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> and rejects non-existent
> > ! recipients. See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the
> > ! <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file. </p>
> >
> > ! <p> Note: Postfix will not automatically forward mail for domains
> > ! that list this system as their primary or backup MX host. See the
> > ! <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> restriction in the <a href="postconf.5.html">postconf(5)</a> manual page. </p>
> >
> > ! <p> Specify a list of host or domain names, "/file/name" patterns
> > ! or "<a href="DATABASE_README.html">type:table</a>" lookup tables, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace. A
> > ! "/file/name" pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>"
> > ! lookup table is matched when a (parent) domain appears as lookup
> > ! key. Specify "!pattern" to exclude a domain from the list. The form
> > ! "!/file/name" is supported only in Postfix version 2.4 and later.
> > ! </p>
> >
> > --- 7803,7845 ----
> >
> > ! <DT><b><a name="smtp_fallback_relay">smtp_fallback_relay</a>
> > ! (default: $<a href="postconf.5.html#fallback_relay">fallback_relay</a>)</b></DT><DD>
> >
> > ! <p>
> > ! Optional list of relay hosts for SMTP destinations that can't be
> > ! found or that are unreachable. With Postfix 2.2 and earlier this
> > ! parameter is called <a href="postconf.5.html#fallback_relay">fallback_relay</a>. </p>
> >
> > ! <p>
> > ! By default, mail is returned to the sender when a destination is
> > ! not found, and delivery is deferred when a destination is unreachable.
> > ! </p>
> >
> > ! <p> The fallback relays must be SMTP destinations. Specify a domain,
> > ! host, host:port, [host]:port, [address] or [address]:port; the form
> > ! [host] turns off MX lookups. If you specify multiple SMTP
> > ! destinations, Postfix will try them in the specified order. </p>
> >
> > + <p> To prevent mailer loops between MX hosts and fall-back hosts,
> > + Postfix version 2.2 and later will not use the fallback relays for
> > + destinations that it is MX host for (assuming DNS lookup is turned on).
> > + </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_generic_maps">smtp_generic_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Optional lookup tables that perform address rewriting in the
> > ! SMTP client, typically to transform a locally valid address into
> > ! a globally valid address when sending mail across the Internet.
> > ! This is needed when the local machine does not have its own Internet
> > ! domain name, but uses something like <i>localdomain.local</i>
> > ! instead. </p>
> >
> > ! <p> The table format and lookups are documented in <a href="generic.5.html">generic(5)</a>;
> > ! examples are shown in the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> and
> > ! <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> documents. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 8509,8522 ****
> >
> > ! <DT><b><a name="relay_domains_reject_code">relay_domains_reject_code</a>
> > ! (default: 554)</b></DT><DD>
> >
> > ! <p>
> > ! The numerical Postfix SMTP server response code when a client
> > ! request is rejected by the <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient
> > ! restriction.
> > </p>
> >
> > ! <p>
> > ! Do not change this unless you have a complete understanding of <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>.
> > ! </p>
> >
> > --- 7848,7858 ----
> >
> > ! <DT><b><a name="smtp_header_checks">smtp_header_checks</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Restricted <a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP client.
> > ! These tables are searched while mail is being delivered. Actions
> > ! that change the delivery time or destination are not available.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 8525,8542 ****
> >
> > ! <DT><b><a name="relay_recipient_maps">relay_recipient_maps</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Optional lookup tables with all valid addresses in the domains
> > ! that match $<a href="postconf.5.html#relay_domains">relay_domains</a>. Specify @domain as a wild-card for
> > ! domains that have no valid recipient list, and become a source of
> > ! backscatter mail: Postfix accepts spam for non-existent recipients
> > ! and then floods innocent people with undeliverable mail. Technically,
> > ! tables
> > ! listed with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> are used as lists: Postfix needs
> > ! to know only if a lookup string is found or not, but it does not
> > ! use the result from table lookup. </p>
> >
> > <p>
> > ! If this parameter is non-empty, then the Postfix SMTP server will reject
> > ! mail to unknown relay users. This feature is off by default.
> > </p>
> > --- 7861,7867 ----
> >
> > ! <DT><b><a name="smtp_helo_name">smtp_helo_name</a>
> > ! (default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
> >
> > <p>
> > ! The hostname to send in the SMTP EHLO or HELO command.
> > </p>
> > ***************
> > *** 8544,8547 ****
> > <p>
> > ! See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
> > ! file.
> > </p>
> > --- 7869,7872 ----
> > <p>
> > ! The default value is the machine hostname. Specify a hostname or
> > ! [ip.add.re.ss].
> > </p>
> > ***************
> > *** 8549,8556 ****
> > <p>
> > ! Example:
> > </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> = hash:/etc/postfix/relay_recipients
> > </pre>
> >
> > --- 7874,7886 ----
> > <p>
> > ! This information can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP
> > ! clients, or it can be specified in the <a href="master.5.html">master.cf</a> file for a specific
> > ! client, for example:
> > </p>
> >
> > + <blockquote>
> > <pre>
> > ! /etc/postfix/<a href="master.5.html">master.cf</a>:
> > ! mysmtp ... smtp -o <a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a>=foo.bar.com
> > </pre>
> > + </blockquote>
> >
> > ***************
> > *** 8563,8586 ****
> >
> > ! <DT><b><a name="relay_transport">relay_transport</a>
> > ! (default: relay)</b></DT><DD>
> > !
> > ! <p>
> > ! The default mail delivery transport and next-hop destination for
> > ! remote delivery to domains listed with $<a href="postconf.5.html#relay_domains">relay_domains</a>. In order of
> > ! decreasing precedence, the nexthop destination is taken from
> > ! $<a href="postconf.5.html#relay_transport">relay_transport</a>, $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>, or
> > ! from the recipient domain. This information can be overruled with
> > ! the <a href="transport.5.html">transport(5)</a> table.
> > ! </p>
> > !
> > ! <p>
> > ! Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i>
> > ! is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
> > ! The <i>:nexthop</i> destination is optional; its syntax is documented
> > ! in the manual page of the corresponding delivery agent.
> > ! </p>
> >
> > <p>
> > ! See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
> > ! file.
> > </p>
> > --- 7893,7900 ----
> >
> > ! <DT><b><a name="smtp_helo_timeout">smtp_helo_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > <p>
> > ! The SMTP client time limit for sending the HELO or EHLO command,
> > ! and for receiving the initial server response.
> > </p>
> > ***************
> > *** 8588,8590 ****
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > </p>
> > --- 7902,7905 ----
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> > ***************
> > *** 8594,8604 ****
> >
> > ! <DT><b><a name="relayhost">relayhost</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! The next-hop destination of non-local mail; overrides non-local
> > ! domains in recipient addresses. This information is overruled with
> > ! <a href="postconf.5.html#relay_transport">relay_transport</a>, <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>,
> > ! <a href="postconf.5.html#default_transport">default_transport</a>, <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
> > ! and with the <a href="transport.5.html">transport(5)</a> table.
> > </p>
> > --- 7909,7916 ----
> >
> > ! <DT><b><a name="smtp_host_lookup">smtp_host_lookup</a>
> > ! (default: dns)</b></DT><DD>
> >
> > <p>
> > ! What mechanisms when the Postfix SMTP client uses to look up a host's IP
> > ! address. This parameter is ignored when DNS lookups are disabled.
> > </p>
> > ***************
> > *** 8606,8650 ****
> > <p>
> > ! On an intranet, specify the organizational domain name. If your
> > ! internal DNS uses no MX records, specify the name of the intranet
> > ! gateway host instead.
> > </p>
> >
> > ! <p>
> > ! In the case of SMTP, specify a domain name, hostname, hostname:port,
> > ! [hostname]:port, [hostaddress] or [hostaddress]:port. The form
> > ! [hostname] turns off MX lookups.
> > ! </p>
> >
> > ! <p>
> > ! If you're connected via UUCP, see the <a href="UUCP_README.html">UUCP_README</a> file for useful
> > ! information.
> > ! </p>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = [gateway.example.com]
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = uucphost
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = [an.ip.add.ress]
> > ! </pre>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="relocated_maps">relocated_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional lookup tables with new contact information for users or
> > ! domains that no longer exist. The table format and lookups are
> > ! documented in <a href="relocated.5.html">relocated(5)</a>.
> > </p>
> >
> > <p>
> > ! If you use this feature, run "<b>postmap /etc/postfix/relocated</b>" to
> > ! build the necessary DBM or DB file after change, then "<b>postfix
> > ! reload</b>" to make the changes visible.
> > </p>
> > --- 7918,7954 ----
> > <p>
> > ! Specify one of the following:
> > </p>
> >
> > ! <dl>
> >
> > ! <dt><b>dns</b></dt>
> >
> > ! <dd>Hosts can be found in the DNS (preferred). </dd>
> >
> > ! <dt><b>native</b></dt>
> > !
> > ! <dd>Use the native naming service only (nsswitch.conf, or equivalent
> > ! mechanism). </dd>
> >
> > + <dt><b>dns, native</b></dt>
> >
> > ! <dd>Use the native service for hosts not found in the DNS. </dd>
> >
> > ! </dl>
> >
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> > +
> > + </DD>
> > +
> > + <DT><b><a name="smtp_line_length_limit">smtp_line_length_limit</a>
> > + (default: 990)</b></DT><DD>
> > +
> > <p>
> > ! The maximal length of message header and body lines that Postfix
> > ! will send via SMTP. Longer lines are broken by inserting
> > ! "<CR><LF><SPACE>". This minimizes the damage to
> > ! MIME formatted mail.
> > </p>
> > ***************
> > *** 8652,8661 ****
> > <p>
> > ! Examples:
> > </p>
> >
> > - <pre>
> > - <a href="postconf.5.html#relocated_maps">relocated_maps</a> = dbm:/etc/postfix/relocated
> > - <a href="postconf.5.html#relocated_maps">relocated_maps</a> = hash:/etc/postfix/relocated
> > - </pre>
> > -
> >
> > --- 7956,7961 ----
> > <p>
> > ! By default, the line length is limited to 990 characters, because
> > ! some server implementations cannot receive mail with long lines.
> > </p>
> >
> >
> > ***************
> > *** 8663,8693 ****
> >
> > ! <DT><b><a name="remote_header_rewrite_domain">remote_header_rewrite_domain</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Don't rewrite message headers from remote clients at all when
> > ! this parameter is empty; otherwise, rewrite message headers and
> > ! append the specified domain name to incomplete addresses. The
> > ! <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> parameter controls what clients Postfix
> > ! considers local. </p>
> >
> > ! <p> Examples: </p>
> >
> > - <p> The safe setting: append "domain.invalid" to incomplete header
> > - addresses from remote SMTP clients, so that those addresses cannot
> > - be confused with local addresses. </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> = domain.invalid
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> The default, purist, setting: don't rewrite headers from remote
> > ! clients at all. </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> =
> > ! </pre>
> > ! </blockquote>
> >
> > --- 7963,7989 ----
> >
> > ! <DT><b><a name="smtp_mail_timeout">smtp_mail_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p>
> > ! The SMTP client time limit for sending the MAIL FROM command, and
> > ! for receiving the server response.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_mime_header_checks">smtp_mime_header_checks</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Restricted mime_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
> > ! client. These tables are searched while mail is being delivered.
> > ! Actions that change the delivery time or destination are not
> > ! available. </p>
> > !
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 8696,8759 ****
> >
> > ! <DT><b><a name="require_home_directory">require_home_directory</a>
> > ! (default: no)</b></DT><DD>
> >
> > <p>
> > ! Require that a <a href="local.8.html">local(8)</a> recipient's home directory exists
> > ! before mail delivery is attempted. By default this test is disabled.
> > ! It can be useful for environments that import home directories to
> > ! the mail server (IMPORTING HOME DIRECTORIES IS NOT RECOMMENDED).
> > </p>
> >
> >
> > - </DD>
> >
> > ! <DT><b><a name="reset_owner_alias">reset_owner_alias</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Reset the <a href="local.8.html">local(8)</a> delivery agent's idea of the owner-alias
> > ! attribute, when delivering mail to a child alias that does not have
> > ! its own owner alias. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. With older
> > ! Postfix releases, the behavior is as if this parameter is set to
> > ! "yes". </p>
> >
> > ! <p> As documented in <a href="aliases.5.html">aliases(5)</a>, when an alias <i>name</i> has a
> > ! companion alias named owner-<i>name</i>, delivery errors will be
> > ! reported to the owner alias instead of the sender. This configuration
> > ! is recommended for mailing lists. <p>
> > !
> > ! <p> A less known property of the owner alias is that it also forces
> > ! the <a href="local.8.html">local(8)</a> delivery agent to write local and remote addresses
> > ! from alias expansion to a new queue file, instead of attempting to
> > ! deliver mail to local addresses as soon as they come out of alias
> > ! expansion. </p>
> > !
> > ! <p> Writing local addresses from alias expansion to a new queue
> > ! file allows for robust handling of temporary delivery errors: errors
> > ! with one local member have no effect on deliveries to other members
> > ! of the list. On the other hand, delivery to local addresses as
> > ! soon as they come out of alias expansion is fragile: a temporary
> > ! error with one local address from alias expansion will cause the
> > ! entire alias to be expanded repeatedly until the error goes away,
> > ! or until the message expires in the queue. In that case, a problem
> > ! with one list member results in multiple message deliveries to other
> > ! list members. </p>
> > !
> > ! <p> The default behavior of Postfix 2.8 and later is to keep the
> > ! owner-alias attribute of the parent alias, when delivering mail to
> > ! a child alias that does not have its own owner alias. Then, local
> > ! addresses from that child alias will be written to a new queue file,
> > ! and a temporary error with one local address will not affect delivery
> > ! to other mailing list members. </p>
> > !
> > ! <p> Unfortunately, older Postfix releases reset the owner-alias
> > ! attribute when delivering mail to a child alias that does not have
> > ! its own owner alias. The <a href="local.8.html">local(8)</a> delivery agent then attempts to
> > ! deliver local addresses as soon as they come out of child alias
> > ! expansion. If delivery to any address from child alias expansion
> > ! fails with a temporary error condition, the entire mailing list may
> > ! be expanded repeatedly until the mail expires in the queue, resulting
> > ! in multiple deliveries of the same message to mailing list members.
> > ! </p>
> >
> > --- 7992,8019 ----
> >
> > ! <DT><b><a name="smtp_mx_address_limit">smtp_mx_address_limit</a>
> > ! (default: 5)</b></DT><DD>
> >
> > <p>
> > ! The maximal number of MX (mail exchanger) IP addresses that can
> > ! result from mail exchanger lookups, or zero (no limit). Prior to
> > ! Postfix version 2.3, this limit was disabled by default.
> > </p>
> >
> > + <p>
> > + This feature is available in Postfix 2.1 and later.
> > + </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_mx_session_limit">smtp_mx_session_limit</a>
> > ! (default: 2)</b></DT><DD>
> >
> > ! <p> The maximal number of SMTP sessions per delivery request before
> > ! giving up or delivering to a fall-back <a href="postconf.5.html#relayhost">relay host</a>, or zero (no
> > ! limit). This restriction ignores sessions that fail to complete the
> > ! SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to
> > ! complete the EHLO and TLS handshake (Postfix version 2.3 and later). </p>
> >
> > ! <p> This feature is available in Postfix 2.1 and later. </p>
> >
> > ***************
> > *** 8762,8780 ****
> >
> > ! <DT><b><a name="resolve_dequoted_address">resolve_dequoted_address</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p> Resolve a recipient address safely instead of correctly, by
> > ! looking inside quotes. </p>
> >
> > ! <p> By default, the Postfix address resolver does not quote the
> > ! address localpart as per <a href="http://tools.ietf.org/html/rfc822">RFC 822</a>, so that additional @ or % or !
> > ! operators remain visible. This behavior is safe but it is also
> > ! technically incorrect. </p>
> >
> > ! <p> If you specify "<a href="postconf.5.html#resolve_dequoted_address">resolve_dequoted_address</a> = no", then
> > ! the Postfix
> > ! resolver will not know about additional @ etc. operators in the
> > ! address localpart. This opens opportunities for obscure mail relay
> > ! attacks with user at domain@domain addresses when Postfix provides
> > ! backup MX service for Sendmail systems. </p>
> >
> > --- 8022,8032 ----
> >
> > ! <DT><b><a name="smtp_nested_header_checks">smtp_nested_header_checks</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Restricted nested_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
> > ! client. These tables are searched while mail is being delivered.
> > ! Actions that change the delivery time or destination are not
> > ! available. </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 8783,8798 ****
> >
> > ! <DT><b><a name="resolve_null_domain">resolve_null_domain</a>
> > (default: no)</b></DT><DD>
> >
> > ! <p> Resolve an address that ends in the "@" null domain as if the
> > ! local hostname were specified, instead of rejecting the address as
> > ! invalid. </p>
> >
> > - <p> This feature is available in Postfix 2.1 and later.
> > - Earlier versions always resolve the null domain as the local
> > - hostname. </p>
> >
> > ! <p> The Postfix SMTP server uses this feature to reject mail from
> > ! or to addresses that end in the "@" null domain, and from addresses
> > ! that rewrite into a form that ends in the "@" null domain. </p>
> >
> > --- 8035,8058 ----
> >
> > ! <DT><b><a name="smtp_never_send_ehlo">smtp_never_send_ehlo</a>
> > (default: no)</b></DT><DD>
> >
> > ! <p> Never send EHLO at the start of an SMTP session. See also the
> > ! <a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> parameter. </p>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a>
> > ! (default: 10s)</b></DT><DD>
> > !
> > ! <p>
> > ! How long the Postfix SMTP client pauses before sending
> > ! ".<CR><LF>" in order to work around the PIX firewall
> > ! "<CR><LF>.<CR><LF>" bug.
> > ! </p>
> > !
> > ! <p>
> > ! Choosing a too short time makes this workaround ineffective when
> > ! sending large messages over slow network connections.
> > ! </p>
> >
> > ***************
> > *** 8801,8809 ****
> >
> > ! <DT><b><a name="resolve_numeric_domain">resolve_numeric_domain</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Resolve "user at ipaddress" as "user@[ipaddress]", instead of
> > ! rejecting the address as invalid. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later.
> >
> > --- 8061,8071 ----
> >
> > ! <DT><b><a name="smtp_pix_workaround_maps">smtp_pix_workaround_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Lookup tables, indexed by the remote SMTP server address, with
> > ! per-destination workarounds for CISCO PIX firewall bugs. The table
> > ! is not indexed by hostname for consistency with
> > ! <a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>. </p>
> >
> > ! <p> This feature is available in Postfix 2.4 and later. </p>
> >
> > ***************
> > *** 8812,8820 ****
> >
> > ! <DT><b><a name="rewrite_service_name">rewrite_service_name</a>
> > ! (default: rewrite)</b></DT><DD>
> >
> > <p>
> > ! The name of the address rewriting service. This service rewrites
> > ! addresses to standard form and resolves them to a (delivery method,
> > ! next-hop host, recipient) triple.
> > </p>
> > --- 8074,8087 ----
> >
> > ! <DT><b><a name="smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a>
> > ! (default: 500s)</b></DT><DD>
> > !
> > ! <p> How long a message must be queued before the Postfix SMTP client
> > ! turns on the PIX firewall "<CR><LF>.<CR><LF>"
> > ! bug workaround for delivery through firewalls with "smtp fixup"
> > ! mode turned on. </p>
> >
> > <p>
> > ! By default, the workaround is turned off for mail that is queued
> > ! for less than 500 seconds. In other words, the workaround is normally
> > ! turned off for the first delivery attempt.
> > </p>
> > ***************
> > *** 8822,8824 ****
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > </p>
> > --- 8089,8093 ----
> > <p>
> > ! Specify 0 to enable the PIX firewall
> > ! "<CR><LF>.<CR><LF>" bug workaround upon the
> > ! first delivery attempt.
> > </p>
> > ***************
> > *** 8828,8855 ****
> >
> > ! <DT><b><a name="sample_directory">sample_directory</a>
> > ! (default: /etc/postfix)</b></DT><DD>
> > !
> > ! <p>
> > ! The name of the directory with example Postfix configuration files.
> > ! Starting with Postfix 2.1, these files have been replaced with the
> > ! <a href="postconf.5.html">postconf(5)</a> manual page.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="send_cyrus_sasl_authzid">send_cyrus_sasl_authzid</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> When authenticating to a remote SMTP or LMTP server with the
> > ! default setting "no", send no SASL authoriZation ID (authzid); send
> > ! only the SASL authentiCation ID (authcid) plus the authcid's password.
> > ! </p>
> >
> > ! <p> The non-default setting "yes" enables the behavior of older
> > ! Postfix versions. These always send a SASL authzid that is equal
> > ! to the SASL authcid, but this causes inter-operability problems
> > ! with some SMTP servers. </p>
> >
> > ! <p> This feature is available in Postfix 2.4.4 and later. </p>
> >
> > --- 8097,8122 ----
> >
> > ! <DT><b><a name="smtp_pix_workarounds">smtp_pix_workarounds</a>
> > ! (default: disable_esmtp, delay_dotcrlf)</b></DT><DD>
> >
> > + <p> A list that specifies zero or more workarounds for CISCO PIX
> > + firewall bugs. These workarounds are implemented by the Postfix
> > + SMTP client. Workaround names are separated by comma or space, and
> > + are case insensitive. This parameter setting can be overruled with
> > + per-destination <a href="postconf.5.html#smtp_pix_workaround_maps">smtp_pix_workaround_maps</a> settings. </p>
> >
> > ! <dl>
> >
> > ! <dt><b>delay_dotcrlf</b><dd> Insert a delay before sending
> > ! ".<CR><LF>" after the end of the message content. The
> > ! delay is subject to the <a href="postconf.5.html#smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a> and
> > ! <a href="postconf.5.html#smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a> parameter settings. </dd>
> >
> > ! <dt><b>disable_esmtp</b><dd> Disable all extended SMTP commands:
> > ! send HELO instead of EHLO. </dd>
> >
> > ! </dl>
> >
> > ! <p> This feature is available in Postfix 2.4 and later. The default
> > ! settings are backwards compatible with earlier Postfix versions.
> > ! </p>
> >
> > ***************
> > *** 8858,8865 ****
> >
> > ! <DT><b><a name="sender_based_routing">sender_based_routing</a>
> > ! (default: no)</b></DT><DD>
> >
> > <p>
> > ! This parameter should not be used. It was replaced by <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
> > ! in Postfix version 2.3.
> > </p>
> > --- 8125,8137 ----
> >
> > ! <DT><b><a name="smtp_quit_timeout">smtp_quit_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > <p>
> > ! The SMTP client time limit for sending the QUIT command, and for
> > ! receiving the server response.
> > ! </p>
> > !
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> > ***************
> > *** 8869,8879 ****
> >
> > ! <DT><b><a name="sender_bcc_maps">sender_bcc_maps</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Optional BCC (blind carbon-copy) address lookup tables, indexed
> > ! by sender address. The BCC address (multiple results are not
> > ! supported) is added when mail enters from outside of Postfix. </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> > --- 8141,8149 ----
> >
> > ! <DT><b><a name="smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>
> > ! (default: yes)</b></DT><DD>
> >
> > <p>
> > ! Quote addresses in SMTP MAIL FROM and RCPT TO commands as required
> > ! by <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. This includes putting quotes around an address localpart
> > ! that ends in ".".
> > </p>
> > ***************
> > *** 8881,8926 ****
> > <p>
> > ! The table search order is as follows:
> > </p>
> >
> > ! <ul>
> >
> > ! <li> Look up the "user+extension at domain.tld" address including the
> > ! optional address extension.
> > !
> > ! <li> Look up the "user at domain.tld" address without the optional
> > ! address extension.
> >
> > ! <li> Look up the "user+extension" address local part when the
> > ! sender domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > ! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
> >
> > - <li> Look up the "user" address local part when the sender domain
> > - equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
> >
> > ! <li> Look up the "@domain.tld" part.
> >
> > ! </ul>
> >
> > <p>
> > ! Specify the types and names of databases to use. After change,
> > ! run "<b>postmap /etc/postfix/sender_bcc</b>".
> > </p>
> >
> > - <p>
> > - Note: if mail to the BCC address bounces it will be returned to
> > - the sender.
> > - </p>
> >
> > ! <p> Note: automatic BCC recipients are produced only for new mail.
> > ! To avoid mailer loops, automatic BCC recipients are not generated
> > ! after Postfix forwards mail internally, or after Postfix generates
> > ! mail itself. </p>
> >
> > <p>
> > ! Example:
> > </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#sender_bcc_maps">sender_bcc_maps</a> = hash:/etc/postfix/sender_bcc
> > ! </pre>
> >
> > --- 8151,8198 ----
> > <p>
> > ! The default is to comply with <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. If you have to send mail to
> > ! a broken SMTP server, configure a special SMTP client in <a href="master.5.html">master.cf</a>:
> > </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/<a href="master.5.html">master.cf</a>:
> > ! broken-smtp . . . smtp -o <a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>=no
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p>
> > ! and route mail for the destination in question to the "broken-smtp"
> > ! message delivery with a <a href="transport.5.html">transport(5)</a> table.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_randomize_addresses">smtp_randomize_addresses</a>
> > ! (default: yes)</b></DT><DD>
> >
> > <p>
> > ! Randomize the order of equal-preference MX host addresses. This
> > ! is a performance feature of the Postfix SMTP client.
> > </p>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_rcpt_timeout">smtp_rcpt_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > <p>
> > ! The SMTP client time limit for sending the SMTP RCPT TO command, and
> > ! for receiving the server response.
> > </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > ***************
> > *** 8929,8941 ****
> >
> > ! <DT><b><a name="sender_canonical_classes">sender_canonical_classes</a>
> > ! (default: envelope_sender, header_sender)</b></DT><DD>
> > !
> > ! <p> What addresses are subject to <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address
> > ! mapping. By default, <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address mapping is
> > ! applied to envelope sender addresses, and to header sender addresses.
> > ! </p>
> >
> > ! <p> Specify one or more of: envelope_sender, header_sender </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 8201,8211 ----
> >
> > ! <DT><b><a name="smtp_rset_timeout">smtp_rset_timeout</a>
> > ! (default: 20s)</b></DT><DD>
> >
> > ! <p> The SMTP client time limit for sending the RSET command, and
> > ! for receiving the server response. The SMTP client sends RSET in
> > ! order to finish a recipient address probe, or to verify that a
> > ! cached session is still usable. </p>
> >
> > ! <p> This feature is available in Postfix 2.1 and later. </p>
> >
> > ***************
> > *** 8944,8972 ****
> >
> > ! <DT><b><a name="sender_canonical_maps">sender_canonical_maps</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional address mapping lookup tables for envelope and header
> > ! sender addresses.
> > ! The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
> > ! </p>
> >
> > ! <p>
> > ! Example: you want to rewrite the SENDER address "user at ugly.domain"
> > ! to "user at pretty.domain", while still being able to send mail to
> > ! the RECIPIENT address "user at ugly.domain".
> > </p>
> >
> > ! <p>
> > ! Note: $<a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
> > ! </p>
> >
> > ! <p>
> > ! Example:
> > </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> = hash:/etc/postfix/sender_canonical
> > </pre>
> >
> >
> > --- 8214,8253 ----
> >
> > ! <DT><b><a name="smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> An optional table to prevent repeated SASL authentication
> > ! failures with the same remote SMTP server hostname, username and
> > ! password. Each table (key, value) pair contains a server name, a
> > ! username and password, and the full server response. This information
> > ! is stored when a remote SMTP server rejects an authentication attempt
> > ! with a 535 reply code. As long as the <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a>
> > ! information does no change, and as long as the <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
> > ! information does not expire (see <a href="postconf.5.html#smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>) the
> > ! Postfix SMTP client avoids SASL authentication attempts with the
> > ! same server, username and password, and instead bounces or defers
> > ! mail as controlled with the <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> configuration
> > ! parameter. </p>
> >
> > ! <p> Use a per-destination delivery concurrency of 1 (for example,
> > ! "<a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> = 1",
> > ! "<a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> = 1", etc.), otherwise multiple
> > ! delivery agents may experience a login failure at the same time.
> > </p>
> >
> > ! <p> The table must be accessed via the proxywrite service, i.e. the
> > ! map name must start with "<a href="proxymap.8.html">proxy</a>:". The table should be stored under
> > ! the directory specified with the <a href="postconf.5.html#data_directory">data_directory</a> parameter. </p>
> >
> > ! <p> This feature uses cryptographic hashing to protect plain-text
> > ! passwords, and requires that Postfix is compiled with TLS support.
> > </p>
> >
> > + <p> Example: </p>
> > +
> > <pre>
> > ! <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> = <a href="proxymap.8.html">proxy</a>:btree:/var/lib/postfix/sasl_auth_cache
> > </pre>
> >
> > + <p> This feature is available in Postfix 2.5 and later. </p>
> > +
> >
> > ***************
> > *** 8974,8994 ****
> >
> > ! <DT><b><a name="sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> A sender-dependent override for the global <a href="postconf.5.html#default_transport">default_transport</a>
> > ! parameter setting. The tables are searched by the envelope sender
> > ! address and @domain. A lookup result of DUNNO terminates the search
> > ! without overriding the global <a href="postconf.5.html#default_transport">default_transport</a> parameter setting.
> > ! This information is overruled with the <a href="transport.5.html">transport(5)</a> table. </p>
> > !
> > ! <p> Note: this overrides <a href="postconf.5.html#default_transport">default_transport</a>, not <a href="postconf.5.html#transport_maps">transport_maps</a>, and
> > ! therefore the expected syntax is that of <a href="postconf.5.html#default_transport">default_transport</a>, not the
> > ! syntax of <a href="postconf.5.html#transport_maps">transport_maps</a>. Specifically, this does not support the
> > ! <a href="postconf.5.html#transport_maps">transport_maps</a> syntax for null transport, null nexthop, or null
> > ! email addresses. </p>
> >
> > ! <p> For safety reasons, this feature does not allow $number
> > ! substitutions in regular expression maps. </p>
> >
> > ! <p> This feature is available in Postfix 2.7 and later. </p>
> >
> > --- 8255,8263 ----
> >
> > ! <DT><b><a name="smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>
> > ! (default: 90d)</b></DT><DD>
> >
> > ! <p> The maximal age of an <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> entry before it
> > ! is removed. </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 8997,9016 ****
> >
> > ! <DT><b><a name="sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> A sender-dependent override for the global <a href="postconf.5.html#relayhost">relayhost</a> parameter
> > ! setting. The tables are searched by the envelope sender address and
> > ! @domain. A lookup result of DUNNO terminates the search without
> > ! overriding the global <a href="postconf.5.html#relayhost">relayhost</a> parameter setting (Postfix 2.6 and
> > ! later). This information is overruled with <a href="postconf.5.html#relay_transport">relay_transport</a>,
> > ! <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>, <a href="postconf.5.html#default_transport">default_transport</a> and with
> > ! the <a href="transport.5.html">transport(5)</a> table. </p>
> >
> > ! <p> For safety reasons, this feature does not allow $number
> > ! substitutions in regular expression maps. </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.3 and later.
> > </p>
> >
> >
> > --- 8266,8283 ----
> >
> > ! <DT><b><a name="smtp_sasl_auth_enable">smtp_sasl_auth_enable</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Enable SASL authentication in the Postfix SMTP client. By default,
> > ! the Postfix SMTP client uses no authentication.
> > ! </p>
> >
> > <p>
> > ! Example:
> > </p>
> >
> > + <pre>
> > + <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes
> > + </pre>
> > +
> >
> > ***************
> > *** 9018,9044 ****
> >
> > ! <DT><b><a name="sendmail_fix_line_endings">sendmail_fix_line_endings</a>
> > ! (default: always)</b></DT><DD>
> > !
> > ! <p> Controls how the Postfix sendmail command converts email message
> > ! line endings from <CR><LF> into UNIX format (<LF>).
> > ! </p>
> >
> > ! <dl>
> >
> > ! <dt> <b>always</b> </dt> <dd> Always convert message lines ending
> > ! in <CR><LF>. This setting is the default with Postfix
> > ! 2.9 and later. </dd>
> > !
> > ! <dt> <b>strict</b> </dt> <dd> Convert message lines ending in
> > ! <CR><LF> only if the first input line ends in
> > ! <CR><LF>. This setting is backwards-compatible with
> > ! Postfix 2.8 and earlier. </dd>
> >
> > ! <dt> <b>never</b> </dt> <dd> Never convert message lines ending in
> > ! <CR><LF>. This setting exists for completeness only.
> > ! </dd>
> >
> > ! </dl>
> >
> > ! <p> This feature is available in Postfix 2.9 and later. </p>
> >
> > --- 8285,8307 ----
> >
> > ! <DT><b><a name="smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p> When a remote SMTP server rejects a SASL authentication request
> > ! with a 535 reply code, defer mail delivery instead of returning
> > ! mail as undeliverable. The latter behavior was hard-coded prior to
> > ! Postfix version 2.5. </p>
> >
> > ! <p> Note: the setting "yes" overrides the global <a href="postconf.5.html#soft_bounce">soft_bounce</a>
> > ! parameter, but the setting "no" does not. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! # Default as of Postfix 2.5
> > ! <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = yes
> > ! # The old hard-coded default
> > ! <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = no
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 9047,9057 ****
> >
> > ! <DT><b><a name="sendmail_path">sendmail_path</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > <p>
> > ! A Sendmail compatibility feature that specifies the location of
> > ! the Postfix <a href="sendmail.1.html">sendmail(1)</a> command. This command can be used to
> > ! submit mail into the Postfix queue.
> > </p>
> >
> >
> > --- 8310,8340 ----
> >
> > ! <DT><b><a name="smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! If non-empty, a Postfix SMTP client filter for the remote SMTP
> > ! server's list of offered SASL mechanisms. Different client and
> > ! server implementations may support different mechanism lists. By
> > ! default, the Postfix SMTP client will use the intersection of the
> > ! two. <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> further restricts what server
> > ! mechanisms the client will take into consideration. </p>
> > !
> > ! <p> Specify mechanism names, "/file/name" patterns or "<a href="DATABASE_README.html">type:table</a>"
> > ! lookup tables. The right-hand side result from "<a href="DATABASE_README.html">type:table</a>" lookups
> > ! is ignored. Specify "!pattern" to exclude a mechanism name from the
> > ! list. The form "!/file/name" is supported only in Postfix version
> > ! 2.4 and later. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > ! <p>
> > ! Examples:
> > </p>
> >
> > + <pre>
> > + <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = plain, login
> > + <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = /etc/postfix/smtp_mechs
> > + <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = !gssapi, !login, static:rest
> > + </pre>
> > +
> >
> > ***************
> > *** 9059,9066 ****
> >
> > ! <DT><b><a name="service_throttle_time">service_throttle_time</a>
> > ! (default: 60s)</b></DT><DD>
> >
> > <p>
> > ! How long the Postfix <a href="master.8.html">master(8)</a> waits before forking a server that
> > ! appears to be malfunctioning.
> > </p>
> > --- 8342,8352 ----
> >
> > ! <DT><b><a name="smtp_sasl_password_maps">smtp_sasl_password_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional SMTP client lookup tables with one username:password entry
> > ! per remote hostname or domain, or sender address when sender-dependent
> > ! authentication is enabled. If no username:password entry is found,
> > ! then the Postfix SMTP client will not
> > ! attempt to authenticate to the remote host.
> > </p>
> > ***************
> > *** 9068,9071 ****
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> > --- 8354,8357 ----
> > <p>
> > ! The Postfix SMTP client opens the lookup table before going to
> > ! chroot jail, so you can leave the password file in /etc/postfix.
> > </p>
> > ***************
> > *** 9075,9085 ****
> >
> > ! <DT><b><a name="setgid_group">setgid_group</a>
> > ! (default: postdrop)</b></DT><DD>
> >
> > ! <p>
> > ! The group ownership of set-gid Postfix commands and of group-writable
> > ! Postfix directories. When this parameter value is changed you need
> > ! to re-run "<b>postfix set-permissions</b>" (with Postfix version 2.0 and
> > ! earlier: "<b>/etc/postfix/post-install set-permissions</b>".
> > ! </p>
> >
> > --- 8361,8372 ----
> >
> > ! <DT><b><a name="smtp_sasl_path">smtp_sasl_path</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Implementation-specific information that the Postfix SMTP client
> > ! passes through to
> > ! the SASL plug-in implementation that is selected with
> > ! <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>. Typically this specifies the name of a
> > ! configuration file or rendezvous point. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 9088,9147 ****
> >
> > ! <DT><b><a name="show_user_unknown_table_name">show_user_unknown_table_name</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p>
> > ! Display the name of the recipient table in the "User unknown"
> > ! responses. The extra detail makes trouble shooting easier but also
> > ! reveals information that is nobody elses business.
> > ! </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > </p>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="showq_service_name">showq_service_name</a>
> > ! (default: showq)</b></DT><DD>
> >
> > ! <p>
> > ! The name of the <a href="showq.8.html">showq(8)</a> service. This service produces mail queue
> > ! status reports.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_address_preference">smtp_address_preference</a>
> > ! (default: any)</b></DT><DD>
> >
> > ! <p> The address type ("ipv6", "ipv4" or "any") that the Postfix
> > ! SMTP client will try first, when a destination has IPv6 and IPv4
> > ! addresses with equal MX preference. This feature has no effect
> > ! unless the <a href="postconf.5.html#inet_protocols">inet_protocols</a> setting enables both IPv4 and IPv6.
> > ! With Postfix 2.8 the default is "ipv6". </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_always_send_ehlo">smtp_always_send_ehlo</a>
> > ! (default: yes)</b></DT><DD>
> >
> > <p>
> > ! Always send EHLO at the start of an SMTP session.
> > </p>
> >
> > ! <p>
> > ! With "<a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> = no", the Postfix SMTP client sends
> > ! EHLO only when
> > ! the word "ESMTP" appears in the server greeting banner (example:
> > ! 220 spike.porcupine.org ESMTP Postfix).
> > ! </p>
> >
> > --- 8375,8424 ----
> >
> > ! <DT><b><a name="smtp_sasl_security_options">smtp_sasl_security_options</a>
> > ! (default: noplaintext, noanonymous)</b></DT><DD>
> >
> > ! <p> Postfix SMTP client SASL security options; as of Postfix 2.3
> > ! the list of available
> > ! features depends on the SASL client implementation that is selected
> > ! with <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>. </p>
> > !
> > ! <p> The following security features are defined for the <b>cyrus</b>
> > ! client SASL implementation: </p>
> >
> > <p>
> > ! Specify zero or more of the following:
> > </p>
> >
> > + <dl>
> >
> > ! <dt><b>noplaintext</b></dt>
> >
> > ! <dd>Disallow methods that use plaintext passwords. </dd>
> >
> > ! <dt><b>noactive</b></dt>
> >
> > + <dd>Disallow methods subject to active (non-dictionary) attack.
> > + </dd>
> >
> > ! <dt><b>nodictionary</b></dt>
> >
> > ! <dd>Disallow methods subject to passive (dictionary) attack. </dd>
> >
> > ! <dt><b>noanonymous</b></dt>
> >
> > ! <dd>Disallow methods that allow anonymous authentication. </dd>
> >
> > + <dt><b>mutual_auth</b></dt>
> >
> > ! <dd>Only allow methods that provide mutual authentication (not
> > ! available with SASL version 1). </dd>
> >
> > ! </dl>
> >
> > <p>
> > ! Example:
> > </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a> = noplaintext
> > ! </pre>
> >
> > ***************
> > *** 9150,9180 ****
> >
> > ! <DT><b><a name="smtp_bind_address">smtp_bind_address</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p>
> > ! An optional numerical network address that the Postfix SMTP client
> > ! should bind to when making an IPv4 connection.
> > ! </p>
> > !
> > ! <p>
> > ! This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
> > ! it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
> > ! for example:
> > ! </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/<a href="master.5.html">master.cf</a>:
> > ! smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>=11.22.33.44
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv4
> > ! address, and that address is a non-loopback address, it is
> > ! automatically used as the <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>. This supports virtual
> > ! IP hosting, but can be a problem on multi-homed firewalls. See the
> > ! <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
> >
> > ! <p> Note 2: address information may be enclosed inside <tt>[]</tt>,
> > ! but this form is not required here. </p>
> >
> > --- 8427,8435 ----
> >
> > ! <DT><b><a name="smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>
> > ! (default: $<a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a>)</b></DT><DD>
> >
> > ! <p> The SASL authentication security options that the Postfix SMTP
> > ! client uses for TLS encrypted SMTP sessions. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 9183,9215 ****
> >
> > ! <DT><b><a name="smtp_bind_address6">smtp_bind_address6</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! An optional numerical network address that the Postfix SMTP client
> > ! should bind to when making an IPv6 connection.
> > ! </p>
> >
> > - <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ! <p>
> > ! This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
> > ! it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
> > ! for example:
> > ! </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/<a href="master.5.html">master.cf</a>:
> > ! smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>=1:2:3:4:5:6:7:8
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv6
> > ! address, and that address is a non-loopback address, it is
> > ! automatically used as the <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>. This supports virtual
> > ! IP hosting, but can be a problem on multi-homed firewalls. See the
> > ! <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
> >
> > ! <p> Note 2: address information may be enclosed inside <tt>[]</tt>,
> > ! but this form is not recommended here. </p>
> >
> > --- 8438,8458 ----
> >
> > ! <DT><b><a name="smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a>
> > ! (default: $<a href="postconf.5.html#smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>)</b></DT><DD>
> >
> > ! <p> The SASL authentication security options that the Postfix SMTP
> > ! client uses for TLS encrypted SMTP sessions with a verified server
> > ! certificate. This feature is under construction as of Postfix version
> > ! 2.3. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_sasl_type">smtp_sasl_type</a>
> > ! (default: cyrus)</b></DT><DD>
> >
> > ! <p> The SASL plug-in type that the Postfix SMTP client should use
> > ! for authentication. The available types are listed with the
> > ! "<b>postconf -A</b>" command. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 9218,9228 ****
> >
> > ! <DT><b><a name="smtp_body_checks">smtp_body_checks</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Restricted <a href="header_checks.5.html">body_checks(5)</a> tables for the Postfix SMTP client.
> > ! These tables are searched while mail is being delivered. Actions
> > ! that change the delivery time or destination are not available.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > --- 8461,8481 ----
> >
> > ! <DT><b><a name="smtp_send_xforward_command">smtp_send_xforward_command</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Send the non-standard XFORWARD command when the Postfix SMTP server
> > ! EHLO response announces XFORWARD support.
> > </p>
> >
> > ! <p>
> > ! This allows an "smtp" delivery agent, used for injecting mail into
> > ! a content filter, to forward the name, address, protocol and HELO
> > ! name of the original client to the content filter and downstream
> > ! queuing SMTP server. This can produce more useful logging than
> > ! localhost[127.0.0.1] etc.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > ***************
> > *** 9231,9244 ****
> >
> > ! <DT><b><a name="smtp_cname_overrides_servername">smtp_cname_overrides_servername</a>
> > ! (default: version dependent)</b></DT><DD>
> >
> > ! <p> Allow DNS CNAME records to override the servername that the
> > ! Postfix SMTP client uses for logging, SASL password lookup, TLS
> > ! policy decisions, or TLS certificate verification. The value "no"
> > ! hardens Postfix <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> hostname-based policies against
> > ! false hostname information in DNS CNAME records, and makes SASL
> > ! password file lookups more predictable. This is the default setting
> > ! as of Postfix 2.3. </p>
> >
> > ! <p> This feature is available in Postfix 2.2.9 and later. </p>
> >
> > --- 8484,8497 ----
> >
> > ! <DT><b><a name="smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Enable sender-dependent authentication in the Postfix SMTP client; this is
> > ! available only with SASL authentication, and disables SMTP connection
> > ! caching to ensure that mail from different senders will use the
> > ! appropriate credentials. </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.3 and later.
> > ! </p>
> >
> > ***************
> > *** 9247,9254 ****
> >
> > ! <DT><b><a name="smtp_connect_timeout">smtp_connect_timeout</a>
> > ! (default: 30s)</b></DT><DD>
> >
> > <p>
> > ! The Postfix SMTP client time limit for completing a TCP connection, or
> > ! zero (use the operating system built-in time limit).
> > </p>
> > --- 8500,8507 ----
> >
> > ! <DT><b><a name="smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a>
> > ! (default: yes)</b></DT><DD>
> >
> > <p>
> > ! Skip SMTP servers that greet with a 4XX status code (go away, try
> > ! again later).
> > </p>
> > ***************
> > *** 9256,9268 ****
> > <p>
> > ! When no connection can be made within the deadline, the Postfix
> > ! SMTP client
> > ! tries the next address on the mail exchanger list. Specify 0 to
> > ! disable the time limit (i.e. use whatever timeout is implemented by
> > ! the operating system).
> > </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > --- 8509,8518 ----
> > <p>
> > ! By default, Postfix moves on the next mail exchanger. Specify
> > ! "<a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> = no" if Postfix should defer delivery
> > ! immediately.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.0 and earlier.
> > ! Later Postfix versions always skip SMTP servers that greet with a
> > ! 4XX status code. </p>
> >
> > ***************
> > *** 9271,9308 ****
> >
> > ! <DT><b><a name="smtp_connection_cache_destinations">smtp_connection_cache_destinations</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Permanently enable SMTP connection caching for the specified
> > ! destinations. With SMTP connection caching, a connection is not
> > ! closed immediately after completion of a mail transaction. Instead,
> > ! the connection is kept open for up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
> > ! seconds. This allows connections to be reused for other deliveries,
> > ! and can improve mail delivery performance. </p>
> >
> > ! <p> Specify a comma or white space separated list of destinations
> > ! or pseudo-destinations: </p>
> >
> > - <ul>
> >
> > ! <li> if mail is sent without a <a href="postconf.5.html#relayhost">relay host</a>: a domain name (the
> > ! right-hand side of an email address, without the [] around a numeric
> > ! IP address),
> >
> > ! <li> if mail is sent via a <a href="postconf.5.html#relayhost">relay host</a>: a <a href="postconf.5.html#relayhost">relay host</a> name (without
> > ! [] or non-default TCP port), as specified in <a href="postconf.5.html">main.cf</a> or in the
> > ! transport map,
> >
> > ! <li> if mail is sent via a UNIX-domain socket: a pathname (without
> > ! the unix: prefix),
> >
> > - <li> a /file/name with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names as
> > - defined above,
> >
> > ! <li> a "<a href="DATABASE_README.html">type:table</a>" with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names on
> > ! the left-hand side. The right-hand side result from "<a href="DATABASE_README.html">type:table</a>"
> > ! lookups is ignored.
> >
> > ! </ul>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 8521,8555 ----
> >
> > ! <DT><b><a name="smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p>
> > ! Skip SMTP servers that greet with a 5XX status code (go away, do
> > ! not try again later).
> > ! </p>
> >
> > ! <p> By default, the Postfix SMTP client moves on the next mail
> > ! exchanger. Specify "<a href="postconf.5.html#smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a> = no" if Postfix should
> > ! bounce the mail immediately. The default setting is incorrect, but
> > ! it is what a lot of people expect to happen. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_skip_quit_response">smtp_skip_quit_response</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p>
> > ! Do not wait for the response to the SMTP QUIT command.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_starttls_timeout">smtp_starttls_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p> Time limit for Postfix SMTP client write and read operations
> > ! during TLS startup and shutdown handshake procedures. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 9311,9350 ****
> >
> > ! <DT><b><a name="smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p> Temporarily enable SMTP connection caching while a destination
> > ! has a high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>. With SMTP connection
> > ! caching, a connection is not closed immediately after completion
> > ! of a mail transaction. Instead, the connection is kept open for
> > ! up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a> seconds. This allows
> > ! connections to be reused for other deliveries, and can improve mail
> > ! delivery performance. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > - <DT><b><a name="smtp_connection_cache_reuse_limit">smtp_connection_cache_reuse_limit</a>
> > - (default: 10)</b></DT><DD>
> >
> > ! <p> When SMTP connection caching is enabled, the number of times that
> > ! an SMTP session may be reused before it is closed.
> > ! </p>
> >
> > ! <p> This feature is available in Postfix 2.2. In Postfix 2.3 it is
> > ! replaced by $<a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>.</p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
> > ! (default: 2s)</b></DT><DD>
> >
> > ! <p> When SMTP connection caching is enabled, the amount of time that
> > ! an unused SMTP client socket is kept open before it is closed. Do
> > ! not specify larger values without permission from the remote sites.
> > ! </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 8558,8597 ----
> >
> > ! <DT><b><a name="smtp_tls_CAfile">smtp_tls_CAfile</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> The file with the certificate of the certification authority
> > ! (CA) that issued the Postfix SMTP client certificate. This is
> > ! needed only when the CA certificate is not already present in the
> > ! client certificate file. </p>
> >
> > ! <p> Example: </p>
> >
> > + <pre>
> > + <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> = /etc/postfix/CAcert.pem
> > + </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_tls_CApath">smtp_tls_CApath</a>
> > ! (default: empty)</b></DT><DD>
> >
> > + <p> Directory with PEM format certificate authority certificates
> > + that the Postfix SMTP client uses to verify a remote SMTP server
> > + certificate. Don't forget to create the necessary "hash" links
> > + with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
> > + </p>
> >
> > ! <p> To use this option in chroot mode, this directory (or a copy)
> > ! must be inside the chroot jail. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> = /etc/postfix/certs
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 9353,9423 ****
> >
> > ! <DT><b><a name="smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p> The amount of time during which Postfix will use an SMTP
> > ! connection repeatedly. The timer starts when the connection is
> > ! initiated (i.e. it includes the connect, greeting and helo latency,
> > ! in addition to the latencies of subsequent mail delivery transactions).
> > ! </p>
> >
> > ! <p> This feature addresses a performance stability problem with
> > ! remote SMTP servers. This problem is not specific to Postfix: it
> > ! can happen when any MTA sends large amounts of SMTP email to a site
> > ! that has multiple MX hosts. </p>
> >
> > ! <p> The problem starts when one of a set of MX hosts becomes slower
> > ! than the rest. Even though SMTP clients connect to fast and slow
> > ! MX hosts with equal probability, the slow MX host ends up with more
> > ! simultaneous inbound connections than the faster MX hosts, because
> > ! the slow MX host needs more time to serve each client request. </p>
> > !
> > ! <p> The slow MX host becomes a connection attractor. If one MX
> > ! host becomes N times slower than the rest, it dominates mail delivery
> > ! latency unless there are more than N fast MX hosts to counter the
> > ! effect. And if the number of MX hosts is smaller than N, the mail
> > ! delivery latency becomes effectively that of the slowest MX host
> > ! divided by the total number of MX hosts. </p>
> > !
> > ! <p> The solution uses connection caching in a way that differs from
> > ! Postfix version 2.2. By limiting the amount of time during which a connection
> > ! can be used repeatedly (instead of limiting the number of deliveries
> > ! over that connection), Postfix not only restores fairness in the
> > ! distribution of simultaneous connections across a set of MX hosts,
> > ! it also favors deliveries over connections that perform well, which
> > ! is exactly what we want. </p>
> >
> > ! <p> The default reuse time limit, 300s, is comparable to the various
> > ! smtp transaction timeouts which are fair estimates of maximum excess
> > ! latency for a slow delivery. Note that hosts may accept thousands
> > ! of messages over a single connection within the default connection
> > ! reuse time limit. This number is much larger than the default Postfix
> > ! version 2.2 limit of 10 messages per cached connection. It may prove necessary
> > ! to lower the limit to avoid interoperability issues with MTAs that
> > ! exhibit bugs when many messages are delivered via a single connection.
> > ! A lower reuse time limit risks losing the benefit of connection
> > ! reuse when the average connection and mail delivery latency exceeds
> > ! the reuse time limit. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_data_done_timeout">smtp_data_done_timeout</a>
> > ! (default: 600s)</b></DT><DD>
> >
> > ! <p>
> > ! The Postfix SMTP client time limit for sending the SMTP ".", and
> > ! for receiving the remote SMTP server response.
> > ! </p>
> >
> > ! <p>
> > ! When no response is received within the deadline, a warning is
> > ! logged that the mail may be delivered multiple times.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > --- 8600,8651 ----
> >
> > ! <DT><b><a name="smtp_tls_cert_file">smtp_tls_cert_file</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> File with the Postfix SMTP client RSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP client private RSA key,
> > ! and these may be the same as the Postfix SMTP server RSA certificate and key
> > ! file. </p>
> >
> > ! <p> Do not configure client certificates unless you <b>must</b> present
> > ! client TLS certificates to one or more servers. Client certificates are
> > ! not usually needed, and can cause problems in configurations that work
> > ! well without them. The recommended setting is to let the defaults stand: </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> =
> > ! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> =
> > ! <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> =
> > ! <a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a> =
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> The best way to use the default settings is to comment out the above
> > ! parameters in <a href="postconf.5.html">main.cf</a> if present. </p>
> >
> > ! <p> In order to verify certificates, the CA certificate (in case
> > ! of a certificate chain, all CA certificates) must be available.
> > ! You should add these certificates to the client certificate, the
> > ! client certificate first, then the issuing CA(s). </p>
> >
> > + <p> Example: the certificate for "client.dom.ain" was issued by
> > + "intermediate CA" which itself has a certificate of "root CA".
> > + Create the client.pem file with "cat client_cert.pem intermediate_CA.pem
> > + root_CA.pem > client.pem". </p>
> >
> > ! <p> If you also want to verify remote SMTP server certificates issued by
> > ! these CAs, you can also add the CA certificates to the <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>,
> > ! in which case it is not necessary to have them in the <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>
> > ! or <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>. </p>
> >
> > ! <p> A certificate supplied here must be usable as an SSL client certificate
> > ! and hence pass the "openssl verify -purpose sslclient ..." test. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> = /etc/postfix/client.pem
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 9426,9456 ****
> >
> > ! <DT><b><a name="smtp_data_init_timeout">smtp_data_init_timeout</a>
> > ! (default: 120s)</b></DT><DD>
> > !
> > ! <p>
> > ! The Postfix SMTP client time limit for sending the SMTP DATA command,
> > ! and for receiving the remote SMTP server response.
> > ! </p>
> > !
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> > !
> > !
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
> > ! (default: 180s)</b></DT><DD>
> >
> > ! <p>
> > ! The Postfix SMTP client time limit for sending the SMTP message content.
> > ! When the connection makes no progress for more than $<a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
> > ! seconds the Postfix SMTP client terminates the transfer.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > --- 8654,8671 ----
> >
> > ! <DT><b><a name="smtp_tls_cipherlist">smtp_tls_cipherlist</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Obsolete Postfix < 2.3 control for the Postfix SMTP client TLS
> > ! cipher list. As this feature applies to all TLS security levels, it is easy
> > ! to create inter-operability problems by choosing a non-default cipher
> > ! list. Do not use a non-default TLS cipher list on hosts that deliver email
> > ! to the public Internet: you will be unable to send email to servers that
> > ! only support the ciphers you exclude. Using a restricted cipher list
> > ! may be more appropriate for an internal MTA, where one can exert some
> > ! control over the TLS software and settings of the peer servers. </p>
> >
> > ! <p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
> >
> > ! <p> This feature is available in Postfix version 2.2. It is not used with
> > ! Postfix 2.3 and later; use <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> instead. </p>
> >
> > ***************
> > *** 9459,9482 ****
> >
> > ! <DT><b><a name="smtp_defer_if_no_mx_address_found">smtp_defer_if_no_mx_address_found</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Defer mail delivery when no MX record resolves to an IP address.
> > ! </p>
> >
> > ! <p>
> > ! The default (no) is to return the mail as undeliverable. With older
> > ! Postfix versions the default was to keep trying to deliver the mail
> > ! until someone fixed the MX record or until the mail was too old.
> > </p>
> >
> > ! <p>
> > ! Note: the Postfix SMTP client always ignores MX records with equal
> > ! or worse preference
> > ! than the local MTA itself.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > --- 8674,8691 ----
> >
> > ! <DT><b><a name="smtp_tls_dcert_file">smtp_tls_dcert_file</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> File with the Postfix SMTP client DSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP client private DSA key. </p>
> >
> > ! <p> See the discussion under <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for more details.
> > </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> = /etc/postfix/client-dsa.pem
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 9485,9523 ****
> >
> > ! <DT><b><a name="smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a>
> > ! (default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
> > !
> > ! <p> The maximal number of parallel deliveries to the same destination
> > ! via the smtp message delivery transport. This limit is enforced by
> > ! the queue manager. The message delivery transport name is the first
> > ! field in the entry in the <a href="master.5.html">master.cf</a> file. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_destination_recipient_limit">smtp_destination_recipient_limit</a>
> > ! (default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
> >
> > - <p> The maximal number of recipients per message for the smtp
> > - message delivery transport. This limit is enforced by the queue
> > - manager. The message delivery transport name is the first field in
> > - the entry in the <a href="master.5.html">master.cf</a> file. </p>
> >
> > ! <p> Setting this parameter to a value of 1 changes the meaning of
> > ! <a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> from concurrency per domain
> > ! into concurrency per recipient. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Lookup tables, indexed by the remote SMTP server address, with
> > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
> > ! etc.) that the Postfix SMTP client will ignore in the EHLO response from a
> > ! remote SMTP server. See <a href="postconf.5.html#smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a> for details. The
> > ! table is not indexed by hostname for consistency with
> > ! <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 8694,8730 ----
> >
> > ! <DT><b><a name="smtp_tls_dkey_file">smtp_tls_dkey_file</a>
> > ! (default: $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>)</b></DT><DD>
> >
> > + <p> File with the Postfix SMTP client DSA private key in PEM format.
> > + This file may be combined with the Postfix SMTP client DSA certificate
> > + file specified with $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>. </p>
> >
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted, but file permissions should grant read/write
> > ! access only to the system superuser account ("root"). </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > + <DT><b><a name="smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
> > + (default: yes)</b></DT><DD>
> >
> > ! <p> With mandatory TLS encryption, require that the remote SMTP
> > ! server hostname matches the information in the remote SMTP server
> > ! certificate. As of <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> the requirements for hostname checking
> > ! for MTA clients are not specified. </p>
> >
> > ! <p> This option can be set to "no" to disable strict peer name
> > ! checking. This setting has no effect on sessions that are controlled
> > ! via the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table. </p>
> >
> > ! <p> Disabling the hostname verification can make sense in closed
> > ! environment where special CAs are created. If not used carefully,
> > ! this option opens the danger of a "man-in-the-middle" attack (the
> > ! CommonName of this attacker will be logged). </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
> >
> > ***************
> > *** 9526,9547 ****
> >
> > ! <DT><b><a name="smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
> > ! auth, etc.) that the Postfix SMTP client will ignore in the EHLO
> > ! response from a remote SMTP server. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > ! <p> Notes: </p>
> >
> > ! <ul>
> >
> > ! <li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
> > ! this action from being logged. </p>
> >
> > ! <li> <p> Use the <a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a> feature to
> > ! discard EHLO keywords selectively. </p>
> >
> > ! </ul>
> >
> > --- 8733,8764 ----
> >
> > ! <DT><b><a name="smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> List of ciphers or cipher types to exclude from the Postfix
> > ! SMTP client cipher
> > ! list at all TLS security levels. This is not an OpenSSL cipherlist, it is
> > ! a simple list separated by whitespace and/or commas. The elements are a
> > ! single cipher, or one or more "+" separated cipher properties, in which
> > ! case only ciphers matching <b>all</b> the properties are excluded. </p>
> >
> > ! <p> Examples (some of these will cause problems): </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = aNULL
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = MD5, DES
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = DES+MD5
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = kEDH+aRSA
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> The first setting, disables anonymous ciphers. The next setting
> > ! disables ciphers that use the MD5 digest algorithm or the (single) DES
> > ! encryption algorithm. The next setting disables ciphers that use MD5 and
> > ! DES together. The next setting disables the two ciphers "AES256-SHA"
> > ! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
> > ! key exchange with RSA authentication. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 9550,9576 ****
> >
> > ! <DT><b><a name="smtp_dns_resolver_options">smtp_dns_resolver_options</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> DNS Resolver options for the Postfix SMTP client. Specify zero
> > ! or more of the following options, separated by comma or whitespace.
> > ! Option names are case-sensitive. Some options refer to domain names
> > ! that are specified in the file /etc/resolv.conf or equivalent. </p>
> >
> > ! <dl>
> >
> > ! <dt><b>res_defnames</b></dt>
> >
> > ! <dd> Append the current domain name to single-component names (those
> > ! that do not contain a "." character). This can produce incorrect
> > ! results, and is the hard-coded behavior prior to Postfix 2.8. </dd>
> >
> > ! <dt><b>res_dnsrch</b></dt>
> >
> > ! <dd> Search for host names in the current domain and in parent
> > ! domains. This can produce incorrect results and is therefore not
> > ! recommended. </dd>
> >
> > ! </dl>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 8767,8825 ----
> >
> > ! <DT><b><a name="smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> List of acceptable remote SMTP server certificate fingerprints
> > ! for the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> =
> > ! fingerprint). At this security level, certificate authorities are
> > ! not used, and certificate expiration times are ignored. Instead,
> > ! server certificates are verified directly via their "fingerprint". The
> > ! fingerprint is a message digest of the server certificate. The digest
> > ! algorithm is selected via the <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b>
> > ! parameter. </p>
> >
> > ! <p> When an <b><a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a></b> table entry specifies the
> > ! "fingerprint" security level, any "match" attributes in that entry specify
> > ! the list of valid fingerprints for the corresponding destination. Multiple
> > ! fingerprints can be combined with a "|" delimiter in a single match
> > ! attribute, or multiple match attributes can be employed. </p>
> >
> > ! <p> Example: Certificate fingerprint verification with internal mailhub.
> > ! Two matching fingerprints are listed. The <a href="postconf.5.html#relayhost">relayhost</a> may be multiple
> > ! physical hosts behind a load-balancer, each with its own private/public
> > ! key and self-signed certificate. Alternatively, a single <a href="postconf.5.html#relayhost">relayhost</a> may
> > ! be in the process of switching from one set of private/public keys to
> > ! another, and both keys are trusted just prior to the transition. </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
> > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
> > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> Example: Certificate fingerprint verification with selected destinations.
> > ! As in the example above, we show two matching fingerprints: </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = hash:/etc/postfix/tls_policy
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
> > ! </pre>
> > ! </blockquote>
> >
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/tls_policy:
> > ! example.com fingerprint
> > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
> > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 9579,9661 ****
> >
> > ! <DT><b><a name="smtp_enforce_tls">smtp_enforce_tls</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> Enforcement mode: require that remote SMTP servers use TLS
> > ! encryption, and never send mail in the clear. This also requires
> > ! that the remote SMTP server hostname matches the information in
> > ! the remote server certificate, and that the remote SMTP server
> > ! certificate was issued by a CA that is trusted by the Postfix SMTP
> > ! client. If the certificate doesn't verify or the hostname doesn't
> > ! match, delivery is deferred and mail stays in the queue. </p>
> > !
> > ! <p> The server hostname is matched against all names provided as
> > ! dNSNames in the SubjectAlternativeName. If no dNSNames are specified,
> > ! the CommonName is checked. The behavior may be changed with the
> > ! <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> option. </p>
> > !
> > ! <p> This option is useful only if you are definitely sure that you
> > ! will only connect to servers that support <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> _and_ that
> > ! provide valid server certificates. Typical use is for clients that
> > ! send all their email to a dedicated mailhub. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
> > !
> > !
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_fallback_relay">smtp_fallback_relay</a>
> > ! (default: $<a href="postconf.5.html#fallback_relay">fallback_relay</a>)</b></DT><DD>
> >
> > ! <p>
> > ! Optional list of relay hosts for SMTP destinations that can't be
> > ! found or that are unreachable. With Postfix 2.2 and earlier this
> > ! parameter is called <a href="postconf.5.html#fallback_relay">fallback_relay</a>. </p>
> >
> > ! <p>
> > ! By default, mail is returned to the sender when a destination is
> > ! not found, and delivery is deferred when a destination is unreachable.
> > </p>
> >
> > ! <p> The fallback relays must be SMTP destinations. Specify a domain,
> > ! host, host:port, [host]:port, [address] or [address]:port; the form
> > ! [host] turns off MX lookups. If you specify multiple SMTP
> > ! destinations, Postfix will try them in the specified order. </p>
> >
> > ! <p> To prevent mailer loops between MX hosts and fall-back hosts,
> > ! Postfix version 2.2 and later will not use the fallback relays for
> > ! destinations that it is MX host for (assuming DNS lookup is turned on).
> > </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_generic_maps">smtp_generic_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > - <p> Optional lookup tables that perform address rewriting in the
> > - Postfix SMTP client, typically to transform a locally valid address into
> > - a globally valid address when sending mail across the Internet.
> > - This is needed when the local machine does not have its own Internet
> > - domain name, but uses something like <i>localdomain.local</i>
> > - instead. </p>
> >
> > ! <p> The table format and lookups are documented in <a href="generic.5.html">generic(5)</a>;
> > ! examples are shown in the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> and
> > ! <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> documents. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_header_checks">smtp_header_checks</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Restricted <a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP client.
> > ! These tables are searched while mail is being delivered. Actions
> > ! that change the delivery time or destination are not available.
> > ! </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > --- 8828,8898 ----
> >
> > ! <DT><b><a name="smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a>
> > ! (default: md5)</b></DT><DD>
> >
> > ! <p> The message digest algorithm used to construct remote SMTP server
> > ! certificate fingerprints. At the "fingerprint" TLS security level
> > ! (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> = fingerprint), the server certificate is
> > ! verified by directly matching its <i>fingerprint</i>. The fingerprint
> > ! is the message digest of the server certificate using the selected
> > ! algorithm. With a digest algorithm resistant to "second pre-image"
> > ! attacks, it is not feasible to create a new public key and a matching
> > ! certificate that has the same fingerprint. </p>
> >
> > ! <p> The default algorithm is <b>md5</b>; this is consistent with
> > ! the backwards compatible setting of the digest used to verify client
> > ! certificates in the SMTP server. </p>
> >
> > ! <p> The best practice algorithm is now <b>sha1</b>. Recent advances in hash
> > ! function cryptanalysis have led to md5 being deprecated in favor of sha1.
> > ! However, as long as there are no known "second pre-image" attacks
> > ! against md5, its use in this context can still be considered safe.
> > </p>
> >
> > ! <p> While additional digest algorithms are often available with OpenSSL's
> > ! libcrypto, only those used by libssl in SSL cipher suites are available to
> > ! Postfix. For now this means just md5 or sha1. </p>
> >
> > ! <p> To find the fingerprint of a specific certificate file, with a
> > ! specific digest algorithm, run:
> > </p>
> >
> > + <blockquote>
> > + <pre>
> > + $ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
> > + </pre>
> > + </blockquote>
> > +
> > + <p> The text to the right of "=" sign is the desired fingerprint.
> > + For example: </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem
> > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_tls_key_file">smtp_tls_key_file</a>
> > ! (default: $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>)</b></DT><DD>
> >
> > + <p> File with the Postfix SMTP client RSA private key in PEM format.
> > + This file may be combined with the Postfix SMTP client RSA certificate
> > + file specified with $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>. </p>
> >
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted, but file permissions should grant read/write
> > ! access only to the system superuser account ("root"). </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> = $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 9664,9709 ****
> >
> > ! <DT><b><a name="smtp_helo_name">smtp_helo_name</a>
> > ! (default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
> >
> > ! <p>
> > ! The hostname to send in the SMTP EHLO or HELO command.
> > ! </p>
> >
> > ! <p>
> > ! The default value is the machine hostname. Specify a hostname or
> > ! [ip.add.re.ss].
> > ! </p>
> >
> > ! <p>
> > ! This information can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP
> > ! clients, or it can be specified in the <a href="master.5.html">master.cf</a> file for a specific
> > ! client, for example:
> > ! </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/<a href="master.5.html">master.cf</a>:
> > ! mysmtp ... smtp -o <a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a>=foo.bar.com
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_helo_timeout">smtp_helo_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p>
> > ! The Postfix SMTP client time limit for sending the HELO or EHLO command,
> > ! and for receiving the initial remote SMTP server response.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > --- 8901,8929 ----
> >
> > ! <DT><b><a name="smtp_tls_loglevel">smtp_tls_loglevel</a>
> > ! (default: 0)</b></DT><DD>
> >
> > ! <p> Enable additional Postfix SMTP client logging of TLS activity.
> > ! Each logging level also includes the information that is logged at
> > ! a lower logging level. </p>
> >
> > ! <dl compact>
> >
> > ! <dt> </dt> <dd> 0 Disable logging of TLS activity. </dd>
> >
> > ! <dt> </dt> <dd> 1 Log TLS handshake and certificate information. </dd>
> >
> > ! <dt> </dt> <dd> 2 Log levels during TLS negotiation. </dd>
> >
> > + <dt> </dt> <dd> 3 Log hexadecimal and ASCII dump of TLS negotiation
> > + process. </dd>
> >
> > ! <dt> </dt> <dd> 4 Log hexadecimal and ASCII dump of complete
> > ! transmission after STARTTLS. </dd>
> >
> > ! </dl>
> >
> > ! <p> Use "<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> = 3" only in case of problems. Use of
> > ! loglevel 4 is strongly discouraged. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 9712,9740 ****
> >
> > ! <DT><b><a name="smtp_host_lookup">smtp_host_lookup</a>
> > ! (default: dns)</b></DT><DD>
> >
> > ! <p>
> > ! What mechanisms the Postfix SMTP client uses to look up a host's IP
> > ! address. This parameter is ignored when DNS lookups are disabled
> > ! (see: <a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a>).
> > ! </p>
> >
> > ! <p>
> > ! Specify one of the following:
> > ! </p>
> >
> > <dl>
> >
> > ! <dt><b>dns</b></dt>
> > !
> > ! <dd>Hosts can be found in the DNS (preferred). </dd>
> > !
> > ! <dt><b>native</b></dt>
> >
> > ! <dd>Use the native naming service only (nsswitch.conf, or equivalent
> > ! mechanism). </dd>
> >
> > ! <dt><b>dns, native</b></dt>
> >
> > ! <dd>Use the native service for hosts not found in the DNS. </dd>
> >
> > --- 8932,9001 ----
> >
> > ! <DT><b><a name="smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>
> > ! (default: medium)</b></DT><DD>
> >
> > ! <p> The minimum TLS cipher grade that the Postfix SMTP client will
> > ! use with
> > ! mandatory TLS encryption. The default value "medium" is suitable
> > ! for most destinations with which you may want to enforce TLS, and
> > ! is beyond the reach of today's crypt-analytic methods. See
> > ! <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure ciphers
> > ! on a per-destination basis. </p>
> >
> > ! <p> The following cipher grades are supported: </p>
> >
> > <dl>
> > + <dt><b>export</b></dt>
> > + <dd> Enable the mainstream "EXPORT" grade or better OpenSSL
> > + ciphers. This is always used for opportunistic encryption. It is
> > + not recommended for mandatory encryption unless you must enforce TLS
> > + with "crippled" peers. The underlying cipherlist is specified via the
> > + <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter, which you are strongly
> > + encouraged to not change. The default value of <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a>
> > + includes anonymous ciphers, but these are automatically filtered out if
> > + the client is configured to verify server certificates. If you must
> > + exclude anonymous ciphers also at the "encrypt" security level, set
> > + "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
> >
> > ! <dt><b>low</b></dt>
> > ! <dd> Enable the mainstream "LOW" grade or better OpenSSL ciphers. This
> > ! setting is only appropriate for internal mail servers. The underlying
> > ! cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration
> > ! parameter, which you are strongly encouraged to not change. The default
> > ! value of <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> includes anonymous ciphers, but these are
> > ! automatically filtered out if the client is configured to verify server
> > ! certificates. If you must exclude anonymous ciphers also at the "encrypt"
> > ! security level, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
> >
> > ! <dt><b>medium</b></dt>
> > ! <dd> Enable the mainstream "MEDIUM" grade or better OpenSSL ciphers.
> > ! The underlying cipherlist is specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
> > ! configuration parameter, which you are strongly encouraged to not change.
> > ! The default value of <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> includes anonymous ciphers,
> > ! but these are automatically filtered out if the client is configured to
> > ! verify server certificates. If you must exclude anonymous ciphers also
> > ! at the "encrypt" security level, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>
> > ! = aNULL". </dd>
> >
> > ! <dt><b>high</b></dt>
> > ! <dd> Enable only the mainstream "HIGH" grade OpenSSL ciphers. This
> > ! setting is appropriate when all mandatory TLS destinations support
> > ! some of "HIGH" grade ciphers, this is not uncommon. The underlying
> > ! cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> configuration
> > ! parameter, which you are strongly encouraged to not change. The default
> > ! value of <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> includes anonymous ciphers, but these are
> > ! automatically filtered out if the client is configured to verify server
> > ! certificates. If you must exclude anonymous ciphers also at the "encrypt"
> > ! security level, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
> >
> > ! <dt><b>null</b></dt>
> > ! <dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
> > ! without encryption. This setting is only appropriate in the rare case
> > ! that all servers are prepared to use NULL ciphers (not normally enabled
> > ! in TLS servers). A plausible use-case is an LMTP server listening on a
> > ! UNIX-domain socket that is configured to support "NULL" ciphers. The
> > ! underlying cipherlist is specified via the <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a>
> > ! configuration parameter, which you are strongly encouraged to not
> > ! change. The default value of <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> excludes anonymous
> > ! ciphers (OpenSSL 0.9.8 has NULL ciphers that offer data integrity without
> > ! encryption or authentication). </dd>
> >
> > ***************
> > *** 9742,9746 ****
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > --- 9003,9005 ----
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 9749,9767 ****
> >
> > ! <DT><b><a name="smtp_line_length_limit">smtp_line_length_limit</a>
> > ! (default: 998)</b></DT><DD>
> >
> > ! <p>
> > ! The maximal length of message header and body lines that Postfix
> > ! will send via SMTP. This limit does not include the <CR><LF>
> > ! at the end of each line. Longer lines are broken by inserting
> > ! "<CR><LF><SPACE>", to minimize the damage to MIME
> > ! formatted mail.
> > ! </p>
> >
> > ! <p>
> > ! The Postfix limit of 998 characters not including <CR><LF>
> > ! is consistent with the SMTP limit of 1000 characters including
> > ! <CR><LF>. The Postfix limit was 990 with Postfix 2.8
> > ! and earlier.
> > ! </p>
> >
> > --- 9008,9018 ----
> >
> > ! <DT><b><a name="smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Additional list of ciphers or cipher types to exclude from the
> > ! SMTP client cipher list at mandatory TLS security levels. This list
> > ! works in addition to the exclusions listed with <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
> > ! (see there for syntax details). </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 9770,9796 ****
> >
> > ! <DT><b><a name="smtp_mail_timeout">smtp_mail_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p>
> > ! The Postfix SMTP client time limit for sending the MAIL FROM command,
> > ! and for receiving the remote SMTP server response.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_mime_header_checks">smtp_mime_header_checks</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Restricted mime_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
> > ! client. These tables are searched while mail is being delivered.
> > ! Actions that change the delivery time or destination are not
> > ! available. </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > --- 9021,9056 ----
> >
> > ! <DT><b><a name="smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>
> > ! (default: SSLv3, TLSv1)</b></DT><DD>
> >
> > ! <p> List of SSL/TLS protocols that the Postfix SMTP client will use with
> > ! mandatory TLS encryption. In <a href="postconf.5.html">main.cf</a> the values are separated by
> > ! whitespace, commas or colons. In the policy table "protocols" attribute
> > ! (see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid separator is colon. An
> > ! empty value means allow all protocols. The valid protocol names, (see
> > ! <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and "TLSv1". </p>
> >
> > ! <p> With Postfix ≥ 2.5 the parameter syntax is expanded to support
> > ! protocol exclusions. One can now explicitly exclude SSLv2 by setting
> > ! "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2". To exclude both SSLv2 and
> > ! SSLv3 set "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3". Listing
> > ! the protocols to include, rather than protocols to exclude, is still
> > ! supported; use the form you find more intuitive. </p>
> >
> > + <p> Since SSL version 2 has known protocol weaknesses and is now
> > + deprecated, the default setting excludes "SSLv2". This means that by
> > + default, SSL version 2 will not be used at the "encrypt" security level
> > + and higher. </p>
> >
> > ! <p> See the documentation of the <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> parameter and
> > ! <a href="TLS_README.html">TLS_README</a> for more information about security levels. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = TLSv1
> > ! # Alternative form with Postfix ≥ 2.5:
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 9799,9828 ****
> >
> > ! <DT><b><a name="smtp_mx_address_limit">smtp_mx_address_limit</a>
> > ! (default: 5)</b></DT><DD>
> > !
> > ! <p>
> > ! The maximal number of MX (mail exchanger) IP addresses that can
> > ! result from Postfix SMTP client mail exchanger lookups, or zero (no
> > ! limit). Prior to
> > ! Postfix version 2.3, this limit was disabled by default.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> > !
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_mx_session_limit">smtp_mx_session_limit</a>
> > ! (default: 2)</b></DT><DD>
> >
> > ! <p> The maximal number of SMTP sessions per delivery request before
> > ! the Postfix SMTP client
> > ! gives up or delivers to a fall-back <a href="postconf.5.html#relayhost">relay host</a>, or zero (no
> > ! limit). This restriction ignores sessions that fail to complete the
> > ! SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to
> > ! complete the EHLO and TLS handshake (Postfix version 2.3 and later). </p>
> >
> > ! <p> This feature is available in Postfix 2.1 and later. </p>
> >
> > --- 9059,9073 ----
> >
> > ! <DT><b><a name="smtp_tls_note_starttls_offer">smtp_tls_note_starttls_offer</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Log the hostname of a remote SMTP server that offers STARTTLS,
> > ! when TLS is not already enabled for that server. </p>
> >
> > ! <p> The logfile record looks like: </p>
> >
> > ! <pre>
> > ! postfix/smtp[pid]: Host offered STARTTLS: [name.of.host]
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 9831,9890 ****
> >
> > ! <DT><b><a name="smtp_nested_header_checks">smtp_nested_header_checks</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Restricted nested_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
> > ! client. These tables are searched while mail is being delivered.
> > ! Actions that change the delivery time or destination are not
> > ! available. </p>
> > !
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_never_send_ehlo">smtp_never_send_ehlo</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Never send EHLO at the start of an SMTP session. See also the
> > ! <a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> parameter. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_per_record_deadline">smtp_per_record_deadline</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Change the behavior of the smtp_*_timeout time limits, from a
> > ! time limit per read or write system call, to a time limit to send
> > ! or receive a complete record (an SMTP command line, SMTP response
> > ! line, SMTP message content line, or TLS protocol message). This
> > ! limits the impact from hostile peers that trickle data one byte at
> > ! a time. </p>
> > !
> > ! <p> Note: when per-record deadlines are enabled, a short timeout
> > ! may cause problems with TLS over very slow network connections.
> > ! The reasons are that a TLS protocol message can be up to 16 kbytes
> > ! long (with TLSv1), and that an entire TLS protocol message must be
> > ! sent or received within the per-record deadline. </p>
> >
> > ! <p> This feature is available in Postfix 2.9 and later. With older
> > ! Postfix releases, the behavior is as if this parameter is set to
> > ! "no". </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a>
> > ! (default: 10s)</b></DT><DD>
> >
> > ! <p>
> > ! How long the Postfix SMTP client pauses before sending
> > ! ".<CR><LF>" in order to work around the PIX firewall
> > ! "<CR><LF>.<CR><LF>" bug.
> > ! </p>
> >
> > ! <p>
> > ! Choosing a too short time makes this workaround ineffective when
> > ! sending large messages over slow network connections.
> > ! </p>
> >
> > --- 9076,9151 ----
> >
> > ! <DT><b><a name="smtp_tls_per_site">smtp_tls_per_site</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Optional lookup tables with the Postfix SMTP client TLS usage
> > ! policy by next-hop destination and by remote SMTP server hostname.
> > ! When both lookups succeed, the more specific per-site policy (NONE,
> > ! MUST, etc) overrides the less specific one (MAY), and the more secure
> > ! per-site policy (MUST, etc) overrides the less secure one (NONE).
> > ! With Postfix 2.3 and later <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> is strongly discouraged:
> > ! use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
> >
> > ! <p> Use of the bare hostname as the per-site table lookup key is
> > ! discouraged. Always use the full destination nexthop (enclosed in
> > ! [] with a possible ":port" suffix). A recipient domain or MX-enabled
> > ! transport next-hop with no port suffix may look like a bare hostname,
> > ! but is still a suitable <i>destination</i>. </p>
> >
> > + <p> Specify a next-hop destination or server hostname on the left-hand
> > + side; no wildcards are allowed. The next-hop destination is either
> > + the recipient domain, or the destination specified with a <a href="transport.5.html">transport(5)</a>
> > + table, the <a href="postconf.5.html#relayhost">relayhost</a> parameter, or the <a href="postconf.5.html#relay_transport">relay_transport</a> parameter.
> > + On the right hand side specify one of the following keywords: </p>
> >
> > ! <dl>
> >
> > ! <dt> NONE </dt> <dd> Don't use TLS at all. This overrides a less
> > ! specific <b>MAY</b> lookup result from the alternate host or next-hop
> > ! lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>,
> > ! and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings. </dd>
> >
> > ! <dt> MAY </dt> <dd> Try to use TLS if the server announces support,
> > ! otherwise use the unencrypted connection. This has less precedence
> > ! than a more specific result (including <b>NONE</b>) from the alternate
> > ! host or next-hop lookup key, and has less precedence than the more
> > ! specific global "<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> = yes" or "<a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
> > ! = yes". </dd>
> >
> > ! <dt> MUST_NOPEERMATCH </dt> <dd> Require TLS encryption, but do not
> > ! require that the remote SMTP server hostname matches the information
> > ! in the remote SMTP server certificate, or that the server certificate
> > ! was issued by a trusted CA. This overrides a less secure <b>NONE</b>
> > ! or a less specific <b>MAY</b> lookup result from the alternate host
> > ! or next-hop lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>,
> > ! <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings. </dd>
> >
> > + <dt> MUST </dt> <dd> Require TLS encryption, require that the remote
> > + SMTP server hostname matches the information in the remote SMTP
> > + server certificate, and require that the remote SMTP server certificate
> > + was issued by a trusted CA. This overrides a less secure <b>NONE</b>
> > + and <b>MUST_NOPEERMATCH</b> or a less specific <b>MAY</b> lookup
> > + result from the alternate host or next-hop lookup key, and overrides
> > + the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
> > + settings. </dd>
> >
> > ! </dl>
> >
> > ! <p> The above keywords correspond to the "none", "may", "encrypt" and
> > ! "verify" security levels for the new <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> parameter
> > ! introduced in Postfix 2.3. Starting with Postfix 2.3, and independently
> > ! of how the policy is specified, the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters only apply when TLS encryption
> > ! is mandatory. Connections for which encryption is optional enable
> > ! all "export" grade and better ciphers. </p>
> >
> > ! <p> As long as no secure DNS lookup mechanism is available, false
> > ! hostnames in MX or CNAME responses can change the server hostname
> > ! that Postfix uses for TLS policy lookup and server certificate
> > ! verification. Even with a perfect match between the server hostname and
> > ! the server certificate, there is no guarantee that Postfix is connected
> > ! to the right server. See <a href="TLS_README.html">TLS_README</a> (Closing a DNS loophole with obsolete
> > ! per-site TLS policies) for a possible work-around. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
> >
> > ***************
> > *** 9893,9938 ****
> >
> > ! <DT><b><a name="smtp_pix_workaround_maps">smtp_pix_workaround_maps</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Lookup tables, indexed by the remote SMTP server address, with
> > ! per-destination workarounds for CISCO PIX firewall bugs. The table
> > ! is not indexed by hostname for consistency with
> > ! <a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>. </p>
> > !
> > ! <p> This feature is available in Postfix 2.4 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a>
> > ! (default: 500s)</b></DT><DD>
> > !
> > ! <p> How long a message must be queued before the Postfix SMTP client
> > ! turns on the PIX firewall "<CR><LF>.<CR><LF>"
> > ! bug workaround for delivery through firewalls with "smtp fixup"
> > ! mode turned on. </p>
> > !
> > ! <p>
> > ! By default, the workaround is turned off for mail that is queued
> > ! for less than 500 seconds. In other words, the workaround is normally
> > ! turned off for the first delivery attempt.
> > ! </p>
> > !
> > ! <p>
> > ! Specify 0 to enable the PIX firewall
> > ! "<CR><LF>.<CR><LF>" bug workaround upon the
> > ! first delivery attempt.
> > </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_pix_workarounds">smtp_pix_workarounds</a>
> > ! (default: disable_esmtp, delay_dotcrlf)</b></DT><DD>
> >
> > ! <p> A list that specifies zero or more workarounds for CISCO PIX
> > ! firewall bugs. These workarounds are implemented by the Postfix
> > ! SMTP client. Workaround names are separated by comma or space, and
> > ! are case insensitive. This parameter setting can be overruled with
> > ! per-destination <a href="postconf.5.html#smtp_pix_workaround_maps">smtp_pix_workaround_maps</a> settings. </p>
> >
> > --- 9154,9188 ----
> >
> > ! <DT><b><a name="smtp_tls_policy_maps">smtp_tls_policy_maps</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Optional lookup tables with the Postfix SMTP client TLS security
> > ! policy by next-hop destination; when a non-empty value is specified,
> > ! this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter. See
> > ! <a href="TLS_README.html">TLS_README</a> for a more detailed discussion of TLS security levels.
> > </p>
> >
> > + <p> The TLS policy table is indexed by the full next-hop destination,
> > + which is either the recipient domain, or the verbatim next-hop
> > + specified in the transport table, $<a href="postconf.5.html#local_transport">local_transport</a>, $<a href="postconf.5.html#virtual_transport">virtual_transport</a>,
> > + $<a href="postconf.5.html#relay_transport">relay_transport</a> or $<a href="postconf.5.html#default_transport">default_transport</a>. This includes any enclosing
> > + square brackets and any non-default destination server port suffix. The
> > + LMTP socket type prefix (inet: or unix:) is not included in the lookup
> > + key. </p>
> >
> > ! <p> Only the next-hop domain, or $<a href="postconf.5.html#myhostname">myhostname</a> with LMTP over UNIX-domain
> > ! sockets, is used as the nexthop name for certificate verification. The
> > ! port and any enclosing square brackets are used in the table lookup key,
> > ! but are not used for server name verification. </p>
> >
> > ! <p> When the lookup key is a domain name without enclosing square brackets
> > ! or any <i>:port</i> suffix (typically the recipient domain), and the full
> > ! domain is not found in the table, just as with the <a href="transport.5.html">transport(5)</a> table,
> > ! the parent domain starting with a leading "." is matched recursively. This
> > ! allows one to specify a security policy for a recipient domain and all
> > ! its sub-domains. </p>
> >
> > ! <p> The lookup result is a security level, followed by an optional list
> > ! of whitespace and/or comma separated name=value attributes that override
> > ! related <a href="postconf.5.html">main.cf</a> settings. The TLS security levels in order of increasing
> > ! security are: </p>
> >
> > ***************
> > *** 9940,12458 ****
> >
> > ! <dt><b>delay_dotcrlf</b><dd> Insert a delay before sending
> > ! ".<CR><LF>" after the end of the message content. The
> > ! delay is subject to the <a href="postconf.5.html#smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a> and
> > ! <a href="postconf.5.html#smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a> parameter settings. </dd>
> > !
> > ! <dt><b>disable_esmtp</b><dd> Disable all extended SMTP commands:
> > ! send HELO instead of EHLO. </dd>
> >
> > ! </dl>
> >
> > ! <p> This feature is available in Postfix 2.4 and later. The default
> > ! settings are backwards compatible with earlier Postfix versions.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_quit_timeout">smtp_quit_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p>
> > ! The Postfix SMTP client time limit for sending the QUIT command,
> > ! and for receiving the remote SMTP server response.
> > ! </p>
> >
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p>
> > ! Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO commands
> > ! as required
> > ! by <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. This includes putting quotes around an address localpart
> > ! that ends in ".".
> > ! </p>
> > !
> > ! <p>
> > ! The default is to comply with <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a>. If you have to send mail to
> > ! a broken SMTP server, configure a special SMTP client in <a href="master.5.html">master.cf</a>:
> > ! </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/<a href="master.5.html">master.cf</a>:
> > ! broken-smtp . . . smtp -o <a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>=no
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p>
> > ! and route mail for the destination in question to the "broken-smtp"
> > ! message delivery with a <a href="transport.5.html">transport(5)</a> table.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_randomize_addresses">smtp_randomize_addresses</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p>
> > ! Randomize the order of equal-preference MX host addresses. This
> > ! is a performance feature of the Postfix SMTP client.
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_rcpt_timeout">smtp_rcpt_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> > !
> > ! <p>
> > ! The Postfix SMTP client time limit for sending the SMTP RCPT TO
> > ! command, and for receiving the remote SMTP server response.
> > ! </p>
> > !
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_reply_filter">smtp_reply_filter</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> A mechanism to transform replies from remote SMTP servers one
> > ! line at a time. This is a last-resort tool to work around server
> > ! replies that break inter-operability with the Postfix SMTP client.
> > ! Other uses involve fault injection to test Postfix's handling of
> > ! invalid responses. </p>
> > !
> > ! <p> Notes: </p>
> > !
> > ! <ul>
> > !
> > ! <li> <p> In the case of a multi-line reply, the Postfix SMTP client
> > ! uses the final reply line's numerical SMTP reply code and enhanced
> > ! status code. </p>
> > !
> > ! <li> <p> The numerical SMTP reply code (XYZ) takes precedence over
> > ! the enhanced status code (X.Y.Z). When the enhanced status code
> > ! initial digit differs from the SMTP reply code initial digit, or
> > ! when no enhanced status code is present, the Postfix SMTP client
> > ! uses a generic enhanced status code (X.0.0) instead. </p>
> > !
> > ! </ul>
> > !
> > ! <p> Specify the name of a "<a href="DATABASE_README.html">type:table</a>" lookup table. The search
> > ! string is a single SMTP reply line as received from the remote SMTP
> > ! server, except that the trailing <CR><LF> are removed.
> > ! When the lookup succeeds, the result replaces the single SMTP reply
> > ! line. </p>
> > !
> > ! <p> Examples: </p>
> > !
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/reply_filter
> > ! </pre>
> > !
> > ! <pre>
> > ! /etc/postfix/reply_filter:
> > ! # Transform garbage into "250-filler..." so that it looks like
> > ! # one line from a multi-line reply. It does not matter what we
> > ! # substitute here as long it has the right syntax. The Postfix
> > ! # SMTP client will use the final line's numerical SMTP reply
> > ! # code and enhanced status code.
> > ! !/^([2-5][0-9][0-9]($|[- ]))/ 250-filler for garbage
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.7. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_rset_timeout">smtp_rset_timeout</a>
> > ! (default: 20s)</b></DT><DD>
> > !
> > ! <p> The Postfix SMTP client time limit for sending the RSET command,
> > ! and for receiving the remote SMTP server response. The SMTP client
> > ! sends RSET in
> > ! order to finish a recipient address probe, or to verify that a
> > ! cached session is still usable. </p>
> > !
> > ! <p> This feature is available in Postfix 2.1 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> An optional table to prevent repeated SASL authentication
> > ! failures with the same remote SMTP server hostname, username and
> > ! password. Each table (key, value) pair contains a server name, a
> > ! username and password, and the full server response. This information
> > ! is stored when a remote SMTP server rejects an authentication attempt
> > ! with a 535 reply code. As long as the <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a>
> > ! information does no change, and as long as the <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
> > ! information does not expire (see <a href="postconf.5.html#smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>) the
> > ! Postfix SMTP client avoids SASL authentication attempts with the
> > ! same server, username and password, and instead bounces or defers
> > ! mail as controlled with the <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> configuration
> > ! parameter. </p>
> > !
> > ! <p> Use a per-destination delivery concurrency of 1 (for example,
> > ! "<a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> = 1",
> > ! "<a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> = 1", etc.), otherwise multiple
> > ! delivery agents may experience a login failure at the same time.
> > ! </p>
> > !
> > ! <p> The table must be accessed via the proxywrite service, i.e. the
> > ! map name must start with "<a href="proxymap.8.html">proxy</a>:". The table should be stored under
> > ! the directory specified with the <a href="postconf.5.html#data_directory">data_directory</a> parameter. </p>
> > !
> > ! <p> This feature uses cryptographic hashing to protect plain-text
> > ! passwords, and requires that Postfix is compiled with TLS support.
> > ! </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> = <a href="proxymap.8.html">proxy</a>:btree:/var/lib/postfix/sasl_auth_cache
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>
> > ! (default: 90d)</b></DT><DD>
> > !
> > ! <p> The maximal age of an <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> entry before it
> > ! is removed. </p>
> > !
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_auth_enable">smtp_sasl_auth_enable</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p>
> > ! Enable SASL authentication in the Postfix SMTP client. By default,
> > ! the Postfix SMTP client uses no authentication.
> > ! </p>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes
> > ! </pre>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p> When a remote SMTP server rejects a SASL authentication request
> > ! with a 535 reply code, defer mail delivery instead of returning
> > ! mail as undeliverable. The latter behavior was hard-coded prior to
> > ! Postfix version 2.5. </p>
> > !
> > ! <p> Note: the setting "yes" overrides the global <a href="postconf.5.html#soft_bounce">soft_bounce</a>
> > ! parameter, but the setting "no" does not. </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! # Default as of Postfix 2.5
> > ! <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = yes
> > ! # The old hard-coded default
> > ! <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = no
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p>
> > ! If non-empty, a Postfix SMTP client filter for the remote SMTP
> > ! server's list of offered SASL mechanisms. Different client and
> > ! server implementations may support different mechanism lists; by
> > ! default, the Postfix SMTP client will use the intersection of the
> > ! two. <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> specifies an optional third mechanism
> > ! list to intersect with. </p>
> > !
> > ! <p> Specify mechanism names, "/file/name" patterns or "<a href="DATABASE_README.html">type:table</a>"
> > ! lookup tables. The right-hand side result from "<a href="DATABASE_README.html">type:table</a>" lookups
> > ! is ignored. Specify "!pattern" to exclude a mechanism name from the
> > ! list. The form "!/file/name" is supported only in Postfix version
> > ! 2.4 and later. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > ! <p>
> > ! Examples:
> > ! </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = plain, login
> > ! <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = /etc/postfix/smtp_mechs
> > ! <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = !gssapi, !login, <a href="DATABASE_README.html#types">static</a>:rest
> > ! </pre>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_password_maps">smtp_sasl_password_maps</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p>
> > ! Optional Postfix SMTP client lookup tables with one username:password
> > ! entry
> > ! per remote hostname or domain, or sender address when sender-dependent
> > ! authentication is enabled. If no username:password entry is found,
> > ! then the Postfix SMTP client will not
> > ! attempt to authenticate to the remote host.
> > ! </p>
> > !
> > ! <p>
> > ! The Postfix SMTP client opens the lookup table before going to
> > ! chroot jail, so you can leave the password file in /etc/postfix.
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_path">smtp_sasl_path</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Implementation-specific information that the Postfix SMTP client
> > ! passes through to
> > ! the SASL plug-in implementation that is selected with
> > ! <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>. Typically this specifies the name of a
> > ! configuration file or rendezvous point. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_security_options">smtp_sasl_security_options</a>
> > ! (default: noplaintext, noanonymous)</b></DT><DD>
> > !
> > ! <p> Postfix SMTP client SASL security options; as of Postfix 2.3
> > ! the list of available
> > ! features depends on the SASL client implementation that is selected
> > ! with <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>. </p>
> > !
> > ! <p> The following security features are defined for the <b>cyrus</b>
> > ! client SASL implementation: </p>
> > !
> > ! <p>
> > ! Specify zero or more of the following:
> > ! </p>
> > !
> > ! <dl>
> > !
> > ! <dt><b>noplaintext</b></dt>
> > !
> > ! <dd>Disallow methods that use plaintext passwords. </dd>
> > !
> > ! <dt><b>noactive</b></dt>
> > !
> > ! <dd>Disallow methods subject to active (non-dictionary) attack.
> > ! </dd>
> > !
> > ! <dt><b>nodictionary</b></dt>
> > !
> > ! <dd>Disallow methods subject to passive (dictionary) attack. </dd>
> > !
> > ! <dt><b>noanonymous</b></dt>
> > !
> > ! <dd>Disallow methods that allow anonymous authentication. </dd>
> > !
> > ! <dt><b>mutual_auth</b></dt>
> > !
> > ! <dd>Only allow methods that provide mutual authentication (not
> > ! available with SASL version 1). </dd>
> > !
> > ! </dl>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a> = noplaintext
> > ! </pre>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>
> > ! (default: $<a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a>)</b></DT><DD>
> > !
> > ! <p> The SASL authentication security options that the Postfix SMTP
> > ! client uses for TLS encrypted SMTP sessions. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a>
> > ! (default: $<a href="postconf.5.html#smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>)</b></DT><DD>
> > !
> > ! <p> The SASL authentication security options that the Postfix SMTP
> > ! client uses for TLS encrypted SMTP sessions with a verified server
> > ! certificate. </p>
> > !
> > ! <p> When mail is sent to the public MX host for the recipient's
> > ! domain, server certificates are by default optional, and delivery
> > ! proceeds even if certificate verification fails. For delivery via
> > ! a submission service that requires SASL authentication, it may be
> > ! appropriate to send plaintext passwords only when the connection
> > ! to the server is strongly encrypted <b>and</b> the server identity
> > ! is verified. </p>
> > !
> > ! <p> The <a href="postconf.5.html#smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a> parameter makes it
> > ! possible to only enable plaintext mechanisms when a secure connection
> > ! to the server is available. Submission servers subject to this
> > ! policy must either have verifiable certificates or offer suitable
> > ! non-plaintext SASL mechanisms. </p>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sasl_type">smtp_sasl_type</a>
> > ! (default: cyrus)</b></DT><DD>
> > !
> > ! <p> The SASL plug-in type that the Postfix SMTP client should use
> > ! for authentication. The available types are listed with the
> > ! "<b>postconf -A</b>" command. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> Whether or not to append the "AUTH=<>" option to the MAIL
> > ! FROM command in SASL-authenticated SMTP sessions. The default is
> > ! not to send this, to avoid problems with broken remote SMTP servers.
> > ! Before Postfix 2.9 the behavior is as if "<a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a>
> > ! = yes".
> > !
> > ! <p> This feature is available in Postfix 2.9 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_send_xforward_command">smtp_send_xforward_command</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p>
> > ! Send the non-standard XFORWARD command when the Postfix SMTP server
> > ! EHLO response announces XFORWARD support.
> > ! </p>
> > !
> > ! <p>
> > ! This allows a Postfix SMTP delivery agent, used for injecting mail
> > ! into
> > ! a content filter, to forward the name, address, protocol and HELO
> > ! name of the original client to the content filter and downstream
> > ! queuing SMTP server. This can produce more useful logging than
> > ! localhost[127.0.0.1] etc.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p>
> > ! Enable sender-dependent authentication in the Postfix SMTP client; this is
> > ! available only with SASL authentication, and disables SMTP connection
> > ! caching to ensure that mail from different senders will use the
> > ! appropriate credentials. </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.3 and later.
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p>
> > ! Skip SMTP servers that greet with a 4XX status code (go away, try
> > ! again later).
> > ! </p>
> > !
> > ! <p>
> > ! By default, the Postfix SMTP client moves on the next mail exchanger.
> > ! Specify
> > ! "<a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> = no" if Postfix should defer delivery
> > ! immediately.
> > ! </p>
> > !
> > ! <p> This feature is available in Postfix 2.0 and earlier.
> > ! Later Postfix versions always skip remote SMTP servers that greet
> > ! with a
> > ! 4XX status code. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p>
> > ! Skip remote SMTP servers that greet with a 5XX status code (go away,
> > ! do
> > ! not try again later).
> > ! </p>
> > !
> > ! <p> By default, the Postfix SMTP client moves on the next mail
> > ! exchanger. Specify "<a href="postconf.5.html#smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a> = no" if Postfix should
> > ! bounce the mail immediately. The default setting is incorrect, but
> > ! it is what a lot of people expect to happen. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_skip_quit_response">smtp_skip_quit_response</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p>
> > ! Do not wait for the response to the SMTP QUIT command.
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_starttls_timeout">smtp_starttls_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> > !
> > ! <p> Time limit for Postfix SMTP client write and read operations
> > ! during TLS startup and shutdown handshake procedures. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_CAfile">smtp_tls_CAfile</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> A file containing CA certificates of root CAs trusted to sign
> > ! either remote SMTP server certificates or intermediate CA certificates.
> > ! These are loaded into memory before the <a href="smtp.8.html">smtp(8)</a> client enters the
> > ! chroot jail. If the number of trusted roots is large, consider using
> > ! <a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> instead, but note that the latter directory must be
> > ! present in the chroot jail if the <a href="smtp.8.html">smtp(8)</a> client is chrooted. This
> > ! file may also be used to augment the client certificate trust chain,
> > ! but it is best to include all the required certificates directly in
> > ! $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>. </p>
> > !
> > ! <p> Specify "<a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> = /path/to/system_CA_file" to use
> > ! ONLY the system-supplied default certificate authority certificates.
> > ! </p>
> > !
> > ! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
> > ! appending the system-supplied default CAs and trusting third-party
> > ! certificates. </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> = /etc/postfix/CAcert.pem
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_CApath">smtp_tls_CApath</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Directory with PEM format certificate authority certificates
> > ! that the Postfix SMTP client uses to verify a remote SMTP server
> > ! certificate. Don't forget to create the necessary "hash" links
> > ! with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
> > ! </p>
> > !
> > ! <p> To use this option in chroot mode, this directory (or a copy)
> > ! must be inside the chroot jail. </p>
> > !
> > ! <p> Specify "<a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> = /path/to/system_CA_directory" to
> > ! use ONLY the system-supplied default certificate authority certificates.
> > ! </p>
> > !
> > ! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
> > ! appending the system-supplied default CAs and trusting third-party
> > ! certificates. </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> = /etc/postfix/certs
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_block_early_mail_reply">smtp_tls_block_early_mail_reply</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> Try to detect a mail hijacking attack based on a TLS protocol
> > ! vulnerability (CVE-2009-3555), where an attacker prepends malicious
> > ! HELO, MAIL, RCPT, DATA commands to a Postfix SMTP client TLS session.
> > ! The attack would succeed with non-Postfix SMTP servers that reply
> > ! to the malicious HELO, MAIL, RCPT, DATA commands after negotiating
> > ! the Postfix SMTP client TLS session. </p>
> > !
> > ! <p> This feature is available in Postfix 2.7. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_cert_file">smtp_tls_cert_file</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> File with the Postfix SMTP client RSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP client private RSA key,
> > ! and these may be the same as the Postfix SMTP server RSA certificate and key
> > ! file. </p>
> > !
> > ! <p> Do not configure client certificates unless you <b>must</b> present
> > ! client TLS certificates to one or more servers. Client certificates are
> > ! not usually needed, and can cause problems in configurations that work
> > ! well without them. The recommended setting is to let the defaults stand: </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> =
> > ! <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> =
> > ! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> =
> > ! <a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a> =
> > ! <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> =
> > ! <a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> =
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p> The best way to use the default settings is to comment out the above
> > ! parameters in <a href="postconf.5.html">main.cf</a> if present. </p>
> > !
> > ! <p> To enable remote SMTP servers to verify the Postfix SMTP client
> > ! certificate, the issuing CA certificates must be made available to the
> > ! server. You should include the required certificates in the client
> > ! certificate file, the client certificate first, then the issuing
> > ! CA(s) (bottom-up order). </p>
> > !
> > ! <p> Example: the certificate for "client.example.com" was issued by
> > ! "intermediate CA" which itself has a certificate issued by "root CA".
> > ! Create the client.pem file with "cat client_cert.pem intermediate_CA.pem
> > ! root_CA.pem > client.pem". </p>
> > !
> > ! <p> If you also want to verify remote SMTP server certificates issued by
> > ! these CAs, you can add the CA certificates to the <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>, in
> > ! which case it is not necessary to have them in the <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>,
> > ! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> or <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>. </p>
> > !
> > ! <p> A certificate supplied here must be usable as an SSL client certificate
> > ! and hence pass the "openssl verify -purpose sslclient ..." test. </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> = /etc/postfix/client.pem
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_cipherlist">smtp_tls_cipherlist</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Obsolete Postfix < 2.3 control for the Postfix SMTP client TLS
> > ! cipher list. As this feature applies to all TLS security levels, it is easy
> > ! to create inter-operability problems by choosing a non-default cipher
> > ! list. Do not use a non-default TLS cipher list on hosts that deliver email
> > ! to the public Internet: you will be unable to send email to servers that
> > ! only support the ciphers you exclude. Using a restricted cipher list
> > ! may be more appropriate for an internal MTA, where one can exert some
> > ! control over the TLS software and settings of the peer servers. </p>
> > !
> > ! <p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
> > !
> > ! <p> This feature is available in Postfix version 2.2. It is not used with
> > ! Postfix 2.3 and later; use <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> instead. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_ciphers">smtp_tls_ciphers</a>
> > ! (default: export)</b></DT><DD>
> > !
> > ! <p> The minimum TLS cipher grade that the Postfix SMTP client
> > ! will use with opportunistic TLS encryption. Cipher types listed in
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> are excluded from the base definition of
> > ! the selected cipher grade. The default value "export" ensures maximum
> > ! inter-operability. Because encryption is optional, stronger controls
> > ! are not appropriate, and this setting SHOULD NOT be changed unless the
> > ! change is essential. </p>
> > !
> > ! <p> When TLS is mandatory the cipher grade is chosen via the
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
> > ! details. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure
> > ! ciphers on a per-destination basis. </p>
> > !
> > ! <p> Example: </p>
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = export
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. With earlier Postfix
> > ! releases only the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter is implemented,
> > ! and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_dcert_file">smtp_tls_dcert_file</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> File with the Postfix SMTP client DSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP client private DSA key. </p>
> > !
> > ! <p> See the discussion under <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for more details.
> > ! </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> = /etc/postfix/client-dsa.pem
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_dkey_file">smtp_tls_dkey_file</a>
> > ! (default: $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>)</b></DT><DD>
> > !
> > ! <p> File with the Postfix SMTP client DSA private key in PEM format.
> > ! This file may be combined with the Postfix SMTP client DSA certificate
> > ! file specified with $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>. </p>
> > !
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted. File permissions should grant read-only
> > ! access to the system superuser account ("root"), and no access
> > ! to anyone else. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_eccert_file">smtp_tls_eccert_file</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> File with the Postfix SMTP client ECDSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP client ECDSA private key. </p>
> > !
> > ! <p> See the discussion under <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for more details.
> > ! </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> = /etc/postfix/ecdsa-ccert.pem
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later, when Postfix is
> > ! compiled and linked with OpenSSL 1.0.0 or later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_eckey_file">smtp_tls_eckey_file</a>
> > ! (default: $<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>)</b></DT><DD>
> > !
> > ! <p> File with the Postfix SMTP client ECDSA private key in PEM format.
> > ! This file may be combined with the Postfix SMTP client ECDSA
> > ! certificate file specified with $<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>. </p>
> > !
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted. File permissions should grant read-only
> > ! access to the system superuser account ("root"), and no access
> > ! to anyone else. </p>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later, when Postfix is
> > ! compiled and linked with OpenSSL 1.0.0 or later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p> With mandatory TLS encryption, require that the remote SMTP
> > ! server hostname matches the information in the remote SMTP server
> > ! certificate. As of <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> the requirements for hostname checking
> > ! for MTA clients are not specified. </p>
> > !
> > ! <p> This option can be set to "no" to disable strict peer name
> > ! checking. This setting has no effect on sessions that are controlled
> > ! via the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table. </p>
> > !
> > ! <p> Disabling the hostname verification can make sense in closed
> > ! environment where special CAs are created. If not used carefully,
> > ! this option opens the danger of a "man-in-the-middle" attack (the
> > ! CommonName of this attacker will be logged). </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> List of ciphers or cipher types to exclude from the Postfix
> > ! SMTP client cipher
> > ! list at all TLS security levels. This is not an OpenSSL cipherlist, it is
> > ! a simple list separated by whitespace and/or commas. The elements are a
> > ! single cipher, or one or more "+" separated cipher properties, in which
> > ! case only ciphers matching <b>all</b> the properties are excluded. </p>
> > !
> > ! <p> Examples (some of these will cause problems): </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = aNULL
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = MD5, DES
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = DES+MD5
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
> > ! <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = kEDH+aRSA
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p> The first setting, disables anonymous ciphers. The next setting
> > ! disables ciphers that use the MD5 digest algorithm or the (single) DES
> > ! encryption algorithm. The next setting disables ciphers that use MD5 and
> > ! DES together. The next setting disables the two ciphers "AES256-SHA"
> > ! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
> > ! key exchange with RSA authentication. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> List of acceptable remote SMTP server certificate fingerprints for
> > ! the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> =
> > ! fingerprint). At this security level, certificate authorities are not
> > ! used, and certificate expiration times are ignored. Instead, server
> > ! certificates are verified directly via their certificate fingerprint
> > ! or public key fingerprint (Postfix 2.9 and later). The fingerprint
> > ! is a message digest of the server certificate (or public key). The
> > ! digest algorithm is selected via the <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b>
> > ! parameter. </p>
> > !
> > ! <p> When an <b><a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a></b> table entry specifies the
> > ! "fingerprint" security level, any "match" attributes in that entry specify
> > ! the list of valid fingerprints for the corresponding destination. Multiple
> > ! fingerprints can be combined with a "|" delimiter in a single match
> > ! attribute, or multiple match attributes can be employed. </p>
> > !
> > ! <p> Example: Certificate fingerprint verification with internal mailhub.
> > ! Two matching fingerprints are listed. The <a href="postconf.5.html#relayhost">relayhost</a> may be multiple
> > ! physical hosts behind a load-balancer, each with its own private/public
> > ! key and self-signed certificate. Alternatively, a single <a href="postconf.5.html#relayhost">relayhost</a> may
> > ! be in the process of switching from one set of private/public keys to
> > ! another, and both keys are trusted just prior to the transition. </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
> > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
> > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p> Example: Certificate fingerprint verification with selected destinations.
> > ! As in the example above, we show two matching fingerprints: </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = hash:/etc/postfix/tls_policy
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/tls_policy:
> > ! example.com fingerprint
> > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
> > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a>
> > ! (default: md5)</b></DT><DD>
> > !
> > ! <p> The message digest algorithm used to construct remote SMTP server
> > ! certificate fingerprints. At the "fingerprint" TLS security level
> > ! (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> = fingerprint), the server certificate is
> > ! verified by directly matching its certificate fingerprint or its public
> > ! key fingerprint (Postfix 2.9 and later). The fingerprint is the
> > ! message digest of the server certificate (or its public key)
> > ! using the selected
> > ! algorithm. With a digest algorithm resistant to "second pre-image"
> > ! attacks, it is not feasible to create a new public key and a matching
> > ! certificate (or public/private key-pair) that has the same fingerprint. </p>
> > !
> > ! <p> The default algorithm is <b>md5</b>; this is consistent with
> > ! the backwards compatible setting of the digest used to verify client
> > ! certificates in the SMTP server. </p>
> > !
> > ! <p> The best practice algorithm is now <b>sha1</b>. Recent advances in hash
> > ! function cryptanalysis have led to md5 being deprecated in favor of sha1.
> > ! However, as long as there are no known "second pre-image" attacks
> > ! against md5, its use in this context can still be considered safe.
> > ! </p>
> > !
> > ! <p> While additional digest algorithms are often available with OpenSSL's
> > ! libcrypto, only those used by libssl in SSL cipher suites are available to
> > ! Postfix. For now this means just md5 or sha1. </p>
> > !
> > ! <p> To find the fingerprint of a specific certificate file, with a
> > ! specific digest algorithm, run:
> > ! </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! $ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p> The text to the right of "=" sign is the desired fingerprint.
> > ! For example: </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem
> > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p> Public key fingerprints are more difficult to extract, however,
> > ! the SHA-1 public key fingerprint is often present as the value of the
> > ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix
> > ! SMTP server and client log the peer certificate fingerprint and public
> > ! key fingerprint when TLS loglevel is 1 or higher. </p>
> > !
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_key_file">smtp_tls_key_file</a>
> > ! (default: $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>)</b></DT><DD>
> > !
> > ! <p> File with the Postfix SMTP client RSA private key in PEM format.
> > ! This file may be combined with the Postfix SMTP client RSA certificate
> > ! file specified with $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>. </p>
> > !
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted. File permissions should grant read-only
> > ! access to the system superuser account ("root"), and no access
> > ! to anyone else. </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> = $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_loglevel">smtp_tls_loglevel</a>
> > ! (default: 0)</b></DT><DD>
> > !
> > ! <p> Enable additional Postfix SMTP client logging of TLS activity.
> > ! Each logging level also includes the information that is logged at
> > ! a lower logging level. </p>
> > !
> > ! <dl compact>
> > !
> > ! <dt> </dt> <dd> 0 Log only a summary message on TLS handshake completion
> > ! — no logging of remote SMTP server certificate trust-chain
> > ! verification errors if server certificate verification is not required.
> > ! With Postfix 2.8 and earlier, disable logging of TLS activity. </dd>
> > !
> > ! <dt> </dt> <dd> 1 Also log remote SMTP server trust-chain verification
> > ! errors and peer certificate summary information. With Postfix 2.8
> > ! and earlier, log TLS handshake and certificate information. </dd>
> > !
> > ! <dt> </dt> <dd> 2 Also log levels during TLS negotiation. </dd>
> > !
> > ! <dt> </dt> <dd> 3 Also log hexadecimal and ASCII dump of TLS negotiation
> > ! process. </dd>
> > !
> > ! <dt> </dt> <dd> 4 Also log hexadecimal and ASCII dump of complete
> > ! transmission after STARTTLS. </dd>
> > !
> > ! </dl>
> > !
> > ! <p> Do not use "<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> = 2" or higher except in case of
> > ! problems. Use of loglevel 4 is strongly discouraged. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>
> > ! (default: medium)</b></DT><DD>
> > !
> > ! <p> The minimum TLS cipher grade that the Postfix SMTP client will
> > ! use with
> > ! mandatory TLS encryption. The default value "medium" is suitable
> > ! for most destinations with which you may want to enforce TLS, and
> > ! is beyond the reach of today's cryptanalytic methods. See
> > ! <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure ciphers
> > ! on a per-destination basis. </p>
> > !
> > ! <p> The following cipher grades are supported: </p>
> > !
> > ! <dl>
> > ! <dt><b>export</b></dt>
> > ! <dd> Enable "EXPORT" grade or better OpenSSL
> > ! ciphers. This is the default for opportunistic encryption. It is
> > ! not recommended for mandatory encryption unless you must enforce TLS
> > ! with "crippled" peers. The underlying cipherlist is specified via the
> > ! <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter, which you are strongly
> > ! encouraged to not change. </dd>
> > !
> > ! <dt><b>low</b></dt>
> > ! <dd> Enable "LOW" grade or better OpenSSL ciphers. This
> > ! setting is only appropriate for internal mail servers. The underlying
> > ! cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration
> > ! parameter, which you are strongly encouraged to not change. </dd>
> > !
> > ! <dt><b>medium</b></dt>
> > ! <dd> Enable "MEDIUM" grade or better OpenSSL ciphers.
> > ! The underlying cipherlist is specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
> > ! configuration parameter, which you are strongly encouraged to not change.
> > ! </dd>
> > !
> > ! <dt><b>high</b></dt>
> > ! <dd> Enable only "HIGH" grade OpenSSL ciphers. This setting may
> > ! be appropriate when all mandatory TLS destinations (e.g. when all
> > ! mail is routed to a suitably capable <a href="postconf.5.html#relayhost">relayhost</a>) support at least one
> > ! "HIGH" grade cipher. The underlying cipherlist is specified via the
> > ! <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> configuration parameter, which you are strongly
> > ! encouraged to not change. </dd>
> > !
> > ! <dt><b>null</b></dt>
> > ! <dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
> > ! without encryption. This setting is only appropriate in the rare case
> > ! that all servers are prepared to use NULL ciphers (not normally enabled
> > ! in TLS servers). A plausible use-case is an LMTP server listening on a
> > ! UNIX-domain socket that is configured to support "NULL" ciphers. The
> > ! underlying cipherlist is specified via the <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a>
> > ! configuration parameter, which you are strongly encouraged to not
> > ! change. </dd>
> > !
> > ! </dl>
> > !
> > ! <p> The underlying cipherlists for grades other than "null" include
> > ! anonymous ciphers, but these are automatically filtered out if the
> > ! Postfix SMTP client is configured to verify server certificates.
> > ! You are very unlikely to need to take any steps to exclude anonymous
> > ! ciphers, they are excluded automatically as necessary. If you must
> > ! exclude anonymous ciphers at the "may" or "encrypt" security levels,
> > ! when the Postfix SMTP client does not need or use peer certificates, set
> > ! "<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers only when
> > ! TLS is enforced, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Additional list of ciphers or cipher types to exclude from the
> > ! Postfix SMTP client cipher list at mandatory TLS security levels. This list
> > ! works in addition to the exclusions listed with <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
> > ! (see there for syntax details). </p>
> > !
> > ! <p> Starting with Postfix 2.6, the mandatory cipher exclusions can be
> > ! specified on a per-destination basis via the TLS policy "exclude"
> > ! attribute. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for notes and examples. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>
> > ! (default: SSLv3, TLSv1)</b></DT><DD>
> > !
> > ! <p> List of SSL/TLS protocols that the Postfix SMTP client will use with
> > ! mandatory TLS encryption. In <a href="postconf.5.html">main.cf</a> the values are separated by
> > ! whitespace, commas or colons. In the policy table "protocols" attribute
> > ! (see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid separator is colon. An
> > ! empty value means allow all protocols. The valid protocol names, (see
> > ! <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and "TLSv1". </p>
> > !
> > ! <p> With Postfix ≥ 2.5 the parameter syntax is expanded to support
> > ! protocol exclusions. One can now explicitly exclude SSLv2 by setting
> > ! "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2". To exclude both SSLv2 and
> > ! SSLv3 set "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3". Listing
> > ! the protocols to include, rather than protocols to exclude, is still
> > ! supported; use the form you find more intuitive. </p>
> > !
> > ! <p> Since SSL version 2 has known protocol weaknesses and is now
> > ! deprecated, the default setting excludes "SSLv2". This means that by
> > ! default, SSL version 2 will not be used at the "encrypt" security level
> > ! and higher. </p>
> > !
> > ! <p> See the documentation of the <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> parameter and
> > ! <a href="TLS_README.html">TLS_README</a> for more information about security levels. </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = TLSv1
> > ! # Alternative form with Postfix ≥ 2.5:
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_note_starttls_offer">smtp_tls_note_starttls_offer</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> Log the hostname of a remote SMTP server that offers STARTTLS,
> > ! when TLS is not already enabled for that server. </p>
> > !
> > ! <p> The logfile record looks like: </p>
> > !
> > ! <pre>
> > ! postfix/smtp[pid]: Host offered STARTTLS: [name.of.host]
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_per_site">smtp_tls_per_site</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Optional lookup tables with the Postfix SMTP client TLS usage
> > ! policy by next-hop destination and by remote SMTP server hostname.
> > ! When both lookups succeed, the more specific per-site policy (NONE,
> > ! MUST, etc) overrides the less specific one (MAY), and the more secure
> > ! per-site policy (MUST, etc) overrides the less secure one (NONE).
> > ! With Postfix 2.3 and later <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> is strongly discouraged:
> > ! use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
> > !
> > ! <p> Use of the bare hostname as the per-site table lookup key is
> > ! discouraged. Always use the full destination nexthop (enclosed in
> > ! [] with a possible ":port" suffix). A recipient domain or MX-enabled
> > ! transport next-hop with no port suffix may look like a bare hostname,
> > ! but is still a suitable <i>destination</i>. </p>
> > !
> > ! <p> Specify a next-hop destination or server hostname on the left-hand
> > ! side; no wildcards are allowed. The next-hop destination is either
> > ! the recipient domain, or the destination specified with a <a href="transport.5.html">transport(5)</a>
> > ! table, the <a href="postconf.5.html#relayhost">relayhost</a> parameter, or the <a href="postconf.5.html#relay_transport">relay_transport</a> parameter.
> > ! On the right hand side specify one of the following keywords: </p>
> > !
> > ! <dl>
> > !
> > ! <dt> NONE </dt> <dd> Don't use TLS at all. This overrides a less
> > ! specific <b>MAY</b> lookup result from the alternate host or next-hop
> > ! lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>,
> > ! and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings. </dd>
> > !
> > ! <dt> MAY </dt> <dd> Try to use TLS if the server announces support,
> > ! otherwise use the unencrypted connection. This has less precedence
> > ! than a more specific result (including <b>NONE</b>) from the alternate
> > ! host or next-hop lookup key, and has less precedence than the more
> > ! specific global "<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> = yes" or "<a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
> > ! = yes". </dd>
> > !
> > ! <dt> MUST_NOPEERMATCH </dt> <dd> Require TLS encryption, but do not
> > ! require that the remote SMTP server hostname matches the information
> > ! in the remote SMTP server certificate, or that the server certificate
> > ! was issued by a trusted CA. This overrides a less secure <b>NONE</b>
> > ! or a less specific <b>MAY</b> lookup result from the alternate host
> > ! or next-hop lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>,
> > ! <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings. </dd>
> > !
> > ! <dt> MUST </dt> <dd> Require TLS encryption, require that the remote
> > ! SMTP server hostname matches the information in the remote SMTP
> > ! server certificate, and require that the remote SMTP server certificate
> > ! was issued by a trusted CA. This overrides a less secure <b>NONE</b>
> > ! and <b>MUST_NOPEERMATCH</b> or a less specific <b>MAY</b> lookup
> > ! result from the alternate host or next-hop lookup key, and overrides
> > ! the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
> > ! settings. </dd>
> > !
> > ! </dl>
> > !
> > ! <p> The above keywords correspond to the "none", "may", "encrypt" and
> > ! "verify" security levels for the new <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> parameter
> > ! introduced in Postfix 2.3. Starting with Postfix 2.3, and independently
> > ! of how the policy is specified, the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters apply when TLS encryption
> > ! is mandatory. Connections for which encryption is optional typically
> > ! enable all "export" grade and better ciphers (see <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>
> > ! and <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>). </p>
> > !
> > ! <p> As long as no secure DNS lookup mechanism is available, false
> > ! hostnames in MX or CNAME responses can change the server hostname
> > ! that Postfix uses for TLS policy lookup and server certificate
> > ! verification. Even with a perfect match between the server hostname and
> > ! the server certificate, there is no guarantee that Postfix is connected
> > ! to the right server. See <a href="TLS_README.html">TLS_README</a> (Closing a DNS loophole with obsolete
> > ! per-site TLS policies) for a possible work-around. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_policy_maps">smtp_tls_policy_maps</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Optional lookup tables with the Postfix SMTP client TLS security
> > ! policy by next-hop destination; when a non-empty value is specified,
> > ! this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter. See
> > ! <a href="TLS_README.html">TLS_README</a> for a more detailed discussion of TLS security levels.
> > ! </p>
> > !
> > ! <p> The TLS policy table is indexed by the full next-hop destination,
> > ! which is either the recipient domain, or the verbatim next-hop
> > ! specified in the transport table, $<a href="postconf.5.html#local_transport">local_transport</a>, $<a href="postconf.5.html#virtual_transport">virtual_transport</a>,
> > ! $<a href="postconf.5.html#relay_transport">relay_transport</a> or $<a href="postconf.5.html#default_transport">default_transport</a>. This includes any enclosing
> > ! square brackets and any non-default destination server port suffix. The
> > ! LMTP socket type prefix (inet: or unix:) is not included in the lookup
> > ! key. </p>
> > !
> > ! <p> Only the next-hop domain, or $<a href="postconf.5.html#myhostname">myhostname</a> with LMTP over UNIX-domain
> > ! sockets, is used as the nexthop name for certificate verification. The
> > ! port and any enclosing square brackets are used in the table lookup key,
> > ! but are not used for server name verification. </p>
> > !
> > ! <p> When the lookup key is a domain name without enclosing square brackets
> > ! or any <i>:port</i> suffix (typically the recipient domain), and the full
> > ! domain is not found in the table, just as with the <a href="transport.5.html">transport(5)</a> table,
> > ! the parent domain starting with a leading "." is matched recursively. This
> > ! allows one to specify a security policy for a recipient domain and all
> > ! its sub-domains. </p>
> > !
> > ! <p> The lookup result is a security level, followed by an optional list
> > ! of whitespace and/or comma separated name=value attributes that override
> > ! related <a href="postconf.5.html">main.cf</a> settings. The TLS security levels in order of increasing
> > ! security are: </p>
> > !
> > ! <dl>
> > !
> > ! <dt><b>none</b></dt>
> > ! <dd>No TLS. No additional attributes are supported at this level. </dd>
> > !
> > ! <dt><b>may</b></dt>
> > ! <dd>Opportunistic TLS. Since sending in the clear is acceptable,
> > ! demanding stronger than default TLS security merely reduces
> > ! inter-operability. The optional "ciphers", "exclude" and "protocols"
> > ! attributes (available for opportunistic TLS with Postfix ≥ 2.6)
> > ! override the "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>", "<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>" and
> > ! "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>" configuration parameters. When opportunistic TLS
> > ! handshakes fail, Postfix retries the connection with TLS disabled.
> > ! This allows mail delivery to sites with non-interoperable TLS
> > ! implementations.</dd>
> > !
> > ! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. At this level
> > ! and higher, the optional "protocols" attribute overrides the <a href="postconf.5.html">main.cf</a>
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameter, the optional "ciphers" attribute
> > ! overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter, and the
> > ! optional "exclude" attribute (Postfix ≥ 2.6) overrides the <a href="postconf.5.html">main.cf</a>
> > ! <a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> parameter. In the policy table,
> > ! multiple protocols or excluded ciphers must be separated by colons,
> > ! as attribute values may not contain whitespace or commas. </dd>
> > !
> > ! <dt><b>fingerprint</b></dt> <dd>Certificate fingerprint
> > ! verification. Available with Postfix 2.5 and later. At this security
> > ! level, there are no trusted certificate authorities. The certificate
> > ! trust chain, expiration date, ... are not checked. Instead,
> > ! the optional <b>match</b> attribute, or else the <a href="postconf.5.html">main.cf</a>
> > ! <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter, lists the certificate
> > ! fingerprints or the public key fingerprint (Postfix 2.9 and later)
> > ! of the valid server certificate. The digest
> > ! algorithm used to calculate the fingerprint is selected by the
> > ! <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. Multiple fingerprints can
> > ! be combined with a "|" delimiter in a single match attribute, or multiple
> > ! match attributes can be employed. The ":" character is not used as a
> > ! delimiter as it occurs between each pair of fingerprint (hexadecimal)
> > ! digits. </dd>
> > !
> > ! <dt><b>verify</b></dt> <dd>Mandatory TLS verification. At this security
> > ! level, DNS MX lookups are trusted to be secure enough, and the name
> > ! verified in the server certificate is usually obtained indirectly via
> > ! unauthenticated DNS MX lookups. The optional "match" attribute overrides
> > ! the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> parameter. In the policy table,
> > ! multiple match patterns and strategies must be separated by colons.
> > ! In practice explicit control over matching is more common with the
> > ! "secure" policy, described below. </dd>
> > !
> > ! <dt><b>secure</b></dt> <dd>Secure-channel TLS. At this security level, DNS
> > ! MX lookups, though potentially used to determine the candidate next-hop
> > ! gateway IP addresses, are <b>not</b> trusted to be secure enough for TLS
> > ! peername verification. Instead, the default name verified in the server
> > ! certificate is obtained directly from the next-hop, or is explicitly
> > ! specified via the optional <b>match</b> attribute which overrides the
> > ! <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> parameter. In the policy table,
> > ! multiple match patterns and strategies must be separated by colons.
> > ! The match attribute is most useful when multiple domains are supported by
> > ! common server, the policy entries for additional domains specify matching
> > ! rules for the primary domain certificate. While transport table overrides
> > ! routing the secondary domains to the primary nexthop also allow secure
> > ! verification, they risk delivery to the wrong destination when domains
> > ! change hands or are re-assigned to new gateways. With the "match"
> > ! attribute approach, routing is not perturbed, and mail is deferred if
> > ! verification of a new MX host fails. </dd>
> > !
> > ! </dl>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> > !
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = hash:/etc/postfix/tls_policy
> > ! # Postfix 2.5 and later
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
> > ! </pre>
> > !
> > ! <pre>
> > ! /etc/postfix/tls_policy:
> > ! example.edu none
> > ! example.mil may
> > ! example.gov encrypt protocols=TLSv1
> > ! example.com verify ciphers=high
> > ! example.net secure
> > ! .example.net secure match=.example.net:example.net
> > ! [mail.example.org]:587 secure match=nexthop
> > ! # Postfix 2.5 and later
> > ! [thumb.example.org] fingerprint
> > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
> > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
> > ! </pre>
> > !
> > ! <p> <b>Note:</b> The <b>hostname</b> strategy if listed in a non-default
> > ! setting of <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> or in the <b>match</b> attribute
> > ! in the policy table can render the <b>secure</b> level vulnerable to
> > ! DNS forgery. Do not use the <b>hostname</b> strategy for secure-channel
> > ! configurations in environments where DNS security is not assured. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_protocols">smtp_tls_protocols</a>
> > ! (default: !SSLv2)</b></DT><DD>
> > !
> > ! <p> List of TLS protocols that the Postfix SMTP client will exclude or
> > ! include with opportunistic TLS encryption. Starting with Postfix 2.6,
> > ! the Postfix SMTP client will by default not use the obsolete SSLv2
> > ! protocol. </p>
> > !
> > ! <p> In <a href="postconf.5.html">main.cf</a> the values are separated by whitespace, commas or
> > ! colons. In the policy table (see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid
> > ! separator is colon. An empty value means allow all protocols. The valid
> > ! protocol names, (see <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3"
> > ! and "TLSv1". </p>
> > !
> > ! <p> To include a protocol list its name, to exclude it, prefix the name
> > ! with a "!" character. To exclude SSLv2 even for opportunistic TLS set
> > ! "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
> > ! "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3". Explicitly listing the protocols to
> > ! include, is supported, but not recommended. OpenSSL provides no mechanisms
> > ! for excluding protocols not known at compile-time. If Postfix is linked
> > ! against an OpenSSL library that supports additional protocol versions,
> > ! they cannot be excluded using either syntax. </p>
> > !
> > ! <p> Example: </p>
> > ! <pre>
> > ! # TLSv1 only!
> > ! <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>
> > ! (default: 9)</b></DT><DD>
> > !
> > ! <p> The verification depth for remote SMTP server certificates. A depth
> > ! of 1 is sufficient if the issuing CA is listed in a local CA file. </p>
> > !
> > ! <p> The default verification depth is 9 (the OpenSSL default) for
> > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
> > ! the default value was 5, but the limit was not actually enforced. If
> > ! you have set this to a lower non-default value, certificates with longer
> > ! trust chains may now fail to verify. Certificate chains with 1 or 2
> > ! CAs are common, deeper chains are more rare and any number between 5
> > ! and 9 should suffice in practice. You can choose a lower number if,
> > ! for example, you trust certificates directly signed by an issuing CA
> > ! but not any CAs it delegates to. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a>
> > ! (default: nexthop, dot-nexthop)</b></DT><DD>
> > !
> > ! <p> How the Postfix SMTP client verifies the server certificate
> > ! peername for the
> > ! "secure" TLS security level. In a "secure" TLS policy table
> > ! ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
> > ! overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
> > !
> > ! <p> This parameter specifies one or more patterns or strategies separated
> > ! by commas, whitespace or colons. In the policy table the only valid
> > ! separator is the colon character. </p>
> > !
> > ! <p> For a description of the pattern and strategy syntax see the
> > ! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> parameter. The "hostname" strategy should
> > ! be avoided in this context, as in the absence of a secure global DNS, using
> > ! the results of MX lookups in certificate verification is not immune to active
> > ! (man-in-the-middle) attacks on DNS. </p>
> > !
> > ! <p>
> > ! Sample <a href="postconf.5.html">main.cf</a> setting:
> > ! </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p>
> > ! Sample policy table override:
> > ! </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! example.net secure match=example.com:.example.com
> > ! .example.net secure match=example.com:.example.com
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_security_level">smtp_tls_security_level</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> The default SMTP TLS security level for the Postfix SMTP client;
> > ! when a non-empty value is specified, this overrides the obsolete
> > ! parameters <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>, and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>.
> > ! </p>
> > !
> > ! <p> Specify one of the following security levels: </p>
> > !
> > ! <dl>
> > !
> > ! <dt><b>none</b></dt> <dd> TLS will not be used unless enabled for specific
> > ! destinations via <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>. </dd>
> > !
> > ! <dt><b>may</b></dt>
> > ! <dd> Opportunistic TLS. Use TLS if this is supported by the remote
> > ! SMTP server, otherwise use plaintext. Since
> > ! sending in the clear is acceptable, demanding stronger than default TLS
> > ! security merely reduces inter-operability.
> > ! The "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>" and "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>" (Postfix ≥ 2.6)
> > ! configuration parameters provide control over the protocols and
> > ! cipher grade used with opportunistic TLS. With earlier releases the
> > ! opportunistic TLS cipher grade is always "export" and no protocols
> > ! are disabled.
> > ! When TLS handshakes fail, the connection is retried with TLS disabled.
> > ! This allows mail delivery to sites with non-interoperable TLS
> > ! implementations. </dd>
> > !
> > ! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. Since a minimum
> > ! level of security is intended, it is reasonable to be specific about
> > ! sufficiently secure protocol versions and ciphers. At this security level
> > ! and higher, the <a href="postconf.5.html">main.cf</a> parameters <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> and
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> specify the TLS protocols and minimum
> > ! cipher grade which the administrator considers secure enough for
> > ! mandatory encrypted sessions. This security level is not an appropriate
> > ! default for systems delivering mail to the Internet. </dd>
> > !
> > ! <dt><b>fingerprint</b></dt> <dd>Certificate fingerprint
> > ! verification. Available with Postfix 2.5 and later. At this security
> > ! level, there are no trusted certificate authorities. The certificate
> > ! trust chain, expiration date, ... are not checked. Instead, the
> > ! <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter lists the certificate
> > ! fingerprint or public key fingerprint (Postfix 2.9 and later) of
> > ! the valid server certificate. The digest
> > ! algorithm used to calculate the fingerprint is selected by the
> > ! <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. </dd>
> > !
> > ! <dt><b>verify</b></dt> <dd>Mandatory TLS verification. At this security
> > ! level, DNS MX lookups are trusted to be secure enough, and the name
> > ! verified in the server certificate is usually obtained indirectly
> > ! via unauthenticated DNS MX lookups. The <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
> > ! parameter controls how the server name is verified. In practice explicit
> > ! control over matching is more common at the "secure" level, described
> > ! below. This security level is not an appropriate default for systems
> > ! delivering mail to the Internet. </dd>
> > !
> > ! <dt><b>secure</b></dt> <dd>Secure-channel TLS. At this security level,
> > ! DNS MX lookups, though potentially used to determine the candidate
> > ! next-hop gateway IP addresses, are <b>not</b> trusted to be secure enough
> > ! for TLS peername verification. Instead, the default name verified in
> > ! the server certificate is obtained from the next-hop domain as specified
> > ! in the <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> configuration parameter. The default
> > ! matching rule is that a server certificate matches when its name is equal
> > ! to or is a sub-domain of the nexthop domain. This security level is not
> > ! an appropriate default for systems delivering mail to the Internet. </dd>
> > !
> > ! </dl>
> > !
> > ! <p>
> > ! Examples:
> > ! </p>
> > !
> > ! <pre>
> > ! # No TLS. Formerly: <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>=no and <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>=no.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = none
> > ! </pre>
> > !
> > ! <pre>
> > ! # Opportunistic TLS.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = may
> > ! # Postfix ≥ 2.6:
> > ! # Do not tweak opportunistic ciphers or protocol unless it is essential
> > ! # to do so (if a security vulnerability is found in the SSL library that
> > ! # can be mitigated by disabling a particular protocol or raising the
> > ! # cipher grade from "export" to "low" or "medium").
> > ! <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = export
> > ! <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2
> > ! </pre>
> > !
> > ! <pre>
> > ! # Mandatory (high-grade) TLS encryption.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = encrypt
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
> > ! </pre>
> > !
> > ! <pre>
> > ! # Mandatory TLS verification of hostname or nexthop domain.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = verify
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
> > ! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> = hostname, nexthop, dot-nexthop
> > ! </pre>
> > !
> > ! <pre>
> > ! # Secure channel TLS with exact nexthop name match.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = secure
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = TLSv1
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
> > ! <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop
> > ! </pre>
> > !
> > ! <pre>
> > ! # Certificate fingerprint verification (Postfix ≥ 2.5).
> > ! # The CA-less "fingerprint" security level only scales to a limited
> > ! # number of destinations. As a global default rather than a per-site
> > ! # setting, this is practical when mail for all recipients is sent
> > ! # to a central mail hub.
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
> > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
> > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Name of the file containing the optional Postfix SMTP client
> > ! TLS session cache. Specify a database type that supports enumeration,
> > ! such as <b>btree</b> or <b>sdbm</b>; there is no need to support
> > ! concurrent access. The file is created if it does not exist. The <a href="smtp.8.html">smtp(8)</a>
> > ! daemon does not use this parameter directly, rather the cache is
> > ! implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
> > ! per-smtp-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not effective.
> > ! Note, that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon:
> > ! $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
> > ! (and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to
> > ! be stored separately. It is not at this time possible to store multiple
> > ! caches in a single database. </p>
> > !
> > ! <p> Note: <b>dbm</b> databases are not suitable. TLS
> > ! session objects are too large. </p>
> > !
> > ! <p> As of version 2.5, Postfix no longer uses root privileges when
> > ! opening this file. The file should now be stored under the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
> > ! under a non-Postfix directory is redirected to the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a> = btree:/var/lib/postfix/smtp_scache
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a>
> > ! (default: 3600s)</b></DT><DD>
> > !
> > ! <p> The expiration time of Postfix SMTP client TLS session cache
> > ! information. A cache cleanup is performed periodically
> > ! every $<a href="postconf.5.html#smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a> seconds. As with
> > ! $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>, this parameter is implemented in the
> > ! <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtp-instance <a href="master.5.html">master.cf</a> overrides
> > ! are not possible. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
> > ! (default: hostname)</b></DT><DD>
> > !
> > ! <p> How the Postfix SMTP client verifies the server certificate
> > ! peername for the
> > ! "verify" TLS security level. In a "verify" TLS policy table
> > ! ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
> > ! overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
> > !
> > ! <p> This parameter specifies one or more patterns or strategies separated
> > ! by commas, whitespace or colons. In the policy table the only valid
> > ! separator is the colon character. </p>
> > !
> > ! <p> Patterns specify domain names, or domain name suffixes: </p>
> > !
> > ! <dl>
> > !
> > ! <dt><i>example.com</i></dt> <dd> Match the <i>example.com</i> domain,
> > ! i.e. one of the names the server certificate must be <i>example.com</i>,
> > ! upper and lower case distinctions are ignored. </dd>
> > !
> > ! <dt><i>.example.com</i></dt>
> > ! <dd> Match subdomains of the <i>example.com</i> domain, i.e. match
> > ! a name in the server certificate that consists of a non-zero number of
> > ! labels followed by a <i>.example.com</i> suffix. Case distinctions are
> > ! ignored.</dd>
> > !
> > ! </dl>
> > !
> > ! <p> Strategies specify a transformation from the next-hop domain
> > ! to the expected name in the server certificate: </p>
> > !
> > ! <dl>
> > !
> > ! <dt>nexthop</dt>
> > ! <dd> Match against the next-hop domain, which is either the recipient
> > ! domain, or the transport next-hop configured for the domain stripped of
> > ! any optional socket type prefix, enclosing square brackets and trailing
> > ! port. When MX lookups are not suppressed, this is the original nexthop
> > ! domain prior to the MX lookup, not the result of the MX lookup. For
> > ! LMTP delivery via UNIX-domain sockets, the verified next-hop name is
> > ! $<a href="postconf.5.html#myhostname">myhostname</a>. This strategy is suitable for use with the "secure"
> > ! policy. Case is ignored.</dd>
> > !
> > ! <dt>dot-nexthop</dt>
> > ! <dd> As above, but match server certificate names that are subdomains
> > ! of the next-hop domain. Case is ignored.</dd>
> > !
> > ! <dt>hostname</dt> <dd> Match against the hostname of the server, often
> > ! obtained via an unauthenticated DNS MX lookup. For LMTP delivery via
> > ! UNIX-domain sockets, the verified name is $<a href="postconf.5.html#myhostname">myhostname</a>. This matches
> > ! the verification strategy of the "MUST" keyword in the obsolete
> > ! <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table, and is suitable for use with the "verify"
> > ! security level. When the next-hop name is enclosed in square brackets
> > ! to suppress MX lookups, the "hostname" strategy is the same as the
> > ! "nexthop" strategy. Case is ignored.</dd>
> > !
> > ! </dl>
> > !
> > ! <p>
> > ! Sample <a href="postconf.5.html">main.cf</a> setting:
> > ! </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> = hostname, nexthop, dot-nexthop
> > ! </pre>
> > !
> > ! <p>
> > ! Sample policy table override:
> > ! </p>
> > !
> > ! <pre>
> > ! example.com verify match=hostname:nexthop
> > ! .example.com verify match=example.com:.example.com:hostname
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_use_tls">smtp_use_tls</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> Opportunistic mode: use TLS when a remote SMTP server announces
> > ! STARTTLS support, otherwise send the mail in the clear. Beware:
> > ! some SMTP servers offer STARTTLS even if it is not configured. With
> > ! Postfix < 2.3, if the TLS handshake fails, and no other server is
> > ! available, delivery is deferred and mail stays in the queue. If this
> > ! is a concern for you, use the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> feature instead. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtp_xforward_timeout">smtp_xforward_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> > !
> > ! <p>
> > ! The Postfix SMTP client time limit for sending the XFORWARD command,
> > ! and for receiving the remote SMTP server response.
> > ! </p>
> > !
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a>
> > ! (default: $<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b></DT><DD>
> > !
> > ! <p> What remote SMTP clients are allowed to specify the XVERP command.
> > ! This command requests that mail be delivered one recipient at a
> > ! time with a per recipient return address. </p>
> > !
> > ! <p> By default, no clients are allowed to specify XVERP. </p>
> > !
> > ! <p> This parameter was renamed with Postfix version 2.1. The default value
> > ! is backwards compatible with Postfix version 2.0. </p>
> > !
> > ! <p> Specify a list of network/netmask patterns, separated by commas
> > ! and/or whitespace. The mask specifies the number of bits in the
> > ! network part of a host address. You can also specify hostnames or
> > ! .domain names (the initial dot causes the domain to match any name
> > ! below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
> > ! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
> > ! is matched when a table entry matches a lookup string (the lookup
> > ! result is ignored). Continue long lines by starting the next line
> > ! with whitespace. Specify "!pattern" to exclude an address or network
> > ! block from the list. The form "!/file/name" is supported only in
> > ! Postfix version 2.4 and later. </p>
> > !
> > ! <p> Note: IP version 6 address information must be specified inside
> > ! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> value, and in
> > ! files specified with "/file/name". IP version 6 addresses contain
> > ! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
> > ! pattern. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p>
> > ! What remote SMTP clients are allowed to use the XCLIENT feature. This
> > ! command overrides remote SMTP client information that is used for access
> > ! control. Typical use is for SMTP-based content filters, fetchmail-like
> > ! programs, or SMTP server access rule testing. See the <a href="XCLIENT_README.html">XCLIENT_README</a>
> > ! document for details.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> > !
> > ! <p>
> > ! By default, no clients are allowed to specify XCLIENT.
> > ! </p>
> > !
> > ! <p>
> > ! Specify a list of network/netmask patterns, separated by commas
> > ! and/or whitespace. The mask specifies the number of bits in the
> > ! network part of a host address. You can also specify hostnames or
> > ! .domain names (the initial dot causes the domain to match any name
> > ! below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
> > ! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
> > ! is matched when a table entry matches a lookup string (the lookup
> > ! result is ignored). Continue long lines by starting the next line
> > ! with whitespace. Specify "!pattern" to exclude an address or network
> > ! block from the list. The form "!/file/name" is supported only in
> > ! Postfix version 2.4 and later. </p>
> > !
> > ! <p> Note: IP version 6 address information must be specified inside
> > ! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a> value, and in
> > ! files specified with "/file/name". IP version 6 addresses contain
> > ! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
> > ! pattern. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p>
> > ! What remote SMTP clients are allowed to use the XFORWARD feature. This
> > ! command forwards information that is used to improve logging after
> > ! SMTP-based content filters. See the <a href="XFORWARD_README.html">XFORWARD_README</a> document for
> > ! details.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> > !
> > ! <p>
> > ! By default, no clients are allowed to specify XFORWARD.
> > ! </p>
> > !
> > ! <p>
> > ! Specify a list of network/netmask patterns, separated by commas
> > ! and/or whitespace. The mask specifies the number of bits in the
> > ! network part of a host address. You can also specify hostnames or
> > ! .domain names (the initial dot causes the domain to match any name
> > ! below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
> > ! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
> > ! is matched when a table entry matches a lookup string (the lookup
> > ! result is ignored). Continue long lines by starting the next line
> > ! with whitespace. Specify "!pattern" to exclude an address or network
> > ! block from the list. The form "!/file/name" is supported only in
> > ! Postfix version 2.4 and later. </p>
> > !
> > ! <p> Note: IP version 6 address information must be specified inside
> > ! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a> value, and in
> > ! files specified with "/file/name". IP version 6 addresses contain
> > ! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
> > ! pattern. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_banner">smtpd_banner</a>
> > ! (default: $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a>)</b></DT><DD>
> > !
> > ! <p>
> > ! The text that follows the 220 status code in the SMTP greeting
> > ! banner. Some people like to see the mail version advertised. By
> > ! default, Postfix shows no version.
> > ! </p>
> > !
> > ! <p>
> > ! You MUST specify $<a href="postconf.5.html#myhostname">myhostname</a> at the start of the text. This is
> > ! required by the SMTP protocol.
> > ! </p>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_banner">smtpd_banner</a> = $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a> ($<a href="postconf.5.html#mail_version">mail_version</a>)
> > ! </pre>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>
> > ! (default: 50)</b></DT><DD>
> > !
> > ! <p>
> > ! How many simultaneous connections any client is allowed to
> > ! make to this service. By default, the limit is set to half
> > ! the default process limit value.
> > ! </p>
> > !
> > ! <p>
> > ! To disable this feature, specify a limit of 0.
> > ! </p>
> > !
> > ! <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.2 and later.
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a>
> > ! (default: 0)</b></DT><DD>
> > !
> > ! <p>
> > ! The maximal number of connection attempts any client is allowed to
> > ! make to this service per time unit. The time unit is specified
> > ! with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
> > ! </p>
> > !
> > ! <p>
> > ! By default, a client can make as many connections per time unit as
> > ! Postfix can accept.
> > ! </p>
> > !
> > ! <p>
> > ! To disable this feature, specify a limit of 0.
> > ! </p>
> > !
> > ! <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.2 and later.
> > ! </p>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a> = 1000
> > ! </pre>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a>
> > ! (default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD>
> > !
> > ! <p>
> > ! Clients that are excluded from smtpd_client_*_count/rate_limit
> > ! restrictions. See the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter
> > ! description for the parameter value syntax.
> > ! </p>
> > !
> > ! <p>
> > ! By default, clients in trusted networks are excluded. Specify a
> > ! list of network blocks, hostnames or .domain names (the initial
> > ! dot causes the domain to match any name below it).
> > ! </p>
> > !
> > ! <p> Note: IP version 6 address information must be specified inside
> > ! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a> value, and
> > ! in files specified with "/file/name". IP version 6 addresses
> > ! contain the ":" character, and would otherwise be confused with a
> > ! "<a href="DATABASE_README.html">type:table</a>" pattern. </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.2 and later.
> > ! </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a>
> > ! (default: 0)</b></DT><DD>
> > !
> > ! <p>
> > ! The maximal number of message delivery requests that any client is
> > ! allowed to make to this service per time unit, regardless of whether
> > ! or not Postfix actually accepts those messages. The time unit is
> > ! specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
> > ! </p>
> > !
> > ! <p>
> > ! By default, a client can send as many message delivery requests
> > ! per time unit as Postfix can accept.
> > ! </p>
> > !
> > ! <p>
> > ! To disable this feature, specify a limit of 0.
> > ! </p>
> > !
> > ! <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.2 and later.
> > ! </p>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a> = 1000
> > ! </pre>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a>
> > ! (default: 0)</b></DT><DD>
> > !
> > ! <p>
> > ! The maximal number of new (i.e., uncached) TLS sessions that a
> > ! remote SMTP client is allowed to negotiate with this service per
> > ! time unit. The time unit is specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a>
> > ! configuration parameter.
> > ! </p>
> > !
> > ! <p>
> > ! By default, a remote SMTP client can negotiate as many new TLS
> > ! sessions per time unit as Postfix can accept.
> > ! </p>
> > !
> > ! <p>
> > ! To disable this feature, specify a limit of 0. Otherwise, specify
> > ! a limit that is at least the per-client concurrent session limit,
> > ! or else legitimate client sessions may be rejected.
> > ! </p>
> > !
> > ! <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.3 and later.
> > ! </p>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a> = 100
> > ! </pre>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_client_port_logging">smtpd_client_port_logging</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> Enable logging of the remote SMTP client port in addition to
> > ! the hostname and IP address. The logging format is "host[address]:port".
> > ! </p>
> > !
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a>
> > ! (default: 0)</b></DT><DD>
> > !
> > ! <p>
> > ! The maximal number of recipient addresses that any client is allowed
> > ! to send to this service per time unit, regardless of whether or not
> > ! Postfix actually accepts those recipients. The time unit is specified
> > ! with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
> > ! </p>
> > !
> > ! <p>
> > ! By default, a client can send as many recipient addresses per time
> > ! unit as Postfix can accept.
> > ! </p>
> > !
> > ! <p>
> > ! To disable this feature, specify a limit of 0.
> > ! </p>
> > !
> > ! <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.2 and later.
> > ! </p>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a> = 1000
> > ! </pre>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_client_restrictions">smtpd_client_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p>
> > ! Optional Postfix SMTP server access restrictions in the context of
> > ! a remote SMTP client connection request.
> > ! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
> > ! restriction lists" for a discussion of evaluation context and time.
> > ! </p>
> > !
> > ! <p>
> > ! The default is to allow all connection requests.
> > ! </p>
> > !
> > ! <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > ! </p>
> > !
> > ! <p>
> > ! The following restrictions are specific to client hostname or
> > ! client network address information.
> > ! </p>
> > !
> > ! <dl>
> > !
> > ! <dt><b><a name="check_ccert_access">check_ccert_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > !
> > ! <dd> Use the remote SMTP client certificate fingerprint or the public key
> > ! fingerprint (Postfix 2.9 and later) as lookup key for the specified
> > ! <a href="access.5.html">access(5)</a> database; with Postfix version 2.2, also require that the
> > ! remote SMTP client certificate is verified successfully.
> > ! The fingerprint digest algorithm is configurable via the
> > ! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
> > ! Postfix version 2.5). This feature is available with Postfix version
> > ! 2.2 and later. </dd>
> > !
> > ! <dt><b><a name="check_client_access">check_client_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > !
> > ! <dd>Search the specified access database for the client hostname,
> > ! parent domains, client IP address, or networks obtained by stripping
> > ! least significant octets. See the <a href="access.5.html">access(5)</a> manual page for details. </dd>
> > !
> > ! <dt><b><a name="check_client_mx_access">check_client_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > !
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for the
> > ! client hostname, and execute the corresponding action. Note: a result
> > ! of "OK" is not allowed for safety reasons. Instead, use DUNNO in order
> > ! to exclude specific hosts from blacklists. This feature is available
> > ! in Postfix 2.7 and later. </dd>
> > !
> > ! <dt><b><a name="check_client_ns_access">check_client_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > !
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers for
> > ! the client hostname, and execute the corresponding action. Note: a
> > ! result of "OK" is not allowed for safety reasons. Instead, use DUNNO
> > ! in order to exclude specific hosts from blacklists. This feature is
> > ! available in Postfix 2.7 and later. </dd>
> > !
> > ! <dt><b><a name="check_reverse_client_hostname_access">check_reverse_client_hostname_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > !
> > ! <dd>Search the specified access database for the unverified reverse
> > ! client hostname, parent domains, client IP address, or networks
> > ! obtained by stripping least significant octets. See the <a href="access.5.html">access(5)</a>
> > ! manual page for details. Note: a result of "OK" is not allowed for
> > ! safety reasons. Instead, use DUNNO in order to exclude specific
> > ! hosts from blacklists. This feature is available in Postfix 2.6
> > ! and later.</dd>
> > !
> > ! <dt><b><a name="check_reverse_client_hostname_mx_access">check_reverse_client_hostname_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > !
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for the
> > ! unverified reverse client hostname, and execute the corresponding
> > ! action. Note: a result of "OK" is not allowed for safety reasons.
> > ! Instead, use DUNNO in order to exclude specific hosts from blacklists.
> > ! This feature is available in Postfix 2.7 and later. </dd>
> > !
> > ! <dt><b><a name="check_reverse_client_hostname_ns_access">check_reverse_client_hostname_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > !
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers for
> > ! the unverified reverse client hostname, and execute the corresponding
> > ! action. Note: a result of "OK" is not allowed for safety reasons.
> > ! Instead, use DUNNO in order to exclude specific hosts from blacklists.
> > ! This feature is available in Postfix 2.7 and later. </dd>
> > !
> > ! <dt><b><a name="permit_inet_interfaces">permit_inet_interfaces</a></b></dt>
> > !
> > ! <dd>Permit the request when the client IP address matches
> > ! $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>. </dd>
> > !
> > ! <dt><b><a name="permit_mynetworks">permit_mynetworks</a></b></dt>
> > !
> > ! <dd>Permit the request when the client IP address matches any
> > ! network or network address listed in $<a href="postconf.5.html#mynetworks">mynetworks</a>. </dd>
> > !
> > ! <dt><b><a name="permit_sasl_authenticated">permit_sasl_authenticated</a></b></dt>
> > !
> > ! <dd> Permit the request when the client is successfully
> > ! authenticated via the <a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH) protocol. </dd>
> > !
> > ! <dt><b><a name="permit_tls_all_clientcerts">permit_tls_all_clientcerts</a></b></dt>
> > !
> > ! <dd> Permit the request when the remote SMTP client certificate is
> > ! verified successfully. This option must be used only if a special
> > ! CA issues the certificates and only this CA is listed as trusted
> > ! CA. Otherwise, clients with a third-party certificate would also
> > ! be allowed to relay. Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" when the
> > ! trusted CA is specified with <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> or <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>,
> > ! to prevent Postfix from appending the system-supplied default CAs.
> > ! This feature is available with Postfix version 2.2.</dd>
> > !
> > ! <dt><b><a name="permit_tls_clientcerts">permit_tls_clientcerts</a></b></dt>
> > !
> > ! <dd>Permit the request when the remote SMTP client certificate
> > ! fingerprint or public key fingerprint (Postfix 2.9 and later) is
> > ! listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
> > ! The fingerprint digest algorithm is configurable via the
> > ! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
> > ! Postfix version 2.5). This feature is available with Postfix version
> > ! 2.2. </dd>
> > !
> > ! <dt><b><a name="reject_rbl_client">reject_rbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
> > !
> > ! <dd>Reject the request when the reversed client network address is
> > ! listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
> > ! (Postfix version 2.1 and later only). Each "<i>d</i>" is a number,
> > ! or a pattern inside "[]" that contains one or more ";"-separated
> > ! numbers or number..number ranges (Postfix version 2.8 and later).
> > ! If no "<i>=d.d.d.d</i>" is specified, reject the request when the
> > ! reversed client network address is listed with any A record under
> > ! <i>rbl_domain</i>. <br>
> > ! The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
> > ! rejected requests (default: 554), the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter
> > ! specifies the default server reply, and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter
> > ! specifies tables with server replies indexed by <i>rbl_domain</i>.
> > ! This feature is available in Postfix 2.0 and later. </dd>
> > !
> > ! <dt><b><a name="permit_dnswl_client">permit_dnswl_client <i>dnswl_domain=d.d.d.d</i></a></b></dt>
> > !
> > ! <dd>Accept the request when the reversed client network address is
> > ! listed with the A record "<i>d.d.d.d</i>" under <i>dnswl_domain</i>.
> > ! Each "<i>d</i>" is a number, or a pattern inside "[]" that contains
> > ! one or more ";"-separated numbers or number..number ranges.
> > ! If no "<i>=d.d.d.d</i>" is specified, accept the request when the
> > ! reversed client network address is listed with any A record under
> > ! <i>dnswl_domain</i>. <br> For safety, <a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a> is silently
> > ! ignored when it would override <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>. The
> > ! result is DEFER_IF_REJECT when whitelist lookup fails. This feature
> > ! is available in Postfix 2.8 and later. </dd>
> > !
> > ! <dt><b><a name="reject_rhsbl_client">reject_rhsbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
> > !
> > ! <dd>Reject the request when the client hostname is listed with the
> > ! A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
> > ! 2.1 and later only). Each "<i>d</i>" is a number, or a pattern
> > ! inside "[]" that contains one or more ";"-separated numbers or
> > ! number..number ranges (Postfix version 2.8 and later). If no
> > ! "<i>=d.d.d.d</i>" is specified, reject the request when the client
> > ! hostname is listed with
> > ! any A record under <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>
> > ! description above for additional RBL related configuration parameters.
> > ! This feature is available in Postfix 2.0 and later; with Postfix
> > ! version 2.8 and later, <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a> will usually
> > ! produce better results. </dd>
> > !
> > ! <dt><b><a name="permit_rhswl_client">permit_rhswl_client <i>rhswl_domain=d.d.d.d</i></a></b></dt>
> > !
> > ! <dd>Accept the request when the client hostname is listed with the
> > ! A record "<i>d.d.d.d</i>" under <i>rhswl_domain</i>. Each "<i>d</i>"
> > ! is a number, or a pattern inside "[]" that contains one or more
> > ! ";"-separated numbers or number..number ranges. If no
> > ! "<i>=d.d.d.d</i>" is specified, accept the request when the client
> > ! hostname is listed with any A record under <i>rhswl_domain</i>.
> > ! <br> Caution: client name whitelisting is fragile, since the client
> > ! name lookup can fail due to temporary outages. Client name
> > ! whitelisting should be used only to reduce false positives in e.g.
> > ! DNS-based blocklists, and not for making access rule exceptions.
> > ! <br> For safety, <a href="postconf.5.html#permit_rhswl_client">permit_rhswl_client</a> is silently ignored when it
> > ! would override <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>. The result is DEFER_IF_REJECT
> > ! when whitelist lookup fails. This feature is available in Postfix
> > ! 2.8 and later. </dd>
> > !
> > ! <dt><b><a name="reject_rhsbl_reverse_client">reject_rhsbl_reverse_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
> > !
> > ! <dd>Reject the request when the unverified reverse client hostname
> > ! is listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>.
> > ! Each "<i>d</i>" is a number, or a pattern inside "[]" that contains
> > ! one or more ";"-separated numbers or number..number ranges.
> > ! If no "<i>=d.d.d.d</i>" is specified, reject the request when the
> > ! unverified reverse client hostname is listed with any A record under
> > ! <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description above for
> > ! additional RBL related configuration parameters. This feature is
> > ! available in Postfix 2.8 and later. </dd>
> > !
> > ! <dt><b><a name="reject_unknown_client_hostname">reject_unknown_client_hostname</a></b> (with Postfix < 2.3: reject_unknown_client)</dt>
> > !
> > ! <dd>Reject the request when 1) the client IP address->name mapping
> > ! fails, 2) the name->address mapping fails, or 3) the name->address
> > ! mapping does not match the client IP address. <br> This is a
> > ! stronger restriction than the <a href="postconf.5.html#reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a>
> > ! feature, which triggers only under condition 1) above. <br> The
> > ! <a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response code
> > ! for rejected requests (default: 450). The reply is always 450 in
> > ! case the address->name or name->address lookup failed due to
> > ! a temporary problem. </dd>
> > !
> > ! <dt><b><a name="reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a></b></dt>
> > !
> > ! <dd>Reject the request when the client IP address has no address->name
> > ! mapping. <br> This is a weaker restriction than the
> > ! <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> feature, which requires not only
> > ! that the address->name and name->address mappings exist, but
> > ! also that the two mappings reproduce the client IP address. <br>
> > ! The <a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response
> > ! code for rejected requests (default: 450). The reply is always 450
> > ! in case the address->name lookup failed due to a temporary
> > ! problem. <br> This feature is available in Postfix 2.3 and
> > ! later. </dd>
> > !
> > ! </dl>
> > !
> > ! <p>
> > ! In addition, you can use any of the following <a name="generic">
> > ! generic</a> restrictions. These restrictions are applicable in
> > ! any SMTP command context.
> > ! </p>
> > !
> > ! <dl>
> > !
> > ! <dt><b><a name="check_policy_service">check_policy_service <i>servername</i></a></b></dt>
> > !
> > ! <dd>Query the specified policy server. See the <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a>
> > ! document for details. This feature is available in Postfix 2.1
> > ! and later. </dd>
> > !
> > ! <dt><b><a name="defer">defer</a></b></dt>
> > !
> > ! <dd>Defer the request. The client is told to try again later. This
> > ! restriction is useful at the end of a restriction list, to make
> > ! the default policy explicit. <br> The <a href="postconf.5.html#defer_code">defer_code</a> parameter specifies
> > ! the SMTP server reply code (default: 450).</dd>
> > !
> > ! <dt><b><a name="defer_if_permit">defer_if_permit</a></b></dt>
> > !
> > ! <dd>Defer the request if some later restriction would result in an
> > ! explicit or implicit PERMIT action. This is useful when a blacklisting
> > ! feature fails due to a temporary problem. This feature is available
> > ! in Postfix version 2.1 and later. </dd>
> > !
> > ! <dt><b><a name="defer_if_reject">defer_if_reject</a></b></dt>
> > !
> > ! <dd>Defer the request if some later restriction would result in a
> > ! REJECT action. This is useful when a whitelisting feature fails
> > ! due to a temporary problem. This feature is available in Postfix
> > ! version 2.1 and later. </dd>
> > !
> > ! <dt><b><a name="permit">permit</a></b></dt>
> > !
> > ! <dd>Permit the request. This restriction is useful at the end of
> > ! a restriction list, to make the default policy explicit.</dd>
> > !
> > ! <dt><b><a name="reject_multi_recipient_bounce">reject_multi_recipient_bounce</a></b></dt>
> > !
> > ! <dd>Reject the request when the envelope sender is the null address,
> > ! and the message has multiple envelope recipients. This usage has
> > ! rare but legitimate applications: under certain conditions,
> > ! multi-recipient mail that was posted with the DSN option NOTIFY=NEVER
> > ! may be forwarded with the null sender address.
> > ! <br> Note: this restriction can only work reliably
> > ! when used in <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> or
> > ! <a href="postconf.5.html#smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>, because the total number of
> > ! recipients is not known at an earlier stage of the SMTP conversation.
> > ! Use at the RCPT stage will only reject the second etc. recipient.
> > ! <br>
> > ! The <a href="postconf.5.html#multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a> parameter specifies the
> > ! response code for rejected requests (default: 550). This feature
> > ! is available in Postfix 2.1 and later. </dd>
> >
> > ! <dt><b><a name="reject_plaintext_session">reject_plaintext_session</a></b></dt>
> >
> > ! <dd>Reject the request when the connection is not encrypted. This
> > ! restriction should not be used before the client has had a chance
> > ! to negotiate encryption with the AUTH or STARTTLS commands.
> > ! <br>
> > ! The <a href="postconf.5.html#plaintext_reject_code">plaintext_reject_code</a> parameter specifies the response
> > ! code for rejected requests (default: 450). This feature is available
> > ! in Postfix 2.3 and later. </dd>
> >
> > - <dt><b><a name="reject_unauth_pipelining">reject_unauth_pipelining</a></b></dt>
> >
> > ! <dd>Reject the request when the client sends SMTP commands ahead
> > ! of time where it is not allowed, or when the client sends SMTP
> > ! commands ahead of time without knowing that Postfix actually supports
> > ! ESMTP command pipelining. This stops mail from bulk mail software
> > ! that improperly uses ESMTP command pipelining in order to speed up
> > ! deliveries.
> > ! <br> With Postfix 2.6 and later, the SMTP server sets a per-session
> > ! flag whenever it detects illegal pipelining, including pipelined
> > ! EHLO or HELO commands. The <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> feature simply
> > ! tests whether the flag was set at any point in time during the
> > ! session.
> > ! <br> With older Postfix versions, <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> checks
> > ! the current status of the input read queue, and its usage is not
> > ! recommended in contexts other than <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a>. </dd>
> >
> > ! <dt><b><a name="reject">reject</a></b></dt>
> >
> > ! <dd>Reject the request. This restriction is useful at the end of
> > ! a restriction list, to make the default policy explicit. The
> > ! <a href="postconf.5.html#reject_code">reject_code</a> configuration parameter specifies the response code for
> > ! rejected requests (default: 554).</dd>
> >
> > ! <dt><b><a name="sleep">sleep <i>seconds</i></a></b></dt>
> >
> > ! <dd>Pause for the specified number of seconds and proceed with
> > ! the next restriction in the list, if any. This may stop zombie
> > ! mail when used as:
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
> > ! sleep 1, <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
> > ! <a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = no
> > ! </pre>
> > ! This feature is available in Postfix 2.3. </dd>
> >
> > - <dt><b><a name="warn_if_reject">warn_if_reject</a></b></dt>
> >
> > ! <dd> A safety net for testing. When "<a href="postconf.5.html#warn_if_reject">warn_if_reject</a>" is placed
> > ! before a reject-type restriction, access table query, or
> > ! <a href="postconf.5.html#check_policy_service">check_policy_service</a> query, this logs a "reject_warning" message
> > ! instead of rejecting a request (when a reject-type restriction fails
> > ! due to a temporary error, this logs a "reject_warning" message for
> > ! any implicit "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" actions that would normally prevent
> > ! mail from being accepted by some later access restriction). This
> > ! feature has no effect on <a href="postconf.5.html#defer_if_reject">defer_if_reject</a> restrictions. </dd>
> >
> > ! </dl>
> >
> > ! <p>
> > ! Other restrictions that are valid in this context:
> > ! </p>
> >
> > ! <ul>
> >
> > ! <li> SMTP command specific restrictions that are described under
> > ! the <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>, <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or
> > ! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> parameters. When helo, sender or
> > ! recipient restrictions are listed under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>,
> > ! they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
> > ! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> is evaluated at the time of the RCPT TO
> > ! command.
> >
> > ! </ul>
> >
> > <p>
> > ! Example:
> > </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a>
> > </pre>
> >
> > --- 9190,9352 ----
> >
> > ! <dt><b>none</b></dt>
> > ! <dd>No TLS. No additional attributes are supported at this level. </dd>
> >
> > ! <dt><b>may</b></dt>
> > ! <dd>Opportunistic TLS. No additional attributes are supported at this
> > ! level. Since sending in the clear is acceptable, demanding stronger
> > ! than default TLS security parameters merely reduces inter-operability.
> > ! Postfix 2.3 and later ignore the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters at this security level; all
> > ! protocols are allowed and "export" grade or better ciphers are used.
> > ! When TLS handshakes fail, the connection is retried with TLS disabled.
> > ! This allows mail delivery to sites with non-interoperable TLS
> > ! implementations.</dd>
> >
> > ! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. At this level
> > ! and higher the optional "ciphers" attribute overrides the <a href="postconf.5.html">main.cf</a>
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter and the optional "protocols"
> > ! keyword overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameter.
> > ! In the policy table, multiple protocols must be separated by colons,
> > ! as attribute values may not contain whitespace or commas. </dd>
> >
> > + <dt><b>fingerprint</b></dt> <dd>Certificate fingerprint
> > + verification. Available with Postfix 2.5 and later. At this security
> > + level, there are no trusted certificate authorities. The certificate
> > + trust chain, expiration date, ... are not checked. Instead,
> > + the optional <b>match</b> attribute, or else the <a href="postconf.5.html">main.cf</a>
> > + <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter, lists the
> > + valid "fingerprints" of the server certificate. The digest
> > + algorithm used to calculate the fingerprint is selected by the
> > + <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. Multiple fingerprints can
> > + be combined with a "|" delimiter in a single match attribute, or multiple
> > + match attributes can be employed. The ":" character is not used as a
> > + delimiter as it occurs between each pair of fingerprint (hexadecimal)
> > + digits. </dd>
> >
> > ! <dt><b>verify</b></dt> <dd>Mandatory TLS verification. At this security
> > ! level, DNS MX lookups are trusted to be secure enough, and the name
> > ! verified in the server certificate is usually obtained indirectly via
> > ! unauthenticated DNS MX lookups. The optional "match" attribute overrides
> > ! the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> parameter. In the policy table,
> > ! multiple match patterns and strategies must be separated by colons.
> > ! In practice explicit control over matching is more common with the
> > ! "secure" policy, described below. </dd>
> >
> > ! <dt><b>secure</b></dt> <dd>Secure-channel TLS. At this security level, DNS
> > ! MX lookups, though potentially used to determine the candidate next-hop
> > ! gateway IP addresses, are <b>not</b> trusted to be secure enough for TLS
> > ! peername verification. Instead, the default name verified in the server
> > ! certificate is obtained directly from the next-hop, or is explicitly
> > ! specified via the optional <b>match</b> attribute which overrides the
> > ! <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> parameter. In the policy table,
> > ! multiple match patterns and strategies must be separated by colons.
> > ! The match attribute is most useful when multiple domains are supported by
> > ! common server, the policy entries for additional domains specify matching
> > ! rules for the primary domain certificate. While transport table overrides
> > ! routing the secondary domains to the primary nexthop also allow secure
> > ! verification, they risk delivery to the wrong destination when domains
> > ! change hands or are re-assigned to new gateways. With the "match"
> > ! attribute approach, routing is not perturbed, and mail is deferred if
> > ! verification of a new MX host fails. </dd>
> >
> > ! </dl>
> >
> > <p>
> > ! Example:
> > </p>
> >
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = hash:/etc/postfix/tls_policy
> > ! # Postfix 2.5 and later
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = md5
> > ! </pre>
> >
> > <pre>
> > ! /etc/postfix/tls_policy:
> > ! example.edu none
> > ! example.mil may
> > ! example.gov encrypt protocols=TLSv1
> > ! example.com verify ciphers=high
> > ! example.net secure
> > ! .example.net secure match=.example.net:example.net
> > ! [mail.example.org]:587 secure match=nexthop
> > ! # Postfix 2.5 and later
> > ! [thumb.example.org] fingerprint
> > ! match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
> > ! match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
> > ! </pre>
> >
> > ! <p> <b>Note:</b> The <b>hostname</b> strategy if listed in a non-default
> > ! setting of <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> or in the <b>match</b> attribute
> > ! in the policy table can render the <b>secure</b> level vulnerable to
> > ! DNS forgery. Do not use the <b>hostname</b> strategy for secure-channel
> > ! configurations in environments where DNS security is not assured. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>
> > ! (default: 9)</b></DT><DD>
> >
> > ! <p> The verification depth for remote SMTP server certificates. A depth
> > ! of 1 is sufficient if the issuing CA is listed in a local CA file. </p>
> >
> > ! <p> The default verification depth is 9 (the OpenSSL default) for
> > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
> > ! the default value was 5, but the limit was not actually enforced. If
> > ! you have set this to a lower non-default value, certificates with longer
> > ! trust chains may now fail to verify. Certificate chains with 1 or 2
> > ! CAs are common, deeper chains are more rare and any number between 5
> > ! and 9 should suffice in practice. You can choose a lower number if,
> > ! for example, you trust certificates directly signed by an issuing CA
> > ! but not any CAs it delegates to. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a>
> > ! (default: nexthop, dot-nexthop)</b></DT><DD>
> >
> > ! <p> The server certificate peername verification method for the
> > ! "secure" TLS security level. In a "secure" TLS policy table
> > ! ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
> > ! overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
> >
> > ! <p> This parameter specifies one or more patterns or strategies separated
> > ! by commas, whitespace or colons. In the policy table the only valid
> > ! separator is the colon character. </p>
> >
> > ! <p> For a description of the pattern and strategy syntax see the
> > ! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> parameter. The "hostname" strategy should
> > ! be avoided in this context, as in the absence of a secure global DNS, using
> > ! the results of MX lookups in certificate verification is not immune to active
> > ! (man-in-the-middle) attacks on DNS. </p>
> >
> > ! <p>
> > ! Sample <a href="postconf.5.html">main.cf</a> setting:
> > ! </p>
> > !
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop
> > ! </pre>
> > ! </blockquote>
> >
> > <p>
> > ! Sample policy table override:
> > </p>
> >
> > + <blockquote>
> > <pre>
> > ! example.net secure match=example.com:.example.com
> > ! .example.net secure match=example.com:.example.com
> > </pre>
> > + </blockquote>
> > +
> > + <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 12461,12502 ****
> >
> > ! <DT><b><a name="smtpd_command_filter">smtpd_command_filter</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> A mechanism to transform commands from remote SMTP clients.
> > ! This is a last-resort tool to work around client commands that break
> > ! inter-operability with the Postfix SMTP server. Other uses involve
> > ! fault injection to test Postfix's handling of invalid commands.
> > </p>
> >
> > ! <p> Specify the name of a "<a href="DATABASE_README.html">type:table</a>" lookup table. The search
> > ! string is the SMTP command as received from the remote SMTP client,
> > ! except that initial whitespace and the trailing <CR><LF>
> > ! are removed. The result value is executed by the Postfix SMTP
> > ! server. </p>
> >
> > ! <p> There is no need to use <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> for the following
> > ! cases: </p>
> >
> > ! <ul>
> >
> > ! <li> <p> Use "<a href="postconf.5.html#resolve_numeric_domain">resolve_numeric_domain</a> = yes" to accept
> > ! "<i>user at ipaddress</i>". </p>
> >
> > ! <li> <p> Postfix already accepts the correct form
> > ! "<i>user@[ipaddress]</i>". Use <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> or <a href="postconf.5.html#canonical_maps">canonical_maps</a>
> > ! to translate these into domain names if necessary. </p>
> > !
> > ! <li> <p> Use "<a href="postconf.5.html#strict_rfc821_envelopes">strict_rfc821_envelopes</a> = no" to accept "RCPT TO:<<i>User
> > ! Name <user at example.com>></i>". Postfix will ignore the "<i>User
> > ! Name</i>" part and deliver to the <i><user at example.com></i> address.
> > ! </p>
> >
> > ! </ul>
> >
> > ! <p> Examples of problems that can be solved with the <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a>
> > ! feature: </p>
> >
> > <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/command_filter
> > </pre>
> > --- 9355,9428 ----
> >
> > ! <DT><b><a name="smtp_tls_security_level">smtp_tls_security_level</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> The default SMTP TLS security level for the Postfix SMTP client;
> > ! when a non-empty value is specified, this overrides the obsolete
> > ! parameters <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>, and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>.
> > </p>
> >
> > ! <p> Specify one of the following security levels: </p>
> > !
> > ! <dl>
> >
> > ! <dt><b>none</b></dt> <dd> TLS will not be used unless enabled for specific
> > ! destinations via <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>. </dd>
> >
> > ! <dt><b>may</b></dt>
> > ! <dd> Opportunistic TLS. TLS will be used if supported by the server. Since
> > ! sending in the clear is acceptable, demanding stronger than default TLS
> > ! security parameters merely reduces inter-operability. Postfix 2.3 and
> > ! later ignore the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters at this security level; all
> > ! protocols are allowed and "export" grade or better ciphers are used.
> > ! When TLS handshakes fail, the connection is retried with TLS disabled.
> > ! This allows mail delivery to sites with non-interoperable TLS
> > ! implementations. </dd>
> >
> > ! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption. Since a minimum
> > ! level of security is intended, it reasonable to be specific about
> > ! sufficiently secure protocol versions and ciphers. At this security level
> > ! and higher, the <a href="postconf.5.html">main.cf</a> parameters <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> and
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> specify the TLS protocols and minimum
> > ! cipher grade which the administrator considers secure enough for
> > ! mandatory encrypted sessions. This security level is not an appropriate
> > ! default for systems delivering mail to the Internet. </dd>
> >
> > ! <dt><b>fingerprint</b></dt> <dd>Certificate fingerprint
> > ! verification. Available with Postfix 2.5 and later. At this security
> > ! level, there are no trusted certificate authorities. The certificate
> > ! trust chain, expiration date, ... are not checked. Instead,
> > ! the <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter lists
> > ! the valid "fingerprints" of the server certificate. The digest
> > ! algorithm used to calculate the fingerprint is selected by the
> > ! <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. </dd>
> >
> > ! <dt><b>verify</b></dt> <dd>Mandatory TLS verification. At this security
> > ! level, DNS MX lookups are trusted to be secure enough, and the name
> > ! verified in the server certificate is usually obtained indirectly
> > ! via unauthenticated DNS MX lookups. The <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
> > ! parameter controls how the server name is verified. In practice explicit
> > ! control over matching is more common at the "secure" level, described
> > ! below. This security level is not an appropriate default for systems
> > ! delivering mail to the Internet. </dd>
> > !
> > ! <dt><b>secure</b></dt> <dd>Secure-channel TLS. At this security level,
> > ! DNS MX lookups, though potentially used to determine the candidate
> > ! next-hop gateway IP addresses, are <b>not</b> trusted to be secure enough
> > ! for TLS peername verification. Instead, the default name verified in
> > ! the server certificate is obtained from the next-hop domain as specified
> > ! in the <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> configuration parameter. The default
> > ! matching rule is that a server certificate matches when its name is equal
> > ! to or is a sub-domain of the nexthop domain. This security level is not
> > ! an appropriate default for systems delivering mail to the Internet. </dd>
> > !
> > ! </dl>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > <pre>
> > ! # No TLS. Formerly: <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>=no and <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>=no.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = none
> > </pre>
> > ***************
> > *** 12504,12508 ****
> > <pre>
> > ! /etc/postfix/command_filter:
> > ! # Work around clients that send malformed HELO commands.
> > ! /^HELO\s*$/ HELO domain.invalid
> > </pre>
> > --- 9430,9433 ----
> > <pre>
> > ! # Opportunistic TLS.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = may
> > </pre>
> > ***************
> > *** 12510,12513 ****
> > <pre>
> > ! # Work around clients that send empty lines.
> > ! /^\s*$/ NOOP
> > </pre>
> > --- 9435,9439 ----
> > <pre>
> > ! # Mandatory (high-grade) TLS encryption.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = encrypt
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
> > </pre>
> > ***************
> > *** 12515,12519 ****
> > <pre>
> > ! # Work around clients that send RCPT TO:<'user at domain'>.
> > ! # WARNING: do not lose the parameters that follow the address.
> > ! /^RCPT\s+TO:\s*<'([^[:space:]]+)'>(.*)/ RCPT TO:<$1>$2
> > </pre>
> > --- 9441,9446 ----
> > <pre>
> > ! # Mandatory TLS verification of hostname or nexthop domain.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = verify
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
> > ! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> = hostname, nexthop, dot-nexthop
> > </pre>
> > ***************
> > *** 12521,12525 ****
> > <pre>
> > ! # Append XVERP to MAIL FROM commands to request VERP-style delivery.
> > ! # See <a href="VERP_README.html">VERP_README</a> for more information on how to use Postfix VERP.
> > ! /^(MAIL FROM:<listname at example\.com>.*)/ $1 XVERP
> > </pre>
> > --- 9448,9454 ----
> > <pre>
> > ! # Secure channel TLS with exact nexthop name match.
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = secure
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = TLSv1
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
> > ! <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop
> > </pre>
> > ***************
> > *** 12527,12535 ****
> > <pre>
> > ! # Bounce-never mail sink. Use <a href="postconf.5.html#notify_classes">notify_classes</a>=bounce,resource,software
> > ! # to send bounced mail to the postmaster (with message body removed).
> > ! /^(RCPT\s+TO:.*?)\bNOTIFY=\S+\b(.*)/ $1 NOTIFY=NEVER $2
> > ! /^(RCPT\s+TO:.*)/ $1 NOTIFY=NEVER
> > </pre>
> >
> > ! <p> This feature is available in Postfix 2.7. </p>
> >
> > --- 9456,9472 ----
> > <pre>
> > ! # Certificate fingerprint verification (Postfix ≥ 2.5).
> > ! # The CA-less "fingerprint" security level only scales to a limited
> > ! # number of destinations. As a global default rather than a per-site
> > ! # setting, this is practical when mail for all recipients is sent
> > ! # to a central mail hub.
> > ! <a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
> > ! <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
> > ! <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
> > ! <a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
> > ! 3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1
> > ! EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35
> > </pre>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 12538,12609 ****
> >
> > ! <DT><b><a name="smtpd_data_restrictions">smtpd_data_restrictions</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional access restrictions that the Postfix SMTP server applies
> > ! in the context of the SMTP DATA command.
> > ! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
> > ! restriction lists" for a discussion of evaluation context and time.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> > !
> > ! <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > ! </p>
> > !
> > ! <p>
> > ! The following restrictions are valid in this context:
> > ! </p>
> > !
> > ! <ul>
> > !
> > ! <li><a href="#generic">Generic</a> restrictions that can be used
> > ! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> > !
> > ! <li>SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
> > ! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
> >
> > ! <li>However, no recipient information is available in the case of
> > ! multi-recipient mail. Acting on only one recipient would be misleading,
> > ! because any decision will affect all recipients equally. Acting on
> > ! all recipients would require a possibly very large amount of memory,
> > ! and would also be misleading for the reasons mentioned before.
> >
> > ! </ul>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
> > ! <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipient_bounce</a>
> > </pre>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_delay_open_until_valid_rcpt">smtpd_delay_open_until_valid_rcpt</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p> Postpone the start of an SMTP mail transaction until a valid
> > ! RCPT TO command is received. Specify "no" to create a mail transaction
> > ! as soon as the Postfix SMTP server receives a valid MAIL FROM
> > ! command. </p>
> > !
> > ! <p> With sites that reject lots of mail, the default setting reduces
> > ! the use of
> > ! disk, CPU and memory resources. The downside is that rejected
> > ! recipients are logged with NOQUEUE instead of a mail transaction
> > ! ID. This complicates the logfile analysis of multi-recipient mail.
> > ! </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > --- 9475,9508 ----
> >
> > ! <DT><b><a name="smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Name of the file containing the optional Postfix SMTP client
> > ! TLS session cache. Specify a database type that supports enumeration,
> > ! such as <b>btree</b> or <b>sdbm</b>; there is no need to support
> > ! concurrent access. The file is created if it does not exist. The <a href="smtp.8.html">smtp(8)</a>
> > ! daemon does not use this parameter directly, rather the cache is
> > ! implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
> > ! per-smtp-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not effective.
> > ! Note, that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon:
> > ! $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
> > ! (and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to
> > ! be stored separately. It is not at this time possible to store multiple
> > ! caches in a single database. </p>
> >
> > ! <p> Note: <b>dbm</b> databases are not suitable. TLS
> > ! session objects are too large. </p>
> >
> > ! <p> As of version 2.5, Postfix no longer uses root privileges when
> > ! opening this file. The file should now be stored under the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
> > ! under a non-Postfix directory is redirected to the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
> >
> > ! <p> Example: </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a> = btree:/var/lib/postfix/smtp_scache
> > </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 12612,12635 ****
> >
> > ! <DT><b><a name="smtpd_delay_reject">smtpd_delay_reject</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p>
> > ! Wait until the RCPT TO command before evaluating
> > ! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
> > ! $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, or wait until the ETRN command before
> > ! evaluating $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
> > ! </p>
> >
> > ! <p>
> > ! This feature is turned on by default because some clients apparently
> > ! mis-behave when the Postfix SMTP server rejects commands before
> > ! RCPT TO.
> > ! </p>
> >
> > ! <p>
> > ! The default setting has one major benefit: it allows Postfix to log
> > ! recipient address information when rejecting a client name/address
> > ! or sender address, so that it is possible to find out whose mail
> > ! is being rejected.
> > ! </p>
> >
> > --- 9511,9523 ----
> >
> > ! <DT><b><a name="smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a>
> > ! (default: 3600s)</b></DT><DD>
> >
> > ! <p> The expiration time of Postfix SMTP client TLS session cache
> > ! information. A cache cleanup is performed periodically
> > ! every $<a href="postconf.5.html#smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a> seconds. As with
> > ! $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>, this parameter is implemented in the
> > ! <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtp-instance <a href="master.5.html">master.cf</a> overrides
> > ! are not possible. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 12638,12691 ****
> >
> > ! <DT><b><a name="smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Lookup tables, indexed by the remote SMTP client address, with
> > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
> > ! etc.) that the Postfix SMTP server will not send in the EHLO response
> > ! to a
> > ! remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
> > ! The table is not searched by hostname for robustness reasons. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
> > ! auth, etc.) that the Postfix SMTP server will not send in the EHLO
> > ! response
> > ! to a remote SMTP client. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ! <p> Notes: </p>
> >
> > ! <ul>
> >
> > ! <li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
> > ! this action from being logged. </p>
> >
> > ! <li> <p> Use the <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a> feature
> > ! to discard EHLO keywords selectively. </p>
> >
> > ! </ul>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Optional access restrictions that the Postfix SMTP server
> > ! applies in the context of the SMTP END-OF-DATA command.
> > ! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
> > ! restriction lists" for a discussion of evaluation context and time.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ! <p> See <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> for details and limitations. </p>
> >
> > --- 9526,9603 ----
> >
> > ! <DT><b><a name="smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
> > ! (default: hostname)</b></DT><DD>
> >
> > ! <p> The server certificate peername verification method for the
> > ! "verify" TLS security level. In a "verify" TLS policy table
> > ! ($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
> > ! overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
> >
> > ! <p> This parameter specifies one or more patterns or strategies separated
> > ! by commas, whitespace or colons. In the policy table the only valid
> > ! separator is the colon character. </p>
> >
> > + <p> Patterns specify domain names, or domain name suffixes: </p>
> >
> > ! <dl>
> >
> > ! <dt><i>example.com</i></dt> <dd> Match the <i>example.com</i> domain,
> > ! i.e. one of the names the server certificate must be <i>example.com</i>,
> > ! upper and lower case distinctions are ignored. </dd>
> >
> > ! <dt><i>.example.com</i></dt>
> > ! <dd> Match subdomains of the <i>example.com</i> domain, i.e. match
> > ! a name in the server certificate that consists of a non-zero number of
> > ! labels followed by a <i>.example.com</i> suffix. Case distinctions are
> > ! ignored.</dd>
> >
> > ! </dl>
> >
> > ! <p> Strategies specify a transformation from the next-hop domain
> > ! to the expected name in the server certificate: </p>
> >
> > ! <dl>
> >
> > ! <dt>nexthop</dt>
> > ! <dd> Match against the next-hop domain, which is either the recipient
> > ! domain, or the transport next-hop configured for the domain stripped of
> > ! any optional socket type prefix, enclosing square brackets and trailing
> > ! port. When MX lookups are not suppressed, this is the original nexthop
> > ! domain prior to the MX lookup, not the result of the MX lookup. For
> > ! LMTP delivery via UNIX-domain sockets, the verified next-hop name is
> > ! $<a href="postconf.5.html#myhostname">myhostname</a>. This strategy is suitable for use with the "secure"
> > ! policy. Case is ignored.</dd>
> >
> > ! <dt>dot-nexthop</dt>
> > ! <dd> As above, but match server certificate names that are subdomains
> > ! of the next-hop domain. Case is ignored.</dd>
> >
> > ! <dt>hostname</dt> <dd> Match against the hostname of the server, often
> > ! obtained via an unauthenticated DNS MX lookup. For LMTP delivery via
> > ! UNIX-domain sockets, the verified name is $<a href="postconf.5.html#myhostname">myhostname</a>. This matches
> > ! the verification strategy of the "MUST" keyword in the obsolete
> > ! <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table, and is suitable for use with the "verify"
> > ! security level. When the next-hop name is enclosed in square brackets
> > ! to suppress MX lookups, the "hostname" strategy is the same as the
> > ! "nexthop" strategy. Case is ignored.</dd>
> >
> > + </dl>
> >
> > ! <p>
> > ! Sample <a href="postconf.5.html">main.cf</a> setting:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> = hostname, nexthop, dot-nexthop
> > ! </pre>
> >
> > ! <p>
> > ! Sample policy table override:
> > </p>
> >
> > ! <pre>
> > ! example.com verify match=hostname:nexthop
> > ! .example.com verify match=example.com:.example.com:hostname
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 12694,12727 ****
> >
> > ! <DT><b><a name="smtpd_enforce_tls">smtpd_enforce_tls</a>
> > (default: no)</b></DT><DD>
> >
> > ! <p> Mandatory TLS: announce STARTTLS support to remote SMTP clients,
> > ! and require that clients use TLS encryption. According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a>
> > ! this MUST NOT be applied in case of a publicly-referenced SMTP
> > ! server. This option is therefore off by default. </p>
> > !
> > ! <p> Note 1: "<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> = yes" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes". </p>
> > !
> > ! <p> Note 2: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
> > ! STARTTLS due to insufficient privileges to access the server private
> > ! key. This is intended behavior. </p>
> >
> > <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_error_sleep_time">smtpd_error_sleep_time</a>
> > ! (default: 1s)</b></DT><DD>
> > !
> > ! <p>With Postfix version 2.1 and later: the SMTP server response delay after
> > ! a client has made more than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors, and
> > ! fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without delivering mail.
> > ! </p>
> > !
> > ! <p>With Postfix version 2.0 and earlier: the SMTP server delay before
> > ! sending a reject (4xx or 5xx) response, when the client has made
> > ! fewer than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors without delivering
> > ! mail. </p>
> >
> > --- 9606,9619 ----
> >
> > ! <DT><b><a name="smtp_use_tls">smtp_use_tls</a>
> > (default: no)</b></DT><DD>
> >
> > ! <p> Opportunistic mode: use TLS when a remote SMTP server announces
> > ! STARTTLS support, otherwise send the mail in the clear. Beware:
> > ! some SMTP servers offer STARTTLS even if it is not configured. With
> > ! Postfix < 2.3, if the TLS handshake fails, and no other server is
> > ! available, delivery is deferred and mail stays in the queue. If this
> > ! is a concern for you, use the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> feature instead. </p>
> >
> > <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
> >
> > ***************
> > *** 12730,12745 ****
> >
> > ! <DT><b><a name="smtpd_etrn_restrictions">smtpd_etrn_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p>
> > ! Optional SMTP server access restrictions in the context of a client
> > ! ETRN request.
> > ! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
> > ! restriction lists" for a discussion of evaluation context and time.
> > ! </p>
> >
> > <p>
> > ! The Postfix ETRN implementation accepts only destinations that are
> > ! eligible for the Postfix "fast flush" service. See the <a href="ETRN_README.html">ETRN_README</a>
> > ! file for details.
> > </p>
> > --- 9622,9629 ----
> >
> > ! <DT><b><a name="smtp_xforward_timeout">smtp_xforward_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > <p>
> > ! The SMTP client time limit for sending the XFORWARD command, and
> > ! for receiving the server response.
> > </p>
> > ***************
> > *** 12747,12752 ****
> > <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > </p>
> > --- 9631,9634 ----
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> > ***************
> > *** 12754,12790 ****
> > <p>
> > ! The following restrictions are specific to the domain name information
> > ! received with the ETRN command.
> > </p>
> >
> > - <dl>
> > -
> > - <dt><b><a name="check_etrn_access">check_etrn_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > -
> > - <dd>Search the specified access database for the ETRN domain name
> > - or its parent domains. See the <a href="access.5.html">access(5)</a> manual page for details.
> > - </dd>
> > -
> > - </dl>
> >
> > ! <p>
> > ! Other restrictions that are valid in this context:
> > ! </p>
> >
> > ! <ul>
> >
> > ! <li><a href="#generic">Generic</a> restrictions that can be used
> > ! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> >
> > ! <li>SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
> >
> > ! </ul>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_etrn_restrictions">smtpd_etrn_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, reject
> > ! </pre>
> >
> > --- 9636,9672 ----
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a>
> > ! (default: $<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b></DT><DD>
> >
> > ! <p> What SMTP clients are allowed to specify the XVERP command.
> > ! This command requests that mail be delivered one recipient at a
> > ! time with a per recipient return address. </p>
> >
> > ! <p> By default, no clients are allowed to specify XVERP. </p>
> >
> > ! <p> This parameter was renamed with Postfix version 2.1. The default value
> > ! is backwards compatible with Postfix version 2.0. </p>
> >
> > ! <p> Specify a list of network/netmask patterns, separated by commas
> > ! and/or whitespace. The mask specifies the number of bits in the
> > ! network part of a host address. You can also specify hostnames or
> > ! .domain names (the initial dot causes the domain to match any name
> > ! below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
> > ! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
> > ! is matched when a table entry matches a lookup string (the lookup
> > ! result is ignored). Continue long lines by starting the next line
> > ! with whitespace. Specify "!pattern" to exclude an address or network
> > ! block from the list. The form "!/file/name" is supported only in
> > ! Postfix version 2.4 and later. </p>
> >
> > ! <p> Note: IP version 6 address information must be specified inside
> > ! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> value, and in
> > ! files specified with "/file/name". IP version 6 addresses contain
> > ! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
> > ! pattern. </p>
> >
> > ***************
> > *** 12793,12801 ****
> >
> > ! <DT><b><a name="smtpd_expansion_filter">smtpd_expansion_filter</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > <p>
> > ! What characters are allowed in $name expansions of RBL reply
> > ! templates. Characters not in the allowed set are replaced by "_".
> > ! Use C like escapes to specify special characters such as whitespace.
> > </p>
> > --- 9675,9685 ----
> >
> > ! <DT><b><a name="smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! What SMTP clients are allowed to use the XCLIENT feature. This
> > ! command overrides SMTP client information that is used for access
> > ! control. Typical use is for SMTP-based content filters, fetchmail-like
> > ! programs, or SMTP server access rule testing. See the <a href="XCLIENT_README.html">XCLIENT_README</a>
> > ! document for details.
> > </p>
> > ***************
> > *** 12803,12805 ****
> > <p>
> > ! This parameter is not subjected to $parameter expansion.
> > </p>
> > --- 9687,9689 ----
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> > ***************
> > *** 12807,12811 ****
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > </p>
> >
> >
> > --- 9691,9714 ----
> > <p>
> > ! By default, no clients are allowed to specify XCLIENT.
> > </p>
> >
> > + <p>
> > + Specify a list of network/netmask patterns, separated by commas
> > + and/or whitespace. The mask specifies the number of bits in the
> > + network part of a host address. You can also specify hostnames or
> > + .domain names (the initial dot causes the domain to match any name
> > + below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
> > + pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
> > + is matched when a table entry matches a lookup string (the lookup
> > + result is ignored). Continue long lines by starting the next line
> > + with whitespace. Specify "!pattern" to exclude an address or network
> > + block from the list. The form "!/file/name" is supported only in
> > + Postfix version 2.4 and later. </p>
> > +
> > + <p> Note: IP version 6 address information must be specified inside
> > + <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a> value, and in
> > + files specified with "/file/name". IP version 6 addresses contain
> > + the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
> > + pattern. </p>
> > +
> >
> > ***************
> > *** 12813,12823 ****
> >
> > ! <DT><b><a name="smtpd_forbidden_commands">smtpd_forbidden_commands</a>
> > ! (default: CONNECT, GET, POST)</b></DT><DD>
> >
> > <p>
> > ! List of commands that cause the Postfix SMTP server to immediately
> > ! terminate the session with a 221 code. This can be used to disconnect
> > ! clients that obviously attempt to abuse the system. In addition to the
> > ! commands listed in this parameter, commands that follow the "Label:"
> > ! format of message headers will also cause a disconnect.
> > </p>
> > --- 9716,9725 ----
> >
> > ! <DT><b><a name="smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! What SMTP clients are allowed to use the XFORWARD feature. This
> > ! command forwards information that is used to improve logging after
> > ! SMTP-based content filters. See the <a href="XFORWARD_README.html">XFORWARD_README</a> document for
> > ! details.
> > </p>
> > ***************
> > *** 12825,12843 ****
> > <p>
> > ! This feature is available in Postfix 2.2 and later.
> > </p>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_hard_error_limit">smtpd_hard_error_limit</a>
> > ! (default: normal: 20, overload: 1)</b></DT><DD>
> >
> > <p>
> > ! The maximal number of errors a remote SMTP client is allowed to
> > ! make without delivering mail. The Postfix SMTP server disconnects
> > ! when the limit is exceeded. Normally the default limit is 20, but
> > ! it changes under overload to just 1. With Postfix 2.5 and earlier,
> > ! the SMTP server always allows up to 20 errors by default.
> >
> > ! </p>
> >
> > --- 9727,9753 ----
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> > ! <p>
> > ! By default, no clients are allowed to specify XFORWARD.
> > ! </p>
> >
> > <p>
> > ! Specify a list of network/netmask patterns, separated by commas
> > ! and/or whitespace. The mask specifies the number of bits in the
> > ! network part of a host address. You can also specify hostnames or
> > ! .domain names (the initial dot causes the domain to match any name
> > ! below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
> > ! pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
> > ! is matched when a table entry matches a lookup string (the lookup
> > ! result is ignored). Continue long lines by starting the next line
> > ! with whitespace. Specify "!pattern" to exclude an address or network
> > ! block from the list. The form "!/file/name" is supported only in
> > ! Postfix version 2.4 and later. </p>
> >
> > ! <p> Note: IP version 6 address information must be specified inside
> > ! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a> value, and in
> > ! files specified with "/file/name". IP version 6 addresses contain
> > ! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
> > ! pattern. </p>
> >
> > ***************
> > *** 12846,12854 ****
> >
> > ! <DT><b><a name="smtpd_helo_required">smtpd_helo_required</a>
> > ! (default: no)</b></DT><DD>
> >
> > <p>
> > ! Require that a remote SMTP client introduces itself with the HELO
> > ! or EHLO command before sending the MAIL command or other commands
> > ! that require EHLO negotiation.
> > </p>
> > --- 9756,9769 ----
> >
> > ! <DT><b><a name="smtpd_banner">smtpd_banner</a>
> > ! (default: $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a>)</b></DT><DD>
> > !
> > ! <p>
> > ! The text that follows the 220 status code in the SMTP greeting
> > ! banner. Some people like to see the mail version advertised. By
> > ! default, Postfix shows no version.
> > ! </p>
> >
> > <p>
> > ! You MUST specify $<a href="postconf.5.html#myhostname">myhostname</a> at the start of the text. This is
> > ! required by the SMTP protocol.
> > </p>
> > ***************
> > *** 12860,12862 ****
> > <pre>
> > ! <a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes
> > </pre>
> > --- 9775,9777 ----
> > <pre>
> > ! <a href="postconf.5.html#smtpd_banner">smtpd_banner</a> = $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a> ($<a href="postconf.5.html#mail_version">mail_version</a>)
> > </pre>
> > ***************
> > *** 12866,12875 ****
> >
> > ! <DT><b><a name="smtpd_helo_restrictions">smtpd_helo_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional restrictions that the Postfix SMTP server applies in the
> > ! context of the SMTP HELO command.
> > ! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
> > ! restriction lists" for a discussion of evaluation context and time.
> > </p>
> > --- 9781,9789 ----
> >
> > ! <DT><b><a name="smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>
> > ! (default: 50)</b></DT><DD>
> >
> > <p>
> > ! How many simultaneous connections any client is allowed to
> > ! make to this service. By default, the limit is set to half
> > ! the default process limit value.
> > </p>
> > ***************
> > *** 12877,12884 ****
> > <p>
> > ! The default is to permit everything.
> > ! </p>
> > !
> > ! <p> Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
> > ! restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
> > ! simply skip <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> by not sending HELO or EHLO).
> > </p>
> > --- 9791,9793 ----
> > <p>
> > ! To disable this feature, specify a limit of 0.
> > </p>
> > ***************
> > *** 12886,12891 ****
> > <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > </p>
> > --- 9795,9798 ----
> > <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > </p>
> > ***************
> > *** 12893,13086 ****
> > <p>
> > ! The following restrictions are specific to the hostname information
> > ! received with the HELO or EHLO command.
> > </p>
> >
> > - <dl>
> > -
> > - <dt><b><a name="check_helo_access">check_helo_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > -
> > - <dd>Search the specified <a href="access.5.html">access(5)</a> database for the HELO or EHLO
> > - hostname or parent domains, and execute the corresponding action.
> > - Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
> > - restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
> > - simply skip <a href="postconf.5.html#check_helo_access">check_helo_access</a> by not sending HELO or EHLO). </dd>
> > -
> > - <dt><b><a name="check_helo_mx_access">check_helo_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > -
> > - <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
> > - the HELO or EHLO hostname, and execute the corresponding action.
> > - Note 1: a result of "OK" is not allowed for safety reasons. Instead,
> > - use DUNNO in order to exclude specific hosts from blacklists. Note
> > - 2: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
> > - restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
> > - simply skip <a href="postconf.5.html#check_helo_mx_access">check_helo_mx_access</a> by not sending HELO or EHLO). This
> > - feature is available in Postfix 2.1 and later.
> > - </dd>
> > -
> > - <dt><b><a name="check_helo_ns_access">check_helo_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > -
> > - <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
> > - for the HELO or EHLO hostname, and execute the corresponding action.
> > - Note 1: a result of "OK" is not allowed for safety reasons. Instead,
> > - use DUNNO in order to exclude specific hosts from blacklists. Note
> > - 2: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
> > - restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
> > - simply skip <a href="postconf.5.html#check_helo_ns_access">check_helo_ns_access</a> by not sending HELO or EHLO). This
> > - feature is available in Postfix 2.1 and later.
> > - </dd>
> > -
> > - <dt><b><a name="reject_invalid_helo_hostname">reject_invalid_helo_hostname</a></b> (with Postfix < 2.3: reject_invalid_hostname)</dt>
> > -
> > - <dd>Reject the request when the HELO or EHLO hostname syntax is
> > - invalid. Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce
> > - this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can simply
> > - skip <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a> by not sending HELO or EHLO).
> > - <br> The <a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> specifies the response code
> > - for rejected requests (default: 501).</dd>
> > -
> > - <dt><b><a name="reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a></b> (with Postfix < 2.3: reject_non_fqdn_hostname)</dt>
> > -
> > - <dd>Reject the request when the HELO or EHLO hostname is not in
> > - fully-qualified domain form, as required by the RFC. Note: specify
> > - "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this restriction
> > - (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can simply skip
> > - <a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a> by not sending HELO or EHLO). <br>
> > - The <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
> > - rejected requests (default: 504).</dd>
> > -
> > - <dt><b><a name="reject_rhsbl_helo">reject_rhsbl_helo <i>rbl_domain=d.d.d.d</i></a></b></dt>
> > -
> > - <dd>Reject the request when the HELO or EHLO hostname hostname is
> > - listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
> > - (Postfix version 2.1 and later only). Each "<i>d</i>" is a number,
> > - or a pattern inside "[]" that contains one or more ";"-separated
> > - numbers or number..number ranges (Postfix version 2.8 and later).
> > - If no "<i>=d.d.d.d</i>" is
> > - specified, reject the request when the HELO or EHLO hostname is
> > - listed with any A record under <i>rbl_domain</i>. See the
> > - <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description for additional RBL related configuration
> > - parameters. Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully
> > - enforce this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a
> > - client can simply skip <a href="postconf.5.html#reject_rhsbl_helo">reject_rhsbl_helo</a> by not sending HELO or
> > - EHLO). This feature is available in Postfix 2.0
> > - and later. </dd>
> > -
> > - <dt><b><a name="reject_unknown_helo_hostname">reject_unknown_helo_hostname</a></b> (with Postfix < 2.3: reject_unknown_hostname)</dt>
> >
> > ! <dd>Reject the request when the HELO or EHLO hostname has no DNS A
> > ! or MX record. <br> The <a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> parameter
> > ! specifies the numerical response code for rejected requests (default:
> > ! 450). <br> The <a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a> parameter
> > ! specifies the action after a temporary DNS error (default:
> > ! <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully
> > ! enforce this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a
> > ! client can simply skip <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a> by not sending
> > ! HELO or EHLO). </dd>
> >
> > ! </dl>
> >
> > <p>
> > ! Other restrictions that are valid in this context:
> > </p>
> >
> > - <ul>
> > -
> > - <li> <a href="#generic">Generic</a> restrictions that can be used
> > - in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> > -
> > - <li> Client hostname or network address specific restrictions
> > - described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> > -
> > - <li> SMTP command specific restrictions described under
> > - <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. When
> > - sender or recipient restrictions are listed under <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
> > - they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
> > - $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> is evaluated at the time of the RCPT TO
> > - command.
> > -
> > - </ul>
> > -
> > <p>
> > ! Examples:
> > </p>
> >
> > - <pre>
> > - <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a>
> > - <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>
> > - </pre>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="smtpd_history_flush_threshold">smtpd_history_flush_threshold</a>
> > - (default: 100)</b></DT><DD>
> > -
> > <p>
> > ! The maximal number of lines in the Postfix SMTP server command history
> > ! before it is flushed upon receipt of EHLO, RSET, or end of DATA.
> > </p>
> >
> > -
> > - </DD>
> > -
> > - <DT><b><a name="smtpd_junk_command_limit">smtpd_junk_command_limit</a>
> > - (default: normal: 100, overload: 1)</b></DT><DD>
> > -
> > <p>
> > ! The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote
> > ! SMTP client can send before the Postfix SMTP server starts to
> > ! increment the error counter with each junk command. The junk
> > ! command count is reset after mail is delivered. See also the
> > ! <a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> and <a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> configuration
> > ! parameters. Normally the default limit is 100, but it changes under
> > ! overload to just 1. With Postfix 2.5 and earlier, the SMTP server
> > ! always allows up to 100 junk commands by default. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> Enable logging of the named "permit" actions in SMTP server
> > ! access lists. This does not affect conditional actions such as
> > ! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>". </p>
> > !
> > ! <p> Specify a list of "permit" action names, "/file/name" or
> > ! "<a href="DATABASE_README.html">type:table</a>" patterns, separated by commas and/or whitespace. The
> > ! list is matched left to right, and the search stops on the first
> > ! match. A "/file/name" pattern is replaced by its contents; a
> > ! "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a name matches a lookup
> > ! key (the lookup result is ignored). Continue long lines by starting
> > ! the next line with whitespace. Specify "!pattern" to exclude a name
> > ! from the list. </p>
> >
> > ! <p> Examples: </p>
> >
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! # Log all "permit" actions.
> > ! <a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> = <a href="DATABASE_README.html#types">static</a>:all
> > ! </pre>
> >
> > <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! # Log "<a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a>" only.
> > ! <a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> = <a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a>
> > </pre>
> >
> > - <p> This feature is available in Postfix 2.10 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > - <DT><b><a name="smtpd_milters">smtpd_milters</a>
> > - (default: empty)</b></DT><DD>
> > -
> > - <p> A list of Milter (mail filter) applications for new mail that
> > - arrives via the Postfix <a href="smtpd.8.html">smtpd(8)</a> server. Specify space or comma as
> > - separator. See the <a href="MILTER_README.html">MILTER_README</a> document for details. </p>
> > -
> > - <p> This feature is available in Postfix 2.3 and later. </p>
> > -
> >
> > --- 9800,9842 ----
> > <p>
> > ! This feature is available in Postfix 2.2 and later.
> > </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a>
> > ! (default: 0)</b></DT><DD>
> >
> > <p>
> > ! The maximal number of connection attempts any client is allowed to
> > ! make to this service per time unit. The time unit is specified
> > ! with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
> > </p>
> >
> > <p>
> > ! By default, a client can make as many connections per time unit as
> > ! Postfix can accept.
> > </p>
> >
> > <p>
> > ! To disable this feature, specify a limit of 0.
> > </p>
> >
> > <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.2 and later.
> > ! </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a> = 1000
> > </pre>
> >
> >
> > ***************
> > *** 13088,13145 ****
> >
> > ! <DT><b><a name="smtpd_noop_commands">smtpd_noop_commands</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! List of commands that the Postfix SMTP server replies to with "250
> > ! Ok", without doing any syntax checks and without changing state.
> > ! This list overrides any commands built into the Postfix SMTP server.
> > </p>
> >
> > -
> > - </DD>
> > -
> > - <DT><b><a name="smtpd_null_access_lookup_key">smtpd_null_access_lookup_key</a>
> > - (default: <>)</b></DT><DD>
> > -
> > <p>
> > ! The lookup key to be used in SMTP <a href="access.5.html">access(5)</a> tables instead of the
> > ! null sender address.
> > </p>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_peername_lookup">smtpd_peername_lookup</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p> Attempt to look up the remote SMTP client hostname, and verify that
> > ! the name matches the client IP address. A client name is set to
> > ! "unknown" when it cannot be looked up or verified, or when name
> > ! lookup is disabled. Turning off name lookup reduces delays due to
> > ! DNS lookup and increases the maximal inbound delivery rate. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_per_record_deadline">smtpd_per_record_deadline</a>
> > ! (default: normal: no, overload: yes)</b></DT><DD>
> > !
> > ! <p> Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> time limit, from a
> > ! time limit per read or write system call, to a time limit to send
> > ! or receive a complete record (an SMTP command line, SMTP response
> > ! line, SMTP message content line, or TLS protocol message). This
> > ! limits the impact from hostile peers that trickle data one byte at
> > ! a time. </p>
> > !
> > ! <p> Note: when per-record deadlines are enabled, a short timeout
> > ! may cause problems with TLS over very slow network connections.
> > ! The reasons are that a TLS protocol message can be up to 16 kbytes
> > ! long (with TLSv1), and that an entire TLS protocol message must be
> > ! sent or received within the per-record deadline. </p>
> > !
> > ! <p> This feature is available in Postfix 2.9 and later. With older
> > ! Postfix releases, the behavior is as if this parameter is set to
> > ! "no". </p>
> >
> > --- 9844,9869 ----
> >
> > ! <DT><b><a name="smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a>
> > ! (default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD>
> >
> > <p>
> > ! Clients that are excluded from connection count, connection rate,
> > ! or SMTP request rate restrictions. See the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter
> > ! description for the parameter value syntax.
> > </p>
> >
> > <p>
> > ! By default, clients in trusted networks are excluded. Specify a
> > ! list of network blocks, hostnames or .domain names (the initial
> > ! dot causes the domain to match any name below it).
> > </p>
> >
> > + <p> Note: IP version 6 address information must be specified inside
> > + <tt>[]</tt> in the <a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a> value, and
> > + in files specified with "/file/name". IP version 6 addresses
> > + contain the ":" character, and would otherwise be confused with a
> > + "<a href="DATABASE_README.html">type:table</a>" pattern. </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.2 and later.
> > ! </p>
> >
> > ***************
> > *** 13148,13155 ****
> >
> > ! <DT><b><a name="smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > <p>
> > ! The time after which an idle SMTPD policy service connection is
> > ! closed.
> > </p>
> > --- 9872,9881 ----
> >
> > ! <DT><b><a name="smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a>
> > ! (default: 0)</b></DT><DD>
> >
> > <p>
> > ! The maximal number of message delivery requests that any client is
> > ! allowed to make to this service per time unit, regardless of whether
> > ! or not Postfix actually accepts those messages. The time unit is
> > ! specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
> > </p>
> > ***************
> > *** 13157,13170 ****
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_policy_service_max_ttl">smtpd_policy_service_max_ttl</a>
> > ! (default: 1000s)</b></DT><DD>
> >
> > <p>
> > ! The time after which an active SMTPD policy service connection is
> > ! closed.
> > </p>
> > --- 9883,9899 ----
> > <p>
> > ! By default, a client can send as many message delivery requests
> > ! per time unit as Postfix can accept.
> > </p>
> >
> > + <p>
> > + To disable this feature, specify a limit of 0.
> > + </p>
> >
> > ! <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > ! </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.2 and later.
> > </p>
> > ***************
> > *** 13172,13176 ****
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> >
> > --- 9901,9909 ----
> > <p>
> > ! Example:
> > </p>
> >
> > + <pre>
> > + <a href="postconf.5.html#smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a> = 1000
> > + </pre>
> > +
> >
> > ***************
> > *** 13178,13185 ****
> >
> > ! <DT><b><a name="smtpd_policy_service_timeout">smtpd_policy_service_timeout</a>
> > ! (default: 100s)</b></DT><DD>
> >
> > <p>
> > ! The time limit for connecting to, writing to or receiving from a
> > ! delegated SMTPD policy server.
> > </p>
> > --- 9911,9920 ----
> >
> > ! <DT><b><a name="smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a>
> > ! (default: 0)</b></DT><DD>
> >
> > <p>
> > ! The maximal number of new (i.e., uncached) TLS sessions that a
> > ! remote SMTP client is allowed to negotiate with this service per
> > ! time unit. The time unit is specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a>
> > ! configuration parameter.
> > </p>
> > ***************
> > *** 13187,13200 ****
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_proxy_ehlo">smtpd_proxy_ehlo</a>
> > ! (default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
> >
> > <p>
> > ! How the Postfix SMTP server announces itself to the proxy filter.
> > ! By default, the Postfix hostname is used.
> > </p>
> > --- 9922,9940 ----
> > <p>
> > ! By default, a remote SMTP client can negotiate as many new TLS
> > ! sessions per time unit as Postfix can accept.
> > </p>
> >
> > + <p>
> > + To disable this feature, specify a limit of 0. Otherwise, specify
> > + a limit that is at least the per-client concurrent session limit,
> > + or else legitimate client sessions may be rejected.
> > + </p>
> >
> > ! <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > ! </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.3 and later.
> > </p>
> > ***************
> > *** 13202,13206 ****
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> >
> > --- 9942,9950 ----
> > <p>
> > ! Example:
> > </p>
> >
> > + <pre>
> > + <a href="postconf.5.html#smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a> = 100
> > + </pre>
> > +
> >
> > ***************
> > *** 13208,13228 ****
> >
> > ! <DT><b><a name="smtpd_proxy_filter">smtpd_proxy_filter</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> The hostname and TCP port of the mail filtering proxy server.
> > ! The proxy receives all mail from the Postfix SMTP server, and is
> > ! supposed to give the result to another Postfix SMTP server process.
> > </p>
> >
> > ! <p> Specify "host:port" or "inet:host:port" for a TCP endpoint, or
> > ! "unix:pathname" for a UNIX-domain endpoint. The host can be specified
> > ! as an IP address or as a symbolic name; no MX lookups are done.
> > ! When no "host" or "host:" are specified, the local machine is
> > ! assumed. Pathname interpretation is relative to the Postfix queue
> > ! directory. </p>
> > !
> > ! <p> This feature is available in Postfix 2.1 and later. </p>
> > !
> > ! <p> The "inet:" and "unix:" prefixes are available in Postfix 2.3
> > ! and later. </p>
> >
> > --- 9952,9961 ----
> >
> > ! <DT><b><a name="smtpd_client_port_logging">smtpd_client_port_logging</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Enable logging of the remote SMTP client port in addition to
> > ! the hostname and IP address. The logging format is "host[address]:port".
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 13231,13273 ****
> >
> > ! <DT><b><a name="smtpd_proxy_options">smtpd_proxy_options</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! List of options that control how the Postfix SMTP server
> > ! communicates with a before-queue content filter. Specify zero or
> > ! more of the following, separated by comma or whitespace. </p>
> > !
> > ! <dl>
> > !
> > ! <dt><b>speed_adjust</b></dt>
> > !
> > ! <dd> <p> Do not connect to a before-queue content filter until an entire
> > ! message has been received. This reduces the number of simultaneous
> > ! before-queue content filter processes. </p>
> > !
> > ! <p> NOTE 1: A filter must not <i>selectively</i> reject recipients
> > ! of a multi-recipient message. Rejecting all recipients is OK, as
> > ! is accepting all recipients. </p>
> > !
> > ! <p> NOTE 2: This feature increases the minimum amount of free queue
> > ! space by $<a href="postconf.5.html#message_size_limit">message_size_limit</a>. The extra space is needed to save the
> > ! message to a temporary file. </p> </dd>
> > !
> > ! </dl>
> >
> > <p>
> > ! This feature is available in Postfix 2.7 and later.
> > </p>
> >
> > -
> > - </DD>
> > -
> > - <DT><b><a name="smtpd_proxy_timeout">smtpd_proxy_timeout</a>
> > - (default: 100s)</b></DT><DD>
> > -
> > <p>
> > ! The time limit for connecting to a proxy filter and for sending or
> > ! receiving information. When a connection fails the client gets a
> > ! generic error message while more detailed information is logged to
> > ! the maillog file.
> > </p>
> > --- 9964,9982 ----
> >
> > ! <DT><b><a name="smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a>
> > ! (default: 0)</b></DT><DD>
> >
> > <p>
> > ! The maximal number of recipient addresses that any client is allowed
> > ! to send to this service per time unit, regardless of whether or not
> > ! Postfix actually accepts those recipients. The time unit is specified
> > ! with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
> > ! </p>
> >
> > <p>
> > ! By default, a client can make as many recipient addresses per time
> > ! unit as Postfix can accept.
> > </p>
> >
> > <p>
> > ! To disable this feature, specify a limit of 0.
> > </p>
> > ***************
> > *** 13275,13278 ****
> > <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > </p>
> > --- 9984,9987 ----
> > <p>
> > ! WARNING: The purpose of this feature is to limit abuse. It must
> > ! not be used to regulate legitimate mail traffic.
> > </p>
> > ***************
> > *** 13280,13305 ****
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> > -
> > - </DD>
> > -
> > - <DT><b><a name="smtpd_recipient_limit">smtpd_recipient_limit</a>
> > - (default: 1000)</b></DT><DD>
> > -
> > <p>
> > ! The maximal number of recipients that the Postfix SMTP server
> > ! accepts per message delivery request.
> > </p>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_recipient_overshoot_limit">smtpd_recipient_overshoot_limit</a>
> > ! (default: 1000)</b></DT><DD>
> > !
> > ! <p> The number of recipients that a remote SMTP client can send in
> > ! excess of the limit specified with $<a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a>, before
> > ! the Postfix SMTP server increments the per-session error count
> > ! for each excess recipient. </p>
> >
> > --- 9989,10000 ----
> > <p>
> > ! This feature is available in Postfix 2.2 and later.
> > </p>
> >
> > <p>
> > ! Example:
> > </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a> = 1000
> > ! </pre>
> >
> > ***************
> > *** 13308,13349 ****
> >
> > ! <DT><b><a name="smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>
> > ! (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>)</b></DT><DD>
> > !
> > ! <p>
> > ! The access restrictions that the Postfix SMTP server applies in
> > ! the context of the RCPT TO command.
> > ! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
> > ! restriction lists" for a discussion of evaluation context and time.
> > ! </p>
> >
> > <p>
> > ! By default, the Postfix SMTP server accepts:
> > </p>
> >
> > - <ul>
> > -
> > - <li> Mail from clients whose IP address matches $<a href="postconf.5.html#mynetworks">mynetworks</a>, or:
> > -
> > - <li> Mail to remote destinations that match $<a href="postconf.5.html#relay_domains">relay_domains</a>, except
> > - for addresses that contain sender-specified routing
> > - (user at elsewhere@domain), or:
> > -
> > - <li> Mail to local destinations that match $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > - or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or
> > - $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
> > -
> > - </ul>
> > -
> > <p>
> > ! IMPORTANT: If you change this parameter setting, you must specify
> > ! at least one of the following restrictions. Otherwise Postfix will
> > ! refuse to receive mail:
> > </p>
> >
> > - <blockquote>
> > - <pre>
> > - reject, defer, <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
> > - </pre>
> > - </blockquote>
> > -
> > <p>
> > --- 10003,10016 ----
> >
> > ! <DT><b><a name="smtpd_client_restrictions">smtpd_client_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional SMTP server access restrictions in the context of a client
> > ! SMTP connection request.
> > </p>
> >
> > <p>
> > ! The default is to allow all connection requests.
> > </p>
> >
> > <p>
> > ***************
> > *** 13356,13359 ****
> > <p>
> > ! The following restrictions are specific to the recipient address
> > ! that is received with the RCPT TO command.
> > </p>
> > --- 10023,10026 ----
> > <p>
> > ! The following restrictions are specific to client hostname or
> > ! client network address information.
> > </p>
> > ***************
> > *** 13362,13503 ****
> >
> > ! <dt><b><a name="check_recipient_access">check_recipient_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the resolved RCPT
> > ! TO address, domain, parent domains, or localpart@, and execute the
> > ! corresponding action. </dd>
> >
> > ! <dt><b><a name="check_recipient_mx_access">check_recipient_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
> > ! the RCPT TO domain, and execute the corresponding action. Note:
> > ! a result of "OK" is not allowed for safety reasons. Instead, use
> > ! DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > ! <dt><b><a name="check_recipient_ns_access">check_recipient_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
> > ! for the RCPT TO domain, and execute the corresponding action.
> > ! Note: a result of "OK" is not allowed for safety reasons. Instead,
> > ! use DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > ! <dt><b><a name="permit_auth_destination">permit_auth_destination</a></b></dt>
> >
> > ! <dd>Permit the request when one of the following is true:
> >
> > ! <ul>
> >
> > ! <li> Postfix is mail forwarder: the resolved RCPT TO domain matches
> > ! $<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and the address contains no
> > ! sender-specified routing (user at elsewhere@domain),
> >
> > ! <li> Postfix is the final destination: the resolved RCPT TO domain
> > ! matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
> > ! $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and the address
> > ! contains no sender-specified routing (user at elsewhere@domain).
> >
> > ! </ul></dd>
> >
> > ! <dt><b><a name="permit_mx_backup">permit_mx_backup</a></b></dt>
> >
> > ! <dd>Permit the request when the local mail system is backup MX for
> > ! the RCPT TO domain, or when the domain is an authorized destination
> > ! (see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> for definition).
> >
> > ! <ul>
> >
> > ! <li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> does not accept addresses that have
> > ! sender-specified routing information (example: user at elsewhere@domain).
> >
> > ! <li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> can be vulnerable to mis-use when
> > ! access is not restricted with <a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a>.
> >
> > ! <li> Safety: as of Postfix version 2.3, <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> no longer
> > ! accepts the address when the local mail system is primary MX for
> > ! the recipient domain. Exception: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> accepts the address
> > ! when it specifies an authorized destination (see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
> > ! for definition).
> >
> > ! <li> Limitation: mail may be rejected in case of a temporary DNS
> > ! lookup problem with Postfix prior to version 2.0.
> >
> > ! </ul></dd>
> >
> > ! <dt><b><a name="reject_non_fqdn_recipient">reject_non_fqdn_recipient</a></b></dt>
> >
> > ! <dd>Reject the request when the RCPT TO address is not in
> > ! fully-qualified domain form, as required by the RFC. <br> The
> > ! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
> > ! rejected requests (default: 504). </dd>
> >
> > ! <dt><b><a name="reject_rhsbl_recipient">reject_rhsbl_recipient <i>rbl_domain=d.d.d.d</i></a></b></dt>
> >
> > ! <dd>Reject the request when the RCPT TO domain is listed with the
> > ! A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
> > ! 2.1 and later only). Each "<i>d</i>" is a number, or a pattern
> > ! inside "[]" that contains one or more ";"-separated numbers or
> > ! number..number ranges (Postfix version 2.8 and later). If no
> > ! "<i>=d.d.d.d</i>" is specified, reject
> > ! the request when the RCPT TO domain is listed with
> > ! any A record under <i>rbl_domain</i>. <br> The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a>
> > ! parameter specifies the response code for rejected requests (default:
> > ! 554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter specifies the default server
> > ! reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter specifies tables with server
> > ! replies indexed by <i>rbl_domain</i>. This feature is available
> > ! in Postfix version 2.0 and later.</dd>
> >
> > ! <dt><b><a name="reject_unauth_destination">reject_unauth_destination</a></b></dt>
> >
> > ! <dd>Reject the request unless one of the following is true:
> >
> > ! <ul>
> >
> > ! <li> Postfix is mail forwarder: the resolved RCPT TO domain matches
> > ! $<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and contains no sender-specified
> > ! routing (user at elsewhere@domain),
> >
> > ! <li> Postfix is the final destination: the resolved RCPT TO domain
> > ! matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
> > ! $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and contains
> > ! no sender-specified routing (user at elsewhere@domain).
> >
> > ! </ul> The <a href="postconf.5.html#relay_domains_reject_code">relay_domains_reject_code</a> parameter specifies the response
> > ! code for rejected requests (default: 554). </dd>
> >
> > ! <dt><b><a name="reject_unknown_recipient_domain">reject_unknown_recipient_domain</a></b></dt>
> >
> > ! <dd>Reject the request when Postfix is not final destination for
> > ! the recipient domain, and the RCPT TO domain has 1) no DNS A or MX
> > ! record or 2) a malformed MX record such as a record with
> > ! a zero-length MX hostname (Postfix version 2.3 and later). <br> The
> > ! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the numerical
> > ! response code for rejected requests (default: 450). The response
> > ! is always 450 in case of a temporary DNS error. <br> The
> > ! <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> parameter specifies the action
> > ! after a temporary DNS error (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). </dd>
> >
> > ! <dt><b><a name="reject_unlisted_recipient">reject_unlisted_recipient</a></b> (with Postfix version 2.0: check_recipient_maps)</dt>
> >
> > ! <dd> Reject the request when the RCPT TO address is not listed in
> > ! the list of valid recipients for its domain class. See the
> > ! <a href="postconf.5.html#smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a> parameter description for details.
> > ! This feature is available in Postfix 2.1 and later.</dd>
> >
> > ! <dt><b><a name="reject_unverified_recipient">reject_unverified_recipient</a></b></dt>
> >
> > ! <dd>Reject the request when mail to the RCPT TO address is known
> > ! to bounce, or when the recipient address destination is not reachable.
> > ! Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
> > ! see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
> > ! <a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> parameter specifies the numerical
> > ! response code when an address is known to bounce (default: 450,
> > ! change into 550 when you are confident that it is safe to do so).
> > ! <br>The <a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> parameter specifies the
> > ! numerical response code when an address probe failed due to a
> > ! temporary problem (default: 450). <br> The
> > ! <a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a> parameter specifies the action
> > ! after addres probe failure due to a temporary problem (default:
> > ! <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). <br> This feature is available in Postfix 2.1
> > ! and later. </dd>
> >
> > --- 10029,10245 ----
> >
> > ! <dt><b><a name="check_ccert_access">check_ccert_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd> Use the client certificate fingerprint as lookup key for the
> > ! specified <a href="access.5.html">access(5)</a> database; with Postfix version 2.2, also require that
> > ! the SMTP client certificate is verified successfully.
> > ! The fingerprint digest algorithm is configurable via the
> > ! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
> > ! Postfix version 2.5). This feature is available with Postfix version
> > ! 2.2 and later. </dd>
> >
> > ! <dt><b><a name="check_client_access">check_client_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified access database for the client hostname,
> > ! parent domains, client IP address, or networks obtained by stripping
> > ! least significant octets. See the <a href="access.5.html">access(5)</a> manual page for details. </dd>
> >
> > ! <dt><b><a name="check_reverse_client_hostname_access">check_reverse_client_hostname_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified access database for the unverified reverse
> > ! client hostname, parent domains, client IP address, or networks
> > ! obtained by stripping least significant octets. See the <a href="access.5.html">access(5)</a>
> > ! manual page for details. Note: a result of "OK" is not allowed for
> > ! safety reasons. Instead, use DUNNO in order to exclude specific
> > ! hosts from blacklists. This feature is available in Postfix 2.6
> > ! and later.</dd>
> >
> > ! <dt><b><a name="permit_inet_interfaces">permit_inet_interfaces</a></b></dt>
> >
> > ! <dd>Permit the request when the client IP address matches
> > ! $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>. </dd>
> >
> > ! <dt><b><a name="permit_mynetworks">permit_mynetworks</a></b></dt>
> >
> > ! <dd>Permit the request when the client IP address matches any
> > ! network or network address listed in $<a href="postconf.5.html#mynetworks">mynetworks</a>. </dd>
> >
> > ! <dt><b><a name="permit_sasl_authenticated">permit_sasl_authenticated</a></b></dt>
> > !
> > ! <dd> Permit the request when the client is successfully
> > ! authenticated via the <a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH) protocol. </dd>
> > !
> > ! <dt><b><a name="permit_tls_all_clientcerts">permit_tls_all_clientcerts</a></b></dt>
> > !
> > ! <dd> Permit the request when the remote SMTP client certificate is
> > ! verified successfully. This option must be used only if a special
> > ! CA issues the certificates and only this CA is listed as trusted
> > ! CA, otherwise all clients with a recognized certificate would be
> > ! allowed to relay. This feature is available with Postfix version 2.2.</dd>
> > !
> > ! <dt><b><a name="permit_tls_clientcerts">permit_tls_clientcerts</a></b></dt>
> > !
> > ! <dd>Permit the request when the remote SMTP client certificate
> > ! fingerprint is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
> > ! The fingerprint digest algorithm is configurable via the
> > ! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
> > ! Postfix version 2.5). This feature is available with Postfix version
> > ! 2.2. </dd>
> > !
> > ! <dt><b><a name="reject_rbl_client">reject_rbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
> > !
> > ! <dd>Reject the request when the reversed client network address is
> > ! listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
> > ! (Postfix version 2.1 and later only). If no "<i>=d.d.d.d</i>" is
> > ! specified, reject the request when the reversed client network
> > ! address is listed with any A record under <i>rbl_domain</i>. <br>
> > ! The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
> > ! rejected requests (default: 554), the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter
> > ! specifies the default server reply, and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter
> > ! specifies tables with server replies indexed by <i>rbl_domain</i>.
> > ! This feature is available in Postfix 2.0 and later. </dd>
> > !
> > ! <dt><b><a name="reject_rhsbl_client">reject_rhsbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
> > !
> > ! <dd>Reject the request when the client hostname is listed with the
> > ! A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
> > ! 2.1 and later only). If no "<i>=d.d.d.d</i>" is specified, reject
> > ! the request when the client hostname is listed with
> > ! any A record under <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>
> > ! description above for additional RBL related configuration parameters.
> > ! This feature is available in Postfix 2.0 and later. </dd>
> > !
> > ! <dt><b><a name="reject_unknown_client_hostname">reject_unknown_client_hostname</a></b> (with Postfix < 2.3: reject_unknown_client)</dt>
> > !
> > ! <dd>Reject the request when 1) the client IP address->name mapping
> > ! fails, 2) the name->address mapping fails, or 3) the name->address
> > ! mapping does not match the client IP address. <br> This is a
> > ! stronger restriction than the <a href="postconf.5.html#reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a>
> > ! feature, which triggers only under condition 1) above. <br> The
> > ! <a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response code
> > ! for rejected requests (default: 450). The reply is always 450 in
> > ! case the address->name or name->address lookup failed due to
> > ! a temporary problem. </dd>
> >
> > ! <dt><b><a name="reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a></b></dt>
> >
> > ! <dd>Reject the request when the client IP address has no address->name
> > ! mapping. <br> This is a weaker restriction than the
> > ! <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> feature, which requires not only
> > ! that the address->name and name->address mappings exist, but
> > ! also that the two mappings reproduce the client IP address. <br>
> > ! The <a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response
> > ! code for rejected requests (default: 450). The reply is always 450
> > ! in case the address->name lookup failed due to a temporary
> > ! problem. <br> This feature is available in Postfix 2.3 and
> > ! later. </dd>
> >
> > ! </dl>
> >
> > ! <p>
> > ! In addition, you can use any of the following <a name="generic">
> > ! generic</a> restrictions. These restrictions are applicable in
> > ! any SMTP command context.
> > ! </p>
> >
> > ! <dl>
> >
> > ! <dt><b><a name="check_policy_service">check_policy_service <i>servername</i></a></b></dt>
> >
> > ! <dd>Query the specified policy server. See the <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a>
> > ! document for details. This feature is available in Postfix 2.1
> > ! and later. </dd>
> >
> > ! <dt><b><a name="defer">defer</a></b></dt>
> >
> > ! <dd>Defer the request. The client is told to try again later. This
> > ! restriction is useful at the end of a restriction list, to make
> > ! the default policy explicit. <br> The <a href="postconf.5.html#defer_code">defer_code</a> parameter specifies
> > ! the SMTP server reply code (default: 450).</dd>
> >
> > ! <dt><b><a name="defer_if_permit">defer_if_permit</a></b></dt>
> >
> > ! <dd>Defer the request if some later restriction would result in an
> > ! explicit or implicit PERMIT action. This is useful when a blacklisting
> > ! feature fails due to a temporary problem. This feature is available
> > ! in Postfix version 2.1 and later. </dd>
> >
> > ! <dt><b><a name="defer_if_reject">defer_if_reject</a></b></dt>
> >
> > ! <dd>Defer the request if some later restriction would result in a
> > ! REJECT action. This is useful when a whitelisting feature fails
> > ! due to a temporary problem. This feature is available in Postfix
> > ! version 2.1 and later. </dd>
> >
> > ! <dt><b><a name="permit">permit</a></b></dt>
> >
> > ! <dd>Permit the request. This restriction is useful at the end of
> > ! a restriction list, to make the default policy explicit.</dd>
> >
> > ! <dt><b><a name="reject_multi_recipient_bounce">reject_multi_recipient_bounce</a></b></dt>
> >
> > ! <dd>Reject the request when the envelope sender is the null address,
> > ! and the message has multiple envelope recipients. This usage has
> > ! rare but legitimate applications: under certain conditions,
> > ! multi-recipient mail that was posted with the DSN option NOTIFY=NEVER
> > ! may be forwarded with the null sender address.
> > ! <br> Note: this restriction can only work reliably
> > ! when used in <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> or
> > ! <a href="postconf.5.html#smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>, because the total number of
> > ! recipients is not known at an earlier stage of the SMTP conversation.
> > ! Use at the RCPT stage will only reject the second etc. recipient.
> > ! <br>
> > ! The <a href="postconf.5.html#multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a> parameter specifies the
> > ! response code for rejected requests (default: 550). This feature
> > ! is available in Postfix 2.1 and later. </dd>
> >
> > ! <dt><b><a name="reject_plaintext_session">reject_plaintext_session</a></b></dt>
> >
> > ! <dd>Reject the request when the connection is not encrypted. This
> > ! restriction should not be used before the client has had a chance
> > ! to negotiate encryption with the AUTH or STARTTLS commands.
> > ! <br>
> > ! The <a href="postconf.5.html#plaintext_reject_code">plaintext_reject_code</a> parameter specifies the response
> > ! code for rejected requests (default: 450). This feature is available
> > ! in Postfix 2.3 and later. </dd>
> >
> > ! <dt><b><a name="reject_unauth_pipelining">reject_unauth_pipelining</a></b></dt>
> >
> > ! <dd>Reject the request when the client sends SMTP commands ahead
> > ! of time where it is not allowed, or when the client sends SMTP
> > ! commands ahead of time without knowing that Postfix actually supports
> > ! ESMTP command pipelining. This stops mail from bulk mail software
> > ! that improperly uses ESMTP command pipelining in order to speed up
> > ! deliveries. <br> Note: <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> is not useful
> > ! outside <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> when 1) the client uses ESMTP (EHLO
> > ! instead of HELO) and 2) with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes" (the
> > ! default). The use of <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> in the other
> > ! restriction contexts is therefore not recommended. </dd>
> >
> > ! <dt><b><a name="reject">reject</a></b></dt>
> >
> > ! <dd>Reject the request. This restriction is useful at the end of
> > ! a restriction list, to make the default policy explicit. The
> > ! <a href="postconf.5.html#reject_code">reject_code</a> configuration parameter specifies the response code to
> > ! rejected requests (default: 554).</dd>
> >
> > ! <dt><b><a name="sleep">sleep <i>seconds</i></a></b></dt>
> >
> > ! <dd>Pause for the specified number of seconds and proceed with
> > ! the next restriction in the list, if any. This may stop zombie
> > ! mail when used as:
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
> > ! sleep 1, <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
> > ! <a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = no
> > ! </pre>
> > ! This feature is available in Postfix 2.3. </dd>
> > !
> > ! <dt><b><a name="warn_if_reject">warn_if_reject</a></b></dt>
> > !
> > ! <dd>Change the meaning of the next restriction, so that it logs
> > ! a warning instead of rejecting a request (look for logfile records
> > ! that contain "reject_warning"). This is useful for testing new
> > ! restrictions in a "live" environment without risking unnecessary
> > ! loss of mail. </dd>
> >
> > ***************
> > *** 13511,13518 ****
> >
> > ! <li><a href="#generic">Generic</a> restrictions that can be used
> > ! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> > !
> > ! <li>SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
> > ! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>.
> >
> > --- 10253,10261 ----
> >
> > ! <li> SMTP command specific restrictions that are described under
> > ! the <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>, <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or
> > ! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> parameters. When helo, sender or
> > ! recipient restrictions are listed under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>,
> > ! they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
> > ! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> is evaluated at the time of the RCPT TO
> > ! command.
> >
> > ***************
> > *** 13525,13527 ****
> > <pre>
> > ! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
> > </pre>
> > --- 10268,10270 ----
> > <pre>
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a>
> > </pre>
> > ***************
> > *** 13531,13608 ****
> >
> > ! <DT><b><a name="smtpd_reject_footer">smtpd_reject_footer</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Optional information that is appended after each Postfix SMTP
> > ! server
> > ! 4XX or 5XX response. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> = For assistance, call 800-555-0101.
> > ! Please provide the following information in your problem report:
> > ! time ($localtime), client ($client_address) and server
> > ! ($server_name).
> > ! </pre>
> >
> > ! <p> Server response: </p>
> >
> > ! <pre>
> > ! 550-5.5.1 <user at example> Recipient address rejected: User unknown
> > ! 550 5.5.1 For assistance, call 800-555-0101. Please provide the
> > ! following information in your problem report: time (Jan 4 15:42:00),
> > ! client (192.168.1.248) and server (mail1.example.com).
> > ! </pre>
> >
> > ! <p> Note: the above text is meant to make it easier to find the
> > ! Postfix logfile records for a failed SMTP session. The text itself
> > ! is not logged to the Postfix SMTP server's maillog file. </p>
> >
> > ! <p> Be sure to keep the text as short as possible. Long text may
> > ! be truncated before it is logged to the remote SMTP client's maillog
> > ! file, or before it is returned to the sender in a delivery status
> > ! notification. </p>
> >
> > ! <p> This feature supports a limited number of $name attributes in
> > ! the footer text. These are replaced by their current value for the
> > ! SMTP session: </p>
> >
> > ! <dl>
> >
> > ! <dt> <b>client_address</b> </dt> <dd> The Client IP address that
> > ! is logged in the maillog file. </dd>
> >
> > - <dt> <b>client_port</b> </dt> <dd> The client TCP port that is
> > - logged in the maillog file. </dd>
> >
> > ! <dt> <b>localtime</b> </dt> <dd> The server local time (Mmm dd
> > ! hh:mm:ss) that is logged in the maillog file. </dd>
> >
> > ! <dt> <b>server_name</b> </dt> <dd> The server's <a href="postconf.5.html#myhostname">myhostname</a> value.
> > ! This attribute is made available for sites with multiple MTAs
> > ! (perhaps behind a load-balancer), where the server name can help
> > ! the server support team to quickly find the right log files. </dd>
> >
> > ! </dl>
> >
> > ! <p> Notes: </p>
> >
> > ! <ul>
> >
> > - <li> <p> NOT SUPPORTED are other attributes such as sender, recipient,
> > - or <a href="postconf.5.html">main.cf</a> parameters. </p>
> >
> > ! <li> <p> For safety reasons, text that does not match
> > ! $<a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> is censored. </p>
> >
> > ! </ul>
> >
> > ! <p> This feature supports the two-character sequence \n as a request
> > ! for a line break in the footer text. Postfix automatically inserts
> > ! after each line break the three-digit SMTP reply code (and optional
> > ! enhanced status code) from the original Postfix reject message.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 10274,10362 ----
> >
> > ! <DT><b><a name="smtpd_data_restrictions">smtpd_data_restrictions</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional access restrictions that the Postfix SMTP server applies
> > ! in the context of the SMTP DATA command.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > ! <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > ! </p>
> >
> > ! <p>
> > ! The following restrictions are valid in this context:
> > ! </p>
> >
> > ! <ul>
> >
> > ! <li><a href="#generic">Generic</a> restrictions that can be used
> > ! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> >
> > ! <li>SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
> > ! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
> >
> > ! </ul>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
> > ! <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipient_bounce</a>
> > ! </pre>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_delay_open_until_valid_rcpt">smtpd_delay_open_until_valid_rcpt</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p> Postpone the start of an SMTP mail transaction until a valid
> > ! RCPT TO command is received. Specify "no" to create a mail transaction
> > ! as soon as the SMTP server receives a valid MAIL FROM command. </p>
> >
> > ! <p> With sites that reject lots of mail, the default setting reduces
> > ! the use of
> > ! disk, CPU and memory resources. The downside is that rejected
> > ! recipients are logged with NOQUEUE instead of a mail transaction
> > ! ID. This complicates the logfile analysis of multi-recipient mail.
> > ! </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_delay_reject">smtpd_delay_reject</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p>
> > ! Wait until the RCPT TO command before evaluating
> > ! $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
> > ! $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, or wait until the ETRN command before
> > ! evaluating $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is turned on by default because some clients apparently
> > ! mis-behave when the Postfix SMTP server rejects commands before
> > ! RCPT TO.
> > </p>
> >
> > ! <p>
> > ! The default setting has one major benefit: it allows Postfix to log
> > ! recipient address information when rejecting a client name/address
> > ! or sender address, so that it is possible to find out whose mail
> > ! is being rejected.
> > ! </p>
> >
> > ***************
> > *** 13611,13641 ****
> >
> > ! <DT><b><a name="smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p>
> > ! Request that the Postfix SMTP server rejects mail for unknown
> > ! recipient addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a>
> > ! access restriction is specified. This prevents the Postfix queue
> > ! from filling up with undeliverable MAILER-DAEMON messages.
> > ! </p>
> >
> > ! <p> An address is always considered "known" when it matches a
> > ! <a href="virtual.5.html">virtual(5)</a> alias or a <a href="canonical.5.html">canonical(5)</a> mapping.
> >
> > ! <ul>
> >
> > ! <li> The recipient domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > ! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, but the recipient is not listed in
> > ! $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> is not null.
> >
> > ! <li> The recipient domain matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> but the
> > ! recipient is not listed in $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>.
> >
> > ! <li> The recipient domain matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> but the
> > ! recipient is not listed in $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
> > ! is not null.
> >
> > ! <li> The recipient domain matches $<a href="postconf.5.html#relay_domains">relay_domains</a> but the recipient
> > ! is not listed in $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>, and $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>
> > ! is not null.
> >
> > --- 10365,10398 ----
> >
> > ! <DT><b><a name="smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Lookup tables, indexed by the remote SMTP client address, with
> > ! case insensitive lists of EHLO keywords (pipelining, starttls, auth,
> > ! etc.) that the SMTP server will not send in the EHLO response to a
> > ! remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
> > ! The table is not searched by hostname for robustness reasons. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> > !
> > !
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> A case insensitive list of EHLO keywords (pipelining, starttls,
> > ! auth, etc.) that the SMTP server will not send in the EHLO response
> > ! to a remote SMTP client. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ! <p> Notes: </p>
> >
> > ! <ul>
> >
> > ! <li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
> > ! this action from being logged. </p>
> >
> > ! <li> <p> Use the <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a> feature
> > ! to discard EHLO keywords selectively. </p>
> >
> > ***************
> > *** 13643,13648 ****
> >
> > - <p>
> > - This feature is available in Postfix 2.1 and later.
> > - </p>
> > -
> >
> > --- 10400,10401 ----
> > ***************
> > *** 13650,13684 ****
> >
> > ! <DT><b><a name="smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Request that the Postfix SMTP server rejects mail from unknown
> > ! sender addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a>
> > ! access restriction is specified. This can slow down an explosion
> > ! of forged mail from worms or viruses. </p>
> >
> > ! <p> An address is always considered "known" when it matches a
> > ! <a href="virtual.5.html">virtual(5)</a> alias or a <a href="canonical.5.html">canonical(5)</a> mapping.
> >
> > ! <ul>
> >
> > - <li> The sender domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or
> > - $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, but the sender is not listed in
> > - $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> is not null.
> >
> > ! <li> The sender domain matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> but the sender
> > ! is not listed in $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>.
> >
> > ! <li> The sender domain matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> but the
> > ! sender is not listed in $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
> > ! is not null.
> >
> > ! <li> The sender domain matches $<a href="postconf.5.html#relay_domains">relay_domains</a> but the sender is
> > ! not listed in $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>, and $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> is
> > ! not null.
> >
> > ! </ul>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > --- 10403,10434 ----
> >
> > ! <DT><b><a name="smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Optional access restrictions that the Postfix SMTP server
> > ! applies in the context of the SMTP END-OF-DATA command. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ! <p> See <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> for syntax details. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_enforce_tls">smtpd_enforce_tls</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Mandatory TLS: announce STARTTLS support to SMTP clients,
> > ! and require that clients use TLS encryption. According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a>
> > ! this MUST NOT be applied in case of a publicly-referenced SMTP
> > ! server. This option is off by default and should be used only on
> > ! dedicated servers. </p>
> >
> > ! <p> Note 1: "<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> = yes" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes". </p>
> >
> > ! <p> Note 2: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
> > ! STARTTLS due to insufficient privileges to access the server private
> > ! key. This is intended behavior. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
> >
> > ***************
> > *** 13687,13701 ****
> >
> > ! <DT><b><a name="smtpd_restriction_classes">smtpd_restriction_classes</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! User-defined aliases for groups of access restrictions. The aliases
> > ! can be specified in <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> etc., and on the
> > ! right-hand side of a Postfix <a href="access.5.html">access(5)</a> table.
> > </p>
> >
> > ! <p>
> > ! One major application is for implementing per-recipient UCE control.
> > ! See the <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a> document for other examples.
> > ! </p>
> >
> > --- 10437,10450 ----
> >
> > ! <DT><b><a name="smtpd_error_sleep_time">smtpd_error_sleep_time</a>
> > ! (default: 1s)</b></DT><DD>
> >
> > ! <p>With Postfix version 2.1 and later: the SMTP server response delay after
> > ! a client has made more than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors, and
> > ! fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without delivering mail.
> > </p>
> >
> > ! <p>With Postfix version 2.0 and earlier: the SMTP server delay before
> > ! sending a reject (4xx or 5xx) response, when the client has made
> > ! fewer than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors without delivering
> > ! mail. </p>
> >
> > ***************
> > *** 13704,13714 ****
> >
> > ! <DT><b><a name="smtpd_sasl_application_name">smtpd_sasl_application_name</a>
> > ! (default: smtpd)</b></DT><DD>
> >
> > <p>
> > ! The application name that the Postfix SMTP server uses for SASL
> > ! server initialization. This
> > ! controls the name of the SASL configuration file. The default value
> > ! is <b>smtpd</b>, corresponding to a SASL configuration file named
> > ! <b>smtpd.conf</b>.
> > </p>
> > --- 10453,10460 ----
> >
> > ! <DT><b><a name="smtpd_etrn_restrictions">smtpd_etrn_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional SMTP server access restrictions in the context of a client
> > ! ETRN request.
> > </p>
> > ***************
> > *** 13716,13730 ****
> > <p>
> > ! This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3
> > ! it was renamed to <a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a>.
> > </p>
> >
> > -
> > - </DD>
> > -
> > - <DT><b><a name="smtpd_sasl_auth_enable">smtpd_sasl_auth_enable</a>
> > - (default: no)</b></DT><DD>
> > -
> > <p>
> > ! Enable SASL authentication in the Postfix SMTP server. By default,
> > ! the Postfix SMTP server does not use authentication.
> > </p>
> > --- 10462,10473 ----
> > <p>
> > ! The Postfix ETRN implementation accepts only destinations that are
> > ! eligible for the Postfix "fast flush" service. See the <a href="ETRN_README.html">ETRN_README</a>
> > ! file for details.
> > </p>
> >
> > <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > </p>
> > ***************
> > *** 13732,13768 ****
> > <p>
> > ! If a remote SMTP client is authenticated, the <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>
> > ! access restriction can be used to permit relay access, like this:
> > </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
> > ! <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, ...
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> To reject all SMTP connections from unauthenticated clients,
> > ! specify "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes" (which is the default) and use:
> > ! </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, reject
> > ! </pre>
> > ! </blockquote>
> >
> > <p>
> > ! See the <a href="SASL_README.html">SASL_README</a> file for SASL configuration and operation details.
> > </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_sasl_authenticated_header">smtpd_sasl_authenticated_header</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Report the SASL authenticated user name in the <a href="smtpd.8.html">smtpd(8)</a> Received
> > ! message header. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > --- 10475,10511 ----
> > <p>
> > ! The following restrictions are specific to the domain name information
> > ! received with the ETRN command.
> > </p>
> >
> > ! <dl>
> >
> > ! <dt><b><a name="check_etrn_access">check_etrn_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified access database for the ETRN domain name
> > ! or its parent domains. See the <a href="access.5.html">access(5)</a> manual page for details.
> > ! </dd>
> > !
> > ! </dl>
> >
> > <p>
> > ! Other restrictions that are valid in this context:
> > </p>
> >
> > + <ul>
> >
> > ! <li><a href="#generic">Generic</a> restrictions that can be used
> > ! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> >
> > ! <li>SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
> >
> > ! </ul>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_etrn_restrictions">smtpd_etrn_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, reject
> > ! </pre>
> >
> > ***************
> > *** 13771,13778 ****
> >
> > ! <DT><b><a name="smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! What remote SMTP clients the Postfix SMTP server will not offer
> > ! AUTH support to.
> > </p>
> > --- 10514,10522 ----
> >
> > ! <DT><b><a name="smtpd_expansion_filter">smtpd_expansion_filter</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > <p>
> > ! What characters are allowed in $name expansions of RBL reply
> > ! templates. Characters not in the allowed set are replaced by "_".
> > ! Use C like escapes to specify special characters such as whitespace.
> > </p>
> > ***************
> > *** 13780,13785 ****
> > <p>
> > ! Some clients (Netscape 4 at least) have a bug that causes them to
> > ! require a login and password whenever AUTH is offered, whether it's
> > ! necessary or not. To work around this, specify, for example,
> > ! $<a href="postconf.5.html#mynetworks">mynetworks</a> to prevent Postfix from offering AUTH to local clients.
> > </p>
> > --- 10524,10526 ----
> > <p>
> > ! This parameter is not subjected to $parameter expansion.
> > </p>
> > ***************
> > *** 13787,13815 ****
> > <p>
> > ! Specify a list of network/netmask patterns, separated by commas
> > ! and/or whitespace. The mask specifies the number of bits in the
> > ! network part of a host address. You can also "/file/name" or
> > ! "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name" pattern is replaced by its
> > ! contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a table entry
> > ! matches a lookup string (the lookup result is ignored). Continue
> > ! long lines by starting the next line with whitespace. Specify
> > ! "!pattern" to exclude an address or network block from the list.
> > ! The form "!/file/name" is supported only in Postfix version 2.4 and
> > ! later. </p>
> >
> > ! <p> Note: IP version 6 address information must be specified inside
> > ! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> value, and in
> > ! files specified with "/file/name". IP version 6 addresses contain
> > ! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
> > ! pattern. </p>
> >
> > <p>
> > ! Example:
> > </p>
> >
> > - <pre>
> > - <a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
> > - </pre>
> > -
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> > --- 10528,10548 ----
> > <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_forbidden_commands">smtpd_forbidden_commands</a>
> > ! (default: CONNECT, GET, POST)</b></DT><DD>
> >
> > <p>
> > ! List of commands that causes the Postfix SMTP server to immediately
> > ! terminate the session with a 221 code. This can be used to disconnect
> > ! clients that obviously attempt to abuse the system. In addition to the
> > ! commands listed in this parameter, commands that follow the "Label:"
> > ! format of message headers will also cause a disconnect.
> > </p>
> >
> > <p>
> > ! This feature is available in Postfix 2.2 and later.
> > </p>
> > ***************
> > *** 13819,13830 ****
> >
> > ! <DT><b><a name="smtpd_sasl_local_domain">smtpd_sasl_local_domain</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! The name of the Postfix SMTP server's local SASL authentication
> > ! realm.
> > </p>
> >
> > <p>
> > ! By default, the local authentication realm name is the null string.
> > </p>
> > --- 10552,10571 ----
> >
> > ! <DT><b><a name="smtpd_hard_error_limit">smtpd_hard_error_limit</a>
> > ! (default: 20)</b></DT><DD>
> >
> > <p>
> > ! The maximal number of errors a remote SMTP client is allowed to
> > ! make without delivering mail. The Postfix SMTP server disconnects
> > ! when the limit is exceeded.
> > </p>
> >
> > +
> > + </DD>
> > +
> > + <DT><b><a name="smtpd_helo_required">smtpd_helo_required</a>
> > + (default: no)</b></DT><DD>
> > +
> > <p>
> > ! Require that a remote SMTP client introduces itself at the beginning
> > ! of an SMTP session with the HELO or EHLO command.
> > </p>
> > ***************
> > *** 13832,13834 ****
> > <p>
> > ! Examples:
> > </p>
> > --- 10573,10575 ----
> > <p>
> > ! Example:
> > </p>
> > ***************
> > *** 13836,13839 ****
> > <pre>
> > ! <a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
> > ! <a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#myhostname">myhostname</a>
> > </pre>
> > --- 10577,10579 ----
> > <pre>
> > ! <a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes
> > </pre>
> > ***************
> > *** 13843,13874 ****
> >
> > ! <DT><b><a name="smtpd_sasl_path">smtpd_sasl_path</a>
> > ! (default: smtpd)</b></DT><DD>
> > !
> > ! <p> Implementation-specific information that the Postfix SMTP server
> > ! passes through to
> > ! the SASL plug-in implementation that is selected with
> > ! <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>. Typically this specifies the name of a
> > ! configuration file or rendezvous point. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. In earlier
> > ! releases it was called <b><a href="postconf.5.html#smtpd_sasl_application_name">smtpd_sasl_application_name</a></b>. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_sasl_security_options">smtpd_sasl_security_options</a>
> > ! (default: noanonymous)</b></DT><DD>
> >
> > ! <p> Postfix SMTP server SASL security options; as of Postfix 2.3
> > ! the list of available
> > ! features depends on the SASL server implementation that is selected
> > ! with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>. </p>
> >
> > ! <p> The following security features are defined for the <b>cyrus</b>
> > ! server SASL implementation: </p>
> >
> > <p>
> > ! Restrict what authentication mechanisms the Postfix SMTP server
> > ! will offer to the client. The list of available authentication
> > ! mechanisms is system dependent.
> > </p>
> > --- 10583,10601 ----
> >
> > ! <DT><b><a name="smtpd_helo_restrictions">smtpd_helo_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional restrictions that the Postfix SMTP server applies in the
> > ! context of the SMTP HELO command.
> > ! </p>
> >
> > ! <p>
> > ! The default is to permit everything.
> > ! </p>
> >
> > <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > </p>
> > ***************
> > *** 13876,13878 ****
> > <p>
> > ! Specify zero or more of the following:
> > </p>
> > --- 10603,10606 ----
> > <p>
> > ! The following restrictions are specific to the hostname information
> > ! received with the HELO or EHLO command.
> > </p>
> > ***************
> > *** 13881,13907 ****
> >
> > ! <dt><b>noplaintext</b></dt>
> >
> > ! <dd>Disallow methods that use plaintext passwords. </dd>
> >
> > ! <dt><b>noactive</b></dt>
> >
> > ! <dd>Disallow methods subject to active (non-dictionary) attack. </dd>
> >
> > ! <dt><b>nodictionary</b></dt>
> >
> > ! <dd>Disallow methods subject to passive (dictionary) attack. </dd>
> >
> > ! <dt><b>noanonymous</b></dt>
> >
> > ! <dd>Disallow methods that allow anonymous authentication. </dd>
> >
> > ! <dt><b>forward_secrecy</b></dt>
> >
> > ! <dd>Only allow methods that support forward secrecy (Dovecot only).
> > </dd>
> >
> > ! <dt><b>mutual_auth</b></dt>
> >
> > ! <dd>Only allow methods that provide mutual authentication (not available
> > ! with Cyrus SASL version 1). </dd>
> >
> > --- 10609,10661 ----
> >
> > ! <dt><b><a name="check_helo_access">check_helo_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the HELO or EHLO
> > ! hostname or parent domains, and execute the corresponding action.
> > ! </dd>
> >
> > ! <dt><b><a name="check_helo_mx_access">check_helo_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
> > ! the HELO or EHLO hostname, and execute the corresponding action.
> > ! Note: a result of "OK" is not allowed for safety reasons. Instead,
> > ! use DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > ! <dt><b><a name="check_helo_ns_access">check_helo_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
> > ! for the HELO or EHLO hostname, and execute the corresponding action.
> > ! Note: a result of "OK" is not allowed for safety reasons. Instead,
> > ! use DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > ! <dt><b><a name="reject_invalid_helo_hostname">reject_invalid_helo_hostname</a></b> (with Postfix < 2.3: reject_invalid_hostname)</dt>
> >
> > ! <dd>Reject the request when the HELO or EHLO hostname syntax is
> > ! invalid. <br> The <a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> specifies the response
> > ! code to rejected requests (default: 501).</dd>
> >
> > ! <dt><b><a name="reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a></b> (with Postfix < 2.3: reject_non_fqdn_hostname)</dt>
> >
> > ! <dd>Reject the request when the HELO or EHLO hostname is not in
> > ! fully-qualified domain form, as required by the RFC. <br> The
> > ! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code to
> > ! rejected requests (default: 504).</dd>
> > !
> > ! <dt><b><a name="reject_rhsbl_helo">reject_rhsbl_helo <i>rbl_domain=d.d.d.d</i></a></b></dt>
> > !
> > ! <dd>Reject the request when the HELO or EHLO hostname hostname is
> > ! listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
> > ! (Postfix version 2.1 and later only). If no "<i>=d.d.d.d</i>" is
> > ! specified, reject the request when the HELO or EHLO hostname is
> > ! listed with any A record under <i>rbl_domain</i>. See the
> > ! <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description for additional RBL related configuration
> > ! parameters. This feature is available in Postfix 2.0 and later.
> > </dd>
> >
> > ! <dt><b><a name="reject_unknown_helo_hostname">reject_unknown_helo_hostname</a></b> (with Postfix < 2.3: reject_unknown_hostname)</dt>
> >
> > ! <dd>Reject the request when the HELO or EHLO hostname has no DNS A
> > ! or MX record. <br> The <a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> specifies the
> > ! response code to rejected requests (default: 450). </dd>
> >
> > ***************
> > *** 13910,13926 ****
> > <p>
> > ! By default, the Postfix SMTP server accepts plaintext passwords but
> > ! not anonymous logins.
> > </p>
> >
> > ! <p>
> > ! Warning: it appears that clients try authentication methods in the
> > ! order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5)
> > ! which means that if you disable plaintext passwords, clients will
> > ! log in anonymously, even when they should be able to use CRAM-MD5.
> > ! So, if you disable plaintext logins, disable anonymous logins too.
> > ! Postfix treats anonymous login as no authentication.
> > ! </p>
> >
> > <p>
> > ! Example:
> > </p>
> > --- 10664,10687 ----
> > <p>
> > ! Other restrictions that are valid in this context:
> > </p>
> >
> > ! <ul>
> > !
> > ! <li> <a href="#generic">Generic</a> restrictions that can be used
> > ! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> > !
> > ! <li> Client hostname or network address specific restrictions
> > ! described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> > !
> > ! <li> SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. When
> > ! sender or recipient restrictions are listed under <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
> > ! they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
> > ! $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> is evaluated at the time of the RCPT TO
> > ! command.
> > !
> > ! </ul>
> >
> > <p>
> > ! Examples:
> > </p>
> > ***************
> > *** 13928,13930 ****
> > <pre>
> > ! <a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a> = noanonymous, noplaintext
> > </pre>
> > --- 10689,10692 ----
> > <pre>
> > ! <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a>
> > ! <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>
> > </pre>
> > ***************
> > *** 13934,13942 ****
> >
> > ! <DT><b><a name="smtpd_sasl_tls_security_options">smtpd_sasl_tls_security_options</a>
> > ! (default: $<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a>)</b></DT><DD>
> >
> > ! <p> The SASL authentication security options that the Postfix SMTP
> > ! server uses for TLS encrypted SMTP sessions. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 10696,10719 ----
> >
> > ! <DT><b><a name="smtpd_history_flush_threshold">smtpd_history_flush_threshold</a>
> > ! (default: 100)</b></DT><DD>
> >
> > ! <p>
> > ! The maximal number of lines in the Postfix SMTP server command history
> > ! before it is flushed upon receipt of EHLO, RSET, or end of DATA.
> > ! </p>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_junk_command_limit">smtpd_junk_command_limit</a>
> > ! (default: 100)</b></DT><DD>
> > !
> > ! <p>
> > ! The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote
> > ! SMTP client can send before the Postfix SMTP server starts to
> > ! increment the error counter with each junk command. The junk
> > ! command count is reset after mail is delivered. See also the
> > ! <a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> and <a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> configuration
> > ! parameters.
> > ! </p>
> >
> > ***************
> > *** 13945,13952 ****
> >
> > ! <DT><b><a name="smtpd_sasl_type">smtpd_sasl_type</a>
> > ! (default: cyrus)</b></DT><DD>
> >
> > ! <p> The SASL plug-in type that the Postfix SMTP server should use
> > ! for authentication. The available types are listed with the
> > ! "<b>postconf -a</b>" command. </p>
> >
> > --- 10722,10729 ----
> >
> > ! <DT><b><a name="smtpd_milters">smtpd_milters</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> A list of Milter (mail filter) applications for new mail that
> > ! arrives via the Postfix <a href="smtpd.8.html">smtpd(8)</a> server. See the <a href="MILTER_README.html">MILTER_README</a>
> > ! document for details. </p>
> >
> > ***************
> > *** 13957,13959 ****
> >
> > ! <DT><b><a name="smtpd_sender_login_maps">smtpd_sender_login_maps</a>
> > (default: empty)</b></DT><DD>
> > --- 10734,10736 ----
> >
> > ! <DT><b><a name="smtpd_noop_commands">smtpd_noop_commands</a>
> > (default: empty)</b></DT><DD>
> > ***************
> > *** 13961,13993 ****
> > <p>
> > ! Optional lookup table with the SASL login names that own sender
> > ! (MAIL FROM) addresses.
> > </p>
> >
> > <p>
> > ! Specify zero or more "<a href="DATABASE_README.html">type:table</a>" lookup tables. With lookups from
> > ! indexed files such as DB or DBM, or from networked tables such as
> > ! NIS, LDAP or SQL, the following search operations are done with a
> > ! sender address of <i>user at domain</i>: </p>
> >
> > - <dl>
> >
> > ! <dt> 1) <i>user at domain</i> </dt>
> >
> > ! <dd>This table lookup is always done and has the highest precedence. </dd>
> >
> > ! <dt> 2) <i>user</i> </dt>
> >
> > ! <dd>This table lookup is done only when the <i>domain</i> part of the
> > ! sender address matches $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > ! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. </dd>
> >
> > - <dt> 3) <i>@domain</i> </dt>
> >
> > ! <dd>This table lookup is done last and has the lowest precedence. </dd>
> >
> > ! </dl>
> >
> > <p>
> > ! In all cases the result of table lookup must be either "not found"
> > ! or a list of SASL login names separated by comma and/or whitespace.
> > </p>
> > --- 10738,10782 ----
> > <p>
> > ! List of commands that the Postfix SMTP server replies to with "250
> > ! Ok", without doing any syntax checks and without changing state.
> > ! This list overrides any commands built into the Postfix SMTP server.
> > </p>
> >
> > +
> > + </DD>
> > +
> > + <DT><b><a name="smtpd_null_access_lookup_key">smtpd_null_access_lookup_key</a>
> > + (default: <>)</b></DT><DD>
> > +
> > <p>
> > ! The lookup key to be used in SMTP <a href="access.5.html">access(5)</a> tables instead of the
> > ! null sender address.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_peername_lookup">smtpd_peername_lookup</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p> Attempt to look up the remote SMTP client hostname, and verify that
> > ! the name matches the client IP address. A client name is set to
> > ! "unknown" when it cannot be looked up or verified, or when name
> > ! lookup is disabled. Turning off name lookup reduces delays due to
> > ! DNS lookup and increases the maximal inbound delivery rate. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > <p>
> > ! The time after which an idle SMTPD policy service connection is
> > ! closed.
> > ! </p>
> > !
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> > ***************
> > *** 13997,14006 ****
> >
> > ! <DT><b><a name="smtpd_sender_restrictions">smtpd_sender_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> >
> > <p>
> > ! Optional restrictions that the Postfix SMTP server applies in the
> > ! context of the MAIL FROM command.
> > ! See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
> > ! restriction lists" for a discussion of evaluation context and time.
> > </p>
> > --- 10786,10793 ----
> >
> > ! <DT><b><a name="smtpd_policy_service_max_ttl">smtpd_policy_service_max_ttl</a>
> > ! (default: 1000s)</b></DT><DD>
> >
> > <p>
> > ! The time after which an active SMTPD policy service connection is
> > ! closed.
> > </p>
> > ***************
> > *** 14008,14017 ****
> > <p>
> > ! The default is to permit everything.
> > </p>
> >
> > <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > </p>
> > --- 10795,10808 ----
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> > +
> > + </DD>
> > +
> > + <DT><b><a name="smtpd_policy_service_timeout">smtpd_policy_service_timeout</a>
> > + (default: 100s)</b></DT><DD>
> > +
> > <p>
> > ! The time limit for connecting to, writing to or receiving from a
> > ! delegated SMTPD policy server.
> > </p>
> > ***************
> > *** 14019,14130 ****
> > <p>
> > ! The following restrictions are specific to the sender address
> > ! received with the MAIL FROM command.
> > </p>
> >
> > - <dl>
> >
> > ! <dt><b><a name="check_sender_access">check_sender_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MAIL FROM
> > ! address, domain, parent domains, or localpart@, and execute the
> > ! corresponding action. </dd>
> >
> > ! <dt><b><a name="check_sender_mx_access">check_sender_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
> > ! the MAIL FROM address, and execute the corresponding action. Note:
> > ! a result of "OK" is not allowed for safety reasons. Instead, use
> > ! DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > - <dt><b><a name="check_sender_ns_access">check_sender_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
> > ! for the MAIL FROM address, and execute the corresponding action.
> > ! Note: a result of "OK" is not allowed for safety reasons. Instead,
> > ! use DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > ! <dt><b><a name="reject_authenticated_sender_login_mismatch">reject_authenticated_sender_login_mismatch</a></b></dt>
> >
> > ! <dd>Enforces the <a href="postconf.5.html#reject_sender_login_mismatch">reject_sender_login_mismatch</a> restriction for
> > ! authenticated clients only. This feature is available in
> > ! Postfix version 2.1 and later. </dd>
> >
> > ! <dt><b><a name="reject_non_fqdn_sender">reject_non_fqdn_sender</a></b></dt>
> >
> > ! <dd>Reject the request when the MAIL FROM address is not in
> > ! fully-qualified domain form, as required by the RFC. <br> The
> > ! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
> > ! rejected requests (default: 504). </dd>
> >
> > ! <dt><b><a name="reject_rhsbl_sender">reject_rhsbl_sender <i>rbl_domain=d.d.d.d</i></a></b></dt>
> >
> > ! <dd>Reject the request when the MAIL FROM domain is listed with
> > ! the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix
> > ! version 2.1 and later only). Each "<i>d</i>" is a number, or a
> > ! pattern inside "[]" that contains one or more ";"-separated numbers
> > ! or number..number ranges (Postfix version 2.8 and later). If no
> > ! "<i>=d.d.d.d</i>" is specified,
> > ! reject the request when the MAIL FROM domain is
> > ! listed with any A record under <i>rbl_domain</i>. <br> The
> > ! <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
> > ! rejected requests (default: 554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter
> > ! specifies the default server reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter
> > ! specifies tables with server replies indexed by <i>rbl_domain</i>.
> > ! This feature is available in Postfix 2.0 and later.</dd>
> >
> > - <dt><b><a name="reject_sender_login_mismatch">reject_sender_login_mismatch</a></b></dt>
> >
> > ! <dd>Reject the request when $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a> specifies an
> > ! owner for the MAIL FROM address, but the client is not (SASL) logged
> > ! in as that MAIL FROM address owner; or when the client is (SASL)
> > ! logged in, but the client login name doesn't own the MAIL FROM
> > ! address according to $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>.</dd>
> >
> > ! <dt><b><a name="reject_unauthenticated_sender_login_mismatch">reject_unauthenticated_sender_login_mismatch</a></b></dt>
> >
> > ! <dd>Enforces the <a href="postconf.5.html#reject_sender_login_mismatch">reject_sender_login_mismatch</a> restriction for
> > ! unauthenticated clients only. This feature is available in
> > ! Postfix version 2.1 and later. </dd>
> >
> > - <dt><b><a name="reject_unknown_sender_domain">reject_unknown_sender_domain</a></b></dt>
> >
> > ! <dd>Reject the request when Postfix is not final destination for
> > ! the sender address, and the MAIL FROM domain has 1) no DNS A or MX
> > ! record, or 2) a malformed MX record such as a record with
> > ! a zero-length MX hostname (Postfix version 2.3 and later). <br> The
> > ! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the numerical
> > ! response code for rejected requests (default: 450). The response
> > ! is always 450 in case of a temporary DNS error. <br> The
> > ! <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> parameter specifies the action
> > ! after a temporary DNS error (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). </dd>
> >
> > ! <dt><b><a name="reject_unlisted_sender">reject_unlisted_sender</a></b></dt>
> >
> > ! <dd>Reject the request when the MAIL FROM address is not listed in
> > ! the list of valid recipients for its domain class. See the
> > ! <a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> parameter description for details.
> > ! This feature is available in Postfix 2.1 and later.</dd>
> >
> > - <dt><b><a name="reject_unverified_sender">reject_unverified_sender</a></b></dt>
> >
> > ! <dd>Reject the request when mail to the MAIL FROM address is known to
> > ! bounce, or when the sender address destination is not reachable.
> > ! Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
> > ! see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
> > ! <a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> parameter specifies the numerical
> > ! response code when an address is known to bounce (default: 450,
> > ! change into 550 when you are confident that it is safe to do so).
> > ! <br>The <a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> specifies the numerical response
> > ! code when an address address probe failed due to a temporary problem
> > ! (default: 450). <br> The <a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a> parameter
> > ! specifies the action after address probe failure due to a temporary
> > ! problem (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). <br> This feature is available
> > ! in Postfix 2.1 and later. </dd>
> >
> > ! </dl>
> >
> > <p>
> > ! Other restrictions that are valid in this context:
> > </p>
> > --- 10810,10909 ----
> > <p>
> > ! This feature is available in Postfix 2.1 and later.
> > </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_proxy_ehlo">smtpd_proxy_ehlo</a>
> > ! (default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
> >
> > ! <p>
> > ! How the Postfix SMTP server announces itself to the proxy filter.
> > ! By default, the Postfix hostname is used.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_proxy_filter">smtpd_proxy_filter</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> The hostname and TCP port of the mail filtering proxy server.
> > ! The proxy receives all mail from the Postfix SMTP server, and is
> > ! supposed to give the result to another Postfix SMTP server process.
> > ! </p>
> >
> > ! <p> Specify "host:port" or "inet:host:port" for a TCP endpoint, or
> > ! "unix:pathname" for a UNIX-domain endpoint. The host can be specified
> > ! as an IP address or as a symbolic name; no MX lookups are done.
> > ! When no "host" or "host:" are specified, the local machine is
> > ! assumed. Pathname interpretation is relative to the Postfix queue
> > ! directory. </p>
> >
> > ! <p> This feature is available in Postfix 2.1 and later. </p>
> > !
> > ! <p> The "inet:" and "unix:" prefixes are available in Postfix 2.3
> > ! and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_proxy_timeout">smtpd_proxy_timeout</a>
> > ! (default: 100s)</b></DT><DD>
> > !
> > ! <p>
> > ! The time limit for connecting to a proxy filter and for sending or
> > ! receiving information. When a connection fails the client gets a
> > ! generic error message while more detailed information is logged to
> > ! the maillog file.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_recipient_limit">smtpd_recipient_limit</a>
> > ! (default: 1000)</b></DT><DD>
> >
> > ! <p>
> > ! The maximal number of recipients that the Postfix SMTP server
> > ! accepts per message delivery request.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_recipient_overshoot_limit">smtpd_recipient_overshoot_limit</a>
> > ! (default: 1000)</b></DT><DD>
> >
> > ! <p> The number of recipients that a remote SMTP client can send in
> > ! excess of the limit specified with $<a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a>, before
> > ! the Postfix SMTP server increments the per-session error count
> > ! for each excess recipient. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>
> > ! (default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>)</b></DT><DD>
> >
> > <p>
> > ! The access restrictions that the Postfix SMTP server applies in
> > ! the context of the RCPT TO command.
> > ! </p>
> > !
> > ! <p>
> > ! By default, the Postfix SMTP server accepts:
> > </p>
> > ***************
> > *** 14133,14145 ****
> >
> > ! <li> <a href="#generic">Generic</a> restrictions that can be used
> > ! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> >
> > ! <li> SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
> >
> > ! <li> SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. When recipient restrictions are listed
> > ! under <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, they have effect only with
> > ! "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> is
> > ! evaluated at the time of the RCPT TO command.
> >
> > --- 10912,10922 ----
> >
> > ! <li> Mail from clients whose IP address matches $<a href="postconf.5.html#mynetworks">mynetworks</a>, or:
> >
> > ! <li> Mail to remote destinations that match $<a href="postconf.5.html#relay_domains">relay_domains</a>, except
> > ! for addresses that contain sender-specified routing
> > ! (user at elsewhere@domain), or:
> >
> > ! <li> Mail to local destinations that match $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > ! or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or
> > ! $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
> >
> > ***************
> > *** 14148,14354 ****
> > <p>
> > ! Examples:
> > </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
> > ! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>,
> > ! <a href="postconf.5.html#check_sender_access">check_sender_access</a> hash:/etc/postfix/access
> > </pre>
> >
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_service_name">smtpd_service_name</a>
> > ! (default: smtpd)</b></DT><DD>
> > !
> > ! <p> The internal service that <a href="postscreen.8.html">postscreen(8)</a> hands off allowed
> > ! connections to. In a future version there may be different
> > ! classes of SMTP service. </p>
> > !
> > ! <p> This feature is available in Postfix 2.8. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_soft_error_limit">smtpd_soft_error_limit</a>
> > ! (default: 10)</b></DT><DD>
> >
> > <p>
> > ! The number of errors a remote SMTP client is allowed to make without
> > ! delivering mail before the Postfix SMTP server slows down all its
> > ! responses.
> > </p>
> >
> > ! <ul>
> >
> > ! <li><p>With Postfix version 2.1 and later, the Postfix SMTP server
> > ! delays all responses by $<a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> seconds. </p>
> >
> > ! <li><p>With Postfix versions 2.0 and earlier, the Postfix SMTP
> > ! server delays all responses by (number of errors) seconds. </p>
> >
> > ! </ul>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_starttls_timeout">smtpd_starttls_timeout</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p> The time limit for Postfix SMTP server write and read operations
> > ! during TLS startup and shutdown handshake procedures. The current
> > ! default value is stress-dependent. Before Postfix version 2.8, it
> > ! was fixed at 300s. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_timeout">smtpd_timeout</a>
> > ! (default: normal: 300s, overload: 10s)</b></DT><DD>
> >
> > ! <p>
> > ! The time limit for sending a Postfix SMTP server response and for
> > ! receiving a remote SMTP client request. Normally the default limit
> > ! is 300s, but it changes under overload to just 10s. With Postfix
> > ! 2.5 and earlier, the SMTP server always uses a time limit of 300s
> > ! by default.
> > ! </p>
> >
> > ! <p>
> > ! Note: if you set SMTP time limits to very large values you may have
> > ! to update the global <a href="postconf.5.html#ipc_timeout">ipc_timeout</a> parameter.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_CAfile">smtpd_tls_CAfile</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> A file containing (PEM format) CA certificates of root CAs trusted
> > ! to sign either remote SMTP client certificates or intermediate CA
> > ! certificates. These are loaded into memory before the <a href="smtpd.8.html">smtpd(8)</a> server
> > ! enters the chroot jail. If the number of trusted roots is large, consider
> > ! using <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> instead, but note that the latter directory must
> > ! be present in the chroot jail if the <a href="smtpd.8.html">smtpd(8)</a> server is chrooted. This
> > ! file may also be used to augment the server certificate trust chain,
> > ! but it is best to include all the required certificates directly in the
> > ! server certificate file. </p>
> > !
> > ! <p> Specify "<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> = /path/to/system_CA_file" to use ONLY
> > ! the system-supplied default certificate authority certificates.
> > ! </p>
> > !
> > ! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
> > ! appending the system-supplied default CAs and trusting third-party
> > ! certificates. </p>
> > !
> > ! <p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are not
> > ! requested, and <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> should remain empty. If you do make use
> > ! of client certificates, the distinguished names (DNs) of the certificate
> > ! authorities listed in <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> are sent to the remote SMTP client
> > ! in the client certificate request message. MUAs with multiple client
> > ! certificates may use the list of preferred certificate authorities
> > ! to select the correct client certificate. You may want to put your
> > ! "preferred" CA or CAs in this file, and install other trusted CAs in
> > ! $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> = /etc/postfix/CAcert.pem
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_CApath">smtpd_tls_CApath</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> A directory containing (PEM format) CA certificates of root CAs
> > ! trusted to sign either remote SMTP client certificates or intermediate CA
> > ! certificates. Do not forget to create the necessary "hash" links with,
> > ! for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
> > ! <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> in chroot mode, this directory (or a copy) must be
> > ! inside the chroot jail. </p>
> > !
> > ! <p> Specify "<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> = /path/to/system_CA_directory" to
> > ! use ONLY the system-supplied default certificate authority certificates.
> > ! </p>
> > !
> > ! <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
> > ! appending the system-supplied default CAs and trusting third-party
> > ! certificates. </p>
> > !
> > ! <p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are
> > ! not requested, and <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> should remain empty. In contrast
> > ! to <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, DNs of certificate authorities installed
> > ! in $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> are not included in the client certificate
> > ! request message. MUAs with multiple client certificates may use the
> > ! list of preferred certificate authorities to select the correct
> > ! client certificate. You may want to put your "preferred" CA or
> > ! CAs in $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, and install the remaining trusted CAs in
> > ! $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> = /etc/postfix/certs
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p> Force the Postfix SMTP server to issue a TLS session id, even
> > ! when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
> > ! is empty). This behavior is compatible with Postfix < 2.3. </p>
> >
> > ! <p> With Postfix 2.3 and later the Postfix SMTP server can disable
> > ! session id generation when TLS session caching is turned off. This
> > ! keeps remote SMTP clients from caching sessions that almost certainly cannot
> > ! be re-used. </p>
> >
> > ! <p> By default, the Postfix SMTP server always generates TLS session
> > ! ids. This works around a known defect in mail client applications
> > ! such as MS Outlook, and may also prevent interoperability issues
> > ! with other MTAs. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> = no
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Ask a remote SMTP client for a client certificate. This
> > ! information is needed for certificate based mail relaying with,
> > ! for example, the <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> feature. </p>
> >
> > ! <p> Some clients such as Netscape will either complain if no
> > ! certificate is available (for the list of CAs in $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)
> > ! or will offer multiple client certificates to choose from. This
> > ! may be annoying, so this option is "off" by default. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 10925,11107 ----
> > <p>
> > ! IMPORTANT: If you change this parameter setting, you must specify
> > ! at least one of the following restrictions. Otherwise Postfix will
> > ! refuse to receive mail:
> > </p>
> >
> > + <blockquote>
> > <pre>
> > ! reject, defer, <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
> > </pre>
> > + </blockquote>
> >
> > ! <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > ! </p>
> >
> > <p>
> > ! The following restrictions are specific to the recipient address
> > ! that is received with the RCPT TO command.
> > </p>
> >
> > ! <dl>
> >
> > ! <dt><b><a name="check_recipient_access">check_recipient_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the resolved RCPT
> > ! TO address, domain, parent domains, or localpart@, and execute the
> > ! corresponding action. </dd>
> >
> > ! <dt><b><a name="check_recipient_mx_access">check_recipient_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> > !
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
> > ! the RCPT TO domain, and execute the corresponding action. Note:
> > ! a result of "OK" is not allowed for safety reasons. Instead, use
> > ! DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > + <dt><b><a name="check_recipient_ns_access">check_recipient_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
> > ! for the RCPT TO domain, and execute the corresponding action.
> > ! Note: a result of "OK" is not allowed for safety reasons. Instead,
> > ! use DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > ! <dt><b><a name="permit_auth_destination">permit_auth_destination</a></b></dt>
> >
> > ! <dd>Permit the request when one of the following is true:
> >
> > ! <ul>
> >
> > + <li> Postfix is mail forwarder: the resolved RCPT TO domain matches
> > + $<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and the address contains no
> > + sender-specified routing (user at elsewhere@domain),
> >
> > ! <li> Postfix is the final destination: the resolved RCPT TO domain
> > ! matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
> > ! $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and the address
> > ! contains no sender-specified routing (user at elsewhere@domain).
> >
> > ! </ul></dd>
> >
> > ! <dt><b><a name="permit_mx_backup">permit_mx_backup</a></b></dt>
> >
> > ! <dd>Permit the request when the local mail system is backup MX for
> > ! the RCPT TO domain, or when the domain is an authorized destination
> > ! (see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> for definition).
> >
> > ! <ul>
> >
> > + <li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> does not accept addresses that have
> > + sender-specified routing information (example: user at elsewhere@domain).
> >
> > ! <li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> can be vulnerable to mis-use when
> > ! access is not restricted with <a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a>.
> >
> > ! <li> Safety: as of Postfix version 2.3, <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> no longer
> > ! accepts the address when the local mail system is primary MX for
> > ! the recipient domain. Exception: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> accepts the address
> > ! when it specifies an authorized destination (see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
> > ! for definition).
> >
> > ! <li> Limitation: mail may be rejected in case of a temporary DNS
> > ! lookup problem with Postfix prior to version 2.0.
> >
> > ! </ul></dd>
> >
> > ! <dt><b><a name="reject_non_fqdn_recipient">reject_non_fqdn_recipient</a></b></dt>
> >
> > ! <dd>Reject the request when the RCPT TO address is not in
> > ! fully-qualified domain form, as required by the RFC. <br> The
> > ! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code to
> > ! rejected requests (default: 504). </dd>
> >
> > + <dt><b><a name="reject_rhsbl_recipient">reject_rhsbl_recipient <i>rbl_domain=d.d.d.d</i></a></b></dt>
> >
> > ! <dd>Reject the request when the RCPT TO domain is listed with the
> > ! A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
> > ! 2.1 and later only). If no "<i>=d.d.d.d</i>" is specified, reject
> > ! the request when the RCPT TO domain is listed with
> > ! any A record under <i>rbl_domain</i>. <br> The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a>
> > ! parameter specifies the response code for rejected requests (default:
> > ! 554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter specifies the default server
> > ! reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter specifies tables with server
> > ! replies indexed by <i>rbl_domain</i>. This feature is available
> > ! in Postfix version 2.0 and later.</dd>
> >
> > ! <dt><b><a name="reject_unauth_destination">reject_unauth_destination</a></b></dt>
> >
> > ! <dd>Reject the request unless one of the following is true:
> >
> > ! <ul>
> >
> > ! <li> Postfix is mail forwarder: the resolved RCPT TO domain matches
> > ! $<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and contains no sender-specified
> > ! routing (user at elsewhere@domain),
> >
> > ! <li> Postfix is the final destination: the resolved RCPT TO domain
> > ! matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
> > ! $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and contains
> > ! no sender-specified routing (user at elsewhere@domain).
> >
> > + </ul> The <a href="postconf.5.html#relay_domains_reject_code">relay_domains_reject_code</a> parameter specifies the response
> > + code for rejected requests (default: 554). </dd>
> >
> > ! <dt><b><a name="reject_unknown_recipient_domain">reject_unknown_recipient_domain</a></b></dt>
> >
> > ! <dd>Reject the request when Postfix is not final destination for
> > ! the recipient domain, and the RCPT TO domain has no DNS A or MX
> > ! record, or when it has a malformed MX record such as a record with
> > ! a zero-length MX hostname (Postfix version 2.3 and later). <br> The
> > ! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the response code
> > ! for rejected requests (default: 450). The response is always 450
> > ! in case of a temporary DNS error.</dd>
> >
> > ! <dt><b><a name="reject_unlisted_recipient">reject_unlisted_recipient</a></b> (with Postfix version 2.0: check_recipient_maps)</dt>
> >
> > ! <dd> Reject the request when the RCPT TO address is not listed in
> > ! the list of valid recipients for its domain class. See the
> > ! <a href="postconf.5.html#smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a> parameter description for details.
> > ! This feature is available in Postfix 2.1 and later.</dd>
> >
> > ! <dt><b><a name="reject_unverified_recipient">reject_unverified_recipient</a></b></dt>
> >
> > ! <dd>Reject the request when mail to the RCPT TO address is known
> > ! to bounce, or when the recipient address destination is not reachable.
> > ! Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
> > ! see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
> > ! <a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> parameter specifies the response
> > ! when an address is known to bounce (default: 450, change into 550
> > ! when you are confident that it is safe to do so). The
> > ! <a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> parameter specifies the response
> > ! when an address probe failed due to a temporary problem (default:
> > ! 450). This feature is available in Postfix 2.1 and later. </dd>
> >
> > ! </dl>
> >
> > ! <p>
> > ! Other restrictions that are valid in this context:
> > ! </p>
> >
> > + <ul>
> >
> > ! <li><a href="#generic">Generic</a> restrictions that can be used
> > ! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> >
> > ! <li>SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
> > ! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>.
> >
> > ! </ul>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
> > ! </pre>
> >
> > ***************
> > *** 14357,14388 ****
> >
> > ! <DT><b><a name="smtpd_tls_auth_only">smtpd_tls_auth_only</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> When TLS encryption is optional in the Postfix SMTP server, do
> > ! not announce or accept SASL authentication over unencrypted
> > ! connections. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a>
> > ! (default: 9)</b></DT><DD>
> >
> > ! <p> The verification depth for remote SMTP client certificates. A
> > ! depth of 1 is sufficient if the issuing CA is listed in a local CA
> > ! file. </p>
> >
> > ! <p> The default verification depth is 9 (the OpenSSL default) for
> > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
> > ! the default value was 5, but the limit was not actually enforced. If
> > ! you have set this to a lower non-default value, certificates with longer
> > ! trust chains may now fail to verify. Certificate chains with 1 or 2
> > ! CAs are common, deeper chains are more rare and any number between 5
> > ! and 9 should suffice in practice. You can choose a lower number if,
> > ! for example, you trust certificates directly signed by an issuing CA
> > ! but not any CAs it delegates to. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 11110,11143 ----
> >
> > ! <DT><b><a name="smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p>
> > ! Request that the Postfix SMTP server rejects mail for unknown
> > ! recipient addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a>
> > ! access restriction is specified. This prevents the Postfix queue
> > ! from filling up with undeliverable MAILER-DAEMON messages.
> > ! </p>
> >
> > ! <ul>
> >
> > + <li> The recipient domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > + or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, but the recipient is not listed in
> > + $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> is not null.
> >
> > ! <li> The recipient domain matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> but the
> > ! recipient is not listed in $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>.
> >
> > ! <li> The recipient domain matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> but the
> > ! recipient is not listed in $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
> > ! is not null.
> >
> > ! <li> The recipient domain matches $<a href="postconf.5.html#relay_domains">relay_domains</a> but the recipient
> > ! is not listed in $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>, and $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>
> > ! is not null.
> >
> > ! </ul>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > ***************
> > *** 14391,14446 ****
> >
> > ! <DT><b><a name="smtpd_tls_cert_file">smtpd_tls_cert_file</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> File with the Postfix SMTP server RSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP server private RSA key. </p>
> > !
> > ! <p> Public Internet MX hosts without certificates signed by a "reputable"
> > ! CA must generate, and be prepared to present to most clients, a
> > ! self-signed or private-CA signed certificate. The client will not be
> > ! able to authenticate the server, but unless it is running Postfix 2.3 or
> > ! similar software, it will still insist on a server certificate. </p>
> > !
> > ! <p> For servers that are <b>not</b> public Internet MX hosts, Postfix
> > ! 2.3 supports configurations with no certificates. This entails the
> > ! use of just the anonymous TLS ciphers, which are not supported by
> > ! typical SMTP clients. Since such clients will not, as a rule, fall
> > ! back to plain text after a TLS handshake failure, the server will
> > ! be unable to receive email from TLS enabled clients. To avoid
> > ! accidental configurations with no certificates, Postfix 2.3 enables
> > ! certificate-less operation only when the administrator explicitly
> > ! sets "<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = none". This ensures that new Postfix
> > ! configurations will not accidentally run with no certificates. </p>
> >
> > ! <p> Both RSA and DSA certificates are supported. When both types
> > ! are present, the cipher used determines which certificate will be
> > ! presented to the client. For Netscape and OpenSSL clients without
> > ! special cipher choices the RSA certificate is preferred. </p>
> >
> > ! <p> To enable a remote SMTP client to verify the Postfix SMTP server
> > ! certificate, the issuing CA certificates must be made available to the
> > ! client. You should include the required certificates in the server
> > ! certificate file, the server certificate first, then the issuing
> > ! CA(s) (bottom-up order). </p>
> >
> > ! <p> Example: the certificate for "server.example.com" was issued by
> > ! "intermediate CA" which itself has a certificate of "root CA".
> > ! Create the server.pem file with "cat server_cert.pem intermediate_CA.pem
> > ! root_CA.pem > server.pem". </p>
> >
> > ! <p> If you also want to verify client certificates issued by these
> > ! CAs, you can add the CA certificates to the <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, in which
> > ! case it is not necessary to have them in the <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> or
> > ! <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. </p>
> >
> > ! <p> A certificate supplied here must be usable as an SSL server certificate
> > ! and hence pass the "openssl verify -purpose sslserver ..." test. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = /etc/postfix/server.pem
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 11146,11177 ----
> >
> > ! <DT><b><a name="smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Request that the Postfix SMTP server rejects mail from unknown
> > ! sender addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a>
> > ! access restriction is specified. This can slow down an explosion
> > ! of forged mail from worms or viruses. </p>
> >
> > ! <ul>
> >
> > ! <li> The sender domain matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or
> > ! $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, but the sender is not listed in
> > ! $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> is not null.
> >
> > ! <li> The sender domain matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> but the sender
> > ! is not listed in $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>.
> >
> > ! <li> The sender domain matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> but the
> > ! sender is not listed in $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
> > ! is not null.
> >
> > ! <li> The sender domain matches $<a href="postconf.5.html#relay_domains">relay_domains</a> but the sender is
> > ! not listed in $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>, and $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> is
> > ! not null.
> >
> > ! </ul>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > ***************
> > *** 14449,14467 ****
> >
> > ! <DT><b><a name="smtpd_tls_cipherlist">smtpd_tls_cipherlist</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS
> > ! cipher list. It is easy to create inter-operability problems by choosing
> > ! a non-default cipher list. Do not use a non-default TLS cipherlist for
> > ! MX hosts on the public Internet. Clients that begin the TLS handshake,
> > ! but are unable to agree on a common cipher, may not be able to send any
> > ! email to the SMTP server. Using a restricted cipher list may be more
> > ! appropriate for a dedicated MSA or an internal mailhub, where one can
> > ! exert some control over the TLS software and settings of the connecting
> > ! clients. </p>
> > !
> > ! <p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
> >
> > ! <p>This feature is available with Postfix version 2.2. It is not used with
> > ! Postfix 2.3 and later; use <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> instead. </p>
> >
> > --- 11180,11194 ----
> >
> > ! <DT><b><a name="smtpd_restriction_classes">smtpd_restriction_classes</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! User-defined aliases for groups of access restrictions. The aliases
> > ! can be specified in <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> etc., and on the
> > ! right-hand side of a Postfix <a href="access.5.html">access(5)</a> table.
> > ! </p>
> >
> > ! <p>
> > ! One major application is for implementing per-recipient UCE control.
> > ! See the <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a> document for other examples.
> > ! </p>
> >
> > ***************
> > *** 14470,14494 ****
> >
> > ! <DT><b><a name="smtpd_tls_ciphers">smtpd_tls_ciphers</a>
> > ! (default: export)</b></DT><DD>
> > !
> > ! <p> The minimum TLS cipher grade that the Postfix SMTP server
> > ! will use with opportunistic TLS encryption. Cipher types listed in
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are excluded from the base definition of
> > ! the selected cipher grade. The default value "export" ensures maximum
> > ! inter-operability. Because encryption is optional, stronger controls
> > ! are not appropriate, and this setting SHOULD NOT be changed unless the
> > ! change is essential. </p>
> > !
> > ! <p> When TLS is mandatory the cipher grade is chosen via the
> > ! <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
> > ! details. </p>
> >
> > ! <p> Example: </p>
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> = export
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.6 and later. With earlier Postfix
> > ! releases only the <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> parameter is implemented,
> > ! and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
> >
> > --- 11197,11213 ----
> >
> > ! <DT><b><a name="smtpd_sasl_application_name">smtpd_sasl_application_name</a>
> > ! (default: smtpd)</b></DT><DD>
> >
> > ! <p>
> > ! The application name that the Postfix SMTP server uses for SASL
> > ! server initialization. This
> > ! controls the name of the SASL configuration file. The default value
> > ! is <b>smtpd</b>, corresponding to a SASL configuration file named
> > ! <b>smtpd.conf</b>.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3
> > ! it was renamed to <a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a>.
> > ! </p>
> >
> > ***************
> > *** 14497,14514 ****
> >
> > ! <DT><b><a name="smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> File with the Postfix SMTP server DSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP server private DSA key. </p>
> >
> > ! <p> See the discussion under <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for more details.
> > </p>
> >
> > ! <p> Example: </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> = /etc/postfix/server-dsa.pem
> > </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 11216,11250 ----
> >
> > ! <DT><b><a name="smtpd_sasl_auth_enable">smtpd_sasl_auth_enable</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Enable SASL authentication in the Postfix SMTP server. By default,
> > ! the Postfix SMTP server does not use authentication.
> > ! </p>
> >
> > ! <p>
> > ! If a remote SMTP client is authenticated, the <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>
> > ! access restriction can be used to permit relay access, like this:
> > </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
> > ! <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, ...
> > ! </pre>
> > ! </blockquote>
> > !
> > ! <p> To reject all SMTP connections from unauthenticated clients,
> > ! specify "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes" (which is the default) and use:
> > ! </p>
> >
> > + <blockquote>
> > <pre>
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, reject
> > </pre>
> > + </blockquote>
> >
> > ! <p>
> > ! See the <a href="SASL_README.html">SASL_README</a> file for SASL configuration and operation details.
> > ! </p>
> >
> > ***************
> > *** 14517,14546 ****
> >
> > ! <DT><b><a name="smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> File with DH parameters that the Postfix SMTP server should
> > ! use with EDH ciphers. </p>
> >
> > ! <p> Instead of using the exact same parameter sets as distributed
> > ! with other TLS packages, it is more secure to generate your own
> > ! set of parameters with something like the following command: </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! openssl gendh -out /etc/postfix/dh_1024.pem -2 1024
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> Your actual source for entropy may differ. Some systems have
> > ! /dev/random; on other system you may consider using the "Entropy
> > ! Gathering Daemon EGD", available at <a href="http://egd.sourceforge.net/">http://egd.sourceforge.net/</a>
> > </p>
> >
> > - <p> Example: </p>
> > -
> > <pre>
> > ! <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> = /etc/postfix/dh_1024.pem
> > </pre>
> >
> > ! <p>This feature is available with Postfix version 2.2.</p>
> >
> > --- 11253,11309 ----
> >
> > ! <DT><b><a name="smtpd_sasl_authenticated_header">smtpd_sasl_authenticated_header</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> Report the SASL authenticated user name in the <a href="smtpd.8.html">smtpd(8)</a> Received
> > ! message header. </p>
> > !
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! What remote SMTP clients the Postfix SMTP server will not offer
> > ! AUTH support to.
> > ! </p>
> >
> > ! <p>
> > ! Some clients (Netscape 4 at least) have a bug that causes them to
> > ! require a login and password whenever AUTH is offered, whether it's
> > ! necessary or not. To work around this, specify, for example,
> > ! $<a href="postconf.5.html#mynetworks">mynetworks</a> to prevent Postfix from offering AUTH to local clients.
> > ! </p>
> >
> > ! <p>
> > ! Specify a list of network/netmask patterns, separated by commas
> > ! and/or whitespace. The mask specifies the number of bits in the
> > ! network part of a host address. You can also "/file/name" or
> > ! "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name" pattern is replaced by its
> > ! contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a table entry
> > ! matches a lookup string (the lookup result is ignored). Continue
> > ! long lines by starting the next line with whitespace. Specify
> > ! "!pattern" to exclude an address or network block from the list.
> > ! The form "!/file/name" is supported only in Postfix version 2.4 and
> > ! later. </p>
> > !
> > ! <p> Note: IP version 6 address information must be specified inside
> > ! <tt>[]</tt> in the <a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> value, and in
> > ! files specified with "/file/name". IP version 6 addresses contain
> > ! the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
> > ! pattern. </p>
> >
> > ! <p>
> > ! Example:
> > </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
> > </pre>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.1 and later.
> > ! </p>
> >
> > ***************
> > *** 14549,14567 ****
> >
> > ! <DT><b><a name="smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> File with DH parameters that the Postfix SMTP server should
> > ! use with EDH ciphers. </p>
> >
> > ! <p> See also the discussion under the <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
> > ! configuration parameter. </p>
> >
> > ! <p> Example: </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> = /etc/postfix/dh_512.pem
> > </pre>
> >
> > - <p>This feature is available with Postfix version 2.2.</p>
> > -
> >
> > --- 11312,11334 ----
> >
> > ! <DT><b><a name="smtpd_sasl_local_domain">smtpd_sasl_local_domain</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! The name of the Postfix SMTP server's local SASL authentication
> > ! realm.
> > ! </p>
> >
> > ! <p>
> > ! By default, the local authentication realm name is the null string.
> > ! </p>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
> > ! <a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#myhostname">myhostname</a>
> > </pre>
> >
> >
> > ***************
> > *** 14569,14583 ****
> >
> > ! <DT><b><a name="smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b></DT><DD>
> > !
> > ! <p> File with the Postfix SMTP server DSA private key in PEM format.
> > ! This file may be combined with the Postfix SMTP server DSA certificate
> > ! file specified with $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. </p>
> >
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted. File permissions should grant read-only
> > ! access to the system superuser account ("root"), and no access
> > ! to anyone else. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 11336,11348 ----
> >
> > ! <DT><b><a name="smtpd_sasl_path">smtpd_sasl_path</a>
> > ! (default: smtpd)</b></DT><DD>
> >
> > ! <p> Implementation-specific information that the Postfix SMTP server
> > ! passes through to
> > ! the SASL plug-in implementation that is selected with
> > ! <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>. Typically this specifies the name of a
> > ! configuration file or rendezvous point. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. In earlier
> > ! releases it was called <b>smtpd_sasl_application_name</b>. </p>
> >
> > ***************
> > *** 14586,14650 ****
> >
> > ! <DT><b><a name="smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> File with the Postfix SMTP server ECDSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP server private ECDSA key. </p>
> > !
> > ! <p> See the discussion under <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for more details. </p>
> > !
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> = /etc/postfix/ecdsa-scert.pem
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.6 and later, when Postfix is
> > ! compiled and linked with OpenSSL 1.0.0 or later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_eckey_file">smtpd_tls_eckey_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b></DT><DD>
> >
> > ! <p> File with the Postfix SMTP server ECDSA private key in PEM format.
> > ! This file may be combined with the Postfix SMTP server ECDSA certificate
> > ! file specified with $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>. </p>
> >
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted. File permissions should grant read-only
> > ! access to the system superuser account ("root"), and no access
> > ! to anyone else. </p>
> >
> > ! <p> This feature is available in Postfix 2.6 and later, when Postfix is
> > ! compiled and linked with OpenSSL 1.0.0 or later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p> The Postfix SMTP server security grade for ephemeral elliptic-curve
> > ! Diffie-Hellman (EECDH) key exchange. </p>
> >
> > ! <p> The available choices are: </p>
> >
> > ! <dl>
> >
> > ! <dt><b>none</b></dt> <dd> Don't use EECDH. Ciphers based on EECDH key
> > ! exchange will be disabled. This is the default in Postfix versions
> > ! 2.6 and 2.7. </dd>
> > !
> > ! <dt><b>strong</b></dt> <dd> Use EECDH with approximately 128
> > ! bits of security at a reasonable computational cost. This is the
> > ! current best-practice trade-off between security and computational
> > ! efficiency. This is the default in Postfix version 2.8 and later.
> > </dd>
> >
> > ! <dt><b>ultra</b></dt> <dd> Use EECDH with approximately 192 bits of
> > ! security at computational cost that is approximately twice as high
> > ! as 128 bit strength ECC. Barring significant progress in attacks on
> > ! elliptic curve crypto-systems, the "strong" curve is sufficient for most
> > ! users. </dd>
> >
> > --- 11351,11400 ----
> >
> > ! <DT><b><a name="smtpd_sasl_security_options">smtpd_sasl_security_options</a>
> > ! (default: noanonymous)</b></DT><DD>
> >
> > ! <p> Postfix SMTP server SASL security options; as of Postfix 2.3
> > ! the list of available
> > ! features depends on the SASL server implementation that is selected
> > ! with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>. </p>
> >
> > ! <p> The following security features are defined for the <b>cyrus</b>
> > ! server SASL implementation: </p>
> >
> > + <p>
> > + Restrict what authentication mechanisms the Postfix SMTP server
> > + will offer to the client. The list of available authentication
> > + mechanisms is system dependent.
> > + </p>
> >
> > ! <p>
> > ! Specify zero or more of the following:
> > ! </p>
> >
> > ! <dl>
> >
> > ! <dt><b>noplaintext</b></dt>
> >
> > ! <dd>Disallow methods that use plaintext passwords. </dd>
> >
> > ! <dt><b>noactive</b></dt>
> >
> > + <dd>Disallow methods subject to active (non-dictionary) attack. </dd>
> >
> > ! <dt><b>nodictionary</b></dt>
> >
> > ! <dd>Disallow methods subject to passive (dictionary) attack. </dd>
> >
> > ! <dt><b>noanonymous</b></dt>
> >
> > ! <dd>Disallow methods that allow anonymous authentication. </dd>
> >
> > ! <dt><b>forward_secrecy</b></dt>
> >
> > ! <dd>Only allow methods that support forward secrecy (Dovecot only).
> > </dd>
> >
> > ! <dt><b>mutual_auth</b></dt>
> > !
> > ! <dd>Only allow methods that provide mutual authentication (not available
> > ! with Cyrus SASL version 1). </dd>
> >
> > ***************
> > *** 14652,14690 ****
> >
> > ! <p> This feature is available in Postfix 2.6 and later, when it is
> > ! compiled and linked with OpenSSL 1.0.0 or later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
> > ! (default: empty)</b></DT><DD>
> >
> > - <p> List of ciphers or cipher types to exclude from the SMTP server
> > - cipher list at all TLS security levels. Excluding valid ciphers
> > - can create interoperability problems. DO NOT exclude ciphers unless it
> > - is essential to do so. This is not an OpenSSL cipherlist; it is a simple
> > - list separated by whitespace and/or commas. The elements are a single
> > - cipher, or one or more "+" separated cipher properties, in which case
> > - only ciphers matching <b>all</b> the properties are excluded. </p>
> >
> > ! <p> Examples (some of these will cause problems): </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = MD5, DES
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = DES+MD5
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = kEDH+aRSA
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> The first setting disables anonymous ciphers. The next setting
> > ! disables ciphers that use the MD5 digest algorithm or the (single) DES
> > ! encryption algorithm. The next setting disables ciphers that use MD5 and
> > ! DES together. The next setting disables the two ciphers "AES256-SHA"
> > ! and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
> > ! key exchange with RSA authentication. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > --- 11402,11435 ----
> >
> > ! <p>
> > ! By default, the Postfix SMTP server accepts plaintext passwords but
> > ! not anonymous logins.
> > ! </p>
> >
> > + <p>
> > + Warning: it appears that clients try authentication methods in the
> > + order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5)
> > + which means that if you disable plaintext passwords, clients will
> > + log in anonymously, even when they should be able to use CRAM-MD5.
> > + So, if you disable plaintext logins, disable anonymous logins too.
> > + Postfix treats anonymous login as no authentication.
> > + </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a> = noanonymous, noplaintext
> > ! </pre>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_sasl_tls_security_options">smtpd_sasl_tls_security_options</a>
> > ! (default: $<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a>)</b></DT><DD>
> >
> > ! <p> The SASL authentication security options that the Postfix SMTP
> > ! server uses for TLS encrypted SMTP sessions. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 14693,14775 ****
> >
> > ! <DT><b><a name="smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>
> > ! (default: md5)</b></DT><DD>
> >
> > ! <p> The message digest algorithm to construct remote SMTP
> > ! client-certificate
> > ! fingerprints or public key fingerprints (Postfix 2.9 and later)
> > ! for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and <b><a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a></b>. The
> > ! default algorithm is <b>md5</b>, for backwards compatibility with Postfix
> > ! releases prior to 2.5. </p>
> >
> > ! <p> Advances in hash
> > ! function cryptanalysis have led to md5 being deprecated in favor of sha1.
> > ! However, as long as there are no known "second pre-image" attacks
> > ! against md5, its use in this context can still be considered safe.
> > ! </p>
> >
> > - <p> While additional digest algorithms are often available with OpenSSL's
> > - libcrypto, only those used by libssl in SSL cipher suites are available to
> > - Postfix. </p>
> >
> > ! <p> To find the fingerprint of a specific certificate file, with a
> > ! specific digest algorithm, run: </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! $ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> The text to the right of "=" sign is the desired fingerprint.
> > ! For example: </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem
> > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> Public key fingerprints are more difficult to extract, however,
> > ! the SHA-1 public key fingerprint is often present as the value of the
> > ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix
> > ! SMTP server and client log the peer certificate fingerprint and public
> > ! key fingerprint when TLS loglevel is 1 or higher. </p>
> >
> > ! <p> Example: client-certificate access table, with sha1 fingerprints: </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> = sha1
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
> > ! <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> hash:/etc/postfix/access,
> > ! reject
> > ! </pre>
> > ! <pre>
> > ! /etc/postfix/access:
> > ! # Action folded to next line...
> > ! AF:88:7C:AD:51:95:6F:36:96:F6:01:FB:2E:48:CD:AB:49:25:A2:3B
> > ! OK
> > ! 85:16:78:FD:73:6E:CE:70:E0:31:5F:0D:3C:C8:6D:C4:2C:24:59:E1
> > ! <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_key_file">smtpd_tls_key_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b></DT><DD>
> >
> > ! <p> File with the Postfix SMTP server RSA private key in PEM format.
> > ! This file may be combined with the Postfix SMTP server RSA certificate
> > ! file specified with $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>. </p>
> >
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted. File permissions should grant read-only
> > ! access to the system superuser account ("root"), and no access
> > ! to anyone else. </p>
> >
> > --- 11438,11487 ----
> >
> > ! <DT><b><a name="smtpd_sasl_type">smtpd_sasl_type</a>
> > ! (default: cyrus)</b></DT><DD>
> >
> > ! <p> The SASL plug-in type that the Postfix SMTP server should use
> > ! for authentication. The available types are listed with the
> > ! "<b>postconf -a</b>" command. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_sender_login_maps">smtpd_sender_login_maps</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional lookup table with the SASL login names that own sender
> > ! (MAIL FROM) addresses.
> > ! </p>
> >
> > ! <p>
> > ! Specify zero or more "<a href="DATABASE_README.html">type:table</a>" lookup tables. With lookups from
> > ! indexed files such as DB or DBM, or from networked tables such as
> > ! NIS, LDAP or SQL, the following search operations are done with a
> > ! sender address of <i>user at domain</i>: </p>
> >
> > ! <dl>
> >
> > ! <dt> 1) <i>user at domain</i> </dt>
> >
> > ! <dd>This table lookup is always done and has the highest precedence. </dd>
> >
> > ! <dt> 2) <i>user</i> </dt>
> >
> > + <dd>This table lookup is done only when the <i>domain</i> part of the
> > + sender address matches $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
> > + or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. </dd>
> >
> > ! <dt> 3) <i>@domain</i> </dt>
> >
> > ! <dd>This table lookup is done last and has the lowest precedence. </dd>
> >
> > ! </dl>
> >
> > ! <p>
> > ! In all cases the result of table lookup must be either "not found"
> > ! or a list of SASL login names separated by comma and/or whitespace.
> > ! </p>
> >
> > ***************
> > *** 14778,14936 ****
> >
> > ! <DT><b><a name="smtpd_tls_loglevel">smtpd_tls_loglevel</a>
> > ! (default: 0)</b></DT><DD>
> >
> > ! <p> Enable additional Postfix SMTP server logging of TLS activity.
> > ! Each logging level also includes the information that is logged at
> > ! a lower logging level. </p>
> >
> > ! <dl compact>
> >
> > ! <dt> </dt> <dd> 0 Log only a summary message on TLS handshake completion
> > ! — no logging of remote SMTP client certificate trust-chain verification
> > ! errors
> > ! if client certificate verification is not required. With Postfix 2.8
> > ! and earlier, disable logging of TLS activity. </dd>
> > !
> > ! <dt> </dt> <dd> 1 Also log trust-chain verification errors and peer
> > ! certificate name and issuer. With Postfix 2.8 and earlier, log TLS
> > ! handshake and certificate information. </dd>
> >
> > ! <dt> </dt> <dd> 2 Also log levels during TLS negotiation. </dd>
> >
> > ! <dt> </dt> <dd> 3 Also log hexadecimal and ASCII dump of TLS negotiation
> > ! process. </dd>
> >
> > ! <dt> </dt> <dd> 4 Also log hexadecimal and ASCII dump of complete
> > ! transmission after STARTTLS. </dd>
> >
> > ! </dl>
> >
> > ! <p> Do not use "<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> = 2" or higher except in case
> > ! of problems. Use of loglevel 4 is strongly discouraged. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>
> > ! (default: medium)</b></DT><DD>
> >
> > ! <p> The minimum TLS cipher grade that the Postfix SMTP server will
> > ! use with mandatory TLS encryption. The default grade ("medium") is
> > ! sufficiently strong that any benefit from globally restricting TLS
> > ! sessions to a more stringent grade is likely negligible, especially
> > ! given the fact that many implementations still do not offer any stronger
> > ! ("high" grade) ciphers, while those that do, will always use "high"
> > ! grade ciphers. So insisting on "high" grade ciphers is generally
> > ! counter-productive. Allowing "export" or "low" ciphers is typically
> > ! not a good idea, as systems limited to just these are limited to
> > ! obsolete browsers. No known SMTP clients fail to support at least
> > ! one "medium" or "high" grade cipher. </p>
> >
> > ! <p> The following cipher grades are supported: </p>
> >
> > ! <dl>
> > ! <dt><b>export</b></dt>
> > ! <dd> Enable "EXPORT" grade or stronger OpenSSL ciphers.
> > ! This is the most appropriate setting for public MX hosts, and is always
> > ! used with opportunistic TLS encryption. The underlying cipherlist
> > ! is specified via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter,
> > ! which you are strongly encouraged to not change. </dd>
> >
> > ! <dt><b>low</b></dt>
> > ! <dd> Enable "LOW" grade or stronger OpenSSL ciphers. The
> > ! underlying cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a>
> > ! configuration parameter, which you are strongly encouraged to
> > ! not change. </dd>
> >
> > ! <dt><b>medium</b></dt>
> > ! <dd> Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit
> > ! or longer symmetric bulk-encryption keys. This is the default minimum
> > ! strength for mandatory TLS encryption. The underlying cipherlist is
> > ! specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> configuration parameter, which
> > ! you are strongly encouraged to not change. </dd>
> >
> > ! <dt><b>high</b></dt>
> > ! <dd> Enable only "HIGH" grade OpenSSL ciphers. The
> > ! underlying cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a>
> > ! configuration parameter, which you are strongly encouraged to
> > ! not change. </dd>
> >
> > ! <dt><b>null</b></dt>
> > ! <dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
> > ! without encryption. This setting is only appropriate in the rare
> > ! case that all clients are prepared to use NULL ciphers (not normally
> > ! enabled in TLS clients). The underlying cipherlist is specified via the
> > ! <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> configuration parameter, which you are strongly
> > ! encouraged to not change. </dd>
> >
> > ! </dl>
> >
> > ! <p> Cipher types listed in
> > ! <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> or <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are
> > ! excluded from the base definition of the selected cipher grade. See
> > ! <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> for cipher controls that apply to opportunistic
> > ! TLS. </p>
> >
> > ! <p> The underlying cipherlists for grades other than "null" include
> > ! anonymous ciphers, but these are automatically filtered out if the
> > ! server is configured to ask for remote SMTP client certificates. You are very
> > ! unlikely to need to take any steps to exclude anonymous ciphers, they
> > ! are excluded automatically as required. If you must exclude anonymous
> > ! ciphers even when Postfix does not need or use peer certificates, set
> > ! "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers only
> > ! when TLS is enforced, set "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Additional list of ciphers or cipher types to exclude from the
> > ! Postfix SMTP server cipher list at mandatory TLS security levels.
> > ! This list
> > ! works in addition to the exclusions listed with <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
> > ! (see there for syntax details). </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>
> > ! (default: SSLv3, TLSv1)</b></DT><DD>
> >
> > ! <p> The SSL/TLS protocols accepted by the Postfix SMTP server with
> > ! mandatory TLS encryption. If the list is empty, the server supports all
> > ! available SSL/TLS protocol versions. A non-empty value is a list
> > ! of protocol
> > ! names separated by whitespace, commas or colons. The supported protocol
> > ! names are "SSLv2", "SSLv3" and "TLSv1", and are not case sensitive. </p>
> >
> > ! <p> With Postfix ≥ 2.5 the parameter syntax is expanded to support
> > ! protocol exclusions. One can now explicitly exclude SSLv2 by setting
> > ! "<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2". To exclude both SSLv2 and
> > ! SSLv3 set "<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2, !SSLv3". Listing
> > ! the protocols to include, rather than protocols to exclude, is still
> > ! supported, use the form you find more intuitive. </p>
> >
> > ! <p> Since SSL version 2 has known protocol weaknesses and is now
> > ! deprecated, the default setting excludes "SSLv2". This means that
> > ! by default, SSL version 2 will not be used at the "encrypt" security
> > ! level. </p>
> >
> > ! <p> Example: </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = TLSv1
> > ! # Alternative form with Postfix ≥ 2.5:
> > ! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
> > </pre>
> >
> > - <p> This feature is available in Postfix 2.3 and later. </p>
> > -
> >
> > --- 11490,11641 ----
> >
> > ! <DT><b><a name="smtpd_sender_restrictions">smtpd_sender_restrictions</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p>
> > ! Optional restrictions that the Postfix SMTP server applies in the
> > ! context of the MAIL FROM command.
> > ! </p>
> >
> > ! <p>
> > ! The default is to permit everything.
> > ! </p>
> >
> > ! <p>
> > ! Specify a list of restrictions, separated by commas and/or whitespace.
> > ! Continue long lines by starting the next line with whitespace.
> > ! Restrictions are applied in the order as specified; the first
> > ! restriction that matches wins.
> > ! </p>
> >
> > ! <p>
> > ! The following restrictions are specific to the sender address
> > ! received with the MAIL FROM command.
> > ! </p>
> >
> > ! <dl>
> >
> > ! <dt><b><a name="check_sender_access">check_sender_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MAIL FROM
> > ! address, domain, parent domains, or localpart@, and execute the
> > ! corresponding action. </dd>
> >
> > ! <dt><b><a name="check_sender_mx_access">check_sender_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
> > ! the MAIL FROM address, and execute the corresponding action. Note:
> > ! a result of "OK" is not allowed for safety reasons. Instead, use
> > ! DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > + <dt><b><a name="check_sender_ns_access">check_sender_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
> >
> > ! <dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
> > ! for the MAIL FROM address, and execute the corresponding action.
> > ! Note: a result of "OK" is not allowed for safety reasons. Instead,
> > ! use DUNNO in order to exclude specific hosts from blacklists. This
> > ! feature is available in Postfix 2.1 and later. </dd>
> >
> > ! <dt><b><a name="reject_authenticated_sender_login_mismatch">reject_authenticated_sender_login_mismatch</a></b></dt>
> >
> > ! <dd>Enforces the <a href="postconf.5.html#reject_sender_login_mismatch">reject_sender_login_mismatch</a> restriction for
> > ! authenticated clients only. This feature is available in
> > ! Postfix version 2.1 and later. </dd>
> >
> > ! <dt><b><a name="reject_non_fqdn_sender">reject_non_fqdn_sender</a></b></dt>
> >
> > ! <dd>Reject the request when the MAIL FROM address is not in
> > ! fully-qualified domain form, as required by the RFC. <br> The
> > ! <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code to
> > ! rejected requests (default: 504). </dd>
> >
> > ! <dt><b><a name="reject_rhsbl_sender">reject_rhsbl_sender <i>rbl_domain=d.d.d.d</i></a></b></dt>
> >
> > ! <dd>Reject the request when the MAIL FROM domain is listed with
> > ! the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix
> > ! version 2.1 and later only). If no "<i>=d.d.d.d</i>" is specified,
> > ! reject the request when the MAIL FROM domain is
> > ! listed with any A record under <i>rbl_domain</i>. <br> The
> > ! <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
> > ! rejected requests (default: 554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter
> > ! specifies the default server reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter
> > ! specifies tables with server replies indexed by <i>rbl_domain</i>.
> > ! This feature is available in Postfix 2.0 and later.</dd>
> >
> > ! <dt><b><a name="reject_sender_login_mismatch">reject_sender_login_mismatch</a></b></dt>
> >
> > ! <dd>Reject the request when $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a> specifies an
> > ! owner for the MAIL FROM address, but the client is not (SASL) logged
> > ! in as that MAIL FROM address owner; or when the client is (SASL)
> > ! logged in, but the client login name doesn't own the MAIL FROM
> > ! address according to $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>.</dd>
> >
> > ! <dt><b><a name="reject_unauthenticated_sender_login_mismatch">reject_unauthenticated_sender_login_mismatch</a></b></dt>
> >
> > ! <dd>Enforces the <a href="postconf.5.html#reject_sender_login_mismatch">reject_sender_login_mismatch</a> restriction for
> > ! unauthenticated clients only. This feature is available in
> > ! Postfix version 2.1 and later. </dd>
> >
> > ! <dt><b><a name="reject_unknown_sender_domain">reject_unknown_sender_domain</a></b></dt>
> >
> > ! <dd>Reject the request when Postfix is not final destination for
> > ! the sender address, and the MAIL FROM address has no DNS A or MX
> > ! record, or when it has a malformed MX record such as a record with
> > ! a zero-length MX hostname (Postfix version 2.3 and later). <br> The
> > ! <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter specifies the response code
> > ! for rejected requests (default: 450). The response is always 450
> > ! in case of a temporary DNS error. </dd>
> >
> > + <dt><b><a name="reject_unlisted_sender">reject_unlisted_sender</a></b></dt>
> >
> > ! <dd>Reject the request when the MAIL FROM address is not listed in
> > ! the list of valid recipients for its domain class. See the
> > ! <a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> parameter description for details.
> > ! This feature is available in Postfix 2.1 and later.</dd>
> >
> > ! <dt><b><a name="reject_unverified_sender">reject_unverified_sender</a></b></dt>
> >
> > ! <dd>Reject the request when mail to the MAIL FROM address is known to
> > ! bounce, or when the sender address destination is not reachable.
> > ! Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
> > ! see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
> > ! <a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> parameter specifies the response when
> > ! an address is known to bounce (default: 450, change into 550 when
> > ! you are confident that it is safe to do so). The
> > ! <a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> specifies the response when an address
> > ! address probe failed due to a temporary problem (default: 450).
> > ! This feature is available in Postfix 2.1 and later. </dd>
> >
> > ! </dl>
> >
> > + <p>
> > + Other restrictions that are valid in this context:
> > + </p>
> >
> > ! <ul>
> >
> > ! <li> <a href="#generic">Generic</a> restrictions that can be used
> > ! in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
> >
> > ! <li> SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
> >
> > ! <li> SMTP command specific restrictions described under
> > ! <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. When recipient restrictions are listed
> > ! under <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, they have effect only with
> > ! "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> is
> > ! evaluated at the time of the RCPT TO command.
> >
> > ! </ul>
> >
> > ! <p>
> > ! Examples:
> > ! </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
> > ! <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>,
> > ! <a href="postconf.5.html#check_sender_access">check_sender_access</a> hash:/etc/postfix/access
> > </pre>
> >
> >
> > ***************
> > *** 14938,14983 ****
> >
> > ! <DT><b><a name="smtpd_tls_protocols">smtpd_tls_protocols</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> List of TLS protocols that the Postfix SMTP server will exclude
> > ! or include with opportunistic TLS encryption. This parameter SHOULD be
> > ! left at its default empty value, allowing all protocols to be used with
> > ! opportunistic TLS. </p>
> > !
> > ! <p> In <a href="postconf.5.html">main.cf</a> the values are separated by whitespace, commas or
> > ! colons. An empty value means allow all protocols. The valid protocol
> > ! names, (see <b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and
> > ! "TLSv1". In <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> table entries, "protocols" attribute
> > ! values are separated by a colon. </p>
> > !
> > ! <p> To include a protocol list its name, to exclude it, prefix the name
> > ! with a "!" character. To exclude SSLv2 even for opportunistic TLS set
> > ! "<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
> > ! "<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2, !SSLv3". Explicitly listing the protocols to
> > ! include, is supported, but not recommended. OpenSSL provides no mechanisms
> > ! for excluding protocols not known at compile-time. If Postfix is linked
> > ! against an OpenSSL library that supports additional protocol versions,
> > ! they cannot be excluded using either syntax. </p>
> > !
> > ! <p> Example: </p>
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_received_header">smtpd_tls_received_header</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Request that the Postfix SMTP server produces Received: message
> > ! headers that include information about the protocol and cipher used,
> > ! as well as the remote SMTP client CommonName and client certificate issuer
> > ! CommonName. This is disabled by default, as the information may
> > ! be modified in transit through other mail servers. Only information
> > ! that was recorded by the final destination can be trusted. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 11643,11662 ----
> >
> > ! <DT><b><a name="smtpd_soft_error_limit">smtpd_soft_error_limit</a>
> > ! (default: 10)</b></DT><DD>
> >
> > + <p>
> > + The number of errors a remote SMTP client is allowed to make without
> > + delivering mail before the Postfix SMTP server slows down all its
> > + responses.
> > + </p>
> >
> > ! <ul>
> >
> > ! <li><p>With Postfix version 2.1 and later, the Postfix SMTP server
> > ! delays all responses by $<a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> seconds. </p>
> >
> > ! <li><p>With Postfix versions 2.0 and earlier, the Postfix SMTP
> > ! server delays all responses by (number of errors) seconds. </p>
> >
> > ! </ul>
> >
> > ***************
> > *** 14986,14996 ****
> >
> > ! <DT><b><a name="smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> With mandatory TLS encryption, require a trusted remote SMTP client
> > ! certificate in order to allow TLS connections to proceed. This
> > ! option implies "<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> = yes". </p>
> >
> > ! <p> When TLS encryption is optional, this setting is ignored with
> > ! a warning written to the mail log. </p>
> >
> > --- 11665,11671 ----
> >
> > ! <DT><b><a name="smtpd_starttls_timeout">smtpd_starttls_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p> The time limit for Postfix SMTP server write and read operations
> > ! during TLS startup and shutdown handshake procedures. </p>
> >
> > ***************
> > *** 15001,15043 ****
> >
> > ! <DT><b><a name="smtpd_tls_security_level">smtpd_tls_security_level</a>
> > ! (default: empty)</b></DT><DD>
> > !
> > ! <p> The SMTP TLS security level for the Postfix SMTP server; when
> > ! a non-empty value is specified, this overrides the obsolete parameters
> > ! <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. This parameter is ignored with
> > ! "<a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> = yes". </p>
> >
> > ! <p> Specify one of the following security levels: </p>
> >
> > ! <dl>
> >
> > ! <dt><b>none</b></dt> <dd> TLS will not be used. </dd>
> >
> > - <dt><b>may</b></dt> <dd> Opportunistic TLS: announce STARTTLS support
> > - to remote SMTP clients, but do not require that clients use TLS encryption.
> > - </dd>
> >
> > ! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption: announce
> > ! STARTTLS support to remote SMTP clients, and require that clients use TLS
> > ! encryption. According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> this MUST NOT be applied in case
> > ! of a publicly-referenced SMTP server. Instead, this option should
> > ! be used only on dedicated servers. </dd>
> >
> > ! </dl>
> >
> > ! <p> Note 1: the "fingerprint", "verify" and "secure" levels are not
> > ! supported here.
> > ! The Postfix SMTP server logs a warning and uses "encrypt" instead.
> > ! To verify remote SMTP client certificates, see <a href="TLS_README.html">TLS_README</a> for a discussion
> > ! of the <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>, <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>, and <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
> > ! features. </p>
> >
> > ! <p> Note 2: The parameter setting "<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> =
> > ! encrypt" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes".</p>
> >
> > ! <p> Note 3: when invoked via "sendmail -bs", Postfix will never
> > ! offer STARTTLS due to insufficient privileges to access the server
> > ! private key. This is intended behavior.</p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > --- 11676,11715 ----
> >
> > ! <DT><b><a name="smtpd_timeout">smtpd_timeout</a>
> > ! (default: 300s)</b></DT><DD>
> >
> > ! <p>
> > ! The time limit for sending a Postfix SMTP server response and for
> > ! receiving a remote SMTP client request.
> > ! </p>
> >
> > ! <p>
> > ! Note: if you set SMTP time limits to very large values you may have
> > ! to update the global <a href="postconf.5.html#ipc_timeout">ipc_timeout</a> parameter.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_CAfile">smtpd_tls_CAfile</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> The file with the certificate of the certification authority
> > ! (CA) that issued the Postfix SMTP server certificate. This is
> > ! needed only when the CA certificate is not already present in the
> > ! server certificate file. This file may also contain the CA
> > ! certificates of other trusted CAs. You must use this file for the
> > ! list of trusted CAs if you want to use chroot-mode. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> = /etc/postfix/CAcert.pem
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 15046,15072 ****
> >
> > ! <DT><b><a name="smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Name of the file containing the optional Postfix SMTP server
> > ! TLS session cache. Specify a database type that supports enumeration,
> > ! such as <b>btree</b> or <b>sdbm</b>; there is no need to support
> > ! concurrent access. The file is created if it does not exist. The <a href="smtpd.8.html">smtpd(8)</a>
> > ! daemon does not use this parameter directly, rather the cache is
> > ! implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
> > ! per-smtpd-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not
> > ! effective. Note, that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a>
> > ! daemon: $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
> > ! (and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to be
> > ! stored separately. It is not at this time possible to store multiple
> > ! caches in a single database. </p>
> > !
> > ! <p> Note: <b>dbm</b> databases are not suitable. TLS
> > ! session objects are too large. </p>
> > !
> > ! <p> As of version 2.5, Postfix no longer uses root privileges when
> > ! opening this file. The file should now be stored under the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
> > ! under a non-Postfix directory is redirected to the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
> > !
> > <p> Example: </p>
> > --- 11718,11734 ----
> >
> > ! <DT><b><a name="smtpd_tls_CApath">smtpd_tls_CApath</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> Directory with PEM format certificate authority certificates
> > ! that the Postfix SMTP server offers to remote SMTP clients for the
> > ! purpose of client certificate verification. Do not forget to create
> > ! the necessary "hash" links with, for example, "$OPENSSL_HOME/bin/c_rehash
> > ! /etc/postfix/certs". </p>
> > !
> > ! <p> To use this option in chroot mode, this directory (or a copy)
> > ! must be inside the chroot jail. Please note that in this case the
> > ! CA certificates are not offered to the client, so that e.g. Netscape
> > ! clients might not offer certificates issued by them. Use of this
> > ! feature is therefore not recommended. </p>
> > !
> > <p> Example: </p>
> > ***************
> > *** 15074,15076 ****
> > <pre>
> > ! <a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a> = btree:/var/lib/postfix/smtpd_scache
> > </pre>
> > --- 11736,11738 ----
> > <pre>
> > ! <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> = /etc/postfix/certs
> > </pre>
> > ***************
> > *** 15082,15110 ****
> >
> > ! <DT><b><a name="smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>
> > ! (default: 3600s)</b></DT><DD>
> > !
> > ! <p> The expiration time of Postfix SMTP server TLS session cache
> > ! information. A cache cleanup is performed periodically
> > ! every $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> seconds. As with
> > ! $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, this parameter is implemented in the
> > ! <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtpd-instance <a href="master.5.html">master.cf</a> overrides
> > ! are not possible. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Run the Postfix SMTP server in the non-standard "wrapper" mode,
> > ! instead of using the STARTTLS command. </p>
> >
> > ! <p> If you want to support this service, enable a special port in
> > ! <a href="master.5.html">master.cf</a>, and specify "-o <a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>=yes" on the SMTP
> > ! server's command line. Port 465 (smtps) was once chosen for this
> > ! purpose. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 11744,11769 ----
> >
> > ! <DT><b><a name="smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>
> > ! (default: yes)</b></DT><DD>
> >
> > + <p> Force the Postfix SMTP server to issue a TLS session id, even
> > + when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
> > + is empty). This behavior is compatible with Postfix < 2.3. </p>
> >
> > ! <p> With Postfix 2.3 and later the Postfix SMTP server can disable
> > ! session id generation when TLS session caching is turned off. This
> > ! keeps clients from caching sessions that almost certainly cannot
> > ! be re-used. </p>
> >
> > ! <p> By default, the Postfix SMTP server always generates TLS session
> > ! ids. This works around a known defect in mail client applications
> > ! such as MS Outlook, and may also prevent interoperability issues
> > ! with other MTAs. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> = no
> > ! </pre>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 15113,15126 ****
> >
> > ! <DT><b><a name="smtpd_use_tls">smtpd_use_tls</a>
> > (default: no)</b></DT><DD>
> >
> > ! <p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
> > ! but do not require that clients use TLS encryption. </p>
> >
> > ! <p> Note: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
> > ! STARTTLS due to insufficient privileges to access the server private
> > ! key. This is intended behavior. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
> >
> > --- 11772,11786 ----
> >
> > ! <DT><b><a name="smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>
> > (default: no)</b></DT><DD>
> >
> > ! <p> Ask a remote SMTP client for a client certificate. This
> > ! information is needed for certificate based mail relaying with,
> > ! for example, the <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> feature. </p>
> >
> > ! <p> Some clients such as Netscape will either complain if no
> > ! certificate is available (for the list of CAs in $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)
> > ! or will offer multiple client certificates to choose from. This
> > ! may be annoying, so this option is "off" by default. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 15129,15148 ****
> >
> > ! <DT><b><a name="soft_bounce">soft_bounce</a>
> > (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Safety net to keep mail queued that would otherwise be returned to
> > ! the sender. This parameter disables locally-generated bounces,
> > ! and prevents the Postfix SMTP server from rejecting mail permanently,
> > ! by changing 5xx reply codes into 4xx. However, <a href="postconf.5.html#soft_bounce">soft_bounce</a> is no
> > ! cure for address rewriting mistakes or mail routing mistakes.
> > ! </p>
> > !
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#soft_bounce">soft_bounce</a> = yes
> > ! </pre>
> >
> > --- 11789,11798 ----
> >
> > ! <DT><b><a name="smtpd_tls_auth_only">smtpd_tls_auth_only</a>
> > (default: no)</b></DT><DD>
> >
> > ! <p> When TLS encryption is optional in the Postfix SMTP server, do
> > ! not announce or accept SASL authentication over unencrypted
> > ! connections. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 15151,15164 ****
> >
> > ! <DT><b><a name="stale_lock_time">stale_lock_time</a>
> > ! (default: 500s)</b></DT><DD>
> >
> > ! <p>
> > ! The time after which a stale exclusive mailbox lockfile is removed.
> > ! This is used for delivery to file or mailbox.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > --- 11801,11820 ----
> >
> > ! <DT><b><a name="smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a>
> > ! (default: 9)</b></DT><DD>
> >
> > ! <p> The verification depth for remote SMTP client certificates. A
> > ! depth of 1 is sufficient if the issuing CA is listed in a local CA
> > ! file. </p>
> >
> > ! <p> The default verification depth is 9 (the OpenSSL default) for
> > ! compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
> > ! the default value was 5, but the limit was not actually enforced. If
> > ! you have set this to a lower non-default value, certificates with longer
> > ! trust chains may now fail to verify. Certificate chains with 1 or 2
> > ! CAs are common, deeper chains are more rare and any number between 5
> > ! and 9 should suffice in practice. You can choose a lower number if,
> > ! for example, you trust certificates directly signed by an issuing CA
> > ! but not any CAs it delegates to. </p>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 15167,15194 ****
> >
> > ! <DT><b><a name="stress">stress</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> This feature is documented in the <a href="STRESS_README.html">STRESS_README</a> document. </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="strict_7bit_headers">strict_7bit_headers</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Reject mail with 8-bit text in message headers. This blocks mail
> > ! from poorly written applications.
> > ! </p>
> >
> > ! <p>
> > ! This feature should not be enabled on a general purpose mail server,
> > ! because it is likely to reject legitimate email.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > --- 11823,11877 ----
> >
> > ! <DT><b><a name="smtpd_tls_cert_file">smtpd_tls_cert_file</a>
> > (default: empty)</b></DT><DD>
> >
> > ! <p> File with the Postfix SMTP server RSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP server private RSA key. </p>
> >
> > ! <p> Public Internet MX hosts without certificates signed by a "reputable"
> > ! CA must generate, and be prepared to present to most clients, a
> > ! self-signed or private-CA signed certificate. The client will not be
> > ! able to authenticate the server, but unless it is running Postfix 2.3 or
> > ! similar software, it will still insist on a server certificate. </p>
> >
> > + <p> For servers that are <b>not</b> public Internet MX hosts, Postfix
> > + 2.3 supports configurations with no certificates. This entails the
> > + use of just the anonymous TLS ciphers, which are not supported by
> > + typical SMTP clients. Since such clients will not, as a rule, fall
> > + back to plain text after a TLS handshake failure, the server will
> > + be unable to receive email from TLS enabled clients. To avoid
> > + accidental configurations with no certificates, Postfix 2.3 enables
> > + certificate-less operation only when the administrator explicitly
> > + sets "<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = none". This ensures that new Postfix
> > + configurations will not accidentally run with no certificates. </p>
> >
> > ! <p> Both RSA and DSA certificates are supported. When both types
> > ! are present, the cipher used determines which certificate will be
> > ! presented to the client. For Netscape and OpenSSL clients without
> > ! special cipher choices the RSA certificate is preferred. </p>
> >
> > ! <p> In order to verify a certificate, the CA certificate (in case
> > ! of a certificate chain, all CA certificates) must be available.
> > ! You should add these certificates to the server certificate, the
> > ! server certificate first, then the issuing CA(s). </p>
> >
> > ! <p> Example: the certificate for "server.dom.ain" was issued by
> > ! "intermediate CA" which itself has a certificate of "root CA".
> > ! Create the server.pem file with "cat server_cert.pem intermediate_CA.pem
> > ! root_CA.pem > server.pem". </p>
> >
> > ! <p> If you also want to verify client certificates issued by these
> > ! CAs, you can add the CA certificates to the <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, in which
> > ! case it is not necessary to have them in the <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> or
> > ! <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. </p>
> >
> > ! <p> A certificate supplied here must be usable as an SSL server certificate
> > ! and hence pass the "openssl verify -purpose sslserver ..." test. </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = /etc/postfix/server.pem
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 15197,15213 ****
> >
> > ! <DT><b><a name="strict_8bitmime">strict_8bitmime</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Enable both <a href="postconf.5.html#strict_7bit_headers">strict_7bit_headers</a> and <a href="postconf.5.html#strict_8bitmime_body">strict_8bitmime_body</a>.
> > ! </p>
> >
> > ! <p>
> > ! This feature should not be enabled on a general purpose mail server,
> > ! because it is likely to reject legitimate email.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > --- 11880,11898 ----
> >
> > ! <DT><b><a name="smtpd_tls_cipherlist">smtpd_tls_cipherlist</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS
> > ! cipher list. It is easy to create inter-operability problems by choosing
> > ! a non-default cipher list. Do not use a non-default TLS cipherlist for
> > ! MX hosts on the public Internet. Clients that begin the TLS handshake,
> > ! but are unable to agree on a common cipher, may not be able to send any
> > ! email to the SMTP server. Using a restricted cipher list may be more
> > ! appropriate for a dedicated MSA or an internal mailhub, where one can
> > ! exert some control over the TLS software and settings of the connecting
> > ! clients. </p>
> >
> > ! <p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
> >
> > ! <p>This feature is available with Postfix version 2.2. It is not used with
> > ! Postfix 2.3 and later; use <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> instead. </p>
> >
> > ***************
> > *** 15216,15301 ****
> >
> > ! <DT><b><a name="strict_8bitmime_body">strict_8bitmime_body</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p>
> > ! Reject 8-bit message body text without 8-bit MIME content encoding
> > ! information. This blocks mail from poorly written applications.
> > ! </p>
> >
> > ! <p>
> > ! Unfortunately, this also rejects majordomo approval requests when
> > ! the included request contains valid 8-bit MIME mail, and it rejects
> > ! bounces from mailers that do not MIME encapsulate 8-bit content
> > ! (for example, bounces from qmail or from old versions of Postfix).
> > ! </p>
> >
> > ! <p>
> > ! This feature should not be enabled on a general purpose mail server,
> > ! because it is likely to reject legitimate email.
> > </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > - <DT><b><a name="strict_mailbox_ownership">strict_mailbox_ownership</a>
> > - (default: yes)</b></DT><DD>
> >
> > ! <p> Defer delivery when a mailbox file is not owned by its recipient.
> > ! The default setting is not backwards compatible. </p>
> >
> > ! <p> This feature is available in Postfix 2.5.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="strict_mime_encoding_domain">strict_mime_encoding_domain</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Reject mail with invalid Content-Transfer-Encoding: information
> > ! for the message/* or multipart/* MIME content types. This blocks
> > ! mail from poorly written software.
> > </p>
> >
> > ! <p>
> > ! This feature should not be enabled on a general purpose mail server,
> > ! because it will reject mail after a single violation.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > - </DD>
> >
> > ! <DT><b><a name="strict_rfc821_envelopes">strict_rfc821_envelopes</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Require that addresses received in SMTP MAIL FROM and RCPT TO
> > ! commands are enclosed with <>, and that those addresses do
> > ! not contain <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> style comments or phrases. This stops mail
> > ! from poorly written software.
> > ! </p>
> >
> > ! <p>
> > ! By default, the Postfix SMTP server accepts <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> syntax in MAIL
> > ! FROM and RCPT TO addresses.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="sun_mailtool_compatibility">sun_mailtool_compatibility</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Obsolete SUN mailtool compatibility feature. Instead, use
> > ! "<a href="postconf.5.html#mailbox_delivery_lock">mailbox_delivery_lock</a> = dotlock".
> > ! </p>
> >
> > --- 11901,11970 ----
> >
> > ! <DT><b><a name="smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> File with the Postfix SMTP server DSA certificate in PEM format.
> > ! This file may also contain the Postfix SMTP server private DSA key. </p>
> >
> > ! <p> See the discussion under <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for more details.
> > </p>
> >
> > ! <p> Example: </p>
> >
> > + <pre>
> > + <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> = /etc/postfix/server-dsa.pem
> > + </pre>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
> > ! (default: empty)</b></DT><DD>
> >
> > + <p> File with DH parameters that the Postfix SMTP server should
> > + use with EDH ciphers. </p>
> >
> > ! <p> Instead of using the exact same parameter sets as distributed
> > ! with other TLS packages, it is more secure to generate your own
> > ! set of parameters with something like the following command: </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! openssl gendh -out /etc/postfix/dh_1024.pem -2 1024
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> Your actual source for entropy may differ. Some systems have
> > ! /dev/random; on other system you may consider using the "Entropy
> > ! Gathering Daemon EGD", available at <a href="http://egd.sourceforge.net/">http://egd.sourceforge.net/</a>
> > </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> = /etc/postfix/dh_1024.pem
> > ! </pre>
> >
> > + <p>This feature is available with Postfix version 2.2.</p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> File with DH parameters that the Postfix SMTP server should
> > ! use with EDH ciphers. </p>
> >
> > + <p> See also the discussion under the <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
> > + configuration parameter. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> = /etc/postfix/dh_512.pem
> > ! </pre>
> >
> > ! <p>This feature is available with Postfix version 2.2.</p>
> >
> > ***************
> > *** 15304,15358 ****
> >
> > ! <DT><b><a name="swap_bangpath">swap_bangpath</a>
> > ! (default: yes)</b></DT><DD>
> > !
> > ! <p>
> > ! Enable the rewriting of "site!user" into "user at site". This is
> > ! necessary if your machine is connected to UUCP networks. It is
> > ! enabled by default.
> > ! </p>
> >
> > ! <p> Note: with Postfix version 2.2, message header address rewriting
> > ! happens only when one of the following conditions is true: </p>
> >
> > ! <ul>
> >
> > ! <li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
> >
> > - <li> The message is received from a network client that matches
> > - $<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
> >
> > ! <li> The message is received from the network, and the
> > ! <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
> >
> > ! </ul>
> >
> > ! <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > <pre>
> > ! <a href="postconf.5.html#swap_bangpath">swap_bangpath</a> = no
> > </pre>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="syslog_facility">syslog_facility</a>
> > ! (default: mail)</b></DT><DD>
> > !
> > ! <p>
> > ! The syslog facility of Postfix logging. Specify a facility as
> > ! defined in syslog.conf(5). The default facility is "mail".
> > ! </p>
> > !
> > ! <p>
> > ! Warning: a non-default <a href="postconf.5.html#syslog_facility">syslog_facility</a> setting takes effect only
> > ! after a Postfix process has completed initialization. Errors during
> > ! process initialization will be logged with the default facility.
> > ! Examples are errors while parsing the command line arguments, and
> > ! errors while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
> > ! </p>
> >
> > --- 11973,12021 ----
> >
> > ! <DT><b><a name="smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b></DT><DD>
> >
> > ! <p> File with the Postfix SMTP server DSA private key in PEM format.
> > ! This file may be combined with the Postfix SMTP server DSA certificate
> > ! file specified with $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. </p>
> >
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted, but file permissions should grant read/write
> > ! access only to the system superuser account ("root"). </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> List of ciphers or cipher types to exclude from the SMTP server
> > ! cipher list at all TLS security levels. Excluding valid ciphers
> > ! can create interoperability problems. DO NOT exclude ciphers unless it
> > ! is essential to do so. This is not an OpenSSL cipherlist; it is a simple
> > ! list separated by whitespace and/or commas. The elements are a single
> > ! cipher, or one or more "+" separated cipher properties, in which case
> > ! only ciphers matching <b>all</b> the properties are excluded. </p>
> >
> > ! <p> Examples (some of these will cause problems): </p>
> >
> > + <blockquote>
> > <pre>
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = MD5, DES
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = DES+MD5
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = kEDH+aRSA
> > </pre>
> > + </blockquote>
> >
> > + <p> The first setting disables anonymous ciphers. The next setting
> > + disables ciphers that use the MD5 digest algorithm or the (single) DES
> > + encryption algorithm. The next setting disables ciphers that use MD5 and
> > + DES together. The next setting disables the two ciphers "AES256-SHA"
> > + and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
> > + key exchange with RSA authentication. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 15361,15391 ****
> >
> > ! <DT><b><a name="syslog_name">syslog_name</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p>
> > ! The mail system name that is prepended to the process name in syslog
> > ! records, so that "smtpd" becomes, for example, "postfix/smtpd".
> > </p>
> >
> > ! <p>
> > ! Warning: a non-default <a href="postconf.5.html#syslog_name">syslog_name</a> setting takes effect only after
> > ! a Postfix process has completed initialization. Errors during
> > ! process initialization will be logged with the default name. Examples
> > ! are errors while parsing the command line arguments, and errors
> > ! while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
> > </p>
> >
> >
> > ! </DD>
> > !
> > ! <DT><b><a name="tcp_windowsize">tcp_windowsize</a>
> > ! (default: 0)</b></DT><DD>
> > !
> > ! <p> An optional workaround for routers that break TCP window scaling.
> > ! Specify a value > 0 and < 65536 to enable this feature. With
> > ! Postfix TCP servers (<a href="smtpd.8.html">smtpd(8)</a>, <a href="qmqpd.8.html">qmqpd(8)</a>), this feature is implemented
> > ! by the Postfix <a href="master.8.html">master(8)</a> daemon. </p>
> > !
> > ! <p> To change this parameter without stopping Postfix, you need to
> > ! first terminate all Postfix TCP servers: </p>
> >
> > --- 12024,12046 ----
> >
> > ! <DT><b><a name="smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>
> > ! (default: md5)</b></DT><DD>
> >
> > ! <p> The message digest algorithm used to construct client-certificate
> > ! fingerprints for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and
> > ! <b><a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a></b>. The default algorithm is <b>md5</b>,
> > ! for backwards compatibility with Postfix releases prior to 2.5.
> > </p>
> >
> > ! <p> The best practice algorithm is now <b>sha1</b>. Recent advances in hash
> > ! function cryptanalysis have led to md5 being deprecated in favor of sha1.
> > ! However, as long as there are no known "second pre-image" attacks
> > ! against md5, its use in this context can still be considered safe.
> > </p>
> >
> > + <p> While additional digest algorithms are often available with OpenSSL's
> > + libcrypto, only those used by libssl in SSL cipher suites are available to
> > + Postfix. For now this means just md5 or sha1. </p>
> >
> > ! <p> To find the fingerprint of a specific certificate file, with a
> > ! specific digest algorithm, run: </p>
> >
> > ***************
> > *** 15393,15396 ****
> > <pre>
> > ! # postconf -e <a href="postconf.5.html#master_service_disable">master_service_disable</a>=inet
> > ! # postfix reload
> > </pre>
> > --- 12048,12050 ----
> > <pre>
> > ! $ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
> > </pre>
> > ***************
> > *** 15398,15402 ****
> >
> > ! <p> This immediately terminates all processes that accept network
> > ! connections. Next, you enable Postfix TCP servers with the updated
> > ! <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> setting: </p>
> >
> > --- 12052,12055 ----
> >
> > ! <p> The text to the right of "=" sign is the desired fingerprint.
> > ! For example: </p>
> >
> > ***************
> > *** 15404,15407 ****
> > <pre>
> > ! # postconf -e <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a>=65535 <a href="postconf.5.html#master_service_disable">master_service_disable</a>=
> > ! # postfix reload
> > </pre>
> > --- 12057,12060 ----
> > <pre>
> > ! $ openssl x509 -noout -fingerprint -sha1 -in cert.pem
> > ! SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
> > </pre>
> > ***************
> > *** 15409,15432 ****
> >
> > ! <p> If you skip these steps with a running Postfix system, then the
> > ! <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> change will work only for Postfix TCP clients (<a href="smtp.8.html">smtp(8)</a>,
> > ! <a href="lmtp.8.html">lmtp(8)</a>). </p>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> > !
> > !
> > ! </DD>
> >
> > ! <DT><b><a name="tls_append_default_CA">tls_append_default_CA</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Append the system-supplied default certificate authority
> > ! certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
> > ! The default is "no"; this prevents Postfix from trusting third-party
> > ! certificates and giving them relay permission with
> > ! <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>. </p>
> > !
> > ! <p> This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
> > ! 2.7.2 and later versions. Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = yes" for
> > ! backwards compatibility, to avoid breaking certificate verification
> > ! with sites that don't use <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>. </p>
> >
> > --- 12062,12084 ----
> >
> > ! <p> Example: client-certificate access table, with sha1 fingerprints: </p>
> >
> > ! <blockquote>
> > ! <pre>
> > ! /etc/postfix/<a href="postconf.5.html">main.cf</a>:
> > ! <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> = sha1
> > ! <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
> > ! <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> hash:/etc/postfix/access,
> > ! reject
> > ! </pre>
> > ! <pre>
> > ! /etc/postfix/access:
> > ! # Action folded to next line...
> > ! AF:88:7C:AD:51:95:6F:36:96:F6:01:FB:2E:48:CD:AB:49:25:A2:3B
> > ! OK
> > ! 85:16:78:FD:73:6E:CE:70:E0:31:5F:0D:3C:C8:6D:C4:2C:24:59:E1
> > ! <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
> > ! </pre>
> > ! </blockquote>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 15435,15446 ****
> >
> > ! <DT><b><a name="tls_daemon_random_bytes">tls_daemon_random_bytes</a>
> > ! (default: 32)</b></DT><DD>
> >
> > ! <p> The number of pseudo-random bytes that an <a href="smtp.8.html">smtp(8)</a> or <a href="smtpd.8.html">smtpd(8)</a>
> > ! process requests from the <a href="tlsmgr.8.html">tlsmgr(8)</a> server in order to seed its
> > ! internal pseudo random number generator (PRNG). The default of 32
> > ! bytes (equivalent to 256 bits) is sufficient to generate a 128bit
> > ! (or 168bit) session key. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 12087,12098 ----
> >
> > ! <DT><b><a name="smtpd_tls_key_file">smtpd_tls_key_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b></DT><DD>
> >
> > ! <p> File with the Postfix SMTP server RSA private key in PEM format.
> > ! This file may be combined with the Postfix SMTP server RSA certificate
> > ! file specified with $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>. </p>
> >
> > ! <p> The private key must be accessible without a pass-phrase, i.e. it
> > ! must not be encrypted, but file permissions should grant read/write
> > ! access only to the system superuser account ("root"). </p>
> >
> > ***************
> > *** 15449,15557 ****
> >
> > ! <DT><b><a name="tls_disable_workarounds">tls_disable_workarounds</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> > !
> > ! <p> List or bit-mask of OpenSSL bug work-arounds to disable. </p>
> > !
> > ! <p> The OpenSSL toolkit includes a set of work-arounds for buggy SSL/TLS
> > ! implementations. Applications, such as Postfix, that want to maximize
> > ! interoperability ask the OpenSSL library to enable the full set of
> > ! recommended work-arounds. </p>
> > !
> > ! <p> From time to time, it is discovered that a work-around creates a
> > ! security issue, and should no longer be used. If upgrading OpenSSL
> > ! to a fixed version is not an option or an upgrade is not available
> > ! in a timely manner, or in closed environments where no buggy clients
> > ! or servers exist, it may be appropriate to disable some or all of the
> > ! OpenSSL interoperability work-arounds. This parameter specifies which
> > ! bug work-arounds to disable. </p>
> > !
> > ! <p> If the value of the parameter is a hexadecimal long integer starting
> > ! with "0x", the bug work-arounds corresponding to the bits specified in
> > ! its value are removed from the <b>SSL_OP_ALL</b> work-around bit-mask
> > ! (see openssl/ssl.h and SSL_CTX_set_options(3)). You can specify more
> > ! bits than are present in SSL_OP_ALL, excess bits are ignored. Specifying
> > ! 0xFFFFFFFF disables all bug-workarounds on a 32-bit system. This should
> > ! also be sufficient on 64-bit systems, until OpenSSL abandons support
> > ! for 32-bit systems and starts using the high 32 bits of a 64-bit
> > ! bug-workaround mask. </p>
> > !
> > ! <p> Otherwise, the parameter is a white-space or comma separated list
> > ! of specific named bug work-arounds chosen from the list below. It
> > ! is possible that your OpenSSL version includes new bug work-arounds
> > ! added after your Postfix source code was last updated, in that case
> > ! you can only disable one of these via the hexadecimal syntax above. </p>
> > !
> > ! <dl>
> >
> > ! <dt><b>MICROSOFT_SESS_ID_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
> >
> > ! <dt><b>NETSCAPE_CHALLENGE_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
> >
> > ! <dt><b>LEGACY_SERVER_CONNECT</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
> >
> > ! <dt><b>NETSCAPE_REUSE_CIPHER_CHANGE_BUG</b></dt> <dd> also aliased
> > ! as <b>CVE-2010-4180</b>. Postfix 2.8 disables this work-around by
> > ! default with OpenSSL versions that may predate the fix. Fixed in
> > ! OpenSSL 0.9.8q and OpenSSL 1.0.0c.</dd>
> >
> > ! <dt><b>SSLREF2_REUSE_CERT_TYPE_BUG</b></dt> <dd>See
> > ! SSL_CTX_set_options(3)</dd>
> >
> > ! <dt><b>MICROSOFT_BIG_SSLV3_BUFFER</b></dt> <dd>See
> > ! SSL_CTX_set_options(3)</dd>
> >
> > ! <dt><b>MSIE_SSLV2_RSA_PADDING</b></dt> <dd> also aliased as
> > ! <b>CVE-2005-2969</b>. Postfix 2.8 disables this work-around by
> > ! default with OpenSSL versions that may predate the fix. Fixed in
> > ! OpenSSL 0.9.7h and OpenSSL 0.9.8a.</dd>
> >
> > ! <dt><b>SSLEAY_080_CLIENT_DH_BUG</b></dt> <dd>See
> > ! SSL_CTX_set_options(3)</dd>
> >
> > ! <dt><b>TLS_D5_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
> >
> > ! <dt><b>TLS_BLOCK_PADDING_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
> >
> > - <dt><b>TLS_ROLLBACK_BUG</b></dt> <dd>See SSL_CTX_set_options(3).
> > - This is disabled in OpenSSL 0.9.7 and later. Nobody should still
> > - be using 0.9.6! </dd>
> >
> > ! <dt><b>DONT_INSERT_EMPTY_FRAGMENTS</b></dt> <dd>See
> > ! SSL_CTX_set_options(3)</dd>
> >
> > ! <dt><b>CRYPTOPRO_TLSEXT_BUG</b></dt> <dd>New with GOST support in
> > ! OpenSSL 1.0.0.</dd>
> >
> > ! </dl>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="tls_eecdh_strong_curve">tls_eecdh_strong_curve</a>
> > ! (default: prime256v1)</b></DT><DD>
> >
> > ! <p> The elliptic curve used by the Postfix SMTP server for sensibly
> > ! strong
> > ! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
> > ! server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong". The phrase "sensibly
> > ! strong" means approximately 128-bit security based on best known
> > ! attacks. The selected curve must be implemented by OpenSSL (as
> > ! reported by ecparam(1) with the "-list_curves" option) and be one
> > ! of the curves listed in Section 5.1.1 of <a href="http://tools.ietf.org/html/rfc4492">RFC 4492</a>. You should not
> > ! generally change this setting. </p>
> >
> > ! <p> This default curve is specified in NSA "Suite B" Cryptography
> > ! (see <a href="http://www.nsa.gov/ia/industry/crypto_suite_b.cfm">http://www.nsa.gov/ia/industry/crypto_suite_b.cfm</a>) for
> > ! information classified as SECRET. </p>
> >
> > ! <p> Note: elliptic curve names are poorly standardized; different
> > ! standards groups are assigning different names to the same underlying
> > ! curves. The curve with the X9.62 name "prime256v1" is also known
> > ! under the SECG name "secp256r1", but OpenSSL does not recognize the
> > ! latter name. </p>
> >
> > ! <p> This feature is available in Postfix 2.6 and later, when it is
> > ! compiled and linked with OpenSSL 1.0.0 or later. </p>
> >
> > --- 12101,12210 ----
> >
> > ! <DT><b><a name="smtpd_tls_loglevel">smtpd_tls_loglevel</a>
> > ! (default: 0)</b></DT><DD>
> >
> > ! <p> Enable additional Postfix SMTP server logging of TLS activity.
> > ! Each logging level also includes the information that is logged at
> > ! a lower logging level. </p>
> >
> > ! <dl compact>
> >
> > ! <dt> </dt> <dd> 0 Disable logging of TLS activity. </dd>
> >
> > ! <dt> </dt> <dd> 1 Log TLS handshake and certificate information. </dd>
> >
> > ! <dt> </dt> <dd> 2 Log levels during TLS negotiation. </dd>
> >
> > ! <dt> </dt> <dd> 3 Log hexadecimal and ASCII dump of TLS negotiation
> > ! process. </dd>
> >
> > ! <dt> </dt> <dd> 4 Also log hexadecimal and ASCII dump of complete
> > ! transmission after STARTTLS. </dd>
> >
> > ! </dl>
> >
> > ! <p> Use "<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> = 3" only in case of problems. Use of
> > ! loglevel 4 is strongly discouraged. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>
> > ! (default: medium)</b></DT><DD>
> >
> > ! <p> The minimum TLS cipher grade that the Postfix SMTP server will
> > ! use with mandatory
> > ! TLS encryption. Cipher types listed in <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>
> > ! or <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are excluded from the base definition
> > ! of the selected cipher grade. With opportunistic TLS encryption,
> > ! the "export" grade is used unconditionally with exclusions specified
> > ! only via <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>. </p>
> >
> > ! <p> The following cipher grades are supported: </p>
> >
> > + <dl>
> > + <dt><b>export</b></dt>
> > + <dd> Enable the mainstream "EXPORT" grade or better OpenSSL ciphers.
> > + This is the most appropriate setting for public MX hosts, and is always
> > + used with opportunistic TLS encryption. The underlying cipherlist
> > + is specified via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter,
> > + which you are strongly encouraged to not change. The default value
> > + of <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> includes anonymous ciphers, but these are
> > + automatically filtered out if the server is configured to ask for
> > + client certificates. If you must always exclude anonymous ciphers,
> > + set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers
> > + only when TLS is enforced, set "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> =
> > + aNULL". </dd>
> >
> > ! <dt><b>low</b></dt>
> > ! <dd> Enable the mainstream "LOW" grade or better OpenSSL ciphers. The
> > ! underlying cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a>
> > ! configuration parameter, which you are strongly encouraged to
> > ! not change. The default value of <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> includes
> > ! anonymous ciphers, but these are automatically filtered out if the
> > ! server is configured to ask for client certificates. If you must
> > ! always exclude anonymous ciphers, set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> =
> > ! aNULL". To exclude anonymous ciphers only when TLS is enforced, set
> > ! "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
> >
> > ! <dt><b>medium</b></dt>
> > ! <dd> Enable the mainstream "MEDIUM" grade or better OpenSSL ciphers. These
> > ! are essentially the 128-bit or stronger ciphers. This is the default
> > ! minimum strength for mandatory TLS encryption. MSAs that enforce
> > ! TLS and have clients that do not support any "MEDIUM" or "HIGH"
> > ! grade ciphers, may need to configure a weaker ("low" or "export")
> > ! minimum cipher grade. The underlying cipherlist is specified via the
> > ! <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> configuration parameter, which you are strongly
> > ! encouraged to not change. The default value of <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
> > ! includes anonymous ciphers, but these are automatically filtered out if
> > ! the server is configured to ask for client certificates. If you must
> > ! always exclude anonymous ciphers, set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> =
> > ! aNULL". To exclude anonymous ciphers only when TLS is enforced, set
> > ! "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
> >
> > ! <dt><b>high</b></dt>
> > ! <dd> Enable only the mainstream "HIGH" grade OpenSSL ciphers. The
> > ! underlying cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a>
> > ! configuration parameter, which you are strongly encouraged to
> > ! not change. The default value of <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> includes
> > ! anonymous ciphers, but these are automatically filtered out if the
> > ! server is configured to ask for client certificates. If you must
> > ! always exclude anonymous ciphers, set "<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> =
> > ! aNULL". To exclude anonymous ciphers only when TLS is enforced, set
> > ! "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </dd>
> >
> > ! <dt><b>null</b></dt>
> > ! <dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
> > ! without encryption. This setting is only appropriate in the rare
> > ! case that all clients are prepared to use NULL ciphers (not normally
> > ! enabled in TLS clients). The underlying cipherlist is specified via the
> > ! <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> configuration parameter, which you are strongly
> > ! encouraged to not change. The default value of <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a>
> > ! excludes anonymous ciphers (OpenSSL 0.9.8 has NULL ciphers that offer
> > ! data integrity without encryption or authentication). </dd>
> >
> > ! </dl>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 15560,15581 ****
> >
> > ! <DT><b><a name="tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a>
> > ! (default: secp384r1)</b></DT><DD>
> > !
> > ! <p> The elliptic curve used by the Postfix SMTP server for maximally
> > ! strong
> > ! ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
> > ! server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = ultra". The phrase "maximally
> > ! strong" means approximately 192-bit security based on best known attacks.
> > ! This additional strength comes at a significant computational cost, most
> > ! users should instead set "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong". The selected
> > ! curve must be implemented by OpenSSL (as reported by ecparam(1) with the
> > ! "-list_curves" option) and be one of the curves listed in Section 5.1.1
> > ! of <a href="http://tools.ietf.org/html/rfc4492">RFC 4492</a>. You should not generally change this setting. </p>
> >
> > ! <p> This default "ultra" curve is specified in NSA "Suite B" Cryptography
> > ! (see <a href="http://www.nsa.gov/ia/industry/crypto_suite_b.cfm">http://www.nsa.gov/ia/industry/crypto_suite_b.cfm</a>) for information
> > ! classified as TOP SECRET. </p>
> >
> > ! <p> This feature is available in Postfix 2.6 and later, when it is
> > ! compiled and linked with OpenSSL 1.0.0 or later. </p>
> >
> > --- 12213,12223 ----
> >
> > ! <DT><b><a name="smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Additional list of ciphers or cipher types to exclude from the
> > ! SMTP server cipher list at mandatory TLS security levels. This list
> > ! works in addition to the exclusions listed with <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
> > ! (see there for syntax details). </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 15584,15615 ****
> >
> > ! <DT><b><a name="tls_export_cipherlist">tls_export_cipherlist</a>
> > ! (default: ALL:+RC4:@STRENGTH)</b></DT><DD>
> > !
> > ! <p> The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This
> > ! defines the meaning of the "export" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
> > ! the cipherlist for the opportunistic ("may") TLS client security
> > ! level and is the default cipherlist for the SMTP server. You are
> > ! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
> > ! later the cipherlist may start with an "aNULL:" prefix, which restores
> > ! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
> > ! list when they are enabled. This prefix is not needed with previous
> > ! OpenSSL releases. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="tls_high_cipherlist">tls_high_cipherlist</a>
> > ! (default: ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH)</b></DT><DD>
> >
> > ! <p> The OpenSSL cipherlist for "HIGH" grade ciphers. This defines
> > ! the meaning of the "high" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
> > ! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
> > ! later the cipherlist may start with an "aNULL:" prefix, which restores
> > ! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
> > ! list when they are enabled. This prefix is not needed with previous
> > ! OpenSSL releases. </p>
> >
> > --- 12226,12256 ----
> >
> > ! <DT><b><a name="smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>
> > ! (default: SSLv3, TLSv1)</b></DT><DD>
> >
> > ! <p> The SSL/TLS protocols accepted by the Postfix SMTP server with
> > ! mandatory TLS encryption. If the list is empty, the server supports all
> > ! available SSL/TLS protocol versions. A non-empty value is a list
> > ! of protocol
> > ! names separated by whitespace, commas or colons. The supported protocol
> > ! names are "SSLv2", "SSLv3" and "TLSv1", and are not case sensitive. </p>
> >
> > + <p> With Postfix ≥ 2.5 the parameter syntax is expanded to support
> > + protocol exclusions. One can now explicitly exclude SSLv2 by setting
> > + "<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2". To exclude both SSLv2 and
> > + SSLv3 set "<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2, !SSLv3". Listing
> > + the protocols to include, rather than protocols to exclude, is still
> > + supported, use the form you find more intuitive. </p>
> >
> > ! <p> Since SSL version 2 has known protocol weaknesses and is now
> > ! deprecated, the default setting excludes "SSLv2". This means that
> > ! by default, SSL version 2 will not be used at the "encrypt" security
> > ! level. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = TLSv1
> > ! # Alternative form with Postfix ≥ 2.5:
> > ! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2, !SSLv3
> > ! </pre>
> >
> > ***************
> > *** 15620,15634 ****
> >
> > ! <DT><b><a name="tls_low_cipherlist">tls_low_cipherlist</a>
> > ! (default: ALL:!EXPORT:+RC4:@STRENGTH)</b></DT><DD>
> >
> > ! <p> The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines
> > ! the meaning of the "low" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
> > ! strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
> > ! later the cipherlist may start with an "aNULL:" prefix, which restores
> > ! the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
> > ! list when they are enabled. This prefix is not needed with previous
> > ! OpenSSL releases. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > --- 12261,12273 ----
> >
> > ! <DT><b><a name="smtpd_tls_received_header">smtpd_tls_received_header</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Request that the Postfix SMTP server produces Received: message
> > ! headers that include information about the protocol and cipher used,
> > ! as well as the client CommonName and client certificate issuer
> > ! CommonName. This is disabled by default, as the information may
> > ! be modified in transit through other mail servers. Only information
> > ! that was recorded by the final destination can be trusted. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 15637,15707 ****
> >
> > ! <DT><b><a name="tls_medium_cipherlist">tls_medium_cipherlist</a>
> > ! (default: ALL:!EXPORT:!LOW:+RC4:@STRENGTH)</b></DT><DD>
> >
> > ! <p> The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This
> > ! defines the meaning of the "medium" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
> > ! the default cipherlist for mandatory TLS encryption in the TLS
> > ! client (with anonymous ciphers disabled when verifying server
> > ! certificates). You are strongly encouraged to not change this
> > ! setting. With OpenSSL 1.0.0 and later the cipherlist may start with an
> > ! "aNULL:" prefix, which restores the 0.9.8-compatible ordering of the
> > ! aNULL ciphers to the top of the list when they are enabled. This prefix
> > ! is not needed with previous OpenSSL releases. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > - </DD>
> >
> > ! <DT><b><a name="tls_null_cipherlist">tls_null_cipherlist</a>
> > ! (default: eNULL:!aNULL)</b></DT><DD>
> >
> > ! <p> The OpenSSL cipherlist for "NULL" grade ciphers that provide
> > ! authentication without encryption. This defines the meaning of the "null"
> > ! setting in smtpd_mandatory_tls_ciphers, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
> > ! <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are strongly encouraged to not
> > ! change this setting. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="tls_preempt_cipherlist">tls_preempt_cipherlist</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> With SSLv3 and later, use the Postfix SMTP server's cipher
> > ! preference order instead of the remote client's cipher preference
> > ! order. </p>
> > !
> > ! <p> By default, the OpenSSL server selects the client's most preferred
> > ! cipher that the server supports. With SSLv3 and later, the server may
> > ! choose its own most preferred cipher that is supported (offered) by
> > ! the client. Setting "<a href="postconf.5.html#tls_preempt_cipherlist">tls_preempt_cipherlist</a> = yes" enables server cipher
> > ! preferences. </p>
> > !
> > ! <p> While server cipher selection may in some cases lead to a more secure
> > ! or performant cipher choice, there is some risk of interoperability
> > ! issues. In the past, some SSL clients have listed lower priority ciphers
> > ! that they did not implement correctly. If the server chooses a cipher
> > ! that the client prefers less, it may select a cipher whose client
> > ! implementation is flawed. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later, in combination
> > ! with OpenSSL 0.9.7 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="tls_random_bytes">tls_random_bytes</a>
> > ! (default: 32)</b></DT><DD>
> >
> > ! <p> The number of bytes that <a href="tlsmgr.8.html">tlsmgr(8)</a> reads from $<a href="postconf.5.html#tls_random_source">tls_random_source</a>
> > ! when (re)seeding the in-memory pseudo random number generator (PRNG)
> > ! pool. The default of 32 bytes (256 bits) is good enough for 128bit
> > ! symmetric keys. If using EGD or a device file, a maximum of 255
> > ! bytes is read. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > --- 12276,12333 ----
> >
> > ! <DT><b><a name="smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> With mandatory TLS encryption, require a trusted remote SMTP client
> > ! certificate in order to allow TLS connections to proceed. This
> > ! option implies "<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> = yes". </p>
> >
> > ! <p> When TLS encryption is optional, this setting is ignored with
> > ! a warning written to the mail log. </p>
> >
> > + <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="smtpd_tls_security_level">smtpd_tls_security_level</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> The SMTP TLS security level for the Postfix SMTP server; when
> > ! a non-empty value is specified, this overrides the obsolete parameters
> > ! <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. This parameter is ignored with
> > ! "<a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> = yes". </p>
> >
> > + <p> Specify one of the following security levels: </p>
> >
> > ! <dl>
> >
> > ! <dt><b>none</b></dt> <dd> TLS will not be used. </dd>
> >
> > ! <dt><b>may</b></dt> <dd> Opportunistic TLS: announce STARTTLS support
> > ! to SMTP clients, but do not require that clients use TLS encryption.
> > ! </dd>
> >
> > ! <dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption: announce
> > ! STARTTLS support to SMTP clients, and require that clients use TLS
> > ! encryption. According to <a href="http://tools.ietf.org/html/rfc2487">RFC 2487</a> this MUST NOT be applied in case
> > ! of a publicly-referenced SMTP server. Instead, this option should
> > ! be used only on dedicated servers. </dd>
> >
> > + </dl>
> >
> > ! <p> Note 1: the "fingerprint", "verify" and "secure" levels are not
> > ! supported here.
> > ! The Postfix SMTP server logs a warning and uses "encrypt" instead.
> > ! To verify SMTP client certificates, see <a href="TLS_README.html">TLS_README</a> for a discussion
> > ! of the <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>, <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>, and <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
> > ! features. </p>
> >
> > ! <p> Note 2: The parameter setting "<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> =
> > ! encrypt" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes".</p>
> >
> > ! <p> Note 3: when invoked via "sendmail -bs", Postfix will never
> > ! offer STARTTLS due to insufficient privileges to access the server
> > ! private key. This is intended behavior.</p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 15710,15736 ****
> >
> > ! <DT><b><a name="tls_random_exchange_name">tls_random_exchange_name</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> > !
> > ! <p> Name of the pseudo random number generator (PRNG) state file
> > ! that is maintained by <a href="tlsmgr.8.html">tlsmgr(8)</a>. The file is created when it does
> > ! not exist, and its length is fixed at 1024 bytes. </p>
> > !
> > ! <p> As of version 2.5, Postfix no longer uses root privileges when
> > ! opening this file, and the default file location was changed from
> > ! ${<a href="postconf.5.html#config_directory">config_directory</a>}/prng_exch to ${<a href="postconf.5.html#data_directory">data_directory</a>}/prng_exch. As
> > ! a migration aid, an attempt to open the file under a non-Postfix
> > ! directory is redirected to the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>, and a
> > ! warning is logged. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="tls_random_prng_update_period">tls_random_prng_update_period</a>
> > ! (default: 3600s)</b></DT><DD>
> >
> > ! <p> The time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to save the state of
> > ! the pseudo random number generator (PRNG) to the file specified
> > ! with $<a href="postconf.5.html#tls_random_exchange_name">tls_random_exchange_name</a>. </p>
> >
> > --- 12336,12367 ----
> >
> > ! <DT><b><a name="smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> Name of the file containing the optional Postfix SMTP server
> > ! TLS session cache. Specify a database type that supports enumeration,
> > ! such as <b>btree</b> or <b>sdbm</b>; there is no need to support
> > ! concurrent access. The file is created if it does not exist. The <a href="smtpd.8.html">smtpd(8)</a>
> > ! daemon does not use this parameter directly, rather the cache is
> > ! implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
> > ! per-smtpd-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not
> > ! effective. Note, that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a>
> > ! daemon: $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
> > ! (and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to be
> > ! stored separately. It is not at this time possible to store multiple
> > ! caches in a single database. </p>
> >
> > + <p> Note: <b>dbm</b> databases are not suitable. TLS
> > + session objects are too large. </p>
> >
> > ! <p> As of version 2.5, Postfix no longer uses root privileges when
> > ! opening this file. The file should now be stored under the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
> > ! under a non-Postfix directory is redirected to the Postfix-owned
> > ! <a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
> >
> > ! <p> Example: </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a> = btree:/var/lib/postfix/smtpd_scache
> > ! </pre>
> >
> > ***************
> > *** 15741,15749 ****
> >
> > ! <DT><b><a name="tls_random_reseed_period">tls_random_reseed_period</a>
> > (default: 3600s)</b></DT><DD>
> >
> > ! <p> The maximal time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to re-seed the
> > ! in-memory pseudo random number generator (PRNG) pool from external
> > ! sources. The actual time between re-seeding attempts is calculated
> > ! using the PRNG, and is between 0 and the time specified. </p>
> >
> > --- 12372,12382 ----
> >
> > ! <DT><b><a name="smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>
> > (default: 3600s)</b></DT><DD>
> >
> > ! <p> The expiration time of Postfix SMTP server TLS session cache
> > ! information. A cache cleanup is performed periodically
> > ! every $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> seconds. As with
> > ! $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, this parameter is implemented in the
> > ! <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtpd-instance <a href="master.5.html">master.cf</a> overrides
> > ! are not possible. </p>
> >
> > ***************
> > *** 15754,15767 ****
> >
> > ! <DT><b><a name="tls_random_source">tls_random_source</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p> The external entropy source for the in-memory <a href="tlsmgr.8.html">tlsmgr(8)</a> pseudo
> > ! random number generator (PRNG) pool. Be sure to specify a non-blocking
> > ! source. If this source is not a regular file, the entropy source
> > ! type must be prepended: egd:/path/to/egd_socket for a source with
> > ! EGD compatible socket interface, or dev:/path/to/device for a
> > ! device file. </p>
> >
> > ! <p> Note: on OpenBSD systems specify /dev/arandom when /dev/urandom
> > ! gives timeout errors. </p>
> >
> > --- 12387,12398 ----
> >
> > ! <DT><b><a name="smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p> Run the Postfix SMTP server in the non-standard "wrapper" mode,
> > ! instead of using the STARTTLS command. </p>
> >
> > ! <p> If you want to support this service, enable a special port in
> > ! <a href="master.5.html">master.cf</a>, and specify "-o <a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>=yes" on the SMTP
> > ! server's command line. Port 465 (smtps) was once chosen for this
> > ! purpose. </p>
> >
> > ***************
> > *** 15772,15781 ****
> >
> > ! <DT><b><a name="tlsproxy_enforce_tls">tlsproxy_enforce_tls</a>
> > ! (default: $<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b></DT><DD>
> >
> > ! <p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and
> > ! require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> for
> > ! further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12403,12416 ----
> >
> > ! <DT><b><a name="smtpd_use_tls">smtpd_use_tls</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p> Opportunistic TLS: announce STARTTLS support to SMTP clients,
> > ! but do not require that clients use TLS encryption. </p>
> >
> > ! <p> Note: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
> > ! STARTTLS due to insufficient privileges to access the server private
> > ! key. This is intended behavior. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. With
> > ! Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
> >
> > ***************
> > *** 15784,15792 ****
> >
> > ! <DT><b><a name="tlsproxy_service_name">tlsproxy_service_name</a>
> > ! (default: tlsproxy)</b></DT><DD>
> >
> > ! <p> The name of the <a href="tlsproxy.8.html">tlsproxy(8)</a> service entry in <a href="master.5.html">master.cf</a>. This
> > ! service performs plaintext <=> TLS ciphertext conversion. <p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12419,12438 ----
> >
> > ! <DT><b><a name="soft_bounce">soft_bounce</a>
> > ! (default: no)</b></DT><DD>
> > !
> > ! <p>
> > ! Safety net to keep mail queued that would otherwise be returned to
> > ! the sender. This parameter disables locally-generated bounces,
> > ! and prevents the Postfix SMTP server from rejecting mail permanently,
> > ! by changing 5xx reply codes into 4xx. However, <a href="postconf.5.html#soft_bounce">soft_bounce</a> is no
> > ! cure for address rewriting mistakes or mail routing mistakes.
> > ! </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#soft_bounce">soft_bounce</a> = yes
> > ! </pre>
> >
> > ***************
> > *** 15795,15804 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_CAfile">tlsproxy_tls_CAfile</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)</b></DT><DD>
> >
> > ! <p> A file containing (PEM format) CA certificates of root CAs
> > ! trusted to sign either remote SMTP client certificates or intermediate
> > ! CA certificates. See <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12441,12454 ----
> >
> > ! <DT><b><a name="stale_lock_time">stale_lock_time</a>
> > ! (default: 500s)</b></DT><DD>
> >
> > ! <p>
> > ! The time after which a stale exclusive mailbox lockfile is removed.
> > ! This is used for delivery to file or mailbox.
> > ! </p>
> >
> > ! <p>
> > ! Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
> > ! The default time unit is s (seconds).
> > ! </p>
> >
> > ***************
> > *** 15807,15816 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_CApath">tlsproxy_tls_CApath</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>)</b></DT><DD>
> >
> > ! <p> A directory containing (PEM format) CA certificates of root CAs
> > ! trusted to sign either remote SMTP client certificates or intermediate
> > ! CA certificates. See <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12457,12464 ----
> >
> > ! <DT><b><a name="stress">stress</a>
> > ! (default: empty)</b></DT><DD>
> >
> > ! <p> This feature is documented in the <a href="STRESS_README.html">STRESS_README</a> document. </p>
> >
> > ! <p> This feature is available in Postfix 2.5 and later. </p>
> >
> > ***************
> > *** 15819,15863 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_always_issue_session_ids">tlsproxy_tls_always_issue_session_ids</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>)</b></DT><DD>
> > !
> > ! <p> Force the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server to issue a TLS session id,
> > ! even when TLS session caching is turned off. See
> > ! <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> >
> > ! </DD>
> >
> > - <DT><b><a name="tlsproxy_tls_ask_ccert">tlsproxy_tls_ask_ccert</a>
> > - (default: $<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>)</b></DT><DD>
> >
> > ! <p> Ask a remote SMTP client for a client certificate. See
> > ! <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="tlsproxy_tls_ccert_verifydepth">tlsproxy_tls_ccert_verifydepth</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a>)</b></DT><DD>
> >
> > - <p> The verification depth for remote SMTP client certificates. A
> > - depth of 1 is sufficient if the issuing CA is listed in a local CA
> > - file. See <a href="postconf.5.html#smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="tlsproxy_tls_cert_file">tlsproxy_tls_cert_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b></DT><DD>
> >
> > ! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server RSA certificate in PEM
> > ! format. This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
> > ! private RSA key. See <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12467,12530 ----
> >
> > ! <DT><b><a name="strict_7bit_headers">strict_7bit_headers</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Reject mail with 8-bit text in message headers. This blocks mail
> > ! from poorly written applications.
> > ! </p>
> >
> > + <p>
> > + This feature should not be enabled on a general purpose mail server,
> > + because it is likely to reject legitimate email.
> > + </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="strict_8bitmime">strict_8bitmime</a>
> > ! (default: no)</b></DT><DD>
> >
> > + <p>
> > + Enable both <a href="postconf.5.html#strict_7bit_headers">strict_7bit_headers</a> and <a href="postconf.5.html#strict_8bitmime_body">strict_8bitmime_body</a>.
> > + </p>
> >
> > ! <p>
> > ! This feature should not be enabled on a general purpose mail server,
> > ! because it is likely to reject legitimate email.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> >
> > ! </DD>
> >
> > + <DT><b><a name="strict_8bitmime_body">strict_8bitmime_body</a>
> > + (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Reject 8-bit message body text without 8-bit MIME content encoding
> > ! information. This blocks mail from poorly written applications.
> > ! </p>
> >
> > ! <p>
> > ! Unfortunately, this also rejects majordomo approval requests when
> > ! the included request contains valid 8-bit MIME mail, and it rejects
> > ! bounces from mailers that do not MIME encapsulate 8-bit content
> > ! (for example, bounces from qmail or from old versions of Postfix).
> > ! </p>
> >
> > ! <p>
> > ! This feature should not be enabled on a general purpose mail server,
> > ! because it is likely to reject legitimate email.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > ***************
> > *** 15866,15875 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_ciphers">tlsproxy_tls_ciphers</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>)</b></DT><DD>
> >
> > ! <p> The minimum TLS cipher grade that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
> > ! will use with opportunistic TLS encryption. See <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>
> > ! for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12533,12541 ----
> >
> > ! <DT><b><a name="strict_mailbox_ownership">strict_mailbox_ownership</a>
> > ! (default: yes)</b></DT><DD>
> >
> > ! <p> Defer delivery when a mailbox file is not owned by its recipient.
> > ! The default setting is not backwards compatible. </p>
> >
> > ! <p> This feature is available in Postfix 2.5.3 and later. </p>
> >
> > ***************
> > *** 15878,15900 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_dcert_file">tlsproxy_tls_dcert_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b></DT><DD>
> >
> > ! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server DSA certificate in PEM
> > ! format. This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
> > ! private DSA key. See <a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> for further details.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="tlsproxy_tls_dh1024_param_file">tlsproxy_tls_dh1024_param_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>)</b></DT><DD>
> > !
> > ! <p> File with DH parameters that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
> > ! should use with EDH ciphers. See <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> for
> > ! further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12544,12562 ----
> >
> > ! <DT><b><a name="strict_mime_encoding_domain">strict_mime_encoding_domain</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Reject mail with invalid Content-Transfer-Encoding: information
> > ! for the message/* or multipart/* MIME content types. This blocks
> > ! mail from poorly written software.
> > </p>
> >
> > ! <p>
> > ! This feature should not be enabled on a general purpose mail server,
> > ! because it will reject mail after a single violation.
> > ! </p>
> >
> > ! <p>
> > ! This feature is available in Postfix 2.0 and later.
> > ! </p>
> >
> > ***************
> > *** 15903,15912 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_dh512_param_file">tlsproxy_tls_dh512_param_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>)</b></DT><DD>
> >
> > ! <p> File with DH parameters that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
> > ! should use with EDH ciphers. See <a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> for
> > ! further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12565,12580 ----
> >
> > ! <DT><b><a name="strict_rfc821_envelopes">strict_rfc821_envelopes</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Require that addresses received in SMTP MAIL FROM and RCPT TO
> > ! commands are enclosed with <>, and that those addresses do
> > ! not contain <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> style comments or phrases. This stops mail
> > ! from poorly written software.
> > ! </p>
> >
> > ! <p>
> > ! By default, the Postfix SMTP server accepts <a href="http://tools.ietf.org/html/rfc822">RFC 822</a> syntax in MAIL
> > ! FROM and RCPT TO addresses.
> > ! </p>
> >
> > ***************
> > *** 15915,15925 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_dkey_file">tlsproxy_tls_dkey_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>)</b></DT><DD>
> > !
> > ! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server DSA private key in PEM
> > ! format. This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
> > ! server DSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>.
> > ! See <a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12583,12591 ----
> >
> > ! <DT><b><a name="sun_mailtool_compatibility">sun_mailtool_compatibility</a>
> > ! (default: no)</b></DT><DD>
> >
> > ! <p>
> > ! Obsolete SUN mailtool compatibility feature. Instead, use
> > ! "<a href="postconf.5.html#mailbox_delivery_lock">mailbox_delivery_lock</a> = dotlock".
> > ! </p>
> >
> > ***************
> > *** 15928,15963 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_eccert_file">tlsproxy_tls_eccert_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b></DT><DD>
> > !
> > ! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server ECDSA certificate in
> > ! PEM format. This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
> > ! server private ECDSA key. See <a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> for further
> > ! details. </p>
> > !
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="tlsproxy_tls_eckey_file">tlsproxy_tls_eckey_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a>)</b></DT><DD>
> >
> > ! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server ECDSA private key in
> > ! PEM format. This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
> > ! server ECDSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>.
> > ! See <a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> >
> > ! </DD>
> >
> > ! <DT><b><a name="tlsproxy_tls_eecdh_grade">tlsproxy_tls_eecdh_grade</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>)</b></DT><DD>
> >
> > ! <p> The Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server security grade for ephemeral
> > ! elliptic-curve Diffie-Hellman (EECDH) key exchange. See
> > ! <a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12594,12629 ----
> >
> > ! <DT><b><a name="swap_bangpath">swap_bangpath</a>
> > ! (default: yes)</b></DT><DD>
> >
> > + <p>
> > + Enable the rewriting of "site!user" into "user at site". This is
> > + necessary if your machine is connected to UUCP networks. It is
> > + enabled by default.
> > + </p>
> >
> > ! <p> Note: with Postfix version 2.2, message header address rewriting
> > ! happens only when one of the following conditions is true: </p>
> >
> > ! <ul>
> >
> > ! <li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
> >
> > ! <li> The message is received from a network client that matches
> > ! $<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
> >
> > + <li> The message is received from the network, and the
> > + <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
> >
> > ! </ul>
> >
> > ! <p> To get the behavior before Postfix version 2.2, specify
> > ! "<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = static:all". </p>
> >
> > ! <p>
> > ! Example:
> > ! </p>
> >
> > ! <pre>
> > ! <a href="postconf.5.html#swap_bangpath">swap_bangpath</a> = no
> > ! </pre>
> >
> > ***************
> > *** 15966,15975 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_exclude_ciphers">tlsproxy_tls_exclude_ciphers</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>)</b></DT><DD>
> >
> > ! <p> List of ciphers or cipher types to exclude from the <a href="tlsproxy.8.html">tlsproxy(8)</a>
> > ! server cipher list at all TLS security levels. See
> > ! <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12632,12648 ----
> >
> > ! <DT><b><a name="syslog_facility">syslog_facility</a>
> > ! (default: mail)</b></DT><DD>
> >
> > ! <p>
> > ! The syslog facility of Postfix logging. Specify a facility as
> > ! defined in syslog.conf(5). The default facility is "mail".
> > ! </p>
> >
> > ! <p>
> > ! Warning: a non-default <a href="postconf.5.html#syslog_facility">syslog_facility</a> setting takes effect only
> > ! after a Postfix process has completed initialization. Errors during
> > ! process initialization will be logged with the default facility.
> > ! Examples are errors while parsing the command line arguments, and
> > ! errors while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
> > ! </p>
> >
> > ***************
> > *** 15978,15988 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_fingerprint_digest">tlsproxy_tls_fingerprint_digest</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>)</b></DT><DD>
> >
> > ! <p> The message digest algorithm to construct remote SMTP
> > ! client-certificate
> > ! fingerprints. See <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> for further details.
> > </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12651,12667 ----
> >
> > ! <DT><b><a name="syslog_name">syslog_name</a>
> > ! (default: postfix)</b></DT><DD>
> >
> > ! <p>
> > ! The mail system name that is prepended to the process name in syslog
> > ! records, so that "smtpd" becomes, for example, "postfix/smtpd".
> > </p>
> >
> > ! <p>
> > ! Warning: a non-default <a href="postconf.5.html#syslog_name">syslog_name</a> setting takes effect only after
> > ! a Postfix process has completed initialization. Errors during
> > ! process initialization will be logged with the default name. Examples
> > ! are errors while parsing the command line arguments, and errors
> > ! while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
> > ! </p>
> >
> > ***************
> > *** 15991,16001 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_key_file">tlsproxy_tls_key_file</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a>)</b></DT><DD>
> >
> > ! <p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server RSA private key in PEM
> > ! format. This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
> > ! server RSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>.
> > ! See <a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12670,12681 ----
> >
> > ! <DT><b><a name="tls_daemon_random_bytes">tls_daemon_random_bytes</a>
> > ! (default: 32)</b></DT><DD>
> >
> > ! <p> The number of pseudo-random bytes that an <a href="smtp.8.html">smtp(8)</a> or <a href="smtpd.8.html">smtpd(8)</a>
> > ! process requests from the <a href="tlsmgr.8.html">tlsmgr(8)</a> server in order to seed its
> > ! internal pseudo random number generator (PRNG). The default of 32
> > ! bytes (equivalent to 256 bits) is sufficient to generate a 128bit
> > ! (or 168bit) session key. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 16004,16014 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_loglevel">tlsproxy_tls_loglevel</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a>)</b></DT><DD>
> >
> > ! <p> Enable additional Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server logging of TLS
> > ! activity. Each logging level also includes the information that
> > ! is logged at a lower logging level. See <a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> for
> > ! further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12684,12696 ----
> >
> > ! <DT><b><a name="tls_export_cipherlist">tls_export_cipherlist</a>
> > ! (default: ALL:+RC4:@STRENGTH)</b></DT><DD>
> >
> > ! <p> The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This
> > ! defines the meaning of the "export" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
> > ! the cipherlist for the opportunistic ("may") TLS client security
> > ! level and is the default cipherlist for the SMTP server. You are
> > ! strongly encouraged to not change this setting. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 16017,16026 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_mandatory_ciphers">tlsproxy_tls_mandatory_ciphers</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>)</b></DT><DD>
> >
> > ! <p> The minimum TLS cipher grade that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
> > ! will use with mandatory TLS encryption. See <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>
> > ! for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12699,12709 ----
> >
> > ! <DT><b><a name="tls_high_cipherlist">tls_high_cipherlist</a>
> > ! (default: ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH)</b></DT><DD>
> >
> > ! <p> The OpenSSL cipherlist for "HIGH" grade ciphers. This defines
> > ! the meaning of the "high" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
> > ! strongly encouraged to not change this setting. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 16029,16038 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_mandatory_exclude_ciphers">tlsproxy_tls_mandatory_exclude_ciphers</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>)</b></DT><DD>
> >
> > ! <p> Additional list of ciphers or cipher types to exclude from the
> > ! <a href="tlsproxy.8.html">tlsproxy(8)</a> server cipher list at mandatory TLS security levels.
> > ! See <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12712,12722 ----
> >
> > ! <DT><b><a name="tls_low_cipherlist">tls_low_cipherlist</a>
> > ! (default: ALL:!EXPORT:+RC4:@STRENGTH)</b></DT><DD>
> >
> > ! <p> The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines
> > ! the meaning of the "low" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
> > ! strongly encouraged to not change this setting. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 16041,16051 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_mandatory_protocols">tlsproxy_tls_mandatory_protocols</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>)</b></DT><DD>
> >
> > ! <p> The SSL/TLS protocols accepted by the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
> > ! with mandatory TLS encryption. If the list is empty, the server
> > ! supports all available SSL/TLS protocol versions. See
> > ! <a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12725,12738 ----
> >
> > ! <DT><b><a name="tls_medium_cipherlist">tls_medium_cipherlist</a>
> > ! (default: ALL:!EXPORT:!LOW:+RC4:@STRENGTH)</b></DT><DD>
> >
> > ! <p> The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This
> > ! defines the meaning of the "medium" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
> > ! <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
> > ! the default cipherlist for mandatory TLS encryption in the TLS
> > ! client (with anonymous ciphers disabled when verifying server
> > ! certificates). You are strongly encouraged to not change this
> > ! setting. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 16054,16063 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_protocols">tlsproxy_tls_protocols</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a>)</b></DT><DD>
> >
> > ! <p> List of TLS protocols that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server will
> > ! exclude or include with opportunistic TLS encryption. See
> > ! <a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12741,12752 ----
> >
> > ! <DT><b><a name="tls_null_cipherlist">tls_null_cipherlist</a>
> > ! (default: eNULL:!aNULL)</b></DT><DD>
> >
> > ! <p> The OpenSSL cipherlist for "NULL" grade ciphers that provide
> > ! authentication without encryption. This defines the meaning of the "null"
> > ! setting in smtpd_mandatory_tls_ciphers, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
> > ! <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are strongly encouraged to not
> > ! change this setting. </p>
> >
> > ! <p> This feature is available in Postfix 2.3 and later. </p>
> >
> > ***************
> > *** 16066,16075 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_req_ccert">tlsproxy_tls_req_ccert</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>)</b></DT><DD>
> >
> > ! <p> With mandatory TLS encryption, require a trusted remote SMTP
> > ! client certificate in order to allow TLS connections to proceed.
> > ! See <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12755,12766 ----
> >
> > ! <DT><b><a name="tls_random_bytes">tls_random_bytes</a>
> > ! (default: 32)</b></DT><DD>
> >
> > ! <p> The number of bytes that <a href="tlsmgr.8.html">tlsmgr(8)</a> reads from $<a href="postconf.5.html#tls_random_source">tls_random_source</a>
> > ! when (re)seeding the in-memory pseudo random number generator (PRNG)
> > ! pool. The default of 32 bytes (256 bits) is good enough for 128bit
> > ! symmetric keys. If using EGD or a device file, a maximum of 255
> > ! bytes is read. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 16078,16088 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_security_level">tlsproxy_tls_security_level</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b></DT><DD>
> >
> > ! <p> The SMTP TLS security level for the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server;
> > ! when a non-empty value is specified, this overrides the obsolete
> > ! parameters <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. See
> > ! <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12769,12785 ----
> >
> > ! <DT><b><a name="tls_random_exchange_name">tls_random_exchange_name</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> > !
> > ! <p> Name of the pseudo random number generator (PRNG) state file
> > ! that is maintained by <a href="tlsmgr.8.html">tlsmgr(8)</a>. The file is created when it does
> > ! not exist, and its length is fixed at 1024 bytes. </p>
> >
> > ! <p> As of version 2.5, Postfix no longer uses root privileges when
> > ! opening this file, and the default file location was changed from
> > ! ${<a href="postconf.5.html#config_directory">config_directory</a>}/prng_exch to ${<a href="postconf.5.html#data_directory">data_directory</a>}/prng_exch. As
> > ! a migration aid, an attempt to open the file under a non-Postfix
> > ! directory is redirected to the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>, and a
> > ! warning is logged. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 16091,16101 ****
> >
> > ! <DT><b><a name="tlsproxy_tls_session_cache_timeout">tlsproxy_tls_session_cache_timeout</a>
> > ! (default: $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>)</b></DT><DD>
> >
> > ! <p> The expiration time of Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server TLS session
> > ! cache information. A cache cleanup is performed periodically every
> > ! $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> seconds. See
> > ! <a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12788,12797 ----
> >
> > ! <DT><b><a name="tls_random_prng_update_period">tls_random_prng_update_period</a>
> > ! (default: 3600s)</b></DT><DD>
> >
> > ! <p> The time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to save the state of
> > ! the pseudo random number generator (PRNG) to the file specified
> > ! with $<a href="postconf.5.html#tls_random_exchange_name">tls_random_exchange_name</a>. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 16104,16113 ****
> >
> > ! <DT><b><a name="tlsproxy_use_tls">tlsproxy_use_tls</a>
> > ! (default: $<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b></DT><DD>
> >
> > ! <p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
> > ! but do not require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>
> > ! for further details. </p>
> >
> > ! <p> This feature is available in Postfix 2.8 and later. </p>
> >
> > --- 12800,12810 ----
> >
> > ! <DT><b><a name="tls_random_reseed_period">tls_random_reseed_period</a>
> > ! (default: 3600s)</b></DT><DD>
> >
> > ! <p> The maximal time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to re-seed the
> > ! in-memory pseudo random number generator (PRNG) pool from external
> > ! sources. The actual time between re-seeding attempts is calculated
> > ! using the PRNG, and is between 0 and the time specified. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 16116,16132 ****
> >
> > ! <DT><b><a name="tlsproxy_watchdog_timeout">tlsproxy_watchdog_timeout</a>
> > ! (default: 10s)</b></DT><DD>
> >
> > ! <p> How much time a <a href="tlsproxy.8.html">tlsproxy(8)</a> process may take to process local
> > ! or remote I/O before it is terminated by a built-in watchdog timer.
> > ! This is a safety mechanism that prevents <a href="tlsproxy.8.html">tlsproxy(8)</a> from becoming
> > ! non-responsive due to a bug in Postfix itself or in system software.
> > ! To avoid false alarms and unnecessary cache corruption this limit
> > ! cannot be set under 10s. </p>
> >
> > ! <p> Specify a non-zero time value (an integral value plus an optional
> > ! one-letter suffix that specifies the time unit). Time units: s
> > ! (seconds), m (minutes), h (hours), d (days), w (weeks). </p>
> >
> > ! <p> This feature is available in Postfix 2.8. </p>
> >
> > --- 12813,12828 ----
> >
> > ! <DT><b><a name="tls_random_source">tls_random_source</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > ! <p> The external entropy source for the in-memory <a href="tlsmgr.8.html">tlsmgr(8)</a> pseudo
> > ! random number generator (PRNG) pool. Be sure to specify a non-blocking
> > ! source. If this source is not a regular file, the entropy source
> > ! type must be prepended: egd:/path/to/egd_socket for a source with
> > ! EGD compatible socket interface, or dev:/path/to/device for a
> > ! device file. </p>
> >
> > ! <p> Note: on OpenBSD systems specify /dev/arandom when /dev/urandom
> > ! gives timeout errors. </p>
> >
> > ! <p> This feature is available in Postfix 2.2 and later. </p>
> >
> > ***************
> > *** 16159,16166 ****
> >
> > - <p> Note: <a href="postconf.5.html#transport_delivery_slot_cost"><i>transport</i>_delivery_slot_cost</a> parameters will not
> > - show up in "postconf" command output before Postfix version 2.9.
> > - This limitation applies to many parameters whose name is a combination
> > - of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
> > - "_delivery_slot_cost"). </p>
> > -
> >
> > --- 12855,12856 ----
> > ***************
> > *** 16175,16182 ****
> >
> > - <p> Note: <a href="postconf.5.html#transport_delivery_slot_discount"><i>transport</i>_delivery_slot_discount</a> parameters will
> > - not show up in "postconf" command output before Postfix version
> > - 2.9. This limitation applies to many parameters whose name is a
> > - combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
> > - this case: "_delivery_slot_discount"). </p>
> > -
> >
> > --- 12865,12866 ----
> > ***************
> > *** 16191,16198 ****
> >
> > - <p> Note: <a href="postconf.5.html#transport_delivery_slot_loan"><i>transport</i>_delivery_slot_loan</a> parameters will not
> > - show up in "postconf" command output before Postfix version 2.9.
> > - This limitation applies to many parameters whose name is a combination
> > - of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
> > - "_delivery_slot_loan"). </p>
> > -
> >
> > --- 12875,12876 ----
> > ***************
> > *** 16208,16216 ****
> >
> > - <p> Note: some <a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a>
> > - parameters will not show up in "postconf" command output before
> > - Postfix version 2.9. This limitation applies to many parameters
> > - whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
> > - built-in suffix (in this case:
> > - "_destination_concurrency_failed_cohort_limit"). </p>
> > -
> > <p> This feature is available in Postfix 2.5 and later. </p>
> > --- 12886,12887 ----
> > ***************
> > *** 16228,16236 ****
> >
> > - <p> Note: some <a href="postconf.5.html#transport_destination_concurrency_limit"><i>transport</i>_destination_concurrency_limit</a>
> > - parameters will not show up in "postconf" command output before
> > - Postfix version 2.9. This limitation applies to many parameters
> > - whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
> > - built-in suffix (in this case: "_destination_concurrency_limit").
> > - </p>
> > -
> >
> > --- 12899,12900 ----
> > ***************
> > *** 16246,16254 ****
> >
> > - <p> Note: some <a href="postconf.5.html#transport_destination_concurrency_negative_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
> > - parameters will not show up in "postconf" command output before
> > - Postfix version 2.9. This limitation applies to many parameters
> > - whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
> > - built-in suffix (in this case:
> > - "_destination_concurrency_negative_feedback"). </p>
> > -
> > <p> This feature is available in Postfix 2.5 and later. </p>
> > --- 12910,12911 ----
> > ***************
> > *** 16266,16274 ****
> >
> > - <p> Note: some <a href="postconf.5.html#transport_destination_concurrency_positive_feedback"><i>transport</i>_destination_concurrency_positive_feedback</a>
> > - parameters will not show up in "postconf" command output before
> > - Postfix version 2.9. This limitation applies to many parameters
> > - whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
> > - built-in suffix (in this case:
> > - "_destination_concurrency_positive_feedback"). </p>
> > -
> > <p> This feature is available in Postfix 2.5 and later. </p>
> > --- 12923,12924 ----
> > ***************
> > *** 16285,16292 ****
> >
> > - <p> Note: some <a href="postconf.5.html#transport_destination_rate_delay"><i>transport</i>_destination_rate_delay</a> parameters
> > - will not show up in "postconf" command output before Postfix version
> > - 2.9. This limitation applies to many parameters whose name is a
> > - combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
> > - this case: "_destination_rate_delay"). </p>
> > -
> > <p> This feature is available in Postfix 2.5 and later. </p>
> > --- 12935,12936 ----
> > ***************
> > *** 16304,16311 ****
> >
> > - <p> Note: some <a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> parameters
> > - will not show up in "postconf" command output before Postfix version
> > - 2.9. This limitation applies to many parameters whose name is a
> > - combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
> > - this case: "_destination_recipient_limit"). </p>
> > -
> >
> > --- 12948,12949 ----
> > ***************
> > *** 16320,16327 ****
> >
> > - <p> Note: <a href="postconf.5.html#transport_extra_recipient_limit"><i>transport</i>_extra_recipient_limit</a> parameters will
> > - not show up in "postconf" command output before Postfix version
> > - 2.9. This limitation applies to many parameters whose name is a
> > - combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
> > - this case: "_extra_recipient_limit"). </p>
> > -
> >
> > --- 12958,12959 ----
> > ***************
> > *** 16336,16344 ****
> >
> > - <p> Note: some <a href="postconf.5.html#transport_initial_destination_concurrency"><i>transport</i>_initial_destination_concurrency</a>
> > - parameters will not show up in "postconf" command output before
> > - Postfix version 2.9. This limitation applies to many parameters
> > - whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
> > - built-in suffix (in this case: "_initial_destination_concurrency").
> > - </p>
> > -
> > <p> This feature is available in Postfix 2.5 and later. </p>
> > --- 12968,12969 ----
> > ***************
> > *** 16384,16391 ****
> >
> > - <p> Note: <a href="postconf.5.html#transport_minimum_delivery_slots"><i>transport</i>_minimum_delivery_slots</a> parameters will
> > - not show up in "postconf" command output before Postfix version
> > - 2.9. This limitation applies to many parameters whose name is a
> > - combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
> > - this case: "_minimum_delivery_slots"). </p>
> > -
> >
> > --- 13009,13010 ----
> > ***************
> > *** 16400,16407 ****
> >
> > - <p> Note: some <a href="postconf.5.html#transport_recipient_limit"><i>transport</i>_recipient_limit</a> parameters will not
> > - show up in "postconf" command output before Postfix version 2.9.
> > - This limitation applies to many parameters whose name is a combination
> > - of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
> > - "_recipient_limit"). </p>
> > -
> >
> > --- 13019,13020 ----
> > ***************
> > *** 16416,16423 ****
> >
> > - <p> Note: <a href="postconf.5.html#transport_recipient_refill_delay"><i>transport</i>_recipient_refill_delay</a> parameters will
> > - not show up in "postconf" command output before Postfix version
> > - 2.9. This limitation applies to many parameters whose name is a
> > - combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
> > - this case: "_recipient_refill_delay"). </p>
> > -
> > <p> This feature is available in Postfix 2.4 and later. </p>
> > --- 13029,13030 ----
> > ***************
> > *** 16434,16441 ****
> >
> > - <p> Note: <a href="postconf.5.html#transport_recipient_refill_limit"><i>transport</i>_recipient_refill_limit</a> parameters will
> > - not show up in "postconf" command output before Postfix version
> > - 2.9. This limitation applies to many parameters whose name is a
> > - combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
> > - this case: "_recipient_refill_limit"). </p>
> > -
> > <p> This feature is available in Postfix 2.4 and later. </p>
> > --- 13041,13042 ----
> > ***************
> > *** 16468,16475 ****
> >
> > - <p> Note: <a href="postconf.5.html#transport_time_limit"><i>transport</i>_time_limit</a> parameters will not show up
> > - in "postconf" command output before Postfix version 2.9. This
> > - limitation applies to many parameters whose name is a combination
> > - of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
> > - "_time_limit"). </p>
> > -
> >
> > --- 13069,13070 ----
> > ***************
> > *** 16496,16498 ****
> > <DT><b><a name="undisclosed_recipients_header">undisclosed_recipients_header</a>
> > ! (default: see "postconf -d" output)</b></DT><DD>
> >
> > --- 13091,13093 ----
> > <DT><b><a name="undisclosed_recipients_header">undisclosed_recipients_header</a>
> > ! (default: To: undisclosed-recipients:;)</b></DT><DD>
> >
> > ***************
> > *** 16500,16512 ****
> > Message header that the Postfix <a href="cleanup.8.html">cleanup(8)</a> server inserts when a
> > ! message contains no To: or Cc: message header. With Postfix 2.8
> > ! and later, the default value is empty. With Postfix 2.4-2.7,
> > ! specify an empty value to disable this feature. </p>
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! # Default value before Postfix 2.8.
> > ! # Note: the ":" and ";" are both required.
> > ! <a href="postconf.5.html#undisclosed_recipients_header">undisclosed_recipients_header</a> = To: undisclosed-recipients:;
> > ! </pre>
> >
> > --- 13095,13098 ----
> > Message header that the Postfix <a href="cleanup.8.html">cleanup(8)</a> server inserts when a
> > ! message contains no To: or Cc: message header. With Postfix 2.4
> > ! and later, specify an empty value to disable this feature. </p>
> >
> > ***************
> > *** 16532,16549 ****
> >
> > - <DT><b><a name="unknown_address_tempfail_action">unknown_address_tempfail_action</a>
> > - (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
> > -
> > - <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
> > - or <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a> fail due to a temporary error
> > - condition. Specify "defer" to defer the remote SMTP client request
> > - immediately. With the default "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix
> > - SMTP server continues to look for opportunities to reject mail, and
> > - defers the client request only if it would otherwise be accepted.
> > - </p>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="unknown_client_reject_code">unknown_client_reject_code</a>
> > --- 13118,13119 ----
> > ***************
> > *** 16565,16581 ****
> >
> > - <DT><b><a name="unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a>
> > - (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
> > -
> > - <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>
> > - fails due to an temporary error condition. Specify "defer" to defer
> > - the remote SMTP client request immediately. With the default
> > - "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
> > - for opportunities to reject mail, and defers the client request
> > - only if it would otherwise be accepted. </p>
> > -
> > - <p> This feature is available in Postfix 2.6 and later. </p>
> > -
> > -
> > - </DD>
> > -
> > <DT><b><a name="unknown_hostname_reject_code">unknown_hostname_reject_code</a>
> > --- 13135,13136 ----
> > ***************
> > *** 16648,16650 ****
> > <p>
> > ! The Postfix SMTP server reply code when a recipient address matches
> > $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> specifies a list
> > --- 13203,13205 ----
> > <p>
> > ! The SMTP server reply code when a recipient address matches
> > $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> specifies a list
> > ***************
> > *** 16664,16666 ****
> > <p>
> > ! The Postfix SMTP server reply code when a recipient address matches
> > $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> specifies a list
> > --- 13219,13221 ----
> > <p>
> > ! The SMTP server reply code when a recipient address matches
> > $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> specifies a list
> > ***************
> > *** 16727,16753 ****
> >
> > ! <p> The Postfix SMTP server's reply when rejecting mail with
> > ! <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>. Do not include the numeric SMTP reply
> > ! code or the enhanced status code. By default, the response includes
> > ! actual address verification details.
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#unverified_recipient_reject_reason">unverified_recipient_reject_reason</a> = Recipient address lookup failed
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a>
> > ! (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
> > !
> > ! <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>
> > ! fails due to a temporary error condition. Specify "defer" to defer
> > ! the remote SMTP client request immediately. With the default
> > ! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
> > ! for opportunities to reject mail, and defers the client request
> > ! only if it would otherwise be accepted. </p>
> >
> > --- 13282,13286 ----
> >
> > ! <p> When rejecting mail with <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>, reply
> > ! with this text as the reason, instead of actual address verification
> > ! details.
> >
> > ***************
> > *** 16809,16835 ****
> >
> > ! <p> The Postfix SMTP server's reply when rejecting mail with
> > ! <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>. Do not include the numeric SMTP reply
> > ! code or the enhanced status code. By default, the response includes
> > ! actual address verification details.
> > !
> > ! <p> Example: </p>
> > !
> > ! <pre>
> > ! <a href="postconf.5.html#unverified_sender_reject_reason">unverified_sender_reject_reason</a> = Sender address lookup failed
> > ! </pre>
> > !
> > ! <p> This feature is available in Postfix 2.6 and later. </p>
> > !
> > !
> > ! </DD>
> > !
> > ! <DT><b><a name="unverified_sender_tempfail_action">unverified_sender_tempfail_action</a>
> > ! (default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
> > !
> > ! <p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>
> > ! fails due to a temporary error condition. Specify "defer" to defer
> > ! the remote SMTP client request immediately. With the default
> > ! "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
> > ! for opportunities to reject mail, and defers the client request
> > ! only if it would otherwise be accepted. </p>
> >
> > --- 13342,13346 ----
> >
> > ! <p> When rejecting mail with <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>, reply with
> > ! this text as the reason, instead of actual address verification
> > ! details.
> >
> > ***************
> > *** 17079,17082 ****
> > <p>
> > ! The maximal size in bytes of an individual <a href="virtual.8.html">virtual(8)</a> mailbox or
> > ! maildir file, or zero (no limit). </p>
> >
> > --- 13590,13594 ----
> > <p>
> > ! The maximal size in bytes of an individual mailbox or maildir file,
> > ! or zero (no limit).
> > ! </p>
> >
> > ***************
> > *** 17196,17199 ****
> > is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
> > ! The <i>:nexthop</i> destination is optional; its syntax is documented
> > ! in the manual page of the corresponding delivery agent.
> > </p>
> > --- 13708,13711 ----
> > is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
> > ! The <i>:nexthop</i> part is optional. For more details see the
> > ! <a href="transport.5.html">transport(5)</a> manual page.
> > </p>
> >
> > _______________________________________________
> > postconf-devel mailing list
> > postconf-devel at de.postfix.org
> > http://de.postfix.org/cgi-bin/mailman/listinfo/postconf-devel
>
>
> --
> Werner Detter
> IT-Consulting, IT-Services
>
> Lilienstraße 4 Mobil: +49 151 19640507
> 81669 München Web: http://www.werner-detter.de
>
> Bashian Roulette?
> [ $(($RANDOM%10)) -eq 0 ] && rm -rf /
>
> _______________________________________________
> postconf-devel mailing list
> postconf-devel at de.postfix.org
> http://de.postfix.org/cgi-bin/mailman/listinfo/postconf-devel
--
state of mind ()
http://www.state-of-mind.de
Franziskanerstraße 15 Telefon +49 89 3090 4664
81669 München Telefax +49 89 3090 4666
Amtsgericht München Partnerschaftsregister PR 563
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 316 bytes
Desc: Digital signature
URL: <http://de.postfix.org/pipermail/postconf-devel/attachments/20120318/1eb89be9/attachment-0001.pgp>
More information about the postconf-devel
mailing list